JP7012123B2 - Information processing equipment, information processing methods and information processing programs - Google Patents

Description

The present invention relates to an information processing apparatus, an information processing method and an information processing program.

Conventionally, a technique of performing authentication by an authentication code using a one-time password (OTP: One Time Password) is known.

Japanese Unexamined Patent Publication No. 2020-013439

However, with the above-mentioned conventional technology, when a user is guided to a fake site such as a phishing site that imitates an authentication code input screen (login screen), it is difficult for the user to determine the authenticity of the site. Met. Therefore, the user may enter the authentication code, personal information, etc. on the phishing site, and the information may be stolen or the account may be hijacked.

The present application has been made in view of the above, and an object thereof is to enable a user to determine the authenticity of a site.

The information processing apparatus according to the present application includes a generation unit that generates authentication information used for user authentication, a notification unit that notifies the user of the authentication information, and an authentication screen in which a part of the authentication information is displayed in advance. It is characterized in that it includes a providing unit that provides the above-mentioned user.

According to one aspect of the embodiment, it is possible to enable the user to determine the authenticity of the site.

FIG. 1 is an explanatory diagram showing an outline of an information processing method according to an embodiment. FIG. 2 is a diagram showing an example of a screen displayed on the terminal device according to the embodiment. FIG. 3 is a diagram showing a configuration example of an information processing system according to an embodiment. FIG. 4 is a diagram showing a configuration example of the information processing apparatus according to the embodiment. FIG. 5 is a diagram showing an example of a user information database. FIG. 6 is a diagram showing an example of an authentication information database. FIG. 7 is a flowchart showing a processing procedure according to the embodiment. FIG. 8 is a diagram showing an example of a hardware configuration.

Hereinafter, an information processing apparatus, an information processing method, and an embodiment for implementing an information processing program (hereinafter referred to as “embodiment”) according to the present application will be described in detail with reference to the drawings. Note that this embodiment does not limit the information processing apparatus, information processing method, and information processing program according to the present application. Further, in the following embodiments, the same parts are designated by the same reference numerals, and duplicate explanations are omitted.

[1. Overview of information processing method]
First, with reference to FIG. 1, an outline of an information processing method performed by the information processing apparatus according to the embodiment will be described. FIG. 1 is an explanatory diagram showing an outline of an information processing method according to an embodiment. In FIG. 1, a case where a part of the authentication code notified to the user (user) is displayed on the authentication screen in advance will be described as an example.

As shown in FIG. 1, the information processing system 1 includes a terminal device 10 and an information providing device 100. The terminal device 10 and the information providing device 100 are connected to each other via a network N (see FIG. 3) so as to be able to communicate with each other by wire or wirelessly.

The terminal device 10 is a smart device such as a smartphone or tablet used by the user U, and communicates with an arbitrary server device via a wireless communication network such as 4G (Generation) or LTE (Long Term Evolution). It is a portable terminal device that can be used. Further, the terminal device 10 is a screen of a liquid crystal display or the like and has a screen having a touch panel function, and the user can use a finger, a stylus, or the like to perform a tap operation, a slide operation, a scroll operation, or the like for display data such as contents. Accepts various operations. The operation performed on the area of the screen on which the content is displayed may be an operation on the content. Further, the terminal device 10 may be not only a smart device but also an information processing device such as a desktop PC (Personal Computer) or a notebook PC.

The information providing device 100 generates (issues) an authentication code used for authentication of the user U, notifies the user U of the authentication code, and provides an authentication screen for inputting the authentication code to the user U. It is a processing device and is realized by a server device, a cloud system, or the like. Here, the information providing device 100 generates a different authentication code each time. For example, the authentication code is a one-time password (OTP) and changes every predetermined time (for example, 60 seconds). The information providing device 100 may randomly generate an authentication code each time. Further, the authentication code may be a security code.

A part of the authentication code is displayed in advance on the authentication screen. When a part of the authentication code displayed in advance on the authentication screen matches a part of the notified authentication code (corresponding part), the user U is the genuine authentication screen (the user U). It is not a phishing site, etc.).

Therefore, the authentication code includes display information and input information. The display information is a part (information) of the authentication code that is displayed in advance on the authentication screen. The input information is a part (information) of the authentication code that is required to be input on the authentication screen. For example, the authentication code is a 6-digit authentication code consisting of a set of a character string and a numerical value. The display information is, for example, a two-digit character string. The display information may include alphabetic characters, kana characters, symbols, pictograms, and the like. Further, the display information may be an image such as an icon. The input information is, for example, a 4-digit numerical value. The number of digits is only an example. Actually, the authentication code may be 7 digits or more.

