JP2018032150A - Authentication processing system, authentication auxiliary server, and web display program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication technique for securing sufficient security with little time and effort.SOLUTION: When a communication terminal 140 performs access to a Web server 110, an authentication key and a start button of a message application are displayed on a login screen of the communication terminal 140. When the start button is operated, the message application is started, and a message text input screen is displayed. When the authentication key is input to the screen, and a message is transmitted to an authentication auxiliary server 130, the authentication auxiliary server 130 transmits an application ID included in the message and the authentication key to the Web server 110. The Web server 110 specifies the communication terminal 140 from the authentication key to authorize login when the application ID belongs to a registered user.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication processing system that performs login authentication to a website, an authentication auxiliary server, and a web display program.

  Conventionally, as an authentication method when logging in to a website with a communication terminal, a method of inputting a user ID and a password on an authentication screen of the website is generally used.

  As is well known, in order to ensure sufficiently high security by using such a user ID and password, it is desirable to increase the number of characters of the user ID and password as much as possible. It is desirable to register a different user ID and password for each site.

  However, when a user ID or password having a very long number of characters is registered for each website, it takes a lot of labor to input them correctly, and this makes the work of receiving login authentication troublesome.

  In addition, since it is difficult to memorize such many types of user IDs and passwords, in general, the user of the communication terminal takes notes of the user ID and password. If the memo is stolen or seen by others, the user ID and password may be leaked.

  As a technique for solving such a defect, for example, a technique described in Patent Document 1 below is known.

  In the technique of Patent Document 1, when a website is authenticated by a personal computer, a QR code (registered trademark) is displayed on the screen, and the QR code (registered trademark) is photographed with a mobile phone. Then, the URL indicated by the QR code (registered trademark) is accessed, and the login authentication of the website is performed using the individual identification number of the mobile phone.

  As a result, the technique disclosed in Patent Document 1 can perform a login authentication process for a website without using a user ID or a password.

JP 2011-238036 A

  However, since the technique of Patent Document 1 needs to capture a screen every time login authentication is performed, the troublesomeness of login authentication work cannot be reduced sufficiently.

  In addition, since another communication terminal is required separately from the communication terminal that wants to receive login authentication, a person who owns only one communication terminal (for example, a person who owns only one smartphone) Not available.

  The subject of this invention is providing the authentication technique which can ensure sufficient security with little effort.

  In order to solve such a problem, the authentication processing system according to the invention of claim 1 is configured such that when the browser application of the communication terminal makes an authentication request to a predetermined website to the web server, the authentication request An authentication processing system for determining authentication / non-authentication, wherein the communication terminal is installed with a message application that transmits a message in which a message body and message application identification information are stored, and the browser of the communication terminal When the application accesses the website and makes the authentication request, an authentication screen that provides authentication identification information for identifying the website and the communication terminal corresponding to the authentication request is displayed on the browser application. And the message application of the communication terminal stores the message in which the authentication identification information is written in the message body. And the browser application corresponding to the authentication identification information is authenticated when the message application specific information stored in the message belongs to a website user registered in advance. .

  The invention of claim 2 is characterized in that, in addition to the configuration of claim 1, the message application is an application with a message transmission function for using a general-purpose social networking service.

  According to a third aspect of the present invention, in addition to the configuration of the first or second aspect, the message is received from the message application of the communication terminal, and the authentication identification information and the message application specific information are received from the message. Extracting and identifying the website that is the object of the authentication request from the authentication identification information, and transmitting the authentication identification information and the message application identification information to the web server corresponding to the identified website And an authentication auxiliary server.

  According to a fourth aspect of the invention, in addition to the configuration according to any one of the first to third aspects, the authentication assistant server encrypts the message application specifying information with a predetermined encryption algorithm and transmits the encrypted information to the web server. The web server permits the authentication request of the browser application when the message application specific information encrypted by the predetermined encryption algorithm belongs to a website user registered in advance. It is characterized by.

  The invention according to claim 5 is an authentication auxiliary server used in the authentication processing system according to claim 4.

  The invention of claim 6 is a web display program for displaying an authentication screen on the browser application of the communication terminal of the authentication processing system according to any one of claims 1 to 4.

