JP5197731B2 - Personal authentication apparatus and method - Google Patents

Description

  The present invention relates to a personal authentication apparatus and method for authenticating a user registered in advance on a communication network.

  On the Internet, various services are provided via the Web. In order to receive a service provided by a certain user, the user operates a terminal to operate a homepage or the like operated in advance by the service provider. Access and registration is required. The service providing entity provides the service to the registered user.

  For the authentication of a registered user, information that only the principal can know is stored as a password together with the user ID issued at the time of registration, and the combination of the user ID and password input at the time of access of the user is stored. This is done by determining whether or not the combination of ID and password matches. However, if the password is easy to predict, it can be easily impersonated, and if it is difficult to predict, the password is difficult for the user to remember and forgets. In order to prevent impersonation, it is effective to change the password periodically. However, the burden of creating and managing the password every time it is changed increases the burden on the user, so the combination of user ID and password is There is a tendency to fix. For this reason, there has been a demand for an authentication method and apparatus that can reduce the burden of password management by the user and can effectively prevent spoofing (for example, Patent Document 1).

Japanese Patent Laid-Open No. 2002-197062

  In Patent Document 1, a combination of a plurality of password elements is registered, randomly displayed including elements different from the password at the time of authentication, and the correct password element combination is selected, thereby reducing the password management burden. Is disclosed. However, storing a plurality of password elements and combinations thereof is a burden on the user, and changing a plurality of password elements is a large burden on the user. And it leads to promoting that the combination of a user ID and a password element is fixed, and once these leak to the outside, impersonation cannot be prevented.

  An object of the present invention is to provide a personal authentication device and method that can reduce the burden of managing authentication information by a user and suppress the fixation of authentication information.

  (1) A personal authentication device for performing user authentication of a user registered in advance on a communication network, wherein the identification information of the user and the identification information of another user having a predetermined relationship with the user are User relationship storage means for storing in association with information indicating a predetermined relationship; input screen transmission means for transmitting an input screen for prompting input of identification information of the user of the user terminal and other users having the predetermined relationship; Input receiving means for receiving user identification information input at the user terminal as related user identification information; and from the user relation storage means based on the related user identification information received by the input receiving means, from the related user A user having the predetermined relationship with the related user indicated by the identification information is extracted as an authentication user candidate of the user who is the target of the personal authentication. Authentication apparatus comprising: a testament user candidate extracting means.

The personal authentication device described in (1) stores identification information of a certain user and identification information of another user in association with information indicating a predetermined relationship, and authenticates a user of a certain user terminal, for example. Therefore, an input screen for authentication is transmitted to the user terminal. This input screen prompts the user to input identification information of another user who has a predetermined relationship with the user of the user terminal that has transmitted the authentication request. Then, based on the related user identification information input and received on the input screen, the personal authentication device extracts a user having a predetermined relationship with the related user as an authentication user candidate of the user to be the target of the personal authentication.
As a result, since the user can be authenticated based on the relationship between a certain user and another user, it is not necessary to input the user ID and password in the user authentication, and the burden of managing the ID and password by the user is eliminated. Can be reduced. Moreover, since the relationship between a certain user and another user fluctuates, the fixation of authentication information can be suppressed.

  (2) The personal authentication device according to (1), wherein the predetermined relationship is a human relationship with the other user registered in advance by the user.

  In the personal authentication device described in (2), in addition to the personal authentication device described in (1), the predetermined relationship is a human relationship registered in advance. Since the human relationship changes little by little over a long period or a short period, the fixation of authentication information can be suppressed.

  (3) The identity authentication device according to (1) or (2), wherein the input screen transmission unit has the predetermined relationship urged last time when the process performed by the input screen transmission unit is performed a plurality of times. A personal authentication device that transmits the input screen for prompting input of identification information of another user having a different predetermined relationship.

  In the personal authentication device described in (3), in addition to the personal authentication device described in (1) or (2), the input screen transmitted by the input screen transmitting means is different from the predetermined relationship that prompted the previous input. The screen prompts input of identification information of other users having the relationship. Thereby, the authentication information requested | required of the user of the user terminal which performed the authentication request | requirement can be varied every time.

