JP6039029B1 - Selection device, selection method, selection program, and authentication processing system - Google Patents

Abstract

A method for flexibly responding to an authentication request.
A selection device according to the present application, which controls an authenticator having a function of authenticating a user's identity, includes a detection unit, a selection unit, and a generation unit. The detection unit detects the usage status of the selection device used by the user. The selection unit selects an authenticator based on the usage status detected by the detection unit. The generation unit is information generated by signing a result of authentication by the authenticator selected by the selection unit with a predetermined key, and is processed by a specific authentication procedure on an authentication server that performs user authentication. The generation of authentication result information, which is information to be processed, is controlled.
[Selection] Figure 1

Description

  The present invention relates to a selection device, a selection method, a selection program, and an authentication processing system.

  In recent years, communication networks have become widespread, and services via networks are actively provided. For example, a user logs in to a service provided via a network using a communication terminal device and uses the service. The user is required to authenticate the user who uses the service when logging in the service or the like.

  As a technique for personal authentication in a network, there is known a technique for automatically selecting an authentication method using a sensor suitable for the environment in which the terminal is installed when the terminal is provided with a plurality of authentication methods ( For example, Patent Document 1).

JP2015-90589A

  However, with the above-described conventional technology, it is difficult to perform personal authentication with excellent convenience. For example, even in an environment where the user can select from a plurality of authentication methods, a complicated procedure such as inputting an answer or inputting biometric information may be required depending on the authentication method.

  The present application has been made in view of the above, and an object of the present invention is to provide a selection device, a selection method, a selection program, and an authentication processing system that can perform user authentication with excellent convenience.

  The selection device according to the present application is a selection device that controls an authenticator having a function of authenticating a user's identity, and includes a detection unit that detects a usage status of the selection device used by the user, and the detection unit Information generated by signing with a predetermined key the authentication unit selected by the selection unit and the authentication result selected by the selection unit based on the usage status detected by the selection unit. The authentication server for authenticating the user includes a generation unit that controls generation of authentication result information that is information processed in a specific authentication procedure.

  According to one aspect of the embodiment, there is an effect that personal authentication with excellent convenience can be performed.

FIG. 1 is a diagram illustrating an example of a selection process according to the embodiment. FIG. 2 is a sequence diagram (1) illustrating the authentication method according to the embodiment. FIG. 3 is a sequence diagram (2) illustrating the authentication method according to the embodiment. FIG. 4 is a diagram illustrating a configuration example of the authentication processing system according to the embodiment. FIG. 5 is a diagram illustrating a configuration example of a user terminal according to the embodiment. FIG. 6 is a diagram illustrating an example of a usage status storage unit according to the embodiment. FIG. 7 is a diagram illustrating an example of the authenticator information storage unit according to the embodiment. FIG. 8 is a diagram illustrating a configuration example of the authentication server according to the embodiment. FIG. 9 is a diagram illustrating an example of a registration information storage unit according to the embodiment. FIG. 10 is a flowchart illustrating an authentication processing procedure according to the embodiment. FIG. 11 is a sequence diagram illustrating an authentication processing procedure according to the embodiment. FIG. 12 is a hardware configuration diagram illustrating an example of a computer that realizes the function of the user terminal.

  Hereinafter, embodiments for implementing a selection device, a selection method, a selection program, and an authentication processing system according to the present application (hereinafter referred to as “embodiments”) will be described in detail with reference to the drawings. Note that the selection device, the selection method, the selection program, and the authentication processing system according to the present application are not limited by this embodiment. In addition, the embodiments can be appropriately combined within a range that does not contradict processing contents. In the following embodiments, the same portions are denoted by the same reference numerals, and redundant description is omitted.

[1. Example of authentication process)
First, an example of the authentication process according to the embodiment will be described with reference to FIG. FIG. 1 shows an example in which an authentication process for authenticating the identity of the user U01 is performed by the user terminal 10 corresponding to the selection device according to the present application and the authentication server 100.

  FIG. 1 is a diagram illustrating an example of authentication processing according to the embodiment. In the example of FIG. 1, the user terminal 10 is an information processing terminal used by a user U01. The user U01 uses the user terminal 10 to use a service provided via a network, for example, a service provided from a web server. In FIG. 1, the user terminal 10 is, for example, a smartphone. In the following description, the user terminal 10 may be referred to as a user U01. That is, in the following, the user U01 can be read as the user terminal 10.

  The authentication server 100 is a server device that acquires information transmitted from the user terminal 10 and authenticates the user U01 based on the acquired information. The information acquired by the authentication server 100 is information indicating that the user terminal 10 proves that the user using the user terminal 10 is the user U01 himself using, for example, a biometric authentication device. The authentication server 100 processes the acquired information according to a specific authentication processing procedure to authenticate the identity of the user U01 and to indicate that it has been authenticated (hereinafter referred to as “authenticated information”). Is generated. The user terminal 10 transmits the authenticated information generated by the authentication server 100 to various services (such as a web server), thereby logging in various services, using a service ID issued for each service, It is possible to use a service that requires personal authentication, such as payment via the Internet.

(About the authentication method of the authentication server 100)
Here, prior to the description of the authentication processing realized in the present application, the identity of the user using the authentication server 100 using a predetermined information processing terminal (hereinafter referred to as “client 20” for distinction from the user terminal 10). A method for performing authentication will be described with reference to FIGS. Note that the client 20 is assumed to be a terminal that satisfies a function required from the authentication server 100 side in communication related to authentication processing performed by the authentication server 100.

  The authentication server 100 adopts an authentication method based on a so-called public key cryptosystem that ensures the certainty of information by verifying a public key and a secret key issued in advance in the authentication of the client 20. That is, the authentication server 100 performs authentication based on a public / private key pair issued to each authenticator included in the client 20. The authenticator refers to a function (or a device having the function) for the client 20 to perform personal authentication locally. Local authentication refers to authentication performed in a situation where connection to a wide area network (external network) such as the Internet is not required, for example, authentication performed using a function provided in the client 20. The authenticator accepts registration in advance for information that can authenticate the user himself / herself, such as the user's biometric information. And at the time of authentication, the authenticator accepts input of biometric information and the like from the user, and authenticates the person based on the collation result between the registered data and the input data. Specifically, the authenticator includes a fingerprint authenticator, an iris authenticator, a voiceprint authenticator, and the like. The authenticator may be realized by software installed in the client 20 or may be realized by hardware existing within a range connected to the client 20 via a LAN (Local Area Network). That is, the authenticator includes hardware that cooperates with the client 20 by being directly connected to an interface provided in the client 20, for example, without going through an external network such as the Internet. Thus, the authenticator can be read as an authentication function that functions on the client 20 side, or an authentication means.

  First, a procedure in which the authentication server 100 registers the client 20 as an authentication target will be described. FIG. 2 is a sequence diagram (1) illustrating the authentication method according to the embodiment. FIG. 2 shows a flow of processing for registering the client 20 to be authenticated by the authentication server 100 prior to the authentication processing.

  The client 20 accesses the authentication server 100 and requests registration of the authenticator (step S11). In response to the request transmitted from the client 20, the authentication server 100 requests authentication by the authenticator (step S12).

  The user who uses the client 20 operates the authenticator that requested registration to the authentication server 100, and executes authentication by the authenticator locally (step S13). For example, when a user selects a fingerprint authentication device as an authentication device used for authentication, the user performs authentication processing by holding a finger over a location where authentication is performed. If the authentication device on the client 20 side can confirm the user as a legitimate user by comparing the registration data in the authentication device with the input data, the authentication device issues a public key and a private key corresponding to the authentication processing. (Step S14). Then, the client 20 stores the issued secret key in the client 20 and transmits a public key paired with the secret key to the authentication server 100 (step S15). The authentication server 100 receives the public key from the client 20, and stores the public key in association with the authenticator (step S16). In principle, the secret key in the client 20 is stored in an area where access is not accepted, and access is not permitted unless local authentication by the registered authenticator succeeds. As a result, registration of the authenticator included in the client 20 to the authentication server 100 is completed.

  Next, FIG. 3 will be described. FIG. 3 is a sequence diagram (2) illustrating the authentication method according to the embodiment. FIG. 3 shows the flow of processing in a scene where the authentication is actually requested from the authentication server 100 such as when the client 20 uses the service.

  The client 20 requests the authentication server 100 to access a predetermined access restricted service (step S21). Such a request may be transmitted via, for example, a web server that provides a service via a network. That is, the user may be required to authenticate himself / herself from the connected web server in the process of using the service. In this case, when the user declares that the user authentication is to be performed, the information is transmitted from the client 20 or the connection destination web server to the authentication server 100.

  The authentication server 100 that has received the request requests the client 20 to perform authentication using a pre-registered authenticator (step S22). The user of the client 20 that has received the request executes local authentication using a pre-registered authenticator (step S23).

  When the authentication by the authenticator is successful, that is, when the personal authentication is confirmed locally, the user can access the secret key stored in the client 20. Then, the client 20 generates a signature (hash value) for information related to the authentication result, using a secret key that can be accessed only by a user who is recognized as an authorized user by the authenticator. In other words, the client 20 generates signed information with a secret key that has been issued in advance (step S24). Information generated in this way is referred to as “authentication result information”.

  Subsequently, the client 20 transmits the generated authentication result information using a specific authentication procedure (details will be described later) defined with the authentication server 100 (step S25). The authentication server 100 verifies the signature attached to the transmitted authentication result information using the public key paired with the secret key (step S26). That is, the authentication server 100 verifies that the authentication result information is not falsified, in other words, whether the authentication result information is generated with an appropriate secret key. In this way, the authentication server 100 confirms that the authenticator to be authenticated has an appropriate secret key. If this confirmation can be made, the authentication server 100 authenticates that the user who uses the client 20 is a legitimate user based on the authentication result information. Then, the authentication server 100 indicates that it has been authenticated, and transmits to the client 20 information indicating that authentication has been performed, including information on the service requested for access in step S21 (step S27). The information indicating that the authentication has been performed is, for example, an authentication cookie.

