JP6435456B1 - Authentication server, program and method using two-stage URL - Google Patents

Abstract

An authentication server and the like capable of executing two-stage user authentication without requiring a user to input a code (user ID, password, passcode) at all. In an authentication server for authenticating a user who operates a terminal, for each user ID, a registration table that stores an address, a first URL that can identify the user, and a first URL directed to the first URL A second URL generation unit that identifies a user ID and generates a second URL that can identify the user ID when receiving a page request of the first page, and a second URL in which the second URL is described. When receiving a second message transmission means for transmitting a message with the address of the user ID as a destination and a second page request directed to the second URL from the terminal, authentication of the user ID to the terminal And a successful authentication means. [Selection] Figure 1

Description

  The present invention relates to a technique in which an authentication server authenticates a user who operates a terminal.

  Generally, in order to authenticate a user who accesses a Web site, the user is required to input a user ID (IDentifier) and a password to the terminal. Such a method is the same even for a commercial transaction site requiring high security.

On the other hand, for example, in the case of a virtual currency trading site, in order to access a wallet managed by the user, a technique for authenticating the user in two stages is applied (for example, see Non-Patent Document 1). According to this technique, the following sequence is taken.
(S11) The user inputs “wallet ID (IDentifier)” and “password” on the login screen of the terminal.
(S12) The site server authenticates the user from the input wallet ID and password, and transmits a mail describing the login state (time, IP address, browser, OS, etc.) to the user's mailbox.
(S13) The user confirms the login state of the mail, and clicks a URL (Uniform Resource Locator) button that permits login.
As a result, the site server sets the first authentication success for the user operating the terminal.
(S21) Next, the site server temporarily generates a five-digit passcode and sends an SMS (Short Messaging Service) message describing the passcode to the user's smartphone (mobile terminal).
(S22) The user confirms the SMS message with the smartphone, and inputs the passcode described in the message on the login screen of the terminal.
As a result, the site server sets the second authentication success for the user operating the terminal.
By executing such two-step authentication, high security is secured and access from a malicious third party is excluded.

  As another conventional technique, there is a technique in which a user can transmit a message by simply tapping a URL displayed on a terminal (see, for example, Patent Document 1). According to this technique, the URL can identify the transmission source user and the destination user. When a server receives a page request for a URL, the server uses a source address identified by the URL as a source address, and an address based on the destination user identified by the URL as a destination address. Send a message.

  There is also a technique for temporarily notifying the destination terminal of map information displaying the position of the transmission source terminal (see, for example, Patent Document 2). According to this technique, the server stores a first page for a first URL that can identify a transmission source terminal and a destination terminal. When the server receives a page request directed to the first URL from the transmission source terminal, the server returns the first page to the transmission source terminal. The transmission source terminal that has reproduced the first page transmits its position information to the server. On the other hand, the server generates a second page in which a map in which the position of the transmission source terminal is plotted is drawn, and a message including the second URL in the second page is identified by the first URL. Send to the terminal.

Japanese Patent No. 6182711 Japanese Patent No. 6152521

"Blockchain Complete Manual / Login Method after 2-Step Authentication Setting", [online], [Search April 1, 2018], Internet <URL: https://hachi-style.com/blockchain/ # i-29>

  According to the technology of Non-Patent Document 1 described above, the user inputs the login ID and password on the terminal screen during the first authentication, and the passcode received by the smartphone on the terminal screen during the second authentication. Need to be entered. In the case of such two-step authentication, the user needs to input a code three times on the terminal screen.

  On the other hand, the inventors of the present application input a code (user ID, password, passcode) required for user authentication multiple times since all users access the same login screen URL. I thought it was necessary.

  Therefore, an object of the present invention is to provide an authentication server, a program, and a method capable of executing two-step user authentication without causing the user to input any code.

According to the present invention, in an authentication server for authenticating a user who operates a terminal,
For each user ID, a registration table that stores an address and a first URL that can identify the user;
A second URL generating means for identifying a user ID and generating a second URL capable of identifying the user ID when receiving a first page request directed to the first URL from the terminal;
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
And an authentication unit that makes the authentication of the user ID successful when a second page request directed to the second URL is received from the terminal.

