JP2022183571A - Terminal device, unauthorized use detection system, unauthorized use detection method and program - Google Patents

Abstract

To detect unauthorized use accompanying loss etc., and notify a user of a detection result when communication means is secured.SOLUTION: A terminal device 2 is connected to a server device through a network. The terminal device comprises: an authentication information acquisition unit 212 which acquires user authentication information based on one or more authentication methods; an authentication determination unit 213 which determines success or failure of authentication on the basis of the user authentication information; an unauthorized use determination unit 214 which determines presence/absence of unauthorized use on the basis of a determination result of the authentication method; a storage unit 22 which stores an unauthorized use determination result determined by the unauthorized use determination unit 214; and a notification unit 215 which reads the unauthorized use determination result from the storage unit 22 to notify the server device, when it is confirmed that a communication path to a server device is established.SELECTED DRAWING: Figure 2

Description

The present invention relates to a terminal device, an unauthorized use detection system, an unauthorized use detection method, and a program.

Terminal devices such as smartphones, tablet devices, and notebook personal computers are portable and have the risk of being misplaced or lost due to theft. In this case, there is a possibility that a third party will use the lost terminal device, and there is a risk that the data and authority in the terminal device will be illegally used.

In order to avoid unauthorized use by a third party due to loss, for example, in Patent Document 1, a detachable attachment unit is provided for a portable information terminal, and the portable information terminal performs short-range wireless communication with the attachment unit. detects whether or not an accessory unit exists within a predetermined distance range, activates a lock function according to the state of separation from the accessory unit, and prevents unauthorized use by a third party.

In addition, in Patent Document 2, when a mobile communication terminal device detects unauthorized use by authentication using a personal identification number, it connects to a specific destination terminal via a wireless communication line, and the connected destination terminal transmits It is disclosed that unauthorized use of a mobile communication terminal is reduced by executing remote control of the operation of the terminal according to instructions.

Japanese Patent No. 4595886 JP 2006-340074 A

However, according to the technique disclosed in Patent Document 1, in addition to the portable information terminal, an accessory unit for detecting whether the portable information terminal exists within a predetermined distance range is required. The owner of a handheld information terminal must wear the accessory unit at all times. Furthermore, the owner of the portable information terminal is at risk of losing not only the portable information terminal but also the attached unit, and if both terminals are lost, the portable information terminal will be illegally used by a third party. there is a possibility.

Further, according to the technology disclosed in Patent Document 2, it relates to a mobile communication terminal device that uses a public wireless communication line such as a mobile phone line, and is configured assuming a state in which wireless communication is always available. . However, if the mobile communication terminal device is located outside the range of wireless communication lines, such as underground or in a building, there is a possibility that it will not be possible to immediately connect to a specific destination and notify unauthorized use.

SUMMARY OF THE INVENTION The present invention has been made in view of the above, and an object of the present invention is to detect unauthorized use due to loss or the like, and to notify the detection result when a communication means is secured.

In order to achieve the above object, the terminal device of the present invention includes:
A terminal device connected to a server device through a network,
an authentication information acquisition unit that acquires user authentication information by one or more authentication methods;
an authentication determination unit that determines success or failure of authentication based on the user authentication information;
an unauthorized use determination unit that determines whether or not there is unauthorized use based on the determination result of the authentication method;
a first storage unit that stores the result of the unauthorized use judgment determined by the unauthorized use judgment unit;
a notification unit that, upon confirming that a communication path with the server device is secured, reads an unauthorized use determination result from the first storage unit and notifies the server device;
Prepare.

Further, in order to achieve the above object, the unauthorized use detection system of the present invention includes:
comprising a terminal device and a server device connected to the terminal device through a network;
The terminal device
an authentication information acquisition unit that acquires user authentication information by one or more authentication methods;
an authentication determination unit that determines success or failure of authentication based on the user authentication information;
an unauthorized use determination unit that determines whether or not there is unauthorized use based on the determination result of the authentication method;
a first storage unit that stores the result of the unauthorized use judgment determined by the unauthorized use judgment unit;
a notification unit that, upon confirming that a communication path with the server device is secured, reads an unauthorized use determination result from the first storage unit and notifies the server device;
with
The server device
an unauthorized use judgment result acquisition unit that acquires an unauthorized use judgment result from the terminal device;
a second storage unit that stores the acquired fraudulent use determination result;
Prepare.

According to the present invention, even if communication means has not been established at the time of detection of unauthorized use of a terminal device due to loss or the like, detection results can be notified when communication means is secured.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure which shows the structure of the unauthorized use detection system based on the 1st Embodiment of this invention. 1A is a block diagram showing an example of a hardware configuration of a terminal device according to a first embodiment of the present invention, and FIG. 1B is a block diagram showing a functional configuration of the terminal device; FIG. 1A is a block diagram showing an example of a hardware configuration of a server device according to a first embodiment of the present invention, and FIG. 1B is a block diagram showing a functional configuration of the server device; FIG. 4 is a flowchart showing an example of unauthorized use detection processing by the terminal device according to the first embodiment of the present invention; 9 is a flowchart showing another example of unauthorized use detection processing by the terminal device according to the first embodiment of the present invention; 4 is a flowchart showing an example of unauthorized use notification processing from the terminal device to the server device according to the first embodiment of the present invention; (a) is a diagram of unauthorized use record information stored in the storage unit of the terminal device according to the first embodiment of the present invention; (b) is an unauthorized use record information stored in the storage unit of the server device; FIG. 4 is a diagram of recorded information; FIG. 8 is a block diagram showing a functional configuration of a terminal device according to a second embodiment of the present invention; FIG. It is a block diagram which shows the functional structure of the server apparatus which concerns on the 2nd Embodiment of this invention. It is a flow chart which shows an example of attestation detection processing by a terminal unit concerning a 2nd embodiment of the present invention. FIG. 10 is a flow chart showing an example of authentication record notification processing from the terminal device to the server device and system function restriction processing of the terminal device according to the second embodiment of the present invention; FIG. (a) is a diagram of the authentication record information stored in the storage unit of the terminal device according to the second embodiment of the present invention, and (b) is the authentication record information stored in the storage unit of the server device. is a diagram. It is a flow chart which shows an example of attestation detection processing by a terminal device concerning a 3rd embodiment of the present invention. FIG. 11 is a flow chart showing an example of authentication record notification processing from a terminal device to a server device and system function restriction processing of the terminal device according to the third embodiment of the present invention; FIG. (a) is a diagram of authentication record information stored in a storage unit of a terminal device according to a third embodiment of the present invention, and (b) is a diagram of authentication record information stored in a storage unit of a server device. is a diagram.

