JP2016024529A - Authentication apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication apparatus configured to present a cue for reminding a user of a password registered in advance, to the user, while preventing the password from being guessed by others.SOLUTION: An authentication server 12 includes: a password storage section 122 for storing a character string as a registered password; a user authentication section 125 for collating an input password with the registered password for authentication; a hint character generation section 126 for generating a hint character, on the basis of a character in a hint start position in the input password; and a hint character display section 129 for displaying the hint character, as a character in a hint output position of the registered password. When the character in the hint start position in the input password coincides with the character in a corresponding position of the registered password, the character in the hint output position in the registered password is displayed as a hint character.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an authentication apparatus, and more particularly to an improvement of an authentication apparatus that performs user authentication by allowing a person to be authenticated to input a password.

  In order to identify whether or not the person to be authenticated is a legitimate user, user authentication for allowing the person to be authenticated to input a character string registered in advance as a password is widely performed. There is also known a technique for displaying a hint for remembering a password when the person to be authenticated forgets the password. For example, Patent Document 1 describes that a hint character string for remembering a password is registered at the time of password registration, and the hint character string is displayed according to a user display command.

  Further, Patent Document 2 describes an information processing apparatus that generates a hint character string by replacing characters other than the first and last characters among characters constituting a password with random characters. In the information processing apparatus described in Patent Document 2, by displaying the hint character string, it is possible to know a part of the password by the non-replacement characters at the beginning and the end, so that the user who forgot the password is reminded of the password Can do. On the other hand, since characters other than the first and last non-replacement characters are converted to random characters, it is difficult for others to guess the password.

JP-A-6-243099 JP 2013-161150 A

  However, the method described in Patent Document 1 does not display the characters that make up the password, so if you cannot understand the correspondence between the password and the hint character string, you can remember the password. There was a problem of not being a clue. In addition, depending on the hint character string, there is a problem that the password can be easily inferred. In the method described in Patent Document 2, the character string constituting the password is always included in the hint character string displayed when authentication fails, so that the vulnerability increases by the number of non-replacement characters. was there. For example, by inputting different passwords and repeatedly displaying the hint character string, a part of the password can be identified by the presence of non-replacement characters.

  The present invention has been made in view of the above circumstances, and provides an authentication apparatus capable of suppressing the analogy of a password by another person while presenting a user with a clue to remember a previously registered password. The purpose is to provide.

  An authentication apparatus according to the present invention includes a password storage means for storing a character string as a registration password, a character string input means for the person to be authenticated to input a character string as an input password, and the input password is checked against the registration password. User authentication means for performing authentication, hint character generation means for generating a hint character based on the character at the hint activation position in the input password, and the hint character as the hint output position character of the registered password If the character at the hint activation position in the input password matches the character at the corresponding position in the registration password, the character at the hint output position in the registration password is the hint. Configured to be displayed as text.

  In this authentication device, the hint character is generated based on the character at the hint activation position in the input password, so depending on whether the character at the hint activation position matches the character at the corresponding position in the registered password. A part of the registered password can be displayed as a hint character. That is, if the character at the hint activation position input by the person to be authenticated is not correct, the characters constituting the registered password are not displayed in many cases. For this reason, it is difficult for an authenticated person who is not a legitimate user to detect a part of the registered password from the hint character, and it is possible to suppress an increase in vulnerability of user authentication by the registered password.

  If the character at the hint activation position in the input password matches the character at the corresponding position in the registration password, the character at the hint output position in the registration password is displayed as the hint character. For this reason, the person to be authenticated can recognize the remaining part of the registered password by inputting the correct character as the character at the hint activation position.

  According to the present invention, there is provided an authentication device that suppresses an analogy of a registered password from a hint character by another person while presenting a clue for remembering a previously registered password by displaying the hint character. Can be provided.