  As described above, according to the authentication method, the client 20 does not transmit information used for authentication itself such as a password and a service ID, which are often used for general authentication, to the network. That is, the information transmitted from the client 20 is only information indicating a local authentication result, and even if a third party intercepts the information transmitted from the client 20, the third party uses the intercepted information. I can't. Therefore, it can be said that the authentication method employed by the authentication server 100 is a highly secure method. Further, according to the authentication method employed by the authentication server 100, the user does not need to memorize the password, so the burden on the user can be reduced.

  Furthermore, as described above, the authentication server 100 uses a specific authentication procedure defined with the client 20 in the processing of the authentication result information transmitted from the client 20. The specific authentication procedure is an authentication procedure defined between the authentication server 100 and the client 20, and can be read as a protocol related to communication. For example, the authentication server 100 uses a protocol such as UAF (Universal Authentication Framework) or U2F (Universal Second Factor). Thereby, the communication between the authentication server 100 and the client 20 is ensured with higher security.

  As described with reference to FIG. 2 and FIG. 3, when communication is established between the authentication server 100 and the authenticator of the client 20 using an authentication method based on a public key encryption method using a specific protocol. The client 20 can authenticate the authentication server 100 without transmitting authentication information such as a password to the network.

  However, in the above-described method, when a plurality of authentication devices are registered in the authentication server 100, the user needs to select an authentication device to be used from the plurality of authentication devices every time local authentication is performed. . In addition, after selecting the authenticator, the user is prompted to input fingerprint data in order to use the fingerprint authenticator, and to input iris data (e.g., photographing an iris with a camera) in order to use the iris authenticator. ), It takes time. As described above, the client 20 side that communicates with the authentication server 100 is required to perform complicated processing such as selecting a plurality of authenticators in order to realize highly secure authentication processing using the authentication server 100. There are challenges.

  Therefore, the user terminal 10 corresponding to the selection device according to the present application reduces the troublesome time for local authentication processing by performing user authentication of the user U01 based on the environment where the user U01 and the user terminal 10 are placed. Let Hereinafter, returning to the description of FIG. 1, an example of authentication processing by the user terminal 10 will be described along the flow.

(Processing by the user terminal 10)
In the example illustrated in FIG. 1, it is assumed that the user U01 desires an authentication process by the authentication server 100 in order to use a predetermined access-restricted service, for example. As described above, when receiving authentication by the authentication server 100, the user U01 needs to register an authenticator capable of performing personal authentication locally in the authentication server 100. Here, it is assumed that the user U01 registers the fingerprint authenticator 163A, the iris authenticator 163B, and the voiceprint authenticator 163C with the authentication server 100 as authenticators for authenticating the user U01. In the example illustrated in FIG. 1, each authenticator is an authentication function realized in the user terminal 10, and is realized by, for example, an application (application) installed in the user terminal 10.

  In the example illustrated in FIG. 1, it is assumed that the user U01 requests to use a service provided by a web server, for example (step S01). Note that this service has an access restriction that restricts some services when the personal authentication is not performed. In addition, the service use request to the authentication server 100 may be transmitted to the authentication server 100 not via the user terminal 10 but via a web server that provides the service.

  The authentication server 100 requests the user terminal 10 to authenticate the user (step S02). For example, the authentication server 100 requests the user terminal 10 to authenticate the user in response to a request from the web server when the web server requests user authentication of the user U01 when the user U01 uses a predetermined web service. I do. In this case, the authentication server 100 requests the user terminal 10 to authenticate with any one of the previously registered authenticators.

  In response to a request from the authentication server 100, the user terminal 10 operates an authenticator for authenticating the user U01. That is, it is assumed that the user terminal 10 causes any one of the authenticators registered in the authentication server 100 to function and perform authentication.

  Here, the user terminal 10 detects the usage status of its own device when authentication is requested. Specifically, the user terminal 10 detects the state of operation by the user U01 when authentication is requested (step S03). For example, when authentication is requested, the user terminal 10 detects that the user U01 is touching the user terminal 10 (step S04). Note that the user terminal 10 may detect an operation other than the touch operation performed by the user U01. For example, the user terminal 10 may detect that the user U01 is taking a picture using the user terminal 10 (step S05) or is making a call (step S06).

  Then, the user terminal 10 selects an authenticator based on the usage status detected when authentication is requested (step S07). For example, when a touch operation is performed by the user (in the case of step S04), the user terminal 10 selects the fingerprint authenticator 163A that authenticates the person using the fingerprint as input data. Alternatively, the user terminal 10 selects the iris authenticator 163B that authenticates the person using the iris as input data when the user has taken a picture (in the case of step S05). Alternatively, when a call is made by the user (in the case of step S06), the user terminal 10 selects the voiceprint authenticator 163C that authenticates the person using voice as input data. In this way, the user terminal 10 detects the usage status at the time of authentication at the user terminal 10 and operates the authenticator related to the operation that the user U01 is currently performing on the user terminal 10. In other words, the user terminal 10 selects an authenticator that is assumed to be less burdensome for the user U01 due to the authentication process.

  Then, the user terminal 10 performs authentication using the selected authenticator and the authenticator registered in the authentication server 100 (step S08). When the authentication is successful, that is, when the authenticator authenticates the user U01, the user terminal 10 can access the secret key held in the user terminal 10. Then, the user terminal 10 attaches a signature (hash value) to the result of authentication by the authenticator using a secret key, and generates authentication result information. Then, the user terminal 10 transmits the authentication result information signed with the secret key to the authentication server 100 (step S09).

  The authentication server 100 analyzes the received authentication result information. Specifically, the authentication server 100 verifies the reliability of the authentication result information using the public key that is paired with the secret key used at the transmission source (step S10).

  In other words, the authentication server 100 verifies whether or not the authentication result information to be verified is information signed with a secret key issued by a registered authenticator using a public key. If the authentication server 100 can verify that the authentication result information has not been falsified, that is, the authentication result information has been generated with an appropriate secret key, the user of the user terminal 10 can confirm that the user of the user terminal 10 It authenticates that it is U01. In this case, the authentication server 100 issues authenticated information indicating that it has been authenticated, and transmits the authenticated information to the user terminal 10 or the service side to which the user terminal 10 is to access. As a result, the user U01 can use a desired service.

  As described above, the user terminal 10 detects the usage status of the user terminal 10 and selects an authentication function (that is, an authenticator) that authenticates the user's identity based on the detected usage status. Then, the user terminal 10 generates authentication result information processed by the authentication server 100 based on the authentication result.

  That is, according to the user terminal 10, by detecting the usage status for the user terminal 10, it is possible to select an authenticator that is easy for the user U01 to use at the time when the authentication process is performed, from among a plurality of authenticators. For this reason, the authentication process can be performed for the user U01 in a natural operation using the user terminal 10. For example, the user terminal 10 can perform an authentication process without interfering with the touch operation of the user U01 by operating the fingerprint authenticator 163A while the user U01 is operating an application or the like that performs a touch operation on the screen. it can. Further, as described above, in the authentication performed by the user terminal 10 locally, only the result of the authentication is transmitted to the authentication server 100, so that it is possible to prevent information that identifies the user himself / herself on the wide area network. In this way, the user terminal 10 can realize a highly convenient authentication process for the user U01 while ensuring safety.

  In the example of FIG. 1, the user terminal 10 selects the authenticator based on the usage situation such as the operation of the user U01 when the local authentication process is performed. However, the user terminal 10 may select an optimal authenticator based on the usage status log (usage history) recorded before the authentication process is performed and the context (context) in the user terminal 10. Good.

[2. Configuration of authentication processing system]
Next, the configuration of the authentication processing system 1 including the user terminal 10 that is the selection device according to the embodiment will be described with reference to FIG. FIG. 4 is a diagram illustrating a configuration example of the authentication processing system 1 according to the embodiment. As illustrated in FIG. 4, the authentication processing system 1 according to the embodiment includes a user terminal 10, an authentication server 100, and a web server 200. These various devices are communicably connected via a network N by wire or wireless.

  The user terminal 10 is an information processing terminal such as a desktop PC (Personal Computer), a notebook PC, a tablet terminal, a mobile phone including a smartphone, or a PDA (Personal Digital Assistant). The user terminal 10 also includes a wearable device that is a glasses-type or clock-type information processing terminal. Furthermore, the user terminal 10 may include various smart devices having an information processing function. For example, the user terminal 10 may include a smart home appliance such as a TV (television), a refrigerator, and a vacuum cleaner, a smart vehicle such as an automobile, a drone, and a home robot.

  The user terminal 10 includes an authenticator. For example, when the user terminal 10 is a smartphone, the authenticator is realized by an application installed on the smartphone. Note that the authentication device may be an independent device, for example, a fingerprint authentication device connected to a USB interface of a notebook PC.

  As described above, the authentication server 100 is a server device that authenticates the user who uses the user terminal 10. The authentication server 100 receives the authentication result information transmitted from the user terminal 10 and verifies the signature using the public key corresponding to the private key that signed the authentication result information. When the verification of the signature by the authentication server 100 is performed, the user terminal 10 is handled as having been authenticated by the authentication server 100. Thereby, the user terminal 10 can use a limited service provided by the web server 200 or the like.

  The web server 200 is a server device that provides various web pages when accessed from the user terminal 10. The web server 200 provides various web pages related to, for example, a news site, a weather forecast site, a shopping site, a finance (stock price) site, a route search site, a map providing site, a travel site, a restaurant introduction site, and a web blog.

