JP5480122B2 - Content presentation type authentication system - Google Patents

Description

  The present invention relates to a user authentication system, and more specifically, presents a plurality of pattern elements arranged in a predetermined pattern as a presentation pattern to a user who is authenticated, and applies a one-time password derivation rule to the presentation pattern, thereby providing a one-time password. The present invention relates to a content presentation type authentication system for performing user authentication and forcibly presenting content to a user at the time of authentication.

  In recent years, a so-called matrix authentication method user authentication system has been developed as a form of challenge-response method in user authentication systems (see, for example, Patent Document 1). In matrix authentication, a matrix-like presentation pattern in which random numbers are arranged in a predetermined pattern is presented to a user who is to be authenticated, and is applied to pattern elements (numbers of random numbers) included in the presentation pattern. Thus, the one-time password derivation rule for generating the one-time password is set as the password of the user. The server and the client share the same presentation pattern, and the one-time password that is the result of applying the one-time password derivation rule that is the password at the client to the presentation pattern and the one-time password derivation rule that is the password at the server By comparing with the verification code that is the result of applying to the above, user authentication is performed without directly comparing the passwords. In matrix authentication, the one-time password derivation rule, which is a password, is the position and order of the elements selected on the matrix, and is easy to memorize as an image. It cannot be specified.

  Furthermore, an offline user authentication system has been developed that enables matrix authentication even when the client is not connected to the server via a network (see Patent Document 2). In an offline authentication system using matrix authentication, a plurality of pattern element sequences constituting a presentation pattern and a result of applying a one-time password derivation rule to each of the presentation patterns within the offline authentication client are unidirectional by a hash function. A plurality of verification codes that have been subjected to a function operation are stored, a presentation pattern is generated by selecting one from the stored pattern element sequence, and the one-way function operation is performed on the input one-time password In order to verify the password without storing the password itself, it is possible to display the presentation pattern on the offline authentication client by having a configuration in which authentication is performed by comparing the one implemented with the corresponding verification code The verification code is hashed and stored Because, the client can realize the matrix certification of off-line with a high level of security, such as password leakage does not occur even been analyzed.

  FIG. 21 is a functional block diagram of an offline user authentication system 2100 that enables conventional matrix authentication. In this system, a user ID 2181 is input by the user of the client 2151 through the user ID input unit 2152 and transmitted to the authentication support server 2101 through the verification data request unit 2153. The authentication support server 2101 receives the input user ID 2181 by the verification data request receiving unit 2103, and patterns the pattern element sequence 2190, which is information for generating a plurality of presentation patterns 2210 (FIG. 22) corresponding to the input user ID. The verification code generation unit 2106 generates a plurality of verification codes 2193 corresponding to the one-time password derivation rules 2102b corresponding to the user ID 2102a generated by the generation unit 2104 and stored in the respective presentation patterns and the password storage unit 2102. These pattern element sequence 2190 and verification code 2193 are transmitted to the client 2151 in advance via the pattern transmission means 2105 and verification code transmission means 2111, and the client 2151 receives the pattern reception means 2154 and It receives them via the validation code receiving means 2162, and stored in the verification data storage unit 2116. Then, the pattern selection unit 2163 selects the pattern element sequence 2190 stored in the verification data storage unit 2161 for the user ID input by the user via the user ID input unit 2153, and the pattern display unit 2155 is selected. The presentation pattern 2210 is displayed on the client 2151 based on the pattern element sequence 2190, and the input of the one-time password is accepted from the user via the one-time password input means 2156. The verification code specifying unit 2164 specifies the verification code 2193 corresponding to the user ID and the selected pattern element sequence and reads it from the verification data storage unit 2161, and the user authentication unit 2165 performs a one-way function operation on the input one-time password. And the verification code 2193 are compared to perform user authentication.

  FIG. 22 is a conceptual diagram of a method for generating a presentation pattern 2210 in a conventional matrix authentication system. FIG. 22 shows a pattern element sequence 2190 composed of pattern elements that are one-digit numbers from 0 to 9, and each pattern element included in the pattern element sequence is represented by a pattern composed of four 4 × 4 matrices. The presentation pattern 2210 arranged at the position of the element is illustrated. The authentication support server 2101 generates 64 single-digit numbers, which are pattern elements included in the presentation pattern 2210, by a random number generation algorithm, and transmits a pattern element sequence 2190 in which the numbers are arranged to the client 2151. The client 2151 receives the pattern element sequence 2190 from the authentication support server 2101 and arranges each pattern element included in the pattern element in order in the shape of a predetermined pattern, here, each element of four 4 × 4 matrices. Thus, a presentation pattern 2210 is generated and displayed on the screen.

  FIG. 23 is a conceptual diagram of a one-time password input method in the matrix authentication method. By applying the one-time password derivation rule 2102 b to the presentation pattern 2210, the user sequentially extracts numbers displayed at predetermined positions on the matrix and inputs them from the one-time password input unit 2156. In FIG. 23, arrows and circles indicated by broken lines indicate that a one-time password based on the presentation pattern 2210 is input from the client keyboard 2300.

International Publication WO03 / 069490 Pamphlet (Page 10, Lines 2-14) Japanese Patent No. 3996939

  However, in order to use a new authentication system such as the offline user authentication system that enables the matrix authentication described above, the user can purchase a license for a program for the new authentication system or use the system. Usually it is necessary to pay. Even if a new user authentication system provides higher security, an existing user authentication system can ensure a certain level of security if a program license fee or system usage fee is incurred. Is likely to continue to use. For this reason, even if it is a new user authentication system with high security, it is only used by some users who are active in security enhancement, and it is difficult to spread widely. Therefore, there is a problem that a developer of a new user authentication system cannot sufficiently recover development costs and maintenance costs.

  The present invention has been made in view of the above problems, and has the following characteristics. That is, the present invention presents a plurality of pattern elements arranged in a predetermined pattern as a presentation pattern to a user who is authenticated, and generates a one-time password by applying it to a pattern element at a specific position included in the presentation pattern. For performing user authentication using a one-time password derivation rule for the user as a password of the user, and for causing the client to perform content presentation type user authentication that forcibly presents content to the user during the user authentication A content presentation type authentication system, which manages a user ID of a user, a password, content data representing each content of a plurality of contents compulsorily presented at the time of user authentication, and each content ID of a plurality of contents, Content to user An authentication service providing server that provides additional authentication information, a content presentation type user authentication program and a processor for performing the content presentation type user authentication, and a client connected to the authentication service provision server via a network, The authentication service providing server includes a user information storage unit that associates and stores a user ID of a user and user attribute information representing the attribute of the user, a user ID of the user, and a one-time password derivation rule for the user Are stored in advance, a password storage unit for storing in advance, pattern specifying information generating means for generating a plurality of pattern specifying information for specifying the presentation pattern according to a predetermined generation rule, and generated by the pattern specifying information generating means Based on each of the plurality of pattern specifying information Verification code generation means for generating a verification code that is obtained by performing a one-way function operation on the result of applying the one-time password derivation rule associated with a user ID for each of the presentation patterns specified by The content presentation target user condition indicating the content ID of the content, the content data representing the content of the content, and the condition of the user who is the subject of the content for each content that is compulsorily presented at the time of user authentication Content information storage unit for storing content-related information including information, and user presentation information in which user attribute information associated with the user ID is included in the content-related information associated with the content ID for each user ID Multiple containers that meet conditions A plurality of pieces of authentication information including target content specifying means for specifying an ID, a verification code generated in association with each user ID, and pattern specifying information used to generate the verification code, and each user An authentication information storage unit that stores content data of each of the plurality of content IDs specified for the ID in association with each user ID, and an authentication information request including the user ID of the user who is going to be authenticated from the client Authentication information request receiving means for receiving through the network, and authentication information with content for transmitting the authentication information with content including a plurality of authentication information and a plurality of content data stored in association with the received user ID to the client Transmission means, and at the time of user authentication in the client When the content presentation type user authentication program operates on the processor, user ID input means for receiving an input of a user ID from a user, and an authentication information request including the input user ID to the authentication service providing server in the network Authentication information request transmitting means for transmitting through the contents, authentication information with contents receiving means for receiving the authentication information with contents transmitted from the authentication service providing server in association with the user ID, and received authentication information with contents Authentication information storage means for storing the information in association with the user ID, authentication information selection means for selecting one authentication information from a plurality of authentication information included in the authentication information with contents associated with the user ID, and the selection The password included in the authenticated authentication information From the pattern element string generating means for generating a pattern element string based on the pattern specifying information, a pattern display means for generating a presentation pattern based on the pattern specifying information and displaying it on the screen, and the user, One-time password input means for receiving an input of a one-time password that is a result of applying the one-time password derivation rule to a pattern element included in the presentation pattern, and the one-way function calculation is performed on the input one-time password A verification code included in the selected authentication information and a user authentication means for successfully authenticating the user if they are equal, and a plurality of content data included in the content-added authentication information Content data that is forcibly presented during user authentication according to the rules of Content selection means for selecting a data and content presentation means for forcibly presenting content to the user during user authentication based on the selected content data are realized.

According to the present invention, in the content presentation type authentication system described above, the content presentation type user authentication in the client is performed by installing the content presentation type user authentication program in the client, whereby the user authentication by the client OS embedded user authentication program is performed. Instead of being executed,
An installation program for installing the content presentation type user authentication program on the client operates on the client processor, whereby the content presentation type user authentication program is replaced with the OS built-in authentication program at the time of user authentication in the client. An installation unit that changes the setting of the OS to be activated may be realized.