An unauthorized use detection system, a terminal device, and a server device according to embodiments of the present invention will be described in detail below with reference to the drawings.

(First embodiment)
As shown in FIG. 1, the unauthorized use detection system 1 of the present embodiment includes a terminal device 2 such as a smart phone, a tablet device, or a notebook personal computer that can be carried by a user, and a terminal device 2. and a server device 4 connected via a network 3 . The network 3 is the Internet, an intranet, a LAN (Local Area Network), a mobile communication network, or the like, and is a communication network including wired and wireless. The server device 4 receives information about unauthorized use notified from the terminal device 2, and detects unauthorized use from the received information.

As shown in FIG. 2A, the terminal device 2 shown in FIG. 1 includes a control unit 21 that performs various controls, a storage unit 22 that stores data, and a communication unit 23 that transmits and receives data to and from the server device 4. , an input unit 24 for inputting fingerprint information and user authentication information such as a password, and a display unit 25 .

The control unit 21 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. Each of these are connected to each other via a system bus. The CPU is, for example, a microprocessor or the like that executes various processes and calculations. The ROM stores programs for performing various initial settings, hardware inspection, program loading, and the like. The RAM temporarily stores various software programs executed by the CPU, data necessary for executing these software programs, and the like, and is used as a work memory.

The storage unit 22 is a memory such as an EPROM (Erasable Programmable Read Only Memory), an EEPROM (Electrically Erasable Programmable Read Only Memory), a RAM, a hard disk, or an SD (Secure Digital Memory) card. Stores software programs and data used for The storage unit 22 stores unauthorized use record information and authentication record information, which will be described later.

The communication unit 23 communicates with the server device 4 via the network 3 . The input unit 24 is a device for inputting various data to the control unit 21, and includes a keyboard, keypad, mouse, operation button, fingerprint sensor, touch pad, camera, voice input device, and the like. A camera is a device that captures an image, and is used, for example, to capture a user's face when authenticating the user's face. A voice input device is a device such as a microphone for inputting a voice signal, and is used for inputting a user's voice when performing user voiceprint authentication, for example. The display unit 25 is a display device that displays an operation screen, images, and the like, and corresponds to liquid crystal, organic EL (Electroluminescence), and the like.

In the terminal device 2, as shown in FIG. 2B, the control unit 21 includes an unauthorized use detection unit 211 for detecting unauthorized use based on the authentication result, and a notification unit 215 for notifying the server device 4 of information on the detected unauthorized use. , and functions as an unauthorized use record information storage unit 221 for recording information on unauthorized use detected by the unauthorized use detection unit 211 by the storage unit 22 .

The unauthorized use detection unit 211 includes an authentication information acquisition unit 212 that acquires user authentication information for user authentication, an authentication determination unit 213 that determines the authentication result based on the user authentication information, and an authentication method and result that has been performed. It also has an unauthorized use judgment unit 214 that judges whether or not it is unauthorized use based on the type, number of times, and the like.

The authentication information acquisition unit 212 acquires user authentication information input by the user through the input unit 24 . User authentication information includes user fingerprint information, face image information, and the like. For example, the authentication information acquisition unit 212 acquires the fingerprint information by reading the user's fingerprint information with the fingerprint sensor of the input unit 24 . Also, by photographing the user's face with the camera of the input unit 24, the authentication information acquiring unit 212 acquires image information of the face. Furthermore, the authentication information acquisition unit 212 can also acquire a personal identification number as other user authentication information. In this case, the authentication information acquisition unit 212 acquires the personal identification number entered through the keyboard, keypad, or the like of the input unit 24 as the user authentication information.

The authentication determination unit 213 compares the user authentication information acquired by the authentication information acquisition unit 212 with pre-registered user authentication information to determine whether or not the user authentication information matches. If the user authentication information matches, it is determined that the authentication has succeeded, and the user is permitted to log in to the terminal device 2 . If the user authentication information does not match, it is determined that the authentication has failed, and the user is not permitted to log in to the terminal device 2 . Note that the authentication determination unit 213 may perform authentication determination using only one authentication method, for example, an authentication method using a personal identification number, or may have an authentication determination function based on a plurality of authentication methods, and may perform authentication determination using another authentication method, such as fingerprint information. Authentication may be determined by the authentication method.

The unauthorized use determination unit 214 determines whether the unauthorized use is by a third party who is not an authorized user, based on the history information of the determination result of the authentication determination unit 213 . For example, if the fingerprint information input by the user does not match the registered fingerprint information n (n is a positive integer) times or more, which is a predetermined number of times, the unauthorized use determination unit 214 determines that it is unauthorized use. do. Further, in the above case, taking into consideration the frequency of authentication failures, it may be determined that unauthorized use is occurring when the fingerprint information does not match consecutively registered fingerprint information for n consecutive times or more. Furthermore, taking time into consideration, fingerprint information input by the user may be compared with registered fingerprint information within a certain period of time, and if the fingerprint information does not match n times or more, it may be determined to be unauthorized use. Further, as another example taking time into consideration, unauthorized use may be determined according to the number of mismatches when one authentication is performed within a predetermined period from the previous authentication. Further, the unauthorized use determining unit 214 may determine that the use is unauthorized when authentication fails in all of a plurality of authentication methods. For example, if authentication using a personal identification number fails, then fingerprint authentication is performed, and if the fingerprint authentication also fails, the unauthorized use determining unit 214 determines that unauthorized use has occurred. Of course, if fingerprint authentication is performed first and the fingerprint authentication fails, then authentication using a personal identification number may be performed. Further, authentication may be performed by a plurality of authentication methods, and unauthorized use may be determined unless all of the authentication methods are successful.

The notification unit 215 notifies the determination result of the unauthorized use determination unit 214 to the server device 4 via the communication unit 23 .

