JP6953759B2 - Authentication device, authentication method and program - Google Patents

Description

The present disclosure relates to authentication devices, authentication methods and programs.

With the spread of the Internet, an environment in which resources such as a computer system that provides services without geographical restrictions, such as a server, can be used is being prepared. Cloud services, which have been increasing in use in recent years, are also considered to be an example of how to use computer systems that are free from geographical restrictions.

However, while the release from geographical restrictions makes it easier to use resources such as servers, unauthorized access to servers by malicious users is increasing.

This unauthorized access may be made not only for the purpose of obtaining the resources of the server or the confidential information contained in the resources, but also for the purpose of interfering with the services provided by the server. Authentication is becoming increasingly important to protect resources such as servers, sensitive information and services from these unauthorized accesses.

A strong authentication mechanism is required to protect the server. However, the stronger the authentication mechanism, the more computer resources (CPU (Central Processing Unit) and memory) of the server required for the authentication mechanism.

Furthermore, the number of times authentication itself is increasing due to the increase in server users due to the release from geographical restrictions and access with the intention of interfering with services (DoS (Denial of Services) attack).

Due to these backgrounds, the cost of authentication in the computer resources owned by the server tends to increase, and the cost of authentication may put a heavy load on the server that provides the service.

As a means for distributing the load of authentication, for example, Patent Document 1 describes a "scale-out" method in which authentication is shared by a plurality of computers. In the method described in Patent Document 1, the client terminal used by the user who requested the authentication accesses each server based on the priority of each server for authentication, so that the authentication on each server is performed. Equalize costs.

Japanese Unexamined Patent Publication No. 11-41252

However, for example, it is difficult to use the method described in Patent Document 1 because a plurality of computers cannot be used in a server such as a mainframe on the premise that a service is provided by one computer.

In view of the above problems, the present disclosure provides a technique for efficiently performing authentication in one computer.

The authentication device according to one form of the present disclosure accepts an authentication request which is a request for authentication for the use of the service, and executes the authentication according to a first priority indicating the priority of the service related to the authentication request. A determination means for assigning a second priority indicating the priority of the above to the authentication request, a selection means for selecting the authentication request to be authenticated according to the second priority, and the selected authentication. It is provided with an authentication means for performing the authentication in response to the request.

The authentication method according to one form of the present disclosure accepts an authentication request which is a request for authentication for the use of the service, and executes the authentication according to a first priority indicating the priority of the service related to the authentication request. A second priority indicating the order is given to the authentication request, an authentication request to be authenticated is selected according to the second priority, and the authentication is performed for the selected authentication request. ..

The program according to one form of the present disclosure accepts an authentication request, which is a request for authentication for the use of the service, and executes the authentication in the order of execution of the authentication according to the first priority indicating the priority of the service related to the authentication request. A determination process for assigning a second priority indicating the above to the authentication request, a selection process for selecting an authentication request to be authenticated according to the second priority, and a selection process for the selected authentication request. , The authentication process for performing the authentication, and the computer are made to execute.

According to the present disclosure, authentication can be efficiently performed in one computer.

It is a functional block diagram which shows an example of the structure of the authentication system which concerns on 1st Embodiment. It is a figure which shows an example of the data structure of the authentication request transmitted from each client terminal. It is a figure which shows an example of a priority determination database. It is a figure which shows an example of the authentication request list. It is a figure which shows an example of the authentication waiting list. It is a flowchart which shows an example of the operation of the determination part. It is a flowchart which shows an example of the operation of a selection part. It is a flowchart which shows an example of the operation of the confirmation part. It is a figure which shows an example of a safety list. It is a figure which shows an example of the authentication request list in the modification 1. It is a figure which shows an example of the password evaluation list. It is a flowchart which shows an example of the operation of the determination part in the modification 2. It is a figure which shows an example of the authentication request list in the modification 2. It is a functional block diagram which shows an example of the structure of the authentication apparatus in the modification 3. It is a figure which shows an example of a continuous list. It is a figure which shows an example of the authentication request list in the modification 3. It is a figure which shows an example of an address list. It is a figure which shows an example of the authentication request list in the modification 4. It is a figure which shows an example of the authentication request list in the modification 5. It is a figure which shows an example of the authentication request list in the modification 6. It is a figure which shows an example of a client terminal list. It is a figure which shows the authentication request list in the modification 7. It is a figure which shows an example of a biometrics list. It is a figure which shows an example of the authentication request list in the modification 8. It is a figure which shows an example of the usage information list. It is a figure which shows an example of a priority list. It is a figure which shows an example of the authentication request list in the modification 9. It is a functional block diagram which shows an example of the structure of the authentication apparatus which concerns on 2nd Embodiment. It is a flowchart which shows an example of the operation of the authentication apparatus which concerns on 2nd Embodiment. It is a block diagram which shows an example of the hardware configuration of the authentication apparatus or the information processing apparatus which realizes the authentication system which concerns on each embodiment of this disclosure.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

<First Embodiment>
FIG. 1 is a functional block diagram showing an example of the configuration of the authentication system 1. The authentication system 1 includes an authentication device 10, a server 20, a server 30, a client terminal 40, and a client terminal 50.

The server 20 and the server 30 provide services to the client terminal 40 and the client terminal 50 via a wired or wireless network. The server 20 is composed of, for example, an HTTP (HyperText Transfer Protocol) server. The server 30 is composed of, for example, a mail server. That is, the server 20 provides the HTTP service, and the server 30 provides the mail service.

The authentication device 10 is a device that authenticates the client terminal 40 or the client terminal 50 for using the service provided by the server 20 or the server 30. In other words, the authentication device 10 is a device that determines whether or not the client terminal 40 and the client terminal 50 have the authority to use the server 20 or the service provided by the server 30.

Further, for example, the authentication device 10 is realized by PAM (Pluggable Authentication Modules) used in Linux (registered trademark) and the like. The authentication device 10 includes a determination unit 11, a confirmation unit 12, a selection unit 13, an authentication unit 14, and a storage unit 15.

(Memory unit 15)
The storage unit 15 stores the authentication request list 151 in which the authentication request to which the priority is given is stored, and the priority determination in which the information used by the determination unit 11 to give the priority to the authentication request is stored. The database 152, the authentication waiting list 153, and the authentication request amount 154 are stored. The authentication request list 151, the priority determination database 152, the authentication waiting list 153, and the authentication request amount 154 will be described later.

(Judgment unit 11)
The determination unit 11 receives an authentication request (hereinafter referred to as a first authentication request) received by the server 20 or the server 30 from the client terminal 40 or the client terminal 50. The first authentication request is an authentication request for the use of the service provided by the server 20 or the server 30.

FIG. 2 is a diagram showing an example of the data structure of the first authentication request received from each server by the determination unit 11. One entry in the table shown in FIG. 2 indicates one first authentication request. The first authentication request includes an authentication request service 1511, an authentication ID (Identifier) 1512, and a password 1513.

The authentication request service 1511 represents a service provided by the server 20 or the server 30 to which the client terminal 40 or the client terminal 50 has sent an authentication request. The authentication request service 1511 may be a service name representing the service, or may be the port number of each server that provides the service.

The authentication ID 1512 is an identifier that identifies a user (hereinafter referred to as a client) who uses each client terminal. The password 1513 is a password used for authentication performed by the authentication unit 14. Authentication ID 1512 and password 1513 are commonly used to ensure client identification and legitimacy.

The determination unit 11 assigns a receipt number (order information) indicating the order of acceptance to the first authentication request. Hereinafter, the first authentication request to which the receipt number is given (including the receipt number) is referred to as a second authentication request. Further, the determination unit 11 determines whether or not to give priority to the second authentication request according to the information included in the second authentication request.

Further, the determination unit 11 stores in the authentication waiting list 153 the second authentication request whose priority associated with the authentication request service 1511 included in the second authentication request exceeds the threshold value. Here, as an example, the threshold value corresponds to a numerical value representing a predetermined order of priority. That is, the authentication waiting list 153 is a list that temporarily stores the authentication request determined by the determination unit 11 to be an authentication request for a service for which the priority order (priority) is relatively high and the responsiveness is not required. Is.

Further, the determination unit 11 assigns a priority to the second authentication request when the priority associated with the authentication request service 1511 included in the second authentication request satisfies a predetermined condition. The predetermined condition is, for example, that the priority associated with the authentication request service 1511 included in the second authentication request is equal to or less than the threshold value.
Hereinafter, the second authentication request (including the priority) to which the priority of a relatively high priority is given is referred to as a third authentication request. Then, the determination unit 11 stores the third authentication request in the authentication request list 151. The operation when the determination unit 11 receives the second authentication request from the confirmation unit 12 will be described later using the flowcharts shown in FIGS. 6 and 8.

FIG. 3 is a diagram showing an example of the priority determination database 152 stored in the storage unit 15. The priority determination database 152 includes an authentication request service 1511 and a priority 1522. The authentication request service 1511 and the priority 1522 are linked. The priority (first priority) 1522 indicates the priority for the authentication request service 1511 associated with itself.