  In the content presentation type authentication system, the content presentation type user authentication program is downloaded from the authentication service providing server to the client, and the authentication service providing server includes the content presentation type user authentication program and the installation program. A download request receiving means for receiving a download request for the content presentation type user authentication program and the installation program from the client through the network, and a download request receiving means for receiving a download request from the client. A program for transmitting the content presentation type user authentication program and the installation program to the client through the network. Gram transmission means, and the client transmits a download request for requesting transmission of the content presentation type user authentication program and the installation program to the authentication service providing server through the network, and Program receiving means for receiving the content presentation type user authentication program and the installation program from an authentication service providing server, and a program storage unit for storing the received program can be included.

  In the content presentation type authentication system, the content can be an advertisement.

  In the content presentation type authentication system, the authentication information storage unit of the authentication service providing server further includes a plurality of pieces of authentication information stored in association with each of the plurality of pieces of content data specified for the user ID. The content selection means in the client stores content data associated with the authentication information selected for the user authentication in order to forcibly present the content at the time of user authentication. You may make it select.

  In the content presentation type authentication system described above, the content related information associated with the content ID of the content includes a desired number of times of presentation indicating the number of times that the content is desired to be presented in one user authentication process, and a single user authentication of the content. A desired presentation condition including at least one of a desired presentation time indicating a time desired to be presented during processing and continuous presentation availability information indicating whether continuous presentation of the content is permitted; and the target content specifying means further includes the content Based on the desired presentation condition included in the content-related information associated with the content ID, at least the presentation time for the one presentation of the content and the continuous presence / absence information indicating whether or not to continuously present the content Content presentation attribute information including any one The content presentation attribute information that is created and associated with the content data associated with the content ID is stored in the authentication information storage unit and transmitted from the authentication service providing server to the client. The content presentation means may further forcibly present content to the user during user authentication according to the content presentation attribute information.

  In the above-described content presentation type authentication system, the authentication information selection unit of the client is already included in the authentication information with content associated with the user ID of the user who wants to receive authentication stored in the authentication information storage unit of the client. The selected authentication information is configured not to be selected, and the authentication with content associated with the user ID of the user who wants to receive authentication stored in the authentication information storage unit of the client by the authentication information selection unit of the client When all authentication information included in the information is selected for authentication of the user, the authentication information request transmission unit of the client sends an authentication information request including the user ID to the authentication service providing server through the network. Authentication information of the authentication service providing server The request receiving unit receives the authentication information request from the client through the network, and the authentication information providing unit with the content of the authentication service providing server receives a new ID associated with the user ID included in the received authentication request information. Content-added authentication information is transmitted to the client, and the content-added authentication information receiving means of the client adds content associated with the user ID included in the authentication information request transmitted from the content-added authentication service providing server. The authentication information may be received through the network, and the content-added authentication information storage unit of the client may be configured to update the content-added authentication information with the received content-added authentication information.

  In the content presentation type authentication system, the authentication service providing server further includes user information update means for updating information stored in the user information storage unit, and authentication information for updating information stored in the authentication information storage unit. An update means and at least one of content information update means for updating information stored in the content information storage unit can be provided.

  In the content presentation type authentication system, the target content specifying unit of the authentication service providing server has user attribute information associated with the user ID associated with the content ID for each of the user IDs at a predetermined timing. The plurality of content IDs that satisfy the content presentation target user condition included in the content related information are re-specified, and the respective content data of the plurality of content IDs re-specified for each user ID are associated with each user ID to perform the authentication The information storage unit may be updated.

  In the above-described content presentation authentication system, the pattern element sequence generation unit may be configured to generate a pattern element sequence based on a user ID in addition to the pattern specifying information.

  In the content presentation type authentication system, the user attribute information may include at least one of a user's age and sex.

  By adopting the above-described configuration, the present invention can forcibly present content such as advertisements to the user during user authentication, so that the content provider can bear a certain financial burden. It becomes. For this reason, the user's burden of the program license fee and the system usage fee for using the user authentication system of the present invention which provides an authentication means with high security and convenience called matrix authentication is reduced or made free of charge. The spread of the user authentication system can be promoted, and the development cost and maintenance cost of the user authentication system of the present invention can be sufficiently recovered.

  In the present invention, content is compulsorily presented during processing that must be executed by the user when the computer is started, such as user authentication, so that the user who operates the client for user authentication can reliably view the content. be able to. This is particularly effective when the content is an advertisement. Furthermore, since authentication information and content data can be managed in association with each other in the authentication information with content transmitted to the client, the content presented to the user can be easily grasped. This makes it possible to calculate the content provider's content provision fee clearly and easily.

It is a system configuration figure of a contents presentation type authentication system concerning one embodiment of the present invention. It is a hardware block diagram of the authentication service provision server and client in the content presentation type | mold authentication system which concerns on one Embodiment of this invention. It is a functional block diagram of an authentication service providing server and a client in a content presentation type authentication system according to an embodiment of the present invention. It is a flowchart which shows the outline of the whole process which concerns on one Embodiment of this invention. It is a flowchart of the user registration in the content presentation type user authentication which concerns on one Embodiment of this invention. It is a user information table which concerns on one Embodiment of this invention. It is a password table concerning one embodiment of the present invention. It is a flowchart of the content registration in the content presentation type user authentication which concerns on one Embodiment of this invention. It is a content information table which concerns on one Embodiment of this invention. It is a flowchart of the authentication information addition with content in the content presentation type user authentication which concerns on one Embodiment of this invention. It is an authentication information table with content which concerns on one Embodiment of this invention. It is a flowchart of authentication information acquisition with content in content presentation type user authentication concerning one embodiment of the present invention. It is a flowchart of the content presentation type user authentication in the content presentation type user authentication which concerns on one Embodiment of this invention. It is an image figure of the Windows logon authentication screen in the client which concerns on one Embodiment of this invention. It is a flowchart of re-acquisition of authentication information with contents in content presentation type user authentication concerning one embodiment of the present invention. It is a functional block diagram of an authentication service providing server and a client in a content presentation type authentication system according to an embodiment of the present invention. It is a flowchart of the authentication information addition with content in the content presentation type user authentication which concerns on one Embodiment of this invention. It is the 1st and 2nd object content table which concerns on one Embodiment of this invention. It is an authentication information table with content which concerns on one Embodiment of this invention. It is a flowchart of the content presentation type user authentication in the content presentation type user authentication which concerns on one Embodiment of this invention. It is a functional block diagram of the user authentication system of the conventional matrix authentication system. It is a conceptual diagram of the production | generation method of the presentation pattern in a matrix authentication system. It is a conceptual diagram of the one-time password input method in a matrix authentication system.

  First, terms used in this specification will be described below.

[Terminology-Presentation patterns and pattern elements]
A presentation pattern is a pattern in which pattern elements are arranged in a predetermined pattern. Typical examples of the predetermined pattern include a matrix arranged so as to form a square as a whole at each of vertical m × n horizontal positions, and a plurality of such matrices arranged. The shape of the figure can be made. In this specification, even when a presentation pattern having a shape other than the typical matrix shape is used, it is called a matrix authentication method. As the predetermined pattern, a regular shape or an impressive shape is easy to remain in the user's memory, and is therefore preferable because the user can easily memorize a one-time password derivation rule that is a password.

  A pattern element is an element arranged at a predetermined position so as to constitute a predetermined pattern in a presentation pattern, and is preferably a one-digit number from 0 to 9, but in addition, an alphabet, a symbol, etc. Can be any character. As symbols, “+”, “−”, “*”, “=”, “_”, “!”, “?”, “#”, “$” Assigned to the standard keyboard of the PC. Symbols such as “,” and “&” are particularly suitable. You can also use graphics, illustrations, photographs, and other designs as characters. Preferably, a plurality of the same pattern elements are displayed in the presentation pattern. In this way, the one-time password derivation rule that is the password and the one-time password that is the result of applying the one-time password derivation rule to the presentation pattern have a one-to-one correspondence, and automatically when the one-time password is entered One-way will be made. Therefore, even if the presentation pattern is specified from only one one-time password, the one-time password derivation rule cannot be specified.

  In the embodiment described below, as shown in FIG. 23, a one-digit number from 0 to 9 is used as a pattern element, and each pattern element is arranged in a predetermined pattern composed of four 4 × 4 matrices. The presentation pattern 2210 is assumed. When the screen area is small, such as a mobile phone, it is preferable to use a presentation pattern in which the number of 4 × 4 matrices is reduced to three.

[Terminology-Pattern specific information]
The pattern specifying information is information for specifying the presentation pattern 2210. Typical pattern specifying information is a pattern element string or a pattern seed value.

  The pattern element string is a pattern element string which is a one-digit number from 0 to 9 as shown in FIG. 22 and is data representing the contents of elements arranged in a predetermined pattern in order to generate the presentation pattern 2210. . Typically, all pattern elements included in the presentation pattern 2210 are arranged in order. The pattern element sequence 2190 does not have to be a single character string in which pattern elements are arranged in order, but means data including information on all pattern elements included in one presentation pattern 2210. It is. Therefore, as long as each pattern element included in the pattern element sequence 2190 is associated with each position in the presentation pattern, the order of the pattern elements included in the pattern element sequence 2190 is arbitrary. The pattern element sequence 2190 may be divided into a plurality of data.