The storage unit 22 has an unauthorized use record information storage unit 221 . The storage section 22 corresponds to the first storage section of the present invention.

The judgment result by the unauthorized use judgment unit 214 is recorded in the unauthorized use record information storage unit 221 . When the communication unit 23 is connected to the server device 4, the notification unit 215 extracts the unauthorized use determination result that has not been transmitted to the server device 4 from the unauthorized use record information storage unit 221 as unauthorized use record information. , to the server device 4 via the communication unit 23 . Here, as the unauthorized use record information to be notified from the terminal device 2 to the server device 4, the unauthorized use record information that has not been transmitted is notified because the unauthorized use record information that has already been notified to the server device 4 is omitted. Alternatively, the already notified unauthorized use record information may be included in the unauthorized use record information to be notified to the server device 4 .

Next, as illustrated in FIG. 3A, the server device 4 includes a control unit 41, a storage unit 42, and a communication unit 43 in terms of hardware.

The control unit 41 includes a processor and executes an operation program stored in the storage unit 42 to perform processing for realizing various functions.

The storage unit 42 is a memory such as EPROM, EEPROM, RAM, etc., and stores software programs and data used by the control unit 41 to perform various processes.

The communication unit 43 communicates with the terminal device 2 via the network 3 .

In the server device 4, as shown in FIG. 3B, the control unit 41 functions as an unauthorized use judgment result acquisition unit 411 that acquires the unauthorized use judgment result notified from the terminal device 2, and the storage unit 42 It functions as an unauthorized use record information storage unit 421 that stores the acquired unauthorized use determination result as unauthorized use record information. The storage section 42 corresponds to the second storage section of the present invention.

The unauthorized use determination result acquisition unit 411 receives and acquires unauthorized use record information transmitted from the communication unit 23 of the terminal device 2 via the communication unit 43 .

The unauthorized use record information storage unit 421 stores the unauthorized use record information acquired by the unauthorized use determination result acquisition unit 411 in association with ID (Identification) information of the terminal device 2 . The terminal ID information may be sent from the terminal device 2 to the server device 4, or the server device 4 may extract the terminal ID information by itself from source information or the like.

Next, the operation of unauthorized use detection processing by the terminal device 2 will be described with reference to the flowchart of FIG.

Unauthorized use detection processing is executed when the system of the terminal device 2 is activated, or when the terminal device 2 recovers from a suspend or sleep state. The control unit 21 confirms that the first authentication method and the second authentication method for user authentication are authentication x and authentication y, respectively (step S101). For authentication x and authentication y, different authentication methods are determined in advance, for example, among authentication methods such as fingerprint, password, and face image. When the terminal device 2 is activated for the first time, the count value i of the counter that counts the number of authentication attempts of authentication x that is the first authentication method and the count value of the counter that counts the number of authentication attempts of authentication y that is the second authentication method are: Both count values j are reset to the initial value 0. This count value i is determined to be a single-factor authentication method in which authentication is determined only by a single authentication method in the determination of multi-factor authentication (step S108: NO), or successful in authentication y, which is the second authentication method. (step 113: YES), or the value is not reset until the unauthorized use process (step S118) is reached, and the current value is retained at the second and subsequent activations. Also, the count value j is not reset until authentication y, which is the second authentication method, is successful (step 113: YES), or until processing for unauthorized use (step S118) is entered. Current value is retained. Subsequently, the control unit 21 determines whether or not the count value i of the authentication x is (M-1) (step S102). Here, M is the maximum number of authentication attempts for authentication x, is an integer of 1 or more, and is predetermined. In the first unauthorized use detection process, the number i of authentication attempts by authentication x is 0, so the control unit 21 determines that the count value i is not (M−1) (step S102: NO), and the authentication x is displayed on the display unit 25 (step S103). When the user performs authentication x (step S104), the authentication result is determined (step S105). If the authentication x fails (step S105: NO), the control unit 21 increments the count value i by 1 (step S106) and returns to step S102. In step S102, it is determined whether or not the count value i indicating the number of trials of authentication x has reached (M-1). The processing from step S102 to step S106 is repeated until reaching. When the authentication x fails M times in succession (step S102: YES), the control unit 21 determines whether to perform alternative authentication to prevent false authentication by the authentication x, here, authentication y, which is the second authentication method. (Step S107). It should be noted that whether or not alternative authentication is used is set in advance. In step S107, if alternative authentication is used (step S107: YES), the process proceeds to authentication y, which is the second authentication method (step S110). If alternative authentication is not used in step S107 (step S107: NO), the control unit 21 stores information indicating unauthorized use of the terminal device 2 as unauthorized use record information in the storage unit 22 (step S116).

As a result of the authentication x, when it is determined that the authentication x has succeeded (step S105: YES), whether the single-factor authentication method is used to determine that the authentication is successful only by the success result of the first authentication x, or the second authentication y and (step S108). Whether it is a single-factor authentication method or a multi-factor authentication method is set in advance. If the single-factor authentication method is set in advance (step S108: NO), the authentication x is successful, so the control unit 21 resets the count value i to the initial value 0, The user is permitted to log in (step S109).

When the multi-factor authentication method is set in advance (step S108: YES), the control unit 21 not only succeeds in the authentication x, but also uses an authentication method different from the authentication x, here the second authentication method. Authentication determination is also made for authentication y. In authentication y, which is the second authentication method, it is determined whether or not the count value j of the counter that counts the number of authentication attempts for authentication y is (N-1) (step S110). Here, N is the maximum number of authentication attempts for authentication y, is an integer of 1 or more, and is predetermined. In the first authentication y, since the number of authentication trials j by authentication y is 0, the control unit 21 determines that the count value j is not (N-1) (step S110: NO), and the authentication y A login screen is displayed on the display unit 25 (step S111). When the user executes authentication y (step S112), the authentication result is determined (step S113). As a result, if the authentication y is successful (step S113: YES), the control unit 21 resets the count values i and j to initial values 0, respectively, and permits the user to log in to the terminal device 2 (step S115). ). If the authentication y fails (step S113: NO), the controller 21 increments the count value j by 1 (step S114) and returns to step S110. In step S110, it is determined whether or not the count value j indicating the number of trials of authentication y has reached (N-1). Until then, the processing from step S110 to step S114 is repeated. When the authentication y fails N times in succession (step S110: YES), the control unit 21 stores unauthorized use record information in the storage unit 22 (step S116). The unauthorized use record information stored in the storage unit 22 is read out from the storage unit 22 and notified to the server device 4 in an unauthorized use notification process to the server device 4, which will be described later.

