JP2008242641A - Authentication approval system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide technology to authenticate users more reliably when a service provider provides services to the users. <P>SOLUTION: An authentication approval system comprises a service execution apparatus 1 for providing a service, and an authentication approval request apparatus 2. When a user requests the service execution apparatus 1 to execute the service, the service execution apparatus 1 sends an execution permission request to approve service execution to the authentication approval request apparatus 2. In response to the execution permission request, the authentication approval request apparatus 2 selects at least one prespecified communication means from a plurality of communication means, and uses the selected communication means to send an authentication approval request to confirm service use to a specified user. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication / authorization system that authenticates a user when using a service.

  In recent years, fraudulent use of cards has become serious in banks and credit industries. According to the Japan Network Security Association's 2005 Report on Information Security Incidents (http://www.jnsa.org/result/2005/20060803_pol01/index.html), the entire card issuer industry in 2005 Unauthorized use of over 15 billion yen has occurred annually. A technique capable of suppressing damage caused by such unauthorized use is desired.

  At present, authentication based on a combination of a user name and a password is widely used. However, there are many cases where the user uses an inappropriate number such as a date of birth or a car number as a password, and a sufficient effect is not obtained. In recent years, an act of stealing a password by stealing a state when a user operates an ATM has actually occurred. Therefore, password authentication alone is no longer sufficient. The use of security tokens with biometrics and IC cards is also conceivable. However, in that case, since a special system is required or a user needs to carry a special device, introduction is difficult.

  The following are known as related technologies.

  Patent Document 1 describes an automated method for authorizing a transaction. The transaction is based on a customer identifier associated with the customer. The method includes: (A) receiving a request to authorize a transaction that includes a customer identifier; and (B) determining whether to authorize the transaction based on the customer identifier in response to the request; , (C) if it is determined that the transaction should be authorized, communicating the decision to the customer; and (D) confirming that the customer has agreed to authorize the transaction. Receiving the communication; and (E) authorizing the transaction in response to the communication from the customer.

  Patent Document 2 describes a method for preventing unauthorized use of a card. The card company center receives the card number read by the terminal of the member store. The center searches the telephone number of the user's mobile communication terminal registered in advance in the database from the card number, and sends it to the mobile communication terminal. When the user's mobile radio terminal inputs that the card can be used, the center permits the use of the card.

  Patent Document 3 describes an authentication server. When there is a request for service from a terminal with low reliability, it is possible to use a service that ensures security even with a terminal with low reliability by using a terminal with high reliability together.

  Patent Document 4 describes a user confirmation method in a transaction using a mobile phone. The user receives the service by accessing the service provider's computer with a mobile phone. At this time, the mobile phone transmits a caller number to the computer, and the computer stores the caller number. The computer transmits a signal for restricting the operation to the transmission source mobile phone, and requests the user to release the restriction and to retransmit the caller ID. The computer compares the caller number retransmitted after deregulation with the caller number stored previously, and if both numbers match, the computer proceeds to a process of providing a service.

  Patent Document 5 describes an authentication processing system capable of specifying a terminal when using a service for a mobile phone from a personal computer terminal. The mobile phone acquires key information for PC registration from the server. The PC uses this key information to access the server. At this time, the PC attaches PC key information for identifying the PC such as a MAC address. The server generates an authentication key including mobile phone identification information and PC key information and transmits it to the PC. When requesting a service, the PC makes a request with the PC key information and the authentication key. The server confirms a match between the PC key information extracted from the authentication key and the received PC key information.

  Patent Document 6 describes a credit settlement completion confirmation system using a mobile phone. According to this system, a user who makes a credit payment using a mobile phone can confirm that the payment has been completed without looking at the display on the mobile phone.

  Patent Document 7 describes an information providing device capable of quickly and reliably notifying contact information to students and guardians through an electronic contact network. The information providing apparatus transmits an input message from a computer to a user's communication terminal via a plurality of communication means via the Internet.