  (4) A user authentication method for performing user authentication of a user registered in advance on a communication network, wherein the user identification information and the identification information of another user having a predetermined relationship with the user are User relation storage means for storing in association with information indicating a predetermined relationship, wherein the computer transmits an input screen for prompting input of identification information of another user having the predetermined relationship with the user of the user terminal From the user relationship storage means based on the screen transmission step, the input reception step for receiving the user identification information input at the user terminal as the related user identification information, and the related user identification information received at the input reception step. A user having the predetermined relationship with a related user indicated by the related user identification information Authentication method of performing an authentication user candidate extracting step of extracting as an authentication user candidates.

  According to the personal authentication method described in (4), the same effect as the personal authentication device described in (1) can be obtained.

  ADVANTAGE OF THE INVENTION According to this invention, the identification authentication apparatus and method which can reduce the management burden of authentication information by a user and can suppress fixation of authentication information can be provided.

It is a figure which shows the functional block of the personal authentication apparatus which concerns on one Embodiment of this invention, and the functional outline | summary of the peripheral device. It is a figure which shows the user relationship table which concerns on one Embodiment of this invention. It is a flowchart which shows the process which the personal authentication apparatus which concerns on one Embodiment of this invention performs. It is a display example in the user terminal which concerns on one Embodiment of this invention. It is a display example in the user terminal which concerns on one Embodiment of this invention. It is a display example in the user terminal which concerns on one Embodiment of this invention.

  Embodiments of the present invention will be described below with reference to the drawings. The embodiment described below is merely an example, and the technical scope of the present invention is not limited to this.

  With reference to FIG.1 and FIG.2, the personal authentication apparatus 10 which concerns on one Embodiment of this invention is demonstrated. The embodiment described below is merely an example, and the technical scope of the present invention is not limited to this.

  A personal authentication device 10 according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a diagram showing a functional block of the personal authentication apparatus 10 and an outline of functions of peripheral devices.

  The personal authentication device 10 can communicate with user terminals 30a and 30b (hereinafter referred to as user terminals 30) via a communication network N such as the Internet. In the following embodiments, the personal authentication device 10 is described as performing user authentication for using a service (for example, SNS) provided by another server (not shown) via the Web.

  The present embodiment is applied to a computer (person authentication device 10, user terminal 30, etc.) and its peripheral devices. Each unit in the present embodiment is configured by hardware included in a computer and its peripheral devices, and software that controls the hardware.

  The hardware includes a CPU as a control unit, a storage unit, a communication unit, a display unit, and an input unit. Examples of the storage unit include a memory (RAM, ROM, etc.), a hard disk drive (HDD), and an optical disk (CD, DVD, etc.) drive. Examples of the communication unit include various wired and wireless interface devices. Examples of the display unit include various displays such as a liquid crystal display and a plasma display. Examples of the input unit include a keyboard and a pointing device (mouse, tracking ball, etc.).

  The software includes a computer program and data for controlling the hardware. The computer program and data are stored in the storage unit, and are appropriately executed and referenced by the control unit. The computer program and data can be distributed via a communication network, and can also be stored and distributed on a computer-readable medium such as a CD-ROM.

Hereinafter, the functional configuration of the personal authentication device 10 will be described.
The control unit of the personal authentication device 10 includes an authentication request receiving unit 11, an input screen transmission unit 12, an input reception unit 13, a user candidate extraction unit 14, an authentication determination unit 15, and an authentication result transmission unit 16. Have. In addition, the storage unit of the personal authentication device 10 includes a user relationship database (hereinafter, the database is expressed as “DB”) 101 as a user relationship storage unit.

  The authentication request receiving unit 11 receives an authentication request from the user terminal 30. When the user terminal 30 used by the user who requests authentication is connected to the user authentication device 10 via the communication network N, the authentication request receiving unit 11 receives the connection from the user terminal 30 as an authentication request.

  The input screen transmission unit 12 receives the authentication input screen as an input screen for inputting authentication information in response to the authentication request receiving unit 11 receiving the authentication request from the user terminal 30. To the user terminal 30. This authentication input screen is a screen that prompts input regarding identification information of other users who have a predetermined relationship with the user of the user terminal 30. The predetermined relationship means a human relationship between users registered in advance. Details will be described later.

