JP2000029842A - Authenication device/method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve security without extremely increasing the operation labor of a user by permitting access to an information server to a client only when the matching of the collation of a password and the matching judgement of inputted individual information corresponding to the request of a prescribed timing are obtained in the collation. SOLUTION: At the time of inputting the password and a user ID from the client 3, re-input due to the non-matching of the password is allowed for the prescribed number of times. In this case, at the time of matching with a certain irregular condition timing, an information server 1 requests the input of the individual information known to only the user corresponding to the user ID, the individual relating information of one of a name and a birth date for instance. When the individual information is inputted, in the information server 1, it is collated with the individual information preserved in a storage device, and in the case of passing in all of the password, the user ID and the individual information, the access to an information service is permitted thereafter.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an authentication apparatus and an authentication method for performing user authentication between a client and a server.

[0002]

2. Description of the Related Art Conventionally, when communication is performed between an information server (host computer) and a client (online terminal), it is determined whether or not a user who uses the client is a person who is permitted access. Therefore, the client is entering the password. The entered password is in the prescribed format, or
The information server determines whether the password matches the password registered in the information server in advance. When it is determined that the input password is a predetermined one, the information server determines that the user of the client is a legitimate user and permits access to the information server. Such password verification is used in various communication network systems. In some systems, security is enhanced by collating a user ID in addition to a password. The authentication method using a password has a drawback that if a password is entered while changing the password by trial and error, an unauthorized user can find out a legitimate password.

[0003] For this reason, an authentication method has been proposed in which, if a password is incorrectly input three consecutive times, access is not accepted for a certain period of time even if the password is input.

[0004]

However, if the memo containing the password is dropped by the user or the genuine password is known to another person by any method, the person who knows the password can easily obtain the information server. Can be accessed.

[0005] In addition to the user ID, it is conceivable that further authentication information is further input from the user. However, increasing the number of items to be constantly input increases the operation labor for the user, resulting in erroneous input. Is also likely to occur.

An object of the present invention is to provide an authentication apparatus and a method capable of improving security without extremely increasing the operation labor of the user.

[0007]

In order to achieve the above object, an invention according to claim 1 is directed to an authentication apparatus for performing user authentication by password collation on an information server prior to access from a client. A storage unit for storing personal information related to an individual user; a unit for requesting the client to input personal information at a predetermined timing; and a personal information input from the client in response to the request; When the personal information matching means for matching personal information stored in the storage means and the personal information matching means are collated, the password matching and the personal information matching are obtained. Means for allowing only the client to access the information server.

According to a second aspect of the present invention, in the authentication device according to the first aspect, the predetermined timing is irregular.

According to a third aspect of the present invention, in an authentication method for performing user authentication by password verification on an information server side prior to access from a client, personal information relating to a user is stored in the information server. Requesting input of personal information to the client at a predetermined timing, and transmitting the personal information input from the client in response to the request and the personal information stored in the information server to the information server and / or Collating at the client, and when the collation is performed, permitting the client to access the information server only when a match between the password matching and a match between the personal information is obtained. Features.

According to a fourth aspect of the present invention, in the authentication method according to the third aspect, the predetermined timing is irregular.

[0011]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 shows a system configuration of an information processing system to which the present invention is applied. In FIG. 1, reference numeral 1 denotes an information server, which is connected to a client 3 via a communication line 2 such as a communication cable or a communication network, and performs information communication with the client 3. Prior to this communication,
The information server 1 performs an authentication process according to the present invention, and permits communication (login) when the authentication is passed.

The client 3 connects to the communication line 3 to the information server. As the client 3, the same client as the conventional one can be used.

The authentication processing executed in such a system will be described with reference to FIG. FIG. 2 shows the details of the authentication process performed in the information server 1.

In FIG. 2, when an access request is issued from the client 3 to the information server 1, the information server 1 requests the client 3 to input a password and a user ID. In response to this request, the user inputs a password and a user ID from the client 3 (step S10).

The information server 1 checks the password and the user ID stored in the apparatus in advance (step S20). Re-entry due to password mismatch is allowed up to a predetermined number of times (step S20 → S100 → S10 loop processing). This processing itself is the same as the conventional one. The difference from the related art is that, when a certain condition timing is met, the information server 1 sends personal information known only to the user corresponding to the user ID, for example, any one of the personal information (Steps S30 → S40). This request is displayed on the display screen of the client 3 as a guide. When the personal information is input from the client 3, the information server 1 checks the personal information stored in a storage device in the information server, for example, a hard disk. Password, user ID
If all the personal information matches, the access to the information service, that is, login is permitted thereafter (steps S40 → S50 → S60).

On the other hand, if the verification of the personal information fails, the login is not permitted and the communication is disconnected (step S50 → S110). It goes without saying that a plurality of re-inputs of the personal information may be permitted.