Specifically, the authentication request service 1511 has a priority of "mail" service (called mail service) 1522 is "1", and the authentication request service 1511 has a priority of "HTTP" service (called HTTP service). 1522 is "2". In the present disclosure, it is assumed that the smaller the numerical value of the priority 1522, the higher the priority. Therefore, it is assumed that the priority of the mail service is higher than the priority of the HTTP service.

The authentication request service 1511 included in the first authentication request is also a service provided by each server as described above. Therefore, the determination unit 11 refers to the priority determination database 152 shown in FIG. 3 in order to confirm the priority 1522 associated with the authentication request service 1151 included in the second authentication request.

Here, the authentication request list 151 and the authentication waiting list 153 will be described with reference to FIGS. 4 and 5.

FIG. 4 is a diagram showing an example of the authentication request list 151. One entry in the authentication request list 151 shown in FIG. 4 indicates one third authentication request. The authentication request list 151 is associated with the authentication request service 1511, the authentication ID 1512, the password 1513, the receipt number 1514, and the priority 1515, respectively. That is, the third authentication request includes the authentication request service 1511, the authentication ID 1512, the password 1513, the receipt number 1514 and the priority 1515. The priority (second priority) 1515 indicates the priority given to the authentication request by the authentication unit 14 described later to execute the authentication.

In the authentication request list 151 shown in FIG. 4, the receipt number 1514 included in the third authentication request is a time stamp indicating the time when the determination unit 11 receives the authentication request. Further, in the first embodiment, the priority 1515 included in the third authentication request is equal to the priority 1522 associated with the authentication request service 1511 included in each third authentication request. Therefore, as shown in FIG. 4, there is an authentication request to which the same priority 1515 is given.

The authentication request amount 154 indicates the number of authentication requests stored in the authentication request list 151. For example, in the case of the authentication request list 151 shown in FIG. 4, the authentication request amount 154 is “3”.

FIG. 5 is a diagram showing an example of the authentication waiting list 153. One entry in the authentication waiting list 153 shown in FIG. 5 indicates one second authentication request. The authentication waiting list 153 is associated with the authentication request service 1511, the authentication ID 1512, the password 1513, and the receipt number 1514. That is, the second authentication request includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the receipt number 1514.

(Selection unit 13)
The selection unit 13 selects a third authentication request for which the authentication unit 14 authenticates. Specifically, the selection unit 13 selects the third authentication request including the highest priority among the third authentication requests stored in the authentication request list 151, and selects the selected third authentication request as the authentication unit. Send to 14.

(Authentication unit 14)
The authentication unit 14 authenticates the third authentication request transmitted from the selection unit 13. Specifically, the authentication unit 14 uses a general method to determine whether or not the client terminal 40 and the client terminal 50 have the authority to use the server 20 or the service provided by the server 30.

(Confirmation unit 12)
The confirmation unit 12 transmits the second authentication request to the determination unit 11. As described above, the authentication unit 14 authenticates according to the priority 1515 included in the third authentication request. Since the second authentication request does not include the priority 1515, it is not authenticated by the authentication unit 14. Therefore, the confirmation unit 12 transmits a second authentication request to the determination unit 11 so that the determination unit 11 again determines whether or not to assign the priority 1515.

FIG. 6 is a flowchart showing an example of the operation of the determination unit 11. The determination unit 11 accepts the authentication request (step S401). Specifically, the determination unit 11 receives the first authentication request from the server 20 or the server 30, or receives the second authentication request from the confirmation unit 12.

The determination unit 11 determines whether or not the receipt number 1514 is assigned to the received authentication request (step S402). Specifically, the determination unit 11 determines whether the received authentication request is the first authentication request or the second authentication request. The first authentication request received from the server 20 or the server 30 does not include the receipt number 1514 as shown in FIG. On the other hand, the second authentication request received from the confirmation unit 12 includes the receipt number 1514 as shown in FIG. Therefore, in the case of the first authentication request, the process becomes NO in step S402, and in the case of the second authentication request, the process becomes YES in step S402.

If the received authentication request is given the receipt number 1514 (YES in step S402), that is, if the received authentication request is the second authentication request, the process proceeds to step S404.

On the other hand, if the received authentication request is not given the receipt number 1514 (NO in step S402), that is, if the authentication request received by the determination unit 11 is the first authentication request, the process proceeds to step S403. .. Then, the determination unit 11 assigns the receipt number 1514 to the first authentication request received (step S403). By the process of step S403, the first authentication request becomes the second authentication request.

The determination unit 11 refers to the priority determination database 152 and confirms the priority 1522 associated with the authentication request service 1511 included in the second authentication request (step S404). Then, the determination unit 11 determines whether or not the authentication request amount 154 is equal to or less than the threshold value (step S405).

When the authentication request amount 154 is larger than the threshold value (NO in step S405), the determination unit 11 determines whether or not the priority 1522 associated with the authentication request service 1511 confirmed in step S404 is equal to or less than the threshold value (step). S409).

When the priority 1522 is equal to or less than the threshold value (YES in step S409), or when the authentication request amount 154 is equal to or less than the threshold value (YES in step S405), the determination unit 11 responds to the second authentication request in step S404. The priority 1522 associated with the authentication request service 1511 confirmed in the above is given as the priority 1515 for the authentication request (step S406). By the process of step S406, the second authentication request becomes the third authentication request. The determination unit 11 assigns the priority 1522 associated with the authentication request service 1511 as the priority 1515 for the authentication request. As a result, the authentication device 10 can increase the speed of the process of assigning the priority 1515 as compared with the case where the priority 1515 for the authentication request is newly calculated and the calculated priority 1515 is assigned to the authentication request.

Then, the determination unit 11 stores the third authentication request in the authentication request list 151 (step S407). Since the number of the third authentication requests stored in the authentication request list 151 increases due to the process of step S407, the determination unit 11 updates the authentication request amount 154 (step S408). Then, the process ends.

When the priority 1522 is larger than the threshold value (NO in step S409), the determination unit 11 returns the response of the authentication standby to the sender who transmitted the authentication request received in step S401 (step S410). Specifically, when the authentication request received in step S401 is the first authentication request, the determination unit 11 returns an authentication waiting response to the server 20 or server 30 in step S410. If the authentication request received in step S401 is the second authentication request, the determination unit 11 returns the authentication standby response to the confirmation unit 12 in step S410. After that, the determination unit 11 stores the second authentication request in the authentication waiting list 153 (step S411). Then, the process ends.

FIG. 7 is a flowchart showing an example of the operation of the selection unit 13. The selection unit 13 periodically performs the following operations. The selection unit 13 determines whether or not the third authentication request is stored in the authentication request list 151 (step S501). If the third authentication request is not stored in the authentication request list 151 (NO in step S501), the process ends.

On the other hand, when the third authentication request is stored in the authentication request list 151 (YES in step S501), the selection unit 13 is the most among the third authentication requests stored in the authentication request list 151. A third authentication request including a priority corresponding to the higher priority (hereinafter referred to as the highest priority) is selected (step S502).

Then, the selection unit 13 determines whether or not there are a plurality of third authentication requests including the highest priority selected in step S502 (step S503). If there are not a plurality of third authentication requests including the highest priority (NO in step S503), that is, if there is only one third authentication request containing the highest priority, the process proceeds to step S505.

On the other hand, when there are a plurality of third authentication requests including the highest priority (YES in step S503), the selection unit 13 is the oldest of the plurality of third authentication requests including the highest priority. Select a third authentication request that includes receipt number 1514 (step S504). In the present embodiment, the receipt number 1514 is a time stamp and may not be the same number. Therefore, in step S504, even if there are a plurality of third authentication requests including the highest priority, the selection unit 13 selects one third authentication request by referring to the receipt number 1514 which is the time stamp. can do. Then, the process proceeds to step S505.

The selection unit 13 transmits one third authentication request selected in step S502 or step S504 to the authentication unit 14 (step S505). After that, the process proceeds to step S501.

Through the above processing, the authentication unit 14 authenticates the third authentication request transmitted from the selection unit 13 in step S505.

For example, the determination unit 11 may periodically send an instruction to the selection unit 13 to perform the operation shown in FIG. 7. Then, the selection unit 13 may perform the operation shown in FIG. 7 based on the instruction from the determination unit 11. Further, the selection unit 13 may periodically execute the operation shown in FIG. 7.

FIG. 8 is a flowchart showing an example of the operation of the confirmation unit 12. The confirmation unit 12 periodically performs the following operations. The confirmation unit 12 determines whether or not the second authentication request is stored in the authentication waiting list 153 (step S601). If the second authentication request is not stored in the authentication waiting list 153 (NO in step S601), the process ends.