  The web server 200 may request user authentication for providing a service. For example, when the web server 200 provides a payment service, if the user using the user terminal 10 cannot be authenticated as the user U01, the web server 200 executes the payment service by the user terminal 10. Can be limited. On the other hand, when the web server 200 receives information indicating that the authentication server 100 has authenticated the user U01 from the user terminal 10 or the authentication server 100, the user using the user terminal 10 is the user U01. Trust that there is. In this case, the web server 200 can also accept operations that are not permitted unless after personal authentication, such as payment by the user terminal 10.

[3. Configuration of user terminal]
Next, the configuration of the user terminal 10 according to the embodiment will be described with reference to FIG. FIG. 5 is a diagram illustrating a configuration example of the user terminal 10 according to the embodiment. As illustrated in FIG. 5, the user terminal 10 includes a communication unit 11, an input unit 12, a display unit 13, a detection unit 14, a storage unit 15, and a control unit 16. Note that the connection relationship between the processing units included in the user terminal 10 is not limited to the connection relationship illustrated in FIG. 5, and may be another connection relationship.

(About the communication unit 11)
The communication unit 11 is connected to the network N by wire or wireless, and transmits / receives information to / from the authentication server 100, the web server 200, and the like. For example, the communication unit 11 is realized by a NIC (Network Interface Card) or the like.

(About the input unit 12)
The input unit 12 is an input device that receives various operations from the user. For example, the input unit 12 is realized by an operation key or the like provided in the user terminal 10. The input unit 12 may include an imaging device (such as a camera) for capturing an image and a sound collection device (such as a microphone) that collects sound.

(About display unit 13)
The display unit 13 is a display device for displaying various information. For example, the display unit 13 is realized by a liquid crystal display or the like. In addition, when a touch panel is employ | adopted for the user terminal 10, a part of input part 12 and the display part 13 are integrated.

(About the detector 14)
The detection unit 14 detects the usage status in the user terminal 10. Specifically, the detection unit 14 determines the operation of the user U01 with respect to the user terminal 10, the location information of the user terminal 10, the information related to the device connected to the user terminal 10, the environment in the user terminal 10, and the like. Detect. In the example illustrated in FIG. 5, the detection unit 14 includes an operation detection unit 141, a position detection unit 142, an external device detection unit 143, and an environment detection unit 144.

(About the operation detection unit 141)
The operation detection unit 141 detects an operation of the user U01 on the user terminal 10. For example, the operation detection unit 141 detects an operation of the user U01 based on information input to the input unit 12. That is, the operation detection unit 141 detects an input of an operation for touching the screen to the input unit 12, an input of a voice, or the like. In addition, the operation detection unit 141 may detect that a predetermined application has been activated by the user U01. When the application is an application that operates the imaging device in the user terminal 10, the operation detection unit 141 detects that the imaging function is used by the user U01. Further, the operation detection unit 141 may detect an operation in which the user terminal 10 itself is moved based on data detected by an acceleration sensor, a gyro sensor, or the like provided in the user terminal 10.

(About the position detection unit 142)
The position detection unit 142 detects the current position of the user terminal 10. Specifically, the position detection unit 142 receives radio waves transmitted from GPS satellites, and acquires position information (for example, latitude and longitude) indicating the current position of the user terminal 10 based on the received radio waves.

  The position detection unit 142 can acquire position information by various methods. For example, when the user terminal 10 has a function equivalent to that of a contactless IC card used at a station ticket gate or a store (or the user terminal 10 has a function of reading a history of the contactless IC card) ), The used position is recorded together with the information on the settlement of the boarding fee at the station by the user terminal 10. The position detection unit 142 detects such information and acquires it as position information. Further, the position detection unit 142 may detect position information that can be acquired from an access point when the user terminal 10 communicates with a specific access point. The position information may be acquired by an optical sensor, an infrared sensor, a magnetic sensor, or the like included in the user terminal 10.

(External device detection unit 143)
The external device detection unit 143 detects an external device connected to the user terminal 10. For example, the external device detection unit 143 detects the external device based on the exchange of communication packets with the external device. Then, the external device detection unit 143 recognizes the detected external device as a terminal connected to the user terminal 10. The external device detection unit 143 may detect the type of connection with the external device. For example, the external device detection unit 143 detects whether the external device is connected to the external device by wire or wireless communication. Further, the external device detection unit 143 may detect a communication method used in wireless communication. The external device detection unit 143 may detect the external device based on information acquired by a radio wave sensor that detects a radio wave emitted by the external device, an electromagnetic wave sensor that detects an electromagnetic wave, or the like.

(Regarding the environment detection unit 144)
The environment detection unit 144 detects the environment in the user terminal 10. The environment detection unit 144 uses various sensors and functions provided in the user terminal 10 to detect information about the environment. For example, the environment detection unit 144 is a microphone that collects sounds around the user terminal 10, an illuminance sensor that detects illuminance around the user terminal 10, and an acceleration sensor that detects physical movement of the user terminal 10 (or , A gyro sensor, etc.), a humidity sensor that detects the humidity around the user terminal 10, a geomagnetic sensor that detects a magnetic field at the location of the user terminal 10, and the like. And the environment detection part 144 detects various information using various sensors. For example, the environment detection unit 144 detects the noise level around the user terminal 10 and whether the surroundings of the user terminal 10 have illuminance suitable for imaging the iris of the user U01.

(About the storage unit 15)
The storage unit 15 stores various information. The storage unit 15 is realized by a semiconductor memory device such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk, for example. The storage unit 15 includes a usage status storage unit 151 and an authenticator information storage unit 152.

(About the usage status storage unit 151)
The usage status storage unit 151 stores a usage status log in the user terminal 10. Here, FIG. 6 illustrates an example of the usage status storage unit 151 according to the embodiment. FIG. 6 is a diagram illustrating an example of the usage status storage unit 151 according to the embodiment. In the example illustrated in FIG. 6, the usage status storage unit 151 includes items such as “acquisition date / time”, “operation”, “location information”, “connected device”, and “environment information”.

  “Acquisition date and time” indicates the date and time when the usage status in the user terminal 10 is acquired (detected). Although FIG. 6 shows an example in which the user terminal 10 detects the usage status every hour, the detection timing is not limited to this example. That is, the user terminal 10 may acquire the usage status at an arbitrary timing such as every 10 seconds, every 1 minute, or every 3 minutes. In addition, the log stored in the usage status storage unit 151 may not be a log at the moment of acquisition date, but may be data that accumulates operations, environments, and the like of the user terminal 10 for several minutes, for example. In addition, the user terminal 10 is not limited to the timing at every predetermined time, and for example, the user terminal 10 may acquire the usage status triggered by detecting predetermined information. For example, the user terminal 10 may acquire the usage status when a known SSID (Service Set Identifier) is detected in the communication status. Thereby, the user terminal 10 can efficiently acquire information handled in the authentication process.

  “Operation” indicates a main operation among operations on the user terminal 10 at the acquisition date and time. Here, the main operation refers to the content that the user U01 has actively operated on the user terminal 10. The operation is detected by, for example, the operation detection unit 141. Further, the operation may be determined by, for example, an application activated by the user U01. For example, when the user U01 activates a web browser application, “touch operation” is stored in the operation item. Further, for example, when the user U01 activates a shooting application, “shooting operation” is stored in the operation item. Further, for example, when the user U01 activates a call application, an input application using voice recognition, or the like, “voice operation” is stored in the operation item. The operation may be extracted and stored, for example, when the usage status log is acquired. For example, when the usage log is acquired every minute, if both the web browser application and the shooting application are operated within one minute, the operation item includes a longer time. You may memorize | store sequentially from operation corresponding to the operated application.

  “Position information” indicates the position of the user terminal 10. The position information is detected by the position detection unit 142, for example. For example, the position information “G01” indicates that the user terminal 10 is at the home of the user U01. The position information “G02” indicates a predetermined position of the user terminal 10 when the user U01 is moving. Further, the position information “G03” indicates that the user terminal 10 is in the company where the user U01 works. The position information “G04” indicates that the user terminal 10 is in a predetermined public place. FIG. 6 shows an example in which conceptual information such as “G01” is stored in the value indicated by “position information”, but in actuality, “latitude and longitude” or “address ( For example, information indicating “prefectures and municipalities” is stored. For example, information detected by the position detection unit 142 is stored as the position information.

  “Connected device” indicates an external device connected to the user terminal 10. The connected device is detected by the external device detection unit 143, for example. The connected device is an external device that communicates with the user terminal 10. For example, the connected devices include a home router 30, a clock-type terminal 40, and an in-house router 50.

  The “environment information” indicates various data detected by the user terminal 10. The environment information is detected by the environment detection unit 144, for example. FIG. 6 shows an example in which conceptual information such as “E01” is stored in the value indicated by “environment information”, but in actuality, information detected by various sensors related to the environment detection unit 144 is stored. The For example, a numerical value indicating the loudness detected by the user terminal 10, a numerical value indicating illuminance, a numerical value indicating the inclination and acceleration of the user terminal 10, and the like are appropriately stored as the environmental information.

  That is, in FIG. 6, as the usage status of the user terminal 10 at “October 1, 2015 8:00”, the main operation performed on the user terminal 10 is “voice operation”, and the position information is “ An example is shown in which a log “G01”, the connected devices are “home router 30” and “clock type terminal 40”, and the environment information is “E01” is acquired.

(About authenticator information storage unit 152)
Next, the authentication device information storage unit 152 will be described. The authenticator information storage unit 152 stores information related to the authenticator. FIG. 7 is a diagram illustrating an example of the authentication device information storage unit 152 according to the embodiment. In the example illustrated in FIG. 7, the authenticator information storage unit 152 includes items such as “authenticator ID”, “type”, “authenticated user”, “secret key”, and “selection condition”.