After step S116, the control unit 21 activates an unauthorized use notification process, which will be described later (step S117). After step S117, the control unit 21 executes processing for illegal use, resets the count values i and j to initial values 0 (step S118), and returns to step S102. In the process of unauthorized use in step S118, a message indicating that login is not allowed may be displayed on the display unit 25 so that the user is not allowed to login until the restriction is lifted. This makes it impossible for a third party who is not an authorized user to use the terminal device 2 . In this case, there is no transition from step S118 to step S102, the state remains at step S118, and in order to enable the terminal device 2 to be used again, it is necessary to cancel the processing at the time of unauthorized use. Note that multi-factor authentication and alternative authentication have been described here using authentication y, which is the second authentication method. Additional methods can be used.

Next, another example of the unauthorized use detection process will be shown. Here, an example will be described based on the flow chart of FIG. 5 for judging fraudulent use when there are Z consecutive authentication failures within a certain period of time T, or when there are Z authentication failures. do. For the sake of simplicity, the case of application to a single-factor authentication method using authentication x will be described as an example. Of course, the same application may be made when using a multi-factor authentication method or a plurality of alternative authentication methods. It is assumed that the fixed period T and the maximum number of authentication failures Z (Z is an integer equal to or greater than 2) used for unauthorized use determination are determined in advance.

In the example of FIG. 5, it is assumed that whether the fraudulent use determination method is a method using the number of consecutive authentication failures within a certain period T or a method using only the number of authentication failures is determined in advance. In step S204, the unauthorized use determination method is determined, and the subsequent processing is divided according to the determined method. For example, such a case of monitoring authentication failures within a certain period of time is effective in detecting unauthorized use by a third party other than the authorized user when the authorized user is absent. First, when the system of the terminal device 2 is activated, or when the terminal device 2 is activated after recovering from a suspend or sleep state, unauthorized use detection processing is executed. When the terminal device 2 is started for the first time, the variable k for counting the number of authentication failures is reset to the initial value 0, but the current value is retained when the terminal device 2 is started for the second time or later.

Next, the control unit 21 displays a login screen for authentication x, which is a predetermined authentication method, on the display unit 25 (step S201). When the user performs authentication x (step S202), the control unit 21 determines whether the authentication has succeeded or failed (step S203). In step S203, if the authentication x is successful (step S203: YES), the fraudulent use judgment method is based on the number of consecutive authentication failures within a certain period T, or simply based on the number of authentication failures. It is determined whether it is an unauthorized use determination method (step S204). If the fraudulent use determination method is based on the number of consecutive authentication failures within a certain period of time T (step S204: YES), the count value k of the number of authentication failures is reset to the initial value 0 (step S205). ), the user is permitted to log in to the terminal device 2 (step S206). If the fraudulent use determination method is based solely on the number of authentication failures within a certain period of time T (step S204: NO), the current count value k of the number of authentication failures is retained. The user is permitted to log in to the terminal device 2 while the user is logged in (step S206).

In step S203, if the authentication x fails (step S203: NO), the authentication execution time of the authentication failure count k is recorded as the time stamp _Tk of the authentication failure count k (step S207). Subsequently, in step S208, it is determined whether or not the number of authentication failures has reached Z times or more. In practice, it is determined whether or not the count k is smaller than (Z-1), and if k is smaller than (Z-1), that is, if the number of authentication failures has not reached Z times (step S208: YES) , the authentication failure count k is incremented by 1 (step S209), and the screen returns to the authentication x login screen (step S201). If the number of authentication failures reaches Z times or more in step S208 (step S208: NO), it is determined whether or not there are past Z authentication failure records or consecutive authentication failure records within a certain period of time T from the current authentication x failures. do. That is, it is determined whether or not the time obtained by subtracting the time stamp Tk _-Z+1 at the time of (Z-1) previous failures from the time stamp _Tk at the time of the current authentication x failure is smaller than T (step S210). In the unauthorized use determination in step S210, if there are Z authentication failure records within a certain period of time T, or if there are Z consecutive authentication failure records (step S210: YES), it is determined that there has been unauthorized use, The unauthorized use record information is stored in the storage unit 22 (step S211). Thereafter, the unauthorized use notification process is activated (step S212), and the unauthorized use process is executed (step S213). In this step S213, the authentication failure count variable k is reset to the initial value 0. Note that the processing at the time of unauthorized use in step S213 is the same as in step S118 of FIG. In addition, in the unauthorized use determination in step S210, if the period of authentication failure records or continuous authentication failure records Z times is longer than the fixed period T (step S210: NO), it is determined that there was unauthorized use, and authentication is performed. The failure count variable k is incremented by 1 (step S209), and the screen returns to the login screen for authentication x (step S201).

Next, referring to the flowchart of FIG. 6, the operation of notification processing of unauthorized use record information from the terminal device 2 to the server device 4 will be described.

When the system of the terminal device 2 is activated, the control unit 21 periodically checks whether a communication path with the server device 4 has been established (step S301). If it cannot be confirmed in step S301 that the communication path with the server device 4 is secured (step S301: NO), the process returns to step S301.

When it is confirmed in step S301 that the communication path with the server device 4 is secured (step S301: YES), the control unit 21 reads the record information of unauthorized use from the storage unit 22 (step S302). The control unit 21 checks whether or not there is unauthorized use record information that has not been transmitted to the server device 4 among the read unauthorized use record information (step S303). If there is unsent unauthorized use record information (step S303: YES), the control section 21 sends the unsent unauthorized use record information to the server device 4 (step S304), and shifts to a standby state (step S305). . If there is no unsent unauthorized use record information (step S303: NO), the control unit 21 shifts to a standby state without sending unauthorized use record information to the server device 4 (step S305). The control unit 21 stores new unauthorized use record information in the storage unit 22 through the unauthorized use detection processing of FIGS. ) is resumed. After restarting the process, the control unit 21 confirms that the communication path with the server device 4 is secured (step S301), and then shifts to the process of step S302. After reading out, the processing after step S303 is performed.