It is the system figure which showed one structural example of the authentication apparatus 1 by embodiment of this invention. It is the block diagram which showed the structural example of the authentication server 12 of FIG. FIG. 2 is a diagram illustrating an example of an operation at the time of user authentication in the authentication device 1 in FIG. 1 and shows a login screen 4 displayed on the client terminal 11. FIG. 7 is a diagram illustrating an example of an operation at the time of password registration in the authentication device 1 in FIG. 1, and shows a password registration screen 5 displayed on the client terminal 11. 3 is a flowchart showing an example of registration processing of the authentication server 12 in FIG. 2. FIG. 3 is a diagram illustrating an example of an operation at the time of password registration of the authentication server 12 of FIG. 3 is a flowchart showing an example of generation processing of a hint table 3 in the authentication server 12 of FIG. It is the figure which showed an example of the operation | movement at the time of user authentication in the authentication apparatus 1 of FIG. 1, and the hint character 44a displayed with the input of an input password is shown. 3 is a flowchart illustrating an example of authentication processing in the authentication server 12 of FIG. 2. It is the figure which showed another example of the operation | movement at the time of password registration in the authentication apparatus 1 of FIG. 1, and the password registration screen 5 provided with the three menu items 55 is shown. It is the figure which showed another example of the operation | movement at the time of password registration in the authentication apparatus 1 of FIG. 1, and the password registration screen 5 provided with the input fields 57 and 59 is shown.

<Authentication device 1>
FIG. 1 is a system diagram showing a configuration example of an authentication apparatus 1 according to an embodiment of the present invention. In the figure, an authentication apparatus 1 including a client terminal 11 and an authentication server 12 connected to each other via a communication network 2 such as the Internet, a mobile communication network, and a LAN (local area network) is shown. The authentication device 1 includes a client terminal 11 and an authentication server 12, and password registration processing and authentication processing are performed in the authentication server 12 based on a request from the client terminal 11.

  The client terminal 11 is a terminal device that accepts an operation input by a person to be authenticated and displays a screen based on the operation input, and includes an operation input unit 11a, a display output unit 11b, and a communication unit 11c. For example, the client terminal 11 is a mobile phone that has a call function and includes a touch panel that detects a touch operation on the display screen.

  The operation input unit 11a is a character string input unit for the person to be authenticated to input a character string as an input password. The communication unit 11c communicates with the authentication server 12 based on the operation input. The display output unit 11b is a screen display unit that displays a screen based on an operation input, obtains display data from the authentication server 12, and displays a login screen for user authentication, a registration screen for registering a password, and the like. indicate.

  The authentication server 12 performs an authentication process for identifying whether or not the person to be authenticated is a legitimate user, and a registration process for storing a character string designated by the legitimate user as a registration password. The authentication process is performed by checking the input password against the registered password. The registration process is performed on the basis of input data by the administrator who is a user who has passed the user authentication.

<Authentication server 12>
FIG. 2 is a block diagram showing a configuration example of the authentication server 12 of FIG. The authentication server 12 includes a password specification unit 121, a password storage unit 122, a hint table generation unit 123, a hint table storage unit 124, a user authentication unit 125, a hint character generation unit 126, a position specification unit 127, a position information storage unit 128, and The hint character display unit 129 is configured.

  The password storage unit 122 stores a predetermined character string composed of two or more characters as a registered password. The registered password consists of character information including a character code of each character constituting the character string and character order information indicating the input order of each character.

  The user authentication unit 125 acquires a character string input as an input password by the person to be authenticated from the client terminal 11, authenticates the character string against the registered password as the input password, and outputs a verification result. This authentication process is performed by reading the registration password corresponding to the user ID designated by the person to be authenticated from the password storage unit 122. If the input password matches the registration password, it is determined that the user authentication is successful. . For example, if user authentication is successful, login is permitted. On the other hand, if the input password does not match the registered password, it is determined that user authentication has failed.