  “Authenticator ID” indicates identification information for identifying an authenticator. In the embodiment, it is assumed that the authentication device ID matches the reference code of the authentication device. For example, the authentication device indicated by the authentication device ID “163A” indicates the fingerprint authentication device 163A.

  “Type” indicates the type of authentication method performed by the authenticator. For example, types include fingerprints, irises, and voiceprints. Note that the authentication method of the authenticator is not limited to the above. For example, the authentication device may be a face authentication device that performs authentication using image data of the user's face, or a biometric information authentication device that detects a user's heartbeat or the like by a sensor. Further, the authentication method of the authenticator is not limited to the authentication method using biometric information. For example, the authenticator may be a hardware authenticator that performs authentication by connecting a predetermined physical key owned by the user U1 to the user terminal 10, or a SIM card (Subscriber Identity) built in the user terminal 10. A SIM card authenticator that performs authentication by determining the contents of the Module Card) may be used. Further, the authenticator may be a method for performing authentication by inputting predetermined information such as a password.

  “Authenticated user” indicates a user authenticated by the authenticator. The “secret key” indicates a key for signing the authentication result of the authenticator and generating authentication result information. The secret key and the public key to be paired are issued when the authenticator is registered in the authentication server 100. The secret key is held in the user terminal 10. The public key is transmitted to the authentication server 100 by the user terminal 10. The secret key is held in an area that cannot be accessed unless the user is successfully authenticated by the corresponding authenticator.

  “Selection condition” indicates a condition for selecting an authenticator. The selection condition is indicated by the usage status for the user terminal 10. For example, as shown in FIG. 7, the selection condition is indicated by the type of operation such as a touch operation, a shooting operation, and a voice operation, and environmental information around the user terminal 10 such as illuminance and noise level. In this case, an appropriate value may be appropriately set as the threshold value that is the condition of the illuminance and the noise level, for example, depending on the performance of the authenticator. For example, the threshold value that is the condition of the illuminance and the noise level is such that the illuminance value by which the iris authenticator 163B can authenticate the captured iris and the voiceprint authenticator 163C recognize the voice input from the user U01. A possible noise level value is set. The selection condition may be indicated by the context of the user terminal 10 including environment information such as a connection status with an external device and position information of the user terminal 10. In addition, the selection condition may be set in advance by the user U01 using the user terminal 10, or may be automatically set through predetermined learning. That is, the user terminal 10 learns what authenticator is used by the user U01 in which context. Then, the user terminal 10 may automatically store the context in which the authenticator is used as a selection condition.

  That is, in FIG. 7, the authentication device (fingerprint authentication device 163A) identified by the authentication device ID “163A” has the authentication type “fingerprint”, the user to be authenticated is “user U01”, and the private key is An example in which “K01” and the condition for selecting the fingerprint authenticator 163A is “touch operation” is shown.

(About the control unit 16)
For example, the control unit 16 executes various programs stored in a storage device inside the user terminal 10 using a RAM (Random Access Memory) as a work area by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like. It is realized by doing. Moreover, the control part 16 is implement | achieved by integrated circuits, such as ASIC (Application Specific Integrated Circuit) and FPGA (Field Programmable Gate Array), for example.

  The control unit 16 controls various processes such as a local authentication process performed in the user terminal 10, a process for causing the authenticator to function, and transmission / reception of information with the authentication server 100 and the web server 200. As illustrated in FIG. 5, the control unit 16 includes an acquisition unit 161, a selection unit 162, an authentication unit 163, a generation unit 164, and a transmission unit 165, and functions and operations of information processing described below. Realize or execute. For example, the control unit 16 implements various types of information processing by executing the above-described application using the RAM as a work area. The internal configuration of the control unit 16 is not limited to the configuration illustrated in FIG. 5, and may be another configuration as long as the information processing described later is performed.

(About the acquisition unit 161)
The acquisition unit 161 acquires various types of information. For example, the acquisition unit 161 receives information transmitted from the authentication server 100 or the web server 200. In addition, the acquisition unit 161 receives a request for user authentication using the user terminal 10 transmitted from the authentication server 100 or the web server 200. The acquisition unit 161 acquires various types of information detected by the detection unit 14.

(About the selection unit 162)
The selection unit 162 selects an authenticator that performs user authentication. For example, the selection unit 162 selects an authentication device based on the usage status of the user terminal 10 detected by the detection unit 14. Specifically, the selection unit 162 determines whether the operation of the user U01 with respect to the user terminal 10 detected by the detection unit 14 or the environment in the user terminal 10 matches the selection conditions of the authentication device. Select an authenticator that meets the selection conditions.

  When selecting the authentication unit based on the operation of the user U01 with respect to the user terminal 10, the selection unit 162 refers to the type of operation of the user U01 detected by the detection unit 14, and performs authentication corresponding to the type of operation of the user U01. Select an authenticator that uses the method. As an example, when the touch operation by the user U01 is detected, the selection unit 162 selects the fingerprint authenticator 163A that employs fingerprint authentication that is an authentication method corresponding to the touch operation. The association between the authentication device and the type of operation may be set by the user U01, or may be set by the administrator of the authentication server 100, the provider of the authentication device, or the like.

  The selection unit 162 may associate the authentication device with the operation type by learning the operation when the authentication device is operated and the operation type by the user U01. For example, the selection unit 162 acquires a log of operations performed by the user U01 when a predetermined authenticator is operated. Then, the selection unit 162 associates the predetermined authentication device with the operation type based on the operation log acquired when the predetermined authentication device is operated. As an example, when the iris authenticator 163B is operated, the selection unit 162 acquires a log that the user U01 performs an imaging operation with the camera. The selection unit 162 sets that the type of operation corresponding to the iris authenticator 163B is an imaging operation when a certain number or more of such logs are acquired.

  The selection unit 162 may select an authentication device based on various information detected by the detection unit 14 as well as the operation of the user U01. For example, the selection unit 162 is acquired by the position information of the user terminal 10 detected by the detection unit 14, the connection status with a device (external device) that communicates with the user terminal 10, or a sensor used by the user terminal 10. The authenticator may be selected based on at least one of the information.

  For example, the selection unit 162 refers to the user terminal 10 being at home based on the position information G01 of the user terminal 10. And the selection part 162 refers the information of the authenticator mainly used when the user terminal 10 exists in the positional information G01. When the user terminal 10 is in the position information G01 and the request for authentication is acquired from the authentication server 100 or the like when the user terminal 10 is in the position information G01, the selection unit 162 has the user terminal 10 in the position information G01. Select the authentication device that is mainly used for this. Specifically, it is assumed that the user U01 operates the user terminal 10 mainly by voice recognition at home, and operates the user terminal 10 mainly by touch operation when going out. At this time, when the position information of the user terminal 10 is the position information G01, the selection unit 162 preferentially selects the voiceprint authenticator 163C as the authenticator. Thereby, since the selection part 162 can select the authentication device suitable for the place, it can provide the authentication procedure excellent in usability for the user U01.

  In addition, the selection unit 162 refers to a connection status with an external device that communicates with the user terminal 10. Then, the selection unit 162 estimates the context of the user terminal 10 based on the connection status with the external device that communicates with the user terminal 10, and selects an authenticator suitable for the context. For example, when the user terminal 10 is connected to the in-house router 50, it is highly likely that the user terminal 10 is in the office where the user U01 works. At this time, the selection unit 162 preferentially selects an authenticator that can perform authentication without using an imaging operation or a voice operation.

  The selection unit 162 may estimate the context of the user terminal 10 based on information acquired from various sensors used by the user terminal 10 and select an authenticator suitable for the context. For example, when the illuminance around the user terminal 10 is insufficient to capture the iris, the selection unit 162 does not select the iris authenticator 163B and selects an authenticator that employs an authentication method that does not depend on illuminance. To do. Alternatively, when the noise level around the user terminal 10 is so high that it is not suitable for recognizing the voice with the microphone of the user terminal 10, the selection unit 162 does not select the voiceprint authenticator 163C, and depends on the noise level. Select an authenticator that uses no authentication method. In addition, the selection unit 162 determines from the data detected by the detection unit 14 that, for example, the user U01 is moving on a train, is walking, is in a relatively dark place, or is relatively quiet. Various contexts, such as being in, may be inferred. In this case, for example, it is assumed that the detection unit 14 detects various data such as an acceleration sensor, a gyro sensor, and a log of actions observed in the past. Then, the selection unit 162 selects an optimum authenticator based on the context of the user terminal 10 estimated from the data detected by the detection unit 14.

  In the selection process described above, the selection unit 162 may select an authenticator based on the usage status detected in the past by the detection unit 14 and the current usage status detected by the detection unit 14. Good. In other words, when the current usage situation and the past usage situation are similar, the selection unit 162 preferentially selects the same authenticator as that selected in the usage situation of the user terminal 10 observed in the past. select. In this case, the similar usage status refers to a case where the same type of operation on the user terminal 10 is detected, a case where part of the context such as the location information and communication status of the user terminal 10 matches, or the like. .

  Further, the selection unit 162 may select an authenticator according to a request received from the authentication server 100. For example, the selection unit 162 receives information related to authentication that can be accepted by the authentication server 100. In this case, the authentication server 100 specifies an acceptable authenticator by identification information (AAID, Authenticator Attestation ID) regarding the authenticator. Then, the selection unit 162 acquires such information from the authentication server 100, and selects a device having an authenticator that can be accepted by the authentication server 100. Further, for example, when receiving a request for local authentication using an authenticator with a predetermined authentication strength guaranteed from the authentication server 100, the selection unit 162 selects an authenticator with a predetermined authentication strength guaranteed. You may do it. In this case, the predetermined authentication strength is determined in advance by a policy or the like on the authentication server 100 side. That is, the authentication server 100 sets the authentication strength for the authenticator on the local side of the user terminal 10 according to the authentication method or the like. For example, it is assumed that the authentication server 100 assures a high authentication strength for the iris authenticator 163B that uses, as authentication information, iris or the like that is difficult to falsify as an authentication method. When the authentication server 100 requests high authentication strength, the selection unit 162 preferentially selects the iris authenticator 163B.