On the other hand, when the second authentication request is stored in the authentication waiting list 153 (YES in step S601), the confirmation unit 12 acquires the authentication request amount 154 from the storage unit 15 (step S602). Then, the confirmation unit 12 determines whether or not the authentication request amount 154 is equal to or less than the threshold value (step S603). When the authentication request amount 154 is larger than the threshold value (NO in step S603), the process ends.

When the authentication request amount 154 is equal to or less than the threshold value (YES in step S603), the confirmation unit 12 is the second authentication request stored in the authentication waiting list 153, including the oldest receipt number 1514. Select an authentication request (step S604). Then, the confirmation unit 12 transmits the second authentication request selected in step S604 to the determination unit 11 (step S605). Then, the process proceeds to step S601.

The determination unit 11 performs the process shown in FIG. 6 in response to the second authentication request transmitted from the confirmation unit 12 in step S605.

The second authentication request whose priority associated with the authentication request service 1511 included in the second authentication request exceeds the threshold value is stored in the authentication waiting list 153 without being given the priority 1515. For example, when a large number of authentication requests are received, priority 1515 is given to all the authentication requests received by the determination unit 11, and then the authentication requests are divided into the authentication request list 151 and the authentication standby list 153. For the authentication device 10, giving priority may reduce the responsiveness of the authentication process. Therefore, the authentication device 10 stores, for example, a large number of authentication requests in the certificate waiting list 153 without giving priority to the second authentication request whose priority associated with the authentication request service 1511 exceeds the threshold value. Even if it is accepted, the priority can be given without deteriorating the responsiveness of the authentication process.

When the authentication request amount 154 is equal to or less than the threshold value, the determination unit 11 assigns the priority 1515 regardless of the priority 1522 associated with the authentication request service 1511 included in the second authentication request. For example, the determination unit 11 assigns the priority 1515 to the second authentication request only when the priority 1522 associated with the authentication request service 1511 included in the second authentication request is smaller than the threshold value. For example, if the priority 1522 associated with the authentication request service 1511 included in all the second authentication requests is larger than the threshold value, there is a possibility that no third authentication request is included in the authentication list 151. Therefore, the determination unit 11 gives priority 1515 to the second authentication request according to the authentication request amount 154, which is the number of the third authentication requests in the authentication list 151, so that the authentication unit 14 efficiently authenticates. It can be performed.

The number of servers included in the authentication system 1 may be one or three or more. Further, the number of client terminals included in the authentication system 1 may be one or three or more. Further, for example, the server 20 or the server 30 may provide two or more services.

The client terminal 40 or the client terminal 50 may use one or more services.

Further, the authentication device 10 may be configured to be included in the server 20 or the server 30 that provides the service.

The receipt number 1514 given to the first authentication request does not have to be a time stamp. The determination unit 11 may assign numbers 1, 2, 3, ..., N (N: natural number) as the receipt number 1514 in the order in which the first authentication request is received. The receipt number 1514 may be assigned so that the order received by the determination unit 11 can be understood.

In this case, in step S604, the confirmation unit 12 may select the second authentication request including the receipt number 1514 having the smallest value among the plurality of second authentication requests. Similarly, in step S504, the selection unit 13 may select the third authentication request including the smallest receipt number 1514 among the plurality of third authentication requests.

Further, when the priority 1522 associated with the authentication request service 1511 confirmed in step S406 is larger than the threshold value, the determination unit 11 may perform the process of step S411 first instead of the process of step S410.

Further, how to handle the response of the authentication standby can be determined on each server or each client terminal side. For example, when each server receives an authentication waiting response, it may send a message to each client terminal indicating that it will wait for a certain period of time. Then, the client terminal may display the received message.

Further, when the authentication is completed, the authentication unit 14 may send a notification indicating that the authentication is completed to the requester of the authentication request.

Further, each server or each client terminal may suspend (time out) the process when receiving the response of the authentication standby. The process of step S409 can be arbitrarily executed as needed.

In this way, the determination unit 11 assigns the receipt number 1514 to the received authentication request, and sets the priority 1522 associated with the authentication request service 1511 including the received authentication request as the priority 1515 for the authentication request, and sets the authentication request. By assigning to, the authentication priority of the authentication request is set. As a result, the selection unit 13 selects the authentication requests to be authenticated by the authentication unit 14 one by one based on the priority of authentication, and transmits the authentication requests to the authentication unit 14. Therefore, the authentication unit 14 can authenticate the authentication request transmitted from the selection unit 13. As a result, the authentication device 10 can efficiently perform authentication in one computer.

(Modification example 1)
Here, a modified example applicable to the first embodiment will be described. In the first embodiment, the determination unit 11 assigns the priority 1522 associated with the authentication request service 1511 included in the second authentication request to the second authentication request as the priority 1515 for the authentication request. In the first modification, the determination unit 11 evaluates the security of the registered password and uses the evaluation result to give priority to the authentication request. In variant 1, the storage unit 15 stores a security list 155 that includes information about password security.

FIG. 9 is a diagram showing an example of the safety list 155. The security list 155 includes an authentication ID 1512 and a password evaluation value 1552, which is an evaluation value for the security of the password. Then, the authentication ID 1512 and the password evaluation value 1552 are associated with each other.

The password evaluation value 1552 is a value given based on the result of evaluation by the determination unit 11 for the security of the registered password, which is a password registered in advance by each client. For example, the registration password is evaluated by the determination unit 11 when each client sets the registration password. The method in which the determination unit 11 evaluates the security of the registered password is a general method.

The determination unit 11 may evaluate the security of the registered password by, for example, comparing the number of characters of the registered password with the threshold value. In the security list 155 shown in FIG. 9, it is assumed that the registered password evaluated to be more secure is given a smaller value.

In the first modification, the determination unit 11 sets the priority 1522 associated with the authentication request service 1511 included in the second authentication request instead of the priority 1522 associated with the authentication request service 1511 included in the second authentication request. , The password evaluation value 1552 associated with the authentication ID 1512 included in the second authentication request stored in the security list 155 is used to give priority to the authentication request.

For example, the determination unit 11 refers to the safety list 155. Then, the determination unit 11 acquires the password evaluation value 1552 associated with the authentication ID 1512 included in the second authentication request. After that, the determination unit 11 sets the value calculated by multiplying the priority 1522 associated with the authentication request service 1511 and the password evaluation value 1552 associated with the authentication ID 1512 as the priority for the authentication request, and sets the second authentication request. Give to. As for the priority for the authentication request, the smaller the value, the higher the priority.

FIG. 10 is a diagram showing an example of the authentication request list 251 in the modification 1. The authentication request list 251 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 1. The authentication request list 251 includes an authentication request service 1511, an authentication ID 1512, a password 1513, a receipt number 1514, and a priority 2515 for an authentication request.

The priority 2515 is a value obtained by multiplying the priority 1522 associated with the authentication request service 1511 stored in the priority determination database 152 shown in FIG. 3 and the password evaluation value 1552 associated with the authentication ID 1512, and is authenticated. Indicates the priority for the request.

Further, referring to the security list 155 shown in FIG. 9, the password evaluation value 1552 in which the authentication ID 1512 is “ID1” is “3”. Further, the password evaluation value 1552 of which the authentication ID 1512 is "ID3" is "1".

With reference to the priority determination database 152 shown in FIG. 3, the priority 1522 associated with the “mail” of the authentication request service 1511 is “1”. Further, the priority 1522 associated with the "HTTP" of the authentication request service 1511 is "2". Therefore, the priority 2515 for which the authentication ID 1512 is “ID1” is “3” calculated by multiplying the password evaluation value “3” of 1552 and the priority 1522 “1”. Further, the priority 2515 for which the authentication ID 1512 is “ID3” is “2” calculated by multiplying the password evaluation value “1” of 1552 and the priority 1522 “2”.

As shown in FIG. 9, the third authentication request in which the password evaluation value 1552 is "1" and the authentication ID 1512 is "ID3" is the third authentication request in which the password evaluation value 1552 is "2" and the authentication ID 1512 is "ID2". It has a higher priority than the certification request. Since the selection unit 13 transmits the third authentication request to the authentication unit 14 according to the priority 2525 included in the third authentication request, the order in which the third authentication request is received and the order in which the authentication is performed are performed. Will be different.

The security level of a password changes depending on the complexity and the number of characters. Therefore, a weak password has a risk of unauthorized use of the service by a brute force attack, which is a brute force attack by a malicious client.

Therefore, by giving a low priority to the authentication request with low security of the registered password, the priority of the authentication request from the client terminal used by the client with low security of the registered password is low. As a result, it can be expected that each client will set a highly secure registration password in order to receive the service preferentially. The authentication device 10 can reduce the number of brute force attacks by a malicious client and reduce the risk of unauthorized use of the service by making each client use a highly secure registration password. Further, by giving a high priority to the authentication request with high security of the registered password, the client set with the highly secure password is preferentially authenticated. For example, a service provider can reduce the number of clients who set less secure passwords by encouraging clients to set more secure passwords.

