JP2016212781A - Authentication server, authentication system, authentication method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide electronic transaction excellent in user's convenience.SOLUTION: An authentication system 1 includes a user terminal 10 and an authentication server 20. The authentication server 20 includes: an information image creation unit 28 that images a transaction content received from a user terminal 10 and creates a transaction content image; an image presentation unit 30 that presents the transaction content image to a user of the user terminal 10 via a display unit 11 of the user terminal 10 so as to confirm the transaction content; and a determination unit 33 that determines whether or not a user's decision to the transaction content image received from the user terminal 10 is to execute a transaction; and a control unit 21 that executes the transaction. The control unit 21 executes the transaction when the determination unit 33 determines that the user's determination received from the user terminal 10 is to execute the transaction.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication server, an authentication system, an authentication method, and a program for preventing an MITB (Man In The Browser) attack in electronic transactions.

  In recent years, with the development of communication networks, damage caused by MITB attacks has increased. In the MITB attack, a malicious third party intrudes malware into the user terminal and causes the malware to monitor user communication. And if the malware detects the login to online banking etc. by the user at the time of carrying out an electronic transaction, it will tamper with the transfer destination and the amount. In this way, a malicious third party steals the user's savings. The outline of the MITB attack will be described below.

  FIG. 7 is a diagram illustrating an example of an outline of the MITB attack. The authentication system 1000 illustrated in FIG. 7 includes a user terminal 1010 and a transaction server 1020. The user terminal 1010 and the transaction server 1020 are connected to each other via the network 1030 and perform electronic transactions. Here, it is assumed that the user terminal 1010 is infected with malware 1040 that performs an MITB attack.

  The user of the user terminal 1010 confirms the transaction content 1011 from a display unit (not shown) during an electronic transaction with the transaction server 1020, and tries to transmit the transaction content 1011 to the transaction server 1020. Then, the transaction content 1011 is falsified to the falsification content 1012 by the malware 1040, and the falsified transaction content is transmitted to the transaction server 1020. As a result, the transaction server 1020 receives the transaction content 1021 altered by the malware 1040. Thereafter, the transaction server 1020 transmits the transaction content 1021 to the user terminal 1010 for confirmation of the transaction content. Then, the transaction content 1021 is falsified by the malware 1040, and the transaction content originally intended for the user is displayed on the display unit as the transaction confirmation 1013. Thereby, the user recognizes that the transaction is normally performed, and transmits to the transaction server 1020 that the transaction is executed. Then, the transaction is performed with the transaction content 1022 altered by the malware 1040.

  As a means for personal authentication in electronic transactions, a technique using a one-time password or a random number table card is known (Non-Patent Document 1). However, even if the one-time password or random number table card technology is used, the user confirms the transaction confirmation 1013 altered by the malware 1040 from the display unit, recognizes that the transaction is normally performed, and Enter a password or random number card. Therefore, there is a problem that the technique using the one-time password or random number table card is not resistant to the MITB attack.

  Therefore, as a countermeasure against the MITB attack, the following two-pass authentication and transaction authentication techniques have been proposed.

  Two-path authentication is a technique for performing electronic transactions using two different media (Non-Patent Document 2). In the two-path authentication, a path for confirming transaction contents using a medium such as a smartphone is used in addition to a path for performing login authentication and transaction declaration using a medium such as a personal computer in electronic transactions. As a result, even if a personal computer or the like is infected with malware and the transaction content is falsified by the malware, a notification confirming the transaction content is sent to a smartphone or the like which is a medium different from the personal computer or the like. Therefore, the user can know the alteration by the malware. Furthermore, since the execution instruction of the transaction is performed from a smartphone or the like which is another medium, the electronic transaction can be performed more safely.

  Transaction authentication is a technology that allows a transaction server to check whether processing information (transactions) based on transaction contents has been tampered with using a digital signature or encryption technology based on a hash value (Non-patent Document 3). There are two ways to do this. First, when an electronic transaction is performed on a personal computer, the user first connects the personal computer to the attached device, and transfers the transaction contents to an attached device different from the personal computer. Then, the user confirms the transaction content with the attached device, digitally signs the transaction content, transfers it to a personal computer, and then transmits the transaction content from the personal computer to the transaction server. As a result, even if the personal computer is infected with malware, the transaction content digitally signed by an attached device different from the personal computer is sent to the transaction server. Can be confirmed. In addition, when connecting a personal computer to an attached device, if the personal computer is infected with malware, in order to prevent the attached device from being further infected with malware, the attached device used must be highly tamper resistant. It becomes. Second, when an electronic transaction is performed on a personal computer, the user first inputs the transaction content to another device not connected to the personal computer. Then, the user converts the transaction content into a hash value using the device, manually inputs the hash value to the personal computer, and then transmits the transaction content from the personal computer. As a result, even if the personal computer is infected with malware, the transaction content encrypted with the hash value from a device different from the personal computer is sent to the transaction server. Can be confirmed.