(About the authentication unit 163)
The authentication unit 163 controls processing related to authentication of the identity of the user U01 who uses the user terminal 10. For example, the authentication unit 163 manages an authenticator included in the user terminal 10. Then, the authentication unit 163 registers information related to the authentication device in the authentication device information storage unit 152.

  In addition, the authentication unit 163 operates the authenticator selected by the selection unit 162 to authenticate the identity of the user U01 who uses the user terminal 10. That is, the authentication unit 163 realizes a function as an authentication device such as the fingerprint authentication device 163A in the embodiment.

  Note that the authentication unit 163 may perform the authentication process by the authenticator in the background without presenting it to the user U01. As described above, the selection unit 162 detects the operation of the user U01 and selects an authenticator according to the operation. Specifically, the selection unit 162 detects the touch operation of the user U01, and selects the fingerprint authenticator 163A as an authenticator used for authentication. The authentication unit 163 operates the fingerprint authenticator 163A and accepts an input of a fingerprint as input data. In this case, the authentication unit 163 performs authentication by the fingerprint authenticator 163A by using the fingerprint acquired in the normal touch operation of the user U01 as input data without prompting the user U01 to hold the fingerprint. be able to. As a result, the authentication unit 163 can provide the user U01 with a convenient authentication process such as completing the authentication process without requiring a special operation from the user U01 for each authentication process.

(About the generation unit 164)
The generation unit 164 controls generation of authentication result information. The generation unit 164 acquires the result of authentication by the authenticator stored in the authenticator information storage unit 152. And the production | generation part 164 produces | generates the authentication result information processed by the authentication server 100 from the result of the authentication by an authenticator.

  Specifically, the generation unit 164 is an authentication device stored in the authentication device information storage unit 152, and acquires a result of authentication performed by the authentication device selected by the selection unit 162. And the production | generation part 164 produces | generates the authentication result information corresponding to the result of an authentication by attaching | subjecting a signature using the private key corresponding to an authenticator with respect to the result by which the user U01 was authenticated. For example, when the authentication unit 163 authenticates using the fingerprint authenticator 163A, the generation unit 164 generates authentication result information by attaching a signature to the authentication result using the secret key K01. . Such authentication result information indicates that in the user terminal 10, the user U01 identity authentication process has been completed. The generation unit 164 sends the generated authentication result information to the transmission unit 165 and causes the authentication server 100 to transmit it.

(About the transmitter 165)
The transmission unit 165 transmits various information. For example, the transmission unit 165 transmits the authentication result information generated by the generation unit 164 to the authentication server 100. In addition, when the acquisition unit 161 acquires authenticated information transmitted from the authentication server 100, the transmission unit 165 may transmit the authenticated information to the web server 200.

[4. Authentication server configuration]
Next, the configuration of the authentication server 100 according to the embodiment will be described with reference to FIG. FIG. 8 is a diagram illustrating a configuration example of the authentication server 100 according to the embodiment. As illustrated in FIG. 8, the authentication server 100 includes a communication unit 110, a storage unit 120, and a control unit 130. The authentication server 100 includes an input unit (for example, a keyboard and a mouse) that receives various operations from an administrator who uses the authentication server 100, and a display unit (for example, a liquid crystal display) for displaying various types of information. You may have.

(About the communication unit 110)
The communication unit 110 is realized by a NIC or the like, for example. The communication unit 110 is connected to the network N in a wired or wireless manner, and transmits and receives information to and from the user terminal 10 and the web server 200 via the network N. In addition, when processing the authentication result information transmitted from the user terminal 10, the communication unit 110 performs processing according to a specific authentication procedure (protocol) with high safety.

(About the storage unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory device such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 120 includes a registration information storage unit 121.

(Registered information storage unit 121)
The registration information storage unit 121 stores information related to the authentication device registered in the authentication server 100. Here, FIG. 9 illustrates an example of the registration information storage unit 121 according to the embodiment. FIG. 9 is a diagram illustrating an example of the registration information storage unit 121 according to the embodiment. In the example illustrated in FIG. 9, the registration information storage unit 121 includes items such as “authenticator ID”, “type”, “authenticated user”, and “public key”.

  “Authenticator ID”, “Type”, and “Authenticated User” correspond to the same items shown in FIG. The “public key” is key information transmitted from the authenticator side (that is, the user terminal 10) at the time of registration of the authenticator, and indicates a key that is paired with the secret key issued simultaneously. The public key is stored in association with each authenticator and authenticated user.

  That is, in FIG. 9, the authenticator identified by the authenticator ID “163A” is registered, the type of the authenticator is “fingerprint”, the authenticated user is “user U01”, and the authenticator Indicates that the public key used when authenticating the user U01 is “K11”.

(About the control unit 130)
The control unit 130 is realized, for example, by executing various programs (corresponding to an example of a selection program) stored in a storage device inside the authentication server 100 using the RAM as a work area by a CPU, MPU, or the like. The control unit 130 is realized by an integrated circuit such as an ASIC or FPGA, for example.

  As illustrated in FIG. 8, the control unit 130 includes a reception unit 131, a registration unit 132, a verification unit 133, and a transmission unit 134, and realizes or executes information processing functions and operations described below. . The internal configuration of the control unit 130 is not limited to the configuration illustrated in FIG. 8, and may be another configuration as long as the information processing described later is performed. Further, the connection relationship between the processing units included in the control unit 130 is not limited to the connection relationship illustrated in FIG. 8, and may be another connection relationship.

(About the receiver 131)
The receiving unit 131 receives various information. For example, the receiving unit 131 receives a request for registration of an authenticator from a device that desires authentication in the authentication server 100. In addition, for example, when the user terminal 10 accesses the web server 200 and the service provided by the access destination web server 200 requests the user terminal 10 to authenticate, the receiving unit 131 sends the authentication request from the web server 200. Receive. In this case, in response to the authentication request received by the reception unit 131, the transmission unit 134 described later transmits a request indicating that the user terminal 10 performs authentication. In addition, the receiving unit 131 receives authentication result information that is information generated based on a locally performed authentication result in the authentication process. The receiving unit 131 processes the authentication result information transmitted from the user terminal 10 using a specific authentication procedure defined by the authentication server 100.

(Registration unit 132)
The registration unit 132 registers information related to the authentication device. For example, the registration unit 132 registers the authenticator included in the terminal device that has requested registration based on the information received by the reception unit 131. The registration unit 132 stores the registered information in the registration information storage unit 121.

  In addition, the registration unit 132 registers a public key among a public key and a private key that are paired between the authentication server 100 and the authenticator. When verifying the authentication result information, the verification unit 133 refers to the public key registered by the registration unit 132 and verifies the authentication result information.

(About the verification unit 133)
The verification unit 133 verifies the authentication result information. Specifically, the verification unit 133 analyzes the authentication result information transmitted from the user terminal 10 and specifies a user to be authenticated based on the authentication result information. Further, the verification unit 133 specifies a secret key corresponding to the authenticator that is the generation source of the authentication result information via the registration information storage unit 121. Then, the verification unit 133 verifies whether or not the signature attached to the authentication result information is a signature created using the registered authenticator private key, using the public key corresponding to the private key.

  Then, when the verification by the public key corresponding to the secret key is confirmed, the verification unit 133 recognizes the authentication result information transmitted from the user terminal 10 as regular authentication information. Then, the verification unit 133 sends information indicating that the authentication result information has been authenticated to the transmission unit 134 and causes the user terminal 10 (or the web server 200) to transmit the information.

  The verification unit 133 may not recognize the identity of the user indicated by the authentication result information when the authenticator that generated the authentication result information does not match a predetermined condition. For example, the verification unit 133 determines whether the authenticator that generated the authentication result information is not stored in the registration information storage unit 121 managed by the registration unit 132 or the transmitted authentication result information is specified by the authentication server 100. If the authentication procedure is not followed, the identity of the user indicated by the authentication result information may not be authenticated.

(About the transmitter 134)
The transmission unit 134 transmits various types of information. For example, when it is requested to authenticate the identity of the user who uses the user terminal 10 when using the service, the transmission unit 134 transmits information indicating that authentication is requested to the user terminal 10. In addition, when the identity of the user who has transmitted the authentication result information is authenticated by the verification unit 133 that has verified the authentication result information, the transmission unit 134 transmits the authenticated information to the user terminal 10 or the web server 200. .

[5. Processing procedure)
[5-1. Processing procedure of user terminal 10]
Next, a processing procedure according to the embodiment will be described with reference to FIGS. 10 and 11. First, the authentication processing procedure by the user terminal 10 will be described with reference to FIG. FIG. 10 is a flowchart illustrating an authentication processing procedure according to the embodiment.

  As illustrated in FIG. 10, the acquisition unit 161 according to the user terminal 10 determines whether an authentication request on the user terminal 10 side (local side) has been acquired (step S101). If the acquisition unit 161 has not acquired a request (step S101; No), the acquisition unit 161 waits until acquisition.

  On the other hand, when the acquisition part 161 acquires a request | requirement (step S101; Yes), the detection part 14 detects the utilization condition in the user terminal 10 (step S102). The acquisition unit 161 acquires information detected by the detection unit 14.

  Then, the selection unit 162 determines whether the usage status detected by the detection unit 14 matches the selection condition (step S103). When the usage status matches the selection condition (step S104; Yes), the selection unit 162 selects an authenticator that meets the condition (step S104).