Since the authentication code that is commonly used is a 6-digit number, it is possible to eliminate fake sites that assume that all (all digits) of the general authentication code consisting of 6-digit numbers will be entered. can. Further, since it is necessary to display a part of the authentication code in advance on the authentication screen and present it to the user U who knows the authentication code, the difficulty of disguising the authentication screen is significantly improved.

[1-1. Transition from authentication code generation to authentication]
Next, the transition from the generation of the authentication code to the authentication will be described with reference to FIGS. 1 and 2. FIG. 2 is a diagram showing an example of a screen displayed on the terminal device 10 according to the embodiment.

As shown in FIG. 1, the information providing device 100 generates an authentication code used for authentication of the user U (step S1).

For example, as shown in FIG. 2, when the user U logs in (signs in) or newly registers (signs up) a Web service or application program (app), the account ID (phone number, mail) is used by the terminal device 10. When the password (or address, login ID, etc.) and password are input (or registered), the information providing device 100 generates an authentication code used for the authentication of the user U in the two-step authentication.

In the example of FIG. 2, the user U inputs a mobile phone number and a password to the login screen LG1 (or the new registration screen RG1) displayed on the terminal device 10, and the user U inputs the mobile phone number and the password to the login screen LG2 (or the new registration screen RG2). After the transition, by pressing the login button (or the new registration button displayed on the new registration screen RG2) displayed on the login screen LG2, the input mobile phone number and password are transmitted from the terminal device 10 to the information providing device 100. Will be sent to. When the information providing device 100 receives the mobile phone number and password of the user U from the terminal device 10, the information providing device 100 generates an authentication code used for the authentication of the user U.

Here, the information providing device 100 generates an authentication code consisting of a set of display information and input information. In the examples of FIGS. 1 and 2, the display information is a two-digit character string "AB", and the input information is a four-digit numerical value "1234". Therefore, the information providing device 100 generates a 6-digit authentication code "AB1234" consisting of a set of a 2-digit character string "AB" and a 4-digit numerical value "1234".

Then, the information providing device 100 notifies the terminal device 10 of the user U of the generated authentication code by a message in the short message service (SMS: Short Message Service), an automatic voice call by telephone, or the like (step S2). ).

For example, the information providing device 100 notifies the generated authentication code by a message in the short message service (SMS), an automatic voice call by telephone, or the like, using the mobile phone number of the user U as a contact. It should be noted that the method is not limited to SMS or telephone, but may be e-mail or other notification means.

At this time, the information providing device 100 uses, for example, SSL (Secure Sockets Layer) / TLS (Transport Layer Security) or the like to encrypt the communication path (first path) for notifying the generated authentication code.

Further, in reality, a small terminal (token) for generating a one-time password (OTP) as an authentication code is provided to the user U in advance, and the user U knows the authentication code using the token. You may do so. At this time, the information providing device 100 generates the same authentication code by the same algorithm as the token.

Then, the information providing device 100 provides the terminal device 10 of the user U with an authentication screen on which a part (display information) of the generated authentication code is displayed in advance (step S3).

The terminal device 10 of the user U who notifies the authentication code generated by the information providing device 100 and the terminal device 10 of the user U who provides the authentication screen do not necessarily have to be the same device. For example, the information providing device 100 may notify the user U's smartphone or the like of the generated authentication code and provide the user U's desktop PC or the like with an authentication screen. Further, the information providing device 100 may notify the user U's home fixed telephone or the like of the authentication code by automatic voice call and provide the authentication screen to the user U's smartphone, desktop PC or the like.

At this time, the information providing device 100 uses, for example, SSL / TLS or the like to encrypt the communication path (second path) for providing the authentication screen on which a part of the generated authentication code is displayed in advance.

The user U sees the authentication screen on which a part of the authentication code (display information) is displayed in advance, and the part of the displayed authentication code matches the corresponding part of the authentication code notified to the terminal device 10. Check if it is. If they match, it is determined that the authentication screen is genuine. On the contrary, if they do not match, it is determined that the authentication screen belongs to a fake site. When the user U determines that the authentication screen is genuine, the user U inputs the remaining part (that is, input information) other than a part (display information) of the displayed authentication code on the authentication screen. do.

In the example of FIG. 2, the user U visually recognizes the two-digit character string "AB" of a part (display information) of the authentication code displayed in advance on the authentication screen AT1 displayed on the terminal device 10. Confirm that it is the same as the two-digit character string "AB" of a part (display information) of the authentication code notified by SMS or the like. The user U inputs a 4-digit numerical value "1234" which is the remaining part (that is, input information) other than a part (display information) of the displayed authentication code to the authentication screen AT1.

Then, the information providing device 100 acquires the authentication code input on the authentication screen (step S5).

At this time, the information providing device 100 acquires only the input information input to the authentication screen by the user U from the terminal device 10 of the user U. Since the information providing device 100 has the display information, the authentication code can be completed even if only the input information is acquired from the terminal device 10 of the user U.

