JP5910589B2 - Authentication system, authentication device, authentication method, and program - Google Patents

Description

  The present invention relates to an authentication system capable of receiving authentication by inputting authentication information.

  Conventionally, there is an authentication system using a computer. The authentication system is to authenticate whether or not the user has the authority by inputting a user name or password on a login screen or the like from a Web browser of Windows (registered trademark) or a smartphone, for example.

  However, in such a system, there is a risk of unauthorized login by leaking a user name and password or receiving a brute force attack (brute force). For this reason, in order to prevent unauthorized login, there are cases in which operation is performed using an increased number of digits or multiple passwords.

  In addition, in Patent Document 1, as a countermeasure against a brute force attack that attempts to log in repeatedly with any password by combining characters, among the plurality of input passwords, there is no input regarding passwords other than the last input password. There has been proposed an authentication apparatus system that includes an authentication control unit that performs the same output to a user as when an incorrect password is input even if it is correct.

JP 2013-97483 A

  The system of Patent Document 1 has a mechanism for preventing unauthorized login by not recognizing the validity of a password every time a plurality of passwords are input.

  However, in Patent Document 1, it is difficult to prevent unauthorized login due to a brute force attack that attempts login until the login is successful, regardless of the authentication failure message.

  Further, in Patent Document 1, it is not possible to prevent unauthorized login when a password leak is detected by a keylogger or the like.

  Therefore, an object of the present invention is to provide an authentication system that can prevent an unauthorized login only by knowing a password by using an input position of login information as an authentication condition.

In an authentication system that authenticates authentication information input by a user, a reception screen display unit that controls display of a dialog screen that can accept the input of authentication information so that the user can move it, and a dialog displayed by the reception screen display unit an authentication information receiving unit that receives an input of authentication information via a screen, display of the dialog screen display position acquisition unit, which has been acquired by the display position acquisition unit that acquires the display position of the dialog screen which is moved by the user And authentication means capable of causing the authentication to succeed when the position is at a predetermined position and the received authentication information is correct.

  According to the present invention, it is possible to provide an authentication system capable of preventing unauthorized login by only knowing a password by using an input position of login information as an authentication condition.

It is a figure which shows an example of the system configuration | structure of the authentication system of this invention. It is a figure which shows an example of the hardware constitutions of the authentication apparatus in the authentication system of this invention. It is a figure which shows an example of a function structure in the authentication system of this invention. It is a figure which shows an example of the login screen in the authentication system of this invention. It is a figure which shows an example of the state in which the display position of the login screen in the authentication system of this invention was changed. It is a figure which shows an example of the display position which can authenticate the login screen of the authentication system of this invention. It is a figure which shows an example of the state by which the login screen of the authentication system of this invention was scrolled. It is a flowchart which shows an example of the whole flow of the authentication system of this invention. It is a flowchart which shows an example of the dialog coordinate position authentication process of the authentication system of this invention. It is a figure which shows an example of the timeout message screen of the authentication system of this invention. It is a flowchart which shows an example of the process at the time of the reconnection of the authentication system of this invention.

Hereinafter, an example of an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing an example of a system configuration of an authentication system according to the present invention.

  As shown in the figure, the authentication system according to the embodiment of the present invention is configured by connecting an authentication device 200 and an authentication server 300 on a LAN 100.

  The LAN 100 is a local area network and refers to a network in a company or a home, but is not limited to this, and may be a public line or a Wi-Fi network.

  The authentication device 200 is an information processing device used by a user, and can be applied to a PC, a tablet terminal, or the like, and is a device for receiving authentication from the authentication server 300 in order to use the application server 400. is there. The application server 400 is a server that can be used when the user successfully logs in. The application may be an application such as a bulletin board or groupware that can use e-mail, or may be a file sharing application that can store images such as photographs.