  According to the first aspect of the present invention, when a browser application of a communication terminal makes an authentication request to a website, the authentication identification information displayed on the authentication screen is transmitted as the message body of the message application. Therefore, authentication can be received with a simple operation.

  According to the invention of claim 1, since authentication is performed using the authentication identification information issued by the web server and the message application specifying information stored in the message application, the security equivalent to the user ID and password is ensured. It can be secured. Furthermore, the user of the communication terminal does not need to make a note of the authentication identification information and the message application specific information, and high security can be ensured in this respect as well.

  In addition, according to the first aspect of the present invention, since two types of applications installed in one communication terminal are used, it is not necessary for the user to have two devices.

  According to the second aspect of the present invention, since a message is transmitted using a general-purpose social networking service, a message application dedicated for authentication is not required, and convenience for the user can be improved.

  According to the invention of claim 3, since it is not necessary to set the destination of the message of the present invention for each web server (or for each website), authentication is further facilitated.

  According to the invention of claim 4, since the third party or the website operator cannot acquire the message application specific information, the leakage of the message application specific information can be prevented and the safety can be further improved.

  According to invention of Claim 5, the authentication auxiliary | assistant server which has the same effect as Claim 3 or 4 can be provided.

  According to the invention of claim 6, the authentication processing system according to claims 1 to 4 can be used in a normal communication terminal.

It is a conceptual diagram which shows the communication network structure which concerns on Embodiment 1 of this invention. (A) is a functional block diagram of the authentication process part provided in the web server which concerns on the same Embodiment 1, (b) is a conceptual diagram which shows the user information table memorize | stored in the user information storage part of (a). It is a sequence diagram which shows the registration process which concerns on the same Embodiment 1. It is a sequence diagram which shows the authentication process which concerns on the same Embodiment 1. It is a conceptual diagram which shows the screen of the communication terminal at the time of performing the registration process which concerns on the same Embodiment 1, (a) is a screen of a browser application, (b) And (c) is a screen of a message application. It is a conceptual diagram which shows the screen of the communication terminal at the time of performing the authentication process which concerns on the same Embodiment 1, Comprising: (a) is a screen of a browser application, (b) And (c) is a screen of a message application.

Embodiment 1 of the Invention
Embodiment 1 of the present invention will be described below with reference to FIGS.

  FIG. 1 is a conceptual diagram showing a communication network configuration according to the first embodiment.

  As shown in FIG. 1, the authentication processing system 100 according to the first embodiment includes a web server 110, an SNS server 120, and an authentication auxiliary server 130. The web server 110, the SNS server 120, and the authentication auxiliary server 130 are communicatively connected to a communication network such as the Internet or a LAN (Local Area Network). In addition, a communication terminal 140 is also connected to the communication network.

  The web server 110 stores a large number of web display programs for each website. The web display program is a program for causing the communication terminal 140 to display a web page. The web display program stored in the web server 110 is transmitted to the communication terminal 140 when the communication terminal 140 requests the web server 110.

  The web server 110 includes an authentication processing unit 111 for performing an authentication process when the communication terminal 140 makes a login request (corresponding to an “authentication request” of the present invention) to a predetermined website. The authentication processing unit 111 will be described later with reference to FIG.

  Although only one web server 110 is shown in FIG. 1, the authentication processing system 100 according to the first embodiment may include a plurality of web servers 110.

  The SNS server 120 is a general-purpose social networking service (hereinafter referred to as “SNS”) server. The SNS server 120 receives a message from an SNS application (described later) installed in the communication terminal 140 and transfers the message to a pre-registered communication partner (for example, referred to as “friend”) (that is, a message service). It has a function to perform.

  As an SNS message service, there is a service capable of not only message exchange between communication terminals but also message transmission / reception between a communication terminal and a server computer of a company or the like. As such a message service, for example, a talk function of LINE (registered trademark) which is an SNS provided by LINE Corporation is known, but a message service of another SNS may be used. As will be described later, in the authentication processing system 100 according to the first embodiment, the authentication auxiliary server 130 is registered as a partner (the above-mentioned “friend”) using the SNS message service.