When the server device 4 receives the unauthorized use record information transmitted from the terminal device 2 (step S306), the received unauthorized use record information is stored in the storage unit 42 (step S307).

7A shows an example of unauthorized use record information stored in the storage unit 22 of the terminal device 2. FIG. The item of unauthorized use record information includes the date and time of judgment of unauthorized use. In the example shown in the figure, "2021/01/01 16:30:00" is recorded as the unauthorized use determination date and time.

FIG. 7B shows an example of unauthorized use record information stored in the storage unit 42 of the server device 4. As shown in FIG. Items of the unauthorized use record information include ID information for identifying the terminal device 2 and the date and time of judgment of unauthorized use. In the illustrated example, "1234567890ABCDEF" is recorded as the ID information, and "2021/01/01 16:30:00" is recorded as the unauthorized use determination date and time. The terminal ID information may be sent from the terminal device 2 to the server device 4, or the server device 4 may extract the terminal ID information by itself from source information or the like.

According to the first embodiment, the terminal device 2 can detect unauthorized use based on information on a plurality of authentication determination results, which is a history of authentication results. In addition, since the terminal device 2 can notify the server device 4 of the unauthorized use judgment information before the communication channel is established, the server device 4 can be notified of the unauthorized use of the terminal device 2 at any time. Regardless of whether or not the user notifies the administrator of the loss of the terminal, it is possible to take measures against the loss of the terminal device 2 (revocation procedures, functional restrictions such as temporary disabling of login, etc.). In addition, since the terminal device 2 separates the processing of storing the determination result of unauthorized use and the processing of notifying the server device 4 of the unauthorized use judgment information, even in an environment where the network cannot be used, the terminal device 2 can The fact of unauthorized use can be recorded, and the fact of unauthorized use can be notified to the server device 4 as soon as communication with the server device 4 is established.

(Second embodiment)
In the first embodiment, the terminal device 2 executes the determination of unauthorized use. In the second embodiment, the server device 4 determines unauthorized use.

FIG. 8 shows the functional configuration of the terminal device 2. As shown in FIG. The same or corresponding parts as those in FIG. 2B showing the terminal device 2 according to the first embodiment are denoted by the same reference numerals, and descriptions thereof are omitted. The terminal device 2 differs from the terminal device 2 of the first embodiment in that an authentication detection unit 217 configured by removing the unauthorized use determination unit 214 from the unauthorized use detection unit 211 is provided, and the system function restriction request from the server device 4 is provided. In response, the system function restriction processing unit 216 performs processing such as restricting login to the terminal device 2 and terminating the system. A further difference is that the storage unit 22 does not include the unauthorized use record information storage unit 221 but includes an authentication record information storage unit 222 for recording information on the authentication result determined by the authentication determination unit 213 . Note that the hardware configuration of the terminal device 2 is the same as that of the first embodiment shown in FIG.

FIG. 9 shows a functional configuration of the server device 4. As shown in FIG. 3B showing the server device 4 according to the first embodiment will be denoted by the same reference numerals, and description thereof will be omitted. A difference from the server device 4 of the first embodiment is that the control unit 41 does not include an unauthorized use result acquisition unit 411 that acquires an unauthorized use determination result, and an authentication determination result acquisition unit 412 that acquires an authentication determination result. , the storage unit 42 does not include the unauthorized use record information storage unit 421, and the authentication record information storage unit 422 for recording the authentication result information transmitted from the terminal device 2 is provided. Be prepared. Note that the hardware configuration of the server device 4 is the same as that of the first embodiment shown in FIG.

Next, the operation of authentication detection processing by the terminal device 2 will be described with reference to the flowchart of FIG. 10 .

Authentication detection processing is executed when the system of the terminal device 2 is activated, or when the terminal device 2 recovers from a suspend or sleep state. The control unit 21 confirms that the first authentication method and the second authentication method for user authentication are authentication x and authentication y, respectively (step S401). The count value i of the number of authentication attempts for authentication x, which is the first authentication method, and the count value j of the number of authentication attempts for authentication y, which is the second authentication method, are both reset to the initial value 0 only at the first startup. Further, the maximum number of authentication attempts M for authentication x, which is the first authentication method, and the maximum number of authentication method attempts, N, for authentication y which is the second authentication method are each an integer of 1 or more, and are predetermined. do. The control unit 21 determines whether or not the count value i of the authentication x is (M-1) (step S402). In the first authentication detection process, since the number i of authentication attempts by authentication x is 0, the control unit 21 determines that the count value i is not (M−1) (step S402: NO), and the authentication x A login screen is displayed on the display unit 25 (step S403). When the user executes authentication x (step S404), it is determined whether the result of authentication x is success or failure (step S405). As a result, if the authentication x fails (step S405: NO), the authentication record result is stored in the storage unit 22 (step S406). Furthermore, the control unit 21 increments the count value i by 1 (step S407), and returns to step S402. In step S402, it is determined whether or not the count value i has reached (M-1). If the authentication x fails consecutively, the count value i is incremented by 1 each time the authentication x fails until the count value i reaches M, and the processing from step S402 to step S407 is repeated. When the authentication x fails M times consecutively (step S402: YES), the control unit 21 determines whether or not the second authentication method is used as an alternative authentication method to prevent false authentication by the first authentication method ( Step S408), if alternative authentication is used (step S408: YES), the process proceeds to authentication y (step S411), and if alternative authentication is not used (step S408: NO), the control unit 21 wakes up the authentication record notification process. (step S419).

If the authentication x is successful in step S405 (step S405: YES), the authentication recording result is stored in the storage unit 22 (step S409). Next, it is determined whether it is a single-factor authentication method or a multi-factor authentication method (step S410). is permitted (step S418). After step S418, the authentication record notification process is activated (step S419), and the count values i and j are reset to the initial value 0 (step S420).