  The verification of the password is performed by directly comparing the character string constituting the input password and the character string constituting the registered password. In addition, from the viewpoint of improving confidentiality, instead of holding the registered password itself specified by the administrator, the character string constituting the registered password is converted using a function such as a hash function, and the converted information May be stored as a registered password. The collation process in this case is performed by converting the input password using the same function as that used for converting the registered password, and comparing the converted character string information with the registered password. That is, the password verification referred to in the present invention includes both a configuration for directly comparing an input password and a registered password and a configuration for comparing both passwords based on information after conversion.

  The hint character generation unit 126 generates a hint character based on the character at the hint activation position in the input password. The hint character is character information for presenting a part of the registration password to the person to be authenticated to remind the person to be authenticated of the registration password. For example, the hint characters are generated based on the hint table 3 in which hint characters are assigned to all characters that can be used for the registered password. The hint activation position is a character position that defines the timing for displaying the hint character. One or more character positions can be designated as the hint activation position.

  If a correct character is input as a character at the hint activation position, a character at a position designated in advance as a hint output position in the registered password is generated as a hint character. On the other hand, when a character different from the correct character is input as the character at the hint activation position, a predetermined arbitrary character is generated as the hint character.

  The hint character display unit 129 generates display data for displaying the hint character as the character at the hint output position of the registered password, and outputs the display data to the client terminal 11. The hint character is displayed in association with the hint output position of the input password. That is, a part of the registered password is displayed as a hint character depending on whether or not the character at the hint activation position matches the character at the corresponding position of the registered password. For this reason, if the character at the hint activation position input by the person to be authenticated is not correct, the characters constituting the registered password are not displayed in many cases. It is difficult to detect a part of the registered password from the hint character.

  On the other hand, if the character at the hint activation position in the input password matches the character at the corresponding position in the registration password, the character at the hint output position in the registration password is displayed as the hint character. For this reason, the person to be authenticated can easily know the remaining part of the registered password by inputting a correct character as the character at the hint activation position.

  The password specifying unit 121 sets the user who has passed the user authentication as an administrator, acquires a character string input as a registration password by the administrator from the client terminal 11, and stores the character string in the password storage unit 122 as the registered password. Store.

  The position designation unit 127 acquires input data from the client terminal 11 and stores the position information designated by the administrator as the hint activation position and the hint output position in the position information storage unit 128. One or more character positions can be designated as the hint output position. The hint activation position and hint output position are designated in advance for the registered password.

  The hint table generation unit 123 generates the above-described hint table 3 based on the registered password in the password storage unit 122 and stores it in the hint table storage unit 124. The hint table 3 is a conversion table for converting the character at the hint activation position, and includes assignment information in which hint characters are assigned to two or more characters that can be used for the registered password. More specifically, in the hint table 3, characters at the hint output position of the registration password are assigned to characters at the hint activation position in the registration password, and characters other than the characters at the hint activation position in the registration password are assigned. , Random characters are assigned.

  The character assigned to the character other than the character at the hint activation position may be arbitrary, but from the viewpoint of making it difficult for a non-authorized user to perceive the registered password, a character different from the character at the hint output position of the registered password desirable. Such a hint table 3 is generated for each registered password. With this configuration, when various characters are input at the hint activation position and the hint character is repeatedly displayed, the same character is displayed when the correct character is input, whereas characters other than the correct character are displayed. It is possible to prevent a situation in which different characters are displayed for each input when input is performed. For this reason, by inputting a different password and repeatedly displaying the hint character, it is possible to prevent a part of the registered password from being perceived by an authenticated person who is not a legitimate user.

  The hint table storage unit 124 holds two or more hint tables 3 corresponding to different registered passwords. In addition, the hint table generation unit 123 updates the corresponding hint table 3 when the registered password is changed.