(Modification 2)
In the first modification, the determination unit 11 evaluates the security of the registered password and uses the password evaluation value 1552 to give priority to the authentication request. In this modification, the determination unit 11 evaluates the security of the password 1513 (entered password) included in the second authentication request, and the result of the evaluation and the authentication request service included in the second authentication request. A priority is given to the second authentication request by using the priority 1522 associated with 1511. Here, the value evaluated for the security of the password, which the determination unit 11 evaluates the password 1513 and outputs as a result of the evaluation, will be described.

FIG. 11 is a diagram showing an example of the password evaluation list 111. The password evaluation list 111 includes a password security 1111 and a security value 1112. The password security 1111 and the security value 1112 are associated with each other.

Password security 1111 indicates the degree of security with respect to password 1513. The security value 1112 indicates a value assigned to the password security 1111 according to the degree of security for the password 1513.

For example, when the determination unit 11 evaluates the security of the password 1513 included in the second authentication request and the security of the password 1513 included in the second authentication request is "high", the determination unit 11 determines the password. From the evaluation list 111, the security value 1112 "1" associated with the password security 1111 "high" is acquired. Further, for example, when the determination unit 11 evaluates the security of the password 1513 included in the second authentication request and the security of the password included in the second authentication request is "low", the determination unit 11 determines the password. From the evaluation list 111, the security value 1112 "3" associated with the password security 1111 "low" is acquired. The determination unit 11 may store the password evaluation list 111 shown in FIG. 12 in advance. Further, the determination unit 11 may evaluate the security of the password 1513 according to the complexity and / or the number of characters of the password 1513.

Since the password 1513 is included in the first authentication request, the storage unit 15 in the second modification does not have to store the security list 155. Instead, the determination unit 11 authenticates using the value evaluated for the security of the password 1513 included in the second authentication request and the priority 1522 associated with the authentication request service 1511 included in the second authentication request. Find the priority for the request. Specifically, the operation of the determination unit 11 in the second modification will be described with reference to FIG.

FIG. 12 is a flowchart showing an example of the operation of the determination unit 11 in the modification 2. Since the processes of steps S701 to S711 shown in FIG. 12 correspond to the processes of steps S401 to S411 shown in FIG. 6, description thereof will be omitted. In this modification, the password included in the second authentication request is evaluated before step S706.

When the priority 1522 is equal to or less than the threshold value (YES in step S709) or the authentication request amount 154 is equal to or less than the threshold value (YES in step S705), the determination unit 11 determines the password 1513 included in the second authentication request. Evaluate safety (step S712). Then, the determination unit 11 refers to the password evaluation list 111, which will be described later, using the security of the evaluated password 1513, and acquires a value associated with the security of the password 1513 (step S713). After that, the determination unit 11 calculates the priority for the second authentication request by using the value associated with the security of the password 1513 acquired in step S713 and the priority 1522 associated with the authentication request service 1511. (Step S714). Then, the determination unit 11 assigns the priority calculated in step S714 (step S706). The determination unit 11 may impart the security of the password 1513 evaluated in step S712 to the second authentication request.

FIG. 13 is a diagram showing an example of the authentication request list 351 in the modification 2. The authentication request list 351 is stored in the storage unit 15 instead of the authentication request list 151 in the second modification. The authentication request list 351 includes the authentication request service 1511, the authentication ID 1512, the password 1513, the password security 1111, the receipt number 1514, and the priority 3515 for the authentication request. The password security 1111 is the security of the password 1513 evaluated by the determination unit 11.

Priority 3515 indicates the priority given to the second authentication request. Further, the priority 3515 is linked to the safety value 1112, which is a value evaluated for the security of the password 1513 (entered password) included in the second authentication, and the authentication request service 1511 included in the second authentication request. It is a value obtained by multiplying the priority of 1522.

With reference to the authentication request list 351 shown in FIG. 13, the security 1111 of the password of the third authentication request whose authentication ID 1512 is "ID1" is "low". Further, the security 1111 of the password of the third authentication request whose authentication ID 1512 is "ID2" is "medium". The password security 1111 with the authentication ID 1512 being "ID3" is "high".

Therefore, the priority 3515 with the authentication ID 1512 of "ID1" is associated with the security value 1112 "3" associated with the password security 1111 "low" and the authentication request service 1511 included in the second authentication request. It becomes "3" by multiplying "1" of priority 1522. Further, the priority 3515 of the authentication request whose authentication ID 1512 is "ID2" is the security value 1112 "2" associated with the password security 1111 "medium" and the authentication request service 1511 included in the second authentication request. It becomes "4" by multiplying "2" of priority 1522 associated with. The priority 3515 with the authentication ID 1512 of "ID3" is associated with the security value 1112 "1" associated with the password security 1111 "high" and the authentication request service 1511 included in the second authentication request. It becomes "1" calculated by multiplying it with "1" of priority 1522.

Referring to the authentication request list 351, the third authentication request with the authentication ID 1512 having a low password security 1111 is "ID1" is higher than the third authentication request with the authentication ID 1512 having a high password security 1111 being "ID2". It has a low priority. As a result, the order in which the authentication request is received and the order in which the authentication is performed are different.

Therefore, by assigning a low priority to an authentication request with low password security, the priority of the authentication request from the client terminal used by the client with low password security is low. As a result, it can be expected that the client will set a highly secure password in order to receive the service preferentially. The authentication device 10 can reduce the number of brute force attacks by a malicious client and reduce the risk of unauthorized use of the service by causing the client to use a highly secure password. In addition, by assigning a high priority to an authentication request with a high password security, the client for which a highly secure password is set is preferentially authenticated. For example, a service provider can reduce the number of clients who set less secure passwords by encouraging clients to set more secure passwords.

(Modification example 3)
In the second modification, the determination unit 11 evaluates the security of the password 1513 (entered password) included in the second authentication request, and the result of the evaluation and the authentication request service included in the second authentication request. The priority 1522 associated with 1511 was used to give priority to the authentication request. In the third modification, the determination unit 11 evaluates the result of the authentication process for each authentication ID 1512, and uses the evaluated result and the priority 1522 associated with the authentication request service 1511 included in the second authentication request. , Give priority to the second authentication request.

FIG. 14 is a functional block diagram showing an example of the configuration of the authentication device 100 according to the third modification. The authentication device 100 includes a determination unit 21, a confirmation unit 12, a selection unit 13, an authentication unit 24, and a storage unit 15. Further, in the authentication device 100, the determination unit 21 corresponding to the determination unit 11 and the authentication unit 24 corresponding to the authentication unit 14 are connected as compared with the authentication device 10 according to the first embodiment. Further, the authentication unit 24 and the storage unit 15 are connected to each other. Further, the storage unit 15 stores the continuous list 156, which will be described later. Further, the storage unit 15 stores the authentication request list 451 instead of the authentication request list 151.

The authentication unit 24 has the function of the authentication unit 14. Further, the authentication unit 24 counts the number of times that the authentication process for the third request is consecutively successful for each authentication ID 1512. Further, the authentication unit 24 counts the number of times that the authentication process for the third request fails continuously for each authentication ID 1512. Then, the authentication unit 24 stores in the storage unit 15 the number of times the authentication process succeeds in succession and the number of times the authentication process fails continuously. The determination unit 21 has the function of the determination unit 11.

FIG. 15 is a diagram showing an example of the linked list 156. The linked list 156 includes an authentication ID 1512, a number of consecutive successes 1562, a number of consecutive failures 1563, and a continuous evaluation value 1564.

The number of consecutive successes 1562 indicating the number of consecutive successes of the authentication process of the authentication unit 14 for the third authentication request, and the number of consecutive failures 1563 indicating the number of consecutive failures of the authentication process of the authentication unit 14 for the authentication request. The evaluation value is 1564.

The number of consecutive successes 1562 indicates the number of times that the authentication process for the third request has succeeded in succession. The number of consecutive failures 1563 indicates the number of times that the authentication process for the third request has failed in succession.

The continuous evaluation value 1564 is a value obtained by the determination unit 11 evaluating the reliability of the client associated with the authentication ID 1512 by using the number of consecutive successes 1562 and the number of consecutive failures 1563. Specifically, the continuous evaluation value 1564 is a value obtained by subtracting the number of consecutive successes 1562 from the reference value and adding the number of consecutive failures 1563. In the continuous list 156 shown in FIG. 14, the initial values of the number of consecutive successes 1562 and the number of consecutive failures 1563 are set to "0". The reference value is "10".

As for the continuous evaluation value 1564, the smaller the value, the higher the reliability of the client. The smaller the value of the continuous evaluation value 1564, the higher the priority is given by the determination unit 11. The reference value does not have to be "10", and the continuous evaluation value 1564 is a value that does not become a negative number so that the determination unit 11 can obtain the priority by multiplying the priority 1522 and the continuous evaluation value 1564. All you need is.