  In this embodiment, as an example of the authentication device 200 used by the user A to the user C, for example, the user A uses a desktop PC, the user B uses a tablet terminal such as a smartphone, and the user C uses a notebook PC as the authentication device. However, the present invention is not limited to this, and can be configured by various information processing apparatuses.

  The authentication server 300 receives the authentication request from the authentication device 200 and performs authentication. For example, the authentication is performed to determine whether authentication information such as a user ID or a password received from the authentication device 200 is registered in the system to be used or whether it matches the registered information. is there. As a result, authentication success or failure is determined.

  Note that authentication may be performed by the authentication server 300 or may be performed by an application server that the user intends to use.

  The above is an example of the system configuration of the printing system according to the embodiment of the present invention.

  Next, an example of the hardware configuration of the information processing apparatus applicable to the authentication apparatus 200 in FIG. 1 will be described with reference to FIG.

  FIG. 2 is a diagram illustrating an example of a hardware configuration of an authentication apparatus in the authentication system of the present invention.

  In FIG. 2, reference numeral 201 denotes a CPU that comprehensively controls each device and controller connected to the system bus 204. Further, the ROM 203 or the external memory 211 has a BIOS (Basic Input / Output System), an operating system program (hereinafter referred to as OS), which is a control program of the CPU 201, and a function necessary for realizing the functions executed by the authentication apparatus 200, which will be described later. Various programs to be stored are stored.

  A RAM 202 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program necessary for execution of processing from the ROM 203 or the external memory 211 into the RAM 202 and executing the loaded program.

  An input controller 205 controls input from an input device 209 such as a keyboard and a pointing device. A video controller 206 controls display on a display device such as a CRT (display device) 210. These are used by the operator as needed.

  A memory controller 207 is connected to the hard disk (HD), flexible disk (FD), or PCMCIA card slot for storing a boot program, various applications, font data, user files, editing files, various data, etc. via an adapter. The access to the external memory 211 such as a compact flash (registered trademark) memory is controlled.

  A communication I / F (interface) controller 208 is connected to and communicates with an external device via a network (for example, the LAN 100 shown in FIG. 1), and executes communication control processing on the network. For example, communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the display device 210 by executing outline font rasterization processing on a display information area in the RAM 202, for example. Further, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the display device 210.

  The processing of each step shown in the flowchart to be described later for realizing the present invention is executed by a program that can be read and executed by a computer, and the program is recorded in the external memory 211. Then, it is executed by the CPU 201 by being loaded into the RAM 202 as necessary. Furthermore, definition files and various information tables used when executing the program are also stored in the external memory 211, and a detailed description thereof will be described later.

  FIG. 3 is a diagram showing an example of a functional configuration in the authentication system of the present invention.

  The authentication system includes the functions of the authentication device 200 and the authentication server 300 shown in FIG.

  The authentication server 300 includes an authentication information storage unit 302, a password storage unit 303, and an authentication control unit 304, and is communicably connected to the authentication system communication control unit 306 of the authentication device 200.

  The authentication device 200 includes a screen information storage unit 305, an authentication system communication control unit 306, and a screen coordinate position storage unit 307, and is connected to the display device 308 and the input device 309.

  The display device 308 is a display unit such as a display, and may be hardware different from the authentication device 200, or the authentication device 200 may have as a display unit. The input device 309 accepts input using an input device such as a keyboard or a mouse. Using a touch panel as an input device, it is also possible to handle voice input using a touch pen, a user's finger or voice.

  The screen information storage unit 305 displays a “login” screen displayed on the display device 308, an “error” screen displayed when authentication fails, and a “timeout notification” screen when a timeout occurs during login. It has a function of storing display information including the position. The various screens may be deleted from the screen after a predetermined time has elapsed or when the user presses the OK button.

  In addition, the input user ID and password and the authentication result thereof are stored, and the first authentication information is used in the reconnection process described later.