  When a part of the input password is input by the person to be authenticated, the hint character generation unit 126 refers to the hint table 3 and obtains a hint character assigned to the character at the hint activation position in the input password. If two or more hint activation positions are specified for one registered password, the characters at the two or more hint activation positions in the input password match the characters at the corresponding positions in the registered password. The character at the hint output position in the registered password is displayed as the hint character.

<Login screen 4>
FIG. 3 is a diagram illustrating an example of an operation at the time of user authentication in the authentication device 1 of FIG. 1, and shows a login screen 4 displayed on the display output unit 11 b of the client terminal 11. The login screen 4 is an input screen for user authentication, and is provided with input fields 41 and 42, an activation position mark 43, an output position mark 44, an enter button 45, and a cancel button 46.

  The input field 41 is a character string input area for inputting a character string composed of two or more characters as a user ID. The user ID is identification information for identifying the person to be authenticated. The input field 42 is a character string input area for inputting a character string composed of two or more characters as an input password.

  The activation position mark 43 is a display object indicating the hint activation position. The activation position mark 43 is composed of an inverted triangle and is displayed in the vicinity of the input field 42 and above the input field 42. The output position mark 44 is a display object indicating the hint output position. The output position mark 44 is formed of a triangular figure and is displayed near the input field 42 and below the input field 42.

  Various modifications can be used for the display form of the activation position mark 43 and the output position mark 44. Specifically, character positions other than the hint activation position and the hint output position may be indicated using a predetermined symbol, for example, “*”. For example, when the hint output positions are the third and eighth characters, the output position mark 44 is “** Δ ****”.

  The decision button 45 is an operation icon for confirming the input. By operating the enter button 45, authentication processing is executed, and if user authentication is successful, login is permitted. The cancel button 46 is an operation icon for canceling the input. By operating the cancel button 46, it is possible to return to the screen before the login screen 4 is displayed. The enter button 45 and the cancel button 46 are arranged below the input field 42.

<Password registration screen 5>
FIG. 4 is a diagram showing an example of the operation at the time of password registration in the authentication device 1 of FIG. 1, and shows the password registration screen 5 displayed on the display output unit 11 b of the client terminal 11. The password registration screen 5 is an input screen for password registration, and is provided with an input field 51, check boxes 52 and 53, and a determination button 54.

  The input field 51 is a character string input area for inputting a character string composed of two or more characters as a registration password. In this input column 51, a broken-line rectangular frame indicating a character position that can be input is displayed.

  The check box 52 is an input field used when the administrator specifies a hint activation position, and is arranged in association with a character position that can be input. By inputting a check mark in the check box 52, the hint activation position is designated. The check box 53 is an input field used when the administrator designates a hint output position, and is arranged in association with a character position that can be input. By inputting a check mark in the check box 53, the hint output position is designated.

  In this password registration screen 5, an 8-digit registration password can be designated, eight check boxes 52 are arranged above the input field 51, and eight check boxes 53 are arranged below the input field 51. Has been. In this example, a character string “abcdefg” consisting of seven English characters is input as a registered password, the first character position is specified as a hint activation position, and the seventh character position is specified as a hint output position. Yes. The first character of the registered password is arranged at the left end of the character string, and the last character is arranged at the right end of the character string.

  Although one or two or more character positions can be arbitrarily designated as the hint activation position, it is desirable to designate the character position of the first character because it is the character position to be input first. When two or more hint activation positions are designated, it is desirable to designate a character position continuous from the first character position.

  If the hint output position is different from the character position designated as the hint activation position, one or more character positions can be arbitrarily designated. When the character position designated as the hint activation position is selected as the hint output position, an input error occurs.

  The decision button 54 is an operation icon for confirming the input. By operating the enter button 54, the registration password input in the input field 51 and the hint activation position and hint output position specified by the check boxes 52 and 53 are stored as registration information.

  Steps S101 to S105 in FIG. 5 are flowcharts showing an example of registration processing of the authentication server 12 in FIG. First, if the registered password, the hint activation position, and the hint output position are designated by the administrator (step S101), the authentication server 12 performs error determination on these input information (step S102), and an input error is detected. If there is, the procedure after step S101 is repeated (step S103).

