JP2007164661A - Program, device and method for user authentication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve convenience for a user who requests login while assuring security nature. <P>SOLUTION: At a preparation stage, a use tendency information generation processing part 11 collects information regarding user's use situation defined by use situation definition information for a fixed period after user authentication, grasps server use tendency of each user by analyzing the information and generates use tendency information by associating authentication levels with each use situation. To a login request transmitted after termination of preparation, an authentication level determination part 12 compares and collates the user's use situation at the point of receiving the login request with the user's use tendency information to determine an authentication level to the login request. A user authentication execution control part 13 performs the user authentication to the login request according to authentication procedures corresponding to the determined authentication level. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to provision of user authentication in accordance with the usage status of a user's server computer.

  Conventionally, in various systems operated by connecting to a server via a network, a method of authenticating and approving a user using a user ID and a password is generally used as a user authentication method. However, in the user authentication method using a password, since it is difficult to store the password, an easy password is set, and problems such as easy password cracking associated with this, and further problems such as spoofing due to password leakage There was a need for stronger security.

  Further, in a system that requires user authentication, a method of complicating the authentication procedure has been considered in order to maintain and strengthen security. However, there is a problem of reduced convenience and increased cost. For example, complication of authentication is generally a method of combining authentication information such as requesting authentication information such as keywords in addition to a user ID and password, and preparing other passwords such as a plurality of passwords. If the user is always input, the convenience of the system will be reduced. In addition, user authentication using personal physical features such as fingerprints and irises can identify individuals more reliably and is effective in terms of security enhancement, but the cost of introducing an authentication mechanism increases. There are challenges. Other authentication methods such as authentication using ID information such as ID cards also have problems such as increased costs associated with the introduction of equipment.

  In order to solve such a problem, there is a technique for improving the security level of authentication using unique information depending on the terminal used by the user (for example, Patent Documents 1 to 3). For example, when a user uses the system, terminal-specific information such as a MAC address of a terminal serving as a client or model number information of a memory is used during authentication. Also, by complicating the authentication procedure when trying to access the system from a terminal other than the terminal that the user normally uses, it is difficult to intrude the user who tries to try unauthorized access. Alternatively, a method has been considered in which the user's terminal information is used to change the user's authentication level to achieve both security enhancement and convenience maintenance.

JP 2004-246715 A JP 2001-306173 A JP 2004-178408 A JP 2003-150550 A Japanese Patent Laid-Open No. 2004-62241

  However, the use of terminal-specific information at the time of authentication causes a problem that convenience is reduced when the terminal-specific information changes due to access from a terminal other than normal use or exchange of communication equipment or the terminal itself. To do. That is, in the Web application, since the browser is used as a general-purpose client, the user can access from various environments. However, if the terminal to be used is fixed, this advantage cannot be enjoyed. In addition, when the terminal configuration device such as the network card or the memory from which the terminal unique information is acquired needs to be replaced due to damage, the registered unique information needs to be changed. In a system in which a large number of users are registered, the management cost for changing the setting information increases.

  The present invention has been made to solve the above-described problems, and an object thereof is to improve user convenience at the time of a login request while ensuring security.

  To achieve the above object, the user authentication program according to the present invention has a function of performing user authentication in response to a login request sent from a client computer used by a user when starting to use a server computer. By analyzing information related to the usage status of the server computer of each user, the usage trend of the server computer is obtained for each user, and the authentication level for each usage status is determined in accordance with an authentication level standard determined in advance according to the usage trend. Is determined for each user, the usage trend information is generated for each user by associating the authentication level with each usage status, and is registered in the usage trend information storage unit. After the trend information is generated, when the login request is sent, the usage trend information From an authentication level determination unit that determines an authentication level for performing the user authentication based on usage trend information of the user stored in the storage unit, an authentication procedure storage unit in which an authentication procedure different for each authentication level is set, An authentication procedure specified by the authentication level determined by the authentication level determination means is read out and functions as a user authentication execution means for executing user authentication processing in accordance with the read authentication procedure.