  In addition, the authentication input screen includes a question sentence for allowing the user of the user terminal 30 that has transmitted the authentication request to input identification information of another user having a predetermined relationship. A plurality of the question sentences are prepared and stored in the storage unit. And the input screen transmission means 12 selects the question sentence displayed on the said input screen for authentication, when transmitting the input screen for authentication. This question sentence may be selected in a predetermined order or randomly.

  The input receiving unit 13 receives an input of identification information of another user who is prompted to input on the authentication input screen. Specifically, the input receiving unit 13 receives the identification information of other users input at the user terminal 30 as the related user identification information via the communication network N.

  The user candidate extracting unit 14 is referred to the user relationship DB 101 and is prompted to input the related user identification information that the input receiving unit 13 has received and the identification information of other users having a predetermined relationship on the authentication input screen. Based on the predetermined relationship, a user having the predetermined relationship is extracted as an authentication user candidate of a user who is a subject of personal authentication.

The authentication determination unit 15 determines whether or not the number of authentication user candidates extracted by the user candidate extraction unit 14 is a predetermined number or less. In the present embodiment, the predetermined number is 1. That is, when the number of authentication user candidates becomes 1, the user of the user terminal 30 that has made the authentication request is authenticated as the person.
If the number of authentication user candidates is greater than 1, the authentication determination unit 15 determines that authentication has not ended and moves the process to the input screen transmission unit 12. That is, the personal authentication device 10 repeats the processing performed by the input screen transmission unit 12, the input reception unit 13, the user candidate extraction unit 14, and the authentication determination unit 15 until the number of authentication user candidates is equal to or less than a predetermined number.

  The authentication result transmitting unit 16 transmits an authentication result screen indicating that the user has been authenticated by the authentication determining unit 15 to the user terminal 30 that has received the authentication request when the user authentication is completed.

  The user relationship DB 101 is a database that stores user identification information and identification information of other users having a predetermined relationship with the user in association with information indicating the predetermined relationship. For example, these pieces of information are stored as a table as shown in FIG.

  Here, the user relationship table 111 will be described with reference to FIG. FIG. 2 is a diagram showing the user relationship table 111.

The user relationship table 111 is a table stored in the user relationship DB 101.
In this embodiment, the user relationship table 111 has an “identification information” column, a “relation” column, and a “registration identification information” column, and stores each piece of information in association with each other.

  In the “identification information” column, identification information of a certain user is stored. The user identification information is information that can uniquely identify a user stored in the user relationship table 111. In the present embodiment, “Taro 01” is used. However, the present invention is not limited to this, and only a numeral, only an alphabet, or a combination of a numeral and an alphabet or other characters may be used as long as it can be uniquely identified.

  The “relation” column stores data indicating a predetermined relationship between the user of the identification information stored in the “identification information” column and the user of the identification information stored in the “registered identification information” column described later. Is done. This predetermined relationship is a relationship indicating a human relationship in the present embodiment. The user relationship table 111 stores, for example, labels indicating relationships such as “friends”, “friends of friends”, “black”, and “company”. Each information stored in the “relation” column and the “registered identification information” column is registered in advance by the user of the identification information stored in the “identification information” column. For example, according to FIG. 2, it can be seen that the user with the identification information “Taro 01” has registered the user with the registration identification information “Jiro 03” as a “friend”.

  In the “registered identification information” column, identification information of other users registered by the user of the identification information stored in the “identification information” column is stored.

  With reference to FIG. 3, the process which the personal authentication apparatus 10 performs is demonstrated. FIG. 3 is a flowchart of processing performed by the personal authentication device 10.

  In step S <b> 11, the authentication request accepting unit 11 of the personal authentication device 10 accepts an authentication request from the user terminal 30.

  In step S12, the input screen transmission means 12 of the personal authentication device 10 selects a question text to be displayed on the authentication input screen. This question text is a content that prompts input of identification information of another user who has a predetermined relationship with the user of the user terminal 30 that has received the authentication request. The input screen transmission unit 12 refers to the storage unit and selects a question sentence to be displayed on the authentication input screen. In step S13, the input screen transmission unit 12 displays the authentication input screen including the selected question sentence. It transmits to the user terminal 30.

