JP2023159772A - Information processing apparatus, information processing method, and information processing program - Google Patents

Abstract

To provide a technique to dynamically create a secret question in an authentication technology.SOLUTION: An information processing apparatus according to the present application comprises: a creation unit that, on the basis of a user's action log, dynamically creates a secret question and a correct answer for identification; and an authentication processing unit that collates a user's answer to the secret question with the correct answer to perform identification. For example, the authentication processing unit causes the user to input data of a document or an image obtained by the user in relation to a user's behavior as the user's answer to the secret question. The authentication processing unit collates a hash value based on the input data of the document or the image with a hash value stored in advance as the correct answer to perform identification.SELECTED DRAWING: Figure 9

Description

The present invention relates to an information processing device, an information processing method, and an information processing program.

As a technology related to authentication, a technology using an authenticator has been disclosed (see Patent Document 1).

Japanese Patent Application Publication No. 2020-141331

However, in the above-mentioned conventional technology, there is still room for improvement regarding the method of creating a secret question for identity verification in the authentication technology.

The present application has been made in view of the above, and aims to provide a method for dynamically creating secret questions in authentication technology.

The information processing device according to the present application includes a generation unit that dynamically generates a secret question and a correct answer for identity verification based on a user's behavior log, and a generation unit that dynamically generates a secret question and a correct answer for identity verification, and a generation unit that dynamically generates a secret question and a correct answer to the secret question. and an authentication processing unit that verifies the identity of the user and verifies the identity of the user.

According to one aspect of the embodiment, a method for dynamically creating secret questions in authentication technology can be provided.

FIG. 1 is an explanatory diagram showing an overview of an information processing method according to an embodiment. FIG. 2 is a diagram showing an example of identity verification. FIG. 3 is an explanatory diagram showing an overview of the identity service. FIG. 4 is an explanatory diagram showing an overview of an embodiment that requests identity verification at the time of authentication. FIG. 5 is an explanatory diagram showing an overview of the attestation mechanism. FIG. 6 is an explanatory diagram showing an overview of authentication strength management. FIG. 7 is an explanatory diagram showing an overview of an embodiment of FIDO registration in authentication strength management. FIG. 8 is an explanatory diagram showing an overview of an example of re-implementing attestation. FIG. 9 is an explanatory diagram showing an overview of an example of dynamic secret question creation. FIG. 10 is an explanatory diagram showing an overview of an example of delegation of authority for account recovery from a child to a parent. FIG. 11 is a diagram illustrating a configuration example of an information processing system according to an embodiment. FIG. 12 is a diagram illustrating a configuration example of a terminal device according to the embodiment. FIG. 13 is a diagram illustrating a configuration example of a server device according to an embodiment. FIG. 14 is a diagram showing an example of a user information database. FIG. 15 is a diagram showing an example of a history information database. FIG. 16 is a diagram showing an example of the authentication information database. FIG. 17 is a flowchart showing the processing procedure according to the embodiment. FIG. 18 is a diagram showing an example of a hardware configuration.

DESCRIPTION OF THE PREFERRED EMBODIMENTS An information processing apparatus, an information processing method, and an information processing program according to the present application (hereinafter referred to as "embodiments") will be described in detail below with reference to the drawings. Note that the information processing apparatus, information processing method, and information processing program according to the present application are not limited to this embodiment. In addition, in the following embodiments, the same parts are given the same reference numerals, and redundant explanations will be omitted.

[1. Overview of information processing method]
First, with reference to FIG. 1, an overview of an information processing method performed by an information processing apparatus according to an embodiment will be described. FIG. 1 is an explanatory diagram showing an overview of an information processing method according to an embodiment. Note that in FIG. 1, an example will be described in which a method of dynamically creating a secret question in authentication technology is provided.

As shown in FIG. 1, the information processing system 1 includes a terminal device 10 and a server device 100. The terminal device 10 and the server device 100 are connected to be able to communicate with each other by wire or wirelessly via a network N (see FIG. 11). In this embodiment, the terminal device 10 cooperates with the server device 100.

The terminal device 10 is a smart device such as a smartphone or a tablet terminal used by a user U (user), and is connected to an arbitrary server device via a wireless communication network such as 4G (Generation) or LTE (Long Term Evolution). This is a mobile terminal device that can communicate. Further, the terminal device 10 has a screen such as a liquid crystal display, which has a touch panel function, and displays data such as content through a tap operation, a slide operation, a scroll operation, etc. from the user U using a finger or a stylus. Accepts various operations on. Note that an operation performed on an area of the screen where content is displayed may be an operation on the content. Further, the terminal device 10 may be not only a smart device but also an information processing device such as a desktop PC (Personal Computer) or a notebook PC.

In this embodiment, the terminal device 10 functions as a FIDO client in FIDO authentication (Fast Identity Online). The FIDO client performs user authentication in cooperation with an authenticator. Note that the authenticator may be installed in the same device as the FIDO client (built-in authenticator), or may be installed in a device physically different from the FIDO client (external authenticator).