According to another embodiment of the authentication server of the present invention,
It is also preferable to further include a first message transmission means for transmitting the first message describing the first URL, with the address of the user ID identified by the first URL as a destination.

According to another embodiment of the authentication server of the present invention,
It is also preferable that the second URL generation means generates a second URL that is different as a one-time URL every time a first page request is received, even for the same user ID.

According to another embodiment of the authentication server of the present invention,
The authentication unit authenticates the user ID only when the time from when the second message is transmitted by the second message transmission unit to when the second page request is received is equal to or shorter than a predetermined time. It is also preferable to succeed.

According to another embodiment of the authentication server of the present invention,
When receiving the first page request from the terminal, the second URL generating means generates a cookie value in HTTP (HyperText Transfer Protocol) cookie protocol, responds to the terminal with the cookie value, and uses the first URL. In association with the identified user ID, register the cookie value in the registration table,
If the cookie value included in the second page request and the cookie value based on the user registered in the registration table match, the authentication means may determine that the user ID has been successfully authenticated to the terminal. preferable.

According to another embodiment of the authentication server of the present invention,
The device address is an email address, phone number or account,
The second message is
Email based on email address,
SMS push message based on phone number, or
An SNS (Social Networking Service) message based on an account is also preferable.

According to another embodiment of the authentication server of the present invention,
The user ID is a user ID of a commerce site or a block chain site, or a wallet ID of virtual currency,
It is also preferable to authenticate the user ID without using a password.

According to the present invention, in a program for causing a computer installed in an authentication server to authenticate a user who operates a terminal to
For each user ID, a registration table that stores an address and a first URL that can identify the user;
A second URL generating means for identifying a user ID and generating a second URL capable of identifying the user ID when receiving a first page request directed to the first URL from the terminal;
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
When a second page request directed to the second URL is received from the terminal, the computer is caused to function as an authentication unit that makes the authentication of the user ID successful.

According to the present invention, there is provided a two-step authentication method of an authentication server for authenticating a user who operates a terminal,
The authentication server
For each user ID, an address and a first URL that can identify the user are stored,
A first step of generating a second URL capable of identifying a user ID and identifying the user ID when receiving a first page request directed to the first URL from a terminal;
A second step of transmitting a second message in which a second URL is described with the address of the user ID as a destination;
When a second page request directed to the second URL is received from the terminal, a third step of performing authentication success of the user ID is executed.

  According to the authentication server, program, and method of the present invention, two-step user authentication can be executed without requiring the user to input any code (user ID, password, passcode).

It is a sequence diagram in the present invention. It is explanatory drawing showing the tap operation screen at the time of the 1st authentication in this invention. It is explanatory drawing showing the tap operation screen at the time of the 2nd authentication in this invention. It is a 1st sequence diagram which determines authentication based on the cookie value of a terminal. FIG. 5 is a second sequence diagram following FIG. 4. It is a functional block diagram of the authentication server in this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a sequence diagram according to the present invention.

According to FIG. 1, the user A performs self-authentication from the terminal 2 to the authentication server 1 in order to receive a predetermined service. The predetermined service may be, for example, a commercial transaction site, a block chain site, or a virtual currency wallet that requires high security.
The authentication server 1 of the present invention serves as a message or mail transmission source device for the terminal 2 and also functions as a Web site.
Further, the authentication server 1 can receive a page request based on the URL by publishing the URL of the Web site.

According to FIG. 1, the authentication server 1 of the present invention has a registration table 100.
[Registration Table 100]
The registration table 100 stores an address and a first URL that can identify the user for each user ID. The address is an email address, a telephone number, or an account corresponding to the message or email described above. For example, the registration table 100 is registered as follows.
[User ID] <-> [Address] [First URL]
AA@aaa.com http://www.SM.co.jp/A
BB@bbb.com http://www.SM.co.jp/B
CC@ccc.com http://www.SM.co.jp/C

[S0: 0th step]
The authentication server 1 sends the first message describing the first URL (http://www.SM.co.jp/A) to the address (A @ aaa) of the user A identified by the first URL. .com) as a destination. The first URL (http://www.SM.co.jp/A) is dedicated to user A and needs only to be recognized by user A. The first message must be transmitted. It is not an element.