If the multi-factor authentication method is used in step S410 (step S410: YES), the control unit 21 determines whether or not the count value j of the number of authentication attempts for authentication y is (N−1) (step S411). In the first authentication y, since the number of authentication attempts j by authentication y is 0, the control unit 21 determines that the count value j is not (N−1) (step S411: NO), login for authentication y The screen is displayed on the display unit 25 (step S412). When the user performs authentication y (step S413), it is determined whether the authentication y succeeded or failed (step S414). As a result, when the authentication y fails (step S414: NO), the authentication record information is stored in the storage unit 22 (step S415). Furthermore, the control unit 21 increments the count value j by 1 (step S416) and returns to step S411. In step S411, each time authentication y fails, count value j is incremented by 1 until count value j reaches (N-1), and steps S411 to S416 are repeated. In step S414, if the authentication y is successful (step S414: YES), the authentication record information is stored in the storage unit 22 (step S417), and the control unit 21 permits the user to log in to the terminal device 2 (step S418). Further, the authentication record notification process is activated (step S419), and the count values i and j are reset to the initial value 0 (step S420).

In step S411, if the authentication y fails N times in succession (step S411: YES), the authentication record notification process is activated (step S419). When the authentication record notification process is activated (step S419), the authentication record information is read from the storage unit 22 and notified to the server apparatus 4 in the authentication record notification process to the server apparatus 4, which will be described later. After step S419, the control unit 21 resets the counter values i and j to the initial value 0 (step S420), and returns to step S402.

Next, with reference to the flowchart of FIG. 11, the operation of the authentication record notification process from the terminal device 2 to the server device 4 and the system function restriction process of the terminal device 2 will be described.

When the system of the terminal device 2 is activated, the control unit 21 periodically checks whether the communication path with the server device 4 is secured (step S501). If it cannot be confirmed in step S501 that the communication path with the server apparatus 4 is secured (step S501: NO), the process returns to step S501.

If the communication path with the server device 4 is secured (step S501: YES), the control section 21 reads the authentication record information from the storage section 22 (step S502). The control unit 21 checks whether or not there is authentication record information that has not been transmitted to the server device 4 among the read authentication record information (step S503). If there is unsent authentication record information (step S503: YES), the control section 21 sends the unsent authentication record information to the server device 4 (step S504), and shifts to a standby state (step S505). If there is no unsent authentication record information (step S503: NO), the control unit 21 shifts to a standby state without sending authentication record information to the server device 4 (step S505). When the control unit 21 wakes up the authentication record notification process in step S419 of FIG. 10, it resumes the authentication record notification process that has been in the standby state (step S505). After confirming the communication path with the server device 4 (step S501), the control unit 21 that has restarted the process reads out the newly stored authentication record information in the process of step S502. process.

When the communication path with the terminal device 2 is secured and the authentication record information is transmitted from the terminal device 2, the server device 4 receives this (step S506). The server device 4 stores the authentication record information in the storage unit 42 each time it receives the authentication record information from the terminal device 2 . After storing the new authentication record information in the storage unit 42, the server device 4 reads out the previously recorded authentication record information, and based on the newly recorded authentication record information and the previously recorded authentication record information, It is determined whether or not there is use (step S507). Here, the past authentication record information read from the storage unit 42 may be all recorded authentication record information, or authentication record information for an arbitrary number of authentication attempts. For example, the history of the authentication result for n pieces (n is a positive integer) from the present is retroactively read, and it is confirmed whether or not the authentication has failed n consecutive times. For example, when the server device 4 confirms that authentication has failed n consecutive times as a result of going back the history of n authentication results from the present, it determines that it is unauthorized use. In addition, similar to the fraudulent use determination in FIG. 5, a case where the number of consecutive or discontinuous authentication failures exceeds n times within a certain period T may be determined as fraudulent use. If it is determined to be unauthorized use (step S507: YES), the server device 4 transmits a system function restriction request to the terminal device 2 (step S508). If it is determined in step S507 that there is no unauthorized use (step S507: NO), it waits until a new authentication record is received. Note that if the process of step S508 cannot be executed due to reasons such as the communication path being disconnected when attempting to execute the process of step S508, the server device 4 repeats step S508 when the communication path is reconnected. process.

In step S508, the server device 4 transmits a system function limitation request, and when the terminal device 2 receives the system function limitation request from the server device 4 (step S509), the control unit 21 causes the terminal device 2 to In accordance with the function restriction request regardless of the state, the system performs processing such as restricting the use of some functions of the system or terminating the system (step S510). For example, it is possible to restrict activation of some functions such as applications of the system by the function restriction request. In addition, it is also possible to display on the display unit 25 that the user cannot log in due to the function restriction request, and to disable login until the restriction is lifted. This limits the use of the terminal device 2 by a third party who is not an authorized user.

12A shows an example of authentication record information stored in the storage unit 22 of the terminal device 2. FIG. Items of the authentication record information include authentication result, authentication date and time, and authentication method. In the illustrated example, "OK" is recorded as the authentication result, "2021/01/01 16:30:00" as the authentication date and time, and "authentication x" as the authentication method.

FIG. 12B shows an example of authentication record information stored in the storage unit 42 of the server device 4. As shown in FIG. Items of the authentication record information include ID information for identifying the terminal device 2, authentication result, authentication date and time, and authentication method. In the illustrated example, "1234567890ABCDEF" is recorded as the ID information, "OK" as the authentication result, "2021/01/01 16:30:00" as the authentication date, and "authentication x" as the authentication method. The terminal ID information may be sent from the terminal device 2 to the server device 4, or the server device 4 may extract the terminal ID information by itself from source information or the like.

According to the second embodiment, the server device 4 determines unauthorized use based on the notification of the authentication result from the terminal device 2, so the server device 4 can detect unauthorized use. Furthermore, when the communication path with the server device 4 is secured, the terminal device 2 notifies the server device 4 of the acquired determination result of authentication, so that the authentication result can be known regardless of the recognition of the authorized user. . In addition, the server device 4 can immediately restrict the use of the terminal device 2 by requesting the terminal device 2 to restrict the functions of the system as soon as the unauthorized use is determined.

(Third Embodiment)
In the second embodiment, all authentication results of user authentication are transmitted from the terminal device 2 to the server device 4, and the determination of unauthorized use is performed by the server device 4. FIG. On the other hand, in the third embodiment, the terminal device 2 transmits only the authentication failure information of the authentication result to the server device 4, and the server device 4 receives the received authentication failure information. Unauthorized use is determined based on

Since the hardware configuration and functional configuration of the terminal device 2 and the server device 4 are the same, description thereof will be omitted.

