JP2023073844A - Authentication system, authentication terminal, and authentication program - Google Patents

Abstract

To provide an authentication system in which security in SMS authentication is enhanced.SOLUTION: A processing server 20 includes: an authentication message transmission unit 211 which transmits an SMS for authentication to an authentication terminal 30; a handling available notice transmission unit 212 which transmits, in response to an additional authentication request from the authentication terminal 30, an SMS indicating that handling is available to the authentication terminal 30; and an additional authentication unit 213 which, when receiving information identifying an SMS authentication application from the authentication terminal 30, authenticates access from a log-in terminal 10 if the information is a previously specified prescribed application. The authentication terminal 30 includes: an authentication information receiving unit 311 which receives an SMS for authentication; an authentication request transmission unit 312 which transmits an additional authentication request to the processing server 20; an approval screen display unit 313 which displays an approval screen; and an authentication information transmission unit 314 which transmits information identifying the SMS application to the processing server 20 when having accepted an approval operation from a user to the approval screen.SELECTED DRAWING: Figure 1

Description

The present invention relates to a multi-step authentication system using SMS.

Conventionally, two-step authentication using SMS on mobile terminals has been widely adopted to improve security at the time of user authentication (see, for example, Patent Document 1). It has increased.
As countermeasures against such attacks, authentication using an Authenticator application, authentication using FIDO (registered trademark), and the like have been proposed.

JP 2007-058469 A

However, conventional authentication methods such as authentication by an Authenticator application or authentication by FIDO make it impossible to log in when a device is lost. can't be

On the other hand, SMS linked to a phone number is highly important because it can be recovered at the store even when the terminal is lost, and can be continued even when the carrier is changed or the model is changed. Therefore, SMS authentication is required to have security equivalent to authentication by an Authenticator application or authentication by FIDO.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a multi-step authentication system that improves the security of SMS authentication.

An authentication system according to the present invention comprises a processing server accessed from a login terminal, and an authentication terminal of a user registered in the processing server. In response to this, an authentication message transmission unit that transmits an authentication message to the authentication terminal using a telephone number associated with the user ID, and a message indicating that it is possible to respond to an additional authentication request from the authentication terminal. When receiving from the authentication terminal, together with authentication information based on the authentication message, authentication information based on the authentication message and information specifying a transmission source application, the application is defined in advance. an additional authentication unit that authenticates access from the login terminal when the application is a specific application, the authentication terminal includes an authentication information reception unit that receives the message for authentication by a predetermined application; an authentication request transmitting unit for transmitting the additional authentication request accompanied by the telephone number of the terminal to the processing server in response to receiving the message for authentication; and the processing server indicating that the response is possible. an approval screen display unit for displaying an approval screen to the user by the predetermined application when the message is received; and an authentication information transmitting unit configured to transmit information specifying the predetermined application to the processing server.

The authentication information transmission unit transmits the authentication information and information specifying the predetermined application with a signature using a private key unique to the application, and the additional authentication unit is an authentication server for the predetermined application. The validity of the application may be verified by obtaining a public key corresponding to the private key provided in .

The authentication information transmission unit may transmit information specifying the predetermined application to the processing server via the authentication server together with authentication information based on the authentication message.

The response notification transmission unit may transmit the message indicating that the response is possible, and cause the login terminal to display a screen requesting an approval operation for the predetermined application.

The authentication terminal according to the present invention, in response to access to a processing server with a user ID from a login terminal, sends an authentication message sent from the processing server by a telephone number associated with the user ID to a predetermined application. an authentication information receiving unit that receives the authentication message from the above; an authentication request sending unit that sends an additional authentication request accompanied by the telephone number to the processing server in response to receiving the authentication message; an approval screen display unit for displaying an approval screen to the user by the predetermined application upon receiving a message indicating that the processing server is ready to respond, which is transmitted from the processing server using the telephone number in response to the request; When the approval operation from the user is received, information identifying the predetermined application is transmitted to the processing server together with authentication information based on the authentication message, so that the application is pre-registered in the processing server. an authentication information transmitting unit that authenticates access from the login terminal when the application is a prescribed specific application.

