JP2010237741A - Authentication system and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent impersonation by a third person, and to achieve high level user authentication by using a one-time password. <P>SOLUTION: An authentication device 3 includes: a generation means 31 which generates an one-time password by receiving an one-time password generation request from a first terminal 1, and transmits the generated one-time password to the first terminal 1, and stores it in an authentication storage means 35; and an authentication means 32 which receives the one-time password input from the second terminal 6 from a task device 4, and authenticates whether or not the received one-time password is matched with the one-time password stored in the authentication storage means 35, and the task device 4 includes: a request accepting means 41 which, when receiving the one-time password from the second terminal 6, transmits the one-time password to the authentication device 3; and a task processing means 42 which, when the authentication of the one-time passwords succeeds, provides prescribed task processing to the second terminal 6. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an authentication technique for authenticating a user's validity using a one-time password.

  In recent years, there has been a problem of identity theft such as user IDs and passwords on the Internet, represented by phishing scams. For this reason, there is a need for a technique that ensures higher security and authenticates the legitimacy of the user. For example, Patent Document 1 describes a one-time password authentication system that performs user authentication using a one-time password.

JP2002-259344

  By the way, in the window business such as a financial institution, the identity of a user who is a customer is confirmed. As general identity verification, identity verification is performed by making a user present not only a passbook and cash card, but also a seal, and collating the seal with the seal registered in advance with a financial institution. Yes.

  However, even a user who has a passbook and a seal registered in a financial institution may be a third party who obtained these passbook and seal improperly. It may be insufficient.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to prevent spoofing by a third party and to perform more advanced user authentication using a one-time password.

  In order to solve the above problems, the present invention responds to a request from an authentication apparatus that transmits a one-time password to a first terminal used by a user and a second terminal used by a counter person in charge of the counter service. An authentication system including a business device for performing business processing, wherein the authentication device receives a one-time password generation request including terminal identification information from the first terminal and corresponds to the terminal identification information. A time password is generated, the generated one-time password is transmitted to the first terminal, the generated one-time password is stored in the authentication storage means, and the one-time password input from the second terminal is received. Whether the received one-time password received from the business device matches the one-time password stored in the authentication storage means And authentication means for transmitting an authentication result to the business device, and when the business device receives the one-time password from the second terminal, the business device transmits the one-time password to the authentication device. And a request processing unit that provides a predetermined job process to the second terminal when an authentication result of successful one-time password authentication is received from the authentication device.

  In addition, the present invention provides an authentication apparatus that transmits a one-time password to a first terminal used by a user, and a business process that performs business processing in response to a request from a second terminal used by a contact person in charge of the business An authentication method performed by the apparatus, wherein the authentication apparatus receives a one-time password generation request including terminal identification information from the first terminal, generates a one-time password corresponding to the terminal identification information, The generated one-time password is transmitted to the first terminal, the generated one-time password is stored in the authentication storage unit, and the one-time password input from the second terminal is received from the business device. Authenticating whether the received one-time password and the one-time password stored in the authentication storage unit match, A request receiving step of transmitting the one-time password to the authentication device when the business device receives the one-time password from the second terminal, and a one-time password. When the authentication result of successful authentication is received from the authentication device, a business process step of providing a predetermined business process to the second terminal is performed.

  In the present invention, spoofing by a third party can be prevented and more advanced user authentication can be performed using a one-time password.

1 is an overall configuration diagram of a personal authentication system to which an embodiment of the present invention is applied. It is a figure which shows an example of a user table. It is a figure which shows an example of an authentication table. It is a figure which shows the hardware structural example of each apparatus. It is a figure which shows the flow of a personal authentication process. An example of the screen transition of the personal authentication process is shown. It is a figure which shows the flow of a registration process of the 1st mobile telephone. It is a figure which shows the flow of a registration process of the 2nd mobile telephone.

  Embodiments of the present invention will be described below.

  FIG. 1 is an overall configuration diagram of a personal authentication system to which an embodiment of the present invention is applied. The personal authentication system according to the present embodiment will be described below by taking as an example an authentication process in the case where the person in charge of the window confirms the identity of the user who is a customer in the window of a financial institution (bank, securities company, etc.).

