JP2019062394A - Information processing apparatus, information processing method, and computer program - Google Patents

Abstract

To provide an information processing apparatus capable of improving security by properly using a plurality of authentication key pairs.SOLUTION: The information processing apparatus for logging in to a service providing apparatus using a plurality of authentication key pairs, includes: communication means for communicating with a plurality of requests to the service providing apparatus and a plurality of responses from the service providing apparatus; setting means for setting a plurality of security classes according to types of the plurality of requests; and restricting means for restricting use of at least one of the plurality of authentication key pairs for communication of a request corresponding to at least one of the plurality of security classes.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing apparatus for logging in to a service providing apparatus, an information processing method, and a computer program.

  As a technique for identifying a user who logs in to a remote system, user authentication by user ID and password is widely used. On the other hand, in recent years, a user authentication technology using public key encryption has been proposed as a means for avoiding complicated password management by the user.

  As an example of user authentication technology using public key encryption, there is a standard technology by FIDO (Fast Identity Online). According to the authentication protocol standardized by FIDO, an authentication key pair of the user is generated at the login terminal operated by the user, and the public key of this authentication key pair is registered in the remote service. When the user logs in to the remote service, a signature is generated using the secret key of the authentication key pair and sent back to the service in response to a challenge sent from the service. The service verifies the signature on the challenge with the public key associated with the user, and determines whether login is possible. The authentication key pair managed by the login terminal is managed by an authentication device such as fingerprint authentication, and the authentication device usually approves a signature by a secret key after confirming an operation by a valid user.

  On the other hand, there has been proposed a technique related to selection of an authentication device in the case where a plurality of authentication devices are provided in a login terminal using such a public key. For example, according to the technology disclosed in Patent Document 1, the anonymity of the user is improved by providing the login terminal with a function for setting the availability of the authentication device.

Japanese Patent Application Publication No. 2016-502373

  When the login terminal is provided with a plurality of authentication devices, it is possible to improve security by properly using authentication devices used by the user. For example, in terms of security, it is desirable that the authentication key pair used when logging in to the remote service and the authentication key pair used to permit remittance on the service are different key pairs. However, in the prior art, in the login terminal, each of the plurality of authentication key pairs could not be properly used properly. The present invention has been made in view of the above problems, and an object of the present invention is to provide an information processing apparatus capable of properly using a plurality of authentication key pairs and improving security.

  The present invention is an information processing apparatus for logging in to a service providing apparatus using a plurality of authentication key pairs, and communication means for communicating by using a plurality of requests for the service providing apparatus and a plurality of responses from the service providing apparatus. And setting means for setting a plurality of security classes according to types of the plurality of requests, and communication of requests corresponding to at least one of the plurality of security classes with at least one of the plurality of authentication key pairs. And restricting means for restricting the use thereof.

  According to the present invention, it is possible to provide an information processing apparatus capable of improving security by properly using a plurality of authentication key pairs.

Block diagram showing the outline configuration of the authentication system Diagram showing an example of content used by the login terminal A diagram showing an example of a key table representing the use state of an authentication key Figure showing an example of authentication key usage condition setting screen A flowchart showing an example of processing for registering an authentication key of an authentication device in the service providing apparatus 102 A flowchart showing an example of service utilization processing of the service providing apparatus 102 by the login terminal 101 A flowchart showing an example of an authentication code generation process by the login terminal 101 Sequence diagram showing an example of state transition of the key table 301

  Hereinafter, the present embodiment will be described in detail with reference to the attached drawings. The configurations shown in the following embodiments are merely examples, and the present embodiment is not limited to the illustrated configurations.