FIG. 16 is a diagram showing an example of the authentication request list 451 in the modification 3. The authentication request list 451 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 3. The authentication request list 451 includes an authentication request service 1511, an authentication ID 1512, a password 1513, a receipt number 1514 and a priority 4515.

The priority 4515 is a value obtained by multiplying the priority 1522 associated with the authentication request service 1511 included in the second authentication request and the continuous evaluation value 1564 associated with the authentication ID 1512 included in the second authentication request. ..

For example, when the authentication ID 1512 is "ID1", the priority 4515 is "1" of the priority 1522 associated with the "mail" of the authentication request service 1511 included in the second authentication request, and the authentication ID 1512 is "ID1". It becomes "12" calculated by multiplying "12" of the continuous evaluation value 1564 associated with.

Referring to the authentication request list 451, the third authentication request with the authentication ID 1512 having continuous authentication failures is "ID1", and the third authentication request with the authentication ID 1512 with continuous authentication successes is "ID3". It has a lower priority of 4515. Therefore, the order in which the authentication request is received and the order in which the authentication is performed are different.

Authentication requests have the characteristic that, as long as they are used for legitimate purposes, the number of successful authentications is greater than the number of unsuccessful authentications. Utilizing this characteristic, the number of consecutively successful authentications and the number of consecutively unsuccessful authentications are recorded, and the determination unit 11 considers that the reliability is high for the clients that continue to succeed, and the determination unit 11 has a high priority. Is given.

On the other hand, since there is a risk that the client that continues to fail is a malicious client, the determination unit 11 gives a low priority. By assigning priorities in this way, the determination unit 11 raises the priority of the authentication request from the client with high reliability and lowers the priority of the authentication request from the client with low reliability. As a result, the authentication device 100 can reduce the risk of unauthorized use.

If the authentication unit 24 does not perform the authentication process for the third authentication request including the specific authentication ID 1512 for a certain period of time, the authentication unit 24 counts the number of consecutive successes associated with the specific authentication ID 1512 and the number of consecutive failures. May be reset.

(Modification example 4)
In the fourth modification, the determination unit 11 uses the priority for the IP (Internet Protocol) address of the client terminal and the priority 1522 associated with the authentication request service 1511 included in the second authentication request. Give priority to the authentication request of.

In the fourth modification, the first authentication request received by the determination unit 11 from each server includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the IP address of the client terminal.

Further, in the modification 4, the storage unit 15 stores the address list 157. FIG. 17 is a diagram showing an example of the address list 157. In the address list 157, the network address unit 1571 of the IP address and the priority 1572 indicating the priority of the network address unit 1571 are stored in association with each other.

Specifically, the network whose network address unit 1571 is "abc" has a low reliability, and the priority 1572 is set to "3". Further, the priority 1572 is set to "1" because the network whose network address unit 1571 is "x.y.z" has high reliability. For networks in which the network address unit 1571 is neither "abc" nor "x.yz", the priority 1572 is set to "2". That is, the higher the reliability of the network, the smaller the value of the priority 1572.

FIG. 18 is a diagram showing an example of the authentication request list 551 in the modified example 4. The authentication request list 551 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 4. The authentication request list 551 includes the authentication request service 1511, the authentication ID 1512, the password 1513, the IP address 5511 of the client terminal, the receipt number 1514, and the priority 5515 for the authentication request. As described above, the IP address 5511 is included in the first authentication request in the fourth modification. That is, the first authentication request includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the IP address 5511. The second authentication request in the fourth modification is the above-mentioned first authentication request to which the receipt number 1514 is added.

The priority 5515 is obtained by multiplying the priority 1522 associated with the authentication request service 1511 included in the second authentication request and the priority 1572 associated with the network address unit 1571 of the IP address 5511 included in the second authentication request. It is a combined value.

Specifically, the IP address 5511 whose authentication ID 1512 is "ID1" is "abcd". Referring to FIG. 18, the priority 1572 associated with the network address portion “abc” is “3”. Therefore, the priority 1572 for the IP address "abcd" of the third authentication request whose authentication ID 1512 is "ID1" is "3".

Further, referring to the priority determination database 152 shown in FIG. 3, the priority 1522 associated with the mail service is “1”. Therefore, the priority 1572 associated with the network address unit "abc" is calculated by multiplying "3" by the priority 1522 "1" associated with the mail service, and the authentication ID 1512 is the authentication ID 1512. The priority of the third authentication request of "ID1" is 5515.

In this way, the third authentication request with the authentication ID 1512 connected from the low-reliability network having the authentication ID 1512 being "ID1" is more than the third authentication request with the authentication ID 1512 connected from the highly reliable network having the "ID3". Is also a low priority. Therefore, the order in which the authentication request is received and the order in which the authentication is performed are different.

When each client uses the service via the Internet, the authentication device 10 can identify the country in which each client terminal exists or the network to which each client terminal belongs based on the IP address 5511 possessed by each client terminal. Therefore, the authentication system 1 identifies a client terminal having an IP address belonging to a high-risk country or network, and lowers the priority of the authentication request sent from the identified client terminal, thereby risking unauthorized use. Can be reduced.

(Modification 5)
In the fifth modification, the determination unit 11 uses the information related to the RTT (Round Trip Time) and the priority 1522 associated with the authentication request service 1511 included in the second authentication request to make the second authentication request. Give priority to it.

In this modification, RTT indicates the time required for a three-way handshake, which is a procedure for establishing a network communication connection in TCP / IP (Transmission Control Protocol / Internet Protocol).

In the fifth modification, the first authentication request received by the determination unit 11 from each server includes information about the RTT in addition to the authentication request service 1511, the authentication ID 1512, and the password 1513.

FIG. 19 is a diagram showing an example of the authentication request list 651 in the modified example 5. The authentication request list 651 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 5. The authentication request list 651 includes an authentication request service 1511, an authentication ID 1512, a password 1513, an RTT6511, a receipt number 1514, and a priority 6515 for an authentication request.

The RTT6511 indicates the time required for the three-way handshake, which is a procedure for establishing a network communication connection between the client terminal and the server 20 or the server 30. The RTT6511 is included as information about the RTT in the first authentication request in the fifth modification. That is, the first authentication request in the fifth modification includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the RTT6511. The second authentication request in the fifth modification is the above-mentioned first authentication request to which the receipt number 1514 is added.

Priority 6515 is the priority given to the second authentication request. Specifically, the priority 6515 is a value obtained by multiplying the priority 1522 associated with the authentication request service 1511 included in the second authentication request and the value of RTT6511 included in the second authentication request.

For example, when the authentication ID 1512 is "ID1", the determination unit 11 sets the priority 1522 "1" associated with the authentication request service 1511 included in the second authentication request and the RTT6511 included in the second authentication request. Multiply the value "15" to obtain the priority 6515. Therefore, the priority 6515 in which the authentication ID 1512 is included in the third authentication request of "ID1" is "15".

When the authentication ID 1512 is "ID3", the determination unit 11 determines "1" of the priority 1522 associated with the authentication request service 1511 included in the second authentication request and the value of RTT6511 included in the second authentication request. Multiply by "5" to obtain the priority 6515. Therefore, the priority 6515 in which the authentication ID 1512 is included in the third authentication request of "ID3" is "5".

As described above, the third authentication request in which the authentication ID 1512 containing "15 ms" in the RTT 6511 is "ID 1" has a lower priority than the third authentication request in which the authentication ID 1512 containing "5 ms" in the RTT 6511 is "ID 3". Become. Therefore, the order in which the authentication request is received and the order in which the authentication is performed are different.

When a client uses a service provided by a server via the Internet, the time (RTT) required for establishing network communication between the server providing the service and the client terminal changes according to the network distance. The responsiveness of the network is reflected in the responsiveness of the service by the determination unit 11 giving a high priority to the authentication request of the client terminal for which the connection is established with the shorter RTT. Therefore, according to the authentication system 1 according to the modification 5, it is possible to provide a service having high responsiveness to a client terminal using a network having high responsiveness.

(Modification 6)
In the sixth modification, the determination unit 11 sets the priority for the second authentication request by using the password input latency and the priority 1522 associated with the authentication request service 1511 included in the second authentication request. Give.

In the sixth modification, the password input latency indicates the time from when each server requests each client terminal to input the password until the password is actually transmitted from the client terminal to each server. When each server requests each client terminal to input a password, the determination unit 11 measures the time when each server requests the password from each client terminal and the time when the password is transmitted from each client terminal to each server. However, the latency of password input can be obtained by calculating the difference between the respective times.

Further, in the modification 6, the first authentication request received from each server by the determination unit 11 includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the above-mentioned password input latency.

FIG. 20 is a diagram showing an example of the authentication request list 751 in the modification 6. The authentication request list 751 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 6. The authentication request list 751 includes an authentication request service 1511, an authentication ID 1512, a password 1513, a password input latency 7511, a receipt number 1514 and a priority 7515. The password input latency 7511 is included in the first authentication request in the modification 6 as described above. That is, the first authentication request includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the password input latency 7511. The second authentication request in the sixth modification is the above-mentioned first authentication request to which the receipt number 1514 is added.