  Instead of the SNS server 120, a general message service other than SNS may be used. Furthermore, instead of a general-purpose service, a dedicated message server may be provided in the authentication processing system 100 according to the first embodiment.

  The authentication auxiliary server 130 receives a message from the SNS server 120. Then, authentication identification information (described later) stored in the message body of this message and an application ID (corresponding to “message application identification information” of the present invention, which will be described later) included as accompanying information in this message are read. . Then, the authentication auxiliary server 130 specifies the transfer destination web server 110 (or the website operated by the web server 110) from the authentication identification information, and authenticates these to the web server 110 (or website). Identification information and application ID are transmitted.

  The communication terminal 140 is, for example, a personal computer, a mobile phone, a smartphone, or the like. In the first embodiment, the following two types of application software (simply referred to as “application” in the present application) are installed in the communication terminal 140.

  The first application is a browser application (see FIG. 5 described later). This browser application displays a website by executing a web display program acquired via a communication network such as the Internet. As this browser application, a general-purpose browser application can be used as it is.

  The second application is an SNS application (corresponding to the “message application” of the present invention, see FIG. 6 described later). The SNS application may be an application that can use the SNS provided by the SNS server 120 described above.

  As this SNS application, an application having a function of storing an application ID (corresponding to “message application identification information” of the present invention) in a transmission message and transmitting it together with the message body is used. Here, the application ID is identification information for distinguishing from the application installed in another communication terminal, and is different from the SNS user ID. This application ID is adopted in many general-purpose SNS applications (for example, LINE application). This application ID is stored in the message as accompanying information together with the message body when the SNS application generates a message.

  By using this application ID as “message application specifying information” of the present invention, an application distributed by a general-purpose SNS can be used as it is as a message application for the authentication processing system 100.

  The application ID is used for the purpose of improving security by allowing use of only the communication terminal registered in the SNS. For this reason, using an SNS for message transmission and using an application ID as “message application identification information” is also useful for improving the security of the authentication processing system 100.

  However, the “message application specifying information” of the present invention is not limited to the application ID. For example, information (such as a solid identification number or a MAC address) for specifying a mobile phone or a smartphone may be used, or a number / symbol string generated based on such specification information may be used. That is, any information that can identify the application (and hence the communication terminal) that transmitted the message can be adopted as the “message application identifying information” of the present invention.

  FIG. 2A is a block diagram schematically illustrating a functional configuration of the authentication processing unit 111 provided in the web server 110. As shown in FIG. 2A, the authentication processing unit 111 includes a browser authentication unit 201, an SNS authentication unit 202, an authentication identification information issuing unit 203, and a user information storage unit 204.

  FIG. 2B is a conceptual diagram showing user information stored in the user information storage unit 204. As shown in FIG. 2B, the user information storage unit 204 stores the user ID, password, and application ID of each registered user in association with each other.

  The browser authentication unit 201 performs normal authentication processing using a user ID and a password. That is, when the browser authentication unit 201 receives the user ID and password from the browser application of the communication terminal 140, the browser authentication unit 201 reads the password corresponding to the user ID from the user information storage unit 204. When the password of the browser application matches the password of the user information storage unit 204, the login request is permitted.

  The SNS authentication unit 202 performs an authentication process (hereinafter referred to as “SNS authentication”) using an SNS server 120 and authentication assistance described later. In this SNS authentication, the SNS authentication unit 202 receives authentication identification information and an application ID (described above) from the authentication auxiliary server 130. Then, the presence / absence of a user ID corresponding to the application ID is checked using the user information storage unit 204. When the user ID corresponding to the application ID exists, the SNS authentication unit 202 determines that the login request by the communication terminal 140 is for the user ID, and permits the login. On the other hand, when there is no user ID corresponding to the application ID, the SNS authentication unit 202 rejects the login request from the communication terminal 140. The detailed procedure of SNS authentication will be described later.

  The authentication identification information issuing unit 203 generates and issues authentication identification information when the browser application of the communication terminal 140 requests SNS authentication.

  This authentication identification information includes the following two types of information.