  Further, in the present embodiment, encryption, decryption, hash processing and the like are described in the following notation. Hereafter, the processes related to the cryptographic technology and data will be described by the following description rules. The encryption process C = Enc (K, P) encrypts the plaintext P using the secret key K and obtains the ciphertext C. The secret key K may be a key of a target key cryptosystem or a key of an asymmetric key cryptosystem (usually a public key). The decryption process P = Dec (K, C) decrypts the ciphertext C using the key K to obtain a plaintext P. Here, in an asymmetric key cryptosystem such as RSA, K is usually a secret key. On the other hand, the signature processing S = Sign (K, D) performs signature processing on the data D with the secret key of the key pair K, and obtains a digital signature S. The generation process of Mac (Message Authentication Code) is described as S = Mac (K, D), which obtains the Mac value S to the data D with the secret key K. The digital signature and Mac value verification process is described as Verify (K, S). If S is a digital signature, K verifies the integrity of S with the public key of RSA key pair K, and if S is a Mac value, the secret key K used to generate the Mac value. The result of the verification process is either success or failure. On the other hand, for encrypted data, {Data} K indicates that Data is encrypted with the key K. If K is an asymmetric key cryptosystem such as RSA, it indicates that the key pair K is encrypted with the public key. Furthermore, the operator “|” represents data concatenation, and “||” in the hash function represents a chain of hash processing. That is, the hash operation of the two data D1 and D2 is Hash (D1 | D2) = Hash (Hash (D1) | D2).

  On the other hand, as for the data description method, signature data using an asymmetric key encryption algorithm such as RSA is represented as {Data} K ^ -1, and that Data is signed (encrypted) with the secret key of key pair K. Show. Finally, Cert {ID, K} ca is a certificate issued by the CA, and the CA proves that the subject holding the public key K is the subject (eg, URL) indicated by the ID. Show.

<System configuration>
FIG. 1 illustrates an exemplary configuration of a system using a remote service system provided by the service providing apparatus 102 in the login terminal 101 (information processing apparatus) represented by a PC and a smart phone in the present embodiment. The purpose of this system is that the service providing apparatus 102 authenticates the user of the login terminal 101 and provides the service to the authorized user through the login terminal 101. For example, the service providing apparatus 102 provides financial services such as an online bank and a securities company, and services for purchasing and selling products. In such a service, it is important to properly authenticate the user who uses it and to perform appropriate access control.

  The login terminal 101 communicates with the service providing apparatus 102 according to the operation of the user, and uses the service provided by the service providing apparatus 102. The login terminal 101 may be a normal personal computer operating using a computer program. Data communication between the login terminal 101 and the service providing apparatus 102 may be performed via a wired LAN such as Ethernet (registered trademark), or may use a wireless LAN technology. Further, in the login terminal 101, client software may perform data communication according to the HTTP / HTTPS protocol, or may perform data communication using a dedicated protocol. The client software can also be realized by a web browser or a dedicated application. Hereinafter, although the case where the web browser communicates with the service providing apparatus 102 using HTTP / HTTPS will be described, the present embodiment is not limited to the type and protocol of the application.

  The log-in terminal 101 and the service providing apparatus 102 in the present system can be realized by a general-purpose PC, a computing device such as a mobile phone or a smart phone, which is generally used. These devices are general-purpose computing devices configured from storage such as CPU, memory (RAM), HDD, SSD, flash memory, and so the detailed description is omitted.

<Login terminal 101>
An example of the software configuration of the login terminal 101 in FIG. 1 will be described. The login terminal 101 is a terminal operated by the user to use the service of the service providing apparatus 102. The login terminal 101 includes a communication monitoring unit 105, a communication processing unit 106, an authentication code generation unit 107, a plurality of authentication devices (108 to 110), a key management table storage unit 111, and a restriction condition storage unit 112. A plurality of authentication devices in this embodiment are an authentication device A (108) that performs user authentication with a fingerprint, an authentication device B (109) that performs user authentication with a face image, and an authentication device C (110) that performs user authentication with a PIN input. It consists of