Priority 7515 indicates the priority for the authentication request. Further, the priority 7515 is a value obtained by multiplying the priority 1522 associated with the authentication request service 1511 by using the value of the password input latency 7511.

Specifically, in the third authentication request in which the authentication ID 1512 is "ID1", the password input latency 7511 is "150 ms". Further, since the authentication request service 1511 having the authentication ID 1512 of "ID1" is a mail service, the priority 1522 associated with the service is "1". Therefore, the priority 7515 for the authentication request whose authentication ID 1512 is "ID1" is calculated by multiplying the password input latency 7511 value "150" and the priority 1522 "1" associated with the authentication request service 1511. It becomes "150".

Referring to the authentication request list 751, the third authentication request having the password input latency 7511 of "150 ms" and the authentication ID 1512 of "ID1" is the third authentication request of the password input latency 7511 of "50 ms" and the authentication ID 1512 of "ID3". It has a lower priority than the certification request of 3. Therefore, the order in which the authentication request is received and the order in which the authentication is performed are different.

In this way, the determination unit 11 assigns a high priority 7515 to the authentication request in which the password is input in a shorter time. As a result, the client can use the highly responsive service by inputting the password in a shorter time.

(Modification 7)
In the modification 7, the determination unit 11 uses the priority for the information of the application version used by each client terminal and the priority 1522 associated with the authentication request service 1511 included in the second authentication request. Therefore, priority is given to the second authentication request.

In the modification 7, the first authentication request received by the determination unit 11 from each server includes the authentication request service 1511, the authentication ID 1512, the password 1513, and information on the version of the application used by each client terminal. Is included.

In the modification 7, the storage unit 15 stores the client terminal list 158. FIG. 21 is a diagram showing an example of the client terminal list 158. The client terminal list 158 stores client information 1581, which is information on the version of the application used by each client terminal, and priority 1582, which indicates the priority of the client information 1581. The client information 1581 and the priority 1582 over the client information 1581 are associated with each other.

Specifically, the "Version 2" of the client information 1581 is associated with the "1" of the priority 1582, and the "Version 1" of the client information 1581 is associated with the "2" of the priority 1582. Further, the client information 1581 other than "Version 2" and "Version 1" is associated with "3" having a priority of 2582. The priority 1582 associated with the client information 1581 indicates that the smaller the value, the higher the priority.

FIG. 22 is a diagram showing an authentication request list 851 according to the modified example 7. The authentication request list 851 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 7. The authentication request list 851 includes the authentication request service 1511, the authentication ID 1512, the password 1513, the client information 1581, the receipt number 1514, and the priority 8515 for the authentication request. As described above, the client information 1581 is included in the first authentication request in the modification 7. That is, the first authentication request includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the client information 1581. The second authentication request in the modified example 7 is the above-mentioned first authentication request to which the receipt number 1514 is added.

Priority 8515 indicates the priority for the authentication request. Further, the priority 8515 is a value obtained by multiplying the priority 1522 associated with the authentication request service 1511 included in the second authentication request and the priority 1582 corresponding to the client information 1581 included in the second authentication request. Is.

Specifically, the authentication request for which the authentication ID 1512 is "ID1" includes the "Version 1" of the client information 1581 and the "mail" of the authentication request service 1511. Therefore, the priority 8515 with the authentication ID 1512 of "ID1" is the priority 1582 "2" associated with the client information 1581 "Version 1" and the priority 1522 "1" associated with the authentication request service 1511 "mail". Is multiplied to give "2". Further, the authentication request in which the authentication ID 1512 is "ID3" includes the "Version 2" of the client information 1581 and the "mail" of the authentication request service 1511. Therefore, the priority 8515 with the authentication ID 1512 of "ID3" is the priority 1582 "1" associated with the client information 1581 "Version 2" and the priority 1522 "1" associated with the authentication request service 1511 "mail". It becomes "1" calculated by multiplying with.

Therefore, as shown in the authentication request list 851, the third authentication request in which the authentication ID 1512 using "Version 1" is "ID 1" is the third authentication request in which the authentication ID 1512 using "Version 2" is "ID 3". It has a lower priority than the authentication request. Therefore, the order in which the authentication request is received and the order in which the authentication is performed are different.

It is common for client terminals that use services to have various applications and application versions mixed. Also, different applications and different versions of applications have different responsiveness and security strengths.

For example, a client terminal using the latest version of an application is likely to have high responsiveness and / or strong security. Therefore, the determination unit 11 gives a higher priority to the connection from the client terminal that uses the version of the application that is likely to have higher responsiveness and / or stronger security. As a result, according to the authentication system 1 according to the modification 7, it is possible to maintain high responsiveness and reduce the risk of unauthorized use.

(Modification 8)
In the modification 8, the priority is given to the second authentication request by using the information corresponding to the biometrics information of the client and the priority 1522 associated with the authentication request service 1511 included in the second authentication request. Give.

In the eighth modification, the client biometrics information indicates information on the behavioral characteristics of the client indicated by the authentication ID 1512. The information on the behavioral characteristics of the client is, for example, the speed or timing of typing when entering a password. When the client sets a password for each client terminal, the same password can be entered several times to quantify the typing speed or timing at the time of entering the password.

Further, in the modification 8, the first authentication request received by the determination unit 11 from each client terminal includes the authentication request service 1511, the authentication ID 1512, and the password 1513, as well as the client biometrics information acquired at the time of password input. Is included.

In the modified example 8, the storage unit 15 stores the biometrics list 159. FIG. 23 is a diagram showing an example of the biometrics list 159. In the biometrics list 159, the registered biometrics information 1592, which is the biometrics information registered in advance, is linked to the authentication ID 1512.

FIG. 24 is a diagram showing an example of the authentication request list 951 in the modified example 8. The authentication request list 951 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 8. The authentication request list 951 includes an authentication request service 1511, an authentication ID 1512, a password 1513, input biometric information 9511, a receipt number 1514, a similarity 9512 and a priority 9515 for an authentication request. The input biometrics information 9511 indicates the biometrics information of the client acquired at the time of entering the password as described above. That is, the first authentication request in the modification 8 includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the input biometrics information 9511. Further, the second authentication request in the modified example 8 is the above-mentioned first authentication request to which the receipt number 1514 is added.

The similarity 9512 indicates the degree to which the input biometric information 9511 and the registered biometric information 1592 are similar. The similarity 9512 is a value calculated by the determination unit 11 collating the input biometrics information 9511 and the registered biometrics information 1592 for each authentication ID 1512. That is, the determination unit 11 collates the input biometrics information 9511 with the registered biometrics information 1592, and calculates the similarity 9512 for each authentication ID 1512. Then, the determination unit 11 assigns the calculated similarity 9512 to the second authentication request. The determination unit 11 does not have to add the calculated similarity 9512 to the second authentication request. In the modified example 8, the smaller the value of the similarity 9512, the more similar the input biometric information 9511 and the registered biometric information 1592 are.

Priority 9515 indicates the priority for the authentication request. Further, the priority 9515 is a value obtained by multiplying the priority 1522 associated with the authentication request service 1511 and the similarity 9512 associated with each authentication ID 1512.

Specifically, the similarity 9512 in which the authentication ID 1512 is associated with "ID1" is "3". Further, since the authentication request service 1511 whose authentication ID 1512 is associated with "ID1" is a mail service, the priority 1522 associated with the authentication request service 1511 is "1". Therefore, the priority 9515 in which the authentication ID 1512 is associated with "ID1" is "3" obtained by multiplying the "3" in the similarity 9512 and the "1" in the priority 1522 associated with the authentication request service 1511. Further, the similarity 9512 in which the authentication ID 1512 is associated with "ID3" is "1". Further, since the authentication request service 1511 whose authentication ID 1512 is associated with "ID3" is a mail service, the priority 1522 associated with the authentication request service 1511 is "1". Therefore, the priority 9515 in which the authentication ID 1512 is associated with "ID3" is "1" obtained by multiplying the "1" in the similarity 9512 and the "1" in the priority 1522 associated with the authentication request service 1511.

Referring to the authentication request list 951, the third authentication request in which the authentication ID 1512 contains "ID1" has a lower priority 9515 than the third authentication request in which the authentication ID 1512 contains "ID3". Therefore, the order in which the authentication request is received and the order in which the authentication is performed are different.

The authentication system 1 according to the modified example 8 assigns a priority having a low priority to an authentication request having a low similarity. As a result, for example, it is possible to reduce the risk of unauthorized use by another person impersonating the client instead of the client himself / herself.

(Modification 9)
In the ninth modification, the second authentication is performed by using the importance according to the client information 1581, the password security 1111 and the like, and the priority 1522 associated with the authentication request service 1511 included in the second authentication request. Give priority to requests.