JP-A-8-339407 JP 2001-306806 A JP 2004-213315 A JP-A-2005-110169 JP 2006-18361 A JP 2006-91999 A JP 2006-268672 A

  The objective of this invention is providing the technique which can authenticate a user more reliably, when a service provider provides a service to a user.

  [Means for Solving the Problems] will be described below using the numbers and symbols used in [Best Mode for Carrying Out the Invention]. These numbers and symbols are added in parentheses in order to clarify the correspondence between the description of [Claims] and [Best Mode for Carrying Out the Invention]. However, these numbers and symbols should not be used for the interpretation of the technical scope of the invention described in [Claims].

  According to the present invention, an authentication authorization system is provided. The authentication authorization system includes a service execution apparatus (1) that provides a service and an authentication authorization request apparatus (2) that requests a specified user to confirm the use of the service. When a user requests the service execution apparatus (1) to execute a service, the service execution apparatus (1) transmits an execution permission request for permission to execute the service to the authentication authorization request apparatus (2). The authentication authorization requesting device (2) is designated by selecting at least one communication means designated in advance among a plurality of communication means in response to the execution permission request, and using the selected communication means. An authentication authorization request is sent to the user who confirms the use of the service.

  The plurality of communication means are, for example, portable terminal mail, shot message, telephone (voice), and Internet mail.

  When the use permission of the service is obtained from the designated user, the authentication authorization requesting apparatus transmits approval information permitting the execution of the service to the service execution apparatus. The service execution apparatus provides a service to the certain user in response to the approval information.

  According to the present invention, when a user requests some service, the service provider can confirm the user's intention. In other words, the service provider can confirm with the user whether or not the service can be actually provided. Therefore, unauthorized use unintended by the user can be reliably prevented.

  Further, when asking the user for confirmation, a communication means such as a mobile phone or a PC that is always used by the user is used. Since no special equipment is required, the user can be easily authenticated. Furthermore, according to the present invention, when asking the user for confirmation, a plurality of communication means such as a mobile phone and a PC can be combined and used. In that case, the user's intention can be confirmed more reliably.

  ADVANTAGE OF THE INVENTION According to this invention, when a service provider provides a service to a user, it becomes possible to authenticate a user more reliably.

  With reference to the accompanying drawings, an authentication authorization technique according to an embodiment of the present invention will be described.

1. Configuration FIG. 1 is a block diagram showing an example of the configuration of an authentication authorization system according to an embodiment of the present invention. The authentication authorization system includes a service execution device 1, an authentication authorization request device 2, a storage device 3, an SMS (Short Message Service) gateway device 4, a mail gateway device 5, a Web device 6, a PSTN (Public Switched Telephone Networks) gateway device 7, A voice response device 8, an Internet gateway device 9, an Internet Web device 10, a mobile phone device 11, a voice phone device 12, and a PC device 13 are provided.

  The service execution apparatus 1 is an apparatus for a service provider such as a bank or a securities company to provide a service to a user, and is an apparatus that executes the service. The service execution device 1 is, for example, a bank ATM. A user uses a service with the service execution apparatus 1. The authentication authorization requesting device 2 is provided by a service mediator such as a mobile operator or a fixed operator.

  When the user requests the service execution apparatus 1 to execute the service, the authentication / authorization request apparatus 2 confirms the user's execution intention (authentication / authorization) by using various communication means. The various communication means are mobile terminal mail, short message (SMS), telephone, PC Internet mail, and the like. That is, the authentication / authorization system according to the present embodiment performs identification (authentication / authorization) of a person using a mobile phone, a telephone, a PC, or the like possessed by the user.

  The storage device 3 stores user information DAT related to the user. The user information DAT includes a user name and a password. Further, the user information DAT includes “communication means (transmission policy)” used when the authentication authorization system according to the present embodiment transmits a confirmation request (authentication authorization request) to the user. Further, the user information DAT includes a “destination” of the confirmation request such as a telephone number or an e-mail address.

  The “communication means” and “destination” of the user information DAT are set in advance according to the user's instruction. The user can designate in advance at least one of the various communication means described above. The user may designate two or more communication means (for example, a short message and Internet mail) in advance. When two or more communication means are designated, the priority to be used may be set. The user can also set the communication means and destination to change according to time and day of the week (for example, a company e-mail address during the day and a private e-mail address after the regular time).