  The communication processing unit 106 performs processing of performing data communication with the service providing apparatus 102. For example, in the case of a web browser, a page acquisition request is transmitted to the URL instructed by the user, and the content returned from the service providing apparatus 102 is drawn. The content to be returned is a document or image data in HTML format, but usually, control information such as an HTTP header is added. When the request for user authentication is included in the received data, the authenticator generating unit 107 generates signature data (authenticator) for the challenge data contained in the request, and transmits it to the service providing apparatus 102. The digital signature process for the challenge data may be performed by the authentication device designated by the key identifier from the service providing apparatus 102, or may be performed by the authentication device selected by the user. In any case, the communication processing unit 106 transmits the signature data generated by the authenticator generation unit 107 to the service providing apparatus 102. Details of the generation process of the authentication code will be described later. An example of the content processed by the login terminal 101 in the present embodiment is shown in FIG. FIG. 2 shows an example of matching of HTML content for receiving a remittance request from the user, in which 201 indicates a screen display on the login terminal, and 202 indicates HTML data used for screen display. On the screen 201, the user is prompted to enter a remittance amount and a remittance destination. When the user inputs a remittance amount in the input box on this screen and presses a button indicated as "remittance", a request for remittance processing is made to the service providing apparatus 102. In the HTML data 202 for the screen display, information for forming a request actually transmitted to the service providing apparatus 102 is described. For example, the "action" attribute of the "form" tag designates a URL for sending a request. In addition, the "input" tag designated as "amount" in the "name" attribute sets the amount of money to be sent by the user. The list boxes in which "branchID" and "accountID" are designated in the "name" attribute respectively indicate the branch name and the account number of the remittance destination. Here, the authentication request from the service providing apparatus 102 to the login terminal may be such that the content is sent from the service providing apparatus 102 to the login terminal 101. It may also be sent as a response to a request generated by the user pressing a "remittance" button. In the former case, user authentication is performed to access the page represented on the screen 201.

  The communication monitoring unit 105 monitors data communication between the communication processing unit 106 and the service providing apparatus, and when the communication data includes data related to user authentication, the communication monitoring unit 105 uses the authentication key stored in the restriction condition storage unit 112. Control according to the limit condition. When the user authentication is performed by a method that deviates from the limit conditions, the communication data is prevented from being transmitted to the service providing apparatus 102 by displaying a warning dialog for the user or blocking communication. The communication monitoring unit 105 may be implemented as a plug-in of a web browser, or may be implemented as a user process separate from the web browser, although various implementations are conceivable. Alternatively, it can be implemented as a software module or hardware circuit that monitors network traffic in the operating system.

  The authentication code generation unit 107 generates a digital signature on the challenge data included in the authentication request passed from the communication processing unit 106. Specifically, the authentication code generation unit 107 generates signature data by the authentication device A (108), the authentication device B (110) to the authentication device C (110) and / or a plurality of authentication devices in response to the challenge, It returns to the communication processing unit 106. The digital signature process for the challenge is performed by the authentication device specified by the communication processing unit 106.

  The authentication device A (108), the authentication device B (109), and the authentication device C (110) each hold an authentication key pair for logging in to the service providing apparatus 102. Each authentication device performs digital signature processing on input data (challenge data) with the secret key of the authentication key pair according to the instruction of the user operating the login terminal 101. The authentication device authenticates the user operating the login terminal before performing the digital signature process using the authentication key pair, and permits the digital signature process when it is determined that the operation is performed by a valid user. For example, an existing authentication process can be used as a method for the authentication device to authenticate the user. For example, when using biometrics of the user, the user is authenticated by sensor input such as fingerprint, vein, voice or the like. Alternatively, a password or PIN code is used when using the user's knowledge, and an IC card or USB token is used when the user belongs. Alternatively, the authentication device may determine the propriety of the digital signature based on a module hash value measured at the time of start of the terminal whether the login terminal has a normal software configuration. A boot process using a TPM (Trusted Platform Module) called Trusted Boot is widely known for the determination of the signature using the software configuration, and thus the detailed description is omitted. In any case, each authentication device performs digital signature using the secret key of the authentication key pair to be managed, if predetermined conditions are satisfied.