  The authentication system communication control unit 306 can be connected to the screen coordinate position storage unit 307, the screen information storage unit 305, the display device 308, the input device 309, and the server (authentication device) 301. It has a function of controlling communication for screen display or authentication with the authentication server 300. Also, it has a function of controlling display of screen display information related to authentication received from the authentication server 300.

  The screen coordinate position storage unit 307 has a function of storing the marking position of the authentication screen that is displayed and controlled by the authentication system communication control unit 306.

  The authentication information storage unit 302 has a function of storing authentication information such as an authentication state of the authentication server 300 such as an initial authentication state, a login success state, and a login timeout state (after successful login).

  The password storage unit 303 stores authentication information necessary for authentication as a password DB. This embodiment requires two items: user information and dialog coordinate positions. The authentication apparatus 200 receives the “user ID” and “password” as the first authentication information and the coordinate position of the login dialog screen as the second authentication information, and controls so that the authentication is successful when both match.

  The authentication control unit 304 performs control so that the authentication is successful when the authentication information received from the authentication device 200 is correct, and the authentication is failed when the authentication information is not correct.

  It should be noted that the authentication apparatus 200 can have all the functions of the authentication server 300 or arbitrary functions.

  Further, for example, the authentication system communication control unit 306 can be configured to transmit the first authentication information to the authentication control unit 304 when the coordinate position of the login screen matches the second authentication information. Yes, it is possible to configure an authentication system by combining various functions.

  FIG. 4 is a diagram showing an example of a login screen in the authentication system of the present invention.

  The login screen 401 is displayed on the screen of the authentication apparatus 200, and the user is authenticated by the authentication server 300 by inputting a user ID and a password (referred to as first authentication information). If the authentication is successful, a desired system can be used.

  In this screen (authentication condition reception screen), authentication conditions such as a user ID and a password are input. However, only a password can be received.

  In the conventional technique, the system can be used when authentication is successful on the screen. In the present invention, the first authentication information and the second authentication information are displayed using the display position of the login screen as the second authentication information. Security is strengthened so that authentication is successful when both authentication information is correct.

  FIG. 5 is a diagram illustrating an example of a state in which the sign position of the login screen has been changed in the authentication system of the present invention.

  On the main screen 501, a login screen 503 is displayed at a predetermined location in order to accept authentication by the user. This displayed location may be an arbitrary location displayed by the authentication system by default, or may be a location set in the authentication system.

  Here, the user moves the login screen 503 to the place where the authentication is permitted (second authentication information), and receives the authentication by inputting the user ID and password as the first authentication information there. ing.

  Although the place where the authentication is permitted is described later, it can be set by the coordinate position where the dialog of the login screen 503 is displayed. For example, when a dialog screen is displayed in the dotted line area 502, it can be determined that the second authentication information is satisfied, and authentication can be performed using the first authentication information.

  The authentication device 200 may receive the authentication by transmitting the first authentication information and the second authentication information to the authentication server 300. When the second authentication information satisfies the condition, the authentication server 200 It is also possible to send the first authentication information to 300 for authentication.

  As a result, even if the first authentication information such as the user name or password is leaked, it is possible to prevent unauthorized authentication as long as the display position of the login screen as the second authentication information is not leaked. It is also possible to prevent unauthorized authentication success due to brute force attacks such as name and password brute force attacks.

  FIG. 6 is a diagram showing an example of a display position where the login screen of the authentication system of the present invention can be authenticated.

  The second authentication information includes “user-specific input-capable coordinates” 601 set for each user ID, “site-specific input-capable coordinates” 602 set for each URL of the application server to be used and the system to be used, and the second authentication information. “Monthly inputable coordinates” 603 set for each time (for example, month, day, or time) can be set.

  It is determined that the second authentication information is satisfied when the login screen is displayed at the coordinate position set as the inputable coordinates. What kind of authentication information is used as the second authentication information can be freely selected by setting in advance by an administrator or the like.

