JP2005157687A - Information processing method, information processing system, program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processing method and the like that provide high security authentication. <P>SOLUTION: At user authentication, a part of a plurality of authentication items is selected and the selected authentication item is output. For the output authentication item, an input of authentication information is received. The authentication determines whether or not the input authentication information matches user authentication information stored in correspondence with the selected authentication item. As to the authentication item selection, if the preceding authentication has been complete (successful), an authentication item different from the preceding selected authentication item is selected, and if the preceding authentication has been incomplete, the same authentication item as the preceding selected authentication item is selected. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an information processing method, an information processing system, a program, and a recording medium that provide highly secure authentication.

  In membership-based Internet services provided by card companies, shopping sites, etc., users are usually authenticated by “ID” and “password”, but there is a risk that the password is known to others.

  Conventionally, in consideration of such dangers, a plurality of authentication information such as passwords are set and a user is requested to input a plurality of authentication information (for example, Patent Document 1 and 2). At that time, the user is requested to input all of a plurality of pieces of authentication information every time.

JP-A-7-129512 (pages 3-4, FIGS. 1-7) JP-A-11-328118 (pages 3-5, FIGS. 1-8)

  However, for example, in a personal computer used by an unspecified large number such as a recent Internet cafe, there is a risk that the input information (authentication information) may be fraudulently misused by software such as a key logger.

  Therefore, even if a plurality of authentication information is set, if all of them are fraudulent, there is a risk that they will be abused after all.

  Therefore, an object of the present invention is to provide highly secure authentication.

  In order to achieve the above object, an information processing method according to the present invention is an information processing method in an information processing system comprising storage means for storing authentication information corresponding to a plurality of authentication items for a certain user. A step of selecting a part of the plurality of authentication items, a step of outputting the selected authentication item, and a step of inputting authentication information for the output authentication item. And performing authentication by determining whether or not the input authentication information matches the authentication information of the user stored in the storage unit corresponding to the selected authentication item, The selecting step selects an authentication item different from the authentication item selected last time when the previous authentication is completed, and selects the previous authentication item when the previous authentication is not completed. To select the same authentication item as the selected authentication item.

  Here, the selecting step may select one of the plurality of authentication items.

  Here, in the step of selecting, when the previous authentication is completed, an authentication item different from the authentication item selected last time may be selected at random.

  Here, the information processing method may further include a step of outputting contents related to incompleteness when the previous authentication is not completed when the user is authenticated. it can.

  Here, the information processing method includes a step of inputting authentication information corresponding to a plurality of authentication items for the user, and a step of registering authentication information corresponding to the plurality of input authentication items in the storage unit. May be further provided.

  Here, the storage means further stores a password for the user, and the information processing method includes a step of inputting a password when authenticating the user, and the input password is stored in the memory. A step of performing authentication by determining whether or not the password of the user stored in the means matches.

  Here, the plurality of authentication items may include items related to the user attributes.

  Here, the item relating to the user's attribute includes at least one of the user's date of birth, telephone number, personal identification number, age, postal code, last name, first name, card expiration date, and zodiac signs It can be.

  The program according to the present invention is a program for causing the information processing system to execute the information processing method.

  The recording medium which concerns on this invention is a recording medium which recorded the program for making the said information processing system perform the said information processing method.

  An information processing system according to the present invention includes: a storage unit that stores authentication information corresponding to a plurality of authentication items for a user; and a part of the plurality of authentication items when performing authentication of the user. Means for selecting; means for outputting the selected authentication item; means for inputting authentication information for the output authentication item; and the input authentication information corresponds to the selected authentication item. A means for performing authentication by determining whether or not the user authentication information stored in the storage means matches, and the means for selecting includes the previous authentication when the previous authentication is completed. An authentication item different from the selected authentication item is selected, and if the previous authentication is not completed, the same authentication item as the previously selected authentication item is selected.

  According to the present invention, highly secure authentication can be provided.

For example, it is possible to perform authentication with higher safety as compared with a method using a general ID and password.
Further, as described below, it is possible to sufficiently counter illegal fraud by keyloggers and the like.
There is a random number table system as a system that can take measures against fraud. However, it is always necessary to carry a personal identification card, and the present invention is more convenient than such a system.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, a case where a user (card member) receives an online service provided by a card company will be described as an example.

  FIG. 1 is a diagram illustrating a configuration example of a communication system according to an embodiment of the present invention. The communication system shown in FIG. 1 includes an information processing system 10 and terminals 91 to 93. Each system or terminal can communicate with another system or terminal via the network 1. The network 1 may include the Internet, a public network, a mobile phone network, and the like.