  The pattern seed value is information for generating the presentation pattern 2210 according to a predetermined rule. As the predetermined rule, for example, a part of a value obtained by performing a hash function operation on the pattern seed value may be used as a pattern element string. By using the pattern seed value instead of the pattern element sequence itself, security can be improved. The pattern seed value is typically a numerical value within a predetermined range generated by a random number generation algorithm. As long as the pattern seed value is a numerical value within a predetermined range, it may be generated by generation rules other than the random number generation algorithm, for example, by counting up or down every predetermined value from a predetermined initial value. It is also possible to provide higher security by combining the user ID with the generated random number.

[Terminology-One-time password derivation rules]
The one-time password derivation rule is a rule for generating the one-time password 2310 by being applied to a pattern element at a specific position included in the presentation pattern 2210, and is data that functions as a user password. The rule applied to the pattern element is typically a pattern element at which position is selected in which order. In this case, the one-time password derivation rule is information on a combination of the position of each selected pattern element included in the presentation pattern 2210 and the order in which each pattern element is selected. In addition, a fixed password component that is not based on the presentation pattern 2210 can be included in the one-time password.

[Terminology-One-time password]
The one-time password 2310 is a one-time password that is generated and input when a user who wants to receive authentication applies his / her one-time password derivation rule to the presentation pattern 2210. FIG. 23 is a conceptual diagram of a one-time password input method in the matrix authentication method. The one-time password derivation rule used in FIG. 23 is to select pattern elements at positions in the presentation pattern indicated by circles in order from the left. The user generates and inputs “2504” as the one-time password by selecting the pattern elements at the predetermined positions included in the presentation pattern 2210 in a predetermined order according to the one-time password derivation rule.

[Terminology-Verification code]
The verification code is data for verifying the validity of the input one-time password. The verification code performed a one-way function operation on the result of applying the user's own one-time password derivation rule to each of a plurality of presentation patterns that can be displayed on the client based on a plurality of pattern specifying information. Is. That is, the verification code is obtained by performing a one-way function operation on the same value as the correct one-time password, which is the result of applying the correct one-time password derivation rule associated with the user who is going to be authenticated to the correct presentation pattern. It is. Accordingly, the verification code is stored in the client in association with the pattern specifying information for specifying the presentation pattern used to generate the verification code. At the time of user authentication in the client, a value obtained by performing the same one-way function operation as that used when generating the verification code on the one-time password input based on the presented presentation pattern, and the verification code corresponding to the presentation pattern By comparing, the validity of the one-time password is verified. Here, even if the verification code is not hashed, it is natural that the validity of the one-time password can be verified. However, since such a verification code is equivalent to a correct one-time password, when the client PC is analyzed by a malicious third party, a plurality of pairs of the presentation pattern and the correct one-time password are known. Therefore, there is a problem that a one-time password derivation rule that is a password is specified. By making the verification code hashed, it is impossible to specify the correct one-time password from the verification code, so even if the client PC is analyzed by a malicious third party, the one-time password that is the password Derivation rules never leak.

[Terminology-one-way function and hash function]
A one-way function is a function in which an output value applied to a certain input value can be easily calculated, but it is extremely difficult to obtain the original input value from the output value. The hash function refers to a function having a one-way characteristic that is a characteristic of the one-way function, and having a collision resistance that the probability that the output values are the same when the original input values are different is extremely small. The hash function normally generates a certain range of output values regardless of the input value. The one-way function is a concept that includes a hash function, and the one-way function and the hash function can be used almost in the same way, but when higher collision tolerance is required due to a large range of input values, etc. It is preferable to use a hash function. In the present invention, it is naturally possible to use a hash function instead of a one-way function, but it is also possible to use a one-way function instead of a hash function.

[Configuration of Content Presentation Authentication System]
FIG. 1 shows a system configuration of an embodiment of a content presentation type authentication system according to the present invention. The content presentation type authentication system 100 according to the present embodiment includes an authentication service providing server 110 for providing an authentication service to a user client, and clients 120-1 to 120-N that are a plurality of users' PCs, mobile phones, and the like. Is provided. The authentication service providing server 110 and the client 120 are connected by a network 130. The network may be a Windows domain network operating with a TCP / IP based protocol. In this specification, Windows is described as an example of the OS. However, other OS such as Mac OS (registered trademark), Linux (registered trademark), Unix (registered trademark), and the like may be used. It is. The content presentation authentication system 100 may further include a content providing server 140 and a settlement server 150. The content providing server 140 provides content information to be provided to the client 120 to the authentication service providing server 110. The settlement server 150 is a server for performing online settlement when money is exchanged between the content provider and the authentication service provider due to the provision of the content. The content providing server 140 and the settlement server 150 may be connected to the authentication service providing server 110 via the network 130 or may be directly connected via a dedicated line.

[Hardware configuration of content presentation type authentication system]
Next, the hardware configuration of the authentication service providing server 110 and the client 120 in the content presentation type authentication system 100 will be described with reference to FIG. The same components as those shown in FIG. 1 are described using the same reference numerals in FIG.

  The authentication service providing server 110 includes a CPU 200, a RAM 201, a user interface (I / F) 202, an external / network interface (I / F) 203, and a storage device 204. The storage device 204 stores the OS and the user authentication support application in its storage area, and further includes a program storage unit 206 and an information storage unit 207. The program storage unit 206 stores a content presentation type user authentication program and an installation program. The content presentation type user authentication program is a program for operating the client 120 to cause the client to perform content presentation type user authentication that forcibly presents content to the user during user authentication. The installation program is a program for installing the content presentation type user authentication program on the client. The information storage unit 207 stores user information regarding each user, a one-time password derivation rule that is a password for each user, content information regarding content to be presented to the user, authentication information necessary for user authentication, and the like. The information storage unit 207 may be implemented as a device different from the authentication service providing server 110, or may be implemented as a separate device for each type of information.

  The client 120 includes an external / network interface (I / F) 250, a user interface (I / F) 251, a RAM 252, a CPU 253, and an information storage device 254. The storage device 254 stores an OS and a content presentation type user authentication program in the storage area. Further, authentication information necessary for user authentication of each user is stored in the storage area. When the content presentation type user authentication program is a pre-installation type program preinstalled in the OS, the authentication service providing server 110 does not need to store the content presentation type user authentication program and the installation program, and the client 120 is installed. There is no need to remember the program.

[Functional Block of Content Presentation Authentication System in First Embodiment]
Next, functional blocks of the content presentation authentication system 100 according to the first embodiment of the present invention will be described. FIG. 3 shows a hardware configuration of the authentication service providing server 110 and the client 120 shown in FIG. 2. The user authentication support application is operated on the CPU 200 of the authentication service providing server 110 and the content presentation type is executed on the CPU 253 of the client 120. The functional block diagram in this embodiment of the authentication service provision server 110 and client 120 in this embodiment implement | achieved by operating an authentication program is shown.

  In the present embodiment, the download request receiving unit 301, the program transmitting unit 302, the authentication information request receiving unit 311 and the authentication information transmitting unit 312 of the authentication service providing server 110 are the CPU 200, RAM 201 and external / network of the authentication service providing server 110. This is a functional block realized by the interface 203 and the like cooperating with software such as a user authentication support application. The download request receiving unit 301 receives a download request 350 that requests downloading of the authentication program. The program transmission unit 302 reads and transmits the installation program and the authentication program 351 from the program storage unit 303 in response to the download request transmission unit 301 receiving the download request. The authentication information request unit 311 receives an authentication information request 352 for requesting authentication information for use in user authentication. The authentication information transmission unit 312 reads the authentication information 353 from the authentication information storage unit 310 and transmits it to the client 120 in response to the authentication information request unit 311 receiving the authentication information request 352.

  The program storage unit 303, password storage unit 306, user information storage unit 307, content information storage unit 308, and authentication information storage unit 310 are the CPU 200, RAM 201, program storage unit 206, information storage unit 207, and the like of the authentication service providing server 110. It is a functional block realized by cooperating with software such as a user authentication support application. The program storage unit 206 stores an authentication program that operates in the client 120 and an installation program for installing the authentication program in the client. The password storage unit 306 stores a user ID and a one-time password derivation rule for each user ID in association with each other. The user information storage unit 307 stores a user ID and user attribute information for each user ID in association with each other. The content information storage unit 308 stores the content ID, the content data of the content ID, and the content related information in association with each other. The authentication information storage unit 310 associates authentication information and content data for each user ID with the user ID and stores them as content-added authentication information. The authentication information storage unit 310 may store the authentication information with contents in a non-volatile memory such as a hard disk, or may store it in a volatile memory such as a RAM.

  The pattern specifying information generating unit 304, the verification code generating unit 305, and the target content specifying unit 309 are functional blocks realized by the CPU 200 and the RAM 201 of the authentication service providing server 110 cooperating with software such as a user authentication support application. is there. The pattern specifying information generating unit 304 generates a plurality of pattern specifying information at a predetermined timing according to a predetermined generation rule. The verification code generation unit 305 reads each user ID and the one-time password derivation rule for each user ID from the password storage unit 306, and for each of the presented patterns specified by each of the generated plurality of pattern specifying information. Thus, a verification code obtained by performing a one-way function operation on the result of applying the one-time password derivation rule for each user ID is generated and output to the authentication information storage unit 310 together with the pattern specifying information. The target content specifying unit 309 specifies the content ID to be forcibly presented to each user based on the user attribute information and the content related information, and outputs the content ID to the authentication information storage unit 310.