Next, the operation of authentication detection processing by the terminal device 2 will be described with reference to the flowchart of FIG. 13 . 13 that are the same as those in FIG. 10 of the second embodiment will be simplified.

Authentication detection processing is executed when the system of the terminal device 2 is activated, or when the terminal device 2 recovers from a suspend or sleep state. The control unit 21 confirms that the first authentication method and the second authentication method for user authentication are authentication x and authentication y, respectively (step S601). The count value i of the number of authentication attempts for authentication x and the count value j of the number of authentication attempts for authentication y are both reset to 0 only at the first startup. Further, the maximum number of authentication attempts M for authentication method x, which is the first authentication method, and the maximum number of authentication method attempts, N, for authentication y which is the second authentication method are each an integer of 1 or more and are predetermined. and The control unit 21 determines whether or not the count value i of the authentication x is (M-1) (step S602). In the first authentication detection process, since the number i of authentication attempts by authentication x is 0, the control unit 21 determines that the count value i is not (M−1) (step S602: NO), and the authentication x A login screen is displayed on the display unit 25 (step S603). When the user performs authentication x (step S604), it is determined whether the result of authentication x is success or failure (step S605). As a result, if the authentication x fails (step S605: NO), the authentication recording result is stored in the storage unit 22 (step S606). Furthermore, the control unit 21 increments the count value i by 1 (step S607), and returns to step S602. When the authentication x fails M times in succession (step S602: YES), the control unit 21 determines whether or not to use the second authentication method as an alternative authentication method to prevent erroneous authentication by the first authentication method ( Step S608), if the alternative authentication is used (step S608: YES), the process proceeds to authentication y (step S610), and if the alternative authentication is not used (step S608: NO), the control unit 21 wakes up the authentication record notification process. (step S617).

If the authentication x succeeds in step S605 (step S605: YES), it is determined whether it is a single-factor authentication method or a multi-factor authentication method (step S609), and if it is a single-factor authentication method (step S609: NO) , the control unit 21 permits the user to log in to the terminal device 2 (step S616).

If the multi-factor authentication method is used in step S609 (step S609: YES), the control unit 21 determines whether or not the count value j of the number of authentication attempts for authentication y is (N−1) (step S610). In the first authentication y, since the number of authentication attempts j by authentication y is 0, the control unit 21 determines that the count value j is not (N−1) (step S610: NO), login for authentication y The screen is displayed on the display unit 25 (step S611). When the user performs authentication y (step S612), it is determined whether the authentication y succeeded or failed (step S613). As a result, when the authentication y fails (step S613: NO), the authentication record information is stored in the storage unit 22 (step S614). Furthermore, the control unit 21 increments the count value j by 1 (step S615) and returns to step S610. Each time authentication y fails, the count value j is incremented by 1, and the processing from step S610 to step S615 is repeated until the count value j reaches (N-1). In step S613, if the authentication y is successful (step S613: YES), the control unit 21 permits the user to log in to the terminal device 2 (step S616). In step S610, if the authentication y fails N times in succession (step S610: YES), the authentication record notification process is activated (step S617). When the authentication record notification process is activated (step S617), the authentication record information is read from the storage unit 22 and notified to the server apparatus 4 in the authentication record notification process to the server apparatus 4. FIG. The control unit 21 stores the authentication failure record information together with the authentication date and time. Note that since the authentication result is recorded only in the case of authentication failure, it is not necessary to record the item indicating the authentication failure in the authentication result. After step S617, the counter values i and j are reset to initial values 0 (step S618), and the process returns to step S602. Here, when authentication fails M times consecutively in authentication x which is the first authentication method, and when authentication fails N times consecutively in authentication y which is the second authentication method, authentication Although the case of starting the record notification process (step S617) has been described, the authentication record notification process is started (step S617).

Next, with reference to the flowchart of FIG. 14, the operation of the authentication record notification process from the terminal device 2 to the server device 4 and the system function restriction process of the terminal device 2 will be described.

When the system of the terminal device 2 is activated, the control unit 21 periodically confirms whether or not the communication path with the server device 4 is secured (step S701).

If the communication path with the server device 4 is secured (step S701: YES), the control unit 21 reads the authentication failure authentication record information from the storage unit 22 (step S702), If there is information (step S703: YES), it is transmitted to the server device 4 (step S704) and shifts to a standby state (step S705). If there is no unsent authentication record information of authentication failure (step S703: NO), the control unit 21 shifts to a standby state without sending authentication record information (step S705). When the control unit 21 wakes up the authentication record notification process in step S617 of FIG. 13, it resumes the authentication record notification process that has been in the standby state (step S705). After confirming the communication path with the server device 4 (step S701), the control unit 21 performs the processing from step S702 onward.

When the communication path with the terminal device 2 is secured, the server device 4 receives the authentication record information indicating the authentication failure from the terminal device 2 (step S706), and determines whether the terminal device 2 has been illegally used. It is determined whether or not (step S707). If it is determined that there has been unauthorized use (step S707: YES), the server device 4 transmits a system function restriction request to the terminal device 2 (step S708). If it is determined that there is no unauthorized use (step S707: NO), it waits until a new authentication record is received. If the processing of step S708 cannot be executed due to reasons such as the disconnection of the communication channel when attempting to execute the processing of step S708, the server device 4 repeats step S708 when the communication channel is reconnected. process.

When the server device 4 transmits a system function limitation request (step S708) and the terminal device 2 receives the system function limitation request from the server device 4 (step S709), the control unit 21 controls the terminal device 2 to Regardless of the state, the functions are restricted according to the system's function restriction request (step S710). For example, the function restriction request can be used to restrict some functions such as applications of the system from being activated. In addition, it is also possible to display on the display unit 25 that login is not possible in response to a function restriction request, and to disable login until the restriction is lifted. This limits the use of the terminal device 2 by a third party who is not an authorized user.

15A shows an example of authentication failure record information stored in the storage unit 22 of the terminal device 2. FIG. Items of authentication failure record information include date and time of authentication and authentication method. Since there are only authentication failure records, there is no authentication result item. In the illustrated example, "2021/01/01 16:30:00" is recorded as the authentication date and time, and "authentication x" is recorded as the authentication method.