  In addition, the “transmission destination” of each of a plurality of users may be included in the user information DAT regarding a single user. For example, the plurality of users includes the person himself / herself and his / her boss. In this case, the confirmation request is transmitted to each of the plurality of users. A plurality of users (transmission destinations) to which the confirmation request is transmitted are also designated in advance by the user.

2. Processing FIGS. 2A to 2F are flowcharts showing the operation of the authentication authorization system according to the present embodiment. The flow shown in FIGS. 2A to 2F is continuous. The confirmation process (authentication authorization process) according to the present embodiment will be described in detail with reference to FIGS. 2A to 2F.

  FIG. 2A shows processing until the user information DAT is read from the storage device 3. First, a certain user requests the service execution apparatus 1 to execute a service. When the service execution request is received from the user, the service execution device 1 transmits a “service execution permission request” for requesting permission to execute the service to the authentication authorization request device 2 (step A1).

  In response to the service execution permission request, the authentication authorization request device 2 transmits a “user information acquisition request” requesting the user information DAT of the user to the storage device 3 (step B1). In response to the user information acquisition request, the storage apparatus 3 returns the user information DAT of the user to the authentication authorization request apparatus 2 (step C1). The above-mentioned “communication means” and “transmission destination” are designated in the user information DAT.

  The authentication authorization requesting device 2 receives the user information DAT and selects at least one “communication means” designated by the user information DAT. When two or more communication means are designated, the authentication authorization requesting apparatus 2 may select these communication means in order. When the priority is set, the authentication authorization requesting apparatus 2 selects the communication means in descending order of the priority. Alternatively, when two or more communication means are specified, the authentication authorization requesting apparatus 2 may select these communication means at the same time.

  As will be described in detail below, the authentication authorization requesting apparatus 2 transmits an “authentication authorization request” to the designated “transmission destination (user)” by using the selected “communication means”. The authentication authorization request is a request for prompting a designated user to confirm (authentication, authorization) of use of the service. When a plurality of communication means are selected at the same time, the authentication authorization requesting apparatus 2 transmits an authentication authorization request using each communication means. When a plurality of transmission destinations (users) are designated, the authentication authorization requesting apparatus 2 transmits an authentication authorization request to each transmission destination.

  FIG. 2B shows processing when the “communication means” is a mobile terminal mail or a short message (SMS). In the case of a short message (step B2; Yes), the authentication authorization requesting device 2 transmits an authentication authorization request to the designated destination mobile phone device 11 as a short message. The SMS gateway device 4 transmits the short message to the mobile phone device 11 (step D1). On the other hand, in the case of mobile terminal mail (step B3; Yes), the authentication authorization requesting apparatus 2 transmits an authentication authorization request to the designated destination mobile phone apparatus 11 by mobile terminal mail. The mail gateway device 5 transmits the mobile terminal mail to the mobile phone device 11 (step E1).

  The mobile phone device 11 receives a short message or a mobile terminal mail. The short message or the portable terminal mail includes the URL of the Web device 6. The mobile phone device 11 accesses the Web device 6 with the URL by the browser function (step K1). The Web device 6 displays an “authentication authorization screen” on the mobile phone device 11 (step F1). FIG. 3 shows an example of the authentication authorization screen. The display of the authentication authorization screen may be automatically executed by the browser function or may be executed when the user reads the short message or the portable terminal mail.

  The user approves or denies execution of the service according to the message on the authentication authorization screen (step K2). The information “approved” or “denied” is sent to the Web apparatus 6. The Web device 6 determines whether or not the execution of the service is approved (step F2). In the case of “approval” (step F2; Yes), the Web apparatus 6 transmits a result of the approval to the authentication approval request apparatus 2 (step F3). On the other hand, when it is not approved (step F2; No), the Web apparatus 6 transmits a rejection result to the authentication approval requesting apparatus 2 (step F4). Subsequent processing will be described later (see X1 and X2).