The first information is web server specifying information for specifying the web server 110 (or a corresponding website) provided with the authentication processing unit 111. In the first embodiment, the web server specifying information is an information value for uniquely specifying the web server 110 in advance. The authentication auxiliary server 130 determines a transmission destination of the authentication identification information and the application ID based on the web server specifying information.

  The second information is communication terminal specifying information for specifying the communication terminal 140 that has made a login request to the web server 110. That is, using the communication terminal specifying information, the above-described SNS authentication unit 202 specifies the communication terminal 140 that permits login. In this Embodiment 1, this communication terminal specific information is made into the information value produced | generated at random for every request | requirement of SNS authentication (thus differing for every request | requirement).

  In order to include two pieces of information in one personality identification information, for example, if a plurality of upper digits of a character string constituting the authentication identification information are set as web server specifying information and the remaining digits are set as communication terminal specifying information. Good, but other methods are acceptable.

  As will be described later, this authentication identification information is issued not only when SNS authentication is performed, but also when SNS authentication use registration is performed in advance. Further, as will be described later, this authentication identification information is incorporated by the web server 110 into a web display program for displaying an authentication screen on the browser application of the communication terminal 140 (described later).

  Hereinafter, the operation of the authentication processing system 100 according to the first embodiment will be described.

  First, the procedure for performing registration for use of SNS authentication will be described with reference to the sequence diagram of FIG. 3 and the conceptual diagram of FIG.

  In advance, the user of the communication terminal 140 accesses the web server 110 via the Internet or the like, and performs use registration for a desired website in a normal procedure. With this use registration, a user ID is issued to the user of the communication terminal 140. In the first embodiment, at the time of use registration, in addition to the user ID, a password for performing a similar login is issued.

  In addition, the user of the communication terminal 140 acquires and installs the SNS application in advance through the Internet or the like, and registers the use of the SNS.

  Thereafter, the user of the communication terminal 140 performs use registration of login authentication (that is, SNS authentication) using the authentication processing system 100 as follows.

  First, the user of the communication terminal 140 accesses the web server 110 with a browser application. And normal login using a user ID and a password is performed with respect to a predetermined website.

  Next, the user of the communication terminal 140 performs an operation for causing the browser application to display a registration setting screen for SNS authentication. By this operation, the communication terminal 140 accesses the web server 110 and requests a web display program for the registration setting screen of the SNS authentication (see S301 in FIG. 3). Then, the web display program is returned to the communication terminal 140 and displayed on the browser application (see S302 in FIG. 3). As shown in FIG. 5A, on this registration setting screen, authentication identification information for registering SNS authentication (herein referred to as “registration key”) 501 and an activation button for activating an SNS application 502 etc. are displayed. In this description, the SNS service (that is, “ABC”) is used, and the user name of the authentication auxiliary server 130 is “XYZ authentication service”.

  Here, when the user of the communication terminal 140 operates (clicks, taps, etc.) the start button 502 to start the SNS application, the SNS application includes the authentication assistant server 130 as the communication partner (the above-mentioned “friends”). The screen for registering in “)” is displayed.

  The user of the communication terminal 140 registers the friend of the authentication auxiliary server 130 on the startup screen of the SNS application (see S303 in FIG. 3). Then, a message transmission screen (that is, a screen for inputting a message body) of the SNS application is displayed, and a registration key 501 is input. At this time, of course, the registration key 501 may be input by a copy and paste operation of the communication terminal 140. Thereafter, the user of the communication terminal 140 transmits this message to the authentication auxiliary server 130 (that is, “XYZ authentication service”) (see S304 in FIG. 3). Then, the fact that this transmission has been performed is displayed on the screen of the SNS application (see FIG. 5B). As described above, the application ID of the SNS application is also stored in this message.

  This message is sent to the authentication assistant server 130 via the SNS server 120. When receiving the message, the authentication assistant server 130 reads the message body (that is, the registration key 501) and the application ID from the message.

  Then, the authentication assistant server 130 specifies the registration target web server 110 (or the website in the web server) from the web server identification information (described above) of the read registration key 501. Then, the authentication assistant server 130 transmits the registration key 501 and the application ID to the identified web server 110 (see S305 in FIG. 3).

