JP2018206068A - Authentication device and authentication method - Google Patents

Abstract

To determine whether additional authentication is required without causing any burden on a user.SOLUTION: A storage unit 14 stores desktop screen information of a user terminal used by an authenticated user and predetermined statistical information based on the desktop screen information, in association with the user terminal. A calculation unit 15b acquires desktop screen information from a user terminal and calculates statistical information from the desktop screen information. A determination unit 15d compares the desktop screen information acquired from the user terminal or the calculated statistical information with the desktop screen information or the statistical information in the storage unit 14. When the desktop screen information match each other or the difference between the calculated statistical information and the statistical information in the storage unit 14 is less than a predetermined threshold value, it is determined that additional authentication of the user for the user terminal is unnecessary. When the desktop screen information do not match each other and the difference between the calculated statistical information and the statistical information in the storage unit 14 is equal to or greater than the threshold value, it is determined that additional authentication of the user for the user terminal is necessary.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an authentication device and an authentication method.

  In general, when a user repeats a wrong password at the time of authentication multiple times, there is a possibility of unauthorized access or spoofing. In order to prevent unauthorized access and spoofing, so-called risk-based authentication is performed at the time of authentication to evaluate the risk of unauthorized access and spoofing from information such as connection information to the user's network and perform additional authentication when the risk is high. (See Non-Patent Document 1). For example, an access from an environment or an IP address different from a normal one, an access from a distance away that should not be able to move in a short time, and the like are evaluated as having a high risk. In addition, as the connection information, an IP address, the type of OS or Web browser, and the like are used.

“Survey Report on Online Identity Authentication Method”, Information-technology Promotion Agency, Incorporated Administrative Agency, August 2014

  However, it is difficult to determine whether additional authentication is necessary from the connection information. That is, connection information such as the user's IP address, OS, or web browser type used for risk evaluation may be difficult to distinguish between a normal environment and an unusual environment. For example, when the IP address is dynamically assigned by DHCP (Dynamic Host Configuration Protocol), it cannot be distinguished. In addition, there are too few types of OSs and Web browsers for performing identity verification.

  The present invention has been made in view of the above, and an object of the present invention is to determine whether or not additional authentication is necessary without burdening the user.

  In order to solve the above-described problems and achieve the object, an authentication apparatus according to the present invention includes information on a desktop screen of a user terminal used by an authenticated user and predetermined statistical information based on the information on the desktop screen. A storage unit that stores the information in association with the user terminal, a calculation unit that acquires the information on the desktop screen from the user terminal, calculates the statistical information from the information on the desktop screen, and the information acquired from the user terminal The desktop screen information and the calculated statistical information are compared with the desktop screen information and the statistical information in the storage unit, and the statistical information in which the desktop screen information matches or is calculated and the statistical information in the storage unit If the difference is less than a predetermined threshold, it is determined that additional authentication of the user of the user terminal is unnecessary, and the information on the desktop screen is A determination unit that determines that additional authentication of the user of the user terminal is necessary when a difference between the statistical information that is coincident and calculated and the statistical information in the storage unit is greater than or equal to the threshold value. And

  According to the present invention, it is possible to determine whether or not additional authentication is necessary without burdening the user.

FIG. 1 is a schematic view illustrating a schematic configuration of an authentication system including an authentication apparatus according to an embodiment of the invention. FIG. 2 is an explanatory diagram for explaining an outline of processing performed by the authentication apparatus. FIG. 3 is a schematic diagram illustrating a schematic configuration of the authentication device. FIG. 4 is a diagram illustrating a data configuration of desktop information. FIG. 5 is a diagram illustrating a data configuration of statistical information. FIG. 6 is a sequence diagram showing an authentication processing procedure. FIG. 7 is a diagram illustrating a computer that executes an authentication program.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited by this embodiment. Moreover, in description of drawing, the same code | symbol is attached | subjected and shown to the same part.