In reality, the information providing device 100 may acquire an authentication code consisting of a set of display information displayed in advance on the authentication screen and input information input on the authentication screen. For example, the information providing device 100 may acquire a 6-digit authentication code "AB1234" consisting of a set of display information and input information from the terminal device 10 of the user U.

Then, the information providing device 100 collates the generated authentication code with the authentication code input to the authentication screen to authenticate the user U (step S6).

For example, if the generated authentication code and the authentication code entered on the authentication screen match, the information providing device 100 determines that the user U is the user (a legitimate user) and permits login. do. On the contrary, if the generated authentication code and the authentication code entered on the authentication screen do not match, the information providing device 100 determines that the user U is not the user (an unauthorized user) and logs in. Do not allow (reject).

[1-2. About payment using terminal device 10]
Here, the payment (electronic payment) using the terminal device 10 becomes available for the payment application (hereinafter, may be simply referred to as “payment application”) by the authentication process executed by the information providing device 100. An example will be described. In the following description, the user U uses a two-dimensional code (QR code (registered trademark)) arranged in the store A and indicates the store identification information C1 that identifies the store A. An example of performing payment using the terminal device 10 will be described, but the embodiment is not limited to this. The example of payment described below can be applied even when an arbitrary user makes a payment at an arbitrary store using an arbitrary terminal device 10. Further, the store identification information C1 may be not only a QR code (registered trademark) but also a barcode, a predetermined mark, a number, or the like.

For example, when the user U makes a payment in connection with the use or purchase of a payment target (transaction target) such as various products and services at the store A, the user U is a payment application installed on the terminal device 10. Start the payment application). Then, the user U photographs the store identification information C1 installed in the store A via the payment application. In such a case, the terminal device 10 displays a screen for inputting the price to be settled, and accepts the input of the settlement amount from the clerk of the user U or the store A. Then, the terminal device 10 includes user identification information for identifying the user U, store identification information C1 (or information indicated by the store identification information C1, that is, information indicating the store A (for example, store ID)). The payment information indicating the payment amount is transmitted to the information providing device 100.

In such a case, the information providing device 100 transfers the electronic money of the amount indicated by the payment amount from the account of the user U indicated by the user identification information to the account of the store A indicated by the store identification information C1. Then, the information providing device 100 transmits a notification to the terminal device 10 that the payment has been completed. In such a case, the terminal device 10 notifies that the payment has been made by electronic money by outputting a screen indicating that the payment has been completed and a predetermined voice.

The payment using the terminal device 10 is not limited to the above-mentioned processing. For example, the payment using the terminal device 10 may be made using the store terminal installed in the store A. For example, the terminal device 10 displays the user identification information for identifying the user U on the screen. In such a case, the store terminal installed in the store A reads the user identification information displayed on the terminal device 10 and obtains the user identification information (or the information indicated by the user identification information, that is, the user U). Information indicating (for example, user ID)), payment amount, and payment information indicating information identifying the store A are transmitted to the information providing device 100. In such a case, the information providing device 100 transfers the electronic money of the amount indicated by the payment amount from the account of the user U indicated by the user identification information to the account of the store A, and the store terminal or terminal of the store A. The device 10 may be notified that the payment has been made by outputting a screen indicating that the payment has been completed or a predetermined voice.

Further, the payment using the terminal device 10 is not only a process of transferring the electronic money from the account charged with the electronic money in advance by the user U to the account of the store A, but also, for example, a credit card registered in advance by the user U. It may be a payment using. In such a case, for example, the terminal device 10 may transfer the electronic commerce payment amount to the account of the store A and charge the payment amount to the credit card management company of the user U.

[2. Information processing system configuration example]
Next, the configuration of the information processing system 1 including the information providing device 100 according to the embodiment will be described with reference to FIG. FIG. 3 is a diagram showing a configuration example of the information processing system 1 according to the embodiment. As shown in FIG. 3, the information processing system 1 according to the embodiment includes a terminal device 10 and an information providing device 100. These various devices are connected so as to be communicable by wire or wirelessly via the network N. The network N is, for example, a LAN (Local Area Network) or a WAN (Wide Area Network) such as the Internet.

Further, the number of each device included in the information processing system 1 shown in FIG. 3 is not limited to that shown in the figure. For example, in FIG. 3, for simplification of the illustration, only one terminal device 10 is shown, but this is merely an example and is not limited, and may be two or more.

The terminal device 10 is an information processing device used by the user U. For example, the terminal device 10 is a smart device such as a smartphone or tablet terminal, a feature phone, a PC (Personal Computer), a PDA (Personal Digital Assistant), a car navigation system, a wearable device such as a smart watch or a head-mounted display (Wearable Device). , Smart glasses, etc.