  In the error determination, for example, when a character that cannot be used for the registered password is input, or when a character position that cannot be specified as the hint activation position or the hint output position is selected, it is determined as an input error. The Also, when the enter button 54 is operated even though the registration password is not input, or when the character position exceeding the length of the registration password is designated as the hint activation position or the hint output position, Judged as an input error. An input error is also determined when the same character position is designated as the hint activation position and the hint output position.

  If there is no input error, the authentication server 12 generates the hint table 3 based on the registration password, hint activation position, and hint output position specified by the administrator, and stores the registration password in the password storage unit 122. This process ends (steps S104 and S105).

  FIG. 6 is a diagram showing an example of the operation at the time of password registration of the authentication server 12 of FIG. (A) in the figure shows the registered password 6 designated by the administrator, and (b) shows the hint table 3. The registered password 6 includes a character string “abcdefg”, and the character position of the first character is designated as the hint activation position, and the character position of the seventh character is designated as the hint output position.

In the hint table 3, when N hint activation positions are designated and M hint output positions are designated, the number of characters that can be used for the registered password is A, and A ^N letters or characters A conversion source is used, A ^M characters or character strings are used as conversion destinations, and these conversion sources are associated with conversion destinations (N, M, and A are integers). From the viewpoint of suppressing an increase in vulnerability of user authentication due to the registered password, it is desirable that M is sufficiently smaller than the length of the registered password, that is, the number of characters.

  For example, when N = M = 1, 10 numbers from 0 to 9 and 26 English letters from a to z can be used for the registration password, A = 36 and 36 ways Are associated one-to-one with the 36 characters. Among these, the character Pn at the hint output position of the registered password is assigned to the character Pn at the hint activation position of the registered password. In this example, Pm = g is assigned to Pn = a. Random characters other than Pm are assigned as conversion destinations to characters other than Pn.

For example, if N = M = 2, 10 numbers from 0 to 9 and 26 alphabetic characters from a to z can be used for the registration password, A = 36 and 36 ² string of the street is associated to a string of 36 ^two ways. Among these, the two characters Pn at the registered password hint output position are assigned to the two characters Pn at the hint activation position of the registered password. Two random characters other than Pm are assigned as conversion destinations to two characters other than Pn.

An example of a method for generating the hint table 3 for a more general case is as follows. When N = M, the number of combinations of character strings to be converted A ^M is the same as the table size A ^N , so that all combinations except Pm are associated with random character strings other than Pn. It is done.

In the case of N> M, the number of combinations of character strings A ^{M to be} converted is 1 / A ^(N−M) of the table size A ^N , so that A ^M character strings are respectively A ^{(N−M )} A set having only one piece is used, and a set obtained by removing Pm from the set is associated with a random character string other than Pn. When N <M, a set obtained by removing Pm from A ^M character strings is used, and (A ^N −1) character strings are randomly extracted from the set and associated with character strings other than Pn. It is done.

Steps S111 to S113 in FIG. 7 are flowcharts illustrating an example of the generation process of the hint table 3 in the authentication server 12 in FIG. First, the authentication server 12 creates a conversion table associating A ^N conversion sources with A ^M conversion destinations (step S111).

  Next, the authentication server 12 assigns the character Pm at the hint output position of the registered password to the character Pn at the hint start position of the registered password (step S112), and other than Pm for characters other than the conversion source Pn. Are assigned as conversion destinations to complete the hint table 3 (step S113).

  FIG. 8 is a diagram illustrating an example of an operation at the time of user authentication in the authentication device 1 of FIG. 1, in which hint characters 44 a that are displayed when the input password is input are illustrated. In this figure, the case where the character input into the input column 42 is displayed as an input character is shown. (A) in the drawing shows a case where there is one hint activation position. When the first character position is designated as the hint activation position and the seventh character is designated as the hint output position, the hint character 44a is the hint output position when the character is input at the first character position. Displayed in association with. In this example, the hint character “g” is displayed in place of the output position mark 44.