  The download request unit 321, program reception unit 322, user ID input unit 324, authentication information request transmission unit 325, authentication information reception unit 330, pattern display unit 334, one-time password input unit 335, and content presentation unit 337 of the client 120 include: This is a functional block realized by the external / network interface 250, the user interface 251, the RAM 252 and the CPU 253 of the client 120 cooperating with software such as an authentication program. The download request means 321 transmits a download request 350 for requesting downloading of the authentication program. The program receiving unit 322 receives the installation program and the authentication program 351. The user ID input unit 324 receives an input of the user ID of the user and outputs it to the authentication information request transmission unit 325, the authentication information selection unit 332, and the content selection unit 336. The authentication information request transmission means 325 transmits an authentication information request 352 for requesting authentication information for use in user authentication. The authentication information receiving unit 330 receives the authentication information 353. The pattern display unit 334 displays a presentation pattern based on the pattern element sequence generated by the pattern element sequence generation unit 333. The one-time password input unit 335 accepts an input of a one-time password from the user based on the presentation pattern displayed by the pattern display unit 334. The content presentation unit 337 is for forcibly presenting the content to the user based on a predetermined number of content data selected by the content selection unit 336.

  The program storage unit 323 and the authentication information storage unit 331 are functional blocks that are realized when the RAM 252, the CPU 253, the information storage unit 256, and the like of the client 120 cooperate with software such as an authentication program. The program storage unit 323 stores the authentication program received by the program receiving unit 322. The authentication information storage unit 331 stores the content-added authentication information 353 received by the authentication information receiving unit 330.

  The authentication information selection unit 332, the pattern element sequence generation unit 333, the content selection unit 336, and the user authentication unit 338 are functional blocks realized by the RAM 252 and the CPU 253 of the client 120 and the like cooperating with software such as an authentication program. . The authentication information selection means 332 selects one authentication information for the user ID output from the user ID input means 324 and outputs it to the pattern element string generation means 333 and the user authentication means 338. The pattern element sequence generation unit 333 generates a pattern element sequence based on the pattern specifying information included in the authentication information received from the authentication information selection unit 332 and outputs the pattern element sequence to the pattern display unit 334. The content selection unit 336 selects and reads out a predetermined number of content data for the user ID received from the user ID input unit 324 from the authentication information storage unit 331, and outputs it to the content presentation unit 337. The user authentication unit 338 compares the one-time function input to the one-time password input by the one-time password input unit 335 with the verification code included in the authentication information received from the authentication information selection unit 332; It authenticates the user when they are equal.

[Operation of Content Presenting Authentication System in First Embodiment]
Next, the operation of the content presentation type authentication system 100 according to the first embodiment of the present invention will be described. FIG. 4 schematically shows the entire processing in an embodiment of the content presentation type authentication system according to the present invention. In the processing in the present embodiment, first, user information and password information for user authentication are registered in the authentication service providing server 110 in the user registration stage (S401). Further, in the content registration stage (S402), the content information is registered in the authentication service providing server 110. Next, in the authentication information with content generation step (S403), authentication information with content is generated for each user ID based on the registered user information, password information, and content information. Then, in the authentication information with content acquisition step (S404), the authentication information with content is transmitted from the authentication service providing server 110 to the client 120. Then, in the content presentation type user authentication stage (S405), content is forcibly presented to the user and user authentication is performed based on the authentication information with content for the user ID to be authenticated. Further, in the authentication information with content reacquisition step (S406), it is confirmed whether or not all authentication information stored in the client 120 for the authenticated user ID is selected, and when all the authentication information is used, The client 120 acquires the authentication information with contents from the authentication service providing server 110 again. Hereinafter, these steps will be described in detail.

[User registration stage]
FIG. 5 shows a flowchart of the user registration stage. In this embodiment, the user authentication is logon authentication to the Windows (registered trademark) of the client 120, but may be other user authentication such as logon authentication to another OS or logon authentication to a company network. . First, a user who desires to use the content presentation type user authentication service transmits a download request from the client 120 to the authentication service providing server 110 by the download request transmission unit 321 in order to download the content presentation type user authentication program (S501). ). In this embodiment, transmission of a download request from the client 120 is assumed to be access to a Web page provided by the authentication service providing server 110 for program download. When the download request receiving unit 301 receives the download request (S502), the authentication service providing server 110 requests the client to transmit user attribute information representing user attributes such as age and gender (S503). In the present embodiment, a user attribute information request is transmitted by requesting the user to input user attribute information (age and gender) representing the user's attribute on the download Web page prior to downloading. When the client 120 receives the user attribute information request (S504), the user transmits user attribute information from the client 120 (S505). In the present embodiment, the user inputs these pieces of information on a Web page from a user interface such as a keyboard and transmits the information to the authentication service providing server 110. The authentication service providing server 110 adds the registration date of the information to the received user attribute information, assigns a user ID, and stores it in the user information storage unit 307. In the present embodiment, the user information storage unit 307 stores a user ID and user attribute information in association with each other in the form shown in FIG. The user attribute information may include a date of birth, a living area, a hobby, or the like, or may not include an age, sex, and registration date.

  Next, the authentication service providing server 110 reads the content presentation type user authentication program and the installation program from the program storage unit 303 by the program transmission unit 302 and transmits them to the client 120 (S508). The client 120 installs the content presentation type user authentication program by executing the installation program received by the program receiving means 322 (S509). In the present embodiment, installation means that an authentication program is stored in the program storage unit 323 of the client 120 and the content presentation type user authentication program is started instead of user authentication by a logon authentication program incorporated in the client's Windows. In this way, the setting of Windows is changed.

Specifically, the setting change of the logon authentication program in Windows is performed as follows. First, a content presentation type user authentication program is created as a DLL file for Windows. Here, a DLL file named “SmxGina.dll” is created. Here, the Windows logon authentication screen program is designated as key data named “GinaDLL” in the registry location shown below.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon
The Windows built-in logon authentication module is a DLL file “msgina.dll”, which is set in the key data named “GinaDLL” described above. When the key data is rewritten to “SmxGina.dll”, the logon authentication module “SmxGinaDLL” for executing the authentication method according to the present invention is called at the time of logon authentication.

  The content presentation type user authentication program and the installation program may be an integrated program. Further, when the user first downloads the installation program and starts the downloaded installation program, the installation program may cause the client 120 to download the content presentation type user authentication program. A storage medium such as a CD or a DVD that stores the content presentation type user authentication program and the installation program may be sent to the user by mail or the like, and the user may use this storage medium to install to the client. Further, the content presentation type user authentication program may be a logon authentication program incorporated in advance in Windows. The user attribute information may be registered by accessing the user attribute information registration Web page of the authentication service providing server 110 independently of the download procedure of the content presentation type user authentication program. The user attribute information may be sent from the user to the authentication service provider by mail or the like, and based on this, the authentication service provider may input the authentication service provider server 110 via the user interface.

  Next, the user who is to be authenticated registers a one-time password derivation rule, which is a password, in the authentication service providing server 110. First, when the content presentation type user authentication program installed in the client 120 is operated on the CPU 253 of the client 120, a screen for inputting a user ID for registering a one-time password derivation rule is displayed. The user inputs the user ID via the user ID input means 324 and transmits the user ID to the authentication service providing server 110 (S510). Upon receiving the user ID, the authentication service providing server 110 checks whether or not the user ID is stored in the user information storage unit 307 (S511). If already stored, the authentication service providing server 110 transmits the pattern specifying information for two times to the client 120 for password registration (S512). If not registered, the authentication service providing server 110 transmits an NG message, and the client 120 displays that an unregistered user ID has been input, and again displays an input screen for inputting the user ID. Display (not shown).

  When the client 120 receives the pattern specifying information for two times (S513), the client 120 displays the presentation pattern twice based on the information, and the user displays the presentation pattern according to the one-time password derivation rule that the user intends to register. The pattern elements included in the are selected, and the one-time password is input twice (S515). The client 120 transmits the input two-time one-time password to the authentication service providing server 110 (S516).

  The authentication service providing server 110 receives two one-time passwords (S515). Then, the authentication service providing server 110 specifies the one-time password derivation rule of the user based on the transmitted pattern specifying information for two times and the received one-time password, and associates the user with the user ID of the user for authentication. The password is stored in the password storage unit 306 in the service providing server 110 (S516). In the present embodiment, the password storage unit 306 stores the user ID and the one-time password derivation rule in association with each other in the form shown in FIG. The authentication service providing server transmits an OK message indicating that the password registration has been normally performed to the client (not shown). Upon receiving this OK message, the client 120 displays the registered one-time password derivation rule on the display of the client 120 and allows the user to confirm the one-time password derivation rule (not shown), and ends the user registration. To do.

  If the one-time password derivation rule is generated so that the second presentation pattern is significantly different from the first presentation pattern, the one-time password derivation rule can be specified by presenting the second presentation pattern. It is. If the one-time password derivation rule cannot be specified by presenting the two presentation patterns, the authentication service providing server 110 transmits new pattern specifying information to the client 120 until the one-time password derivation rule can be specified. The client repeatedly transmits a one-time password based on the new pattern specifying information (not shown). In the present embodiment, the pattern specifying information transmitted from the authentication service providing server 110 is twice, but may be transmitted once, or may be transmitted three times or more at a time.