  The key management table storage unit 111 manages the use state of the authentication key pair managed by the authentication device of the login terminal 101. An example of the table managed by the key management table storage unit 111 in this embodiment is shown in FIG. In FIG. 3, a key table 301 shows a management table of authentication keys used in the login terminal 101. The management table of the authentication key is used to determine whether the condition of the authentication key use condition 113 held by the restriction condition storage unit 112 described later is applicable.

  In the key table 301, a service ID column 302 indicates an identifier of a service used by the login terminal 101, and indicates, for example, a domain name of the service providing apparatus 102. The service providing device 102 for providing the service 1 is https: // www. example1. com, the service providing apparatus 102 for providing the service 2 is https: // www. example2. Identified by the domain name of com.

  The KeyID column 303 identifies the authentication key of the authentication device used by the login terminal 101. For example, in the key table 301, authentication keys identified by Key1, Key2 and Key3 are registered in the service 1, and each authentication key is managed by an authentication device that performs user authentication by fingerprint authentication, face authentication, and PIN code. ing. In addition, an authentication key identified by Key 4 is registered in the service 2 and registered by an authentication device that performs fingerprint authentication.

  The security class column 304 in the key table 301 indicates the classification of the function provided by the service providing apparatus 102 identified by the service ID column 302. The security class in this embodiment represents a set of service functions in which an authentication key managed by an authentication device is used. In the key table 301 in the present embodiment, the functions are classified by the URL as an example of expressing the security class. For example, service 1 has a login function http: // www. example1. com / login. The remittance function is available at http: // www. example1. com / transfer. Provided by URL2 provided by cgi. The service function may be identified by a URL, or may be identified using a URL and its associated parameters. That is, in the web content illustrated in FIG. 2, the request transmitted by the login terminal 101 may be identified using the parameters (“branchID”, “accountID”, “amount”) of the POST method in addition to the URL. This makes it possible to appropriately identify the security class even when providing a plurality of service functions in the same URL.

  The restriction condition storage unit 112 stores the authentication key use condition 113 set in advance in the device or set by the user. The authentication key use condition 113 in the present embodiment is defined by associating the use condition of the authentication key managed in the authentication device with the security class in the key table 301. FIG. 4 shows an example of a setting screen of the authentication key use condition 113 set by the user. In the screen 401, the number of security classes that can use one authentication key pair is set, and if used more than once, it indicates that the user is warned and the use is blocked more than five times. As described later, the restriction condition in the present embodiment is not limited to the restriction by the number of times, and classification can be performed based on authentication session information included in the cookie, and restriction can be performed.

<Service Providing Device 102>
The service providing apparatus 102 is a processing apparatus that provides a service to a user who operates the login terminal 101. The service providing apparatus 102 includes a communication processing unit 103 and an authentication key management unit 104.

  The communication processing unit 103 returns a response to the service request (request) from the login terminal according to the processing logic of the service. The service providing apparatus 102 in the present embodiment authenticates the user who operates the login terminal 101 as necessary, and performs appropriate access control. The processing logic implemented in the communication processing unit 103 provides the user with trading of products such as financial services such as online banking. When there is a request for access to content requiring user authentication, the communication processing unit 103 transmits a user authentication request and a challenge to the login terminal 101. When the digital signature for the challenge is returned from the login terminal, verification is performed using the public key of the authentication key pair of the user managed by the authentication key management unit 104 described later. If verification of the digital signature is successful, it is determined that the request has been sent from a valid user, and service is provided. If verification fails, the service is canceled by returning an error code or the like.

  The authentication key management unit 104 manages the authentication key registered by the login terminal 101 in association with the user. For example, the public key of the authentication key pair necessary to use the service as the user X is stored. The service providing apparatus 102 determines that the user authentication is successful if the signature data (authenticator) sent back to the challenge can be properly verified with the public key associated with the user X.

<Authentication key registration process>
FIG. 5 is a flowchart showing an example of processing in which the login terminal 101 registers the authentication key pair of the authentication device in the service providing apparatus 102. By this registration process, the service providing apparatus 102 can associate the public key of the authentication key pair managed by the authentication device provided in the login terminal 101 with the user.