[Configuration of authentication system]
First, a schematic configuration of an authentication system including an authentication apparatus according to the present embodiment will be described with reference to FIG. As illustrated in FIG. 1, the authentication system 1 includes a user terminal 2, a Web server 3, and an authentication device 10. In this authentication system 1, when a user accesses a web service site provided by the web server 3 using the user terminal 2, the authentication device 10 authenticates the user. When the user is authenticated, the Web server 3 starts providing a service to the user of the user terminal 2.

  When the authentication apparatus 10 authenticates the user, an authentication process described later is performed as risk assessment, and identity verification is performed to estimate that the user using the user terminal 2 is the same person as the previous access. Here, identity verification will be described with reference to FIG. As illustrated in FIG. 2, for example, among users who use the online bank service, Hanako Sato and Taro Suzuki have different types and arrangements of icons on the desktop of the user terminal 2.

  Therefore, in the present embodiment, the personality confirmation is performed using desktop information representing the type and arrangement of icons on the desktop screen of the user terminal 2 as an index of personality. For example, when it is estimated that the user is the same user as when the user registration is performed, the authentication device 10 determines that the additional authentication is unnecessary because the risk is low. In addition, when access from the user terminal 2 that is different from the time when the user registration is performed is confirmed and the identity is estimated to be the same user, it is determined that additional authentication is unnecessary.

[User terminal configuration]
Returning to the description of FIG. The user terminal 2 is realized by a personal computer, a tablet, a smartphone, or the like, and includes a communication unit and a control unit. The communication unit 2a is realized by a NIC (Network Interface Card) or the like, and communicates between an external device such as the Web server 3 and the authentication device 10 and a control unit via an electric communication line such as a LAN (Local Area Network) or the Internet. To control.

  The control unit functions as a desktop information acquisition unit 2b as illustrated in FIG. 1 by executing a processing program stored in a memory by an arithmetic processing unit such as a CPU (Central Processing Unit).

  The desktop information acquisition unit 2b collects desktop information including the name, type, and position of icons arranged on the desktop corresponding to the user by acquiring desktop screen information from the OS or performing desktop screen image recognition. To do.

[Web server configuration]
The Web server 3 is realized by a general-purpose computer such as a workstation or a personal computer, and includes a communication unit and a control unit. The communication unit 3a is realized by a NIC or the like, and controls communication between an external device such as the user terminal 2 or the authentication device 10 and a control unit via an electric communication line such as a LAN or the Internet.

  The control unit functions as a user registration unit 3b and a Web service providing unit 3c as illustrated in FIG. 1 by executing a processing program stored in a memory by an arithmetic processing unit such as a CPU.

  The user registration unit 3b sets authentication information such as an ID / password corresponding to the user and notifies the authentication apparatus 10 when the user uses the Web service for the first time. The web service providing unit 2c provides the web service to a user who has been successfully authenticated by the authentication information.

[Configuration of authentication device]
FIG. 3 is a schematic view illustrating a schematic configuration of the authentication device 10. As illustrated in FIG. 3, the authentication device 10 is realized by a general-purpose computer such as a workstation or a personal computer, and includes an input unit 11, an output unit 12, a communication unit 13, a storage unit 14, and a control unit 15.

  The input unit 11 is realized by using an input device such as a keyboard or a mouse, and inputs various instruction information such as processing start to the control unit 15 in response to an input operation by the operator. The output unit 12 is realized by a display device such as a liquid crystal display or a printing device such as a printer.

  The communication unit 13 is realized by a NIC or the like, and controls communication between an external device such as the IoT device 2 and the control unit 15 via an electric communication line such as a LAN or the Internet.

  The storage unit 14 is realized by a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk, and stores information used for authentication processing to be described later. . The storage unit 14 may be configured to communicate with the control unit 15 via the communication unit 13.

  In the present embodiment, the storage unit 14 stores information on the desktop screen of the user terminal 2 used by the authenticated user and predetermined statistical information based on the information on the desktop screen in association with the user terminal 2. Specifically, the storage unit 14 stores authentication information 14a, desktop information 14b, and statistical information 14c.

