JP2018036801A - Information processing apparatus, information processing method, and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To appropriately address a change in authentication state of an authentication device or an authentication method.SOLUTION: An information processing apparatus for performing authentication of a user comprises: first storage means that stores an authentication state indicating the state of the information processing apparatus or an authentication method; second storage means that holds association information in which an authentication state and processing on authentication are associated with each other; and processing means that, when the authentication state is determined to have been changed, performs the processing on authentication on the basis of the association information.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an information processing apparatus, an information processing method, and a computer program for authenticating a user.

  As a technique for identifying a user who logs in to a remote system, user authentication using a user ID and a password is widely used. On the other hand, in recent years, a user authentication technique using public key cryptography has been proposed in order to avoid complicated password management for the user.

  As an example of a user authentication technique using public key cryptography, there is a standard technique based on FIDO (Fast Identity Online) (Non-patent Document 1). According to the authentication protocol standardized by FIDO, a user authentication key pair is generated at a login terminal operated by the user, and the public key of the authentication key pair is registered in the remote service. When the user logs in to the remote service, a signature is generated with the secret key of the authentication key pair in response to the challenge sent from the service and sent back to the service.

  The service verifies the signature for the challenge with the public key associated with the user, and determines whether login is possible. The authentication key pair managed by the login terminal is managed by an authentication device such as fingerprint authentication, and the authentication device normally confirms an operation by a legitimate user and permits a signature with a secret key.

  On the other hand, a technique related to selection of an authentication device when a plurality of authentication devices are provided for a login terminal using such a public key has been proposed. For example, in Patent Document 1, the environment in which the terminal is placed is detected by using a sensor, and the user's convenience is improved by automatically selecting an authentication method suitable for the environment based on the evaluation result. Is disclosed.

FIDO UAF Protocol Specification v1.0 (https://fidalignance.org/)

JP2015-90589A

  However, in the technique disclosed in Patent Document 1, it is assumed that an authentication device and an authentication method that can be used in a login terminal are fixed. In reality, however, there are cases where the authentication state is changed by adding or discarding an authentication device or releasing a more secure authentication method. If these are not appropriately handled, there is a possibility that an authentication process using the added authentication device cannot be performed, or a more secure authentication method cannot be used.

  The present invention has been made in view of the above problems, and an object thereof is to appropriately cope with a change in an authentication state of an authentication device or an authentication method.

The present invention is an information processing apparatus for authenticating a user, and corresponds to a first storage unit that stores an authentication state indicating the state of the information processing apparatus or an authentication method, and an authentication state and processing related to authentication. A second storage unit that holds the attached correspondence information; and a processing unit that performs processing related to authentication based on the correspondence information when it is determined that the authentication state has changed.

  ADVANTAGE OF THE INVENTION According to this invention, it can respond appropriately with respect to the change of the authentication state of an authentication device or an authentication system.

It is a figure explaining the hardware constitutions of information processing apparatus. It is a figure explaining the functional composition of an information processor. It is a figure explaining an authentication state. It is a figure explaining the processing flow of information processing apparatus.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(First embodiment)
<Hardware configuration of information processing device>
An information processing apparatus that can be applied to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram showing a basic configuration of an information processing apparatus applicable to the present embodiment. In the figure, the information processing apparatus 100 can store data in an HD 105, a CD 106, a DVD 107, and the like. In addition, the accumulated data can be displayed on the monitor 101. Further, these data can be distributed via the Internet or the like by using the NIC 108 or the like. In addition, various instructions from the user are performed by input from the pointing device 110 and the keyboard 111. Inside the information processing apparatus 100, blocks to be described later are connected by a bus 112, and various data can be transferred.