  Further, the usage trend information generation means obtains a usage trend of the server computer for each user by analyzing information related to the usage status of the server computer of each user within a specified period.

  In addition, the usage trend information generation unit may store at least one of information on the status of the server computer at the time when the user starts using the server computer or information on the status of the client computer used for using the server computer. It is characterized in that it is collected and analyzed as information on the usage status of the user's application.

  Further, when the authentication level obtained from a plurality of information items included in the usage trend information is different, the authentication level determination means performs a weighting calculation according to a weight value set in advance for each information item. It is characterized by determining.

  The user authentication device according to the present invention is different for each authentication level in a user authentication device having a function of performing user authentication in response to a login request sent from a client computer used by a user when starting use of a server computer. The authentication procedure storage means in which the authentication procedure is set, and the usage trend of the server computer are obtained for each user by analyzing the information on the usage status of each user's server computer, and the authentication level predetermined according to the usage trend A usage trend information generating unit that determines an authentication level for each usage status for each user in accordance with a standard, associates an authentication level with each usage status, generates usage trend information for each user, and registers the usage trend information in the usage trend information storage unit; After the usage trend information is generated by the usage trend information generation means, a login request is sent. Authentication level determination means for determining an authentication level for performing the user authentication based on the usage trend information of the user stored in the usage trend information storage means, and the authentication determined by the authentication level determination means User authentication execution means for reading an authentication procedure specified by a level from the authentication procedure storage means and executing user authentication processing in accordance with the read authentication procedure.

  The user authentication method according to the present invention is implemented by a computer having a function of performing user authentication in response to a login request sent from a client computer used by a user when starting use of a server computer. Usage trend information generation step for generating usage trend information of each user from the usage status of the user, and when a login request is sent after the usage trend information is generated, user authentication to be performed for the login request is determined and executed The usage trend information generating step obtains the usage trend of the server computer for each user by analyzing information on the usage status of the server computer of each user, and determines in advance according to the usage trend. The authentication level for each usage status is in accordance with the specified authentication level standard. Was determined for each user, a usage trend information generated for each user by associating the authentication level to each usage, registers the use tendency information of each user thus generated to the use tendency information storage means. Further, the user authentication step determines an authentication level for performing the user authentication based on the usage trend information of the user stored in the usage trend information storage unit when a login request is sent. An authentication procedure specified by the determined authentication level is read from the authentication procedure storage means in which different authentication procedures are set for each authentication level, and user authentication processing is executed according to the read authentication procedure.

  According to the present invention, the usage trend of each user is grasped by analyzing the usage status of the user's server computer, and then, according to the usage status of the user at that time, when the user's usage of the server computer is started. The authentication procedure for user authentication is determined dynamically. In other words, when it is determined that the usage status of the user at the start of usage of the user's server computer is a high usage status based on the usage trend of the user, the user's convenience is achieved by simplifying the authentication procedure, On the other hand, when it is judged that the usage situation is infrequent, it is possible to enhance security by complicating the authentication procedure, thus improving user convenience during user authentication while ensuring security. Can be achieved.

  Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is an overall configuration diagram of a network system according to the present embodiment. FIG. 1 shows a plurality of client computers (hereinafter simply “clients”) 2 used by a user and a server computer (hereinafter simply referred to as “clients”) installed with a plurality of Web applications used by the client users via the Internet 4. Server ") 6.

  The server 6 includes an application execution unit 8 that executes a Web application specified by the user and a user authentication processing unit 10 that performs user authentication before causing the user to execute the Web application.

  In the above configuration, when a user wants to use any of the Web applications installed in the server 6, the user issues a login request to the server 6 by inputting a URL indicating the Web application and its storage location. The user authentication processing unit 10 returns a login form in response to a login request from the client 2. When the user inputs a user name (user ID) and password from the login form, user authentication processing is executed according to a predetermined authentication procedure described later. The application execution unit 8 executes a Web application designated by the user after user authentication.