Nikkei Computer, “Unauthorized remittance of Sumitomo Mitsui Banking is“ MITB attack ”, one passport users are also damaged”, [online], May 13, 2014, [March 31, 2015 search], Internet “http : //itpro.nikkeibp.co.jp/article/NEWS/20140513/556399 ” Joyo Bank, “One-Push Authentication (two-pass authentication)”, [online], [Search on March 31, 2015], Internet “http://www.joyobank.co.jp/jweboffice/onepush.html” Hitachi Solutions, “What are transaction signatures,” [online], November 25, 2014, [March 31, 2015 search], Internet “http://securityblog.jp/words/transacion_signatures.html”

  However, in the two-path authentication and the transaction authentication, when performing an electronic transaction, the user performs an operation using a device different from a personal computer or the like that performs the electronic transaction. Therefore, there is a problem that the convenience for the user is not excellent.

  An object of the present invention is to provide an authentication server, an authentication system, an authentication method, and a program that are excellent in user convenience.

  In order to solve the above-described problem, an authentication server according to the present invention is an authentication server connected to a user terminal through a network, and is an information image creation unit that images transaction contents received from the user terminal and creates a transaction content image An image presentation unit that presents the transaction content image to a user of the user terminal via a display unit of the user terminal for confirmation of the transaction content, and the user's transaction content image received from the user terminal. A determination unit that determines whether or not the determination is transaction execution; and a control unit that executes the transaction, wherein the determination unit receives the determination of the user received from the user terminal by the transaction execution When it is determined that the transaction is performed, the transaction is executed.

  Moreover, in order to solve the said subject, the authentication system which concerns on this invention is an authentication system provided with a user terminal and the authentication server connected with this user terminal through a network, Comprising: The said user terminal is provided with a display part, The authentication server images the transaction content received from the user terminal and creates an information image creation unit that creates the transaction content image, and the transaction content image via the display unit of the user terminal for confirmation of the transaction content. An image presentation unit presented to the user of the user terminal, a determination unit that determines whether or not the user's determination on the transaction content image received from the user terminal is transaction execution, and a control unit that executes the transaction. The control unit executes a transaction when the determination unit determines that the user's determination received from the user terminal is a transaction execution. To.

  In order to solve the above problem, an authentication method according to the present invention is an authentication method in an authentication system comprising a user terminal and an authentication server connected to the user terminal through a network, wherein the user is Imaging a transaction content received from a terminal, creating a transaction content image, presenting the transaction content image to a user via a display unit of the user terminal for confirmation of the transaction content, and the user terminal In the step of determining whether or not the determination of the user of the user terminal with respect to the transaction content image received from is a transaction execution, and in the determination step, the determination of the user received from the user terminal is a transaction execution If determined, a step of executing a transaction is included.

  Moreover, in order to solve the said subject, the transaction content which the user input from the said user terminal is imaged to the authentication server connected via a network with a user terminal, the transaction content image is created, Presenting to the user via the display unit of the user terminal for confirmation of content, determining whether the user's judgment on the transaction content image received from the user terminal is transaction execution, In the determining step, when it is determined that the user's determination received from the user terminal is a transaction execution, a step of executing the transaction is executed.

  According to the authentication server, the authentication system, the authentication method, and the program according to the present invention, it is possible to provide an electronic transaction excellent in user convenience.

It is a figure which shows an example of a structure of the authentication system which concerns on one Embodiment of this invention. It is a figure which shows an example of the information which transaction DB hold | maintains. It is a figure which shows an example of the superimposition process of the CAPTCHA image and transaction content image by an image synthetic | combination part. It is a figure which shows an example of the information which answer DB hold | maintains. It is a flowchart which shows an example of operation | movement of the authentication system which concerns on one Embodiment of this invention. It is a figure which shows an example of the synthesized image shown to a user. It is a figure which shows an example of the outline | summary of a MITB attack.

  Hereinafter, embodiments according to the present invention will be described with reference to the drawings.