  On the other hand, when the usage status does not match the selection condition (step S103; No), the selection unit 162 selects an arbitrary authenticator (step S105). Note that the authenticator selected when the usage status and the selection condition do not match is, for example, an authenticator that the user U01 determines to use as an initial setting, or an authenticator designated by the authentication server 100. Or an authenticator selected at random.

  In any case of step S104 and step S105, the authentication unit 163 operates the authenticator registered in the authentication server 100. Then, the authentication unit 163 authenticates the user U01 using the selected authenticator (step S106). Then, with respect to the result of the authentication process performed by the authentication unit 163, the generation unit 164 generates authentication result information using the secret key corresponding to the authenticator (step S107). Then, the transmission unit 165 transmits the authentication result information generated by the generation unit 164 to the authentication server 100 (step S108).

[5-2. Processing procedure of authentication processing system)
Next, a processing procedure performed by the authentication processing system 1 according to the embodiment will be described with reference to FIG. FIG. 11 is a sequence diagram illustrating an authentication processing procedure according to the embodiment. Note that FIG. 11 shows an example of an authentication processing procedure when the user terminal 10 makes a service use request to the web server 200.

  First, the user terminal 10 requests the web server 200 to use a service (step S201). In response to the service use request, the web server 200 requests the authentication server 100 to authenticate the user terminal 10 (step S202).

  In response to the request from the web server 200, the authentication server 100 requests the user terminal 10 for authentication using a specified authentication method (step S203). The prescribed authentication method refers to an authentication method (authentication procedure) performed by performing authentication by an authenticator registered in the authentication server 100 locally and transmitting the result of the authentication to the authentication server 100.

  Therefore, the user terminal 10 selects one of the authenticators registered in the authentication server 100 based on the usage status of the user terminal 10 (step S204). Then, the user terminal 10 authenticates the user U01 who uses the user terminal 10 using the selected authenticator (step S205).

  And the user terminal 10 produces | generates authentication result information based on the result of the authentication which shows that authentication was successful (step S206). The user terminal 10 transmits the generated authentication result information to the authentication server 100 (step S207).

  The authentication server 100 verifies the authentication result information transmitted from the user terminal 10 (step S208). Specifically, the authentication server 100 verifies the signature attached to the authentication result information using the public key corresponding to the secret key used for creating the signature. Then, the authentication server 100 completes the user authentication process when the authentication result information is verified. Then, the authentication server 100 notifies the web server 200 of the result of the personal authentication indicating that the user has been authenticated (step S209).

  Based on the notified information, the web server 200 permits the use of the service for the requested service on the assumption that the user authentication of the user using the user terminal 10 is guaranteed (step S210).

[6. (Modification)
The authentication process by the user terminal 10 described above may be implemented in various different forms other than the above embodiment. Therefore, in the following, another embodiment of the user terminal 10 will be described.

[6-1. (Continuation of usage status)
The user terminal 10 may select an authenticator in the past, and after the authentication by the selected authenticator is performed, the user terminal 10 may continue the authentication state under a predetermined condition such as a small change in usage status.

  For example, when the detection unit 14 associated with the user terminal 10 receives an authentication request from the authentication server 100 next after the previous authentication process, the current usage status and the previous authentication result information are generated by the generation unit 164. Change in usage status when detected. When the change in the usage status detected by the detection unit 14 satisfies a predetermined condition, the selection unit 162 selects the authenticator used when the previous authentication result information is generated.

  Then, when the authentication unit used when the selection unit 162 generates the previous authentication result information is selected, the generation unit 164 uses the result of the authentication performed last time by the authentication unit to the authentication server 100. Authentication result information to be transmitted may be generated. That is, when it is assumed that the user terminal 10 continues to be used by the user U01, for example, since there is no significant change in the usage status from the previous authentication, the user terminal 10 performs authentication without performing a new authentication process. Result information may be generated. In this case, for example, the user terminal 10 holds a cache (for example, an authenticated token) indicating that the authentication was successful when the previous authentication was performed. When the change in the usage status detected by the detection unit 14 satisfies a predetermined condition, the user terminal 10 generates authentication result information using the same authenticator using the cache. As a result, the user U01 can respond to the authentication request received from the authentication server 100 without performing a new local authentication process.

  When the change in the usage status detected by the detection unit 14 satisfies a predetermined condition, the usage status assumed that the user U01 using the user terminal 10 has not changed to another user is observed. This is the case. For example, the predetermined condition is that there is no change in part or all of the position information, the connected device, and the environment information shown in FIG. 6, in other words, the context in the user terminal 10 is less changed. Further, the predetermined condition is, for example, that the operation by the user U01 is continued, that is, the state in which the user terminal 10 is not operated for a predetermined time or longer is not detected, and the user terminal 10 is continuously operated. But you can. As described above, in the user terminal 10, the user estimated from the current usage status detected by the detection unit 14 and the user estimated from the usage status when the previous authentication result information is generated are the same user. In some cases, the authenticator used when the previous authentication result information is generated may be selected. And the user terminal 10 produces | generates authentication result information using the cache to the effect that authentication was successful, when authentication was performed last time. Thereby, according to the user terminal 10, since the authentication state of the user U01 can be continued by detecting the usage status, the effort of the authentication process can be reduced for the user, and the burden of the authentication process can be reduced. .

  In addition, when the change in the usage status detected by the detection unit 14 does not satisfy the predetermined condition, the user terminal 10 has no relation to the authenticator used when the previous authentication result information is generated. An authenticator may be newly selected based on the current usage status detected by the detection unit 14. In this case, the user terminal 10 newly generates authentication result information using the authentication result by the selected authenticator.

[6-2. (Selecting multiple authenticators)
The user terminal 10 may select a plurality of authenticators. For example, it is assumed that the user terminal 10 has only an authenticator whose authentication strength is not high with respect to the authentication strength as described above. In this case, the user terminal 10 may not be able to perform authentication processing by an authenticator that satisfies the authentication strength required by the authentication server 100.

  Therefore, the user terminal 10 selects a plurality of authenticators when selecting the authenticators. For example, the user terminal 10 includes a hardware authenticator that authenticates the identity by inserting a hardware key into the terminal, and SIM card authentication that performs authentication by determining the contents of the SIM card built in the user terminal 10. Select the vessel. Then, the user terminal 10 performs authentication by the two selected types of authenticators. In this case, when both of the two types of authenticators authenticate the identity of the user U01, higher reliability is given to the authentication of the user U01 than when authentication by one type of authenticator is performed. Then, the user terminal 10 transmits to the authentication server 100 as authentication result information that the two types of authenticators have been successfully authenticated. When it is determined that the authentication strength required by the authentication server 100 can be satisfied, the user U01 using the user terminal 10 can be authenticated by the authentication server 100.

  Thus, the user terminal 10 may select a plurality of authentication devices according to the situation. Thereby, since the user terminal 10 can perform the authentication process by multi-factor, it can improve the reliability of authentication. Further, the user terminal 10 can flexibly respond to a request transmitted from the authentication server 100.

[6-3. (Select account)
The user terminal 10 may flexibly change the authentication device or the authentication result information generated by the authentication device in accordance with a user operation. For example, the user terminal 10 receives the thumb of the user U01 and the index finger of the user U01 as registration data for the fingerprint authenticator 163A. And the user terminal 10 produces | generates the authentication result information containing different information, although it is the same fingerprint authenticator 163A according to the data input from the user U01 at the time of authentication.

  For example, when the user U01 uses the thumb as input data and when the user U01 uses the index finger as input data, the user terminal 10 uses the service after the user U01 has been authenticated. Set to change the account information to the side. As a result, the user U01 can use different accounts for services only by changing the data input to the authenticator.

  The user terminal 10 may perform the above processing for each authenticator. For example, the user terminal 10 may log in with a different account or perform different services depending on whether authentication is performed using the fingerprint authenticator 163A and authentication is performed using the iris authenticator 163B. Access. Note that the user terminal 10 may accept registration from the user U01 in advance for the association between the authenticator and the service to be accessed when authentication is performed by the authenticator.

  Thus, the user terminal 10 can perform authentication processing in association with an account used for a service, a service to be accessed, and the like. Thereby, the user terminal 10 can provide an authentication process that is convenient for the user.

[6-4. Usage situation〕
The user terminal 10 showed the example which detects the kind of operation, such as a touch operation and imaging | photography operation, as a utilization condition. Here, the user terminal 10 may detect and acquire not only the type of operation but also the action of the user U01 as the usage status.

  For example, the user terminal 10 may detect an action of the user U01 purchasing a product using a service on the network. And the user terminal 10 preferentially activates the authenticator normally used by the user U01 when, for example, when authentication is requested from the authentication server 100 in processing such as settlement when purchasing a product.

  That is, the user terminal 10 detects an action such as access to a service frequently used by the user U01, and activates an authenticator used by the normal user U01 when authentication processing is performed in the service. For example, in such a service, when the frequency at which the user U01 uses the voiceprint authenticator 163C is high, the voiceprint authenticator 163C is activated preferentially. As a result, the user U01 can perform authentication using the automatically activated authenticator without selecting the authenticator every time the service is used. Thus, since the user terminal 10 can select a suitable authenticator according to various actions of the user U01, a convenient authentication process can be provided to the user.

  The above processing is not limited to the purchase behavior of the user and can be applied to various usage situations. For example, the user terminal 10 detects a context in which the user U01 is with a friend from the communication status with surrounding external devices. In this case, the user terminal 10 detects that the external device is in the vicinity of the user terminal 10 using, for example, identification information of the external device owned by the friend, so that the user U01 can be with the friend. Context is determined to be. When the user terminal 10 receives an authentication request from the authentication server 100 in the context that the user U01 is with a friend, the user terminal 10 preferentially selects an authenticator that is frequently used in the context.