  In step S14, the input receiving means 13 of the personal authentication device 10 determines whether or not there is an input on the authentication input screen transmitted in step S13. The input receiving unit 13 determines whether or not the identification information of another user whose input is prompted on the authentication input screen is received from the user terminal 30. When receiving the identification information of another user (in the case of YES at step S14), the input receiving means 13 receives the identification information of the other user as related user identification information, and moves the process to step S15. If the user identification information is not received, the process of step S14 is repeated.

  In step S15, the user candidate extraction unit 14 of the personal authentication device 10 refers to the user relationship DB 101 and extracts an authentication user candidate. The user candidate extraction unit 14 extracts an authentication user candidate based on the identification information of another user received by the input reception unit 13 and a predetermined relationship prompted by the question text.

  In step S16, the authentication determination unit 15 of the personal authentication device 10 determines whether or not the number of authentication user candidates extracted by the user candidate extraction unit 14 is equal to or less than a predetermined number. The authentication discrimination | determination means 15 moves a process to step S17, when the number of authentication user candidates is below a predetermined number (in the case of YES at step S16). If the number of authentication user candidates is greater than the predetermined number, the authentication determination unit 15 moves the process to step S12.

  In step S17, the authentication result transmitting unit 16 of the personal authentication device 10 transmits a screen indicating the authentication result to the user terminal 30 that has received the authentication request.

  The authentication input screen and the authentication result screen displayed on the user terminal 30 will be described with reference to FIGS. 2 and 4 to 6, and an example of user authentication by the personal authentication device 10 will be described. 4 and 5 are display examples of the authentication input screen, and FIG. 6 is a display example of the authentication result screen.

  First, when the user authentication device 10 receives a user authentication request from the user terminal 30, an authentication input screen 41 shown in FIG. On the authentication input screen 41, a question sentence 411, an input field 412 and a send button 413 are displayed. The question sentence 411 prompts the user of the user terminal 30 to input identification information of another user having a predetermined relationship. In FIG. 4, the question sentence 411 “Who are your friends?” Is displayed.

  The user terminal 30 receives an input of other user identification information (“Hanako 12”) registered in advance as “friends” in the input field 412 from the user of the user terminal 30, and further presses the transmission button 413. Is received, the input information is transmitted to the personal authentication device 10.

  Upon receiving the information (related user identification information) input from the user terminal 30 to the authentication input screen 41, the personal authentication device 10 refers to the user relationship DB 101 and extracts an authentication user candidate. Here, according to the user relationship table 111 in FIG. 2, users who have registered “Hanako 12” input in the input field 412 in FIG. 4 as “friends” (that is, the relationship is “friends” and the registration identification information is changed). The users of identification information registered as “Hanako 12” are “Taro 01”, “Jiro 03”, and “Saburo 36”. Therefore, “Taro 01”, “Jiro 03”, and “Saburo 36” are authentication user candidates. At this time, the number of authentication user candidates is 3, and the user of the user terminal 30 that has requested authentication cannot be specified. Therefore, the personal authentication device 10 further transmits an authentication input screen 42 (FIG. 5).

  On the second authentication input screen 42, a question sentence 421 different from the question sentence 411 displayed on the first authentication input screen 41 is displayed. This question sentence 421 prompts an input regarding a predetermined relationship different from the question sentence 411 on the first authentication input screen 41. In FIG. 5, a question sentence 421 “Who are your friends?” Is displayed. When the user terminal 30 receives an input of “Saburo 36” in the input field 422 and receives a pressing operation on the transmission button 423, the user terminal 30 transmits the input information to the personal authentication device 10.

  When the user authentication apparatus 10 receives information input from the user terminal 30 on the authentication input screen 42 and receives the information as related user identification information, the user authentication apparatus 10 refers to the user relation DB 101 and extracts an authentication user candidate. Here, according to the user relationship table 111 of FIG. 2, “Hanako 12” is registered as “friend”, and “Saburo 36” input in the input field 422 of FIG. 5 is registered as “friend of friend”. The only user (that is, the user whose identification information is registered as “Saburo 36” with the relationship “friend of friend”) is “Taro 01”. Accordingly, since “Taro 01” is an authentication user candidate and the number of authentication user candidates is 1, the user authentication apparatus 10 authenticates that the user of the user terminal 30 that has requested authentication is “Taro 01”.