  At this time, the authentication auxiliary server 130 may encrypt the application ID using an encryption algorithm such as a hash function, and then transmit it to the web server 110.

  The SNS authentication unit 202 of the web server 110 receives the registration key 501 and the application ID. Then, the communication terminal 140 corresponding to the communication terminal specifying information (described above) of the registration key 501 is specified. With this specification, the user ID corresponding to the registration key 501 can be specified. The SNS authentication unit 202 stores the application ID received together with the registration key 501 in the user information storage unit 204 in association with the user ID (see FIG. 2B).

  Here, when the authentication auxiliary server 130 encrypts the application ID and transmits it to the web server 110, the web server 110 may decrypt the encrypted application ID and store it in the user information storage unit 204. May be stored in an encrypted state.

  Thereafter, the web server 110 transmits a registration completion notification to the authentication auxiliary server 130 (see S306 in FIG. 3). Upon receiving this registration completion notification, the authentication auxiliary server 130 transmits a message indicating that registration of SNS authentication is completed to the communication terminal 140 (see S307 in FIG. 3 and FIG. 5C).

  As described above, use registration of login authentication (that is, SNS authentication) using the authentication processing system 100 is completed.

  Next, a procedure for performing SNS authentication will be described with reference to the sequence diagram of FIG. 4 and the conceptual diagram of FIG.

  First, the user of the communication terminal 140 performs an operation for accessing the web server 110 with a browser application. By this operation, the communication terminal 140 requests the web server 110 for a web display program for a login screen (see S401 in FIG. 4). Then, the web display program is returned to the communication terminal 140 and displayed on the browser application (see S402 in FIG. 4). As shown in FIG. 6A, the registration setting screen includes a user ID input field 601, a password input field 602, and a login button 603, as well as authentication identification information (here “Authentication”). 604), an activation button 605 for activating the SNS application, and the like are displayed.

  When the user of the communication terminal 140 logs in using the user ID and password, the user may input the user ID and password in the input fields 601 and 602 and then operate the login button 603.

  On the other hand, when it is desired to receive SNS authentication, the user of the communication terminal 140 operates the start button 605 to start the SNS application. It is desirable that the SNS application displays a message transmission screen at the time of activation. Further, it is desirable that the authentication auxiliary server 130 (that is, “XYZ authentication service”) is automatically set as the message transmission destination, and it is desirable that the authentication key 604 is automatically input in the message body. However, display of the message transmission screen, automatic setting of the message transmission destination, and automatic input of the authentication key 604 are not essential, and the user of the communication terminal 140 may operate.

  Thereafter, the user of the communication terminal 140 transmits this message to the authentication assistant server 130 (see S403 in FIG. 4). Then, the fact that this transmission has been performed is displayed on the screen of the SNS application (see FIG. 6B). As described above, the application ID of the SNS application is also stored in this message.

  When receiving the message, the authentication auxiliary server 130 reads the message body (that is, the authentication key 604) and the application ID from the message.

  Then, the authentication auxiliary server 130 specifies the registration target web server 110 (or a website in the web server) from the web server identification information (described above) of the read authentication key 604. Then, the authentication assistant server 130 transmits the authentication key 604 and the application ID to the identified web server 110 (see S404 in FIG. 4).

  At this time, the authentication auxiliary server 130 may encrypt the application ID using an encryption algorithm such as a hash function, and then transmit it to the web server 110.

  The SNS authentication unit 202 of the web server 110 receives the authentication key 604 and the application ID. Then, the SNS authentication unit 202 specifies the communication terminal 140 corresponding to the communication terminal specifying information (described above) of the authentication key 604. Also, the SNS authentication unit 202 searches the user information storage unit 204 for the same application ID as the received application ID.

  When the same application ID as the received application ID is stored in the user information storage unit 204, the SNS authentication unit 202 reads the user ID corresponding to the application ID from the user information storage unit 204. The SNS authentication unit 202 determines that the login request is a login request from a registered user corresponding to the read user ID. Then, the login request is permitted to the communication terminal 140 specified by the communication terminal specifying information of the authentication key 604 corresponding to the application ID.