  FIG. 2C shows processing when the “communication means” is a telephone (voice). In the case of telephone (voice) (step B4; Yes), the authentication authorization request device 2 transmits an authentication authorization request to the designated destination voice telephone device 12 using a call control protocol such as SIP (Session Initiation Protocol). . The PSTN gateway device 7 calls the voice telephone device 12 (step G1). The user learns that there is a call with a telephone ringing tone or the like, and starts a call by an on-hook operation (step L1). When the call starts, the PSTN gateway device 7 performs switching processing and switches processing to the voice response device 8 (step G2).

  The voice response device 8 informs the user of an automatic voice message such as “There was a service execution request. Press 1 to execute the service, press 2 to not execute the service.” In accordance with the automatic voice message, the user approves or denies the execution of the service by DTMF (Dial Tone Multi Frequency) (step L2). The voice response device 8 obtains information of “approval” or “denial” (step H1). In the case of “approval” (step H2; Yes), the voice response device 8 transmits a result of the approval to the authentication approval request device 2 (step H3). On the other hand, when not approved (step H2; No), the voice response device 8 transmits a rejection result to the authentication approval requesting device 2 (step H4). Subsequent processing will be described later (see X1 and X2).

  FIG. 2D shows processing when the “communication means” is Internet mail of a PC. In the case of Internet mail (step B5; Yes), the authentication authorization request device 2 transmits an authentication authorization request to the designated transmission destination PC device 13 by Internet mail. The Internet gateway device 9 transmits the Internet mail to the PC device 13 (step I1).

  The PC device 13 receives Internet mail. The Internet mail includes the URL of the Internet Web apparatus 10. The PC device 13 accesses the Internet Web device 10 of the URL by the browser function (step M1). The Internet Web apparatus 10 displays an “authentication authorization screen” on the PC apparatus 13 (step J1).

  The user sees the displayed authentication authorization screen and approves or denies the execution of the service (step M2). The information “approved” or “denied” is sent to the Internet Web apparatus 10. The Internet Web apparatus 10 determines whether or not the execution of the service is approved (step J2). In the case of “approval” (step J2; Yes), the Internet Web apparatus 10 transmits a result of the approval to the authentication authorization request apparatus 2 (step J3). On the other hand, when it is not approved (step J2; No), the Internet Web apparatus 10 transmits a rejection result to the authentication authorization request apparatus 2 (step J4). Subsequent processing will be described later (see X1 and X2).

  FIG. 2E shows the processing when the authentication / authorization requesting apparatus 2 receives the rejection result (X2). The authentication authorization requesting apparatus 2 determines whether there is any other designated “communication means” (step B6). If another communication means has not been tried (step B6; Yes), the processing returns to “X3” in FIG. 2A. That is, if the service use permission is not obtained from the designated user, the authentication authorization requesting apparatus 2 selects an untrial communication means.

  If there are no uncommitted communication means remaining (step B6; No), the authentication authorization requesting device 2 determines that the authentication authorization request has been finally rejected. Then, the authentication authorization requesting device 2 transmits a rejection notification for refusing execution of the service to the service execution device 1 (step B7). In response to the rejection notification, the service execution device 1 performs a service rejection process (step A2).

  FIG. 2F shows a process when the authentication / authorization requesting apparatus 2 receives the result of the approval (X1). In this case, use permission of the service is obtained from the designated user. Accordingly, the authentication authorization requesting apparatus 2 transmits a notification of approval for permitting execution of the service to the service execution apparatus 1 (step B8). In response to the approval notification, the service execution device 1 performs service approval processing (step A3). That is, the service execution device 1 provides the service to the user who has issued the service execution request.

  When the authentication authorization requesting apparatus 2 selects a plurality of communication means at the same time, a plurality of authentication authorization requests are transmitted by the respective communication means. At this time, if a decision result is obtained in response to at least one authentication authorization request, the authentication authorization requesting apparatus 2 may execute the processing shown in FIG. 2F. Alternatively, only when the approval result is obtained in response to all the authentication authorization requests, the authentication authorization requesting apparatus 2 may execute the process shown in FIG. 2F. In the latter case, authentication authorization processing is more reliable.