  First, the user logs in to the service providing apparatus 102 using the log-in terminal 101 (S501). The login may use a password, or if an authentication device whose public key has been registered for the service is provided in the login terminal 101, the authentication key pair may be used.

  If there is an authentication device requiring registration in the login terminal 101 (S502-Yes), a registration request for the authentication device is transmitted to the service providing apparatus 102 (S503), and challenge data is received from the service providing apparatus 102 as a response (S504) ). If there is no authentication device that needs to be registered in the login terminal 101 (S502-No), the registration process of the authentication device is ended. The login terminal 101 having received the challenge data generates an authentication key pair, and performs digital signature processing on the challenge data received in S504 with the secret key of the authentication key pair (S505). Subsequently, the login terminal 101 adds the newly registered authentication key to the key table stored in the key management table storage unit 111 (S506).

  The flow of the process of registering the authentication key pair of the authentication device provided in the login terminal 101 in the service providing apparatus 102 has been described above. By this step, the login terminal 101 can register the authentication key pair managed by the authentication device in the service providing apparatus 102. Thereafter, the user can perform login processing without using a password by signing a challenge from the service providing apparatus 102 with the secret key of the registered authentication key pair.

<Login process>
FIG. 6 is a flowchart showing an example of processing in which the login terminal 101 logs in to the service providing apparatus 102 using the authentication key managed by the authentication device.

  First, the user activates an application on the login terminal 101 (S601). For example, the application in the present embodiment is a web browser that accesses web content, and is executed by the communication processing unit 106 in the login terminal 101. The communication processing unit 106 performs network communication with the service providing apparatus 102 via the HTTP / HTTPS protocol. The network communication is performed by content request transmission processing (S602) to the server providing apparatus and response reception processing (S603) from the service providing apparatus 102. When the service providing apparatus 102 performs access restriction for access to the content to which the request has been sent in S602, the service providing apparatus 102 gives a response a request for user authentication. The user authentication request may be passed to the login terminal 101 as a parameter of a communication protocol such as an HTTP header, or may be passed as HTML content such as a login form. When the authentication request is included in the response (S604-Yes), an authentication code (signature data) to be described later is generated (S605), and is returned to the service providing apparatus 102. If an authentication request is not included in the response from the service providing apparatus 102 (S604-No), the response is processed by an application such as a web browser and provided to the user (S606). The application in the communication processing unit 106 communicates with the service providing apparatus 102 by repeating the processing steps of S602 to S606 described above (S607-No). When the user instructs the termination (S607-Yes), the application termination processing is performed (S608).

  In the above, a series of flows of communication processing with the service providing apparatus 102 by the login terminal 101 and login processing have been described. Note that this embodiment can be implemented not only in the case where the application is a web browser, but also in a mobile application executed on Android or iOS, an application on a general-purpose PC, or the like.

<Process of generating authenticator (signature)>
FIG. 7 is a flow chart showing an example of a process of generating a login authentication code at the login terminal 101 in process step S605 in the flowchart of FIG. As described above, generation of the authenticator is triggered by the fact that the response received by the communication processing unit 106 includes the user authentication request. The purpose of the series of processing in this flowchart is that the authenticator generation unit 107 applies a digital signature to the challenge data included in the authentication request and performs user authentication on the service providing apparatus 102.

  First, the communication monitoring unit 105 that monitors communication data transmitted and received by the communication processing unit 106 classifies security classes based on request data (S701). The security class is classified based on the request transmitted from the login terminal 101. The classification of the security class has already been described with reference to FIG.