[Content registration stage]
FIG. 8 shows a flowchart of the content data registration stage. First, the content providing server 140 transmits a content upload request to the authentication service providing server 110 (S801). Typically, the content is advertisements, service information such as product support information, and music and movies for promotion of music and movies. It can also be news, novels, movies, photos, television programs, anime, music, games, manga, and the like. In the present embodiment, the transmission of the upload request from the content providing server 140 is an access to a Web page provided by the authentication service providing server 110 for content upload. When receiving the content upload request (S802), the authentication service providing server 110 transmits a content information request (S803). In the present embodiment, the authentication service providing server 110 transmits a content information request by requesting input of content information on this Web page. The content information includes the name of the content provider that provides the content, content data representing the content, and content-related information. The content related information includes content presentation target user conditions. The content presentation target user condition can be the gender (male or female) and age (for example, teens to 20s) that the content provider desires to present the content. The content related information may include other information corresponding to the content. The content providing server 140 transmits the content information by inputting and transmitting the content information on the Web page (S805). Upon receiving the content information (S806), the authentication service providing server 110 assigns a content ID and a content provider ID to the content information and stores them in the content information storage unit 308 (S807). The content information storage unit 308 stores the content ID, the content provider ID, and the content related information in association with each other in the form shown in FIG.

  Further, by using the payment server 150, online payment between the authentication service provider and the content provider can be performed. Typically, when the content is an advertisement, the content provider pays an authentication fee to the authentication service provider based on the number of user IDs that distributed the advertisement, the total number of advertisements presented to the user, and the like. Do. The authentication service providing server 110 or the content providing server 140 that requests payment can access the payment server 150 at a predetermined timing to make a payment request for making the payment described above. The content providing server 140 can specify the payment target by the content provider ID.

[Authentication information generation stage with contents]
FIG. 10 shows a flowchart of the authentication information generation step with content. This step may be performed simultaneously for a plurality of or all user IDs, or may be performed for one user ID. This stage is started at a predetermined timing. The predetermined timing is typically a timing specified by an authentication information update unit described later when a new user ID is registered, or when the authentication service providing server 110 receives an authentication information request from a client 120 described later. It is. First, the pattern specifying information generating unit 304 generates a plurality of pattern specifying information according to a predetermined generation rule (S1001). The predetermined generation rule is typically to generate a 64-digit random number as a pattern element string or pattern seed value and use it as pattern specifying information. The verification code generation unit 305 reads each user ID and the one-time password derivation rule for each user ID from the password storage unit 306 (S1002). Then, the verification code generation unit 305 applied the one-time password derivation rule for each user ID to each of the presentation patterns specified by a predetermined rule based on each of the generated plurality of pattern specifying information. A verification code that is obtained by performing a one-way function operation on the result is generated (S1003).

  When the pattern specifying information is the pattern element sequence itself, the predetermined rule for specifying the presentation pattern based on the pattern specifying information is typically four patterns elements included in the pattern element sequence. It is arranged at the position of each element of a pattern consisting of a 4 × 4 matrix. When the pattern specifying information is a pattern seed value, a pattern element sequence is generated based on the pattern seed value and is arranged at the position of each element of a pattern composed of four 4 × 4 matrices. The presentation pattern is specified by For example, an encryption operation using a numeric string as a pattern seed value as a kind of initial value is performed to generate a bit string having a predetermined bit length. Here, the predetermined bit length is 256 bits, which is an amount of information sufficient to generate a presentation pattern 2190 composed of 64 numbers. As the encryption operation, it is only necessary that it is practically impossible to obtain the original numeric string from the operation result, and a hash function operation, a common key encryption operation, and the like can be used. For example, when SHA256 is used as a hash function and the predetermined numeric string is encrypted, a 256-bit bit string can be generated. In addition, when AES is used as a common key encryption operation, a key is generated from the predetermined numeric string, and when a 256-bit numeric string appropriately set in advance is encrypted with the key, a 256-bit bit string 384 is generated. can do. Next, a 256-bit bit string is converted into a 77-digit decimal number, and a 64-digit number is extracted therefrom to form a pattern element string. Extraction of 64-digit numbers can use any operation such as deletion of unnecessary upper bit strings, deletion of unnecessary lower bit strings, and division. In this way, if the presentation pattern is specified by a predetermined rule based on the pattern seed value, even if the pattern seed value is stolen by eavesdropping or the like, the presentation pattern can be specified if the predetermined rule is not known. Can not. Therefore, even if the one-time password input based on the presentation pattern is stolen, the password derivation rule cannot be specified, so that high security can be provided. Furthermore, the presentation pattern can be specified by combining the user ID with the pattern seed value. For example, it is a pattern element sequence uniquely determined for a combination of a user ID and a pattern seed value, and it is extremely difficult to estimate the original input user ID and pattern seed value from only the pattern element sequence. Generate something. Typically, the combination of the user ID and the pattern seed value is used as a kind of initial value, and the presentation pattern is specified by the same method as that based on the above-described pattern seed value alone. As a method of combining the user ID and the pattern seed value, the user ID and the pattern seed value expressed in hexadecimal can be combined using any operation such as combining, addition, subtraction, exclusive OR, etc. . By combining the user ID with the pattern seed value, it becomes more difficult to specify a presentation pattern by a malicious third party, and thus higher security can be provided.

  Next, the target content specifying unit 309 performs processing for specifying the content to be forcibly presented to each user based on the user attribute information and the content related information. That is, the target content specifying unit 309 reads the user ID and user attribute information from the user information storage unit 307 and reads the content ID, content data, and content related information from the content information storage unit 308 (S1004). Then, for each user ID, the target content specifying unit 309 has a plurality of content IDs that satisfy the content presentation target user condition in which the user attribute information associated with the user ID is included in the content related information associated with the content ID. Is identified. For example, when the user attribute information associated with the user ID = U000 is “sex” = “female” and “age” = “15 years old”, the content presentation target user condition for the content ID = C000 is “sex”. Since “female” and “age” = “teenage”, the user ID is specified as a presentation target for C000. However, when the content presentation target user condition of content ID = C001 is “gender” = “male” and “age” = “teens”, content ID = C001 is not specified as a presentation target for user ID = U000. . When the content is paid content such as music, the content presentation target user condition is a purchaser of the paid content, and the user attribute information indicates whether the purchaser is the paid content purchaser. Information may be added. In this way, the content can be presented only to the user who the content provider desires to present.

  Based on the pattern identification information and verification code received from the verification code generation unit 305 and the plurality of identified content IDs received from the target content identification unit 309, the authentication information storage unit 310 performs the following processing for each user ID. A plurality of authentication information for each user ID and content data of a plurality of specified content IDs are stored (S1006). In this specification, information including a plurality of authentication information and a plurality of content data is referred to as content-added authentication information. Each authentication information includes pattern specifying information and a verification code generated based on the pattern specifying information and the one-time password derivation rule. The authentication information storage unit 310 stores authentication information and content data including pattern specifying information and a verification code in association with a user ID in the form shown in FIG. Prior to the authentication information request from the client 120, the authentication information storage unit 310 can generate authentication information with contents and store it in advance. The authentication information with contents may be stored in a non-volatile memory such as a hard disk, or may be stored in a volatile memory such as a RAM. If authentication information with contents is generated and stored in advance, it becomes possible to provide such information at a minimum server load in response to an authentication information request from a client. In addition, in response to the authentication information request, the content-added authentication information generation step for the user ID that has transmitted the authentication information request is started and stored temporarily for transmission to the client 120. You may do it. In this case, the authentication information with contents is preferably stored in a volatile memory such as a RAM. In this way, the capacity of the storage unit such as a hard disk can be reduced.

[Authentication information with content acquisition stage]
FIG. 12 shows a flowchart of the authentication information acquisition step with contents. In this stage, the client 120 acquires authentication information with contents including a plurality of authentication information and a plurality of contents data from the authentication service providing server 110 prior to user authentication. The client 120 can perform user authentication a plurality of times by using a plurality of authentication information included in the acquired authentication information with contents. As a result, even when the client 120 is in an offline state where it is not connected to the server, user authentication can be performed a plurality of times as many times as the number of authentication information included in the already acquired authentication information with contents. Hereinafter, this stage will be described in detail.

  First, before receiving authentication, a user who wants to receive authentication transmits an authentication information request for requesting authentication information to the authentication service providing server 110 by the authentication information request transmitting unit 325 of the client 120 (S1201). The authentication information request includes the user ID of the user who is going to be authenticated. In this embodiment, the authentication information request is transmitted by accessing a Web page provided by the authentication service providing server 110 for acquiring authentication information, and inputting the user ID on this Web page via the user ID input means 324. This is done by requesting authentication information. The authentication service providing server 110 receives the authentication information request including the input user ID transmitted from the client 120 by the authentication information request receiving unit 311 and extracts the user ID from the authentication information request (S1202). Next, the authentication service providing server 110 reads, from the authentication information storage unit 310, the authentication information transmitting unit 312 from the authentication information storage unit 310 by reading authentication information with contents including a plurality of authentication information and a plurality of content data associated with the extracted user ID. And transmitted to the client 120 (S1203). The authentication information with content transmitted by the authentication information transmitting unit 312 may include all authentication information and content data stored in the authentication information storage unit 310 in association with the user ID, or a part of them. Also good. Next, when the authentication information receiving means 330 receives the content-added authentication information, the client 120 associates it with the input user ID and stores it in the authentication information storage unit 331 of the client 120. Similar to the authentication information storage unit 310 of the authentication service providing server 110, the authentication information storage unit 331 of the client 120 stores the authentication information with contents in the form described in FIG. Through the above operation, the content-added authentication information corresponding to the input user ID is stored in the client 120, and user authentication can be executed based on the information. Since the authentication information with contents is stored on the client 120, it is not necessary to be connected to the server at the time of user authentication, and in that state, multiple times corresponding to the number of authentication information included in the stored authentication information with contents. User authentication is possible.