  FIG. 2 is a block diagram of the user authentication processing unit 10 shown in FIG. The user authentication processing unit 10 includes a usage trend information generation processing unit 11, an authentication level determination unit 12, and a user authentication execution control unit 13. Further, as various information storage means, a usage status definition information storage unit 14, a usage status storage unit 15, a usage trend information storage unit 16, and an authentication procedure definition information storage unit 17 are provided. The usage trend information generation processing unit 11 collects the usage status of each user's server 6 and records it in the usage status storage unit 15. Furthermore, the usage trend of the server 6 is obtained for each user by analyzing information related to the usage status of the server 6 within a certain period of time for each user, and an authentication level for each usage status is determined for each user according to the usage trend. The usage level information is generated for each user by associating the usage level with each usage status. Then, the generated usage trend information is registered in the usage trend information storage unit 16. When a login request is sent, the authentication level determination unit 12 determines an authentication level for performing the user authentication from the usage status of the user at the time when the login request is received. The user authentication execution control unit 13 performs user authentication with respect to the received login request by an authentication procedure according to the determination level determined by the authentication level determination unit 12. In addition to performing user authentication, information is exchanged with the client 2 and operation control related to user authentication such as activation of the usage trend information generation processing unit 11 and the authentication level determination unit 12 is performed. The processing functions in the constituent elements 11 to 13 are realized by a cooperative operation between the server 6 and one or more user authentication programs that realize the processing functions.

  The storage units 14 to 17 will be described together with the description of the operation. In the present embodiment, each of the storage units 14 to 17 is assumed to be realized by an external storage device such as an HDD mounted on the server 6, but is realized by a RAM in a state where necessary data is copied. You may do it.

  Next, the operation in this embodiment will be described. In the present embodiment, the usage trend of each user is determined, the processing until obtaining usage trend information to be set and registered in the usage trend information storage unit 16, and the authentication procedure is determined according to the login request sent, It can be roughly divided into processing for executing user authentication in accordance with the determined authentication procedure. The former is a process performed as advance preparation, and the latter is equivalent to a process executed after completion of the advance preparation. First, the usage trend is obtained from the usage status of each user, and the usage trend information is statically registered. The process will be described.

  In this embodiment, as a preparation for performing the characteristic user authentication process of the present embodiment, the user usage status for a certain period is collected. This process is mainly used as a usage trend information generation processing unit. 11 is implemented. In the present embodiment, the usage status definition information indicating what kind of information the usage status of the user to be collected is defined in advance and set and registered in the usage status definition information storage unit 14. . The usage status definition information set and registered in the usage status definition information storage unit 14 is shown in FIG.

  In FIG. 3, the usage status definition information is classified into information on each status on the client side and the server side. The information on the situation on the client side is information on the usage environment of the client 2 used by the user (client environment information). In this embodiment, the name and version of the browser used for accessing the server 6, the language, The IP address is a typical example of client 2 specific information. On the other hand, the information on the server-side status is information on the status of the server 6 at the time of use by the user (system usage status information), and in this embodiment, the information at the time of user authentication in response to the login request. Use time zone specified by the day of the week and time (the use time zone is set in advance by dividing 24 hours), the application information such as the name of the Web application used by the user, information and contents regarding the page accessed by the user Consists of information about.

  In the preliminary preparation stage, the user authentication execution control unit 13 performs normal user authentication processing in response to a login request from the user. After the user authentication, the usage trend information generation processing unit 11 reads the usage status definition information from the usage status definition information storage unit 14 and selects the information item defined by the usage status definition information, specifically the server 6. The client environment information is collected by acquiring the language of the name and version of the browser activated on the client 2 being used when accessing and extracting the IP address included in the communication packet. At the same time, system usage status information is collected by acquiring application information, pages, and content information that can be specified from the day of the week, the usage time zone, and the user request obtained from the date and time when user authentication is performed. Then, the collected information is recorded in the usage status storage unit 15 as a set.

  Then, for example, after a predetermined time such as one month elapses, the usage trend information generation processing unit 11 starts generating usage trend information. Note that the usage trend information generation processing unit 11 may collect information only for a certain period, or extract information included in the certain period for generating usage trend information from the collected usage status information. It may be.