  In response to authenticating that the user of the user terminal 30 that transmitted the authentication request is “Taro 01”, the personal authentication device 10 transmits an authentication result screen 43 to the user terminal 30 (FIG. 6). On the authentication result screen 43, an Enter button 432 for connecting to a service provided by another server is displayed together with a message 431 indicating that the user of the user terminal 30 that transmitted the authentication request is authenticated as “Taro 01”. Is done. By pressing the Enter button 432 with the user terminal 30, the user can connect the user terminal 30 to a service site provided by another server and receive the service.

As described above, according to the present embodiment, the user is prompted to input the identification information of another user having a predetermined relationship with the identification information of the user, and the user is authenticated based on the identification information of the other user and the information of the predetermined relationship. Therefore, management of so-called IDs and passwords can be made unnecessary.
For this reason, it is possible for the system administrator to reduce the response when the registered user forgets the ID and password, and the burden of managing these, and the user is also freed from managing the ID and password. Benefits can be provided.

  Further, according to the present embodiment, since the predetermined relationship is a human relationship, it becomes information that changes in a short period or a long period of time, so that fixation of authentication information can be suppressed.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

  For example, in the present embodiment, there is one user relationship table 111 stored in the user relationship DB 101, but there may be a plurality of user relationship tables 111. For example, you may divide for every user and relationship of identification information.

  In the present embodiment, the question sentences 411 and 421 displayed on the authentication input screens 41 and 42 are selected in a predetermined order or randomly. However, the present invention is not limited to this. For example, as the question sentence 421 displayed on the authentication input screen 42 for the second and subsequent times, a question sentence with higher specificity may be selected. Specifically, when the authentication input screen 42 is displayed in the above-described example, “friends of friends” are displayed as the question sentence 421. Here, for example, when a question message “Who is registered as black?” Is displayed, according to FIG. 2, a friend who is registered as “Hanako 12” and registered “black”. There are three persons who are “Taro 01”, “Jiro 03”, and “Saburo 36”. Also, since “Taro 01” and “Saburo 36” register the same “Taro 02” as black, the question “Who is registered as black?” Identifies the user to be authenticated. I can't. In such a case, the personal authentication device 10 (input screen transmission means 12) may compare the two and select the more specific question “Who are friends of friends?” .

DESCRIPTION OF SYMBOLS 10 Personal authentication apparatus 11 Authentication request reception means 12 Input screen transmission means 13 Input reception means 14 User candidate extraction means 15 Authentication discrimination means 16 Authentication result transmission means 101 User relation DB

Claims (4)

A user authentication device for performing user authentication of a registered user on a communication network,
User relationship storage means for storing the identification information of the user and the identification information of another user having a predetermined relationship with the user in association with the information indicating the predetermined relationship;
An input screen transmitting means for transmitting an input screen for prompting input of identification information of another user having the predetermined relationship with the user of the user terminal;
Input accepting means for accepting user identification information input at the user terminal as related user identification information;
Based on the related user identification information received by the input receiving unit, a user having the predetermined relationship with a related user indicated by the related user identification information is stored in the user relationship storage unit. A user authentication apparatus comprising: an authentication user candidate extraction unit that extracts an authentication user candidate. The personal authentication device according to claim 1,
The personal authentication apparatus, wherein the predetermined relationship is a human relationship with the other user registered in advance by the user. The identity authentication device according to claim 1 or 2,
The input screen transmitting means prompts input of identification information of another user having the predetermined relationship different from the predetermined relationship that was prompted last time when the process performed by the input screen transmitting means is performed a plurality of times. A personal authentication device that transmits A personal authentication method for authenticating a user registered in advance on a communication network,
User relation storage means for storing the identification information of the user and the identification information of another user having a predetermined relationship with the user in association with information indicating the predetermined relationship;
Computer
An input screen transmitting step for transmitting an input screen for prompting input of identification information of another user having the predetermined relationship with the user of the user terminal;
An input receiving step of receiving user identification information input at the user terminal as related user identification information;
Based on the related user identification information received in the input receiving step, the user having the predetermined relationship with the related user indicated by the related user identification information is stored in the user relationship storage unit. An authentication user candidate extraction step of extracting as an authentication user candidate;

Images