[S1: First step]
(S11) The first URL (http://www.SM.co.jp/A) of the user A is displayed on the terminal 2 equipped with the touch panel display, and the user A corresponds to the first URL. Can be activated (tap or click).
As a result, the terminal 2 transmits a page request (GET Request) toward the first URL.

  FIG. 2 is an explanatory diagram showing a tap operation screen at the time of the first authentication according to the present invention.

  According to FIG. 2A, the user has tapped the first URL (http://www.SM.co.jp/A) described in the message received in S0. This URL is given an identifier “A” for identifying the user following the domain name, and is recognized as a page dedicated to the user A for the terminal 2.

  According to FIG. 2B, the user is tapping an operation button on which an HTML (HyperText Markup Language) code is displayed on the browser. This is simply a visual button display of the first URL (http://www.SM.co.jp/A) for user A.

(S12) When receiving the first page request for the first URL, the authentication server 1 determines whether or not the first URL is registered in the registration table 100. If it is determined to be false (unregistered), the page request is ignored.
According to FIG. 1, when a page request (HTTP Get Request) directed to the first URL (http://www.SM.co.jp/A) is received, the user A registered in the registration table 100 is received. Identify

(S13) If it is determined to be true (registered) in S12, a second URL that can identify the user ID is generated.
At this time, even for the same user ID, for example, the first URL and the second URL are different as follows.
(First URL) http://www.SM.co.jp/A
(Second URL) http://www.SM.co.jp/Axx
Even if the second URL is the same user ID, a different second URL is generated as a one-time URL each time a first page request is received.
(Second URL generated at time i) http://www.SM.co.jp/Axi
(Second URL generated at time j) http://www.SM.co.jp/Axj
The generated second URL is temporarily registered in the registration table 100 in association with the user ID.

[S2: Second step]
The authentication server 1 transmits a second message in which the second URL is described with the address of the user ID as a destination.
According to FIG. 1, the destination address of the second message is set to the address (A@aaa.com) of the user identified by the first URL.

When the message is an e-mail based on a mail address, for example, the authentication server 1 has a mail client function and transmits the mail to an external SMTP server.
When the message is, for example, an SMS push message based on a telephone number, the authentication server 1 has a telephone call function, executes a call connection sequence of a mobile telephone network, and transmits a short message. In this case, the terminal 2 needs to be a smart phone or a portable terminal that can be connected by call.
When the message is, for example, an SNS message based on an account, the authentication server 1 has a login function for the SNS site and notifies the message via the site.

  FIG. 3 is an explanatory diagram showing a tap operation screen at the time of second authentication in the present invention.

In FIG. 3, the text described in the received second message is displayed on the display of the terminal 2. The message describes the second URL and prompts the user to perform an activation operation (tap or click).
(Second URL) http://www.SM.co.jp/Axx
The second URL is recognized as a page dedicated to the user A for the authentication server 1.

[S3: Third step]
(S31) When the user A taps the second URL (http://www.SM.co.jp/Axx), the terminal 2 sends a second page request (GET Request) to the authentication server 1. Send.
(S32) When receiving the second page request from the terminal 2, the authentication server 1 determines whether or not the second UL is registered in the registration table 100. If it is determined to be true (registered), the user ID is authenticated successfully.
The authentication server 1 may return a success of authentication to the terminal 2 operated by the user A by a page response.
Thereby, the user A who operates the terminal 2 can receive provision of a predetermined service after authentication.

  As another embodiment, the authentication server 1 starts a timer when the second message is transmitted in S2. Then, only when the time until the second page request is received from the terminal 2 is equal to or shorter than the predetermined time, the user ID is authenticated successfully. This predetermined time is set as a valid period of the one-time URL.