[Content presentation type user authentication stage]
FIG. 13 shows a flowchart of the content presentation type user authentication stage. First, the user ID input unit 324 of the client 120 receives an input of a user ID from the user (S1301). In the present embodiment, the Windows logon authentication screen A1400 shown in FIG. 14 is displayed on the display to prompt the user to input a user ID, and the user inputs his / her user ID in the user name field on the logon authentication screen A. . When logging on to a Windows domain network, enter the domain network name of the logon destination in the logon destination field.

  Next, the authentication information selection unit 332 of the client 120 selects and reads one authentication information from a plurality of authentication information in the authentication information storage unit 331 associated with the input user ID according to a predetermined rule (S1302). . In the present embodiment, the selected authentication information is used for authentication of the user among the plurality of stored authentication information until the authentication information is newly acquired and stored from the authentication service providing server 110 next time. Those already selected to do are not selected. By doing in this way, a different presentation pattern can be displayed for every user authentication, and a brute force attack can be eliminated, so that security can be further improved. For example, when 100 pieces of authentication information are stored, user authentication can be performed 100 times continuously until new authentication information is acquired. When there is less authentication information not selected, a warning to that effect is displayed. Once all authentication information has been selected, no further new user authentication is possible.

  Next, the content selection unit 336 selects and reads the content data according to a predetermined rule from the plurality of content data associated with the input user ID in the authentication information storage unit 331, and the content presentation unit 337 is selected. The content is forcibly presented to the user based on the predetermined number of content data (S1303). Typically, the predetermined rule for selecting content data is to select in the order of the memory addresses of the authentication information storage unit. In the present embodiment, as the selected content data, until the next authentication information with content is acquired and stored from the authentication service providing server 110, the user's data among the plurality of stored content data is stored. Those already selected for authentication are not selected. Then, the content selection unit 336 selects the content data so that all the stored content data is selected when all the stored authentication information is selected. For example, the content-added authentication information includes content data three times as many as the authentication information, and the content selection unit 336 selects three content data for each authentication. By doing so, it is ensured that the content data transmitted from the authentication service providing server 110 is forcibly presented to the user, so that the number of times the content is actually presented can be easily grasped. Therefore, for example, when the content is an advertisement, the advertisement fee can be clearly calculated. Typically, the content is presented by displaying a logon authentication screen B1402 including a presentation pattern 1403 after requesting user authentication by entering the user ID in the user name field on the Windows logon authentication screen A1400. Before doing so, three contents are displayed on the contents presentation screen 1401 for 5 seconds each. By doing in this way, since the user is viewing the display for user authentication, the user can be surely viewed the content.

  Next, the pattern element string generation unit 333 of the client 120 generates a pattern element string based on the pattern specifying information included in the selected authentication information, and the pattern display unit 334 generates each pattern element of the pattern element string generated. The image of the presentation pattern 1403 arranged at the position of each element of the pattern composed of four 4 × 4 matrices is generated and displayed (S1304). The presentation pattern can be specified based on the pattern specifying information according to the predetermined rule described above with reference to the verification code generation unit 305. Typically, as shown in FIG. 14, following the content presentation screen 1401, a logon authentication screen B 1402 including a presentation pattern 1403 is displayed on the screen of the client 120. When the pattern specifying information is the pattern element sequence itself, the pattern element sequence generation unit 333 reads the pattern element sequence from the authentication information and outputs it as it is to the pattern display unit 334.

  Next, the user who intends to receive authentication selects one of the pattern elements displayed at a specific position of the presentation pattern 1403 displayed on the screen of the client 120 by the one-time password input means 335 in order, The one-time password as a result of applying the one-time password derivation rule to the presentation pattern 1403 is input to the client 120 (S1305). The user authentication unit 338 of the client 120 compares the one-time password input by the one-time password input unit 335 with the verification code included in the selected authentication information (S1306). If they are equal, the user authentication of the user is successful. If they are not equal, the presentation pattern may be displayed again based on the pattern specifying information to prompt the user to re-enter the one-time password (S1304, S1305). Authentication information for a presentation pattern to be displayed again may be selected again or reused. Moreover, you may return to S1301 in order to prompt the user to input the user ID again. The one-way function calculation applied to the one-time password at the client is the same as the position-direction function calculation applied when the verification code included in the authentication information is generated at the authentication service providing server.

  The presentation of content may be performed at a predetermined position on the screen while displaying the logon authentication screen A1400 and the logon authentication screen B1402, or may be performed after the logon authentication is successful. Since some time during which computer operation cannot be performed due to processing such as computer startup after successful login authentication occurs, content can be forcibly presented without burdening the user if the content is presented to the user at that time. it can. When the content is a music piece, the output may be continued while the logon authentication process is performed.

  By presenting the content at the time of user authentication, the user who operates the client for user authentication always views the content. Since the presented content is appropriately specified for each user based on the content presentation target user condition, the user can view the content that interests him / herself. Further, when the content is an advertisement, it is ensured that the advertisement is viewed by an appropriate user, so that the advertisement can be effectively performed.

[Authentication information reacquisition stage with content]
It is preferable that the plurality of pieces of authentication information included in the content-added authentication information is used only once and the authentication information used once is not used. This is because by displaying different presentation patterns using different authentication information each time for user authentication, it is possible to eliminate brute force attacks and provide higher security. Accordingly, when the authentication information used once is not used, when the authentication information included in the authentication information with contents acquired by the client 120 is used or when a predetermined number is used, the client 120 is used. Re-acquires new authentication information with contents in order to acquire new authentication information. In addition, when a certain period of time has elapsed since the authentication information with content was previously acquired, the content included in the authentication information with content may be old information. Even in such a case, it is preferable to reacquire new authentication information with contents.

  FIG. 15 is a flowchart of the authentication information reacquisition stage with contents. Whether or not all authentication information associated with the authenticated user ID and stored in the authentication information storage unit 331 of the client 120 has been selected for authentication of the user ID after successful user authentication. Is confirmed (S1501).

  When all the authentication information is used, the authentication information request transmission unit 325 of the client 120 transmits an authentication information request for the user ID again (S1502). In this embodiment, an authentication information acquisition Web page provided by the authentication service providing server 110 is accessed, and a screen prompting to reacquire new authentication information is displayed on the display of the client 120. In accordance with this display, the user accesses a Web page for acquiring authentication information and inputs his or her user ID on this Web page to request authentication information.

  When the authentication information request is received by the authentication information request transmission unit 311, the authentication service providing server 110 extracts the user ID included in the authentication request (S 1503). Then, the authentication information transmitting unit 312 reads out the authentication information with contents associated with the user ID from the authentication information storage unit 310, and retransmits it to the client 120 via the network 130 (S1504). Here, it is preferable that the authentication information included in the authentication information with contents to be retransmitted is different from the authentication information that it has already been transmitted. This is because, as described above, by using different authentication information, different presentation patterns can be displayed and brute force attacks can be eliminated, so that security can be further improved.

  The client 120 receives the re-transmitted content-added authentication information by the authentication information receiving unit 330 and stores it in the authentication information storage unit 331 in association with the user ID, thereby updating the content-added authentication information (S1505). . The content-added authentication information reacquisition step described here may be performed at another timing such as before user authentication starts.

[Information update stage]
The authentication service providing server 110 may include means for updating information stored in the user information storage unit 307, the content information storage unit 308, and the authentication information storage unit 310 at a predetermined timing. For example, the user information update unit updates the age of the user information in the user information storage unit 307 that has passed one year or more from the registration date and time of the user information once a year according to the elapsed year from the registration date and time. The content information update unit deletes the content stored in the content information storage unit 308 when a certain period has passed since registration. Further, the authentication information update unit operates the pattern specifying information generation unit at a predetermined timing, and stores new authentication information with content based on the latest information in the user information storage unit 307 and the content information storage unit 308. Store in the unit 310. The predetermined timing is typically at regular intervals, when a new user is registered, or when each piece of information is updated by the user information updating unit or the content information updating unit. Also, the timing at which the information stored in the user information storage unit 307, the password information storage unit 306, and the content information storage unit 308 is updated may be used.

[Content Presentation Type Authentication System in Second Embodiment]
Next, the content presentation type user authentication system according to the second embodiment of the present invention will be described focusing on differences from the content presentation type user authentication system according to the first embodiment. The same configurations and the same steps as those in the first embodiment are referred to by the same numbers. FIG. 16 is a diagram showing the hardware configuration of the authentication service providing server 110 and the client 120 shown in FIG. 2. The user authentication support application is operated on the CPU 200 of the authentication service providing server 110 and the content presentation type is executed on the CPU 253 of the client 120. The functional block diagram in this embodiment of the authentication service provision server 110 and client 120 in this embodiment implement | achieved by operating an authentication program is shown.