  The monitor 101 is a monitor that can display various information from the information processing apparatus 100. The CPU 102 is a CPU that can control the operation of each unit in the information processing apparatus 100 or execute a program loaded in the RAM 104. The ROM 103 is a ROM that stores a BIOS and a boot program. The RAM 104 is a RAM that temporarily stores programs and data to be processed for processing by the CPU 102, and is loaded with programs for the OS and the CPU 102 to perform various processes described later. The HD 105 is a hard disk (HD) used for storing an OS or program transferred to a RAM or the like, or for storing or reading data while the apparatus is operating. The CD 106 is a CD-ROM drive that can read or write data stored in a CD-ROM (CD-R, CD-R / W, etc.) that is one of external storage media. The DVD 107 is also a DVD-ROM (DVD-RAM) drive capable of reading from the DVD-ROM and writing to the DVD-RAM, as with the CD 106. When programs are stored in a CD-ROM, DVD-ROM, etc., these programs are installed in the HD 105 and transferred to the RAM 104 as necessary. The I / F 109 is an I / F for connecting the information processing apparatus 100 to the NIC 108 that connects data stored in the RAM 104, the HD 105, the CD 106, the DVD 107, and the like to a network such as the Internet. The information processing apparatus 100 transmits data to the Internet or receives data from the Internet via the I / F 109. The I / F 109 is an I / F for connecting the pointing device 110 and the keyboard 111 to the information processing apparatus 100, and various instructions input from the pointing device 110 and the keyboard 111 via the I / F 109 are input to the CPU 102. Entered. Further, by connecting an authentication device 113 having an authentication function such as biometric authentication to the I / F 109, data can be transmitted to and received from the authentication device 113. For example, the authentication device 113 is a USB dongle having a fingerprint authentication function. The information processing apparatus 100 can be realized by supplying a program for executing processing to be described later to, for example, a digital camera, printer, network camera, smartphone, PC (personal computer), or the like, which is an IoT device.

  Heretofore, the hardware configuration of the information processing apparatus applicable to the present embodiment has been described.

<Functional configuration of information processing apparatus>
Next, the functional configuration of the information processing apparatus 100 that can be applied to the present embodiment will be described with reference to FIG. As illustrated in FIG. 2, the information processing apparatus 100 according to the present embodiment includes an input unit 201, an acquisition unit 202, a comparison unit 203, a processing determination unit 204, a processing unit 205, an output unit 206, a first storage unit 207, a second The storage unit 208 is configured. The information processing apparatus 100 is connected to the server 200 via a NIC 108 via a wired or wireless communication line and can communicate data with each other. The hardware configuration of the information processing apparatus 100 described above can also be applied to the server 200. For example, a PC having a server function can be used.

  In this system, the service provided by the server 200 authenticates the user of the information processing apparatus 100 and provides the service to a legitimate user through the information processing apparatus 100. For example, the server 200 provides financial services such as online banks and securities companies, and services for purchasing and selling products. In such a service, it is necessary to correctly authenticate the user to be used and implement appropriate access control.

  The input unit 201 receives an instruction from the user through an input unit such as the pointing device 110 or the keyboard 111. The input unit 201 receives an authentication result and a first authentication state from the authentication device 113. Here, an authentication device applicable to the present embodiment will be described. The authentication device 113 is a device that has an authentication function and authenticates a user in response to an authentication request from the information processing apparatus 100. As long as the authentication function is used, an authentication method such as fingerprint authentication or face authentication may be used, or an authentication method using a password or an IC card may be used. In this embodiment, the authentication device 113 is described as a device different from the information processing apparatus 100, but the information processing apparatus 100 may have the function of the authentication device 113. Further, the function of the authentication device 113 may be held in the information processing apparatus 100 as software. Here, the authentication result is a result of user authentication in the authentication device 113, and indicates information such as authentication success or authentication failure, for example. The first authentication status is information indicating the status of the authentication device 113 or the authentication means provided by the authentication device 113, for example. Specifically, it is information such as whether or not the authentication device 113 is connected to the information processing apparatus 100 and whether or not the authentication device 113 can be used. In the present embodiment, the first authentication state is described as the above-described information. However, information such as time information, position information, or vulnerability may be used as long as the information is used for authentication of the authentication device 113. The input unit 201 receives information such as a registration / authentication request and priority information from the server 200. Here, a registration / authentication request and priority information input from the server 200 will be described. First, the registration / authentication request will be described. The registration / authentication request is a request in which a user registers in advance an authentication device 113 or an authentication method that can be used in a service provided by the server 200 or requests user authentication. Next, priority information will be described. The priority information is information to which a priority with respect to the authentication method requested by the server 200 to the information processing apparatus 100 is given. As shown in FIG. 3 (b), for example, in order from the authentication method with the highest priority, priority is given to the authentication method, such as fingerprint authentication and multiple authentication of passwords, second authentication only, and third authentication only. The degree is given. In this embodiment, the priority information is described as a combination of fingerprint authentication, password, and vocal cord authentication as an authentication method. However, if the information can authenticate the user, for example, an authentication method using a password or an IC card is used. Also good. The input unit 201 outputs the first authentication state and priority information as described above to the acquisition unit 202. The authentication result is output to the output unit 206 as a processing result.