  An example of the contents of the usage trend information generated by the usage trend information generation processing unit 11 is shown in FIGS. Of the usage trend information, FIG. 4 shows an example of the usage trend information on the system side (server 6 side) corresponding to the system usage status information, and FIG. 5 shows the usage trend information on the client 2 side corresponding to the client environment information. It is a content example. In this embodiment, since the authentication level is set in four stages, elements corresponding to information items such as “day of the week”, “usage time zone”, or “browser name and version” according to the usage status of the user Is assigned to any of the authentication levels to generate usage trend information. Here, an example of a method of generating usage trend information will be described with reference to FIG.

  FIG. 6 is a graph when the result of totaling the number of server accesses made by a certain user within a certain period for each day of the week is displayed in a graph. In this embodiment, the number of server accesses within a certain period is analyzed as the user usage status in order to obtain the usage trend of the day of the week. As illustrated in FIG. 6, it is assumed that the number of accesses from Monday to Sunday within a certain period is 20, 12, 5, 27, 30, 2, 0. In this embodiment, the authentication level is set in four stages. Regarding the number of server accesses, the authentication level is 4 times or more and less than 5 times, and the authentication level is 3 or more and less than 10 times. An authentication level standard of assigning authentication level 2 and 17 or more times to authentication level 1 is set in advance. Therefore, the authentication level for Monday with 20 accesses is determined to be 1. Then, the authentication level for Tuesday with 12 accesses is determined to be 2. The authentication level can be similarly determined for other days of the week. When the authentication level for each day of the week is determined in this way, each day of the week is set and registered in the usage trend information storage unit 16 in association with the authentication level. In this way, the authentication level of the elements included in each information item (month, Tuesday, Wednesday,.

  As is clear from the above description, the lower the user usage frequency, the smaller the authentication level is assigned. Similarly, with respect to information items of client environment information such as “usage time zone”, “application”, and “browser name and version”, the usage trend information generation processing unit 11 uses the usage status storage unit 15 within a certain period of time. Information on the situation is read, and the read information such as the number of accesses described above is analyzed to obtain the user's usage trend, and usage trend information is generated and registered. This process is performed for each user.

  As described above, advance preparations for performing the characteristic user authentication processing of the present embodiment are performed.

  Next, the user authentication process after completion of the above-described advance preparation will be described.

  FIG. 7 is a diagram showing a setting example of authentication procedure definition information that is set and registered in advance in the authentication procedure definition information storage unit 17 in the present embodiment. In the present embodiment, a plurality of authentication procedures for user authentication are prepared, and the authentication procedure for user authentication actually performed in response to the login request from the user is determined by the user at the time of the login request. It is characterized in that it is dynamically determined according to the usage situation. In the present embodiment, four levels of authentication are set, and an authentication procedure is set corresponding to each authentication level. According to the setting example shown in FIG. 8, as an authentication procedure, user authentication is performed using only a password at authentication level 1, and user authentication is performed using a password and keyword input at authentication level 2. At authentication level 3, user authentication is further performed by presenting a client certificate, and at authentication level 4, a time limit is set for execution of user authentication processing.

  Based on the above authentication procedure setting examples for each authentication level, the security level is improved (security is strengthened) as the authentication level value increases and the number of authentication items increases, making authentication more sophisticated. Can understand.

  Next, user authentication processing in the present embodiment will be described using the flowchart shown in FIG.

  The user makes a login request by inputting a predetermined URL on the Web browser. Upon receiving the login request sent by the client user, the user authentication execution control unit 13 returns a login form to the client 2 in response to the request and causes the client 2 to display a screen (step 101). When the user inputs a predetermined item necessary for user authentication, that is, a user name and password, from the login form displayed on the screen, the user authentication execution control unit 13 accepts the user name and password input by the user (step 102). . Subsequently, the user authentication execution control unit 13 determines whether or not the user is a registered user by comparing and collating the user name with user authentication information registered in a storage unit (not shown) by a conventional method. The usage status of the user who made the login request is collected (step 103). The information collected here is information items defined for comparison and collation with usage trend information, specifically, client environment information and system usage status information.