  When the “transmission destination” of each of the plurality of users is specified in the user information DAT related to one user, the authentication authorization request is transmitted to each of the specified plurality of users. At this time, if “approval” is obtained from at least one designated user, the authentication authorization requesting apparatus 2 may execute the processing shown in FIG. 2F. Alternatively, only when “approval” is obtained from all designated users, the authentication authorization requesting apparatus 2 may execute the processing shown in FIG. 2F. In the latter case, authentication authorization processing is more reliable.

3. Setting of User Information FIG. 4 is a block diagram showing a configuration for setting the above-described user information DAT. The storage device 3 in which the user information DAT is stored is connected to the customer control device 15. The customer control device 15 is connected to the user PC device 14. These user PC device 14 and customer control device 15 are also part of the authentication authorization system according to the present embodiment. The user uses the user PC device 14 to instruct the user information DAT to be set or changed. The customer control device 15 sets or changes the user information DAT in accordance with the user instruction.

  FIG. 5 is a flowchart showing the setting process of the user information DAT. The user accesses the customer control device 15 using a Web browser of the user PC device 14 or the like. Then, the user inputs a user name and a password (Step N1). The customer control device 15 requests the storage device 3 for the password of the accessing user (step O1). The storage device 3 acquires the password of the user from the user information DAT, and transmits the password to the customer control device 15 (step C2).

  The customer control device 15 compares the password entered by the user with the password registered in the user information DAT, and authenticates the user (step O2). When the authentication fails (Step O3; No), the customer control device 15 displays an authentication failure screen on the user PC device 14 (Step O7). On the other hand, when the authentication is successful (step O3; Yes), the customer control device 15 displays a successful authentication screen on the user PC device 14 (step O4).

  Next, the user inputs information to be registered or changed using the user PC device 14 (step N2). The customer control device 15 transmits the information received from the user PC device 14 to the storage device 3 (step O5). The storage device 3 writes the received information in the user information DAT (step C3). As a result, the user information DAT is set or changed. Thereafter, the storage device 3 notifies the customer control device 15 of the result (step C4). The customer control device 15 displays a user information change screen indicating the result on the user PC device 14 (step O6).

4). Effect According to the authentication authorization system according to the present embodiment, when a user requests some service, the service provider can confirm the user's intention. In other words, the service provider can confirm with the user whether or not the service can be actually provided. Therefore, unauthorized use unintended by the user can be reliably prevented. For example, when a bank performs a withdrawal service using a deposit card at an ATM, it is possible to confirm with the user whether or not the processing is really possible. As a result, the deposit card or credit card is stolen and prevented from being illegally used by a third party.

  Further, when asking the user for confirmation, a communication means such as a mobile phone or a PC that is always used by the user is used. Since no special equipment is required, the user can be easily authenticated.

  Furthermore, according to the present embodiment, a plurality of communication means such as a mobile phone and a PC can be combined and used when asking the user for confirmation. In that case, the user's intention can be confirmed more reliably. For example, if there is no response after sending Internet mail to the user's PC, it is possible to request confirmation by sending a short message to the user's mobile phone. Alternatively, the service may be executed only when confirmation is simultaneously obtained by a plurality of communication means and confirmation is obtained by all of the communication means. Thus, it becomes possible to authenticate a user more reliably by using a combination of a plurality of communication means. As the plurality of communication means, it is preferable to use at least two of the above-described portable terminal mail, short message, telephone, and Internet mail. The communication means to be used can be designated by the user through his / her own operation.

  Furthermore, according to the present embodiment, a confirmation request can be sent to a plurality of designated users in order to confirm a service execution intention of a certain user. That is, a service execution permission can be requested from a plurality of people. In that case, the service may be executed only when permission is obtained from a predetermined number of users. As a result, it becomes possible to confirm the user's intention more reliably. This can be expected to have the same effect as an act of obtaining approval from a superior using, for example, a request for approval.