Further, the terminal device 10 includes a wireless communication network such as LTE (Long Term Evolution), 4G (4th Generation), 5G (5th Generation: 5th generation mobile communication system), Bluetooth (registered trademark), and wireless LAN (Local). It can be connected to the network N via short-range wireless communication such as Area Network) and communicate with the information providing device 100.

The information providing device 100 is, for example, a PC, a server device, a mainframe, a workstation, or the like. The information providing device 100 may be realized by cloud computing.

[3. Configuration example of information processing device]
Next, the configuration of the information providing device 100 according to the embodiment will be described with reference to FIG. FIG. 4 is a diagram showing a configuration example of the information providing device 100 according to the embodiment. As shown in FIG. 4, the information providing device 100 includes a communication unit 110, a storage unit 120, and a control unit 130.

(Communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card) or the like. Further, the communication unit 110 is connected to the network N (see FIG. 3) by wire or wirelessly.

(Memory unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory (Flash Memory), or a storage device such as a hard disk or an optical disk. As shown in FIG. 4, the storage unit 120 has a user information database 121 and an authentication information database 122.

(User information database 121)
The user information database 121 stores various information about the user U. For example, the user information database 121 stores various information such as the attributes of the user U. FIG. 5 is a diagram showing an example of the user information database 121. In the example shown in FIG. 5, the user information database 121 has items such as "user ID (Identifier)", "age", "gender", "home", "work location", and "interest".

The "user ID" indicates identification information for identifying the user U. Further, "age" indicates the age of the user U identified by the user ID. The "age" may be a specific age of the user U identified by the user ID, for example, 35 years old. Further, "gender" indicates the gender of the user U identified by the user ID.

Further, "home" indicates the location information of the home of the user U identified by the user ID. In the example shown in FIG. 5, "home" is illustrated with an abstract reference numeral such as "LC11", but may be latitude / longitude information or the like. Further, for example, "home" may be a region name or an address.

Further, the "work location" indicates the location information of the work location (school in the case of a student) of the user U identified by the user ID. In the example shown in FIG. 5, the “work location” is illustrated with an abstract code such as “LC12”, but may be latitude / longitude information or the like. Further, for example, the "work location" may be a region name or an address.

Further, "interest" indicates the interest of the user U identified by the user ID. That is, "interest" indicates an object that the user U identified by the user ID is highly interested in. For example, "interest" may be a search query (keyword) or the like that the user U inputs into a search engine and searches. In the example shown in FIG. 5, "interest" is shown one for each user U, but may be plural.

For example, in the example shown in FIG. 5, the age of the user U identified by the user ID "U1" is "20's", and the gender is "male". Further, for example, the user U identified by the user ID "U1" indicates that his / her home is "LC11". Further, for example, the user U identified by the user ID "U1" indicates that the work location is "LC12". Further, for example, the user U identified by the user ID "U1" indicates that he / she is interested in "sports".

Here, in the example shown in FIG. 5, abstract values such as “U1”, “LC11”, and “LC12” are used for illustration, but “U1”, “LC11”, and “LC12” are specific. Information such as character strings and numerical values shall be stored. Hereinafter, abstract values may be illustrated also in figures relating to other information.

The user information database 121 is not limited to the above, and various information may be stored depending on the purpose. For example, the user information database 121 may store various information about the terminal device 10 of the user U. In addition, the user information database 121 has attributes such as demographic (demographic attribute), psychographic (psychological attribute), geographic (geographical attribute), and behavioral (behavioral attribute) of the user U. May remember information about. For example, the user information database 121 includes name, family structure, occupation, position, contact information, income, qualification, living style (detached house, apartment, etc.), presence / absence of a car, commuting time, commuting route, commuter pass. Information such as sections (stations, lines, etc.), frequently used stations (other than the nearest station to your home / work location), lessons (location, time zone, etc.), hobbies, interests, lifestyle, etc. may be stored.

(Authentication information database 122)
The authentication information database 122 stores various information related to the authentication information of the user U. FIG. 6 is a diagram showing an example of the user information database 121. In the example shown in FIG. 6, the authentication information database 122 has items such as "user ID", "account ID", "password", and "authentication code".

The "user ID" indicates identification information for identifying the user U.

Further, the "account ID" indicates identification information for identifying the user U's account in a Web service, an application, or the like. For example, the "account ID" may be the telephone number, e-mail address, login ID, or the like of the user U. Further, the "account ID" may be information common to the "user ID".

Further, the "password" is the password of the user U and indicates a password paired with the "account ID".