For example, FIDO authentication uses authentication methods that use memories or possessions such as PIN (Personal Identification Number), USB (Universal Serial Bus) security keys, and smart cards, as well as biometric information such as fingerprints, face, iris, veins, and voice prints. It is possible to implement an authentication method using behavioral information. The authentication method is not limited to these, and any method can be introduced. It is also possible to combine multiple authentication methods to achieve multimodal biometric authentication and multifactor authentication.

Hereinafter, in order to simplify the explanation, the terminal device 10 will be described as both a FIDO client and an authenticator without distinguishing between a FIDO client and an authenticator. That is, a case where the authenticator is an internal authenticator will be explained as an example. Note that, in reality, the authenticator may be an external authenticator that is physically independent from the terminal device 10 and can cooperate with the terminal device 10.

It is also possible to implement a web authentication API (Application Programming Interface) that calls an authenticator from the web content displayed on the FIDO client's web browser and enables FIDO authentication through interaction with the authentication server. I will omit the explanation of the form.

The server device 100 is an information processing device that functions as an authentication server (FIDO server) in FIDO authentication, and is realized by a computer, a cloud system, or the like. The authentication server corresponds to an RP (Relying Party)/IdP (Identity Provider). FIDO authentication is resistant to phishing because "secrets" such as passwords and biometric information are not shared between the authenticator and the authentication server.

As shown in FIG. 1, in FIDO authentication, upon receiving an authentication request from a user, the authentication server sends a challenge to the authenticator on the user side. The challenge is a random character string that is valid only once, and is a data string that is different each time based on random numbers. The user performs user verification using an authenticator and verifies his/her identity locally. Then, the authenticator signs the verification result with a private key and sends it to the authentication server as a signed verification result (signed response). Upon receiving the signed verification result, the authentication server verifies the signature using a public key.

In this way, in FIDO authentication, the authentication server uses a public key to realize authentication by confirming that the user's authenticator has an appropriate private key. The authenticator and authentication server do not share a "private key".

The server device 100 also functions as a cooperative RP/SP (Service Provider) that provides identity services through ID cooperation (federation) with an RP/IdP that supports FIDO authentication. When FIDO authentication and ID federation are combined, the authentication context is propagated from the authenticator to the cooperating RP/SP via the RP/IdP.

Hereinafter, in order to simplify the explanation, the server device 100 will be described as both an RP/IdP and a cooperative RP/SP without distinguishing between RP/IdP and cooperative RP/SP. Note that, in reality, the server device 100 as the RP/IdP and the server device 100 as the cooperative RP/SP may be physically independent and different server devices 100.

For example, the server device 100 cooperates with the terminal device 10 of each user U, and provides API (Application Programming Interface) services for various applications (hereinafter referred to as applications) to the terminal device 10 of each user U. Various data may be provided.

Further, the server device 100 may be an information processing device that provides some kind of web service online to the terminal device 10 of each user U. For example, the server device 100 provides web services such as Internet connection, search service, SNS (Social Networking Service), electronic commerce (EC), electronic payment, online games, online banking, online trading, accommodation/ticket reservation, Services such as video/music distribution, news, maps, route searches, route guidance, route information, operation information, weather forecasts, etc. may be provided. In reality, the server device 100 may cooperate with various servers that provide the above-mentioned Web services, mediate the Web services, or may be in charge of processing the Web services.

Note that the server device 100 can acquire user information regarding the user U. For example, the server device 100 acquires information regarding user U's attributes such as user U's gender, age, and residential area. The server device 100 stores and manages identification information indicating the user U (user ID, etc.) as well as information regarding attributes of the user U.

Further, the server device 100 acquires various kinds of history information (log data) indicating the actions of the user U from the terminal device 10 of the user U or from various servers based on the user ID or the like. For example, the server device 100 acquires a location history, which is a history of user U's location, date and time, from the terminal device 10. The server device 100 also acquires a search history, which is a history of search queries input by the user U, from a search server (search engine). Additionally, the server device 100 acquires a viewing history, which is a history of content viewed by the user U, from the content server. The server device 100 also acquires a purchase history (payment history) that is a history of product purchases and payment processing by the user U from the electronic commerce server and the payment processing server. Further, the server device 100 may acquire the listing history and the sales history, which are the listing history of the user U on the marketplace, from the electronic commerce server or the payment processing server. The server device 100 also acquires a posting history, which is a history of postings by the user U, from a posting server or SNS server that provides a word-of-mouth posting service. Note that the various servers described above may be the server device 100 itself. That is, the server device 100 may function as the various servers described above.

[1-1. Personal strength management〕
As shown in FIG. 2, in a typical authentication system, identity proofing is used to confirm whether the user is the user. FIG. 2 is a diagram showing an example of identity verification. In identity verification, the user is deemed to be the user by confirming that the attribute information registered in advance by the user matches the attribute information presented. The server device 100 can provide a personal identity service specific to the user on the premise that the user's identity is properly verified. For example, since user self-reported attribute information has low identity strength, services that require high identity accuracy cannot be provided.