  Hereinafter, functional blocks different from those in the first embodiment will be described. The target content specifying unit 1601 of the target content server 110 is a functional block realized by the CPU 200 and the RAM 201 of the authentication service providing server 110 cooperating with software such as a user authentication support application. Based on the information, a plurality of content IDs forcibly presented to each user and their content presentation attribute information are specified for each predetermined number used in one user authentication, and are output to the authentication information storage unit 1602 Is. The authentication information storage unit 1602 is a functional block realized when the CPU 200, the RAM 201, the program storage unit 206, the information storage unit 207, and the like of the authentication service providing server 110 cooperate with software such as a user authentication support application. ID, authentication information for each user ID, content data, and content presentation attribute information are stored in association with each other, and output to the authentication information transmitting unit 312 as authentication information with content 1607. Data and content presentation attribute information are directly associated with each other. The authentication information storage unit 1602 may store the authentication information with contents in a nonvolatile memory such as a hard disk, or may store it in a volatile memory such as a RAM.

  The authentication information storage unit 1603 of the client 120 is a functional block realized by the RAM 252 and the CPUs 253 and 256 of the client 120 cooperating with software such as an authentication program. The authentication information storage unit 1603 stores the authentication information with contents 1607 received by the authentication information receiving unit 330. The authentication information storage unit 1603 may store the authentication information with contents in a non-volatile memory such as a hard disk or temporarily store it in a volatile memory such as a RAM. The authentication information selection unit 1604 is a functional block realized by the RAM 252 and the CPU 253 of the client 120 cooperating with software such as an authentication program, and one content regarding the user ID received from the user ID input unit 324. Authentication information is selected by selecting and reading the attached authentication information pack, and the authentication information included in the content-attached authentication information pack is output to the pattern element sequence generation means 333 and the user authentication means 338, and the content-added authentication information pack Is output to the content selection means 1605. The content selection unit 1605 is a functional block realized by the RAM 252 and the CPU 253 of the client 120 cooperating with software such as an authentication program, and is included in the authentication information pack with content received from the authentication information selection unit 1604. By extracting the content data and the content presentation attribute information, the content data associated with the selected authentication information is selected and output to the content presentation unit 1606. The content presentation unit 1606 is a functional block realized by the external / network interface 250, the user interface 251, the RAM 252, the CPU 253, and the like of the client 120 cooperating with software such as an authentication program, and is received from the content selection unit 1605. The content is forcibly presented to the user based on the content data and the content presentation attribute information.

  Next, the operation of the content presentation type user authentication system in the second embodiment will be described. In the present embodiment, the content related information associated with the content ID further includes a desired presentation condition for the content associated with the content ID. Desired presentation conditions include a desired number of presentations indicating the number of times the content is desired to be presented in one user authentication process, a desired presentation time indicating the time in which the content is desired to be presented in one user authentication process, and continuous presentation of the content. Information indicating whether or not to perform continuous presentation is included. Therefore, in the content registration stage (FIG. 8), these desired presentation conditions are also included in the content related information and transmitted from the content providing server 140 to the authentication service providing server 110 (S805). The information is stored in the information storage unit 308 in association with the content ID (S807).

  And the flowchart of the authentication information production | generation step with content in 2nd Embodiment is shown in FIG. Hereinafter, steps different from those of the first embodiment will be described. The target content identification unit 1601 identifies, for each user ID, a plurality of content IDs that satisfy the content presentation target user condition included in the content related information in which the user attribute information associated with the user ID is associated with the content ID. (S1005). Then, the content IDs specified for each user ID are arranged according to a predetermined rule in the order of presentation to the user (S1700). Then, a plurality of content IDs presented in one user authentication are grouped as a set of first content packs, and temporarily stored as a first target content table in which user IDs and grouped content IDs are associated with each other. Is stored in the RAM 201 (S1701). Typically, the identified content IDs are randomly arranged, but the authentication service providing server 110 includes the presentation priority in the content related information and arranges the presentation priority in the order of higher presentation priority. You may arrange them. In the present embodiment, there are three contents to be presented in one user authentication. Accordingly, three content IDs are included in one first content pack. Typically, the first target content pack table is stored in the form shown in FIG.

  Furthermore, the target content specifying unit 1601 rearranges the content IDs in the first target content table so as to satisfy the desired presentation condition included in the content-related information associated with each content ID, and assigns the content ID to each content ID. Content presentation attribute information indicating a method of presenting each content is generated in accordance with the desired presentation condition included in the related content related information. Then, a plurality of content IDs presented in one user authentication and their content presentation attribute information are grouped as a second content pack, and the second target content is associated with the plurality of second content packs with the user ID. The data is temporarily stored in the RAM 201 as a table. Typically, the second target content table is stored in the form of a table shown in FIG. 18B (S1702).

  For example, in FIG. 18A, after a plurality of content IDs specified for user ID = U000 are randomly arranged, the first content pack (1) including three content IDs in the order of memory addresses. The first target content table is created by grouping in (R). The first content pack (1) of the first target content table includes three content IDs = C000 to C002. The desired presentation conditions of content ID = C000 are “desired number of presentations” = “twice”, “desired presentation time” = “5 seconds”, “continuous presentation availability information” = “impossible”, and content ID = It is assumed that the desired presentation conditions of C001 are “desired number of presentations” = “once”, “desired presentation time” = “5 seconds”, and “continuous presentation availability information” = “impossible”. In this case, content ID = C000 is assigned to the first presentation memory 1801 and the third presentation memory 1803 of the second content pack (1) of the second target content table, and “ Content presentation attribute information indicating “presentation time” = “5 seconds” and continuous presentation = “none” is generated and associated. Then, content ID = C001 is assigned to the second presentation memory 1802 of the second content pack (1), and content presentation indicating “presentation time” = “5 seconds” and “continuous presentation” = “none” is presented. Associate attribute information. Since the second content pack (1) has no memory to which content ID = C002 is assigned, it is assigned to the second content pack (2). Similar processing is performed on all the first content packs (1) to (R) to generate second target content tables (1) to (S). In the case of continuous presentation, continuous content data can be represented by one content data. For example, when one content data is presented three times in succession, one content data and one content presentation attribute information are included in one content pack as in the second content pack (S) of FIG. It becomes one by one.

  Next, the authentication information storage unit 1602 sequentially reads out the second content pack in the second target content table one by one for each user ID, and associates the content ID in the second content pack with the content ID. The content data is replaced with the content information and stored as authentication information with content in association with each of the plurality of authentication information (S1703). The content-added authentication information includes a plurality of content-added authentication information packs. The authentication information pack with content includes one authentication information, a plurality of content data associated with the authentication information, and content presentation attribute information associated with the content data. The authentication information includes pattern specifying information and a verification code obtained based on the pattern specifying information. Typically, the content-added authentication information is stored in the form shown in FIG. In the authentication information with content in the first embodiment, the plurality of authentication information and the plurality of content data are each associated with the user ID, but the authentication information and the content data are not directly associated with each other. On the other hand, in the second embodiment, content data corresponding to the content ID is directly associated with each authentication information and stored. The content data and the content presentation attribute information may be individually associated with the authentication information, or a plurality of content data and their content presentation attribute information may be grouped to associate each group with the authentication information. When the client 120 selects authentication information to be used for user authentication, the client 120 presents content data associated with the authentication information to the user. When content data is associated with authentication information in this way, the client 120 can easily select content data to be presented, so that the computational processing resources of the client 120 can be used effectively. Similarly to the first embodiment, the authentication information storage unit 1602 may store the authentication information with content in advance, or temporarily generate and transmit it in response to the authentication information request. It may be memorized.

  Next, in the authentication information with content acquisition stage, when the authentication service providing server 110 receives an authentication information request including a user ID from the client 120 (S1202), the authentication service providing server 110 is associated with the user ID included in the received authentication information request. The content-added authentication information including the authentication information, content data, and content presentation attribute information is transmitted to the client 120 (S1203). The client 120 receives the authentication information with contents and stores it in the authentication information storage unit 331 (S1204).

  A flowchart of the content presentation type user authentication stage in the second embodiment is shown in FIG. As in the first embodiment, the client receives an input of a user ID to be authenticated (S1301), and the authentication information selection unit 1604 is selected from a plurality of authentication information associated with the input user ID. One authentication information is selected according to a predetermined rule (S1302). In this embodiment, the authentication information selection unit 1604 selects authentication information included in the content-added authentication information by selecting and reading one content-added authentication information pack. Typically, the predetermined rule for selecting authentication information is to select in order of memory addresses. The content selection unit 1605 extracts a plurality of content data included in the content-added authentication information pack received from the authentication information selection unit 1604 and content presentation attribute information thereof, thereby associating the content associated with the selected authentication information. And the selected content data and content presentation attribute information are provided to the content presentation means 1606. The authentication information selection unit 1604 and the content selection unit 1605 may operate as an integrated functional block. The content presentation unit 1606 forcibly presents the content to the user based on the given content data (S2001). Further, the content presentation unit 1606 determines the content presentation time and whether or not to continuously present the content according to the content presentation attribute information associated with each content data. For example, when “content presentation time” = “5 seconds” and “continuous presentation presence / absence” = “present (twice)”, the content is presented for 5 seconds and then presented again for 5 seconds. As described above, based on the content-added authentication information pack, the content is presented in a predetermined presentation form at the time of user authentication.