[System configuration]
FIG. 1 is a diagram illustrating an example of a configuration of an authentication system according to an embodiment of the present invention. The authentication system 1 shown in FIG. 1 includes a user terminal 10 and a transaction server (authentication server) 20. The user terminal 10 and the transaction server 20 are connected to each other via the network 40 and perform electronic transactions.

  The user terminal 10 includes a display unit 11. In addition, although each function of the user terminal 10 which concerns on this invention is demonstrated, it should be noted that it is not intended to exclude other functions provided in the user terminal 10. The user terminal 10 can be configured as a computer, for example, and stores a program describing processing contents for realizing each function of the user terminal 10 in a storage unit (not shown), and the central processing unit ( This can be realized by reading out and executing this program by a CPU (Central Processing Unit).

  The display unit 11 is an output device such as a monitor, for example. When the electronic transaction is performed on the display unit 11, for example, a transaction input screen for inputting transaction contents is displayed by a Web browser.

  The transaction server 20 includes a control unit 21, a presentation unit 22, a communication unit 23, a transaction management unit 24, a transaction DB (database) 25, and a transaction information confirmation unit 26. In addition, although each function of the transaction server 20 which concerns on this invention is demonstrated, it should be noted that it is not intended to exclude other functions provided in the transaction server 20. The transaction server 20 can be configured as a computer, for example, and stores a program describing processing contents for realizing each function of the transaction server 20 in a storage unit or the like (not shown), and the central processing unit ( This can be realized by reading and executing this program by a CPU.

  The control unit 21 controls and manages the entire transaction server 20, and can be configured by a processor, for example. The control part 21 performs a transaction in the case of an electronic transaction.

  The presentation unit 22 displays a transaction input screen or the like on the display unit 11 of the user terminal 10 via the communication unit 23 and presents it to the user.

  The communication unit 23 communicates with the user terminal 10 via the network 40.

  The transaction management unit 24 attaches a transaction number to each transaction of the transaction content received from the user terminal 10. Then, the transaction management unit 24 causes the transaction DB 25 to hold the transaction content and transaction status in association with the transaction number. Further, when the transaction management unit 24 receives a notification from the result answering unit 34 to change the transaction status together with the transaction number, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25. Details of the function of the transaction management unit 24 will be described later.

  The transaction DB 25 holds transaction contents and transaction status in association with the transaction number. FIG. 2 shows an example of information held by the transaction DB. Examples of transaction contents include a transfer source (branch, account number, holder), transfer destination (financial institution, branch, account number, holder), and transfer amount. The transaction status includes, for example, types such as confirmation failure, confirmation success, confirmation in progress, and transaction completion.

  The transaction information confirmation unit 26 confirms whether or not the transaction content is correct for the user at the time of electronic transaction. The transaction information confirmation unit 26 includes a problem image creation unit 27, an information image creation unit 28, an image composition unit 29, an image presentation unit 30, an answer management unit 31, an answer DB (database) 32, and a determination unit 33. And a result answering unit 34.

  The problem image creation unit 27 creates a problem image for confirming whether the user of the user terminal 10 is a human being. For example, the problem image creation unit 27 randomly selects alphanumeric characters (about 5 to 7 characters), and generates a CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) image based on the randomly selected characters. create. As a CAPTCHA image creation method, for example, “Method for selectively restricting access to computer systems” (public number: US6195698B1) can be used. Hereinafter, the problem image created by the problem image creation unit 27 will be described as a CAPTCHA image.

  The information image creation unit 28 receives the transaction content from the transaction DB 25 via the transaction management unit 24, and creates a transaction content image obtained by imaging the transaction content. By translating the transaction content into an image and displaying the transaction content to be displayed on the display unit 11 of the user terminal 10 as an image instead of a text display, it is possible to make it difficult to falsify the transaction content by mechanical processing by malware.

  The image composition unit 29 superimposes the CAPTCHA image created by the problem image creation unit 27 and the transaction content image created by the information image creation unit 28 to create a composite image. In FIG. 3, an example of the superimposition processing of the CAPTCHA image and the transaction content image by the image composition unit 29 is shown. As shown in FIG. 3, the image composition unit 29 superimposes the transaction content image 51 on the CAPTCHA image 50, for example. Here, in the present invention, a composite image in which the CAPTCHA image and the transaction content image are superimposed is presented to the user of the user terminal 10, and the user is made to answer the character string of the CAPTCHA image, thereby confirming whether the user is a human being. To do. That is, the purpose of overlapping the CAPTCHA image and the transaction content image is to make it difficult to separate the CAPTCHA image and the transaction content image by mechanical image processing. If it becomes difficult to separate the CAPTCHA image and the transaction content image by mechanical image processing, it becomes more difficult to reply the character string of the CAPTCHA image by mechanical processing. In addition, if it becomes difficult to separate a CAPTCHA image or the like by transactional image processing from a transaction content image, it becomes even more difficult to tamper the transaction content image by mechanical processing. Therefore, in order to make it difficult to separate the CAPTCHA image from the transaction content image, it is desirable that the CAPTCHA image 50 and the transaction content image 51 have the same color in FIG.