In addition, users' personal attribute information may vary in reliability depending on the method of identity verification, information may become obsolete over time, or management information may not be updated in accordance with actual personal attribute information. With the conventional technology, it is difficult to appropriately maintain the reliability of information because the reliability of the information decreases due to various reasons.

Furthermore, security policies are subject to frequent changes due to technological advances, the discovery of vulnerabilities, social demands, corporate policies, etc.

As shown in FIG. 3, in this embodiment, the server device 100 continuously manages personal attribute information when verifying the person (identity verification) so as to satisfy the security policy. FIG. 3 is an explanatory diagram showing an overview of the identity service.

For example, the server device 100 appropriately and continuously manages the reliability of personal attribute information, and performs new authentication or identity verification processing to satisfy security policies if they are not satisfied during access control to provide identity services. Activate.

When controlling access to provide identity services, the server device 100 determines the accuracy of attributes for the online user being authenticated by multiplying the authentication accuracy and the identity accuracy. When the authentication accuracy is p1 and the identity accuracy is p2, the accuracy of the attribute for the online user being authenticated is expressed by the following equation (1). Here, as an example, both probabilities are multiplied.

If the original identity accuracy is low, the attributes linked to the ID are not reliable. If the authentication accuracy is weak, there is a possibility that the ID associated with the user is not appropriate (spoofing). When ID: id, user: u, attribute: A, authentication accuracy: p1, and identity accuracy: p2, the evaluation function is expressed by the following equation (2). Here, "*" means multiplication, and any operation may be defined.

As shown in FIG. 3, a link L1 between user:u and ID:id is established after each successful authentication attempt (authentication session). If the validity period of the authentication session is exceeded, the strength becomes 0. The strength of this link L1 indicates authentication accuracy: p1.

Attribute: A is managed by the authentication server. Attribute: A has strength as an attribute set (a ₁ , a ₂ , . . . _an ). Attribute: A may have a strength for each attribute, but it depends on the form of the identity verification document (identity verification document).

Further, a link L2 between ID:id and attribute:A is established at the time of identity verification. The intensity changes (attenuates, increases, etc.) depending on the type of attribute. The strength of this link L2 indicates the identity accuracy: p2.

Also, the link L3 between ID:id and authentication information:password can be considered as one of the strengths of the person, but since it is set by the person who opened the ID (or the administrator), the accuracy can be considered to be 1.

In this manner, the server device 100 determines the accuracy of personal attribute information for the online user being authenticated by multiplying the authentication accuracy and the identity accuracy. The authentication accuracy becomes 0 when the validity period of the authentication session established after each successful authentication attempt is exceeded. The identity accuracy varies depending on the type of personal attribute information.

[1-1-1. Identity management function]
(1) Management of user attributes The server device 100, which is an authentication server, manages user attributes. For example, the server device 100 performs life cycle processing such as registration, update, and deletion.

(2) Management of Attribute Meta Information The server device 100 also manages attribute meta information in association with user attributes. For example, the server device 100 manages the identity verification method used to obtain user attributes, identity verification documents, meta information (issuer, etc.) of the identity verification documents, identity verification date and time, and the like.

(3) Management of identity accuracy The server device 100 also manages identity accuracy. For example, the server device 100 uses the above-mentioned attributes and meta information to calculate the evaluation function based on a predetermined evaluation function, and continuously manages the evaluation function. Further, the server device 100 uses a trigger when necessary, such as access control, or periodically updates the information. At this time, the server device 100 performs an evaluation that takes attenuation into consideration. Further, the server device 100 may describe and control the accuracy information management method using a security policy. For example, the server device 100 updates every day. Alternatively, the server device 100 issues an alert if the expiration date of the person verification document has expired, or requests (requests) the implementation of identity verification at the time of authentication. Alternatively, the server device 100 decreases the identity accuracy by 0.01 every day (from the date of issue of the identity verification document).

[1-1-2. Identity verification request during authentication]
Referring to FIG. 4, an embodiment in which identity verification is requested at the time of authentication will be described. FIG. 4 is an explanatory diagram showing an overview of an embodiment that requests identity verification at the time of authentication.

As shown in FIG. 4, a user U, who is a user, uses a terminal device 10 to perform authentication using an ID and password with a server device 100, which is an authentication server, via a network N (see FIG. 11). (Step S1). Note that the authentication may be performed in advance. For example, the user U may continue to maintain a logged-in state to the server device 100 after being authenticated for the first time.

Subsequently, the user U uses the terminal device 10 to transmit a service request to the server device 100, which is an authentication server, via the network N (see FIG. 11) (step S2).

Subsequently, the server device 100, which is an authentication server, calculates authentication accuracy, identity accuracy, and evaluation function in response to a service request from user U, who is a user (step S3).