  A user can use the terminals 91 to 93 to connect to the information processing system 10 of the card company and receive provision of an online service. In order to receive the provision of the online service, the user registers in advance by entering a password and predetermined authentication information (in this embodiment, the date of birth, etc.). When actually receiving the service, the user enters the password and the designated authentication information and is authenticated. If the authentication is completed (successful), the user can receive the service.

  In this embodiment, authentication is performed using both a password and predetermined authentication information, but password authentication may not be performed.

  As the terminals 91 to 93, in addition to a fixed terminal (for example, a combination of a fixed telephone and a personal computer), a form of a mobile terminal (for example, a mobile phone, a PHS, and a combination of these and a portable computer) can be used. It can also be taken. In the case of a portable terminal, it is connected to the network 1 via a base station or the like.

  FIG. 2 is a diagram illustrating a configuration example of the information processing system 10 in the present embodiment. The information processing system 10 illustrated in FIG. 2 includes a control unit 12, a storage unit 14, an interface unit 18, an input unit 20, a display unit 22, and a printing unit 24. The information processing system 10 can be configured by a personal computer, a workstation, or the like.

  The control unit 12 can take the form of a CPU (Central Processing Unit) or the like, and performs various controls of the information processing system 10. The storage unit 14 includes a RAM, a ROM, a hard disk, a floppy (registered trademark) disk, an optical disk, and the like, and stores various programs, various data, and the like. The input unit 20 includes a keyboard, a mouse, and the like. The display unit 22 is used for displaying various data. The printing unit 24 prints various data.

  The control unit 12 functions as a control program such as an OS (Operating System) stored in the storage unit 14, a program for performing various information processing such as authentication and selection of authentication information, and a function as a WWW (World Wide Web) server. Processing is performed based on a program or the like for realizing. These programs can be recorded on a recording medium such as a floppy (registered trademark) disk, a CD-ROM, or an optical disk, and read into a main storage device, a hard disk, or the like before being executed.

  The information processing system 10 can communicate with a terminal via the interface unit 18 and a network.

  On the other hand, the user can connect to the information processing system 10 and communicate with the information processing system 10 by using a terminal with a predetermined network address or the like. The user can perform communication based on HTTP (Hyper Text Transfer Protocol) with the information processing system 10 having a function as a WWW server via a terminal in which a browser program is installed. The card member can browse and input various data on the web page provided by the information processing system 10.

FIG. 3 is a diagram illustrating an example of functional blocks of a main part of the information processing system 10 in the present embodiment. The information processing unit 34 performs various types of information processing and exchanges with a terminal (user) via the interface unit 32. In addition, the information processing unit 34 performs processing by accessing each database.
The password database 52 stores (manages) each user's password.

  FIG. 4 is a diagram illustrating an example of passwords stored in the password database 52. In the example of FIG. 4, the password of the user is memorize | stored for every user identification information (here user number).

  Returning to FIG. 3, the authentication information database 54 stores the authentication information of each user for each authentication item. The authentication information database 54 also stores information related to the previous authentication of each user.

  FIG. 5 is a diagram illustrating an example of information stored in the authentication information database 54. In the example of FIG. 5, authentication information for each authentication item is stored for each user identification information (here, a user number).

  As the authentication item, for example, an item related to the attribute of the user can be considered. Items relating to the user attributes include, for example, the date of birth of the user, a telephone number (for example, a home telephone number), a personal identification number, an age (for example, full age), a postal code, a surname (for example, a surname in Chinese characters, (Last name in Roman characters), first name (for example, first name in Kanji, first name in Romaji), card expiry date, zodiac signs, and the like.

  In this embodiment, the user's date of birth, telephone number, personal identification number, age, postal code, last name, first name, card expiration date, and zodiac signs are adopted as authentication items. In other words, the authentication information database 54 stores, for each user (user number), the date of birth, telephone number, personal identification number, age, postal code, last name, first name, card expiration date, and zodiac information of the user (user number). Authentication information) is stored. However, only some of these authentication items may be adopted, additional authentication items may be added to these authentication items, or another authentication item may be adopted instead of these authentication items. May be.

  The authentication information database 54 also stores information related to the previous authentication of each user. That is, it memorizes whether the user has completed the previous authentication (success) or not (failed) and what authentication item was used (selected) in the previous authentication doing.

  Next, the flow of processing in the information processing system 10 (information processing unit 34) will be described.

  FIG. 6 is a diagram illustrating an example of an initial screen transmitted from the information processing system 10 to a user terminal. When the user connects using the terminal, the information processing system 10 transmits the screen illustrated in FIG. 6 to the terminal. The screen is displayed on the terminal.

  When the user selects “user registration” with a mouse or the like and clicks “OK”, the information processing system 10 performs processing for user registration.

  FIG. 7 is a flowchart illustrating an example of a flow of processing for user registration in the information processing system 10.

  First, the information processing system 10 gives a user number to a user and requests input of a password and authentication information (step S110).

