JP2013206292A - Customer terminal for performing authentication processing, authentication method and program for authentication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a customer terminal, an authentication method and a program for authentication for improving authentication security by considering the living time zone of a user who uses the Internet banking.SOLUTION: In accordance with an input to a customer terminal 10 and the detection of a user who uses the customer terminal, the living time zone of an individual who uses the customer terminal 10 is estimated, and first authentication from the individual is accepted in order to execute the predetermined processing of the Internet banking, and whether or not the authenticated time zone is the estimated living time zone of the individual is determined, and when it is determined that the authenticated time zone is not the living time zone, additional authentication processing is performed to the authentication processing for specifying the individual who executes the processing.

Description

  The present invention relates to a customer terminal that performs authentication processing, an authentication method, and an authentication program, and more particularly, to a customer terminal that performs authentication processing via an electric communication line, an authentication method, and an authentication program.

  Today, financial institutions such as banks provide Internet banking services that allow users to view their account balances via the Internet and transfer funds to other people's accounts.

  In general, in internet banking, security is secured by a user ID and a password set for each user. In addition to this, in order to further ensure security, a method for improving security by making it possible to execute predetermined processing of a computer used in a bank only in a predetermined time zone is known (for example, Patent Document 1 and Patent Document 2).

JP 2006-119798 A Japanese Patent Laid-Open No. 355088

  However, in the above-mentioned patent document, if another person who knows the user ID and password performs a predetermined process such as Internet banking at a predetermined time, authentication can be performed without any problem, and theft may occur.

  Therefore, the present inventor pays attention to the fact that it may be determined based on the normal life time of the user in order to determine whether or not the access is by a user who uses Internet banking. did.

  An object of the present invention is to provide a customer terminal, an authentication method, and an authentication program that improve authentication security by considering the life time zone of a user who uses Internet banking.

  In order to solve the above-described problems, the present invention includes the following solution means.

(1) Before executing a predetermined process, a customer terminal that executes an authentication process for identifying an individual who executes the process,
A life time zone estimation module for estimating a life time zone of an individual using the customer terminal in response to an input to the customer terminal and detection of a user using the customer terminal;
An authentication acceptance module for accepting authentication from the individual in order to execute the predetermined processing;
A time zone determination module that determines whether or not a time zone in which the authentication acceptance module has received authentication is a life time zone estimated by the life time zone estimation module;
If it is determined that the time zone in which the authentication acceptance module is received is not the life time zone estimated by the life time zone estimation module, an additional process is added to the authentication process for identifying an individual who performs the process. An additional authentication module that performs secure authentication processing,
With customer terminal.

  According to the invention of (1), the customer terminal estimates the life time zone of the individual who uses the customer terminal in response to the input to the customer terminal and the detection of the user who uses the customer terminal, and the predetermined In order to execute the process, the authentication from the individual is accepted, and it is determined whether the time zone in which the authentication is accepted is the estimated life time zone, and is not the estimated life time zone. In this case, an additional authentication process is performed with respect to the authentication process for specifying the individual who executes the process.

  Therefore, it is possible to improve authentication security as a result by making a determination based on the normal life time of the user in order to determine whether the access is made by a user who uses Internet banking. It becomes.

  (2) The life time zone estimation module is based on either the operation time for the customer terminal, the detection time of a sensor included in the customer terminal, or the detection data received by the customer terminal. The customer terminal according to (1), which estimates a time zone.

  According to the invention of (2), the estimation of the life time zone in the invention of (1), specifically, the operation time for the customer terminal, the detection time of the sensor provided in the customer terminal, the detection received by the customer terminal It can be done based on any of the data.

  (3) The additional authentication executed by the additional authentication module is not performed by cooperation with a communicable server, but is processed in the customer terminal. (1) or (2) .

  According to the invention of (3), since the additional authentication processing is not performed in cooperation with a server capable of communication, but only in the customer terminal, it is possible to avoid leakage of personal information such as a life time zone. Is possible.

(4) Before executing a predetermined process, a method executed by a customer terminal that executes an authentication process for identifying an individual who executes the process,
Estimating a life time zone of an individual using the customer terminal in response to an input to the customer terminal and detection of a user using the customer terminal;
Accepting authentication from the individual to perform the predetermined process;
Determining whether the time zone accepted in the step of accepting the authentication is the life time zone estimated in the step of estimating the life time zone;
If it is determined that the time zone accepted in the step of accepting the authentication is not the life time zone estimated in the step of estimating the life time zone, the authentication process for identifying the individual who performs the process And performing an additional authentication process.