Next, the server device 100, which is an authentication server, has an identity management function, refers to the security policy, makes a control decision, and requests the user U to confirm the identity based on the security policy and the control decision. is determined (step S4). For example, if the identity verification document is a driver's license (paper copy) and the expiration date is December 2021, the server device 100 requests identity verification if the attribute information has expired based on the security policy.

Next, the server device 100, which is an authentication server, sends an error message indicating that the attribute information does not satisfy the security policy or a new message to the terminal device 10, which is an authenticator, via the network N (see FIG. 11). A service response including a request for identity verification processing is transmitted (step S5). In this embodiment, the terminal device 10 serving as the authenticator is the terminal device 10 of the user U who is the user. At this time, the server device 100, which is an authentication server, transmits a challenge to the terminal device 10, which is an authenticator.

Subsequently, the terminal device 10 as an authenticator determines the attributes included in the identification document (driver's license, My Number card, etc.) of the user U, in response to the service response from the server device 100 as an authentication server. Information is acquired (step S6). At this time, the terminal device 10 may request the user U to input attribute information included in the identification card, and may accept the input of the attribute information. The method of inputting the attribute information is not limited to manual input, but may also be data uploading, image data scanning and image analysis, voice input, etc. Alternatively, the terminal device 10 may extract attribute information that it owns internally.

Next, the terminal device 10 as an authenticator transmits a service request including a set of ID and attribute information to the server device 100 as an authentication server via the network N (see FIG. 11). (Step S7). At this time, the terminal device 10 serving as the authenticator signs and transmits the challenge from the server device 100 using the private key for authentication.

Next, in response to a service request from the terminal device 10 as an authenticator, the server device 100, which is an authentication server, authenticates the identity of the user U, based on the user U's ID and attribute information. The confirmation document is checked, and if there are any changes, the data is updated, and compliance with the security policy is verified (step S8). At this time, the server device 100, which is an authentication server, verifies the signature using the authentication public key in response to the signed challenge from the terminal device 10, which serves as an authenticator.

Subsequently, the server device 100, which is an authentication server, transmits a service response indicating OK to the terminal device 10, which is an authenticator, via the network N (see FIG. 11) (step S9).

Note that the accuracy function for identity verification may take into account that the accuracy of data attenuates over time.

Additionally, the concept of risk-based authentication may be introduced. For example, if the usage environment is different from usual, set a higher threshold (set the security policy accordingly).

Additionally, the security policy may be as follows.
(1) If the evaluation function is lower than a predetermined threshold, identity verification is required.
(2) If a self-declaration of the user's attributes is input (first entry or update), the relevant identification documents are requested.
(3) If there is a self-declaration of the user's attributes, it is registered as no identification document required.

In this manner, in this embodiment, the server device 100 verifies the identity of the user by confirming that the personal attribute information registered in advance by the user matches the personal attribute information presented by the user. Then, the server device 100 continuously manages the registered personal attribute information for identity verification so as to satisfy the security policy.

At this time, when the server device 100 performs access control to provide identity services to the user, if the personal attribute information does not satisfy the security policy, it initiates new authentication and identity verification processing so as to satisfy the security policy.

Thereby, the server device 100 suppresses variations in the reliability of personal attribute information due to differences in identity verification methods and continuously manages the reliability of personal attribute information based on the security policy. Furthermore, the server device 100 suppresses a decrease in the reliability of personal attribute information over time and continuously manages the reliability of personal attribute information based on the security policy.

Furthermore, when the security policy is changed, the server device 100 continuously manages personal attribute information so that it satisfies the changed security policy.

Additionally, the server device 100 determines that the personal attribute information does not satisfy the security policy if the expiration date of the identity verification document that is the basis of the registered personal attribute information has passed or the identity verification document has expired. It is determined that this is the case, and a new authentication and identity verification process is initiated to satisfy the security policy.

[1-2. Authenticator management]
In this embodiment, an authentication system is realized that can manage authenticator birth certificate documents (attestation) and change the authentication method.

Referring to FIG. 5, a description will be given of a mechanism in which an authentication server determines the reliability of an authenticator using the authenticator's birth certificate document (attestation) in normal (conventional) FIDO authentication. FIG. 5 is an explanatory diagram showing an overview of the attestation mechanism.

As shown in FIG. 5, an authenticator vendor generates and distributes a key pair (private key, public key) for attestation at the time of shipment. In this embodiment, the authenticator vendor or the like stores the attestation private key in the authenticator at the time of shipment. The server device 100, which is an authentication server, obtains an attestation public key in advance from an authenticator vendor or the like.