In the ninth modification, the first authentication request received by the determination unit 11 from each server includes the authentication request service 1511, the authentication ID 1512, the password 1513, and the client information 1581. Further, the second authentication request in the modification 9 is given the password security 1111 and the receipt number 1514.

In the ninth modification, the storage unit 15 stores the usage information list 160. FIG. 25 is a diagram showing an example of the usage information list 160. In the usage information list 160, usage information 1601 which is information used for giving priority to an authentication request and importance 1602 indicating the degree of importance of each usage information are stored in association with each other.

Further, the importance level 1602 indicates that the smaller the value, the higher the importance. Therefore, referring to the usage information list 160 shown in FIG. 25, it can be seen that the password security 1111 is more important than the client information 1581 in the modification 9. The usage information 1601 may be password input latency 7511, RTT6511, or the like.

Further, in the modification 9, the storage unit 15 stores the priority list 161. FIG. 26 is a diagram showing an example of the priority list 161. The priority list 161 includes an authentication ID 1512, a password priority 1612, a first intermediate value 1613, a client priority 1614, a second intermediate value 1615, and a total priority 1616. The authentication ID 1512, the password priority 1612, the client priority 1614, and the overall priority 1616 are linked. The first intermediate value 1613 and the second intermediate value 1615 will be described later.

The password priority 1612 is a priority given to the result of evaluation by the determination unit 11 of the password included in the authentication request associated with each authentication ID 1512 based on the password evaluation list 111 shown in FIG. ..

The client priority 1614 is a priority given to the client information 1581 of the client terminal associated with each authentication ID 1512 based on the client terminal list 158 shown in FIG.

The total priority 1616 indicates the priority for the combination of the password priority 1612 and the client priority 1614. The total priority 1616 is a value obtained by multiplying the password priority 1612, the client priority 1614, and the importance 1602.

Specifically, a method of obtaining the overall priority 1616 for which the authentication ID 1512 is "ID1" will be described. First, the determination unit 11 evaluates the security of the password 1513 included in the second authentication request of "PW1" and acquires "3" of the password priority 1612.

Then, the determination unit 11 refers to the priority list 161 and multiplies the “1” of the importance 1602 for the security of the password by the “3” of the password priority 1612, and “3” of the first intermediate value 1613. Is calculated.

Further, the determination unit 11 refers to the usage information list 160 and acquires the client priority 1614 "2" by using the "Version 1" of the client information 1581 included in the second authentication request. After that, the determination unit 11 refers to the priority list 161 and multiplies the “2” of the importance 1602 for the client information by the “2” of the priority 1614, and the second intermediate value 1615 “4”. Is calculated. Then, the determination unit 11 multiplies the first intermediate value 1613 for the security of the password and the second intermediate value 1615 for the client information to calculate "12" of the total priority 1616. After that, the priority 1522 "1" associated with the authentication request service 1511 whose authentication ID 1512 is "ID1" is acquired from the priority determination database 152. Then, the determination unit 11 multiplies the "12" of the total priority 1616 and the "1" of the priority 1522 to calculate the priority "12" for the authentication request.

FIG. 27 is a diagram showing an example of the authentication request list 1051 in the modified example 9. The authentication request list 1051 is stored in the storage unit 15 instead of the authentication request list 151 in the modification 9. The authentication request list 1051 includes an authentication request service 1511, an authentication ID 1512, a password 1513, client information 1581, a receipt number 1514, and a priority 1015 for an authentication request.

As described above, the priority 1015 is a value obtained by multiplying the priority 1522 associated with the authentication request service 1511 and the total priority 1616.

Referring to the authentication request list 1051, the password security is low, and the priority 1015 of the authentication ID 1512 using the application of "Version 1" is "ID1" is the authentication request for the HTTP service having a lower priority than the mail service. The authentication ID 1512 is lower than the priority 1015 of "ID2". According to the authentication system 1 according to the modification 9, the determination unit 11 may assign the priority 1015 to the second authentication request according to the plurality of usage information and the importance and priority based on the usage information. can.

In this modification, the priority for the authentication request is determined by using the total priority 1616 and the priority 1522 associated with the authentication request service 1511. Therefore, the storage unit 15 does not have to store the total priority 1616 itself. In this modification, the storage unit 15 may store the password evaluation list 111, the priority determination database 152, the client terminal list 158, and the usage information list 160. The determination unit 11 may obtain the total priority 1616 based on the password evaluation list 111, the priority determination database 152, the client terminal list 158, and the usage information list 160 by using the first or second authentication request. Further, the first intermediate value 1613 and the second intermediate value 1615 do not have to be stored in the priority list 161.

<Second Embodiment>
FIG. 28 is a functional block diagram showing an example of the configuration of the authentication device 200 according to the second embodiment. The authentication device 200 includes a determination unit 201, a selection unit 203, and an authentication unit 204. The authentication device 200 according to the second embodiment is a basic configuration for solving the problem to be solved by the present disclosure.

The determination unit 201 has the function of the determination unit 11. Further, the determination unit 201 receives an authentication request which is an authentication request for the use of the service, and indicates the priority of the execution of the authentication according to the first priority which indicates the priority of the service related to the received authentication request. The priority of 2 is given to the accepted authentication request.

The selection unit 203 has the function of the selection unit 13. Further, the selection unit 203 selects an authentication request to be authenticated according to the second priority. The authentication unit 204 has the function of the authentication unit 14. Further, the authentication unit 204 authenticates the authentication request selected by the selection unit 203.

FIG. 29 is a flowchart showing an example of the operation of the authentication device 200 according to the second embodiment.

The determination unit 201 receives an authentication request, which is an authentication request for the use of the service (step S801). Then, the determination unit 201 assigns a second priority indicating the priority of execution of authentication to the received authentication request according to the first priority indicating the priority of the service related to the received authentication request. (Step S802).

The selection unit 203 selects an authentication request to be authenticated according to the second priority (step S803). Then, the authentication unit 204 authenticates the authentication request selected by the selection unit 203 (step S804).

As described above, the authentication device 200 receives the second priority indicating the priority of the authentication according to the first priority indicating the priority of the authentication request service included in the received authentication request. By assigning to the above, selecting an authentication request based on the second priority, and performing authentication for the selected authentication request, it is possible to efficiently perform authentication in one computer.

<Hardware configuration>
In each embodiment of the present disclosure, each component of each device or system represents a block of functional units. A part or all of each device or each component of each system is realized by an arbitrary combination of the information processing device 900 and the program as shown in FIG. 30, for example. The information processing device 900 includes the following configuration as an example.

・ CPU901
-ROM (Read Only Memory) 902
-RAM (Random Access Memory) 903
-Program 904 loaded into RAM 903
A storage device 905 that stores the program 904.
A drive device 907 that reads and writes the recording medium 906.
-Communication interface 908 that connects to the communication network 909
-I / O interface 910 for inputting / outputting data
-Bus 911 connecting each component
Each component of each device in each embodiment is realized by the CPU 901 acquiring and executing the program 904 that realizes these functions. The program 904 that realizes the functions of each component of each device is stored in, for example, a storage device 905 or ROM 902 in advance, and is read by the CPU 901 as needed. The program 904 may be supplied to the CPU 901 via the communication network 909, or may be stored in the recording medium 906 in advance, and the drive device 907 may read the program and supply the program to the CPU 901.

There are various modifications in the method of realizing each device. For example, each device may be realized by any combination of the information processing device 900 and the program, which are separate for each component. Further, a plurality of components included in each device may be realized by any combination of one information processing device 900 and a program.

Further, a part or all of each component of each device is realized by other general-purpose or dedicated circuits, processors, etc. or a combination thereof. These may be composed of a single chip or may be composed of a plurality of chips connected via a bus.

A part or all of each component of each device may be realized by a combination of the above-mentioned circuit or the like and a program.

When a part or all of each component of each device is realized by a plurality of information processing devices and circuits, the plurality of information processing devices and circuits may be centrally arranged or distributed. May be good. For example, the information processing device, the circuit, and the like may be realized as a form in which each of the client terminal and server system, the cloud computing system, and the like is connected via a communication network.

Although the present disclosure has been described above with reference to each embodiment, the present disclosure is not limited to each of the above embodiments. Various changes that can be understood by those skilled in the art can be made to the structure and details of the present disclosure within the scope of the present disclosure.

Some or all of the above embodiments may also be described, but not limited to:

(Appendix 1)
Accepts an authentication request, which is an authentication request for the use of a service, and sets a second priority, which indicates the priority of execution of the authentication, according to a first priority, which indicates the priority of services related to the authentication request. Judgment means given to the authentication request and
A selection means for selecting an authentication request to be authenticated according to the second priority, and
An authentication device including an authentication means for performing the authentication in response to a selected authentication request.

(Appendix 2)
The authentication device according to Appendix 1, wherein when the number of authentication requests to which the second priority is given is equal to or less than a threshold value, the determination means gives the second priority to the received authentication request.