  The communication monitoring unit 105 uses the key table managed by the key management table storage unit 111 and the authentication key usage condition 113 held in the restriction condition storage unit 112 to determine whether the authentication key specified in the authentication request can be used. (S702). When it is not determined that it is within the use condition (S702-No), the communication monitoring unit 105 performs a process of restricting the use of the authentication key (S707). The restriction process includes, for example, a method of preventing (blocking) execution of the authentication request in S703 to S706 authentication process, and a method of displaying a warning screen to the user before the authentication process of S703 to S706. If it is determined that the usage condition is inside (S702-Yes), the challenge data included in the authentication request received by the communication processing unit 106 is processed by the authentication code generation unit 107. The authenticator generation unit 107 selects an authentication device that manages an authentication key pair that signs the challenge data, and requests digital signature processing on the challenge data. The selected authentication device executes predetermined user authentication, and after identifying that the user operating the login terminal 101 is a valid user (S703), the challenge data is created using the secret key of the authentication key pair to be managed. Digital signature is performed (S704). The method of identifying the user who operates the login terminal 101 by the authentication device may use biometric authentication such as fingerprint or vein, or may use knowledge of the user such as a PIN code.

  Subsequently, the generated authentication code is transmitted to the service providing apparatus 102 via the communication processing unit 106 (S705). The communication monitoring unit 105 updates the key class managed by the key management table storage unit 111 by associating the identifier of the authentication key for which the authentication code is generated with the security class (S706).

  The steps of the process of generating an authenticator by the login terminal 101 have been described above. This makes it possible to prevent the authentication device from being used for service processing classified into a plurality of security classes, and there is a risk that the user may inadvertently execute the authentication processing using the authentication device. It is reduced.

<Key management table update process>
FIG. 8 is an example of a sequence diagram for explaining the update of the key table 301 in the key management table storage unit 111 in association with the authentication history of the authentication device in the login terminal 101. In the description of the present sequence, it is assumed that the restriction of “block when the authentication key is used for two or more security classes” is set as the authentication key use condition 113. Also, security classes are classified in units of URLs.

  The key table 801 is an example of a key table configuration after the key registration process of the authentication device described with reference to FIG. 5 (S506). The login terminal 101 includes three authentication devices, and registers three authentication keys, Key 1 controlled by fingerprint authentication, Key 2 controlled by face authentication, and Key 3 controlled by PIN input, in the service 1. As shown in the key table 801, since the authentication key is unused after the authentication key registration, the security class of each authentication key is unset.

  Subsequently, when the login terminal 101 transmits a request to the URL identified by the URL 1 provided by the service providing apparatus 102, a user authentication request is returned as a response. In response to this authentication request, the login terminal 101 performs user authentication using the authentication key Key1 managed by fingerprint authentication. As a result, as in the key table 802, URL1 is associated with the security class of Key1.

  Furthermore, the login terminal 101 accesses the URL 2 to perform a remittance procedure, and receives a response including a user authentication request from the service providing apparatus 102. Here, when the login terminal 101 uses a fingerprint authentication device that manages Key 1 again as an authentication device for accessing URL 2, Key 1 is in a state of being used for authentication of URL 1 and URL 2 as in the key table 804. Therefore, the communication monitoring unit 105 blocks the use of the authentication key Key1 because the authentication key use condition 113 is violated. On the other hand, when accessing the URL 2 with the Key 2 managed by the face authentication device, one authentication key is not used for a plurality of security classes (URLs) as in the key table 803. Therefore, the communication processing unit 106 logs in to the service providing apparatus 102 as normal authentication processing.

  The authentication key use sequence in FIG. 8 has been described above. As described above, the communication monitoring unit 105 monitors the request for communication data and its response, and forces the authentication key to be used according to the authentication key use condition 113. This makes it possible to prevent the user from unintentionally performing authentication on services of multiple security classes with a single authentication device.