An authentication program according to the present invention is an authentication program possessed by a user's authentication terminal, and in response to access to a processing server with a user ID from a login terminal, the processing server uses a telephone number linked to the user ID. an authentication information receiving step of receiving the transmitted authentication message; and an authentication request sending step of sending an additional authentication request accompanied by the telephone number to the processing server in response to receiving the authentication message. an approval screen display step of displaying an approval screen to a user upon receiving a message indicating that the processing server can respond to the additional authentication request by using the telephone number; When an approval operation is received from the user on the screen, information specifying the authentication program is sent to the processing server together with authentication information based on the authentication message, so that the authentication program in the processing server is a predetermined specific application, an authentication information transmission step for authenticating access from the login terminal is performed by the authentication terminal.

According to the present invention, the security of SMS authentication can be improved in a multi-step authentication system.

It is a figure which shows the functional structure of the authentication system in embodiment. 4 is a sequence diagram illustrating an authentication procedure by the authentication system in the embodiment; FIG.

An example of an embodiment of the present invention will be described below.
The authentication method of this embodiment performs multi-step user authentication such as inputting a one-time password (OTP) notified by SMS to a terminal for authentication, following first authentication using an ID and a password. applied to the system.
That is, when the user himself/herself approves a specific application that has received an SMS, additional authentication is performed by verifying the legitimacy of this specific application at the access destination.

FIG. 1 is a diagram showing the functional configuration of an authentication system 1 according to this embodiment.
The authentication system 1 includes a processing server 20 and an authentication terminal 30 owned by a user registered in the processing server 20 as a configuration for performing additional user authentication when the login terminal 10 accesses the processing server 20. It has

The login terminal 10 is, for example, an information processing device such as a personal computer or a mobile terminal, and uses services provided by the processing server 20 .

The authentication terminal 30 is an information processing device capable of receiving a message (hereinafter referred to as SMS) based on the telephone number registered in the processing server 20 in order to authenticate the user of the login terminal 10, and is a mobile terminal such as a smart phone. is applicable.
Further, in the authentication terminal 30, a predetermined application for receiving SMS (hereinafter referred to as an SMS authentication application) operates. This SMS authentication application is mutually authenticated with the authentication server 40, and can communicate safely between two parties.

The control unit 21 of the processing server 20 functions as an authentication message transmission unit 211 , a correspondence notification transmission unit 212 , and an additional authentication unit 213 by executing software stored in the storage unit 22 .

The authentication message sending unit 211 sends an SMS for authentication to the authentication terminal 30 using the telephone number associated with the user ID in response to access from the login terminal 10 with the user ID.

In response to the additional authentication request from the authentication terminal 30, the support notification sending unit 212 sends an SMS indicating that it is available to the authentication terminal 30 using a telephone number.

When additional authentication unit 213 receives, from authentication terminal 30, OTP as authentication information described in an SMS for authentication and information specifying a transmission source application, this application is specified in advance as a specific application (SMS authentication application), access from the login terminal 10 is authenticated.
It is assumed that identification information of a specific reliable application is recorded in advance in the storage unit 22 .

By executing the SMS authentication application (authentication program) stored in the storage unit 32, the control unit 31 of the authentication terminal 30 controls the authentication information reception unit 311, the authentication request transmission unit 312, the approval screen display unit 313, and the authentication information transmission unit. It functions as part 314 .

The authentication information receiving unit 311 receives SMS for authentication.
In response to the authentication information receiving unit 311 receiving the SMS for authentication, the authentication request sending unit 312 sends an additional authentication request with the telephone number of its own terminal (authentication terminal 30) to the processing server 20 that is the sender. to send.

When the approval screen display unit 313 receives an SMS indicating that additional authentication is available from the processing server 20, the approval screen is displayed automatically or according to user operation.

Upon receiving an approval operation from the user on the approval screen, the authentication information sending unit 314 transmits information identifying itself (SMS authentication application) together with OTP, which is the authentication information described in the SMS for authentication, to the processing server 20. Send to

FIG. 2 is a sequence diagram illustrating an authentication procedure by the authentication system 1 in this embodiment.

In step S<b>1 , the user accesses a target service provided by the processing server 20 from a browser running on the login terminal 10 .

In step S<b>2 , the login terminal 10 (browser) accesses the processing server 20 , and the processing server 20 returns the login page to the login terminal 10 .