As described above, in the present embodiment,
It accepts input of personal information on an irregular basis, and performs user authentication including the personal information. The personal information is a matter stored in the user without being described in a memo or the like, and need not be described in a memo or the like. Therefore, even if the user ID and the password are known by trial and error, the unauthorized access person can be detected by the authentication based on the personal information that is performed irregularly. Also, there is no need to constantly input personal information, and the operation effort of the user does not increase extremely.

The following embodiment can be implemented in addition to the embodiment described above.

1) The timing for determining the input timing of the personal information may be irregular or constant. If it is performed irregularly, the next time when the personal information is input may be determined by a random number device. In the case of performing at a fixed cycle, a method of counting the passage of a certain date and time by a timer and the number of times of access may be counted, and the input timing of the personal information may be determined every predetermined number of times.

2) The personal information may be fixed, or the type, for example, name, date of birth, and age may be changed irregularly and input. Also in this case, the type may be determined by a random number device.

3) In the case of inputting the above-mentioned personal information, for example, if the user ID is not input, the operation labor of the user does not increase at all.

4) Although the above-described authentication processing is performed on the information server 1 side, it may be performed on the client 3 side or on both sides. Further, the information server 1 may instruct the personal information collation timing and the type of personal information, and the client 3 may collate the personal information according to the instruction. When performing authentication on the client 3 side, dedicated software for authentication may be installed in the client 3 in advance, and the client 3 or the CP of the information server 1 that executes the software for authentication may be used.
U functions as an authentication device.

5) In the above embodiment, the information server and the client are separated from each other. However, there is a case where a password is accepted at the time of startup by a single device such as a personal computer. Alternatively, a password may be input when accessing specific information, a document, or a database of a single / separate information processing apparatus. In this case, a keyboard for inputting information, an online terminal, or the like should be interpreted as a client, and an information processing device that receives access should be interpreted as an information server.

[0025]

As described above, according to the first and third aspects of the present invention, authentication based on personal information verification is performed only at a predetermined timing in addition to password verification, so that the user's operation labor is unnecessarily increased. In addition, security can be improved and unauthorized access can be detected.

According to the second and fourth aspects of the present invention, the authentication based on the personal information is performed irregularly, so that the unauthorized access person cannot predict the authentication timing based on the personal information.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a system configuration according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating a processing procedure of the information server of FIG. 1;

[Explanation of symbols]

 1 information server 2 communication line 3 client

────────────────────────────────────────────────── ───

[Procedure amendment]

[Submission date] June 22, 1999 (1999.6.2
2)

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] Claim 1

[Correction method] Change

[Correction contents]

[Procedure amendment 2]

[Document name to be amended] Statement

[Correction target item name] Claim 3

[Correction method] Change

[Correction contents]

[Procedure amendment 3]

[Document name to be amended] Statement

[Correction target item name] 0007

[Correction method] Change

[Correction contents]

[0007]

In order to achieve the above object, an invention according to claim 1 is directed to an authentication apparatus for performing user authentication by password collation on an information server prior to access from a client. a storage means for storing personal information associated with an individual user, irregularly
/ The personal information and the
Enter the password for password verification
Request, and at times other than the predetermined timing, the password
Means for requesting the client to input only a code ,
Personal information is input from the client in response to the request
In the case where the personal information is input , the input personal information is compared with the personal information stored in the storage means. Means for permitting the client to access the information server only when a match of the collation and a determination of the match of the personal information are obtained.

[Procedure amendment 4]

[Document name to be amended] Statement

[Correction target item name] 0009

[Correction method] Change

[Correction contents]

According to a third aspect of the present invention, in an authentication method for performing user authentication by password verification on an information server side prior to access from a client, personal information relating to a user is stored in the information server. At certain times, irregular / constant , personal information and
Before entering the password for password verification
Request to the client
Prompt for only the password to the client, the personal information from the client in response to the request
When input, the input personal information is compared with the personal information stored in the information server in the authentication server and / or the client, and when the check is performed, the password is checked. The client is permitted to access the information server only when the matching of the collation and the determination of the matching of the personal information are obtained.

Claims (4)

[Claims] 1. An authentication apparatus for performing user authentication by password collation on an information server side prior to access from a client, comprising: storage means for storing personal information relating to an individual user; Means for requesting the client to input personal information; personal information matching means for comparing personal information input from the client in response to the request with personal information stored in the storage means; If the verification by the verification means is performed,
Means for permitting the client to access the information server only when the password matching and the personal information matching are obtained. 2. The authentication device according to claim 1, wherein the predetermined timing is irregular. 3. An authentication method for performing user authentication by password collation on an information server side prior to access from a client, wherein personal information relating to a user is stored in the information server, and at a predetermined timing. Requesting the client to input personal information, and collating the personal information input from the client in response to the request with the personal information stored in the information server in the authentication server and / or the client; An authentication method for permitting the client to access the information server only when a match between the password matching and a match between personal information is obtained when the matching is performed. . 4. The authentication method according to claim 3, wherein the predetermined timing is irregular.