  On the other hand, when the same application ID as the received application ID is not stored in the user information storage unit 204, the login request of the corresponding communication terminal 140 is rejected.

  When the application ID in the encrypted state is stored in the user information storage unit 204, the SNS authentication unit 202 may compare the application ID received from the authentication auxiliary server 130 without decrypting it. .

  Thereafter, the web server 110 transmits an authentication permission notification or an authentication rejection notification to the authentication auxiliary server 130 (see S406 in FIG. 3). Upon receiving this notification, the authentication auxiliary server 130 transmits a message indicating permission / denial of the login request to the communication terminal 140 (see S406 in FIG. 4 and FIG. 6C).

  As described above, login authentication using the authentication processing system 100 is completed.

  As described above, according to the first embodiment, when the browser application of the communication terminal 140 makes a login request to the website, the authentication key displayed on the authentication screen is transmitted as the message body of the message application. Thus, login authentication can be received, and therefore, login authentication can be received with a simple operation.

  Moreover, since login authentication is performed using the authentication identification information (registration key, authentication key) issued by the web server and the application ID stored in the SNS application, it is possible to ensure the same safety as the user ID and password. Further, the user of the communication terminal 140 does not need to make a note of the authentication identification information and application ID, and high security can be ensured in this respect as well.

  In addition, since two types of applications installed in one communication terminal 140 are used, it is not necessary for the user to have two devices.

  Furthermore, since a message is transmitted using a general-purpose social networking service, a message application dedicated for authentication is not required, and convenience for the user can be improved.

  Further, by providing the authentication auxiliary server 130 for the plurality of web servers 110, it is not necessary to set the message destination for each web server (or for each website), so that authentication is further facilitated.

  In addition, by encrypting the application ID with the authentication auxiliary server 130 and sending it to the web server 110, leakage of the application ID on the communication network can be prevented, and thus the safety can be further improved.

  Furthermore, by using the encrypted application ID for authentication as it is, the website operator can no longer know the application ID, so that leakage of the application ID can be prevented and safety can be further improved. .

  Also, by configuring the web display program for the authentication screen so that the authentication auxiliary server 130 is automatically set as the message transmission destination when the SNS application is activated or the authentication key 604 is automatically input in the message body, the login screen is configured. The operation for receiving authentication is further simplified.

  In the first embodiment, the web server 110 performs either one of SNS authentication and other authentication (here, user ID and password authentication). However, all of two or more types of authentication are communicated. Of course, it may be requested to the terminal 140.

  Further, in this Embodiment 1D, the authentication auxiliary server 130 is provided, but the authentication auxiliary server 130 is not essential. For example, when the message transmission destination (the above-mentioned “friend”) registered in the SNS server 120 is the web server 110, the authentication auxiliary server 130 is not necessary. In this case, the web server specifying information of the authentication information is not essential.

100 authentication processing system 110 web server 111 authentication processing unit 120 SNS server 130 authentication auxiliary server 140 communication terminal 201 browser authentication unit 202 SNS authentication unit 203 authentication identification information issuing unit 204 user information storage unit 501 registration key (authentication identification information)
502, 605 Start button 601, 602 Input field 603 Login button 604 Authentication key (authentication identification information)

In order to solve such a problem, the authentication processing system according to the invention of claim 1 is configured such that when the browser application of the communication terminal makes an authentication request to a predetermined website to the web server, the authentication request an authentication processing system for determining an authentication / fail authentication, the communication terminal, the message for transmitting a message and the message body and message application identification information is stored, by using the message service to the authentication assist server When an application is installed and the browser application of the communication terminal accesses the website and makes the authentication request, the web server of the website corresponding to the authentication request Or web specifying information for specifying the web server and the communication terminal that has made the authentication request An authentication screen to provide authentication identification information including a signal terminal identification information, is displayed on the browser application of the communication terminal, the communication terminal, using the message application, the written authentication identification information to the message body The authentication auxiliary server sends the authentication identification information and the message application identification information included in the received message to the web identification information of the authentication identification information. To the web server, and the web server corresponds to the communication terminal identification information of the received authentication identification information when the received message application identification information belongs to a website user registered in advance. The browser application of the communication terminal is authenticated.