Furthermore, when registering the authenticator, the user uses the attestation key pair to place the authentication key pair. In this embodiment, the terminal device 10 as an authenticator generates an authentication key pair when registering the authenticator. Then, the terminal device 10 as an authenticator registers and stores the authentication private key. Further, the terminal device 10 as an authenticator sends the public key for authentication to the server device 100 as an authentication server, including the data signed with the private key for attestation (signed data). The server device 100, which is an authentication server, verifies the signature of the signed data received from the terminal device 10 as an authenticator using the attestation public key, and if it is successful, verifies the signature received from the terminal device 10 as an authenticator. Register and store the public key for use.

However, in normal FIDO authentication, if a user registers a FIDO authenticator using an attestation mechanism, the authentication method cannot be changed even if the security policy of the authentication server changes thereafter. The reason is that the attestation document is the basis for the user's authentication accuracy.

Therefore, in this embodiment, the server device 100, which is an authentication server, stores and manages the user's attestation document received at the time of FIDO registration.

[1-2-1. Management of authentication strength]
An overview of authentication strength management will be described with reference to FIG. 6. FIG. 6 is an explanatory diagram showing an overview of authentication strength management.

As shown in FIG. 6, the link L1 between user:u and ID:id is established after each authentication attempt is successful (authentication session). If the validity period of the authentication session is exceeded, the strength becomes 0. The strength of this link L1 indicates authentication accuracy: p1.

Authentication accuracy: p1 is based on public key reliability strength. In other words, if a public key is created using unreliable attestation, the authentication strength in each authentication attempt will be low.

Note that the link L2 between ID:id and attribute:A is irrelevant in the management of authentication strength. That is, the identity accuracy: p2 is not considered. However, in reality, there may be an option to manage the authentication strength by combining the authentication accuracy: p1 and the identity accuracy: p2.

Further, a link L3' between ID: id and authentication information: public key indicates public key reliability strength.
Authentication information: The public key is set at the time of FIDO registration. The authenticator's birth certificate document (attestation document) is used as a measure of this reliability.

The authenticator birth certificate document (attestation document) proves the reliability of the authenticator/device that created the public key. The public key reliability strength is determined by this content.

In this embodiment, the server device 100, which is an authentication server, has an authenticator birth certificate management function and an authentication strength management function in addition to a FIDO registration function and a FIDO authentication function.

[1-2-2. Implementation of FIDO registration]
With reference to FIG. 7, an example of FIDO registration in authentication strength management will be described. FIG. 7 is an explanatory diagram showing an overview of an embodiment of FIDO registration in authentication strength management.

As shown in FIG. 7, the server device 100, which is an authentication server, transmits a challenge, which is a random character string, as an authentication request to the terminal device 10, which is an authenticator (step S11).

Subsequently, the terminal device 10 serving as an authenticator performs user verification on the user U using a predetermined authentication means such as biometric authentication in response to an authentication request from the authentication server (step S12).

Subsequently, if the terminal device 10 as an authenticator succeeds in user verification, it signs the challenge from the authentication server using the attestation private key 1 it possesses, and also signs the authentication key pair (authentication private key 1). , an authentication public key 1) is generated, and the authentication private key 1 is stored (step S13).

Subsequently, the terminal device 10 as an authenticator transmits a signed challenge, an authentication public key 1, and an attestation document 1 to the server device 100 as an authentication server as an authentication response to the authentication request. (Step S14).

Next, in response to the authentication response from the authenticator, the server device 100, which is an authentication server, verifies the signature of the signed challenge using the attestation public key 1 that it owns, and stores the authentication public key 1. (Step S15).

Note that, in reality, the server device 100, which is an authentication server, may store the authentication public key 1 only when signature verification is successful.

Subsequently, if the signature verification is successful, the server device 100, which is the authentication server, extracts the user ID indicating the user U (step S16).

Subsequently, the server device 100, which is an authentication server, stores the attestation document 1 in association with the extracted user ID (step S17). Note that the attestation document is an example of a document that evaluates authentication strength.

[1-2-3. Re-execution of attestation]
When the server device 100, which is an authentication server, decides to strengthen security, if the already stored user's attestation document 1 does not satisfy the authentication strength (level), it re-performs attestation that satisfies the set strength. .

For example, suppose that a vulnerability is found in authenticator A currently in use. Assume that the security policy is updated to disallow authentication requests from authenticator A that has a bug. In this case, when an authentication request using authenticator A is received from a user, the authentication device A is prompted to update the firmware of authenticator A, and at the same time is prompted to re-register with the updated authenticator A, and the attestation document is updated. Alternatively, it prompts re-registration with a new authenticator B and updates the attestation document.

An example of re-implementing attestation will be described with reference to FIG. FIG. 8 is an explanatory diagram showing an overview of an example of re-implementing attestation.

As shown in FIG. 8, the server device 100, which is an authentication server, refers to the user's authenticator birth certificate document (attestation document) in advance, and if it confirms that the strength is insufficient, the server device 100, which is an authentication server, re-references it at the next authentication opportunity. Settings are made to prompt registration (step S20).