  The image presenting unit 30 displays the composite image created by the image compositing unit 29 and the answer input form for inputting the reply of the CAPTCHA image on the display unit 11 of the user terminal 10 via the communication unit 23 and presents it to the user. To do.

  The answer management unit 31 receives the transaction number of the transaction from the transaction management unit 24. Then, the answer management unit 31 stores the answer of the CAPTCHA image created by the problem image creating unit 27 in the answer DB 32 in association with the transaction number.

  The answer DB 32 holds the answer of the CAPTCHA image in association with the transaction number. FIG. 4 shows an example of information held in the answer DB.

  When the determination unit 33 determines that the user executes the transaction, the determination unit 33 determines whether the answer of the CAPTCHA image input by the user matches the answer of the answer DB 32. Moreover, the determination part 33 determines whether the user of the user terminal 10 performs a transaction.

  The result answering unit 34 notifies the transaction management unit 24 of the notification that the transaction status is changed based on the determination result by the determining unit 33 together with the transaction number. Specifically, when the determination unit 33 determines that the user does not execute the transaction, the transaction management unit 24 is notified of the confirmation cancellation together with the transaction number. If the determination unit 33 determines that the user's CAPTCHA image response and the CAPTCHA image response stored in the response DB 32 do not match, the transaction management unit 24 is notified of the confirmation failure along with the transaction number. If the determination unit 33 determines that the answer of the user's CAPTCHA image and the response of the CAPTCHA image stored in the response DB 32 match, the transaction management unit 24 is notified of the confirmation success along with the transaction number. Further, when a transaction is executed by the control unit 21, the result answering unit 34 notifies the transaction management unit 24 of the transaction completion together with the transaction number.

  Here, details of the function of the transaction management unit 24 will be described. When the transaction management unit 24 receives a transaction number and confirmation cancellation notification from the result answering unit 34, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to confirmation cancellation. When the transaction management unit 24 receives a transaction number and confirmation failure notification from the result answering unit 34, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to confirmation failure. When the transaction management unit 24 receives a transaction number and a confirmation success notification from the result reply unit 34, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to a confirmation success. Further, when the transaction management unit 24 receives a transaction number and transaction completion notification from the result answering unit 34, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to transaction completion.

[System operation]
FIG. 5 is a flowchart showing an example of the operation of the authentication system according to the embodiment of the present invention. The user of the user terminal 10 inputs transaction details from the transaction input screen displayed on the display unit 11 by the presentation unit 22 of the transaction server 20. Then, the transaction content is transmitted to the transaction server 20 via the network 40.

  The transaction management unit 24 attaches a transaction number to the transaction content received via the communication unit 23, and stores the transaction content and transaction status in the transaction DB 25 in association with the transaction number (step S101). For example, the transaction management unit 24 assigns a random and non-overlapping transaction number to each transaction. On the other hand, the problem image creation unit 27 creates a CAPTCHA image for confirming whether the user is a human (step S102).

  Thereafter, the response management unit 31 receives the transaction number of the transaction from the transaction management unit 24. Then, the answer management unit 31 stores the answer of the CAPTCHA image created by the question image creating unit 27 in the answer DB 32 in association with the transaction number (step S103).

  On the other hand, the information image creation unit 28 receives the transaction content of the transaction DB 25 via the transaction management unit 24, and creates a transaction content image obtained by imaging the transaction content (step S104).

  As described above, the transaction content is imaged, and the transaction content to be displayed on the display unit 11 of the user terminal 10 is not a text display but an image, thereby making it difficult to falsify the transaction content by mechanical processing by malware. be able to.

  Then, the image composition unit 29 creates a composite image by superimposing the CAPTCHA image created by the problem image creation unit 27 and the transaction content image created by the information image creation unit 28 (step S105).