  The authentication information 14a is acquired from the Web server 3 and stored in the storage unit 14 in advance. As described above, the authentication information 14a includes authentication information such as an ID / password for each user who uses the Web service.

  The desktop information 14b stores desktop information acquired via the Web server 3 from the user terminal 2 used by the authenticated user in the authentication process described later. FIG. 4 is a diagram illustrating a data configuration of the desktop information 14b. As illustrated in FIG. 4, the desktop information 14 b includes user ID that is user identification information, device that is identification information of the user terminal 2, and information on each icon arranged on the desktop. The information of each icon includes a name, type, x coordinate, y coordinate, size, arrangement date, and last use date.

  In FIG. 4, the name (icon1_name) of the first icon (icon1) is Pic1.jpg, the type (icon1_type) is an image, the x coordinate (icon1_x coordinate) is 100, the y coordinate (icon1_y coordinate) is 100, and the size. It is exemplified that (icon1_size) is 50. In addition, FIG. 4 shows that the placement date (icon1_placement date) of the icon (icon1) is 20160303 (March 3, 2016) and the last use date (icon1_last use date) is 20160808 (August 8, 2016) ).

  The desktop information is acquired for each user terminal 2 when the user uses a plurality of user terminals 2. In addition, when the user uses one user terminal 2, the device of the desktop information 14b may be omitted.

  The statistical information 14 c is predetermined statistical information based on desktop information, is calculated from the desktop information in an authentication process described later, and is stored in the storage unit 14. FIG. 5 is a diagram illustrating a data configuration of the statistical information 14c. As illustrated in FIG. 5, the statistical information includes icon ID calculated from desktop information in addition to userID, which is user identification information, and device, which is identification information of the user terminal 2. The icon statistical information includes the number of icons (number of icons), the number of shortcuts, the average of the x coordinate of the icon, the average of the y coordinate, the variance of the x coordinate, the variance of the y coordinate, the number of icons placed by the user within one month, And the number of icons used by the user within a week. FIG. 5 illustrates, for example, that the number of icons is 32 and the number of shortcuts is 10.

  Note that when the number of user terminals 2 used by each user is one, the device of the desktop information 14b may be omitted.

  Returning to the description of FIG. The control unit 15 is implemented using a CPU or the like, and executes a processing program stored in a memory. Thereby, the control part 15 functions as the authentication part 15a, the calculation part 15b, the storage part 15c, and the determination part 15d so that it may illustrate in FIG. Note that these functional units may be implemented on different or different hardware. For example, the calculation unit 15b may be implemented in the Web server 3.

  The authentication unit 15a authenticates the user of the user terminal 2 that has accessed the Web server 3 using the authentication information. Specifically, when the authentication unit 15a receives the authentication information input by the user via the Web server 3, the authentication unit 15a refers to the authentication information 14a of the storage unit 14 and the authentication information corresponding to the user and the received authentication information. Match information. If the authentication information matches, it is determined that the authentication is successful.

  The calculation unit 15b acquires information on the desktop screen from the user terminal 2 used by the authenticated user, and calculates predetermined statistical information from the information on the desktop screen. Specifically, the calculation unit 15b acquires the desktop information of the user terminal 2 transmitted via the Web server 3 when the authentication information verified by the authentication unit 15a matches. Further, the calculation unit 15b uses the obtained desktop information, and uses the number of icons, the number of shortcuts, the average and variance of the x-coordinate and y-coordinate, the number of icons arranged within one month, and within one week. Predetermined statistical information such as the number of icons is calculated.

  The storage unit 15 c stores the acquired desktop screen information and the calculated statistical information in the storage unit 14 in association with the user terminal 2. Specifically, the storage unit 15 c stores the desktop information acquired by the calculation unit 15 b in the desktop information 14 b of the storage unit 14. The storage unit 15 c stores the statistical information calculated by the calculation unit 15 b in the statistical information 14 c of the storage unit 14.