In step S3, the user enters an ID and password on the displayed login page.

In step S<b>4 , the login terminal 10 (browser) transmits the input ID and password to the processing server 20 , and the processing server 20 returns the login page to the login terminal 10 .

In step S5, the processing server 20 extracts the telephone number associated with the user ID from the user information database stored in the storage unit 22, and sends the OTP and sender domain to the authentication terminal 30 having this telephone number. Send an SMS containing

In step S6, the authentication terminal 30 (SMS authentication application) sends the phone number of the authentication terminal 30 to the processing server 20 of the sender domain when the received SMS is "SMS including OTP and source domain". Send.
This phone number may be sent via the authentication server 40 of the SMS authentication application.

In step S7, the processing server 20 returns to the authentication terminal 30 whether or not additional authentication is available.
Note that the processing server 20 may explicitly notify whether or not the response is possible, but may simply indicate that the response is possible.

In step S8, if the processing server 20 can handle additional authentication, the authentication terminal 30 (SMS authentication application) automatically displays an approval screen requesting the user to perform an approval operation, or displays an approval screen to the user based on the notification. display.

In step S9, the user performs a predetermined approval operation (for example, pressing a button or further inputting an OTP) on the approval screen.

In step S10, the authentication terminal 30 (SMS authentication application) sends the processing server 20 of the source domain a phone number identifying the authentication terminal 30, an OTP as authentication information, and information specifying the SMS authentication application ( app name, app domain, etc.).
The transmission path of these data may be directly to the processing server 20 or via the authentication server 40 .

In step S11, the user updates the login page (by pressing a button) or waits for automatic update. As a result, the login terminal 10 (browser) confirms the authentication status with the processing server 20 .

In step S12, the processing server 20 confirms that the received phone number, OTP, and SMS authentication application of the transmission source are valid, transmits the authentication information to the login terminal 10, and completes the login.

It should be noted that this processing procedure is only an example, and modifications in terms of implementation, such as increasing the authentication strength of the SMS authentication application in the processing server 20, may be made as appropriate.

For example, in step S6 of the sequence (FIG. 2), the authentication terminal 30 (SMS authentication application) may access the following URL and check the support status of the processing server 20 in advance.
https://[host]/sms-otp-configuration

In response to this, the processing server 20 writes the destination URL ("sms-opt-start") of the telephone number and the public key ("n") in the return value as follows, for example.
{
"sms-otp-start" : "https://[host]/api/sms-otp-start",
"sms-otp-confirm" : "https://[host]/api/sms-otp-confirm",
"key" : {
"e" : "AQAB",
"n" : "**** ... ****"
}
}

The authentication terminal 30 (SMS authentication application) transmits information such as the telephone number (MSISDN) to the notified URL, but not the telephone number as it is, but in the form of "nonce + hash value of MSISDN and nonce". good too. With SMS, malicious senders can spoof the source domain and can cause SMS authentication apps to send unintended phone numbers. can be kept secret.

Furthermore, the authentication terminal 30 (SMS authentication application) may transmit an application name or an application domain and a signature made with a secret key held by the SMS authentication application in addition to the phone number. Note that the private key may be held in the authentication server 40 instead of in the binary of the SMS authentication application, and the authentication terminal 30 (SMS authentication application) may transmit the signature via the authentication server 40. FIG.
Specifically, the authentication terminal 30 (SMS authentication application) accesses the processing server 20 as follows.
https://[host]/api/sms-otp-start?
nonce=AAAA
&msisdn=XXXXXXXXXXXX
&appdomain=****.com
&domainsign=YYYYYYYYY

The processing server 20 calculates a hash of nonce+MSISDN for the phone number currently being authenticated and confirms that it is currently being authenticated.
Next, the processing server 20 accesses the authentication server 40 provided by the provider of the SMS authentication application based on the application domain (appdomain) as follows.
https://[appdomain]/sms-otp-sender-configuration

The authentication server 40 responds as follows and returns the public key corresponding to the private key used for the signature to the processing server 20 .
{
"key" : {
"e" : "AQAB",
"n" : "**** ... ****"
}
}