  Further, when the user terminal 10 detects a context that the user U01 is in a predetermined place, the user terminal 10 may preferentially select an authenticator that is frequently used in the context. For example, the user terminal 10 refers to the usage history of the authenticator that is frequently used when the user U01 is at the company, and when the context that the user U01 is at the company is observed, the authentication that is frequently used Select the vessel preferentially.

[6-5. (External device to be connected)
In the above-described embodiment, the usage status of the user terminal 10 is, for example, installed in a watch-type terminal 40 which is another terminal used by the user U01, a home router 30 installed at home, or a company where the user U01 works. As an example, the situation is shown in which it is connected to an in-house router 50 or the like. However, external devices connected to the user terminal 10 are not limited to these.

  For example, the external device connected to the user terminal 10 may be a device installed in a store or the like operated by a communication carrier. For example, a communication carrier that provides a line used by the user terminal 10 installs a predetermined communication terminal (hereinafter referred to as “store terminal”) in the store. And user terminal 10 tries communication with a store terminal, when user U01 visits a store. In this case, the store terminal verifies registration data of the user terminal 10 and the user U01 registered in advance (for example, a SIM card and establishes communication with the user terminal 10).

  The user terminal 10 may use the usage status established for communication with the store terminal for selection of the authenticator. For example, the user terminal 10 may preferentially select an authenticator having a history of use by the user in the past in a situation where communication between the user terminal 10 and the store terminal is established. Further, when the store terminal operates as an authenticator that can authenticate the user U01, the user terminal 10 may select an authenticator included in the store terminal. For example, the store terminal can verify the contents of the SIM card of the user terminal 10 as described above. In other words, the store terminal can function as an authenticator that authenticates the user U01 based on the contents of the SIM card. Therefore, the user terminal 10 may select an authenticator included in the store terminal when the situation that the user has visited the store is detected. As described above, the user terminal 10 can select an appropriate authenticator when the user U01 visits the store.

  In the above example, a terminal installed in a telecommunications carrier's store is taken as an example, but an external device is not limited to this as long as it is a reliable terminal. For example, in the above example, a terminal installed in a public office may be used. Further, for example, the user terminal 10 may treat a terminal used by the family and friends of the user U01 as a reliable terminal. That is, the user terminal 10 may select an authenticator provided in a terminal used by the family or friend in a situation where a terminal used by the family or friend exists in the vicinity and communication with the terminal is established. Good. In this case, it is assumed that registration data or the like for authenticating the user U01 is held in advance in a terminal used by a family member or friend. Further, it is assumed that terminals used by family members and friends include, for example, an authenticator whose authentication strength is higher than that of the authenticator included in the user terminal 10 or a highly convenient authenticator. In this case, when a terminal used by a family member or friend is detected, the user terminal 10 selects an authenticator included in the terminal used by the family member or friend so that the user U01 is authenticated. Thereby, the user U01 can generate authentication result information with higher reliability, or can perform authentication using a highly convenient authenticator.

[6-6. (Type of authenticator)
In the above-described embodiment, an example in which each authenticator is realized as one function of authentication processing realized by the authentication unit 163 has been described. However, the authenticator may be realized as an authentication device (hardware) connected to the user terminal 10.

  In this case, the authenticator has a function of communicating with the user terminal 10 and a function of acquiring information such as a fingerprint input from the user terminal 10. Then, the authenticator authenticates that the user terminal 10 is used by the user U01 when the input data and the registration data are collated. The authenticator generates authentication result information based on the authentication result. Then, the authenticator receives authenticated information from the authentication server 100 and transmits the information to the user terminal 10. In this case, the authentication unit 163 and the generation unit 164 related to the user terminal 10 control the operation of the authentication device connected to the user terminal 10. Thereby, the user terminal 10 can use various services provided from the web server 200.

  Further, the authenticator may be realized as a program (application) in which the functions of the authentication unit 163 and the generation unit 164 are integrated. When the authenticator is an application, the application is executed by being installed in the user terminal 10 in accordance with a user operation.

[6-7. Configuration of each device]
In the above embodiment, the configuration examples of the user terminal 10 and the authentication server 100 have been described with reference to FIGS. 5 and 8. However, each device included in the authentication processing system 1 does not necessarily have to be realized by the exemplified configuration. For example, the user terminal 10 does not necessarily include all the processing units illustrated in FIG. That is, the user terminal 10 does not necessarily include the display unit 13 and the detection unit 14 inside. Further, the user terminal 10 may be separated into two or more devices to realize the configuration illustrated in FIG. For example, the user terminal 10 is realized by two or more devices having a configuration in which an authentication device including at least the detection unit 14, the authentication unit 163, and the generation unit 164 and a communication device including at least the communication unit 11 are separated. May be.

[6-8. Operation of authentication processing system)
In the said embodiment, the user terminal 10 showed the example which detects using the detection part 14 that communication with predetermined | prescribed external devices, such as the clock-type terminal 40, is established. Here, for each device included in the authentication processing system 1, the user terminal 10 may detect a communication state or the like of each device by using a predetermined application, and determine the usage status.

  That is, a common application is installed in the user terminal 10, the clock-type terminal 40, or the like by an administrator who manages the user terminal 10 (for example, the user U01). The user terminal 10 searches for the clock-type terminal 40 and the like by acquiring the communication status and the like by controlling the function of the application. As described above, the common application is installed in each device included in the authentication processing system 1, whereby the user terminal 10 can realize the authentication processing quickly and accurately.

[6-9. Usage situation〕
In the embodiment described above, the user terminal 10 has shown an example of detecting the operation of the user U01, the connected device connected to the user U01, position information, and the like as the usage status. Here, the user terminal 10 may use information other than the above example as the usage status. For example, the user terminal 10 may select an authenticator using time information in the user terminal 10. That is, the detection unit 14 according to the user terminal 10 detects an authenticator frequently used by the user U01 who uses the user terminal 10 in the morning or night of weekdays. When the user U10 is operating the user terminal 10 on a weekday morning or night, when there is an authentication request from the authentication server 100, the user terminal 10 frequently uses the user U01 based on the usage history. Select the authenticator used from. As described above, according to the user terminal 10, it is possible to automatically select an authenticator that is easy to use in the daily activities of the user U01. Thereby, the user terminal 10 can improve the usability in authentication.

[7. Hardware configuration)
The user terminal 10 and the authentication server 100 according to the above-described embodiment are realized by a computer 1000 configured as shown in FIG. 12, for example. Hereinafter, the user terminal 10 will be described as an example. FIG. 12 is a hardware configuration diagram illustrating an example of a computer 1000 that implements the functions of the user terminal 10. The computer 1000 includes a CPU 1100, RAM 1200, ROM 1300, HDD 1400, communication interface (I / F) 1500, input / output interface (I / F) 1600, and media interface (I / F) 1700.

  The CPU 1100 operates based on a program stored in the ROM 1300 or the HDD 1400 and controls each unit. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 is started up, a program depending on the hardware of the computer 1000, and the like.

  The HDD 1400 stores a program executed by the CPU 1100, data used by the program, and the like. The communication interface 1500 receives data from other devices via the communication network 500 (corresponding to the network N shown in FIG. 4), sends the data to the CPU 1100, and transmits the data generated by the CPU 1100 to the other devices via the communication network 500. Send to device.

  The CPU 1100 controls an output device such as a display and a printer and an input device such as a keyboard and a mouse via the input / output interface 1600. The CPU 1100 acquires data from the input device via the input / output interface 1600. Further, the CPU 1100 outputs the data generated via the input / output interface 1600 to the output device.

  The media interface 1700 reads a program or data stored in the recording medium 1800 and provides it to the CPU 1100 via the RAM 1200. The CPU 1100 loads such a program from the recording medium 1800 onto the RAM 1200 via the media interface 1700, and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or PD (Phase change rewritable disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. Etc.

  For example, when the computer 1000 functions as the user terminal 10 according to the embodiment, the CPU 1100 of the computer 1000 implements the function of the control unit 16 by executing a program loaded on the RAM 1200. The HDD 1400 stores data in the storage unit 15. The CPU 1100 of the computer 1000 reads these programs from the recording medium 1800 and executes them, but as another example, these programs may be acquired from other devices via the communication network 500.

[8. Others]
In addition, among the processes described in the above embodiment, all or part of the processes described as being automatically performed can be performed manually, or the processes described as being performed manually can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedures, specific names, and information including various data and parameters shown in the document and drawings can be arbitrarily changed unless otherwise specified. For example, the various types of information illustrated in each drawing is not limited to the illustrated information.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the authentication unit 163 and the generation unit 164 illustrated in FIG. 5 may be integrated. Further, for example, information stored in the storage unit 15 may be stored in a storage device provided outside via the network N.

  In addition, the above-described embodiments and modifications can be combined as appropriate within a range that does not contradict processing contents.

[9. effect〕
As described above, the user terminal 10 (an example of a selection device) according to the embodiment includes the detection unit 14, the selection unit 162, and the generation unit 164. The detection unit 14 detects the usage status of the user terminal 10 used by the user. The selection unit 162 selects an authentication device based on the usage status detected by the detection unit 14. The generation unit 164 is information generated by signing a result of authentication by the authenticator selected by the selection unit 162 with a predetermined key, and is specific to the authentication server 100 that performs user authentication. Authentication result information that is information processed in the procedure is generated.

  As described above, the user terminal 10 according to the embodiment selects an authenticator to be used in the authentication process from a plurality of authenticators based on the usage status of the user terminal 10. For example, the user terminal 10 selects an authenticator that is convenient for the user based on the usage status. Thereby, the user terminal 10 can perform the personal authentication excellent in convenience for the user.