  The determination unit 15d compares the desktop screen information and the calculated statistical information acquired from the user terminal 2 with the desktop screen information and statistical information in the storage unit 14, and the statistical information in which the desktop screen information matches or is calculated. And the statistical information in the storage unit 14 are less than a predetermined threshold value, it is determined that additional authentication of the user of the user terminal 2 is unnecessary. The determination unit 15d needs additional authentication of the user of the user terminal 2 when the information on the desktop screen is inconsistent and the difference between the calculated statistical information and the statistical information in the storage unit 14 is equal to or greater than the threshold. judge.

  Specifically, the determination unit 15d collates the acquired desktop information with the desktop information corresponding to the user terminal 2 in the desktop information 14b of the storage unit 14. If the two match, the determination unit 15d regards the access from the same user terminal 2 by the same user, and determines that additional authentication is unnecessary.

  The determination unit 15d corresponds to the user terminal 2 of the statistical information calculated by the calculation unit 15b and the statistical information 14c of the storage unit 14 when the acquired desktop information and the desktop information of the storage unit 14 do not match. Check against statistical information. When the difference between the two is less than the predetermined threshold, the determination unit 15d regards the access as the same user, and determines that additional authentication is unnecessary.

  On the other hand, when the difference between the acquired statistical information and the statistical information stored in the storage unit 14 is equal to or greater than a predetermined threshold, the determination unit 15d determines that additional authentication is necessary because the risk of access by a different user is high. To do.

  When the determination unit 15d determines that additional authentication is unnecessary, the storage unit 15c stores the current desktop information acquired from the user terminal 2 and the corresponding statistical information in the desktop information 14b of the storage unit 14. At this time, the storage unit 15c may overwrite and store the desktop information 14b. When the desktop information is accumulated, the determination unit 15d determines using the latest desktop information.

  Alternatively, when the desktop information at a plurality of points in time is stored in the desktop information 14b of the storage unit 14 for the same user and user terminal 2, the determination unit 15d changes the value of the statistical information calculated from the desktop information. The necessity of additional authentication may be determined using the width of. For example, the determination unit 15d may determine that additional authentication is necessary when the difference between the acquired statistical information and the statistical information in the storage unit 14 is larger than the width of the change.

  The determination unit 15d notifies the determination result to the Web server 3. When notified of the determination result that the additional authentication is unnecessary, the Web server 3 starts a Web service for the user of the user terminal 2. When the determination result that the additional authentication is unnecessary is notified, the Web server 3 may perform simple authentication instead of the normal additional authentication.

  When notified of the determination result that additional authentication is required, the Web server 3 outputs a screen requesting input of authentication information for performing additional authentication to the user terminal 2. In that case, the Web server 3 transmits the authentication information input from the user terminal 2 to the authentication device 10. In the authentication device 10, the authentication unit 15a refers to the authentication information 14a in the storage unit 14, and collates the authentication information corresponding to this user with the received authentication information. If the authentication information matches, the authentication unit 15a determines that the additional authentication of the user has been successful, and notifies the Web server 3 of it. The web server 3 starts a web service for the user of the user terminal 2.

  Note that the authentication information used for the additional authentication may be the same as or different from the authentication information used for the previous authentication by the authentication unit 15a. Any authentication information is stored in the authentication information 14a in advance in association with the user.

[Authentication process]
Next, with reference to FIG. 6, the authentication process by the authentication device 10 according to the present embodiment will be described. FIG. 6 is a sequence diagram showing an authentication processing procedure. The sequence diagram of FIG. 6 is started, for example, at the timing when the user accesses the website using the user terminal 2 (step S1). When accessing the Web site, the user terminal 2 transmits the authentication information input by the user and the desktop information acquired by the desktop information acquisition unit 2 b to the Web server 3.

  In the authentication device 10, the authentication unit 15a collates the authentication information transferred from the Web server 3 with the authentication information corresponding to this user in the authentication information 14a of the storage unit 14 (step S2). To the Web server 3 (step S3). In this case, the Web server 3 transmits a request for determining whether or not additional authentication is necessary with the desktop information of the user terminal 2 added to the authentication device 10 (step S4).