<Matching cookie values based on browser>
1 to 3, the terminal 2 transmits a page request to the authentication server 1 and receives a page response from the authentication server 1 using both the first URL and the second URL. That is, the first page is displayed on the browser activated at the time of the first authentication, and the second page is also displayed on the same browser at the time of the second authentication.
Therefore, the authentication server 1 stores the cookie value unique to the user in the browser displayed by the first page response at the time of the first authentication. Then, the terminal 2 transmits a second page request including the cookie value to the authentication server 1 during the second authentication. The authentication server 1 determines whether or not the cookie value included in the second page request is stored in the registration table 100 at the time of the first authentication. If it is determined to be true, the authentication is successful, but if it is determined to be false (the cookie value is not stored in the registration table 100), it can be determined that the authentication has failed.

  FIG. 4 is a first sequence diagram for determining authentication based on the cookie value of the terminal.

According to FIG. 4, compared with FIG. 1, only the sequence of S12 is different.
(S121) Upon receiving an HTTP Get Request for http://www.SM.co.jp/A, the authentication server 1 determines whether or not the URL is registered in the registration table 100. .
(S122) The authentication server 1 generates a cookie value (A1B2C3D4) for the user A when determined to be true in S121. The cookie value is determined uniquely by the authentication server 1 for the user.
(S123) The authentication server 1 returns a first page response including the “cookie value” generated in S122 to the terminal 2. As a result, the terminal 2 activates the browser and stores the cookie value in the browser.
Then, the authentication server 1 registers the cookie value (A1B2C3D4) in the registration table 100 in association with the user A.

  FIG. 5 is a second sequence diagram subsequent to FIG.

According to FIG. 5, compared with FIG. 1, only the sequence of S31 and S32 is different.
(S31) When the terminal 2 transmits an HTTP Get Request for http://www.SM.co.jp/Axx, the terminal 2 includes the cookie value (A1B2C3D4) stored in the browser activated in S123.
(S32) When the authentication server 1 receives the HTTP Get Request, the URL (http://www.SM.co.jp/Axx) and the cookie value (A1B2C3D4) are registered in the registration table 100. It is determined whether or not. If it is determined to be true, the authentication is successful, but if it is determined to be false (the cookie value is not stored in the registration table 100), it is determined that the authentication has failed.

  FIG. 6 is a functional configuration diagram of the authentication server in the present invention.

  According to FIG. 6, the authentication server 1 includes a registration table 100, a first message transmission unit 101, a second URL generation unit 11, a second message transmission unit 12, and an authentication unit 13. These functional components are realized by executing a program that causes a computer mounted on the server to function. The processing flow of these functional components can also be understood as an authentication method.

The registration table 100 stores an address and a first URL that can identify the user for each user ID (see FIG. 1 described above).
The first message transmission unit 101 transmits the first message describing the first URL, with the address of the user ID identified by the first URL as the destination (see S0 in FIG. 1 described above).
When receiving the first page request for the first URL from the terminal 2, the second URL generation unit 11 identifies the user ID and generates a second URL that can identify the user ID. (Refer to S1 in FIG. 1).
The second message transmission unit 12 transmits the second message in which the second URL is described with the address of the user ID as a destination (see S2 in FIG. 1).
When the authentication unit 13 receives the second page request for the second URL from the terminal 2, the authentication unit 13 determines that the user ID has been successfully authenticated (see S3 in FIG. 1).

  As described above in detail, according to the authentication server, program, and method of the present invention, two-step user authentication is performed without requiring the user to input any code (user ID, password, passcode). Can do.

As described above, according to the present invention, user authentication can be executed with only two stages of URL taps. Here, the operational effect of Non-Patent Document 1 is compared with the operational effect of the present invention.
(1) According to Non-Patent Document 1, a user ID and a password are input at the time of the first authentication, but the present invention only taps the first URL dedicated to the user ID. This is similar to the fact that only the user knows the user ID and password, and the first URL is dedicated to the user and can only be known by the user (first step).
(2) According to Non-Patent Document 1, an SMS message is transmitted by telephone call to the user's smartphone at the time of the second authentication. In this respect, the message transmission of the present invention is the same (second Step).
(3) According to Non-Patent Document 1, the pass code of the SMS message is input to the site at the time of the second authentication, but the present invention only taps the one-time second URL dedicated to the user ID. It is. This is the same as validating the passcode in one time, and the second URL is valid only in one time (third step).