The invention of claim 2 is an authentication processing system for judging authentication / non-authentication of an authentication request when a browser application of a communication terminal makes an authentication request for a predetermined website to a web server. The communication terminal is installed with a message application for transmitting a message storing a message body and message application specifying information to the web server using a message service, and the browser of the communication terminal When an application accesses the website and makes the authentication request, the web server of the website corresponding to the authentication request is a communication terminal for specifying the communication terminal that has made the authentication request An authentication screen that provides authentication identification information including specific information is displayed on the browser application of the communication terminal, and the communication terminal Using a message application, the message in which the authentication identification information is written in the message body is transmitted to the web server, and the web server stores the message application identification information included in the received message in advance. In the case of a website user, the browser application of the communication terminal corresponding to the communication terminal specifying information of the authentication identification information included in the received message is authenticated.

According to a third aspect of the present invention, in addition to the configuration of the first aspect, the authentication auxiliary server encrypts the message application specifying information with a predetermined encryption algorithm and transmits the encrypted information to the web server. The authentication request of the browser application is permitted when the message application specifying information encrypted by the predetermined encryption algorithm belongs to a website user registered in advance .

According to a fourth aspect of the present invention, in addition to the configuration according to any one of the first to third aspects, the message application is an application with a message transmission function for using a general-purpose social networking service. It is characterized by.

The invention according to claim 5 is an authentication auxiliary server used in the authentication processing system according to claim 1 or 3 .

According to the first and second aspects of the present invention, when an authentication request to a website is made by the browser application of the communication terminal, only authentication identification information displayed on the authentication screen is transmitted as a message body of the message application. The authentication can be received, and therefore the authentication can be performed with a simple operation.

Further, according to the first and second aspects of the invention, authentication is performed using the authentication identification information issued by the web server and the message application specifying information stored in the message application. Can be secured. Furthermore, the user of the communication terminal does not need to make a note of the authentication identification information and the message application specific information, and high security can be ensured in this respect.

In addition, according to the first and second aspects of the invention, since two types of applications installed in one communication terminal are used, the user does not need to own two devices.

According to the invention of claim 3, since the third party or the website operator cannot acquire the message application specific information, the leakage of the message application specific information can be prevented and the safety can be further improved.

According to the fourth aspect of the present invention, since a message is transmitted using a general-purpose social networking service, a message application dedicated for authentication is not required, and convenience for the user can be improved.

According to invention of Claim 5, the authentication auxiliary | assistant server which has the same effect as Claim 1 or 3 can be provided.

Claims (6)

An authentication processing system for determining authentication / non-authentication of an authentication request when a browser application of a communication terminal makes an authentication request to a predetermined website to a web server,
The communication terminal is installed with a message application that transmits a message in which a message body and message application identification information are stored,
When the browser application of the communication terminal accesses the website and makes the authentication request,
An authentication screen for providing authentication identification information for identifying the website and the communication terminal corresponding to the authentication request is displayed on the browser application;
Causing the message application of the communication terminal to transmit the message in which the authentication identification information is written in the message body;
Authenticating the browser application corresponding to the authentication identification information when the message application specific information stored in the message is of a previously registered website user;
An authentication processing system characterized by that.   The authentication processing system according to claim 1, wherein the message application is an application with a message transmission function for using a general-purpose social networking service. Receiving the message from the message app of the communication terminal, extracting the authentication identification information and the message app specifying information from the message;
From the authentication identification information, identify the website that is the target of the authentication request,
Transmitting the authentication identification information and the message application identification information to the web server corresponding to the identified website;
The authentication processing system according to claim 1, further comprising an authentication auxiliary server. The authentication auxiliary server encrypts the message application specific information with a predetermined encryption algorithm and transmits it to the web server,
The web server permits the authentication request of the browser application when the message application specific information encrypted by the predetermined encryption algorithm is a pre-registered website user;
The authentication processing system according to any one of claims 1 to 3, wherein   An authentication auxiliary server used in the authentication processing system according to claim 4.   The web display program which displays an authentication screen on the browser application of the communication terminal of the authentication processing system in any one of Claims 1 thru | or 4.

Images