  Upon receiving the desktop information of the user terminal 2, the authentication device 10 refers to the desktop information 14b in the storage unit 14, and collates the previous desktop information of the user terminal 2 with the desktop information received this time (step S5).

  If the previous desktop information matches the current desktop information, or if the difference in statistical information calculated from each desktop information is less than a predetermined threshold, the authentication device 10 determines that additional authentication is unnecessary, The web server 3 is notified (step S6). In this case, the web server 3 starts providing web services to the user of the user terminal 2 (step S7).

  On the other hand, the previous desktop information does not match the current desktop information, and the difference between the statistical information calculated from the previous desktop information and the statistical information calculated from the current desktop information is greater than or equal to a predetermined threshold. In this case, the authentication device 10 determines that additional authentication is necessary, and notifies the Web server 3 (step S8). In this case, the Web server 3 outputs to the user terminal 2 a screen requesting the user terminal 2 to input authentication information necessary for additional authentication (step S9).

  The Web server 3 transfers the authentication information input from the user terminal 2 to the authentication device 10 (Step S10). The authentication device 10 refers to the authentication information 14a in the storage unit 14 and collates the authentication information corresponding to this user with the received authentication information (step S11). If the authentication information matches, the authentication apparatus 10 determines that the additional authentication of the user has been successful and notifies the Web server 3 (step S12). The web server 3 starts a web service for the user of the user terminal 2 (step S13).

  On the other hand, if the authentication information does not match, the authentication device 10 determines that the additional authentication of the user has failed and notifies the Web server 3 (step S14). The Web server 3 notifies the user terminal 2 that the authentication fails and the Web service cannot be provided (step S15).

  As described above, in the authentication device 10 of the present embodiment, the storage unit 14 stores the desktop information of the user terminal 2 used by the authenticated user and the predetermined statistical information based on the desktop information. 2 is stored in association with each other. In addition, the calculation unit 15b acquires desktop information from the user terminal 2 and calculates predetermined statistical information from the desktop information.

  Further, the determination unit 15d compares the desktop information acquired from the user terminal 2 and the calculated statistical information with the desktop information and statistical information in the storage unit 14, and the statistical information in which the desktop information matches or is calculated and the storage unit 14 If the difference from the statistical information is less than a predetermined threshold, it is determined that additional authentication of the user of the user terminal 2 is unnecessary. The determination unit 15d determines that additional authentication of the user of the user terminal 2 is necessary when the desktop information does not match and the difference between the calculated statistical information and the statistical information in the storage unit 14 is equal to or greater than the threshold. . This makes it possible to determine whether or not additional authentication is necessary without burdening the user.

[program]
It is also possible to create a program in which processing executed by the authentication device 10 according to the above embodiment is described in a language that can be executed by a computer. As an embodiment, the authentication device 10 can be implemented by installing an authentication program for executing the above-described authentication processing as package software or online software on a desired computer. For example, the information processing apparatus can function as the authentication apparatus 10 by causing the information processing apparatus to execute the authentication program. The information processing apparatus referred to here includes a desktop or notebook personal computer. In addition, the information processing apparatus includes mobile communication terminals such as smart phones, mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDA (Personal Digital Assistants).

  The authentication device 10 can also be implemented as a server device that uses a terminal device used by a user as a client and provides the client with a service related to the authentication processing. For example, the authentication device 10 is implemented as a server device that provides an authentication processing service that receives desktop information of the user terminal 2 and outputs a determination as to whether additional authentication is necessary. In this case, the authentication device 10 may be implemented as a Web server, or may be implemented as a cloud that provides a service related to the above-described authentication processing by outsourcing. Hereinafter, an example of a computer that executes an authentication program that realizes the same function as the authentication device 10 will be described.

  FIG. 7 is a diagram illustrating an example of a computer that executes an authentication program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. For example, a mouse 1051 and a keyboard 1052 are connected to the serial port interface 1050. For example, a display 1061 is connected to the video adapter 1060.

  Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each table described in the above embodiment is stored in the hard disk drive 1031 or the memory 1010, for example.

  Further, the authentication program is stored in the hard disk drive 1031 as a program module 1093 in which a command executed by the computer 1000 is described, for example. Specifically, a program module 1093 describing each process executed by the authentication device 10 described in the above embodiment is stored in the hard disk drive 1031.

  Data used for information processing by the authentication program is stored as program data 1094 in, for example, the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 to the RAM 1012 as necessary, and executes the above-described procedures.

  Note that the program module 1093 and the program data 1094 related to the authentication program are not limited to being stored in the hard disk drive 1031, but are stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1041 or the like. May be. Alternatively, the program module 1093 and the program data 1094 related to the authentication program are stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network) and read by the CPU 1020 via the network interface 1070. May be.

  As mentioned above, although embodiment which applied the invention made | formed by this inventor was described, this invention is not limited with the description and drawing which make a part of indication of this invention by this embodiment. That is, other embodiments, examples, operational techniques, and the like made by those skilled in the art based on this embodiment are all included in the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Authentication system 2 User terminal 3 Web server 10 Authentication apparatus 11 Input part 12 Output part 13 Communication part 14 Storage part 14a Authentication information 14b Desktop information 14c Statistical information 15 Control part 15a Authentication part 15b Calculation part 15c Storage part 15d Determination part

Claims (5)

A storage unit that stores information on a desktop screen of a user terminal used by an authenticated user and predetermined statistical information based on the information on the desktop screen in association with the user terminal;
Obtaining the desktop screen information from the user terminal, and calculating the statistical information from the desktop screen information;
The desktop screen information obtained from the user terminal and the calculated statistical information are collated with the desktop screen information and the statistical information in the storage unit, and the statistical information with which the desktop screen information matches or is calculated and the statistical information When the difference between the statistical information in the storage unit is less than a predetermined threshold, it is determined that the additional authentication of the user of the user terminal is unnecessary, and the statistical information that is calculated when the desktop screen information does not match and the storage unit A determination unit that determines that additional authentication of the user of the user terminal is necessary when a difference from the statistical information is equal to or greater than the threshold value;
An authentication device comprising: A storage unit that stores the information on the desktop screen acquired by the calculation unit and the calculated statistical information in the storage unit in association with the user terminal;
The authentication apparatus according to claim 1, further comprising:   The determination unit, for the same user and user terminal, when the information on the desktop screen at a plurality of points in time is stored in the storage unit, the range of change in the value of the statistical information calculated from the information on the desktop screen The authentication apparatus according to claim 1, wherein whether or not additional authentication of the user of the user terminal is necessary is determined using. The information on the desktop screen includes the name, type, icon x-coordinate, y-coordinate, size, placement date, and last use date of the icon placed on the desktop screen of the user terminal,
The statistical information includes the number of icons, the number of shortcuts, the average of the x coordinates of the icons, the average of the y coordinates, the variance of the x coordinates, the variance of the y coordinates, the number of icons arranged within one month, and within one week. The authentication apparatus according to any one of claims 1 to 3, further comprising a number of icons used. An authentication method executed by an authentication device,
The authentication device includes a storage unit that stores information on a desktop screen of a user terminal used by an authenticated user and predetermined statistical information based on the information on the desktop screen in association with the user terminal,
Obtaining desktop screen information from the user terminal and calculating predetermined statistical information from the desktop screen information;
The desktop screen information obtained from the user terminal and the calculated statistical information are collated with the desktop screen information and the statistical information in the storage unit, and the statistical information with which the desktop screen information matches or is calculated and the statistical information When the difference between the statistical information in the storage unit is less than a predetermined threshold, it is determined that the additional authentication of the user of the user terminal is unnecessary, and the statistical information that is calculated when the desktop screen information does not match and the storage unit A determination step of determining that additional authentication of the user of the user terminal is necessary when a difference from the statistical information is equal to or greater than the threshold value;
The authentication method characterized by including.

Images