Further, the "authentication code" indicates an authentication code used for the authentication of the user U in the two-step authentication or the like. For example, the "authentication code" is a 6-digit authentication code consisting of a set of a character string and a numerical value. Actually, the authentication code may be 7 digits or more. The authentication code may be a one-time password (OTP) or a security code.

Further, the "authentication code" has items such as "display information" and "input information". The "display information" is a part (information) of the "authentication code" that is displayed in advance on the authentication screen. Further, the "input information" is a part (information) of the "authentication code" for which input is required on the authentication screen. For example, when the "authentication code" is a 6-digit authentication code consisting of a set of a character string and a numerical value, the "display information" is, for example, a two-digit character string at the beginning (first half) of the "authentication code". Further, the "input information" is, for example, the remaining (second half) 4-digit numerical value of the "authentication code".

For example, in the example shown in FIG. 6, the user U identified by the user ID "U1" logs in (signs in) to a Web service, an application, or the like using the account ID "account # 1" and the password "password # 1". ) Or when trying to newly register (sign up), the authentication information consisting of the display information "display information # 1" and the input information "input information # 1" is notified by SMS or the like, and one of the authentication information. Indicates that an authentication screen on which the display information "display information # 1", which is a unit, is displayed in advance is provided.

The authentication information database 122 is not limited to the above, and various information may be stored depending on the purpose. For example, the authentication information database 122 may store identification information and various information for identifying a Web service, an application, or the like. Further, the authentication information database 122 may store identification information and various information for identifying the authentication screen on which the display information is displayed in advance.

(Control unit 130)
Returning to FIG. 4, the explanation will be continued. The control unit 130 is a controller, and is an information providing device 100 by means of, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or the like. It is realized by executing various programs (corresponding to an example of an information processing program) stored in the internal storage device of the ASIC with a storage area such as a RAM as a work area. In the example shown in FIG. 4, the control unit 130 includes a reception unit 131, a generation unit 132, a notification unit 133, a provision unit 134, an acquisition unit 135, and an authentication unit 136.

(Reception Department 131)
The reception unit 131 inputs (or) an account ID (phone number, e-mail address, login ID, etc.) and password using the terminal device 10 when the user U logs in or newly registers a Web service or application program (app). In the case of registration), the account ID and password input (or registered) from the terminal device 10 are accepted via the communication unit 110.

At this time, the reception unit 131 stores the received account ID and password in the authentication information database 122 of the storage unit 120.

(Generation unit 132)
The generation unit 132 generates (issues) an authentication code used for user U authentication in two-step verification or the like. Here, the generation unit 132 generates a different authentication code each time. For example, the authentication code is a one-time password (OTP) and changes every predetermined time (for example, 60 seconds). The generation unit 132 may randomly generate an authentication code each time. Further, the authentication code may be a security code.

The authentication code includes display information and input information. The display information is a part (information) of the authentication code that is displayed in advance on the authentication screen. The input information is a part (information) of the authentication code that is required to be input on the authentication screen. For example, the authentication code is a 6-digit authentication code consisting of a set of a character string and a numerical value. The display information is, for example, a two-digit character string. The display information may include alphabetic characters, kana characters, symbols, pictograms, and the like. Further, the display information may be an image such as an icon.

(Notification unit 133)
The notification unit 133 notifies the terminal device 10 of the user U of the authentication code generated by the generation unit 132 by a message in the short message service (SMS: Short Message Service), an automatic voice call by telephone, or the like. It should be noted that the method is not limited to SMS or telephone, but may be e-mail or other notification means.

At this time, the notification unit 133 encrypts the communication path (first path) for notifying the generated authentication code by using, for example, SSL (Secure Sockets Layer) / TLS (Transport Layer Security) or the like. That is, the notification unit 133 has an encryption unit that encrypts the communication path (first path).

Further, in reality, a small terminal (token) for generating a one-time password (OTP) as an authentication code is provided to the user U in advance, and the user U knows the authentication code using the token. You may do so. At this time, the generation unit 132 generates the same authentication code by the same algorithm as the token.

(Providing section 134)
The providing unit 134 provides the terminal device 10 of the user U with an authentication screen on which a part (display information) of the authentication code generated by the generating unit 132 is displayed in advance via the communication unit 110.

At this time, the providing unit 134 uses, for example, SSL / TLS or the like to encrypt the communication path (second path) for providing the authentication screen on which a part of the generated authentication code is displayed in advance. That is, the providing unit 134 has an encryption unit that encrypts the communication path (second path).

(Acquisition unit 135)
The acquisition unit 135 acquires only the input information from the terminal device 10 of the user U via the communication unit 110. Since the generation unit 132 generates the authentication code and has the display information, the authentication code can be completed even if the acquisition unit 135 acquires only the input information from the terminal device 10 of the user U.

Further, the acquisition unit 135 may acquire the input information input to the authentication screen by the user U together with the identification information or the information proving the validity of the authentication screen.