  In this way, by creating a composite image by superimposing a plurality of images (CAPTCHA image and transaction content image), it is possible to make it difficult to separate images by mechanical image processing. If it becomes difficult to separate the CAPTCHA image and the transaction content image by mechanical image processing, it is possible to make it more difficult to answer the character string of the CAPTCHA image by mechanical processing. Further, if it becomes difficult to separate the CAPTCHA image and the transaction content image by mechanical image processing, it is possible to further make it difficult to tamper the transaction content image by mechanical processing.

  Thereafter, the image presentation unit 30 displays the composite image created by the image composition unit 29 and the reply input form for inputting the reply of the CAPTCHA image on the display unit 11 of the user terminal 10 via the communication unit 23, and the user (Step S106). FIG. 6 shows an example of a composite image presented to the user. As shown in FIG. 6, the composite image 60 is displayed on the display unit 11, and the composite image 60 is presented to the user. The user identifies the character string of the CAPTCHA image from the presented CAPTCHA image of the composite image 60, inputs the answer to the input answer form 61, and selects the transaction execution button 62. Alternatively, when the user determines that the transaction content is not correct from the transaction content image of the presented composite image 60, the user selects the transaction stop button 63. In addition, when the presented composite image 60 is collapsed and the user terminal 10 is suspected of being infected with malware, the transaction stop button 63 may be selected to stop the transaction. The responses to the input response form 61 by these users and the selection of the transaction execution button 62 and the transaction stop button 63 are transmitted to the transaction server 20 via the network 40.

  Thus, the reply of the CAPTCHA image and the confirmation of transaction contents by the user can be performed by displaying the composite image on the display unit 11 and presenting it to the user. That is, the reply of the CAPTCHA image and the confirmation of the transaction content can be performed using the user terminal 10, and it is not necessary to use a device different from the user terminal 10. Thereby, the electronic transaction excellent in the convenience of the user can be provided.

  Furthermore, by adding an image such as a CAPTHA image that can confirm that the user is a human to the composite image, even if communication between the user terminal 10 and the transaction server 20 is taken over by a third party, the response to the CAPTHA image Can fail confirmation and prevent completion of the transaction.

  The determination unit 33 determines whether or not the user's selection is transaction execution (step S107). If the determination unit 33 determines that the user's selection is transaction execution (step S107: Yes), the process proceeds to step S109. On the other hand, when the determination unit 33 determines that the user's selection is not transaction execution (that is, when the user's selection is transaction cancellation) (step S107: No), the process proceeds to step S108.

  In the process of step S108, the result reply unit 34 notifies the transaction management unit 24 of confirmation cancellation together with the transaction number. Upon receipt of this notification, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to the confirmation cancellation (see FIG. 2).

  In the processing of step S109, the determination unit 33 determines whether or not the user's CAPTCHA image response matches the CAPTCHA image response stored in the response DB 32. For example, the determination unit 33 collates the response of the user's CAPTCHA image with the response associated with the transaction number in the response DB 32 and determines whether or not they match. If the determination unit 33 determines that the user's CAPTCHA image response matches the CAPTCHA image response stored in the response DB 32 (step S109: Yes), the process proceeds to step S111. On the other hand, when it is determined by the determination unit 33 that the answer of the user's CAPTCHA image and the answer of the CAP image held in the answer DB 32 do not match (step S109: No), the process proceeds to step S110.

  In the process of step S110, the result reply unit 34 notifies the transaction management unit 24 of the confirmation failure along with the transaction number. Upon receiving this notification, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to a confirmation failure (see FIG. 2).

  In the process of step S111, the result answering unit 34 notifies the transaction management unit 24 of the confirmation success together with the transaction number. Upon receipt of this notification, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to the confirmation success (see FIG. 2).

  In the process of step S112, the control unit 12 executes a transaction. For example, the control unit 12 transfers the transfer amount illustrated in FIG. 2 from the transfer source to the transfer destination. Further, the result answering unit 34 notifies the transaction management unit 24 of the transaction completion together with the transaction number. Upon receiving this notification, the transaction management unit 24 changes the transaction status associated with the transaction number in the transaction DB 25 to transaction completion (see FIG. 2).

  As described above, the reply of the CAPTCHA image and the confirmation of the transaction content can be performed using the user terminal 10, and it is not necessary to use a device different from the user terminal 10. For this reason, the electronic transaction excellent in the convenience of the user can be provided. Furthermore, since it is not necessary to use a device different from the user terminal 10, there is no distribution cost for another device. Therefore, the authentication system 1 according to the present invention can be used at a lower cost. Moreover, even if communication between the user terminal 10 and the transaction server 20 is taken over by a third party by adding an image such as a CAPTHA image that can confirm that the user is a human being to the composite image, a reply to the CAPTHA image Can fail confirmation and prevent completion of the transaction. Moreover, even if the user terminal 10 is infected with malware, all authentication and confirmation processing is performed on the transaction server 20 side, so that safer electronic transactions can be provided.