  The personal authentication system shown in the figure includes a mobile phone (first terminal) 1 and a user terminal 2 used by a user, an IC reader 5 (for example, a FeliCa (registered trademark) reader) installed in a financial institution, It has an operation terminal (second terminal) 6, an authentication server 3, and a business server 4 that are used by the person in charge at the institution. These devices 1 to 6 are connected via a network 9 such as a mobile phone network or the Internet.

  The user of this embodiment is a user who can use various services provided by the business server 4. The user is registered in advance in the business server 4 and acquires a user ID for identifying the user in the business server 4. It shall be.

  In addition, when a user requests a predetermined operation at a financial institution, the user obtains a disposable password (hereinafter referred to as “one-time password”) from the authentication server 3 using the mobile phone 1 in advance. The time password shall be presented to the contact person as authentication information for identity verification.

  The mobile phone 1 (first terminal) accepts user instructions, displays various information / screens, and transmits and receives mail. It is assumed that the mobile phone 1 stores in advance a mobile phone ID (terminal identification information) such as a machine identification number in a storage device such as a memory (not shown). The memory or the like in which the mobile phone ID is stored may be an IC card that can be detached from the mobile phone 1. The mobile phone 1 may be one having an IC chip such as a FeliCa (registered trademark) chip.

  The user terminal 2 is a terminal 2 used when registering the mobile phone 1 in the authentication server 3 and accepts various instructions from the user, displays various information / screens on the output device, and is similar to the Web browser. It shall have a function.

  The IC reader 5 installed in the financial institution holds up (contacts) the mobile phone 1 mounted with the IC chip, designates a predetermined URL set in advance, and accesses the authentication server 3. The screen provided by the authentication server 3 is displayed. Further, when accessing the authentication server 3, the IC reader 5 transmits the store number (installation information of the IC reader 5) of the financial institution stored in advance in the storage device of the IC reader 5 to the authentication server 3. And

  The operation terminal (second terminal) 6 used by the person in charge at the financial institution is a terminal for authenticating the identity of the user who has visited the window, and performs the window work requested by the user after successful authentication. It is a terminal for performing. The operation terminal 6 accepts various instructions from the person in charge of the window, displays various information / screens on the output device, and has the same function as the Web browser.

  The authentication server 3 includes a generation unit 31 that generates a one-time password in response to a request from the mobile phone 1, an authentication unit 32 that authenticates the one-time password in response to a request from the business server 4, and the mobile phone 1 to the authentication server 3. A registration unit 33 that performs registration, and an authentication table 35. Various types of information necessary for authentication are registered in the authentication table 35. Note that the authentication server 3 may be configured by a plurality of servers.

  The business server 4 is a system owned by a financial institution, and includes a request receiving unit 41 that receives a personal authentication request from the operation terminal 6, a business processing unit 42 that performs a predetermined business after successful personal authentication, and a user terminal 2 includes a registration receiving unit 43 that receives a registration request of the mobile phone 1 from the authentication server 3 to the authentication server 3, and a user table 45.

  Next, the user table 45 of the business server 4 and the authentication table 35 of the authentication server 3 will be described.

  FIG. 2 is a diagram illustrating an example of the user table 45. The illustrated user table 45 includes an account number 451, a user ID 452, a password 453, an authentication ID 454, and other information (name, password, etc.) not illustrated. The user ID 462 is identification information for identifying the user in the business server 4. The authentication ID 464 is identification information for identifying the mobile phone 1 (or user) in the authentication server 3, and the authentication ID is set in the user table 45 when the mobile phone 1 is registered in the authentication server 3. Shall be.

  FIG. 3 is a diagram illustrating an example of the authentication table 35. The illustrated authentication table 35 includes an authentication ID 351, a PIN (Personal Identification Number) 352, a mobile phone ID 353, a one-time password 354, a store number 355, and other information not shown. The authentication user ID 351 is identification information for identifying the mobile phone 1 (or user) in the authentication server 3. The PIN 352 is a personal identification number arbitrarily set by the user. As the mobile phone ID 353, for example, it is conceivable to use the machine identification number of the mobile phone 1, the phone number of the mobile phone, user information stored in the IC memory of the mobile phone, and the like.

  In the one-time password 354, the one-time password generated by the generation unit 31 is set. Store number 355 is set to the store number of the financial institution transmitted by IC reader 5 when mobile phone 1 requests a one-time password using IC reader 5. The registration method of the authentication table 35 will be described later.