  Subsequently, when receiving the user usage status information collected by the user authentication execution control unit 13, the authentication level determination unit 12 reads the usage trend information of the user from the usage trend information storage unit 16, and receives the received user usage status information. Are compared with the read usage trend information to identify a matching authentication level (step 104). For example, if the setting example shown in FIG. 4 is followed, if today is Monday, the authentication level is determined to be 1. Note that if the current time is Monday at 8:00, the authentication level determined at the day of the week is 1, but if determined in the usage time zone, the authentication level is 2, and the determination results are different. In this case, a single authentication level must be determined for the login request by some method, and this determination method will be described in detail later.

  When the authentication level is determined, the authentication level determination unit 12 reads and acquires the authentication procedure corresponding to the determined authentication level from the authentication procedure definition information storage unit 17 (step 105). This acquired authentication procedure is a user authentication execution procedure executed in response to the login request. For example, if the authentication level is 1, user authentication is performed using only a password, and if the authentication level is 2, user authentication is performed using keyword input after password confirmation. The authentication level determination unit 12 notifies the user authentication execution control unit 13 of the authentication procedure specified as described above.

  Upon receiving the notification of the authentication procedure from the authentication level determination unit 12, the user authentication execution control unit 13 performs user authentication according to the authentication procedure (step 106). Note that the user authentication execution control unit 13 may receive the authentication level from the authentication level determination unit 12 and access the authentication procedure definition information storage unit 17 by itself to acquire the authentication procedure.

  In this embodiment, since it is necessary to perform user authentication using a password at any authentication level, user authentication is performed using the user name and password acquired in step 102. If the authentication level is 2 or higher, a keyword input form is further transmitted to the client 2 and displayed on the browser screen. When a keyword input by the user is received from the keyword input form, the user authentication execution control unit 13 performs user authentication using the keyword. If the authentication level is 3 or higher, a client certificate presentation request is further transmitted to the client 2. When receiving the client certificate sent from the user in response to the presentation request, the user authentication execution control unit 13 performs user authentication using the presented client certificate. When the authentication level is 4, the user authentication execution control unit 13 determines that the time required from the start of user authentication according to the specified authentication procedure to the present time is a preset time limit (timeout). It is determined whether it is within (time). In other words, if you are a legitimate login user, you can quickly enter keywords and present your client certificate, but if you are an unauthorized login requester, you will not be able to perform the input / presentation operation quickly and will take more time than necessary. In this embodiment, a timeout is set as a method for enhancing security. As a result of performing the user authentication process in this way, if the process is completed normally, login to the server 6 is permitted, and if the user cannot be authenticated, the login request is rejected. In addition, as for the coping method when there is an individual user authentication based on keyboard input or client certificate and an input error, etc., a conventional method can be used, so the detailed explanation of each method is omitted. .

  Here, the authentication level determination process performed in step 104 will be described in detail. As described above, if the login request is received at 8:00 on Monday, the authentication level determined at the day of the week is 1, but the authentication level is 2 when determined by the usage time period. The result will be different. Even in such a case, it is necessary to determine a single authentication level for the login request, but in this embodiment, the authentication level is determined by weighting. The pattern which performs this weighting is demonstrated using FIG.

  Information constituting the usage trend information in this embodiment can be broadly divided into information related to the client 2 used by the user (client environment information) and information related to the server 6 (system usage status information). The client environment information is composed of information items such as the browser name and version, language, and IP address as defined in the usage status definition information. The system usage status information includes the day of the week, usage time zone, application information, It consists of information items such as page information and content information. FIG. 9A shows an example in which weighting is performed for each broadly classified information. That is, according to the setting example shown in FIG. 9A, the weight value is set to 0.3 for the browser name, version, language, and IP address constituting the client environment information, and the day of the week constituting the system usage information, The weight value is set to 0.7 for the usage time zone, application information, page information, and content information. FIG. 9B shows an example in which weight values are individually set for the browser name, version, language, and IP address constituting the client environment information. FIG. 9C shows an example in which weight values are individually set for the day of the week, the usage time zone, application information, page information, and content information constituting the system usage status information. In this way, a single authentication level is determined for the login request by setting a weight value in advance for each information item and performing weighting calculation. When a single authentication level is determined, an authentication procedure is determined as described above, and user authentication processing is performed for the login request according to the authentication procedure.