FIG. 15B shows an example of authentication record information stored in the storage unit 42 of the server device 4. As shown in FIG. Items of the authentication record information include ID information for identifying the terminal device 2, authentication date and time, and an authentication method. Similar to the above, only the authentication failure record is included, so the authentication result item is not provided. In the illustrated example, "1234567890ABCDEF" is recorded as the ID information, "2021/01/01 16:30:00" as the authentication date and time determined as authentication failure, and "authentication x" as the authentication method. The terminal ID information may be sent from the terminal device 2 to the server device 4, or the server device 4 may extract the terminal ID information by itself from source information or the like. Also, in this example, no authentication result item is provided, but there is no particular restriction on the presence or absence of this item, and the authentication result item may be included.

According to the third embodiment, as in the second embodiment, the terminal device 2 notifies the server device 4 of the authentication failure result when the communication means is secured, so that the server device 4 Since unauthorized use is determined based on the authentication failure result from the terminal device 2, the fact of unauthorized use can be known regardless of recognition of the authorized user. Further, according to the third embodiment, the terminal device 2 stores only the determination result of authentication failure and notifies the server device 4 of only the determination result of authentication failure. In comparison, the amount of data stored in the storage unit 22 of the terminal device and the storage unit 42 of the server device 4 can be reduced. In addition, the frequency and amount of data transmitted from the terminal device 2 to the server device 4 can be reduced, and the frequency and time required for the process of judging unauthorized use by the server device 4 can be reduced.

In the above embodiments, the CPU functions as the control units 21 and 41 by executing programs stored in the RAM and ROM. However, instead of the CPU executing programs stored in RAM or ROM, dedicated hardware such as ASICs (Application Specific Integrated Circuits), FPGAs (Field-Programmable Gate Arrays), and various control circuits are provided. Hardware may function as the controllers 21 and 41 . In this case, one part may be implemented by dedicated hardware, and the other part may be implemented by software or firmware.

In addition, the program can be provided by any method. ) Disc), MO (Magneto-Optical Disc), memory card, USB memory, etc.) and distributed. It may be provided by downloading.

Although the preferred embodiments of the present invention have been described above, the present invention is not limited to such specific embodiments, and the present invention includes the invention described in the claims and their equivalents. be

DESCRIPTION OF SYMBOLS 1... Unauthorized use detection system, 2... Terminal device, 3... Network, 4... Server apparatus, 21, 41... Control part, 22, 42... Storage part, 23, 43... Communication part, 24... Input part, 25... Display Unit 211 Unauthorized use detection unit 212 Authentication information acquisition unit 213 Authentication determination unit 214, 413 Unauthorized use determination unit 215 Notification unit 216 System function restriction processing unit 217 Authentication detection unit 221, 421... Unauthorized use record information storage unit, 222, 422... Authentication record information storage unit, 411... Unauthorized use determination result acquisition unit, 412... Authentication determination result acquisition unit.

Claims (7)

A terminal device connected to a server device through a network,
an authentication information acquisition unit that acquires user authentication information by one or more authentication methods;
an authentication determination unit that determines success or failure of authentication based on the user authentication information;
an unauthorized use determination unit that determines whether or not there is unauthorized use based on the determination result of the authentication method;
a first storage unit that stores the result of the unauthorized use judgment determined by the unauthorized use judgment unit;
a notification unit that, upon confirming that a communication path with the server device is secured, reads an unauthorized use determination result from the first storage unit and notifies the server device;
terminal device. comprising a terminal device and a server device connected to the terminal device through a network;
The terminal device
an authentication information acquisition unit that acquires user authentication information by one or more authentication methods;
an authentication determination unit that determines success or failure of authentication based on the user authentication information;
an unauthorized use determination unit that determines whether or not there is unauthorized use based on the determination result of the authentication method;
a first storage unit that stores the result of the unauthorized use judgment determined by the unauthorized use judgment unit;
a notification unit that, upon confirming that a communication path with the server device is secured, reads an unauthorized use determination result from the first storage unit and notifies the server device;
with
The server device
an unauthorized use judgment result acquisition unit that acquires an unauthorized use judgment result from the terminal device;
a second storage unit that stores the acquired fraudulent use determination result;
fraud detection system. comprising a terminal device and a server device connected to the terminal device through a network;
The terminal device
an authentication information acquisition unit that acquires user authentication information by one or more authentication methods;
an authentication determination unit that determines success or failure of authentication based on the user authentication information;
a first storage unit that stores the determination result of the authentication method;
a notification unit that, upon confirming that a communication path with the server device is secured, reads out the determination result of the authentication method from the first storage unit and notifies the server device;
with
The server device
an authentication determination result acquisition unit that acquires the determination result of the authentication method from the terminal device;
a second storage unit that stores the acquired determination result of the authentication method;
an unauthorized use determination unit that determines whether or not there is unauthorized use based on the determination result of the authentication method;
fraud detection system. The server device
requesting system function restriction to the terminal device based on the determination result of the unauthorized use determining unit;
The terminal device
Restricting system functions based on a system function restriction request from the server device;
The unauthorized use detection system according to claim 3. The first storage unit of the terminal device stores only the determination result of authentication failure, and the notification unit notifies the server device of only the determination result of authentication failure.
An unauthorized use detection system according to claim 3 or 4. obtaining user authentication information by one or more authentication methods;
determining success or failure of authentication based on the user authentication information;
a step of determining the presence or absence of unauthorized use based on the determination result of the authentication method;
a step of storing an unauthorized use determination result in a first storage unit;
a step of, upon confirming that a communication path with a server device is secured, reading an unauthorized use determination result from the first storage unit and notifying the server device of the result;
A fraud detection method comprising: the computer,
an authentication information acquisition unit that acquires user authentication information by one or more authentication methods;
an authentication determination unit that determines success or failure of authentication based on the user authentication information;
An unauthorized use determination unit that determines whether or not there is unauthorized use based on the determination result of the authentication method;
a first storage unit that stores an unauthorized use determination result;
a notification unit that, upon confirming that a communication path with a server device is secured, reads out an unauthorized use determination result from the first storage unit and notifies the server device;
A program to function as

Images