(5) Before executing a predetermined process, a customer terminal that executes an authentication process for identifying an individual who executes the process,
Estimating a life time zone of an individual using the customer terminal in response to an input to the customer terminal and detection of a user using the customer terminal;
Accepting authentication from the individual to perform the predetermined process;
Determining whether the time zone accepted in the step of accepting the authentication is the life time zone estimated in the step of estimating the life time zone;
If it is determined that the time zone accepted in the step of accepting the authentication is not the life time zone estimated in the step of estimating the life time zone, the authentication process for identifying the individual who performs the process An authentication program for executing the step of performing additional authentication processing.

  ADVANTAGE OF THE INVENTION According to this invention, the customer terminal which improves authentication security, the authentication method, and the program for authentication can be provided by considering the lifetime of the user who uses Internet banking.

It is a figure showing the whole authentication system 1 composition which is a suitable embodiment of the present invention. It is a functional block diagram of customer terminal 10 and banking server 100 which are preferred embodiments of the present invention. It is a flowchart of the additional authentication process which is a preferred embodiment of the present invention. It is a flowchart of the life time zone estimation process which is a preferred embodiment of the present invention. It is a conceptual diagram which shows the logic 1 which estimates the life time zone which is suitable embodiment of this invention. It is a conceptual diagram which shows the logic 2 which estimates the life time zone which is suitable embodiment of this invention. It is an output image figure of alert data which is a suitable embodiment of the present invention. It is an output image figure of setting operation of the life time zone which is a suitable embodiment of the present invention.

  DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments for carrying out the present invention (hereinafter referred to as embodiments) will be described in detail with reference to the accompanying drawings.

[Configuration of authentication system]
FIG. 1 is an overall configuration diagram of the authentication system 1. The authentication system 1 includes a banking server 100, customer terminals 10 a, b, and c (hereinafter referred to as “customer terminal 10”) and a public line network 3. The customer terminal 10 and the banking server 100 may be communicably connected via a public line network 3 such as the Internet, or may be communicably connected via a dedicated line.

  The banking server 100 is accessed from the customer terminal 10 to provide the Internet banking service. The banking server 100 performs only the authentication processing according to the present embodiment described below, and is a server 150 different from the banking server 100. However, Internet banking services may be implemented. In this case, the service providing module 210 described below is realized by the server 150.

  Next, the configuration of the banking server 100 and the customer terminal 10 will be described with reference to FIG.

  The customer terminal 10 is a terminal that is accessed for internet banking, and as shown in FIG. Good. The customer terminal 10 includes a control unit 11, a data storage unit 12, a data communication unit 13, an input / output unit 14, and a detection sensor unit 15.

  The customer terminal 10 is assumed to be used by only one user. That is, in order to estimate the life time zone of the user who uses the customer terminal 10 by the life time zone estimation process described later, the customer terminal 10 is assumed to be used by a plurality of users having different life time. Absent.

  The control unit 11 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), and the like, and the data communication unit 13 includes a wired or wireless compatible communication device. The data storage unit 12 includes one or both of an HDD (Hard Disk Drive) and an SSD (Solid State Drive). Furthermore, the input / output unit 14 includes a display unit such as a liquid crystal monitor that displays an image, and includes a touch panel that accepts input from the user and an input unit such as voice input.

  The detection sensor unit 15 is a detection sensor for determining whether or not the user is currently living by operating or using the customer terminal 10 by the user operating the customer terminal 10. is there. The detection sensor unit 15 may be, for example, an acceleration sensor, an infrared sensor, or a contact sensor.

  The data storage unit 12 includes an operation / use history database 31 for operating the customer terminal 10 and storing a used history. As will be described later, the operation / use history database 31 stores an operation history for the customer terminal 10 and a history indicating the usage status of the customer terminal 10 determined by detection by the detection sensor unit 15.