Then, on the occasion of authentication, the server device 100, which is an authentication server, transmits a challenge, which is a random character string, as an authentication request to the terminal device 10, which is an authentication device, and also sends a challenge, which is a random character string, to the terminal device 10, which is an authentication device. Prompt re-registration (step S21).

Subsequently, the terminal device 10 serving as an authenticator performs user verification on the user U using a predetermined authentication means such as biometric authentication in response to the authentication request from the authentication server (step S22).

Subsequently, when the terminal device 10 as an authenticator succeeds in user verification, it signs the challenge from the authentication server using the attestation private key 2 that it possesses (step S23).

For example, due to the firmware update of the currently used authenticator A (or authentication app update) or the start of use of a new authenticator B, the terminal device 10 as an authenticator may differ from the attestation private key 1. The attestation private key 2 is now stored. In other words, the authenticator vendor or the like has generated and distributed a new attestation key pair (private key, public key).

At this time, the terminal device 10 serving as the authenticator may delete the authentication private key 1 that it holds. This makes it necessary to re-implement the above FIDO registration (see FIG. 8). That is, after re-implementing the current attestation, the terminal device 10 serving as the authenticator performs FIDO registration again, and generates and distributes a new authentication key pair. Further, the terminal device 10 serving as an authenticator may delete the attestation private key 1 if the attestation private key 1 that does not satisfy the authentication strength (level) remains inside.

Subsequently, the terminal device 10 as the authenticator transmits the signed challenge and the attestation document 2 as an authentication response to the authentication request to the server device 100 as the authentication server (step S24).

Subsequently, the server device 100, which is an authentication server, performs signature verification of the signed challenge using the attestation public key 2 that it possesses in response to the authentication response from the authenticator (step S25).

Note that the server device 100, which is an authentication server, acquires the paired attestation public key 2 at the timing when the terminal device 10, which is an authenticator, stores (or becomes able to acquire) the attestation private key 2. It is assumed that the For example, the server device 100, which is an authentication server, obtains the attestation public key 2 from an authenticator vendor or the like and stores it.

Subsequently, if the signature verification is successful, the server device 100, which is the authentication server, extracts the user ID indicating the user U (step S26).

Subsequently, the server device 100, which is an authentication server, stores the attestation document 2 in association with the extracted user ID, and updates the authenticator birth certificate document (step S27).

At this time, the server device 100, which is an authentication server, may discard (delete) the attestation document 1 that has been linked to the user ID. For example, the server device 100, which is an authentication server, may overwrite the attestation document 1 associated with the user ID with the attestation document 2.

As a result, even if the security policy changes, the strength (level) of identity verification can be flexibly changed to satisfy the security policy. In addition, the strength of identification can be adjusted to match the security policy without changing the user authentication process (procedure).

In this manner, in this embodiment, the server device 100, which is an authentication server, determines the reliability of the authenticator based on the attestation document, and performs FIDO authentication with the reliable authenticator. For this purpose, the server device 100 stores the attestation document and continuously manages the authentication strength of the attestation document.

For example, when the server device 100 decides to strengthen security, if the already stored attestation document does not satisfy the authentication strength, it re-performs the attestation that satisfies the authentication strength. Alternatively, if the authenticator no longer satisfies the security policy due to the passage of time or the discovery of a problem, the server device 100 re-executes the attestation. Alternatively, if the authenticator no longer satisfies the security policy due to a change in the security policy, the server device 100 re-executes the attestation.

Furthermore, the server device 100 determines the reliability strength of the public key based on the contents of the attestation document. The server device 100 verifies the signature using the private key of the authenticator with the public key corresponding to the private key. At this time, the server device 100 manages the reliability strength of the public key, and requests a change of the public key when the reliability strength of the public key decreases.

For example, the server device 100 determines that the reliability of the public key has deteriorated over time, and requests that the public key be changed. Alternatively, if the public key has expired, the server device 100 determines that the reliability of the public key has decreased and requests that the public key be changed. Further, if the reliability strength of the public key does not satisfy the security policy, the server device 100 determines that the reliability strength of the public key has decreased, and requests a change of the public key.

[1-3. Dynamic secret question creation]
Information that will be used to determine identity verification must be registered in advance, which is time-consuming. Also, unless the person is registered, it is not possible to confirm that the person is the person.

Therefore, in this embodiment, a "secret question" (a question unique to the user) for verifying the user's identity is dynamically generated. For example, a user's "secret question" is dynamically created based on the user's behavior log.

An example of dynamic secret question creation will be described with reference to FIG. FIG. 9 is an explanatory diagram showing an overview of an embodiment of dynamic secret question creation.

As shown in FIG. 9, the server device 100, which is an authentication server, analyzes the log of the user U, who is the user, in advance, and generates a question template (step S30).

The terminal device 10 of the user U makes an access request including the user ID indicating the user U to the server device 100 that is the authentication server (step S31).

Next, in response to the access request from the terminal device 10 of the user U, the server device 100, which is an authentication server, generates questions and answers for the user U, and also displays an authentication screen (questions and answers). ) is generated (step S32).