  In the present embodiment, as described above, the usage status of each user's server 6 is accumulated, and the usage tendency of each user for a certain period is grasped from the accumulated information. If the log-in request is based on the usage status of the server 6 that is regularly performed (for example, a log-in request at 10:00 on Monday), the possibility of a log-in request by a regular user is relatively high due to past usage trends. Judgment is made, the security level of user authentication is lowered, and user authentication is performed only with a password. On the other hand, if the login request is a situation different from the normal usage situation of the user (for example, a login request of 1:00 on Wednesday), the possibility of a login request by a regular user is relatively based on past usage trends. It is judged that the security level is low, and the security level of user authentication is increased, and user authentication by other methods such as keyboard input is additionally performed. That is, if daily server usage is required, the security level is lowered to give priority to user convenience, and if extraordinary server usage is requested, the security level is increased to improve user convenience. Prioritized security enhancement.

  According to the present embodiment, even when a login request is made from the same user as described above, user authentication based on a user only at the time when the login request is made, or a plurality of authentications. The methods can be combined and the authentication procedure can be changed dynamically. As described above, since an appropriate security level can be selected according to the usage situation at the time when the login request is made, it is possible to improve the convenience of the user while ensuring the security.

  By the way, in the present embodiment, it is necessary to set and register the usage status definition information and the authentication procedure definition information in the storage units 14 and 17 in advance, but an information management means is provided in the configuration shown in FIG. In addition, the definition information stored in the storage units 14 and 17 may be appropriately updated such as addition, change, and deletion.

  Various information defined by the usage status definition information can be appropriately selected without being limited to the items exemplified in the present embodiment. For example, in the present embodiment, the system is configured such that the user logs in to the server 6 and uses the Web application installed in the server 6, so that the system usage status information includes application information. If it is configured to use a resource other than the application, information relating to the resource may be included as an information item instead of the application. Further, the authentication level defined by the authentication procedure definition information does not necessarily have to be four stages, but may be two or more stages. In addition, the user authentication method included in the authentication procedure is not limited to this example, and may be appropriately combined and set according to the type of service provided by the server 6, the confidentiality of information, the characteristics of the client user serving as the user, and the like. Can do.

  Note that in this embodiment, the usage trend information is generated and registered with the information related to the login request within the preparation period as an analysis target, and the login request sent thereafter is characterized by this embodiment. Added basic user authentication. However, the usage trend information may be updated as appropriate even after it is generated once. That is, the user authentication execution control unit 13 performs the above-described user authentication process for the login request sent after the preparation period has elapsed, and sends the login request to the usage trend information generation processing unit 11. The usage status storage unit 15 continuously collects the usage status. Then, the usage trend information generation processing unit 11 re-generates the usage trend information by newly setting a certain period for generating the usage trend information, or extends the certain period, etc. Improve the accuracy of usage trends. As described above, the usage trend information may be updated as needed with reference to the login request sent after the preparation period has elapsed.

1 is an overall configuration diagram of a network system in the present embodiment. It is a block block diagram of the user authentication process part shown in FIG. It is the figure which showed the example of the usage status definition information set and registered into the usage status definition information storage part in this Embodiment. It is the figure which showed the example of a setting of the system usage condition information contained in the usage tendency information which the usage trend information generation process part in this Embodiment produces | generates. It is the figure which showed the example of a setting of the client environment information contained in the usage trend information which the usage trend information generation process part in this Embodiment produces | generates. In this Embodiment, it is a figure when the result of having totaled the frequency | count of the server access performed by the user within the fixed period for every day of the week is displayed as a graph. It is the figure which showed the example of a setting of the authentication procedure definition information previously set and registered in the authentication procedure definition information storage part in this Embodiment. It is the flowchart which showed the user authentication process in this Embodiment. It is the figure which showed the example of a setting of the weighting to each information item of the utilization condition definition information used when calculating | requiring an authentication level in this Embodiment.