  The customer terminal 10 realizes the authentication receiving module 20 and the additional authentication module 23 by at least the cooperation of the control unit 11 and the input / output unit 14. Further, the customer terminal 10 realizes a life time zone estimation module 21 by at least the cooperation of the control unit 11 and the data storage unit 12. In addition, the customer terminal 10 realizes the time zone determination module 22 by at least the control unit 11.

  The banking server 100 is a server or computer that can communicate with the customer terminal 10, and includes a control unit 101, a data storage unit 102, and a data communication unit 103. As described above, the banking server 100 may have a function of providing an Internet banking service. The function of the Internet banking service is executed by another server 150, and the customer terminal 10 is configured as described below. You may provide only the authentication function of the user who operates.

  The banking server 100 is generally operated by a bank that implements an internet banking service or a business that provides a system of this bank.

  The control unit 101 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), and the like. The data communication unit 103 includes a wired or wireless communication device, and the data storage unit 102 includes: One or both of HDD (Hard Disk Drive), SSD (Solid State Drive), etc. are provided.

  The banking server 100 implements the authentication module 200 in cooperation with at least the control unit 101 and the data communication unit 103. Furthermore, the banking server 100 implements a service providing module 210 in cooperation with the control unit 101, the data communication unit 103, and the data storage unit 102.

[Additional authentication processing]
Next, with reference to FIG. 3, the additional authentication process which is a preferred embodiment of the present invention will be described. This process is a process in which an additional authentication process is performed when it is determined that the access made to the banking server 100 from the customer terminal 10 is not in the user's life time zone.

  First, the customer terminal 10 determines whether or not there is an access request for Internet banking from a user (step S01). If there is an access request (step S01: “YES”), the process proceeds to step S02. Until there is an access request (step S01: “NO”), the processing is awaited.

  This access request may be made by the user inputting a URL (Uniform Resource Locator) into the Web browser, or may be made by starting a predetermined application.

  Next, the customer terminal 10 accesses the banking server 100 in response to the access request (step S02). And the authentication reception module 20 of the customer terminal 10 receives the input of the contractor ID and password of the user to be used as the first authentication (step S03). This process is an authentication process for specifying an individual who makes an access request this time. For example, the process is performed by accepting an input of an ID and a password in a predetermined window in the Web browser. The customer terminal 10 transmits the input contractor ID to the banking server 100 to make an authentication request.

  The authentication module 200 of the banking server 100 receives the contractor ID and password and executes authentication processing (step S04). The authentication process here is a process of referring to the contractor ID database stored in the data storage unit 102 of the banking server 100 to confirm the contractor ID and password.

  Then, when the authentication module 200 of the banking server 100 authenticates without any problem in the first authentication (step S05: “YES”), the customer terminal 10 notifies the customer terminal 10 that the first authentication is completed. The process moves to step S06. On the other hand, when it is not authenticated by the first authentication (step S05: “YES”), the process returns to step S04 and re-authentication is performed.

  Upon receiving the notification of completion of the first authentication, the authentication reception module 20 of the customer terminal 10 completes the login (Step S06). In response, the banking server 100 outputs to the customer terminal 10 a web page that accepts operations such as a transfer process, balance inquiry, and account inquiry, which are predetermined processes for Internet banking, from the user.

  Then, the customer terminal 10 determines whether or not an instruction for a transfer process, which is a predetermined process, has been received from the user (step S07). If an instruction for the transfer process is accepted (step S07: “YES”), the process proceeds to step S08. Until an instruction for the transfer process is received (step S07: “NO”), the process waits.

  Next, the time zone determination module 22 of the customer terminal 10 determines whether or not the time when the instruction for the transfer process is in the user's life time zone (step S08). The user's life time zone is estimated by the life time zone estimation process of FIG. 4 described later. If the time zone determination module 22 determines that the time at which the transfer processing instruction is given is the user's life time zone (step S08: “YES”), the processing moves to step S11. When the time zone determination module 22 determines that the time at which the transfer processing instruction is issued is not the user's life time zone (step S08: “NO”), the process proceeds to step S09.

  When the time zone determination module 22 of the customer terminal 10 determines that it is not the life time zone estimated by the life time zone estimation module 21 described later, the additional authentication module 23 performs authentication for specifying the user who executes the transfer process An additional authentication process is performed on the process. Therefore, the authentication reception module 20 outputs alert data 91 as shown in FIG. 7 and performs authentication processing (step S09).