  The above-described mobile phone 1, user terminal 2, IC reader 5, operation terminal 6, authentication server 3 and business server 4 are all CPUs 901, memories 902, HDDs, etc. as shown in FIG. A general-purpose computer system including a storage device 903, an input device 904 such as a keyboard and a mouse, an output device 905 such as a display and a printer, and a communication control device 906 for connecting to a network can be used. . In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of each device.

  For example, the functions of the authentication server 3 and the business server 4 are executed by the CPU 901 of the authentication server 3 in the case of the program for the authentication server 3, and the CPU 901 of the business server 4 in the case of the program for the business server 4, respectively. It is realized by doing.

  The memory 902 or the external storage device 903 of the authentication server 3 is used for the authentication table 35 of the authentication server 3, and the memory 902 or the external storage device 903 of the business server 4 is used for the user table 45 of the business server 4. Shall be. In addition, regarding the input device 904 and the output device 905, each device is provided as necessary.

  Next, the one-time password issuing process and the personal authentication process will be described. The user acquires a one-time password using the mobile phone 1 before requesting a predetermined process (transfer process, withdrawal process, etc.) at a financial institution, and the acquired one-time password and the account number are obtained. Present the written passbook or cash card to the contact person. The person in charge of the window inputs the one-time password and the account number presented by the user to the operation terminal 6 to authenticate the user, and then performs the window service requested by the user.

  In the process of acquiring the one-time password by the mobile phone 1, the first method of accessing the authentication server 3 without using the IC reader 5 and holding (contacting) the mobile phone 1 over the IC reader 5 There is a second method of accessing the authentication server 3.

  FIG. 5 is a diagram schematically showing the flow of the one-time password acquisition process and the personal authentication in the first method. FIG. 6 shows an example of various screens (screen transitions) displayed on the output device of the mobile phone 1 and the operation terminal 6 in the process shown in FIG.

  In the first method, the mobile phone 1 receives a user instruction, specifies a predetermined URL (Uniform Resource Locator), accesses the authentication server 3, and displays a menu screen 61 shown in FIG. 6 on the output device, for example. (S11). Then, the mobile phone 1 receives the user instruction and transmits a one-time password issue request to the authentication server 3 (S12). In the illustrated example, it is assumed that the user clicks the [2] one-time password on the menu screen 61.

  Upon receiving the one-time password issuance request, the generation unit 31 of the authentication server 3 transmits a PIN input screen to the mobile phone 1 (S13). For example, the mobile phone 1 displays a PIN input screen 62 shown in FIG. 6 on the output device. The user inputs a PIN registered in advance in the PIN input screen 62 and clicks the send button. The mobile phone 1 transmits the input PIN to the authentication server 3 (S14). It is assumed that the mobile phone 1 also transmits the mobile phone ID stored in the memory or the like of the mobile phone 1 when transmitting information to the authentication server 3.

  The generation unit 31 of the authentication server 3 determines whether the PIN and the mobile phone ID received from the mobile phone 1 exist in the authentication table 35 (see FIG. 3). When it exists in the authentication table 35, the production | generation part 31 produces | generates a one-time password with a predetermined algorithm, and memorize | stores the produced | generated one-time password in the corresponding record of the authentication table 35 (S15). Then, the generation unit 31 transmits a screen including the generated one-time password to the mobile phone 1. For example, the mobile phone 1 displays the one-time password display screen 63 of FIG. 6 on the output device (S16).

  In S15, when the record having the received PIN and mobile phone ID does not exist in the authentication table 35, the generation unit 31 determines that the request is an unauthorized mobile phone 1 or a user, and sends an error message to the mobile phone. 1 to send.

  Next, a process in which a person in charge of a financial institution uses the operation terminal 6 to confirm the identity of a user who is a customer will be described. The user who has obtained the one-time password requests a predetermined person from the person in charge at the financial institution. The person in charge of the window inputs the user ID of the person in charge of the window, the store number of the financial institution, etc., in advance to the operation terminal 6 and logs in to the business server 4, for example, the identity confirmation TOP screen 64 shown in FIG. Assume that it is displayed.

  When a person in charge of a window is requested by a user to perform a predetermined job, the person in charge of the user clicks a start button on the identity confirmation TOP screen 64 in order to authenticate the user whether or not the user is the person before performing the job. . Thereby, the operation terminal 6 transmits an authentication start request to the business server 4 (S21), and the business server 4 transmits an input screen for inputting authentication information to the operation terminal 6 (S22).