Actually, the acquisition unit 135 acquires an authentication code consisting of a set of the display information displayed in advance on the authentication screen and the input information input on the authentication screen from the terminal device 10 of the user U. May be good.

(Authentication unit 136)
The authentication unit 136 collates the authentication code generated by the generation unit 132 with the authentication code acquired by the acquisition unit 135 to authenticate the user U.

For example, if the authentication code generated by the generation unit 132 and the authentication code acquired by the acquisition unit 135 match, the authentication unit 136 determines that the user U is the user (a legitimate user). And allow login. On the contrary, if the authentication code generated by the generation unit 132 and the authentication code acquired by the acquisition unit 135 do not match, the authentication unit 136 is not the user U himself (an unauthorized user). Judge and do not allow (reject) login.

[4. Processing procedure]
Next, the processing procedure by the information providing apparatus 100 according to the embodiment will be described with reference to FIG. 7. FIG. 7 is a flowchart showing a processing procedure according to the embodiment. The processing procedure shown below is repeatedly executed by the control unit 130 of the information providing device 100.

As shown in FIG. 7, the information providing device 100 has an account ID (phone number, e-mail address, etc.) entered by the user U using the terminal device 10 when logging in or newly registering a Web service, an application program (application), or the like. Accept the login ID, etc.) and password (step S101).

Then, the information providing device 100 generates (issues) an authentication code used for the authentication of the user U in the two-step authentication or the like (step S102).

Here, the information providing device 100 generates a different authentication code each time. For example, the authentication code is a one-time password (OTP) and changes every predetermined time (for example, 60 seconds). The information providing device 100 may randomly generate an authentication code each time. Further, the authentication code may be a security code.

Then, the information providing device 100 notifies the terminal device 10 of the user U of the generated authentication code by a message in the short message service (SMS), an automatic voice call by telephone, or the like (step S103).

At this time, the information providing device 100 uses, for example, SSL / TLS or the like to encrypt the communication path (first path) for notifying the generated authentication code.

Further, in reality, a small terminal (token) for generating a one-time password (OTP) as an authentication code is provided to the user U in advance, and the user U knows the authentication code using the token. You may do so. At this time, the information providing device 100 generates the same authentication code by the same algorithm as the token.

Then, the information providing device 100 provides the terminal device 10 of the user U with an authentication screen on which a part (display information) of the generated authentication code is displayed in advance (step S104).

At this time, the information providing device 100 uses, for example, SSL / TLS or the like to encrypt the communication path (second path) for providing the authentication screen on which a part of the generated authentication code is displayed in advance.

The user U determines whether or not a part of the authentication code displayed in advance on the authentication screen matches a part (corresponding part) of the notified authentication code (step S105).

When a part of the authentication code displayed in advance on the authentication screen does not match the part of the notified authentication code (step S105; No), the user U has the authentication screen of a fake site. And exit without entering the authentication code on the authentication screen. Alternatively, the information providing device 100 is requested to provide the authentication code and the authentication screen again.

When a part of the authentication code displayed in advance on the authentication screen matches a part of the notified authentication code (step S105; Yes), the user U is the genuine authentication screen. It is determined that (it is not a phishing site or the like), and the remaining part (input information) of the authentication code is input to the authentication screen (step S106).

Then, the information providing device 100 acquires the authentication code input to the authentication screen from the terminal device 10 of the user U (step S107).

At this time, the information providing device 100 acquires only the input information input to the authentication screen by the user U from the terminal device 10 of the user U. Since the information providing device 100 has the display information, the authentication code can be completed even if only the input information is acquired from the terminal device 10 of the user U. Actually, the information providing device 100 acquires an authentication code consisting of a set of the display information displayed in advance on the authentication screen and the input information input on the authentication screen from the terminal device 10 of the user U. You may.

Then, the information providing device 100 collates the generated authentication code with the authentication code input to the authentication screen to authenticate the user U (step S108).

For example, if the generated authentication code and the authentication code entered on the authentication screen match, the information providing device 100 determines that the user U is the user (a legitimate user) and permits login. do. On the contrary, if the generated authentication code and the authentication code entered on the authentication screen do not match, the information providing device 100 determines that the user U is not the user (an unauthorized user) and logs in. Do not allow (reject).

[5. Modification example]
The terminal device 10 and the information providing device 100 described above may be implemented in various different forms other than the above-described embodiment. Therefore, a modified example of the embodiment will be described below.

In the above embodiment, the terminal device 10 may automatically input the authentication code. For example, the terminal device 10 may automatically read the authentication code received by the message of the short message service (SMS) and automatically input the input information on the authentication screen. At this time, when the terminal device 10 receives the message in which the authentication code required for login is described, the terminal device 10 proposes to the user U to input the authentication code. Then, when the user U taps the proposed authentication code, the terminal device 10 automatically inputs the input information in the input information input field of the authentication screen.