  According to the present invention, different authentication URLs dedicated to user IDs are used in both S1 and S3. In light of Non-Patent Document 1, this corresponds to performing an input operation with different user ID and password twice. This can be more advantageous than Non-Patent Document 1 in terms of ensuring security.

  Further, according to the present invention, even if the first URL dedicated to the user ID leaks, the message including the one-time second URL reaches only the terminal 2 of the true user. Thus, according to the present invention, the user ID and the password are concealed by the first URL and the second URL dedicated to the user ID, and the security of user authentication can be improved.

  Furthermore, according to the present invention, the user only taps two authentication URLs displayed on the terminal 2, and does not need to start a specific application on the terminal 2. There is no need to access.

  As described above, the present invention only taps the first URL and the second URL twice with respect to the user, despite ensuring the same or higher security as compared with Non-Patent Document 1. Only the operation of is required.

  Various changes, modifications, and omissions of the above-described various embodiments of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

DESCRIPTION OF SYMBOLS 1 Authentication server 100 Registration table 101 1st message transmission part 11 2nd URL production | generation part 12 2nd message transmission part 13 Authentication part 2 Terminal

Claims (9)

In the authentication server that authenticates the user who operates the terminal,
For each user ID (IDentifier), a registration table that stores an address and a first URL (Uniform Resource Locator) that can identify the user;
A second URL generating means for identifying a user ID and generating a second URL that can identify the user ID when receiving a first page request for the first URL from the terminal;
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
An authentication server, comprising: an authentication unit that makes the authentication of the user ID successful when a second page request directed to the second URL is received from the terminal. The first message transmitting means for transmitting the first message describing the first URL to the address of the user ID identified by the first URL as a destination. Authentication server. 3. The second URL generation means generates a second URL different as a one-time URL every time a first page request is received even for the same user ID. Authentication server described in. The authenticating means only receives the user ID when the time from when the second message transmitting means transmits the second message to when the second page request is received is equal to or shorter than a predetermined time. The authentication server according to any one of claims 1 to 3, wherein the authentication is successful. When receiving the first page request from the terminal, the second URL generation means generates a cookie value in HTTP (HyperText Transfer Protocol) cookie protocol, responds to the cookie value to the terminal, In association with the user ID identified by the URL, the cookie value is registered in the registration table,
If the cookie value included in the second page request matches the cookie value based on the user registered in the registration table, the authentication means determines that the user ID has been successfully authenticated to the terminal. The authentication server according to any one of claims 1 to 4, characterized in that: The address of the terminal is an email address, a phone number or an account,
The second message is
An email based on the email address;
SMS (Short Message Service) push message based on the phone number, or
6. The authentication server according to claim 1, wherein the authentication server is an SNS (Social Networking Service) message based on the account. The user ID is a user ID of a commercial transaction site or a block chain site, or a wallet ID of a virtual currency,
The authentication server according to claim 1, wherein the user ID is authenticated without using a password. In a program for causing a computer mounted on an authentication server to authenticate a user who operates a terminal to function,
For each user ID, a registration table that stores an address and a first URL that can identify the user;
A second URL generating means for identifying a user ID and generating a second URL that can identify the user ID when receiving a first page request for the first URL from the terminal;
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
A program for causing a computer to function as an authentication means for successful authentication of a user ID when receiving a second page request for a second URL from the terminal. An authentication server two-step authentication method for authenticating a user operating a terminal,
The authentication server is
For each user ID, an address and a first URL that can identify the user are stored,
A first step of identifying a user ID and generating a second URL capable of identifying the user ID when receiving a first page request for the first URL from the terminal;
A second step of transmitting a second message in which a second URL is described with the address of the user ID as a destination;
A two-step authentication method for an authentication server, wherein, when a second page request directed to a second URL is received from the terminal, a third step of making the authentication of the user ID successful is executed.

Images