  For example, the operation terminal 6 displays an input screen (or dialog box) 65 shown in FIG. On the screen 65 shown in the figure, a one-time password input field, an account number input field, and a send button are displayed. The person in charge of the window asks the user to present the one-time password displayed on the screen 63 of the mobile phone 1 and the account number described in the passbook or cash card 69, and the presented one-time password and account number are requested. Input to the screen 65 of the operation terminal 6 and click the send button. The operation terminal 6 receives the input from the person in charge of the window and transmits the one-time password and the account number to the business server 4 (S23).

  The request receiving unit 41 of the business server 4 identifies a record having the received account number from the user table 45 (see FIG. 2), and acquires the authentication ID set in the record. Then, the request reception unit 41 transmits an authentication request including the acquired authentication ID and the one-time password received in S23 to the authentication server 3 (S24). When there is no record having the accepted account number in the user table 45, the request receiving unit 41 determines that the request is from an unregistered or unauthorized user and transmits an error message to the operation terminal 6. .

  The authentication unit 32 of the authentication server 3 that has received the authentication request determines whether or not it matches the one-time password generated at the time of generating the one-time password in S15. A failure notification is transmitted to the business server 4 (S25). Specifically, the authentication unit 32 identifies the record of the authentication ID received from the business server 4, and if the one-time password of the record matches the one-time password received from the business server 4, the authentication is successful. If it does not match, it is determined that the authentication has failed.

  When the request reception unit 41 of the business server 4 receives the authentication success notification, the user at the window considers that the user at the window is a legitimate person who uses the account number, and transmits a result screen of the authentication success to the operation terminal 6 ( S26). For example, the operation terminal 6 displays an authentication success result screen 66 shown in FIG. 6 on the output device (S27). Thereby, the processing of the business processing unit 42 of the business server 4 is permitted, and the contact person can perform the contact business requested by the user. That is, the operation terminal 6 transmits a business process request instructed by the person in charge of the window to the business server 4, and the business processing unit 42 of the business server 4 performs the requested business process.

  If an authentication failure notification is received from the authentication server 3 (S25), the request reception unit 41 of the business server 4 transmits an error message indicating that the authentication has failed to the operation terminal 6.

  Next, a second method for acquiring a one-time password using the IC reader 5 will be described.

  In the second method, the user holds the mobile phone 1 over the IC reader 5 installed in the financial institution. As a result, the IC reader 5 accesses the authentication server 3 by specifying a predetermined URL set in advance, and displays, for example, the PIN input screen 62 shown in FIG. 6 on the output device of the mobile phone 1. Further, when accessing the authentication server 3, the IC reader 5 transmits the store number (installation information of the IC reader 5) of the financial institution stored in advance in the IC reader 5 to the authentication server 3.

  In the second method by the processing of the IC reader 5, the process proceeds to S <b> 13 of the processing shown in FIG. 5. When the authentication server 3 receives the store number from the IC reader 5, it generates a PIN input screen 62 in which the store number is set. To the mobile phone 1. The store number may not be displayed on the PIN input screen 62.

  The mobile phone 1 displays the PIN input screen 62 on the output device, and transmits the PIN input by the user and the store number of the IC reader 5 set on the screen 62 to the authentication server 3 (S14). It is assumed that the mobile phone 1 also transmits the mobile phone ID stored in the memory or the like of the mobile phone 1 when transmitting information to the authentication server 3.

  The generation unit 31 of the authentication server 3 receives the PIN, the mobile phone ID, and the store number, and determines whether the PIN and the mobile phone ID exist in the authentication table 35 (see FIG. 3). When it exists in the authentication table 35, the production | generation part 31 produces | generates a one-time password by a predetermined algorithm. And the authentication part 32 memorize | stores the produced | generated one-time password and the received shop number in the corresponding record of the authentication table 35 (S15). Then, the generation unit 31 transmits a screen including the generated one-time password to the mobile phone 1. For example, the mobile phone 1 displays the one-time password display screen 63 of FIG. 6 on the output device (S16).

  If the record having the received PIN and mobile phone ID does not exist in the authentication table 35, the generation unit 31 determines that the request is an unauthorized mobile phone 1 or a user, and displays an error message on the mobile phone 1 Send to.