Subsequently, the server device 100, which is an authentication server, provides (displays) an authentication screen including a question as an authentication request to the terminal device 10, which serves as an authenticator (step S33).

Subsequently, the user U inputs an answer to the question included in the authentication screen on the authentication screen displayed on the terminal device 10 serving as an authenticator (step S34).

Subsequently, the terminal device 10 as the authenticator transmits the answer input by the user U as an authentication response to the authentication request from the server device 100 as the authentication server (step S35).

Subsequently, the server device 100, which is an authentication server, verifies the response from the terminal device 10, which serves as an authenticator, and generates a result screen regarding the authentication result (step S36).

For example, the server device 100, which is an authentication server, compares the answer created with the question and the answer from the terminal device 10, which acts as an authenticator, and determines that the answer is successful if they match. Note that the match is not limited to a complete match, and a partial match may also be possible.

Subsequently, the server device 100, which is an authentication server, transmits a result screen regarding the authentication result and a request screen as an access response to the terminal device 10, which is an authenticator (step S37).

[1-3-1. Log analysis]
In this embodiment, the server device 100, which is an authentication server, specifies the format of the action log of the user U, who is the user.

For example, the server device 100 identifies a purchase history that is a history of user U's product purchases and service usage. Additionally, the server device 100 identifies a posting history that is a history of postings by the user U to the SNS. Further, the server device 100 identifies a payment history that is a history of electronic payments using the payment application of the terminal device 10.

Then, the server device 100, which is an authentication server, specifies and extracts question items from the behavior log whose format has been specified.

For example, the server device 100 determines the date and time, product, price, product model/brand, product type, store of purchase, frequency, pattern, frequently purchased store, cycle, etc. from the user U's purchase history. , identify and extract question items.

In addition, the server device 100 specifies, as question items, the date and time, communication partners, posting destinations, content of conversations, frequency of multiple postings, patterns, and people with whom the user often converses, etc. from the user U's SNS posting history. ·Extract.

Additionally, the server device 100 identifies and extracts the date and time, store, amount, frequency of multiple transactions, pattern, frequently visited stores, etc. as question items from the user U's payment history.

Alternatively, the server device 100, which is an authentication server, may specify data question items using a statistical analysis method such as machine learning, instead of searching in a predetermined log format.

Further, the server device 100, which is an authentication server, may add question items specified by a statistical analysis method to the pre-selected question items, and use the question items from the next time onwards.

[1-3-2. Question creation〕
(1) Extraction of question target log The server device 100, which is an authentication server, extracts one event that is a question target from the data set of the behavior log of the user U, who is the user. For example, the server device 100 reads from the purchase history of user U, "On January 14, 2022, at 3:15 p.m., I purchased one product BBB (priced at 5,000 yen) from Y Shopping's AAA store." Extract the event.

(2) Creation of question template The server device 100, which is an authentication server, creates a question template in which question items (one or more) are determined from the question target log. For example, if the server device 100 determines the purchase date and time (time) as the question item, the server device 100 creates a question template that reads, "At time xxxx, I purchased one computer BBB (price: 5000 yen) from the AAA store of Y Shopping." create.

(3) Determination of question item generation policy The server device 100, which is an authentication server, determines a policy for generating question items (question item generation policy). For example, the server device 100 determines a question item generation policy such as free text or a multiple-choice format using an ambiguous time period.

(4) Generation of questions and correct answers The server device 100, which is an authentication server, generates questions and their answers (correct answers) according to the question item generation policy. For example, the server device 100 asks the question, "What time did you write about electronic products on Y Shopping?" and the answer options are "(a) 1-4 o'clock, (b) 4-7 o'clock, (c)." 7 to 10 o'clock'', and generates ``(a) 1 to 4 o'clock'' as the correct answer.

(5) Others Note that the server device 100, which is an authentication server, may include dummy questions (dummy questions). For example, the server device 100 may generate a question that is not based on the action log of the user U and that the user U cannot answer (no answer is the correct answer). In this case, "no correct answer" or "skip" may be set as answer options for all questions. Furthermore, in the case of inputting an answer in free text, an unentered (blank) answer may be accepted. Various methods can be considered for creating a dummy.

Further, the server device 100, which is an authentication server, may create questions by utilizing logs spanning multiple services instead of for each service. This strengthens security to prevent attacks with single questions.

Additionally, the server device 100, which is an authentication server, may generate questions that take into account anonymity (an evaluation scale such as K-anonymity) as a privacy measure. For example, location information may be made ambiguous.

Further, it is preferable that the server device 100, which is an authentication server, does not limit the number of question items to one, but has two or more question items. In other words, the question items need not be limited.

In this manner, in this embodiment, the server device 100 dynamically generates a secret question and correct answer for identity verification based on the user's behavior log. Then, the server device 100 checks the user's answer to the secret question and the correct answer to verify the user's identity.