  In “user inputable coordinates” 601, second authentication information is set for each of the users “AAA”, “BBB”, and “CCC”. For example, the user “AAA” sets the X coordinate between 10 and 200 and the Y coordinate between 10 and 200 with respect to the coordinate positions X and Y on the login screen. When the screen is displayed, the second authentication information is satisfied.

  As a result, since the coordinates for successful authentication can be made different for each user, even if another user succeeds in authentication, another user cannot succeed in authentication unless the login screen is displayed at a different position. It becomes like this.

  Similarly, in “site-specific input-capable coordinates” 602, second authentication information is set for sites “Site_A”, “Site_B”, and “Site_c” that are connection destinations related to authentication.

  Similarly, in “monthly inputable coordinates” 603, second authentication information is set for “Jan”, “Feb”, and “Mar” (January, February, March). For example, when authenticating in January, the coordinate information set to “Jan” is used. Further, instead of every month, it may be set at every timing of authentication, for example, every day, or may be set according to a time zone.

  FIG. 7 is a diagram showing an example of a state where the login screen of the authentication system of the present invention is scrolled.

  Although FIG. 6 illustrates an example of a login screen displayed on an information processing apparatus such as a PC, FIG. 7 illustrates an example in which a login screen is displayed on a smartphone or a tablet terminal.

  The main screen 701 displays a login screen 702 (authentication information reception screen). On this screen, it is possible to receive a first authentication using a user ID or a password that is the first authentication information. .

  Here, when the display position of the authentication screen as the second authentication information is set, the position of the login screen 712 displayed on the main screen 711 is scrolled by scrolling the screen (in this embodiment, scrolling up). It has been moved up the screen. Here, if the coordinates of the upper part of the screen are set in the second authentication information, the second authentication is satisfied, and the first authentication can be received.

  FIG. 8 is a flowchart showing an example of the overall flow of the authentication system of the present invention.

  Processing is started by accessing a desired application server by the user.

  In step S801, a user authentication dialog screen (acceptance screen display means) as shown in FIG. 4 is displayed. In step S802, a user name and password are acquired (authentication accepting means) by user input. When the user presses the “OK” button, the process proceeds to step S803.

  In step S803, the coordinate position of the login screen is acquired (display position acquisition means). It is assumed that the user performs processing such as moving the login screen to a predetermined position before inputting login information and requesting authentication.

  In step S804, the first authentication information of the user ID and password and the second authentication information that is the coordinate position of the dialog are transmitted to the authentication server 300.

  In step S805, the authentication server 300 performs a first authentication process that is a user name and password authentication process. For the user name and password, the password DB stored in the password storage unit 303 is used. A user DB (password DB) stored in the application server may be used.

  In step S806, “dialog coordinate position” authentication processing is performed (second authentication). Specifically, it is determined whether or not the display coordinates of the login screen transmitted from the authentication device 200 satisfy the authentication-relieved display position shown in FIG.

  In step S807, the authentication apparatus 200 receives a notification of the returned authentication result and ends the process. The authentication result only needs to know that the authentication has failed as a result. For example, even if it fails, it is desirable not to notify which of the first authentication and the second authentication has failed.

  Note that the authentication apparatus 200 performs processing to determine whether or not the second authentication information satisfies the condition. If the condition is satisfied, the first authentication information may be transmitted to the authentication server 300 in step S804. In that case, the authentication server 300 does not perform the process of step S806. In this case, if the second authentication information does not satisfy the condition, the first authentication may not be performed without displaying an error, or the first authentication may be displayed as an error. May be.

  FIG. 9 is a flowchart showing an example of dialog coordinate position authentication processing of the authentication system of the present invention.

  In step S901, the “dialog coordinate position” received from the authentication apparatus 200 is acquired. The dialog coordinate position stored in the screen information storage unit 305 in FIG. 2 is transmitted.

  In step S902, the input possible coordinate position shown in FIG. 6 is acquired. When acquiring, a coordinate range of a preset type is acquired.