  Next, a process in which the person in charge of the financial institution in the case of the second method performs identity verification using the operation terminal 6 will be described. Note that S21 and S22 are the same as those in the first method described above, and a description thereof will be omitted here.

  In S <b> 23, the operation terminal 6 receives an input from the person in charge of the window and transmits an authentication start request including the input one-time password, account number, and store number to the business server 4. It is assumed that the store number (installation information of the operation terminal 6) is input by the person in charge at the time of logging in to the business server 4 and is stored in a storage unit such as a memory of the operation terminal 6. Alternatively, the store number is stored in the storage means of the business server, and when the business server receives the authentication start request including the one-time password and the account number, the operation terminal in the login state is identified, and the authentication ID and The store number may be added to the authentication request including the one-time password and transmitted to the authentication server.

  The request reception unit 41 of the business server 4 identifies a record having the received account number from the user table 45 and acquires the authentication ID set in the record. Then, the request reception unit 41 transmits an authentication request including the acquired authentication ID and the one-time password and store number received in S23 to the authentication server 3 (S24). When there is no record having the accepted account number in the user table 45, the request receiving unit 41 determines that the request is from an unregistered or unauthorized user and transmits an error message to the operation terminal 6. .

  The authentication unit 32 of the authentication server 3 that has received the authentication request determines whether or not it matches the one-time password generated in S15 and the store number of the IC reader 5, and if they match, the authentication success notification is not matched. Transmits an authentication failure notification to the business server 4 (S25). Specifically, the authentication unit 32 identifies the record of the authentication ID received from the business server 4, and the one-time password and store number of the record and the one-time password and store number received from the business server 4 are If they match, it is determined that the authentication has succeeded, and if they do not match, it is determined that the authentication has failed.

  As described in S26 and S27 of the first method, the business server 4 displays an authentication success result screen when receiving an authentication success notification, and receives an authentication failure notification when receiving an authentication failure notification. Is transmitted to the operation terminal 6 (S26). The operation terminal 6 displays the received result screen on the output device (S27). If the authentication is successful, the processing of the business processing unit 42 of the business server 4 is permitted, and the contact person in charge can perform the contact business requested by the user.

  Next, registration processing of the mobile phone 1 with respect to the authentication server 3 will be described. In the present embodiment, it is assumed that a plurality of mobile phones can be registered for one account number (or one user). As a result, when one user owns a plurality of mobile phones, a one-time password can be obtained from any mobile phone and processing can be requested at the window of a financial institution. In addition, by registering a mobile phone of the user's family or the like, the user's family can request processing at the financial institution's counter on behalf of the user.

  FIG. 7 is a diagram schematically showing the flow of registration processing of the first mobile phone 1. First, the user terminal 2 receives a user instruction, accesses the business server 4, and displays, for example, a login screen 101 (for registration of the first mobile phone) shown in the figure. And the user terminal 2 receives a user's instruction | indication, and transmits the login request containing a user ID and a password to the business server 4 (S51). The user inputs the user ID and password registered in advance in the user table 45 of the business server 4 on the login screen.

  The registration receiving unit 43 of the business server 4 refers to the user table 45, confirms that the received user ID and password are registered in the user table 45, generates a screen after login, and transmits it to the user terminal 2. (S52). Then, for example, the user terminal 2 displays a screen 102 after login, receives a user instruction, and transmits a registration request for the first mobile phone to the business server 4 (S53).

  The registration receiving unit 43 of the business server 4 transmits a mail address input screen to the user terminal 2 (S54). For example, the user terminal 2 displays the mail address input screen 103 shown in the figure, and transmits a registration request including the mail address of the mobile phone 1 input by the user to the business server 4 (S55). The registration reception unit 43 of the business server 4 transmits a reception completion screen to the user terminal 2 (S56), and the user terminal 2 displays, for example, the reception completion screen 104 shown in the figure.

  Further, the registration receiving unit 43 of the business server 4 encrypts the user ID input in S51, and generates a URL for time-limited and one-time registration using the encrypted user ID. And the registration reception part 43 produces | generates the mail with which produced | generated URL was described, and transmits the produced | generated mail to the mail address of the mobile telephone 1 transmitted by S55 (S57).

  In addition, the registration receiving unit 43 transmits the user ID input on the login screen and the generated URL to the authentication server 3 (S58).