  The alert data is composed of message data explaining that additional authentication is performed to the user and an interface that prompts the user to input an authentication password. In the example of FIG. 7, in the alert data 91, “The first authentication has been authenticated, but the second authentication is performed again to confirm that the customer is the user. Please enter "message data is output.

  Next, the additional authentication module 23 determines whether there is no problem with the authentication of the second authentication. If it is determined that there is no problem with the authentication (step S10: “YES”), the process proceeds to step S11, where the authentication is a problem If it is determined that there is (step S10: "NO"), the process returns to step S09 to prompt the user to authenticate again.

  Then, the customer terminal 10 executes the transfer process based on the determination that the second authentication has no problem (step S11). The banking server 100 accepts the transfer process from the customer terminal 10 (step S12) and executes the transfer process (step S12).

  In the above description, the second authentication performed by the additional authentication module 23 is not performed through communication linked to the banking server 100 but is performed only within the customer terminal 10, so that the personal information It is possible to avoid spills.

  In the above description, an example in which additional authentication processing is performed in response to a transfer processing instruction has been described. However, predetermined processing that triggers additional authentication processing is limited to the transfer processing. Rather, it may be a predetermined process executed by Internet banking, such as balance inquiry, account inquiry, and transfer process.

  In addition, although the above-mentioned 1st authentication and 2nd authentication are demonstrated by authenticating by collating contractor ID and a password, other authentication methods, for example, fingerprint authentication, one time password, etc. You may carry out by a well-known method.

[Lifetime estimation processing]
Next, a life time zone estimation process for the customer terminal 10 to estimate a user's life time zone will be described. The life time zone estimation process is performed once a day on the customer terminal 10, and based on the operation time of the user terminal 10 of the user, the detection time of the sensor, and detection data of other devices described later, the life of the user This is a process for estimating the time zone.

  First, the life time zone estimation module 21 of the customer terminal 10 acquires data related to the operation history of the application installed in the customer terminal 10. This application may be a mailer, an application related to a social network service, a voice call application, a game, or the like. These operation histories are acquired, and the life time zone based on the operation history of the application is estimated (step S20).

  For example, it is assumed that the applications A, B, and C are not operated in a band-like time zone as shown in FIG. 5 (non-lifetime zone). In this example, the application A is not operated from 23:40 to 9:40. In the application B, the operation from 23:20 to 9:20 is not performed. In the application C, no operation is performed from 22:00 to 10:00.

  Accordingly, since all applications are not operated from 23:40 to 9:20, this time zone is estimated as a non-lifetime zone (ST1). The life time zone is a life time zone (from 9:20 to 23:40), which is the time zone excluding this ST1 out of 24 hours.

  Next, the life time zone estimation module 21 estimates a life time zone based on the detection time of the detection sensor unit 15 (step S21). The detection sensor unit 15 may be a plurality of sensors such as an acceleration sensor, an infrared sensor, and a contact sensor, and estimates a life time zone with the same logic as the above-described plurality of applications based on the time zone detected by each sensor. . That is, the life time zone is estimated by calculating backwards by setting the time zone during which no numerical value is detected as a non-life time zone for all the sensors of the plurality of sensors.

  Next, the life time zone estimation module 21 estimates a life time zone from another device (step S22). Here, the other device is not a sensor provided in the customer terminal 10 like the detection sensor unit 15 of the customer terminal 10, but a sensor embedded in the user's clothing or provided in the vicinity of the user's bed. It is a sensor that detects the brightness of an electric light. The other device transmits the detection data detected by the sensor to a big data server 130 (not shown) connected to be communicable.

  The life time zone estimation module 21 of the customer terminal 10 accesses the big data server 130, acquires the detection data, and sets the time zone where the user is not detected in all other devices as the non-life time zone, Similar to the estimation in the above application, the life time zone is calculated backward.

  The life time zone estimation module 21 estimates a final life time zone from the three life time zones estimated by the above-described method (step S23). The estimation of the final life time zone is performed by estimating the time zone that is the non-life time zone as the final non-life time zone in all the life time zones estimated in step S20 to step S23. The life time zone is estimated by calculating backwards.