The processing server 20 uses this public key to confirm that the signature of nonce+appdomain is domainsign. Here, the processing server 20 confirms that the appdomain is not illegal, and if there is no problem, replies as follows. Note that the country name of useragent and from is access source information at the time of access that sent the ID and password.
{
"auth-status" : "OK",
"useragent" : "XXXXXXXX",
"from" : "Japan"
}

After sending the SMS for authentication, the processing server 20 determines that the SMS authentication application is installed in the authentication terminal 30 when the above-mentioned access is made, and performs authorization by the SMS authentication application instead of the OTP input window. A screen requesting an operation is displayed on the login terminal 10.例文帳に追加

Further, in the sequence (FIG. 2), the authentication terminal 30 responds to the URL ("sms-otp-confirm") notified from the processing server 20 in step S10 after the user performs the approval operation with the SMS authentication application. Then, the phone number and OTP are transmitted, and the strength of authentication can be increased here as well as in step S6.
That is, the authentication terminal 30 may transmit “nonce+hash value of MSISDN and nonce” and “nonce+hash value of MSISDN+OTP and nonce”. Alternatively, the processing server 20 may return a token when returning the access source information, and use this token instead of "nonce+hash value of MSISDN and nonce".

Further, in the additional authentication in step S10, for example, any one of the following (1) to (4) can be adopted as the verification pattern of the SMS authentication application.

(1) Unsigned pattern:
The authentication terminal 30 (SMS authentication application) transmits its own telephone number, OTP, and application name to the processing server 20 of the transmission source domain.
The processing server 20 determines safety based on the application name.

(2) Signature pattern using the key in the SMS authentication app:
The authentication terminal 30 (SMS authentication application) sends the "application domain and phone number and OTP”.
The processing server 20 acquires the public key from the authentication server 40 of the application domain, verifies the signature, and determines security by the application domain.

(3) Signature pattern using the key in the authentication server 40:
Authentication terminal 30 (SMS authentication application) transmits its own phone number and OTP to authentication server 40 .
The authentication server 40 sends a "signature including the application domain, telephone number, and OTP" generated using the application domain, telephone number, OTP, and private key held in the authentication server 40 to the SMS authentication application. Send.

The SMS authentication application transmits the application domain, the telephone number, the OTP, and the "signature including the application domain, the telephone number, and the OTP" received from the authentication server 40 to the processing server 20 of the source domain.
The processing server 20 acquires the public key from the authentication server 40 of the application domain, verifies the signature, and determines security by the application domain.

(4) Pattern for relaying authentication server 40:
Authentication terminal 30 (SMS authentication application) transmits its own phone number and OTP to authentication server 40 .
The authentication server 40 transmits the telephone number and OTP to the processing server 20 of the source domain.
The processing server 20 determines security based on the IP address of the authentication server 40 that is the access source, or the SSL server certificate/client certificate.

According to the present embodiment, the authentication system 1 allows the SMS authentication application of the authentication terminal 30 to authenticate the processing server 20 when the SMS authentication application of the authentication terminal 30 accepts the user's own authorization operation during SMS authentication. Send OTP. By performing additional authentication for verifying the validity of this SMS authentication application, the processing server 20 can counter SMS wiretapping malware and improve the security of SMS authentication in the multi-step authentication system 1 .

Furthermore, even if the processing server 20 does not support additional authentication, the authentication system 1 can complete SMS authentication using the conventional sequence that only accepts OTP, so it is easily adaptable to existing implementations and has high versatility. .
Also, even if the authentication terminal does not support additional authentication, SMS authentication can be completed by the conventional sequence.
Note that when the processing server 20 separates the additional authentication sequence and the conventional sequence, it is preferable not to complete the login for a certain period of time when there is a possibility of access from the SMS authentication application.

The authentication system 1 obtains a public key from the authentication server 40 by sending a signature to the information specifying the SMS authentication application from the authentication terminal 30 to the processing server 20, thereby validating the SMS authentication application. can be properly verified.
In addition, by transmitting data to the processing server 20 via the authentication server 40, information for additional authentication can be safely provided from the authentication server 40 already mutually authenticated with the SMS authentication application.

The processing server 20 transmits a message indicating that additional authentication is available to the authentication terminal 30, and causes the login terminal 10 to display a screen requesting an approval operation for the SMS authentication application, thereby ensuring greater safety. The user can be appropriately notified of the necessary additional authentication procedures.