  The mobile phone 1 receives the mail, accepts the user's instruction, and accesses the URL of the authentication server 3 described in the mail (S59). Note that the illustrated screen 105 shows an example of an email transmitted from the business server 4.

  And the registration part 33 of the authentication server 3 produces | generates the registration screen which makes a user input information required for registration, and transmits to the mobile phone 1, and the mobile phone 1 displays a registration screen, and a user is displayed on the said screen. Is sent to the authentication server 3. It is assumed that the mobile phone 1 also transmits a mobile phone ID when transmitting information to the authentication server 3.

  In the illustrated example, the registration unit 33 of the authentication server 3 transmits the user ID input screen 106 (S60), and the mobile phone 1 displays the screen 106, and the user inputs and transmits the user ID to the authentication server 3. (S61).

  The registration unit 33 of the authentication server 3 authenticates whether or not the URL accessed in S59 and the user ID received in S61 match the combination of the user ID and URL received in S58. The screen 107 is transmitted to the mobile phone 1 (S62). The mobile phone 1 displays the screen 107 and transmits the PIN input by the user to the authentication server 3 (S63). As described above, when the mobile phone 1 transmits the PIN to the authentication server 3, the mobile phone 1 also transmits the mobile phone ID.

  The registration unit 33 of the authentication server 3 receives the PIN and the mobile phone ID, generates a record of the mobile phone 1, and registers it in the authentication table 35. That is, the registration unit 33 generates a unique authentication ID in the authentication server 3 and registers a record in which the authentication ID, the received PIN, and the mobile phone ID are set in the authentication table 35. And the registration part 33 transmits the registration completion screen containing ID for authentication to the mobile telephone 1 (S64). The mobile phone 1 displays a registration completion screen 108.

  Further, the registration unit 33 of the authentication server 3 notifies the business server 4 of the generated authentication ID, and the registration reception unit 43 of the business server 4 records the user ID record input on the login screen 101 from the user table 45. The ID for authentication specified and notified to the record is set (S65). As described above, the registration process of the first mobile phone 1 is completed, and the one-time password can be obtained from the authentication server 3 by using the registered first mobile phone 1.

  FIG. 8 is a diagram schematically showing the flow of registration processing of the second mobile phone 1. First, the user terminal 2 receives a user instruction, accesses the business server 4, and displays, for example, a login screen 201 (for registration of the second mobile phone) shown in the figure. In order to prevent the registration of the second mobile phone from the user of the first mobile phone registered first without permission from the user of the first mobile phone, in the present embodiment, the first mobile phone is registered in the first mobile phone. It is assumed that the one-time password acquired from the authentication server 3 using a mobile phone is input.

  Therefore, on the login screen 201 for registration of the second mobile phone, in addition to the user ID and password input fields, an input field for inputting the one-time password acquired using the first mobile phone is displayed. Has been. Thus, by making the input of the one-time password acquired from the first mobile phone an indispensable condition, it is premised on the approval of the user who uses the first mobile phone, and unauthorized registration can be prevented. .

  Then, the user terminal 2 receives a user instruction and transmits a login request including the user ID, password, and one-time password to the business server 4 (S71). The user inputs the user ID and password registered in advance in the user table 45 of the business server 4 and the one-time password acquired using the first mobile phone on the login screen.

  Hereinafter, the processing from S72 to S77 is the same as the processing from S51 to S57 described in FIG. The e-mail address input on the e-mail address input screen 113 is the e-mail address of the second mobile phone, and the e-mail describing the registration URL is changed to the e-mail address of the second mobile phone in S77. Sent.

  In S <b> 78, the registration receiving unit 43 of the business server 4 refers to the user table 45 and acquires an authentication ID corresponding to the user ID input on the login screen 111. This authentication ID is set in S65 of FIG. Then, the registration reception unit 43 transmits the acquired authentication ID and the one-time password transmitted in S71 to the authentication server 3 together with the user ID and URL.

  The second mobile phone receives the mail, receives the user's instruction, and accesses the URL of the authentication server 3 described in the mail (S79). The screen 205 shown in the figure shows an example of an email transmitted from the business server 4.

  And the registration part 33 of the authentication server 3 produces | generates the registration screen which makes a user input the information required for registration, and transmits to a mobile phone, and the mobile phone is the information which the user input into the said screen with the mobile phone ID. Is transmitted to the authentication server 3.