  For example, the non-life time zone estimated in step S20 was estimated at 23:40 to 9:40, and the non-life time zone estimated at step S21 was estimated at 23:20 to 9:20 in step S22. The non-life time zone is assumed to be 22:00 to 10:00. In this case, since the time zone that is the non-life time zone in all the life time zones is from 23:40 to 9:20, this time zone is estimated as the final non-life time zone. The final life time zone is a time (9:20 to 23:40) excluding this final non-life time in 24 hours.

  In addition, a life time zone usually performs the life time zone estimation process every day, so that the estimated life time zone usually varies from day to day. For example, as shown in FIG. 6, when the non-life time zone is different from 1 to 3 days, only the time zone corresponding to the non-life time zone may be set as the non-life time zone (ST2) for all three days. The non-lifetime zone may be estimated by taking an average of three days. In addition, when a time zone that is significantly different from the average is estimated as the living time zone of the day, the living time zone of the next day may be calculated except for that day.

  In addition, as shown in FIG. 8, the user himself / herself can browse the life time zone, and may provide an interface that can be set.

  The means, functions, and modules described above are realized by a computer (including a CPU, a server, a device, and various terminals) reading and executing a predetermined program. The program is provided in a form recorded on a computer-readable recording medium such as a flexible disk, CD (CD-ROM, etc.), DVD (DVD-ROM, DVD-RAM, etc.), for example. In this case, the computer reads the program from the recording medium, transfers it to the internal storage device or the external storage device, stores it, and executes it. The program may be recorded in advance in a storage device (recording medium) such as a magnetic disk, an optical disk, or a magneto-optical disk, and provided from the storage device to a computer via a communication line.

  As mentioned above, although this invention was demonstrated using embodiment, it cannot be overemphasized that the technical scope of this invention is not limited to the range as described in the said embodiment. It will be apparent to those skilled in the art that various modifications or improvements can be added to the above-described embodiments. Further, it is apparent from the scope of the claims that the embodiments added with such changes or improvements can be included in the technical scope of the present invention.

1 Authentication System 10 Customer Terminal 100 Banking Server

Claims (5)

Before executing a predetermined process, a customer terminal that executes an authentication process for identifying an individual who executes the process,
A life time zone estimation module for estimating a life time zone of an individual using the customer terminal in response to an input to the customer terminal and detection of a user using the customer terminal;
An authentication acceptance module for accepting authentication from the individual in order to execute the predetermined processing;
A time zone determination module that determines whether or not a time zone in which the authentication acceptance module has received authentication is a life time zone estimated by the life time zone estimation module;
If it is determined that the time zone in which the authentication acceptance module is received is not the life time zone estimated by the life time zone estimation module, an additional process is added to the authentication process for identifying an individual who performs the process. An additional authentication module that performs secure authentication processing,
With customer terminal.   The life time zone estimation module calculates the life time zone of the individual based on either the operation time for the customer terminal, the detection time of a sensor provided in the customer terminal, or the detection data received by the customer terminal. The customer terminal according to claim 1 to be estimated.   The customer terminal according to claim 1 or 2, wherein the additional authentication executed by the additional authentication module is processed in the customer terminal, not in an authentication process in cooperation with a communicable server. Before executing a predetermined process, a method executed by a customer terminal that executes an authentication process for identifying an individual who executes the process,
Estimating a life time zone of an individual using the customer terminal in response to an input to the customer terminal and detection of a user using the customer terminal;
Accepting authentication from the individual to perform the predetermined process;
Determining whether the time zone accepted in the step of accepting the authentication is the life time zone estimated in the step of estimating the life time zone;
If it is determined that the time zone accepted in the step of accepting the authentication is not the life time zone estimated in the step of estimating the life time zone, the authentication process for identifying the individual who performs the process And performing an additional authentication process. Before executing a predetermined process, a customer terminal that executes an authentication process for identifying an individual who executes the process,
Estimating a life time zone of an individual using the customer terminal in response to an input to the customer terminal and detection of a user using the customer terminal;
Accepting authentication from the individual to perform the predetermined process;
Determining whether the time zone accepted in the step of accepting the authentication is the life time zone estimated in the step of estimating the life time zone;
If it is determined that the time zone accepted in the step of accepting the authentication is not the life time zone estimated in the step of estimating the life time zone, the authentication process for identifying the individual who performs the process An authentication program for executing the step of performing additional authentication processing.

Images