  If the character input at the first character position matches the first character of the registered password, the seventh character of the registered password is displayed as the hint character 44a. On the other hand, if the character input at the first character position does not match the first character of the registered password, in many cases, a character other than the seventh character of the registered password is used as the hint character 44a. Is displayed.

  (B) in the figure shows a case where there are two hint activation positions. When the first character position and the second character position are specified as the hint activation position and the sixth character and the seventh character are specified as the hint output position, when the character is input at the second character position. The hint character 44a is displayed in association with the hint output position. In this example, hint characters “f” and “g” are replaced with the output position mark 44 and displayed.

  If the character string consisting of the character entered at the first character position and the character entered at the second character position matches the character string consisting of the first and second characters of the registered password A character string composed of the sixth and seventh characters of the registered password is displayed as a hint character 44a. On the other hand, if the input character string does not match the corresponding character string of the registered password, in many cases, a character string other than the corresponding character string of the registered password is displayed as the hint character 44a.

  Here, an example in which the character entered in the input field 42 is displayed as it is as an input character has been described. However, in order to improve confidentiality, the input character is replaced with a predetermined symbol, for example, “*”. May be displayed, or may be configured not to display input characters or symbols.

  Steps S201 to S209 in FIG. 9 are flowcharts illustrating an example of authentication processing in the authentication server 12 in FIG. First, if the user ID is input to the input field 41 of the login screen 4 (step S201), the authentication server 12 selects a registration password corresponding to the user ID (step S202).

  Next, when a character is input at the hint activation position in the input field 42, the authentication server 12 refers to the hint table 3 to generate the hint character 44a, and displays the hint character 44a in association with the hint output position. (Steps S203 and S204).

  Next, if the determination button 45 is operated (step S205), the authentication server 12 collates the input password with the registered password (step S206), and if the authentication is successful, outputs the collation result and ends this processing. (Steps S207 and S208). On the other hand, if the authentication is not successful, the processing procedure after step S203 is repeated. If the cancel button 46 is operated in step S205, the authentication server 12 discards the user ID and the input password input by the person to be authenticated and ends this process (step S209). Further, if the input password is changed in step S209, the authentication server 12 repeats the processing procedure after step S203.

  In the authentication device 1 according to the present embodiment, since the hint character is generated based on the character at the hint activation position in the input password, does the character at the hint activation position match the character at the corresponding position in the registered password? Depending on whether or not, a part of the registered password can be displayed as a hint character. In particular, if the character at the hint activation position input by the person to be authenticated is not correct, the characters constituting the registration password are not displayed in many cases. It is difficult to detect a part of the registered password from the hint character, and it is possible to suppress an increase in the vulnerability of user authentication by the registered password.

  If the character at the hint activation position in the input password matches the character at the corresponding position in the registration password, the character at the hint output position in the registration password is displayed as the hint character. For this reason, the person to be authenticated can easily recognize the remaining part of the registered password by inputting a correct character as the character at the hint activation position.

  In this embodiment, an example in which the hint activation position or the hint output position is designated by inputting a check mark in the check box 52 or 53 has been described. However, the present invention describes the hint activation position and the hint. The method for specifying the output position is not limited to this. For example, a configuration in which a hint activation position and a hint output position are designated by providing a plurality of menu items and selecting one of these menu items may be adopted.

  FIG. 10 is a diagram showing another example of the operation at the time of password registration in the authentication device 1 of FIG. 1, and shows a password registration screen 5 on which three menu items 55 are provided. The password registration screen 5 is provided with three menu items 55 for designating a hint activation position and a hint output position instead of the check boxes 52 and 53.