Further, in the above embodiment, the display information is described by taking "two-digit character string" and the input information by taking "four-digit numerical value" as an example, but the present invention is not limited to these examples. For example, the character string and the numerical value may be exchanged, and the display information may be a "2-digit numerical value" and the input information may be a "4-digit character string". Further, both the display information and the input information may be a character string or a numerical value. That is, the 6-digit authentication code can be a 6-digit character string or a 6-digit numerical value.

Further, in the above embodiment, the order of the display information and the input information constituting the authentication code may be reversed. For example, of the 6-digit authentication code, the first 4 digits may be used as input information and the last 2 digits may be used as display information.

Further, in the above embodiment, the authentication code may have display information and input information arranged alternately. For example, of the 6-digit authentication code, odd-numbered digits (1st, 3rd, and 5th digits) may be used as display information, and even-numbered digits (2nd, 4th, and 6th digits) may be used as input information. good.

Further, in the above embodiment, the information providing device 100 may set an arbitrary digit (part) of the authentication code as display information. Since the user U knows the digit (part) of the authentication code that is the display information when he / she sees the display information displayed on the authentication screen, the information provision that provides the authentication screen to the user U is provided. The device 100 can arbitrarily set which digit (part) of the authentication code is used as the display information. For example, the information providing device 100 may set a different digit (part) as display information each time. Further, the information providing device 100 may randomly change the digit (part) of the authentication code to be displayed information each time. Of course, the same applies to the input information.

[6. effect〕
As described above, the information providing device 100 according to the present application includes a generation unit 132 that generates authentication information (authentication code) used for user authentication, a notification unit 133 that notifies the user of the authentication information, and a notification unit 133. It includes a providing unit 134 that provides the user with an authentication screen on which a part (display information) of the authentication information is displayed in advance.

This makes it possible for the user to determine the authenticity of the site.

[7. Hardware configuration]
Further, the terminal device 10 and the information providing device 100 according to the above-described embodiment are realized by, for example, a computer 1000 having a configuration as shown in FIG. Hereinafter, the information providing device 100 will be described as an example. FIG. 8 is a diagram showing an example of a hardware configuration. The computer 1000 is connected to the output device 1010 and the input device 1020, and the arithmetic unit 1030, the primary storage device 1040, the secondary storage device 1050, the output I / F (Interface) 1060, the input I / F 1070, and the network I / F 1080 are bused. It has a form connected by 1090.

The arithmetic unit 1030 operates based on a program stored in the primary storage device 1040 or the secondary storage device 1050, a program read from the input device 1020, or the like, and executes various processes. The arithmetic unit 1030 is realized by, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or the like.

The primary storage device 1040 is a memory device such as a RAM (Random Access Memory) that temporarily stores data used by the arithmetic unit 1030 for various calculations. Further, the secondary storage device 1050 is a storage device in which data used by the calculation device 1030 for various calculations and various databases are registered, and is a ROM (Read Only Memory), an HDD (Hard Disk Drive), and an SSD (Solid). State Drive), flash memory, etc. The secondary storage device 1050 may be an internal storage or an external storage. Further, the secondary storage device 1050 may be a removable storage medium such as a USB memory or an SD (Secure Digital) memory card. Further, the secondary storage device 1050 may be a cloud storage (online storage), NAS (Network Attached Storage), a file server, or the like.

The output I / F 1060 is an interface for transmitting information to be output to an output device 1010 that outputs various information such as a display, a projector, and a printer. For example, USB (Universal Serial Bus) or DVI. (Digital Visual Interface), HDMI (Registered Trademark) (High Definition Multimedia Interface), etc. Further, the input I / F 1070 is an interface for receiving information from various input devices 1020 such as a mouse, a keyboard, a keypad, a button, a scanner, and the like, and is realized by, for example, USB.

Further, the output I / F 1060 and the input I / F 1070 may be wirelessly connected to the output device 1010 and the input device 1020, respectively. That is, the output device 1010 and the input device 1020 may be wireless devices.

Further, the output device 1010 and the input device 1020 may be integrated like a touch panel. In this case, the output I / F 1060 and the input I / F 1070 may also be integrated as input / output I / F.

The input device 1020 is, for example, an optical recording medium such as a CD (Compact Disc), a DVD (Digital Versatile Disc), a PD (Phase change rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), or a tape. It may be a device that reads information from a medium, a magnetic recording medium, a semiconductor memory, or the like.

The network I / F 1080 receives data from another device via the network N and sends it to the arithmetic unit 1030, and also transmits the data generated by the arithmetic unit 1030 to the other device via the network N.