  Next, the functional configuration of the information processing apparatus 100 will be described. In the figure, the acquisition unit 202 acquires the first authentication state from the input unit 201 and outputs it to the comparison unit 203. The acquisition unit 202 is, for example, an authentication device that can acquire information of the corresponding authentication device 113 and can be newly used when authentication-related software bundled with the authentication device 113 is installed in the information processing apparatus 100. Recognize. Similarly, when the bundled software related to authentication is uninstalled, information on the authentication device that the corresponding authentication device is no longer necessary is acquired. As described above, the acquisition unit 202 acquires the state of the authentication device that can be used by the information processing apparatus 100, adds the state to the first authentication state, and outputs the first authentication state to the comparison unit 203. The comparison unit 203 receives the first authentication state from the acquisition unit 202 and the second authentication state from the first storage unit 207, compares them, and outputs the comparison result to the processing determination unit 204. At the same time as outputting the comparison result, the first authentication state is output to the first storage unit 207 to update the authentication state of the information processing apparatus 100 to the latest state. Here, the second authentication state will be described. The second authentication state is information indicating the state of the authentication unit when the user authentication is finally performed in the information processing apparatus 100. The second authentication state includes, for example, the type of authentication device that can be used by the information processing apparatus 100 and the authentication method that can be used by the authentication device 113 as shown in FIG. Similarly, priority information is included as shown in FIG. In the present embodiment, the first authentication state and the second authentication state will be described as the authentication device type, authentication method, and priority information. However, for example, information related to an authentication unit such as time information, position information, and information of an application bundled with a device can be used without being limited to these information. The comparison unit 203 compares the first authentication state with the second authentication state. The comparison means, for example, whether a new authentication device can be used, or conversely, an authentication device that has been available so far cannot be used because it is not connected. In addition, it is confirmed whether or not the priority information provided from the server 200 has been changed. The comparison unit 203 outputs the result to the process determination unit 204 as a comparison result. In this embodiment, it demonstrated by the content mentioned above as a comparison result. However, for example, information provided from the server 200 such as time, location, version of the authentication device, and vulnerability, or information acquired from the authentication device 113 can be used for user authentication. It can be used without limitation. In addition, as the latest authentication state, the first authentication state is output to the first storage unit, and the second authentication state is updated. In this way, by updating the second authentication state to the latest state, it becomes possible to select an optimal authentication device and authentication method in the subsequent user authentication.

  The process determination unit 204 determines a process based on the comparison result from the comparison unit 203 and the determination criterion (corresponding information) in the second storage unit 208 and outputs the determined process content to the processing unit 205. Here, the second storage unit will be described. The second storage unit stores a determination criterion that defines processing related to authentication according to the comparison result. The determination criterion is defined as information as shown in FIG. In FIG. 2C, as the comparison result, processing according to the comparison result, such as change of priority information and increase / decrease of authentication devices, is defined. For example, when the priority information is changed and the authentication device cannot be used, the authentication unit adapted to the priority information is presented, the DL or introduction of another authentication unit is presented, and the registration deletion to the server 200 is performed. Processing such as presenting a request or warning / message to the user is performed. As for the processing to be performed, the user may be able to select a plurality of presented ones, or the processing may be prioritized by giving priority to the processing. Alternatively, all the associated processes may be performed. In the present embodiment, the processing content has been described as the processing described above. For example, if the authentication device 113 has a vulnerability, the authentication device 113 may be updated if the processing is related to user authentication. It is possible to use without limiting to. Further, in the present embodiment, the determination criterion is described as a process defined in advance in the information processing apparatus 100. However, if it is possible to define a process related to the comparison result, for example, the user adds a process content and the comparison result And the relationship between the processing contents and the processing content may be selected. In this way, by comparing the first authentication state and the second authentication state, it is possible to provide more appropriate user authentication. That is, until now, if the authentication device with high priority requested by the server 200 is not held and an authentication method with low priority is used, an authentication device can be newly purchased. There was no function that automatically changed or presented the authentication method. In addition, when an authentication device used so far fails or is discarded, the authentication information registered in the server 200 needs to be discarded. Even in such a case, the conventional methods require that the user intentionally discard the authentication information, and there is no function that automatically performs and presents the processing. In the present embodiment, it is possible to determine such a change from the comparison result and provide appropriate processing. The process determination unit 204 determines a process using the determination criteria defined in the second storage unit and the comparison result input from the comparison unit 203 by the method described above, and outputs the process to the processing unit 205. . The processing unit 205 performs the processing input from the processing determination unit 204 and outputs the processing result to the output unit 206. The output unit 206 outputs a message to the user, displays an instruction for prompting processing, or executes a processing request to the server 200 according to the processing result input from the processing unit 205. Further, the authentication result input from the input unit 201 is output to the server 200. Furthermore, a registration / authentication request is made to the authentication device 113 according to the processing content of the processing unit 205.