In addition, according to the above-described embodiment, for example, SMS authentication that is resistant to malware attacks can be realized and unauthorized access damage can be reduced. It will be possible to contribute to the promotion of sustainable industrialization and the expansion of innovation.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely enumerations of the most suitable effects produced by the present invention, and the effects of the present invention are not limited to those described in the embodiments.

An authentication method by the authentication system 1 is realized by software. When it is implemented by software, a program constituting this software is installed in an information processing device (computer). Further, these programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to users' computers via a network. Furthermore, these programs may be provided to the user's computer as a web service through the network without being downloaded.

1 authentication system 10 login terminal 20 processing server 21 control unit 22 storage unit 30 authentication terminal 31 control unit 32 storage unit 40 authentication server 211 authentication message transmission unit 212 correspondence notification transmission unit 213 additional authentication unit 311 authentication information reception unit 312 authentication request transmission Unit 313 Approval screen display unit 314 Authentication information transmission unit

Claims (6)

An authentication system comprising a processing server accessed from a login terminal and a user authentication terminal registered in the processing server,
The processing server is
an authentication message sending unit that sends an authentication message to the authentication terminal using a telephone number associated with the user ID in response to access from the login terminal with the user ID;
a response notification transmission unit that transmits a message indicating that it is possible to respond to an additional authentication request from the authentication terminal to the authentication terminal using the telephone number;
When receiving from the authentication terminal, authentication information based on the authentication message and information specifying a source application, if the application is a predetermined specific application, access from the login terminal is prohibited. an additional authenticator that authenticates,
The authentication terminal is
an authentication information receiving unit for receiving the authentication message by a predetermined application;
an authentication request transmission unit that transmits the additional authentication request accompanied by the phone number of the terminal to the processing server in response to receiving the authentication message;
an approval screen display unit for displaying an approval screen to the user by the predetermined application when receiving the message indicating that the response is possible from the processing server;
an authentication information transmitting unit configured to transmit information identifying the predetermined application together with authentication information based on the authentication message to the processing server when an approval operation is received from the user on the approval screen; authentication system. The authentication information transmission unit transmits the authentication information and the information specifying the predetermined application with a signature using a private key unique to the application, and
2. The authentication system according to claim 1, wherein said additional authentication unit verifies the validity of said application by acquiring a public key corresponding to said private key provided by an authentication server of said predetermined application. 3. The authentication system according to claim 2, wherein said authentication information transmitting unit transmits information specifying said predetermined application to said processing server via said authentication server together with authentication information based on said message for authentication. According to any one of claims 1 to 3, the response notification transmission unit transmits a message indicating that the response is possible, and causes the login terminal to display a screen requesting an approval operation for the predetermined application. An authentication system according to any one of the preceding claims. an authentication information receiving unit that receives, by a predetermined application, an authentication message sent from the processing server by a telephone number associated with the user ID in response to access to the processing server with the user ID from the login terminal; ,
an authentication request transmission unit that transmits an additional authentication request accompanied by the telephone number to the processing server in response to receiving the authentication message;
an approval screen display unit for displaying an approval screen to a user by the predetermined application upon receiving a message indicating that the processing server can respond, which is transmitted from the processing server through the telephone number in response to the additional authentication request; ,
Upon receiving an approval operation from the user on the approval screen, authentication information based on the authentication message and information specifying the predetermined application are transmitted to the processing server, thereby causing the processing server to: an authentication information transmitting unit that authenticates access from the login terminal when the application is a predetermined specific application. An authentication program possessed by a user's authentication terminal,
an authentication information receiving step of receiving an authentication message sent from the processing server by a telephone number associated with the user ID in response to access to the processing server with the user ID from the login terminal;
an authentication request transmission step of transmitting an additional authentication request accompanied by the telephone number to the processing server in response to receiving the authentication message;
an approval screen display step of displaying an approval screen to a user upon receipt of a message indicating that the processing server is ready to respond, which is transmitted from the processing server through the telephone number in response to the additional authentication request;
When an approval operation is received from the user on the approval screen, authentication information based on the authentication message and information specifying the authentication program are transmitted to the processing server, thereby allowing the processing server to perform the authentication. and an authentication information transmission step for authenticating access from the login terminal when the authentication program is a predetermined specific application.

Images