  Each embodiment described above is an example for explaining the present invention, and the present invention is not limited to these embodiments. The present invention can be implemented in various forms without departing from the gist thereof.

100 Content Presentation Type Authentication System 110 Authentication Service Providing Server 120 Client 130 Network 140 Content Providing Server 150 Payment Server 200 CPU
201 RAM
202 User Interface 203 External / Network Interface 204 Storage Device 206 Program Storage Unit 207 Information Storage Unit 250 External / Network Interface 251 User Interface 252 RAM
253 CPU
254 Storage device 256 Information storage unit 301 Download request reception unit 302 Program transmission unit 303 Program storage unit 304 Pattern identification information generation unit 305 Verification code generation unit 306 Password storage unit 307 User information storage unit 308 Content information storage unit 309 Target content identification unit 310 Authentication information storage unit 311 Authentication information request reception unit 312 Authentication information transmission unit 321 Download request transmission unit 322 Program reception unit 324 User ID input unit 325 Authentication information request transmission unit 330 Authentication information reception unit 331 Authentication information storage unit 332 Authentication information selection Means 333 Pattern element sequence generation means 334 Pattern display means 335 One-time password input means 336 Content selection means 337 Content presentation means 338 User authentication means 1400 Logon authentication screen A
1401 Content presentation screen 1402 Logon authentication screen B
1403 Presentation pattern 1601 Target content identification unit 1602 Authentication information storage unit 1604 Authentication information selection unit 1605 Content selection unit 1606 Content presentation unit 1801 Presentation memory 1802 Presentation memory 1803 Presentation memory 2100 Offline user authentication system 2101 Offline authentication support server 2102a User ID
2102b One-time password derivation rule 2151 Offline authentication client 2152 User ID input means 2156 One-time password input means 2165 User authentication means 2181 User ID
2190 Pattern element sequence 2193 Verification code 2210 Presentation pattern 2300 Keyboard 2310 One-time password

Claims (11)

Executed using the one-time password derivation rule applied to the pattern element in the presentation pattern as a password by the user who is the object of authentication, which is the source of deriving the one-time password including the element at a specific position in the presentation pattern A content presentation type authentication system for causing a client to perform content presentation type user authentication for unilaterally presenting content to the user during user authentication,
The content presentation type authentication system includes an authentication service providing server and a client,
(A) The authentication service providing server includes (i) a user ID of the user and a password of the user, (ii) content data describing each content unilaterally presented during the user authentication, and ( iii) configured to manage the content ID of the content,
The authentication service providing server includes:
A user information storage unit that stores the user ID and user attribute information that represents the attribute of the user in association with each other;
A password storage unit that associates and stores the user ID and the one-time password derivation rule;
Pattern specifying information generating means for generating a set of a plurality of pattern specifying information for specifying the presentation pattern according to a predetermined generation rule;
Verification code generation means for generating a verification code that is obtained by performing a one-way function operation on the one-time password;
Used to identify (i) the content ID, (ii) the content data, and (iii) the user to whom the content will be presented for each content that is forcibly presented during user authentication A content information storage unit that stores content related information including the content presentation target user condition to be associated with each content, and
Target content specifying means for specifying the content ID of the content having content presentation target user conditions satisfying user attribute information of a specific user;
(I) a set of the plurality of authentication information including the verification code and the pattern specifying information used to generate the verification code; and (ii) specified to satisfy the user attribute of the user An authentication information storage unit for storing a plurality of sets of content data about content in association with the respective user IDs;
Authentication information request receiving means for receiving an authentication information request including a user ID of a user who is going to be authenticated from the client through the network;
Content-added authentication information transmitting means for transmitting to the client the content-added authentication information including the plurality of authentication information sets stored in association with the received user ID and the plurality of content data sets;
Have
(B) The client has a content presentation type user authentication program and a processor for performing the content presentation type user authentication, and the content presentation type user authentication program operates on the processor.
User ID input means for receiving input of a user ID from the user;
Authentication information request transmitting means for transmitting an authentication information request including the input user ID to the authentication service providing server through the network;
Content-added authentication information receiving means for receiving content-added authentication information transmitted from the authentication service providing server through the network;
Authentication information storage means for storing the received content-added authentication information;
Authentication information selecting means for selecting one set of authentication information included in the received authentication information with content;
Pattern element sequence generation means for generating a pattern element sequence based on the pattern specifying information included in the set of the selected authentication information;
Pattern display means for generating a presentation pattern based on the generated pattern element sequence and displaying the generated presentation pattern on a screen;
One-time password input means for receiving an input of a one-time password from the user who applied the one-time password derivation rule to the pattern element displayed in the presentation pattern;
A user who performs the one-way function operation on the inputted one-time password and the verification code included in the selected set of authentication information and succeeds in the authentication of the user when they are equal Authentication means;
Content selection means for selecting a set of content data unilaterally presented during user authentication from the plurality of sets of content data included in the received authentication information with content according to a predetermined rule;
Content presenting means for presenting the content of the selected set of content data to the user during user authentication;
A content presentation type authentication system characterized by realizing the above. The content presentation type authentication system according to claim 1,
The content presentation type user authentication is replaced with user authentication performed by installing the content presentation type user authentication program on the client on the client and executing by the OS built-in user authentication program originally installed on the client. Is to execute,
In order to install the content presentation type user authentication program in the client, an installation program is executed by the processor of the client, and the content presentation type user authentication program is started instead of the OS built-in user authentication program. A content presentation type authentication system characterized by changing a setting of a client OS. The content presentation type authentication system according to claim 2,
The content presentation type user authentication program is downloaded from the authentication service providing server to the client,
The authentication service providing server includes:
(I) a content storage type user authentication program and a program storage unit for storing the installation program;
(Ii) download request receiving means for receiving a download request for the content presentation type user authentication program and the installation program from the client through the network;
(Iii) In response to a download request from the client, program transmission means for transmitting the content presentation type user authentication program and the installation program to the client through the network;
Have
The client
(I) download request transmission means for transmitting a download request for requesting transmission of the content presentation type user authentication program and the installation program to the authentication service providing server through the network;
(Ii) program receiving means for receiving the content presentation type user authentication program and the installation program from the authentication service providing server;
And (iii) a program storage unit for storing the received program. The content presentation type authentication system according to any one of claims 1 to 3,
A content presentation type authentication system, wherein the content is an advertisement. The content presentation type authentication system according to any one of claims 1 to 4,
The authentication information storage unit of the authentication service providing server further stores a plurality of sets of content data related to each user ID in association with a plurality of sets of authentication information stored in association with the user ID,
The content selection means in the client authenticates the user and selects a set of content data associated with a set of authentication information selected to present the content during user authentication. Content presentation type authentication system. The content presentation type authentication system according to any one of claims 1 to 5,
The content related information includes: (i) the number of times the related content is to be presented during the user authentication with respect to the content related to the content related information; and (ii) the related content during the user authentication. A desired presentation condition including at least one of a desired time for performing presentation and (iii) continuous presentation availability information indicating whether continuous presentation of the related content is permitted or not,
The target content specifying means further includes
Content including at least one of (i) presentation time of the related content and (ii) continuous presentation information indicating whether or not to continuously present the related content based on the desired presentation condition Create presentation attribute information, associate the content presentation attribute information with the content data of the related content, store the content presentation attribute information in the authentication information storage unit,
The content-added authentication information transmitted from the authentication service providing server to the client further includes the content presentation attribute information,
The content presentation means further includes
In accordance with the content presentation attribute information, the content presentation type authentication system unilaterally presents the related content to the user during the user authentication. The content presentation type authentication system according to any one of claims 1 to 6,
The authentication information selection means of the client is the authentication already selected from the plurality of authentication information sets included in the authentication information with contents stored for the specific user in the authentication information storage means of the client The information is configured not to be selected,
When the plurality of sets of authentication information for the specific user are selected,
The authentication information request transmitting means of the client transmits a new authentication information request including the user ID of the specific user through the network,
The authentication information request receiving means of the authentication service providing server receives the new authentication information request from the client through the network,
The content-added authentication information transmitting means of the authentication service providing server transmits new content-added authentication information for the specific user to the client,
The authentication information receiving unit with content of the client receives the new authentication information with content transmitted from the authentication service providing server through the network,
The authentication information storage unit with content of the client is configured to update the stored authentication information with content for the specific user with the received authentication information with content. Content presentation type authentication system. The content presentation type authentication system according to any one of claims 1 to 7,
The authentication service providing server further includes: (i) user information update means for updating information stored in the user information storage section; (ii) authentication information update means for updating information stored in the authentication information storage section; And (iii) a content presentation type authentication system comprising at least one of content information updating means for updating information stored in the content information storage unit. The content presentation type authentication system according to any one of claims 1 to 8,
The target content specifying unit of the authentication service providing server respecifies, for each user ID, a plurality of content IDs having a content presentation target user condition that satisfies the user attribute information for the user ID,
A content presentation type authentication system configured to update the authentication information storage unit with the plurality of re-identified content IDs. The content presentation type authentication system according to any one of claims 1 to 9,
The pattern element sequence generation unit generates a pattern element sequence based on a user ID in addition to the pattern specifying information. The content presentation type authentication system according to any one of claims 1 to 10,
The content presentation type authentication system, wherein the user attribute information includes at least one of an age and a gender of each user.

Images