  Specifically, by deselecting the hint output position, the hint character is not displayed, the first character position is designated as the hint activation position, and the last character position of the registered password is output as a hint. It is possible to select either the case where the position is designated, or the case where the character position of the first character is designated as the hint activation position and the character position of the second character is designated as the hint output position. These menu items can be arbitrarily selected by operating radio buttons.

  FIG. 11 is a diagram showing another example of the operation at the time of password registration in the authentication device 1 of FIG. 1, and shows a password registration screen 5 provided with input fields 57 and 59 for inputting character positions. ing. The password registration screen 5 includes an input field 57 for designating the hint activation position by the number of characters from the first character or the last character, and an input field 59 for designating the hint output position by the number of characters from the first character or the last character. And are provided.

  By operating the radio button 56, it is possible to select either the case where the hint activation position is designated by the number of characters from the first character or the case where the hint activation position is designated by the number of characters from the end character. Further, by operating the radio button 58, it is possible to select either the case where the hint output position is designated by the number of characters from the first character or the case where the hint output position is designated by the number of characters from the end character.

  In this embodiment, an example in which a hint character is generated from a character at a hint activation position using the hint table 3 has been described. However, the present invention is not limited to this method of generating a hint character. Absent. For example, the character at the hint activation position in the registered password is converted to an integer value by a function such as a hash function, and a reference value that can obtain the character at the hint output position in the registered password from the converted integer value A configuration in which the information is stored in association with each other may be used. According to such a configuration, a hint character can be generated from the character at the hint activation position without using the hint table 3.

  In this embodiment, an example in which the administrator can arbitrarily specify the hint activation position and the hint output position has been described. However, the present invention provides a method for specifying the hint activation position and the hint output position. It is not limited to. For example, the hint activation position and the hint output position may be automatically specified based on the length of the registration password and the character types constituting the registration password.

  Specifically, since it is the character position to be input first, the character position of the first character is designated as the hint activation position. Alternatively, the character position at the end of the registered password is designated as the hint output position. Alternatively, the character position of the first character is specified as the hint activation position, and the character position at the end of the registered password and the character position of the second character from the end are specified as the hint output position. Alternatively, the character position of the first character and the character position of the second character are designated as the hint activation position, and the character position at the end of the registered password is designated as the hint output position.

  Alternatively, the configuration may be such that when a registered password using a plurality of different types of characters is specified, a hint activation position or a hint output position is specified by detecting a boundary where the character type changes. For example, the character position of the first character behind the boundary line is designated as the hint output position. Alternatively, when the menu item 55 for designating the hint output position is displayed on the password registration screen 5, the content of the menu item 55 may be changed according to the boundary where the character type changes.

  Moreover, although this Embodiment demonstrated the example in case the authentication apparatus 1 consists of the client terminal 11 and the authentication server 12, this invention does not limit the structure of the authentication apparatus 1 to this. For example, the present invention can also be applied to a terminal device such as a mobile phone, a tablet terminal, a PDA (Personal Digital Assistant: portable information terminal), or an ATM (Automatic Teller Machine) that incorporates an authentication server.

The configuration of the authentication device 1 according to the embodiment of the present invention and the corresponding operational effects are organized and summarized below.
The authentication device 1 according to the first aspect of the present invention includes a password storage unit 122 for storing a character string as a registration password, an operation input unit 11a for the person to be authenticated to input a character string as an input password, and an input password as a registration password. The user authentication unit 125 that performs authentication by checking with the hint, the hint character generation unit 126 that generates a hint character based on the character at the hint activation position in the input password, and the hint character as the hint output position character of the registered password Is displayed, and if the character at the hint activation position in the input password matches the character at the corresponding position in the registered password, the character at the hint output position in the registered password is displayed as the hint character. Configured to be.