  FIG. 8 is a diagram illustrating an example of a screen requesting input of a password and authentication information, which is transmitted from the information processing system 10 to a user terminal. This screen is transmitted to the terminal, and this screen is displayed on the terminal.

  The user inputs information about each item (password and authentication item) using a keyboard, mouse, or the like (step S120). When “OK” is clicked with a mouse, the input information is transmitted from the terminal to the information processing system 10. The information processing system 10 registers the received information in the password database 52 and the authentication information database 54 in association with the user number of the user (step S130).

  In this embodiment, in order to use the online service, user registration is requested from the user. However, without requesting user registration, existing user identification information, password, and authentication information are used. You may make it use. Further, it may be requested to input only the password or only all or a part of the authentication information. For example, in the case of an online service of a card company, the card number can be used as user identification information, or the password and various information (birth date etc.) registered at the time of card enrollment can be used as a password or authentication information. Conceivable. Such information may be registered in the information processing system 10 in advance by the card company.

  Next, processing when the user uses the service, that is, processing when the information processing system 10 provides the service will be described.

  In FIG. 6, when the user selects “service use” with a mouse or the like and clicks “OK”, the information processing system 10 performs a process for providing a service.

  FIG. 9 is a flowchart illustrating an example of a process flow for providing a service in the information processing system 10.

  First, the information processing system 10 requests the user to enter a user number and password (step S210).

  FIG. 10 is a diagram illustrating an example of a screen requesting input of a user number and a password, which is transmitted from the information processing system 10 to the user's terminal. This screen is transmitted to the terminal, and this screen is displayed on the terminal.

  The user inputs the user number and password using a keyboard, mouse, etc. (step S220). When “OK” is clicked with a mouse, the input information is transmitted from the terminal to the information processing system 10.

  The information processing system 10 accesses the password database 52 and checks whether or not the received password is correct, that is, whether or not the received user number corresponds to the password (step S230).

  If the password is incorrect, it is determined that service provision is not permitted (step S240).

  On the other hand, if the password is correct, the information processing system 10 accesses the authentication information database 54 and checks whether or not the user has completed the previous authentication (step S250). If the user is a new registrant, the previous authentication is assumed to have been completed.

  If the authentication has been completed, one authentication item different from the authentication item selected last time is selected at random (step S260), and the user is requested to input authentication information for the selected authentication item. (Step S270). When the user is a new registrant, one of all authentication items is selected at random.

  In this embodiment, an authentication item different from the authentication item selected last time is selected at random. However, if an authentication item different from the authentication item selected last time is selected, the authentication item is not random but predetermined. You may make it select by the method given.

  On the other hand, if the authentication has not been completed, the same authentication item as the previously selected authentication item is selected (step S280), and the user is requested to input authentication information for the selected authentication item (step S280). S290). Further, contents (messages) related to the fact that the previous authentication has not been completed are output to the user (step S300).

  In response to a request for inputting authentication information, the user inputs authentication information (step S305). The input authentication information is transmitted from the terminal to the information processing system 10.

  The information processing system 10 accesses the authentication information database 54 and checks whether the received authentication information is correct (step S310). That is, it is checked whether or not the received authentication information matches the authentication information registered in association with the user number of the user.

  If the authentication information is correct, the current authentication item and this completion (success) are stored in the authentication information database 54 as the previous authentication item and the previous result (step S320). Then, service provision is permitted (step S330).

  On the other hand, when the authentication information is not correct, the fact that the current authentication item and the current incomplete (failure) are stored as the previous authentication item and the previous result are stored in the authentication information database 54 (step S340). Then, the service provision is not permitted (step S350).

  FIGS. 11 to 13 are diagrams showing examples of screens for requesting input of authentication information (step S270 or S290) transmitted from the information processing system 10 to the user's terminal. This screen is transmitted to the terminal, and this screen is displayed on the terminal.

  The user inputs authentication information using a keyboard, mouse, or the like (step S305). When “OK” is clicked with a mouse, the input information is transmitted from the terminal to the information processing system 10.

  In the example of FIG. 11, when a user inputs correct information as a telephone number, when the user uses the service next time, an authentication item different from the previous authentication item (phone number) is selected. (Step S260). For example, as shown in the example of FIG. 12, the date of birth is selected as the authentication item.

  Accordingly, in the authentication shown in FIG. 11, even if the user's telephone number is stolen by a key logger or the like, the next time the service is used, as shown in FIG. ), The fraudster cannot use the fraudulent information. Therefore, the authentication cannot be completed and the service cannot be used.

  If the fraudster fails to complete the authentication shown in FIG. 12 and tries to use the service again, as shown in FIG. 13, the same authentication item (date of birth) as the previous authentication item is displayed. Selected (step S280). Further, the content (message) related to the fact that the previous authentication has not been completed is output to the fraudster (step S300). As a result, a deterrent effect against fraudulent users such as fraudsters is exhibited, and a self-check function is provided to legitimate users.