  In the illustrated example, the registration unit 33 of the authentication server 3 transmits a user ID input screen 206 (S80), and the mobile phone displays the screen 206, and the user inputs and transmits the user ID to the authentication server 3. (S81).

  The registration unit 33 of the authentication server 3 authenticates whether or not the URL accessed in S79 and the user ID received in S81 match the combination of the user ID and URL received in S78. The password input screen 207 is transmitted to the mobile phone (S82). The mobile phone 1 displays the screen 207 and transmits the one-time password of the first mobile phone input by the user to the authentication server 3 (S83). Here, the user inputs the same one-time password as the one-time password input on the login screen 111 of S71.

  The registration unit 33 of the authentication server 3 acquires the one-time password corresponding to the authentication ID received in S78 from the authentication table 35, receives the acquired one-time password, the one-time password transmitted in S83, and received in S78. If the three one-time passwords match, the PIN entry screen 208 is transmitted to the mobile phone 1 (S84). If any one of them does not match, it is assumed that the registration is invalid, such as when registering without permission from the user of the first mobile phone, and an error message is transmitted to the mobile phone.

  If they match, the mobile phone 1 displays the PIN input screen 208 and transmits the PIN input by the user to the authentication server 3 (S85). As described above, when the mobile phone 1 transmits the PIN to the authentication server 3, the mobile phone 1 also transmits the mobile phone ID.

  The registration unit 33 of the authentication server 3 receives the PIN and the mobile phone ID, generates a record of the second mobile phone 1, and registers it in the authentication table 35. That is, the registration unit 33 generates a unique authentication ID in the authentication server 3 and registers a record in which the authentication ID, the received PIN, and the mobile phone ID are set in the authentication table 35. And the registration part 33 transmits the registration completion screen containing ID for authentication to the mobile telephone 1 (S86). The mobile phone displays a registration completion screen 209.

  Also, the registration unit 33 of the authentication server 3 notifies the business server 4 of the generated authentication ID, and the registration reception unit 43 of the business server 4 records the user ID record input on the login screen 111 from the user table 45. The ID for authentication specified in the record is specified (S87). When the second mobile phone is registered, two IDs, that is, an authentication ID for the first mobile phone and an authentication ID for the second mobile phone are set in the record. As described above, the registration process for the second mobile phone is completed, and the one-time password can be acquired from the authentication server 3 using the second mobile phone. Note that the registration process for the third mobile phone is the same as the registration process for the second mobile phone.

  In the present embodiment described above, impersonation by a third party can be prevented and more advanced user authentication can be performed using a one-time password. Specifically, in the present embodiment, the authentication server 3 does not issue a one-time password unless the user inputs a PIN (personal identification number) set in advance with his / her mobile phone. Further, in the present embodiment, the user presents the one-time password acquired using the mobile phone and the passbook or cash card in which the account number is described to the counter person in charge, and the one-time password presented by the counter person in charge Then, the user is authenticated by entering the account number.

  In other words, in the present embodiment, more advanced user authentication can be realized by performing two-factor authentication such as possession authentication such as a mobile phone and a passbook and knowledge authentication using a PIN. Therefore, a malicious third party must simultaneously steal (or forge) a mobile phone, PIN, and passbook or cash card from a legitimate user, and if any one is missing, it cannot be used illegally. . Thus, in the personal authentication system of this embodiment, unauthorized use by a third party can be prevented and higher security can be ensured.

  Also, in this embodiment, even if the loss of the mobile phone and the leakage of the PIN overlap, by notifying the authentication server that the one-time password issuance of the mobile phone has been made, Since it will not be issued, the risk of third-party spoofing is eliminated as much as possible.

  Further, in the present embodiment, in the case of the mobile phone 1 equipped with an IC chip such as a FeliCa (registered trademark) chip, the authentication server 3 is accessed using an IC reader such as a FeliCa (registered trademark) reader. At this time, it is further verified whether or not the store number indicating the installation location of the IC reader matches the store number input to the operation terminal by the person in charge of the window. Thereby, in this embodiment, higher security can be ensured.