  According to such a configuration, since the hint character is generated based on the character at the hint activation position in the input password, whether or not the character at the hint activation position matches the character at the corresponding position in the registered password. Accordingly, a part of the registered password can be displayed as a hint character. Also, if the character at the hint activation position in the input password matches the character at the corresponding position in the registered password, the character at the hint output position in the registered password is displayed as a hint character. By inputting the correct character as the position character, the remaining part of the registered password can be recognized.

  In addition to the above-described configuration, the authentication device 1 according to the second aspect of the present invention generates a hint table 3 in which hint characters are assigned to two or more characters that can be used in a registered password, for each registered password. The hint character generation unit 126 refers to the hint table 3 to obtain a hint character assigned to the character at the hint activation position in the input password, and the hint table 3 stores the hint activation position in the registered password. A character at the hint output position of the registered password is assigned to the character, and a random character is assigned to a character other than the character at the hint activation position in the registered password. According to such a configuration, since the hint character assignment is predetermined by the hint table, when various characters are input at the hint activation position and the hint character is repeatedly displayed, the same character is input when the correct character is input. In contrast, when a character other than the correct character is input, a situation in which a different character is displayed for each input can be prevented.

  In addition to the above configuration, the authentication device 1 according to the third aspect of the present invention is configured such that the hint table generating unit 123 updates the hint table 3 when the registered password is changed. According to such a configuration, it is possible to prevent the assignment of hint characters from being changed every time an input password is input.

  In addition to the above configuration, the authentication device 1 according to the fourth aspect of the present invention includes a password specifying unit 121 for an administrator to specify a registered password, and a position specifying unit for the administrator to specify a hint activation position and a hint output position. 127. According to such a configuration, the administrator can arbitrarily designate the hint activation position and the hint output position as the character position in the registered password.

  In addition to the above configuration, the authentication device 1 according to the fifth aspect of the present invention provides a hint in the registration password if the characters at two or more hint activation positions in the input password match the characters in the corresponding positions in the registration password. The character at the output position is configured to be displayed as a hint character. According to such a configuration, by inputting correct characters at a plurality of hint activation positions, the remaining part of the registered password can be recognized by the hint characters.

DESCRIPTION OF SYMBOLS 1 Authentication apparatus 11 Client terminal 11a Operation input part 11b Display output part 12 Authentication server 121 Password designation part 122 Password storage part 123 Hint table generation part 124 Hint table storage part 125 User authentication part 126 Hint character generation part 127 Position designation part 128 Position Information storage unit 129 Hint character display unit 3 Hint table 4 Login screen 5 Password registration screen 6 Registration password

Claims (5)

Password storage means for storing a character string as a registered password;
A character string input means for the person to be authenticated to input a character string as an input password;
User authentication means for authenticating the input password against the registered password; and
A hint character generating means for generating a hint character based on the character at the hint activation position in the input password;
A hint character display means for displaying the hint character as a character at the hint output position of the registered password;
If the character at the hint activation position in the input password matches the character at the corresponding position in the registration password, the character at the hint output position in the registration password is displayed as the hint character. Authentication device to perform. A hint table generating means for generating, for each of the registered passwords, a hint table in which the hint characters are respectively assigned to two or more characters usable in the registered password;
The hint character generation means refers to the hint table, obtains the hint character assigned to the character at the hint activation position in the input password,
In the hint table, the character at the hint activation position of the registration password is assigned to the character at the hint activation position in the registration password, and for the characters other than the character at the hint activation position in the registration password, The authentication apparatus according to claim 1, wherein random characters are assigned.   The authentication apparatus according to claim 2, wherein the hint table generating unit updates the hint table when the registered password is changed. A password specifying means for the administrator to specify the registration password;
The authentication apparatus according to any one of claims 1 to 3, wherein an administrator includes position specifying means for specifying the hint activation position and the hint output position.   If two or more characters at the hint activation position in the input password match the characters at the corresponding positions in the registration password, the characters at the hint output position in the registration password are displayed as the hint characters. The authentication apparatus according to any one of claims 1 to 4, wherein

Images