  In the present embodiment, a mode is described in which a user connects to the information processing system 10 using a terminal and inputs and outputs information. However, for example, the information processing system 10 is placed in a place where the user can easily use it. It is also possible that the user can directly input / output information to / from the information processing system 10 via the input unit 20, the display unit 22, the printing unit 24, and the like.

  In the present embodiment, one authentication item is selected as a part of all authentication items and information input is requested for the authentication item. It is also possible to select two or more items and request input of information for those authentication items. In this case, when the previous authentication is completed, at least a part of the two or more authentication items to be selected may be different from the previously selected item (the item that was not previously selected).

  In this embodiment, at the time of user registration, information is input for authentication items predetermined on the information processing system 10 side. However, the user sets authentication items and inputs the information. You can also

It is a figure which shows the structural example of the communication system in embodiment of this invention. It is a figure which shows the structural example of the information processing system in embodiment of this invention. It is a figure which shows the example of the functional block of the principal part of the information processing system in embodiment of this invention. It is a figure which shows the example of the information which a password database memorize | stores. It is a figure which shows the example of the information which an authentication information database memorize | stores. It is a figure which shows the example of the initial screen which an information processing system transmits with respect to a user's terminal. It is a flowchart which shows the example of the flow of the process for user registration in an information processing system. It is a figure which shows the example of the screen which requests | requires the input of a password and authentication information which an information processing system transmits with respect to a user's terminal. It is a flowchart which shows the example of the flow of a process for the service provision in an information processing system. It is a figure which shows the example of the screen which requests | requires the input of a user number and a password which an information processing system transmits with respect to a user's terminal. It is a figure which shows the example of the screen which requests | requires the input of authentication information which an information processing system transmits with respect to a user's terminal. It is a figure which shows the example of the screen which requests | requires the input of authentication information which an information processing system transmits with respect to a user's terminal. It is a figure which shows the example of the screen which requests | requires the input of authentication information which an information processing system transmits with respect to a user's terminal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network 10 Information processing system 12 Control part 14 Storage part 18, 32 Interface part 20 Input part 22 Display part 24 Printing part 34 Information processing part 52 Password database 54 Authentication information database 91-93 Terminal

Claims (11)

An information processing method in an information processing system comprising storage means for storing authentication information corresponding to a plurality of authentication items for a user,
When performing authentication of the user, selecting a part of the plurality of authentication items;
Outputting the selected authentication item;
Inputting authentication information for the output authentication item;
Authenticating by determining whether or not the input authentication information matches the authentication information of the user stored in the storage unit corresponding to the selected authentication item,
The selecting step selects an authentication item different from the authentication item selected last time when the previous authentication is completed, and selects the authentication item selected last time when the previous authentication is not completed. An information processing method characterized by selecting the same authentication item.   The information processing method according to claim 1, wherein the selecting step selects one of the plurality of authentication items.   The information processing method according to claim 1, wherein the selecting step randomly selects an authentication item different from the previously selected authentication item when the previous authentication is completed. Information processing method.   The information processing method according to claim 1, further comprising a step of outputting contents related to the incomplete when the previous authentication is not completed when the user is authenticated. An information processing method characterized by the above. An information processing method according to claim 1,
Inputting authentication information corresponding to a plurality of authentication items for the user;
And registering authentication information corresponding to the plurality of input authentication items in the storage means. An information processing method according to claim 1,
The storage means further stores a password for the user;
The information processing method includes:
Entering a password when authenticating the user; and
And a step of performing authentication by determining whether or not the input password matches the password of the user stored in the storage means.   The information processing method according to claim 1, wherein the plurality of authentication items include an item related to the attribute of the user.   The information processing method according to claim 7, wherein the item related to the attribute of the user includes a date of birth of the user, a telephone number, a password, an age, a postal code, a surname, a first name, a card expiration date, And at least one of the zodiac signs.   A program for causing the information processing system to execute the information processing method according to claim 1.   A computer-readable recording medium storing a program for causing the information processing system to execute the information processing method according to claim 1. An information processing system,
Storage means for storing authentication information corresponding to a plurality of authentication items for a user;
Means for selecting a part of the plurality of authentication items when authenticating the user;
Means for outputting the selected authentication item;
Means for inputting authentication information for the output authentication item;
Means for authenticating by determining whether or not the input authentication information matches the authentication information of the user stored in the storage means corresponding to the selected authentication item;
The means for selecting selects an authentication item different from the authentication item selected last time when the previous authentication is completed, and selects the authentication item selected last time when the previous authentication is not completed. An information processing system characterized by selecting the same authentication item.

Images