  The functional configuration of the information processing apparatus 100 that can be applied to the present embodiment has been described above.

<Processing flow of information processing apparatus>
Next, an information processing flow applicable to the present embodiment will be described with reference to FIG. The following flow is realized as software (computer program) on the information processing apparatus 100 described above. Each step is realized by the corresponding program and the CPU 102 executing the program.

  The information processing apparatus 100 accesses the server 200 to use the service (S401). When the information processing apparatus 100 accesses the server 200, the server 200 makes a registration / authentication request, and the information processing apparatus 100 receives the registration / authentication request (S402). When the registration / authentication request is received, priority information included in the registration / authentication request is acquired (S403). Next, the first authentication state is acquired from the authentication device 113 connected to the information processing apparatus 100, application information bundled with the authentication device 113, or the like (S404). Further, the second authentication state held in the information processing apparatus 100 is acquired (S405). When the first authentication state and the second authentication state are acquired, the acquired first authentication state is compared with the second authentication state (S406). As a result of the comparison, if there is a change between the first authentication state and the second authentication state (YES in S407), a determination criterion is acquired (S408). When there is no change (NO in S407), a conventional process is performed (S410). When the comparison result is acquired, the process is determined based on the comparison result and the criterion (S409), and the determined process is performed (S410). The information processing flow of the information processing apparatus 100 in the present embodiment has been described above.

  As described above, according to the present embodiment, it is possible to select an appropriate authentication unit according to the status of the authentication device and authentication method that can be used in the login terminal.

(Other examples)
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program This process can be realized. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

Claims (8)

An information processing apparatus for authenticating a user,
First storage means for storing an authentication state indicating the state of the information processing apparatus or the authentication method;
A second storage means for holding correspondence information in which an authentication state and processing related to authentication are associated;
An information processing apparatus comprising: processing means for performing processing related to authentication based on the correspondence information when it is determined that the authentication state has changed.   The information processing apparatus according to claim 1, wherein the processing unit presents a plurality of processes performed by the processing unit to the user, and performs a process selected by the user from the presented processes.   The processing means determines that the authentication state has changed when authentication-related software is installed in the authentication device or when authentication-related software is uninstalled from the authentication device. 3. The information processing apparatus according to any one of 2 above.   4. The information according to claim 1, wherein the processing unit determines that the authentication state has changed when a change in priority of an authentication method is received from a server that performs authentication. 5. Processing equipment.   The said processing means displays the warning with respect to the said user, when it is judged that the number of the information processing apparatuses for authenticating the said user has decreased. The information processing apparatus described.   The processing means, when it is determined that the number of information processing apparatuses for authenticating the user has increased, displays a message prompting the user to register the authentication means. The information processing apparatus according to any one of 1 to 5. An information processing method for authenticating a user,
A first storage step for storing an authentication state indicating a state of the information processing apparatus or the authentication method;
A second storage step in which a second storage unit holds correspondence information in which an authentication state and a process related to authentication are associated;
An information processing method comprising: a processing step that performs processing related to authentication based on the correspondence information when it is determined that the authentication state has changed. Computer
An information processing apparatus for authenticating a user,
First storage means for storing an authentication state indicating the state of the information processing apparatus or the authentication method;
A second storage means for holding correspondence information in which an authentication state and processing related to authentication are associated;
A computer program for functioning as an information processing apparatus, comprising: processing means for performing processing relating to authentication based on the correspondence information when it is determined that the authentication state has changed.

Images