  Moreover, the detection part 14 detects the user's operation with respect to the user terminal 10 or the environment (context) in the user terminal 10 as a utilization condition. The selection unit 162 selects an authenticator based on a user operation on the user terminal 10 detected by the detection unit 14 or an environment in the user terminal 10.

  As described above, the user terminal 10 according to the embodiment uses the user's operation and the environment of the user terminal 10 as elements for selecting an authentication device. Thereby, the user terminal 10 can appropriately select an authenticator according to the situation.

  The detection unit 14 detects the type of user operation on the user terminal 10. The selection unit 162 selects an authenticator that employs an authentication method corresponding to the type of user operation.

  Thus, the user terminal 10 according to the embodiment selects an authentication device corresponding to the type of user operation. For this reason, the user terminal 10 can appropriately select an authenticator corresponding to the operation without causing the user to be particularly aware of the situation in which the user terminal 10 is used as usual. As a result, the user can save time and effort to select an authenticator, and can perform authentication processing with a natural flow of operations.

  Further, the detection unit 14 detects information acquired by a sensor used by the user terminal 10 such as position information of the user terminal 10 and a connection status with a device that communicates with the user terminal 10. The selection unit 162 selects an authenticator based on information acquired by the sensor detected by the detection unit 14.

  As described above, the user terminal 10 according to the embodiment detects position information or the like using a sensor provided in the user terminal 10 and selects an authenticator based on the detected information. For this reason, the user terminal 10 can select an authentication device suitable for authentication, including an environment (noise, illuminance, etc.) suitable for the authentication device.

  The selection unit 162 selects an authenticator based on the usage status detected in the past by the detection unit 14 and the current usage status detected by the detection unit 14.

  As described above, the user terminal 10 according to the embodiment can hold the detected usage state as a log and select an authenticator based on the log. For this reason, the user terminal 10 gives priority to an authenticator that can efficiently perform authentication processing, such as selecting an authenticator that is frequently selected by a user or an authenticator that has been successfully authenticated in the past. You can choose.

  In addition, the detection unit 14 detects a change between the current usage status and the usage status when the authentication result information was previously generated by the generation unit 164. When the change in the usage status detected by the detection unit 14 satisfies a predetermined condition, the selection unit 162 selects the authenticator that was used when the authentication result information was generated in the past.

  As described above, the user terminal 10 according to the embodiment holds a usage status log in the past (for example, previous) authentication process, and detects a change from the current usage status. And the user terminal 10 can save the effort in authentication, such as selecting the same authenticator as the past when there is little change in the usage status. For this reason, the user terminal 10 can perform an authentication process with less burden on the user.

  In addition, the selection unit 162 is configured such that the user estimated from the current usage status detected by the detection unit 14 and the user estimated from the usage status when authentication result information was generated in the past are the same user. In addition, the authenticator used when the authentication result information has been generated in the past is selected.

  Thus, the user terminal 10 according to the embodiment determines the identity of the user who uses the user terminal 10 based on the usage status. If the user terminal 10 can be trusted to be the same user, the user terminal 10 selects the authenticator used in the past authentication process. Thereby, the user terminal 10 can save the effort in authentication.

  Further, when the authentication unit used when the selection unit 162 generated the authentication result information in the past is selected, the generation unit 164 uses the result of the authentication performed in the past by the authentication unit to generate an authentication server. Authentication result information to be transmitted to 100 is generated.

  As described above, the user terminal 10 according to the embodiment authenticates by using the cache of the result of the previous authentication without requiring new authentication when the identity of the user can be trusted based on the usage situation. Generate result information. Thereby, according to the user terminal 10, the user can save time and effort for new authentication, and the burden of authentication processing is reduced.

  Further, the detection unit 14 detects a change between the current usage status and the usage status when the authentication result information has been generated in the past by the generation unit 164. When the change in the usage status detected by the detection unit 14 does not satisfy a predetermined condition, the selection unit 162 newly selects an authenticator based on the current usage status detected by the detection unit detection unit 14. To do. In this case, the generation unit 164 may newly generate authentication result information using the authentication result by the authenticator selected by the selection unit 162.

  As described above, when the user terminal 10 detects that the usage status in the user terminal 10 has changed after the previous authentication process has been performed, the user terminal 10 performs a new authentication without using the past authentication result. May be performed. Thereby, since the user terminal 10 can confirm again the user who uses the user terminal 10, it can perform the authentication process with which safety | security was ensured.

  As described above, some of the embodiments of the present application have been described in detail based on the drawings. It is possible to implement the present invention in other forms with improvements.

  In addition, the above-mentioned “section (module, unit)” can be read as “means” or “circuit”. For example, the generation unit can be read as generation means or a generation circuit.

DESCRIPTION OF SYMBOLS 1 Authentication processing system 10 User terminal 20 Client 30 Home router 40 Clock type terminal 50 Internal router 100 Authentication server 200 Web server

Claims (12)

A selection device that controls an authenticator having a function of authenticating a user's identity,
As a usage status of the selection device used by the user, a detection unit that detects a type of operation performed on the selection device by the user ;
A storage unit that stores a type of operation performed on the selection device by the user in association with the authenticator that is different for each authentication method;
Based on the type of operation performed on the selection device by the user detected by the detection unit, the authentication unit associated with the type of operation is selected from the authentication units stored in the storage unit. A selection section;
Information generated by signing a result of authentication by the authenticator selected by the selection unit with a predetermined key, which is processed by an authentication server that performs user authentication of the user in a specific authentication procedure A generation unit that controls generation of authentication result information that is information;
A selection device comprising: The detector is
As the usage status, a user operation on the selection device or an environment in the selection device is detected,
The selection unit includes:
Selecting the authenticator based on a user operation on the selection device detected by the detection unit or an environment in the selection device;
The selection device according to claim 1, wherein: The detector is
Detecting information acquired by a sensor used by the selection device;
The selection unit includes:
Selecting the authenticator based on information acquired by the sensor detected by the detector;
The selection device according to claim 1 or 2 , characterized by the above-mentioned. The storage unit
Storing information on the type of operation for the selection device by the user detected in the past by the detection unit;
The selection unit includes:
The type of operation for the selected device by the user which is detected in the past which is stored by the storage unit, based on the type of operation on the selected device according to the present time of the user detected by the detection unit, wherein Select an authenticator,
The selection device according to any one of claims 1 to 3 , wherein The detector is
Detecting a change between the current usage status and the usage status when authentication result information has been generated in the past by the generation unit,
The selection unit includes:
If the change in the usage status detected by the detection unit satisfies a predetermined condition, the authenticator used when the authentication result information was generated in the past is selected.
The selection device according to any one of claims 1 to 4 , wherein The selection unit includes:
When the user estimated from the current usage status detected by the detection unit and the user estimated from the usage status when the authentication result information was generated in the past are the same user, the authentication result in the past Select the authenticator that was used when the information was generated,
The selection device according to claim 5 , wherein: The generator is
Authentication result information to be transmitted to the authentication server using the result of authentication performed in the past by the authenticator when the authenticator used when the authentication unit is generated in the past by the selection unit is selected Generate
The selection device according to claim 5 or 6 , characterized by the above. The detector is
Detecting a change between the current usage status and the usage status when authentication result information has been generated in the past by the generation unit,
The selection unit includes:
If the change in the usage status detected by the detection unit does not satisfy a predetermined condition, an authenticator is selected based on the current usage status detected by the detection unit;
Selection device according to any one of claims 1 to 7, characterized in that. The generator is
Using the authentication result by the authenticator selected by the selection unit, newly generate authentication result information,
The selection device according to claim 8 , wherein: A selection method executed by a selection device that controls an authenticator having a function of authenticating a user's identity,
As a usage status of the selection device used by the user, a detection step of detecting a type of operation on the selection device by the user ;
A storage step of storing in the storage unit the type of operation performed on the selection device by the user and the authentication unit that is different for each authentication method in association with each other;
Based on the type of operation performed on the selection device by the user detected by the detection step, the authentication unit associated with the type of operation is selected from the authentication units stored in the storage unit. A selection process;
Information generated by signing a result of authentication by the authenticator selected in the selection step with a predetermined key, which is processed by an authentication server that performs user authentication of the user in a specific authentication procedure A generation process for controlling generation of authentication result information, which is information;
The selection method characterized by including. In a selection device that controls an authenticator having a function of authenticating a user's identity,
As a usage status of the selection device used by the user, a detection procedure for detecting a type of operation on the selection device by the user ;
A storage procedure for storing the type of operation for the selection device by the user and the authentication unit that is different for each authentication method in association with each other in the storage unit;
Based on the type of operation on the selection device by the user detected by the detection procedure, the authentication unit associated with the type of operation is selected from the authentication units stored in the storage unit. Selection procedure,
Information generated by signing a result of authentication by the authenticator selected by the selection procedure with a predetermined key, which is processed by an authentication server that performs user authentication of the user by a specific authentication procedure A generation procedure for controlling generation of authentication result information that is information;
A selection program characterized by causing An authentication processing system including a selection device and an authentication server,
The selection device that controls an authenticator having a function of authenticating a user's identity,
As a usage status of the selection device used by the user, a detection unit that detects a type of operation performed on the selection device by the user ;
A storage unit that stores a type of operation performed on the selection device by the user in association with the authenticator that is different for each authentication method;
Based on the type of operation performed on the selection device by the user detected by the detection unit, the authentication unit associated with the type of operation is selected from the authentication units stored in the storage unit. A selection section;
Information generated by signing a result of authentication by the authenticator selected by the selection unit with a predetermined key, which is processed by an authentication server that performs user authentication of the user in a specific authentication procedure A generation unit that controls generation of authentication result information that is information,
The authentication server is
An authentication processing system comprising: a verification unit that verifies authentication result information generated by the generation unit with a public key corresponding to the predetermined key.

Images