The arithmetic unit 1030 controls the output device 1010 and the input device 1020 via the output I / F 1060 and the input I / F 1070. For example, the arithmetic unit 1030 loads a program from the input device 1020 or the secondary storage device 1050 onto the primary storage device 1040, and executes the loaded program.

For example, when the computer 1000 functions as the information providing device 100, the arithmetic unit 1030 of the computer 1000 realizes the function of the control unit 130 by executing the program loaded on the primary storage device 1040. Further, the arithmetic unit 1030 of the computer 1000 may load a program acquired from another device via the network I / F 1080 onto the primary storage device 1040 and execute the loaded program. Further, the arithmetic unit 1030 of the computer 1000 may cooperate with other devices via the network I / F 1080 to call the functions and data of the program from other programs of the other devices and use them.

[8. others〕
Although the embodiments of the present application have been described above, the present invention is not limited to the contents of these embodiments. Further, the above-mentioned components include those that can be easily assumed by those skilled in the art, those that are substantially the same, that is, those in a so-called equal range. Furthermore, the components described above can be combined as appropriate. Further, various omissions, replacements or changes of the components can be made without departing from the gist of the above-described embodiment.

Further, among the processes described in the above-described embodiment, all or a part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed can be performed. All or part of it can be done automatically by a known method. In addition, information including processing procedures, specific names, various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each figure is not limited to the information shown in the figure.

Further, each component of each of the illustrated devices is a functional concept, and does not necessarily have to be physically configured as shown in the figure. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or part of them may be functionally or physically distributed / physically in arbitrary units according to various loads and usage conditions. Can be integrated and configured.

For example, the above-mentioned information providing device 100 may be realized by a plurality of server computers, or may be realized by calling an external platform or the like by API (Application Programming Interface), network computing, or the like depending on the function. Can be changed flexibly.

Further, the above-described embodiments and modifications can be appropriately combined as long as the processing contents do not conflict with each other.

Further, the above-mentioned "section, module, unit" can be read as "means" or "circuit". For example, the reception unit can be read as a reception means or a reception circuit.

1 Information processing system 10 Terminal device 100 Information provider 110 Communication unit 120 Storage unit 121 User information database 122 Authentication information database 130 Control unit 131 Reception unit 132 Generation unit 133 Notification unit 134 Providing unit 135 Acquisition unit 136 Authentication unit

Claims (15)

A generator that generates authentication information used for user authentication,
A notification unit that notifies the user of the authentication information,
A provider that provides the user with an authentication screen on which a part of the authentication information is displayed in advance, and
An information processing device characterized by being equipped with. The authentication information is
The display information displayed in advance on the authentication screen and
Input information input to the authentication screen by the user and
including,
The information processing apparatus according to claim 1. The input information is a numerical value.
The information processing apparatus according to claim 2. The display information is a character string.
The information processing apparatus according to claim 2 or 3. The display information is a pictogram.
The information processing apparatus according to claim 2 or 3. The display information is a predetermined number of character strings at the beginning of the authentication information.
The information processing apparatus according to any one of claims 2 to 5. When the input information input to the authentication screen by the user matches the input information generated by the generation unit, the authentication unit that permits the user to log in and the authentication unit.
The information processing apparatus according to any one of claims 2 to 6, further comprising. The set of the display information displayed in advance on the authentication screen and the input information input to the authentication screen by the user matches the set of the display information and the input information generated by the generation unit. In some cases, the authentication unit that allows the user to log in,
The information processing apparatus according to any one of claims 2 to 6, further comprising. The notification unit notifies the user of the authentication information via the first route.
The providing unit provides the user with the authentication screen on which a part of the authentication information is displayed in advance via the second route.
The information processing apparatus according to any one of claims 1 to 8. An encryption unit that encrypts at least one of the first path and the second path,
The information processing apparatus according to claim 9, further comprising. The reception section that accepts the user's account ID and password,
Further prepare
When the generation unit receives the user's account ID and password, the generation unit generates the authentication information used for the user's authentication.
The information processing apparatus according to any one of claims 1 to 10. The generator generates the authentication information that is different each time.
The information processing apparatus according to any one of claims 1 to 11. The generator randomly generates the authentication information each time.
The information processing apparatus according to any one of claims 1 to 12. It is an information processing method executed by an information processing device.
A generation process that generates authentication information used for user authentication,
A notification process for notifying the user of the authentication information, and
The providing process of providing the user with an authentication screen in which a part of the authentication information is displayed in advance, and
An information processing method characterized by including. Generation procedure to generate authentication information used for user authentication,
The notification procedure for notifying the user of the authentication information and
A provision procedure for providing the user with an authentication screen in which a part of the authentication information is displayed in advance, and
Information processing program to make a computer execute.

Images