  The application range of the authentication and authorization system according to the present invention using a mobile phone or PC owned by the user is wide. The present invention is applicable to various services such as authentication and authorization when using a card, stock transaction execution confirmation, ticketing execution confirmation, and voting.

FIG. 1 is a block diagram showing an example of the configuration of an authentication authorization system according to an embodiment of the present invention. FIG. 2A is a flowchart showing an authentication authorization process according to the embodiment of the present invention. FIG. 2B is a flowchart showing authentication authorization processing according to the embodiment of the present invention. FIG. 2C is a flowchart showing authentication authorization processing according to the embodiment of the present invention. FIG. 2D is a flowchart showing authentication authorization processing according to the embodiment of the present invention. FIG. 2E is a flowchart showing authentication authorization processing according to the embodiment of the present invention. FIG. 2F is a flowchart showing authentication authorization processing according to the embodiment of the present invention. FIG. 3 is a conceptual diagram illustrating an example of an authentication authorization screen. FIG. 4 is a block diagram showing a configuration for setting user information. FIG. 5 is a flowchart showing user information setting processing.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Service execution apparatus 2 Authentication authorization request apparatus 3 Storage apparatus 4 SMS gateway apparatus 5 Mail gateway apparatus 6 Web apparatus 7 PSTN gateway apparatus 8 Voice response apparatus 9 Internet gateway apparatus 10 InternetWeb apparatus 11 Mobile phone apparatus 12 Voice telephone apparatus 13 PC apparatus 14 User PC device 15 Customer control device DAT User information

Claims (10)

A service execution device for providing a service;
An authentication authorization requesting device that requests the specified user to confirm the use of the service, and
When a user requests the service execution device to execute the service,
The service execution device transmits an execution permission request for permission to execute the service to the authentication authorization request device;
The authentication authorization requesting apparatus selects at least one communication means designated in advance among a plurality of communication means in response to the execution permission request, and uses the selected communication means to specify the designation. An authentication authorization system that transmits an authentication authorization request for requesting confirmation of the use of the service to a registered user. The authentication authorization system according to claim 1,
When permission to use the service is obtained from the designated user,
The authentication authorization requesting device sends a notification of approval permitting execution of the service to the service executing device,
The service execution apparatus provides an authentication and authorization system for providing the service to the certain user in response to the approval notification. The authentication authorization system according to claim 1 or 2,
An authentication authorization system in which two or more communication means are designated in advance among the plurality of communication means. An authentication authorization system according to claim 3,
The authentication authorization requesting device selects the two or more communication means in order,
The authentication authorization system in which the authentication authorization requesting apparatus selects an untried communication means from among the two or more communication means when permission to use the service is not obtained from the designated user. An authentication authorization system according to claim 3,
The authentication authorization requesting apparatus, wherein the authentication authorization requesting device simultaneously selects the two or more communication means and transmits the authentication authorization request using each of the two or more communication means. The authentication authorization system according to claim 5,
When permission for use of the service is obtained from the designated user for all of the authentication permission requests transmitted by the respective communication means,
The authentication authorization requesting device sends a notification of approval permitting execution of the service to the service executing device,
The service execution apparatus provides an authentication and authorization system for providing the service to the certain user in response to the approval notification. The authentication authorization system according to any one of claims 1 to 6,
The number of the specified users is 2 or more. The authentication authorization system according to claim 7,
When permission to use the service is obtained from all of the two or more designated users,
The authentication authorization requesting device sends a notification of approval permitting execution of the service to the service executing device,
The service execution apparatus provides an authentication and authorization system for providing the service to the certain user in response to the approval notification. The authentication authorization system according to any one of claims 1 to 8,
The plurality of communication means is an authentication / authorization system including at least two of mobile terminal mail, short message, telephone, and Internet mail. An authentication authorization system according to any one of claims 1 to 9,
Furthermore,
A storage device for storing user information about the user;
A control device that sets the user information in response to an instruction from the user,
In the user information, a communication means used by the authentication authorization requesting device among the plurality of communication means is designated,
The authentication authorization requesting apparatus, wherein the authentication authorization requesting apparatus selects the at least one communication means with reference to the user information.

Images