  In the present embodiment, a plurality of mobile phones can be registered in the authentication server for one account number (or one user) (see FIG. 8). That is, for the registration of the second and subsequent mobile phones, the one-time password acquired from the authentication server 3 using the first mobile phone registered first is input. In this way, by entering the one-time password obtained from the first mobile phone registered first as a prerequisite, it is assumed that the user using the first mobile phone is approved, Thus, it is possible to prevent the second and subsequent units from being registered. As a result, when one user owns a plurality of mobile phones, a one-time password can be obtained from any mobile phone, and by registering a mobile phone such as the user's family, the family can It is possible to improve the convenience of the user, such as being able to request processing at a financial institution on behalf of

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary. For example, the authentication server 3 of the above embodiment may be shared by a plurality of business servers 4. That is, it is assumed that the authentication server 3 is an ASP (Application Service Provider) and provides a plurality of business servers 4 with a user authentication function.

  1: mobile phone 2: user terminal 3: authentication server 31: generation unit 32: authentication unit 33: registration unit 35: authentication table 4: business server 41: request reception unit 42: business process Part, 43: registration acceptance part, 45: user table, 5: IC reader, 6: operation terminal, 9 network

Claims (6)

An authentication device having an authentication device that transmits a one-time password to a first terminal used by a user, and a business device that performs business processing in response to a request from a second terminal used by a contact person in charge of the business A system,
The authentication device
A one-time password generation request including terminal identification information is received from the first terminal, a one-time password corresponding to the terminal identification information is generated, and the generated one-time password is transmitted to the first terminal and generated. Generating means for storing the one-time password in the authentication storage means;
Receiving the one-time password input from the second terminal from the business device, authenticating whether or not the received one-time password matches the one-time password stored in the authentication storage means; Authentication means for transmitting to the business device,
The business device is
A request accepting means for transmitting the one-time password to the authentication device when the one-time password is received from the second terminal;
An authentication system comprising: business processing means for providing a predetermined business processing to the second terminal when an authentication result of successful one-time password authentication is received from the authentication device. The authentication system according to claim 1,
An IC reader that reads an IC chip mounted on the first terminal, causes the first terminal to access the authentication device, and transmits predetermined installation information to the authentication device;
The request accepting means of the business device transmits installation information of the second terminal together with the one-time password to the authentication device,
The authenticating unit of the authenticating device matches the one-time password received from the business device with the one-time password stored in the authentication storage means, and the installation information of the second terminal received from the business device is An authentication system that authenticates whether or not the installation information received from the IC reader matches, and transmits an authentication result to the business device. An authentication system according to claim 1 or claim 2, wherein
The authentication device
When registering the second and subsequent first terminals in the authentication device, the one-time acquired from the second and subsequent first terminals using the first registered first terminal Registration means for registering the second and subsequent first terminals when the one-time password is received and the one-time password generated by the generation means and stored in the authentication storage means matches; And an authentication system characterized by further comprising: Authentication performed by an authentication device that transmits a one-time password to a first terminal used by a user and a business device that performs business processing in response to a request from a second terminal used by a contact person in charge of the business A method,
The authentication device
A one-time password generation request including terminal identification information is received from the first terminal, a one-time password corresponding to the terminal identification information is generated, and the generated one-time password is transmitted to the first terminal and generated. Generating the stored one-time password in the authentication storage unit;
Receiving the one-time password input from the second terminal from the business device, authenticating whether or not the received one-time password matches the one-time password stored in the authentication storage unit; Transmitting to the business device, and
The business device is
When receiving a one-time password from the second terminal, a request reception step for transmitting the one-time password to the authentication device;
And a business processing step of providing a predetermined business processing to the second terminal when an authentication result of successful one-time password authentication is received from the authentication device. An authentication method according to claim 4, wherein
The authentication device further performs a receiving step of reading the IC chip mounted on the first terminal and receiving installation information of the IC reader from an IC reader that causes the first terminal to access the authentication device,
The request reception step of the business device transmits installation information of the second terminal together with the one-time password to the authentication device,
In the authentication step of the authentication device, the one-time password received from the business device matches the one-time password stored in the authentication storage unit, and the installation information of the second terminal received from the business device is An authentication method comprising: authenticating whether or not the installation information received from the IC reader matches with the reception step, and transmitting an authentication result to the business device. The authentication method according to claim 4 or 5, wherein:
The authentication device
When registering the second and subsequent first terminals in the authentication device, the one-time acquired from the second and subsequent first terminals using the first registered first terminal When the password is received and the one-time password matches the one-time password generated in the generation step and stored in the authentication storage unit, a registration step of registering the second and subsequent first terminals is performed. And an authentication method characterized by further performing.

Images