  Note that it is not essential for the image composition unit 29 to create a composite image by superimposing the CAPTHA image and the transaction content image. Only the transaction content image may be displayed on the display unit 11 of the user terminal 10 by the image presentation unit 30 and presented to the user. As described above, the transaction content is imaged and the transaction content to be displayed on the display unit 11 is an image instead of a text display, thereby making it difficult to falsify the transaction content by mechanical processing by malware. . At this time, the user determines from the presented transaction content image whether or not to execute the transaction.

  Although the present invention has been described based on the drawings and examples, it should be noted that those skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these variations and modifications are included in the scope of the present invention. For example, the functions included in each component, each step, etc. can be rearranged so that there is no logical contradiction, and multiple components, steps, etc. can be combined or divided into one It is. Further, although the present invention has been described mainly with respect to the apparatus, the present invention can also be realized as a method, a program executed by a processor included in the apparatus, or a storage medium storing the program, and is within the scope of the present invention. It should be understood that these are also included.

DESCRIPTION OF SYMBOLS 1 Authentication system 10 User terminal 11 Display part 20 Transaction server 21 Control part 22 Presentation part 23 Communication part 24 Transaction management part 25 Transaction DB
26 Transaction Information Confirmation Unit 27 Problem Image Creation Unit 28 Information Image Creation Unit 29 Image Composition Unit 30 Image Presentation Unit 31 Response Management Unit 32 Response DB
33 determination part 34 result answer part 40 network

Claims (5)

An authentication server connected to a user terminal through a network,
An image of the transaction content received from the user terminal, an information image creation unit for creating a transaction content image,
An image presentation unit for presenting the transaction content image to a user of the user terminal via a display unit of the user terminal for confirmation of the transaction content;
A determination unit that determines whether or not the user's determination on the transaction content image received from the user terminal is a transaction execution;
A control unit for executing a transaction,
The control unit executes a transaction when the determination unit determines that the user's determination received from the user terminal is a transaction execution.
An authentication server characterized by that. The authentication server is
A problem image creation unit for creating a problem image;
An answer DB that holds answers to the problem images;
An image compositing unit that creates a composite image by superimposing the problem image and the transaction content image;
The image presenting unit presents the composite image to the user via a display unit of the user terminal,
The determination unit further determines whether or not the answer to the problem image of the user received from the user terminal matches the answer held in the answer DB;
The control unit is a case where the determination unit determines that the user's determination received from the user terminal is a transaction execution, and the answer of the problem image of the user received from the user terminal; When it is determined that the answer stored in the answer DB matches, the transaction is executed.
The authentication server according to claim 1. An authentication system comprising a user terminal and an authentication server connected to the user terminal through a network,
The user terminal is
With a display,
The authentication server is
An image of the transaction content received from the user terminal, an information image creation unit for creating a transaction content image,
An image presentation unit for presenting the transaction content image to the user of the user terminal via the display unit of the user terminal for confirmation of the transaction content;
A determination unit that determines whether or not a user's determination on the transaction content image received from the user terminal is a transaction execution;
A control unit for executing a transaction,
The control unit executes a transaction when the determination unit determines that the user's determination received from the user terminal is a transaction execution.
An authentication system characterized by that. An authentication method in an authentication system comprising a user terminal and an authentication server connected to the user terminal through a network,
By the authentication server,
Imaging the transaction content received from the user terminal and creating a transaction content image;
Presenting the transaction content image to the user via the display unit of the user terminal for confirmation of the transaction content;
Determining whether the user terminal user's decision on the transaction content image received from the user terminal is a transaction execution;
In the step of determining, if it is determined that the user's determination received from the user terminal is transaction execution, executing the transaction;
An authentication method that includes: To the authentication server connected to the user terminal through the network,
Imaging the transaction content entered by the user from the user terminal, creating a transaction content image;
Presenting the transaction content image to the user via the display unit of the user terminal for confirmation of the transaction content;
Determining whether the user's judgment on the transaction content image received from the user terminal is a transaction execution;
In the step of determining, if it is determined that the user's determination received from the user terminal is transaction execution, executing the transaction;
A program that executes

Images