Explanation of symbols

  2 client, 4 Internet, 6 server, 8 application execution unit, 10 user authentication processing unit, 11 usage trend information generation processing unit, 12 authentication level determination unit, 13 user authentication execution control unit, 14 usage status definition information storage unit, 15 A usage status storage unit; 16 a usage trend information storage unit; and 17 an authentication procedure definition information storage unit.

Claims (6)

A computer having a function of performing user authentication in response to a login request sent from a client computer used by a user when starting use of a server computer;
By analyzing information related to the usage status of the server computer of each user, the usage trend of the server computer is obtained for each user, and the authentication level for each usage status is determined for each user in accordance with an authentication level standard determined in accordance with the usage trend. Usage trend information generating means for determining, associating an authentication level with each usage situation, generating usage trend information for each user, and registering in the usage trend information storage means;
In order to perform the user authentication based on the usage trend information of the user stored in the usage trend information storage unit when a login request is sent after the usage trend information is generated by the usage trend information generation unit. Authentication level determination means for determining the authentication level of
User authentication that reads an authentication procedure specified by the authentication level determined by the authentication level determination unit from an authentication procedure storage unit in which a different authentication procedure is set for each authentication level, and executes user authentication processing according to the read authentication procedure Execution means,
User authentication program to function as. The user authentication program according to claim 1,
The usage trend information generation means obtains a usage trend of a server computer for each user by analyzing information related to the usage status of the server computer of each user within a specified period. In the user authentication program according to claim 1 or 2,
The usage trend information generating means obtains at least one of the information on the status of the server computer at the time when the user starts using the server computer or the information on the status of the client computer used for using the server computer. A user authentication program that collects and analyzes information about the usage status of an application. In the user authentication program according to claim 3,
When the authentication level obtained from a plurality of information items included in the usage trend information is different, the authentication level determination means determines the authentication level by performing weighting calculation according to a preset weight value for each information item. A user authentication program. In a user authentication apparatus having a function of performing user authentication in response to a login request sent from a client computer used by a user when starting use of a server computer,
Authentication procedure storage means in which different authentication procedures are set for each authentication level;
By analyzing information related to the usage status of the server computer of each user, the usage trend of the server computer is obtained for each user, and the authentication level for each usage status is determined for each user in accordance with an authentication level standard determined in accordance with the usage trend. Usage trend information generating means for determining, associating each usage situation with an authentication level, generating usage trend information for each user, and registering it in the usage trend information storage means;
In order to perform the user authentication based on the usage trend information of the user stored in the usage trend information storage unit when a login request is sent after the usage trend information is generated by the usage trend information generation unit. Authentication level determination means for determining the authentication level of
User authentication execution means for reading out an authentication procedure specified by the authentication level determined by the authentication level determination means from the authentication procedure storage means, and executing user authentication processing according to the read authentication procedure;
A user authentication device comprising: Implemented on a computer having a function of performing user authentication in response to a login request sent from a client computer used by a user when starting use of a server computer,
A usage trend information generation step of generating usage trend information of each user from the usage status of each user's server computer;
When a login request is sent after generation of usage trend information, a user authentication step is performed to determine and perform user authentication for the login request;
Including
The usage trend information generation step includes:
By analyzing the information about the usage status of each user's server computer, the usage tendency of the server computer is obtained for each user,
The authentication level for each usage status is determined for each user according to the authentication level standard determined in advance according to the usage trend,
Generate usage trend information for each user by associating the authentication level with each usage status,
Register the generated usage trend information of each user in the usage trend information storage means,
The user authentication step includes:
When a login request is sent, an authentication level for performing the user authentication is determined based on the user usage trend information stored in the usage trend information storage unit,
Read out the authentication procedure specified by the determined authentication level from the authentication procedure storage means in which a different authentication procedure is set for each authentication level,
A user authentication method, wherein user authentication processing is executed in accordance with the read authentication procedure.

Images