(Appendix 3)
The determination means calculates the second priority based on the degree of password security set in advance for each client using the service and the first priority, and the calculated second priority. The authentication device according to Appendix 1 or 2, wherein the degree is given to the received authentication request.

(Appendix 4)
The determination means calculates the second priority based on the degree of security of the password included in the authentication request and the first priority, and the authentication request accepts the calculated second priority. The authentication device according to Appendix 1 or 2 given to the above.

(Appendix 5)
The authentication means counts the number of consecutive successes indicating the number of consecutive successes of the authentication and the number of consecutive failures indicating the number of consecutive failures of the authentication for each requester of the authentication request.
The determination means calculates the second priority based on the number of consecutive successes, the number of consecutive failures, and the first priority, and assigns the calculated second priority to the received authentication request. The authentication device according to Appendix 1 or 2.

(Appendix 6)
The determination means calculates the second priority based on the IP (Internet Protocol) address used by the requester of the authentication request and the first priority, and accepts the calculated second priority. The authentication device according to Appendix 1 or 2 given to an authentication request.

(Appendix 7)
The determination means calculates the second priority based on the time required for network communication to be established between the request source of the authentication request and the request destination of the authentication request and the first priority. The authentication device according to Appendix 1 or 2, which is given to the authentication request that has received the calculated second priority.

(Appendix 8)
The determination means calculates the second priority based on the information about the application used by the requester of the authentication request and the first priority, and the authentication request accepts the calculated second priority. The authentication device according to Appendix 1 or 2 given to the above.

(Appendix 9)
The determination means is biometrics information indicating the behavioral characteristics of the client who uses the service, and the similarity is determined by using the biometrics information registered in advance and the biometrics information included in the received authentication request. The second priority is calculated based on the calculated similarity and the first priority, and the calculated second priority is given to the received authentication request according to Appendix 1 or 2. Authentication device.

(Appendix 10)
The authentication device according to Appendix 1 or 2, wherein the determination means assigns the first priority to an authentication request received as the second priority.

(Appendix 11)
The authentication device according to any one of Supplementary note 1 to 10, which is given to an authentication request that has received the second priority when the first priority satisfies a predetermined condition.

(Appendix 12)
The determination means gives order information indicating the accepted order to the received authentication request.
The authentication according to Appendix 11, wherein the selection means selects an authentication request to be authenticated according to the order information when there are a plurality of the authentication requests to which the second highest priority is given. Device.

(Appendix 13)
A storage means for storing the authentication request to which the order information is given, and
When the number of authentication requests to which the second priority is given is equal to or less than the threshold value, the authentication request is selected from the authentication requests stored in the storage means based on the order information, and the selected authentication request is determined. With a confirmation means to send to the means,
The authentication device according to Appendix 12, wherein the determination means stores the received authentication request in the storage means when the first priority does not satisfy the predetermined condition.

(Appendix 14)
The authentication request, which is an authentication request for the use of the service, is accepted, and the second priority indicating the execution order of the authentication is set according to the first priority indicating the priority of the service related to the authentication request. Grant to the request
According to the second priority, the authentication request to be authenticated is selected, and the authentication request is selected.
An authentication method that performs the above authentication for the selected authentication request.

(Appendix 15)
The authentication request, which is an authentication request for the use of the service, is accepted, and the second priority indicating the execution order of the authentication is set according to the first priority indicating the priority of the service related to the authentication request. Judgment processing given to the request and
A selection process for selecting an authentication request to be authenticated according to the second priority, and
A program that causes a computer to execute the authentication process for performing the authentication in response to the selected authentication request.

1 Authentication system 10 Authentication device 11 Judgment unit 12 Confirmation unit 13 Selection unit 14 Authentication unit 15 Storage unit 20 Server 21 Judgment unit 24 Authentication unit 30 Server 40 Client terminal 50 Client terminal 100 Authentication device 111 Password evaluation list 151 Authentication request list 152 Priority Degree judgment database 153 Authentication standby list 155 Safety list 156 Continuous list 157 Address list 158 Client terminal list 159 Biometrics list 160 Usage information list 161 Priority list 200 Authentication device 201 Judgment unit 203 Selection unit 204 Authentication unit 251 Authentication request list 351 Authentication request list 451 Authentication request list 551 Authentication request list 651 Authentication request list 751 Authentication request list 851 Authentication request list 900 Information processing device 901 CPU
902 ROM
903 RAM
904 Program 905 Storage device 906 Recording medium 907 Drive device 908 Communication interface 909 Communication network 910 Input / output interface 911 Bus 951 Authentication request list 1051 Authentication request list

Claims (10)

Receiving a request at a authentication request authentication for use of the service, based on the first priority indicating the priority of the service related to the authentication request and the degree of security of the password included in the authentication request, the authentication A determination means for calculating a second priority indicating the priority of execution of the above and assigning the calculated second priority to the authentication request.
A selection means for selecting an authentication request to be authenticated according to the second priority, and
An authentication device including an authentication means for performing the authentication in response to a selected authentication request. Accepts an authentication request, which is an authentication request for the use of a service, and sets a second priority, which indicates the priority of execution of the authentication, according to a first priority, which indicates the priority of services related to the authentication request. Judgment means given to the authentication request and
A selection means for selecting an authentication request to be authenticated according to the second priority, and
It is provided with an authentication means for performing the authentication in response to the selected authentication request .
The authentication means counts the number of consecutive successes indicating the number of consecutive successes of the authentication and the number of consecutive failures indicating the number of consecutive failures of the authentication for each requester of the authentication request.
The determination means calculates the second priority based on the number of consecutive successes, the number of consecutive failures, and the first priority, and assigns the calculated second priority to the authentication request that has received the calculated second priority. Authentication device. The time required for receiving an authentication request, which is an authentication request for the use of a service, and establishing network communication between the request source of the authentication request and the request destination of the authentication request, and the priority of the service related to the authentication request. A determination means that calculates a second priority that indicates the priority of executing the authentication based on the first priority that indicates the order, and assigns the calculated second priority to the authentication request.
A selection means for selecting an authentication request to be authenticated according to the second priority, and
An authentication device including an authentication means for performing the authentication in response to a selected authentication request. Receiving a service request in which authentication requests authentication for access, based on the first priority indicating the priority of the authentication request of the requesting is related to information and the authentication request for an application that uses the service, the authentication A determination means for calculating a second priority indicating the priority of execution of the above and assigning the calculated second priority to the authentication request.
A selection means for selecting an authentication request to be authenticated according to the second priority, and
An authentication device including an authentication means for performing the authentication in response to a selected authentication request. Accepts an authentication request, which is an authentication request for the use of a service, and sets a second priority, which indicates the priority of execution of the authentication, according to a first priority, which indicates the priority of services related to the authentication request. Judgment means given to the authentication request and
A selection means for selecting an authentication request to be authenticated according to the second priority, and
It is provided with an authentication means for performing the authentication in response to the selected authentication request .
The determination means is biometrics information indicating the behavioral characteristics of the client who uses the service, and the similarity is determined by using the biometrics information registered in advance and the biometrics information included in the received authentication request. An authentication device that calculates the second priority based on the calculated similarity and the calculated similarity and gives the calculated second priority to an authentication request that has been accepted. When the number of authentication requests to which the second priority is given is equal to or less than the threshold value, the determination means gives the second priority to the received authentication request according to any one of claims 1 to 5. The authentication device according to item 1. Receiving a request at a authentication request authentication for use of the service, based on the first priority indicating the priority of the service related to the authentication request and the degree of security of the password included in the authentication request, the A second priority indicating the execution order of authentication is calculated, and the calculated second priority is given to the authentication request.
According to the second priority, the authentication request to be authenticated is selected, and the authentication request is selected.
An authentication method that performs the above authentication for the selected authentication request. Receiving a request at a authentication request authentication for use of the service, based on the first priority indicating the priority of the service related to the authentication request and the degree of security of the password included in the authentication request, the A determination process in which a second priority indicating the execution order of authentication is calculated and the calculated second priority is given to the authentication request.
A selection process for selecting an authentication request to be authenticated according to the second priority, and
A program that causes a computer to execute the authentication process for performing the authentication in response to the selected authentication request. Receiving a service request in which authentication requests authentication for access, based on the first priority indicating the priority of the service related to the authentication request the authentication request information about the requesting application that uses the said A second priority indicating the execution order of authentication is calculated, and the calculated second priority is given to the authentication request.
According to the second priority, the authentication request to be authenticated is selected, and the authentication request is selected.
An authentication method that performs the above authentication for the selected authentication request. Receiving a service request in which authentication requests authentication for access, based on the first priority indicating the priority of the service related to the authentication request the authentication request information about the requesting application that uses the said A determination process in which a second priority indicating the execution order of authentication is calculated and the calculated second priority is given to the authentication request.
A selection process for selecting an authentication request to be authenticated according to the second priority, and
A program that causes a computer to execute the authentication process for performing the authentication in response to the selected authentication request.

Images