  In step S903, it is determined whether or not the dialog coordinate position (login screen display position) acquired in step S901 is within the range of the input-capable coordinate position acquired in step S902 (within the range).

  If it is within the range, the authentication control unit 304 is notified that the second authentication has been successful in step S904. On the other hand, if it is not within the range, the fact that the second authentication has failed is notified in step S905, and processing is performed. Exit.

  FIG. 10 is a diagram showing an example of a timeout message screen of the authentication system of the present invention.

  Depending on the application server, there is a case where even for a user who has been authenticated and is using the system, the user once times out, such as when there is no operation for a predetermined time, and prompts for the password again.

  A message indicating a timeout is displayed on the login screen 1001. When the “OK” button is pressed, a login screen as shown in FIG. 4 is displayed.

  In this case, the user may be allowed to input the authentication information again by the method shown in FIG. 8, but in this embodiment, the login that is the second authentication information is used as the simple authentication when the authentication is already completed. If the display position of the screen is correct, the timeout can be canceled.

  FIG. 11 is a flowchart showing an example of processing at the time of reconnection of the authentication system of the present invention.

  In step S1101, the authentication apparatus 200 displays a reconnection user authentication dialog. In step S <b> 1102, the user ID and password (first authentication information) when the previous authentication was successful are acquired from the screen information storage unit 305.

  In step S1103, the displayed coordinate position of the login screen is acquired, and in step S1104, the login ID and password, which are the first authentication information, and the display position of the login screen, which is the second authentication information, are sent to the authentication server. To 300.

  In step S1105, the authentication server 300 performs authentication using the received user ID and password, which are the first authentication information. In step S1106, the “dialog coordinate position” authentication process shown in FIG. 9 is performed, and the result is returned. The authentication device 200 receives the result and ends the process.

  As described with reference to FIG. 8, it is only necessary to know that the authentication result has failed as a result. For example, even if it fails, it does not notify which of the first authentication and the second authentication has failed. It is desirable.

  In step S1104, re-authentication at the time-out may be performed using only the second authentication information without using the first authentication information. In that case, the process of step S1105 is omitted.

  As a result, when re-authentication due to timeout, if the position is correct for the user who knows the display position of the login screen, the input of the first authentication information such as the user ID and password is not accepted. Simple authentication can be performed.

  Although one embodiment has been described above, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or recording medium, and specifically includes a plurality of devices. The present invention may be applied to a system including a single device.

  The program in the present invention is a program that can execute the processing method of the flowchart shown in the embodiment, and the storage medium of the present invention stores the program that can execute the processing method of the flowchart in the embodiment. Yes. The program in the present invention may be a program for each processing method of each device in the embodiment.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by executing the reading.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk, solid state drive, or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Further, the present invention may be applied to a system composed of a plurality of devices or an apparatus composed of a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention.

  In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

100 LAN
200 Authentication Device 300 Authentication Server 400 Application Server

Claims (13)