  The configurations and processing steps of the login terminal 101 and the service providing apparatus 102 in the present embodiment have been described above. The present embodiment is not limited to the implementation with the apparatus configuration described above, and it is also possible to apply the information processing method to different apparatus configurations. For example, an authentication device may be provided outside the login terminal 101 and connected by a wireless / wired interface. In the present embodiment, as shown in FIG. 8, at the time of authentication key registration, as described in the key table 801, the description has been made using the case where correspondence between any authentication key and security class is not performed. This is highly convenient in that it is widely applicable to applications in which commonly used web services do not distribute definition information on provided security classes. However, the present embodiment is not limited to this, and can be realized, for example, by the service providing apparatus 102 distributing in advance the correspondence key table of the URL and the security class. As a result, the login terminal 101 can grasp the definition of the security class more accurately, and it is possible to control the use of the authentication key more appropriately. Alternatively, the user can select the security class of the authentication device at the time of authentication key registration. In this case, the user can set an authentication device according to the user's preference, such as performing authentication with a fingerprint authentication device for authentication with a normal security class such as login and performing authentication with face authentication for important processing such as remittance.

  Further, the security class identification method need not be limited to the one based on the URL as described in the present embodiment, but may be based on the state of the service. That is, there is a cookie as a representative means for managing the authentication state of the web service, but the security class may be defined according to the state of the cookie. In this case, for example, a state in which the user is not authenticated is regarded as one security class, and a state in which the user is authenticated is regarded as another security class. Normally, user authentication is performed when transitioning to a security class for which user authentication has already been performed, so the key table 301 manages an authentication key (KeyID) and an authentication device that are used to transition to a security class for which authentication has been performed.

  In the above embodiment, the usage restriction of the authentication key pair based on the URL of the web browser and the service accessed by the browser has been described as an example, but the present invention is not limited to this and various applications can cooperate. For example, the communication processing unit 106 may be a mobile application described in Java (registered trademark) language. In this case, it is possible to define the security class using not only the URL but also the screen transition state (Intent) or the internal state of the mobile application.

(Other embodiments)
The present invention supplies a program that implements one or more functions of the above-described embodiments to a system or apparatus via a network or storage medium, and one or more processors in a computer of the system or apparatus read and execute the program. Can also be realized. It can also be implemented by a circuit (eg, an ASIC) that implements one or more functions.

Claims (9)

An information processing apparatus for logging in to a service providing apparatus using a plurality of authentication key pairs, comprising:
Communication means for communicating with a plurality of requests to the service providing device and a plurality of responses from the service providing device;
Setting means for setting a plurality of security classes according to types of the plurality of requests;
An information processing apparatus, comprising: restricting means for restricting use of at least one of the plurality of authentication key pairs for communication of a request corresponding to at least one of the plurality of security classes.   The information processing apparatus according to claim 1, wherein the plurality of security classes are set according to a type of URL or parameter included in the request.   The information processing apparatus according to claim 1, wherein the plurality of security classes are set according to a state of an application that issues the request.   The information processing apparatus according to claim 1, wherein the plurality of security classes are set according to an authentication history of the authentication key pair.   5. The information processing apparatus according to claim 4, wherein the authentication history includes at least one of face authentication, fingerprint authentication, and PIN input authentication.   The information processing apparatus according to claim 1, wherein the plurality of security classes are set based on a user's instruction.   7. The apparatus according to any one of claims 1 to 6, wherein the limiting means limits the number of times at least one of the plurality of authentication key pairs is used to communicate a request corresponding to at least one of the plurality of security classes. An information processing apparatus according to any one of the preceding items. An information processing method for logging in to a service providing apparatus using a plurality of authentication key pairs, comprising:
A communication process in which communication means communicate with a plurality of requests to the service providing apparatus and a plurality of responses from the service providing apparatus;
A setting step of setting a plurality of security classes in accordance with the types of the plurality of requests;
An information processing characterized in that the limiting means limits the use of at least one of the plurality of authentication key pairs for communication of a request corresponding to at least one of the plurality of security classes. Method. Computer,
An information processing apparatus for logging in to a service providing apparatus using a plurality of authentication key pairs, comprising:
Communication means for communicating with a plurality of requests to the service providing device and a plurality of responses from the service providing device;
Setting means for setting a plurality of security classes according to types of the plurality of requests;
A control unit configured to control at least one of the plurality of authentication key pairs to use for communication of a request corresponding to at least one of the plurality of security classes; Computer program for.

Images