In an authentication system that authenticates authentication information entered by a user,
A reception screen display means for controlling display so that the user can move the dialog screen that can accept the input of authentication information;
Authentication information accepting means for accepting input of authentication information via the dialog screen displayed by the accepting screen display means;
Display position acquisition means for acquiring the display position of the dialog screen moved by the user ;
Authentication means capable of succeeding in authentication when the display position of the dialog screen moved by the user acquired by the display position acquisition means is at a predetermined position and the received authentication information is correct;
An authentication system comprising: In an authentication system that authenticates authentication information entered by a user,
A reception screen display means for controlling display so that the user can move the dialog screen that can accept the input of authentication information;
Authentication information accepting means for accepting input of authentication information via the dialog screen displayed by the accepting screen display means;
Display position acquisition means for acquiring the display position of the dialog screen moved by the user ;
When the display position of the dialog screen moved by the user acquired by the display position acquisition unit is displayed at a predetermined position, authentication is performed using the authentication information received by the authentication information reception unit, while the user If the display position of the dialog screen moved by is not displayed at a predetermined position, an authentication unit that does not perform authentication by the authentication information received by the authentication information reception unit;
An authentication system comprising: The authentication unit, when the display position of the dialog screen which is moved by the user is in place, No placement claim 1 Symbol and performing authentication by the authentication information received by the authentication information reception means Authentication system. Even if the authentication information received by the authentication information receiving means is correct, the authentication means determines that the authentication fails if the display position of the dialog screen moved by the user is not at a predetermined position. claim 1 or 3 Symbol placement authentication system characterized. The authentication system according to claim 1, wherein the predetermined position of the dialog screen is set for a user who performs authentication. The authentication system according to claim 1, wherein the predetermined position of the dialog screen is set for a connection destination related to authentication. The authentication system according to any one of claims 1 to 6, wherein the predetermined position of the dialog screen is set with respect to a timing of authentication. Authentication information storage means for storing authentication information received by the authentication information receiving means;
A reconnection dialog screen display means for accepting a reconnection request from a user who has been authenticated once;
When the display position of the reconnection dialog screen acquired by the display position acquisition means is at a predetermined position, the authentication means uses authentication information at the time of previous authentication success stored by the authentication information storage means. The authentication system according to any one of claims 1 to 7, wherein authentication can be made successful . The authentication system according to any one of claims 1 to 8, wherein the dialog screen is a screen for inputting authentication information displayed separately from the main screen. An authentication system control method for authenticating authentication information input by a user,
A reception screen display step for controlling the display of the dialog screen that can accept the input of authentication information so that the user can move it;
An authentication information accepting step for accepting input of authentication information via the dialog screen displayed by the accepting screen displaying step;
A display position acquisition step of acquiring a display position of the dialog screen moved by the user ;
An authentication step capable of allowing successful authentication when the display position of the dialog screen moved by the user acquired by the display position acquisition step is at a predetermined position and the received authentication information is correct;
A method for controlling an authentication system, comprising: An authentication system control method for authenticating authentication information input by a user,
A reception screen display step for controlling the display of the dialog screen that can accept the input of authentication information so that the user can move it;
An authentication information accepting step for accepting input of authentication information via the dialog screen displayed by the accepting screen displaying step;
A display position acquisition step of acquiring a display position of the dialog screen moved by the user ;
When the display position of the dialog screen moved by the user acquired in the display position acquisition step is displayed at a predetermined position, authentication is performed using the authentication information received in the authentication information reception step. If the display position of the dialog screen moved by is not displayed at a predetermined position, an authentication step that does not perform authentication using the authentication information received by the authentication information reception step;
A method for controlling an authentication system, comprising: A program readable by an authentication system that authenticates authentication information input by a user,
The authentication system;
A reception screen display means for controlling display so that the user can move the dialog screen that can accept the input of authentication information;
Authentication information accepting means for accepting input of authentication information via the dialog screen displayed by the accepting screen display means;
Display position acquisition means for acquiring the display position of the dialog screen moved by the user ;
Authentication means capable of succeeding in authentication when the display position of the dialog screen moved by the user acquired by the display position acquisition means is at a predetermined position and the received authentication information is correct;
A program for causing an authentication system to function. A program readable by an authentication system that authenticates authentication information input by a user,
The authentication system;
A reception screen display means for controlling display so that the user can move the dialog screen that can accept the input of authentication information;
Authentication information accepting means for accepting input of authentication information via the dialog screen displayed by the accepting screen display means;
Display position acquisition means for acquiring the display position of the dialog screen moved by the user ;
When the display position of the dialog screen moved by the user acquired by the display position acquisition unit is displayed at a predetermined position, authentication is performed using the authentication information received by the authentication information reception unit, while the user If the display position of the dialog screen moved by is not displayed at a predetermined position, an authentication unit that does not perform authentication by the authentication information received by the authentication information reception unit;
A program for causing an authentication system to function.

Images