For example, the server device 100 specifies the format of the behavior log, and specifies and extracts question items from the behavior log. Alternatively, the server device 100 identifies the question items using a statistical analysis method using machine learning.

In addition, the server device 100 extracts a question target log from among the user's multiple behavior logs, creates a question template in which one or more question items are determined from the question target log, determines a question item generation policy, and Generate questions and correct answers based on generation policy.

At this time, the server device 100 may generate a dummy question together with the secret question, and present the dummy question together with the secret question to the user. Further, the server device 100 may generate a dummy answer together with the correct answer, present the correct answer and the dummy answer as options to the user, and allow the user to make a selection.

Note that the server device 100 may generate one question based on a plurality of user behavior logs.

Further, the server device 100 may allow the user to input document or image data obtained by the user in relation to the user's actions as the user's answer to the secret question.

For example, the server device 100 verifies the identity of the user by comparing a hash value based on input document or image data with a hash value stored in advance as the correct answer. At this time, the server device 100 causes the user to input the data of a plurality of documents or images obtained by the user in relation to each of the plurality of actions of the user, and the data of the plurality of documents or images. The user's identity is verified by comparing the hash value based on this with the hash value stored in advance as the correct answer.

Alternatively, the server device 100 verifies the identity of the user by comparing the input document or image data with the document or image data stored in advance as the correct answer. Alternatively, the server device 100 verifies the identity of the person by comparing the characteristics of the input document or image data with the characteristics stored in advance as correct answers.

At this time, the server device 100 allows the user to enter data from emails obtained by the user in connection with the user's purchasing behavior (order confirmation email, product shipping notification email, etc.) as the user's answer to the secret question. It's okay. For example, the server device 100 can verify the user's identity by comparing a combination of the contents (text) of each email related to multiple purchasing actions performed by the user with pre-registered correct answer data. . The title may be the data itself or a hash value. Furthermore, the content (text) of each email related to a plurality of purchasing behaviors and the date and time of each purchase (or date and time of email reception) may be combined.

[1-4. Identity verification judgment]
In identity proofing, the server device 100, which is an authentication server, confirms whether the user is the user by confirming that the input attribute information matches the attribute information registered in advance by the user. , is considered to be the user himself/herself. In addition, if you (the person in question) fail to authenticate and are unable to access your account, we will perform account recovery.

With current account recovery, when verifying your identity on the recovery screen, you may have to answer several questions, including your attribute information. Questions include general questions such as address, but also special questions such as questions about payment app integration and holding a member card (company-issued credit card). They may also use methods to verify your identity, such as a "secret question."

However, since conventional identity verification methods such as "secret questions" ask fixed questions, they can be attacked by people trying to predict or research the correct answer to a question.

Therefore, in this embodiment, a "secret question" that is non-fixed and takes privacy protection into consideration is dynamically created to safely realize identity verification. For example, dynamically create a screen that prompts you to enter a "secret question."

In this embodiment, the server device 100, which is an authentication server, has an authentication function, an identity verification determination function, and an identity verification screen generation function. The server device 100 displays a set of confirmation attributes, but different ones appear each time or dummy questions are included.

[1-4-1. Identity verification judgment logic]
In this embodiment, the server device 100, which is an authentication server, uses the following equations (3) and (4) as the identity verification determination logic.

Here, regarding the weight W, it is assumed that W={w ₁ , w ₂ ,..., w _n }, and w ₁ +w ₂ +...+w _n =1. Further, f_A _n (x) is a determination function of attribute A _n , and returns the accuracy of x. If the value of the determination function f(A) is larger than a predetermined threshold value, the person is considered to be the real person. Note that a ₁ , a ₂ , . . . may be empty. Furthermore, if a ₁ and a ₂ are not independent, f(a ₁ , a ₂ ) may be used. Further, the weight corresponding to A _n included in the dummy question is set to w _n =0.

Even if the attribute input screen for identity verification changes, identity verification can be performed simply by adjusting the corresponding determination function described above, making it possible to respond flexibly.

[1-4-2. Screen creation logic〕
In this embodiment, the server device 100, which is an authentication server, creates a plurality of question templates from a predetermined log format (shopping, auction, etc.) using the log generation logic of C: "Dynamic secret question creation". do. For example, the server device 100 creates a question template such as "At what time did you write about electrical appliances on Y Shopping?"

This makes it possible to enter a variety of attribute information into question items and verify identity on a unified common screen. Furthermore, since the screen is shared, it is possible to prevent privacy leaks such as the registered attributes being guessed due to different attribute information appearing depending on the person.

Note that the server device 100, which is an authentication server, actively changes the attribute information to be asked regarding additional questions that are asked in addition to the static questions that are always included. In this case as well, the determination function may be adjusted. However, a determination function is registered for each identity verification attempt (session). For example, it changes depending on the ID, time zone, and context. Or make it random. Also, include a moderate amount of dummy questions.

Further, the server device 100, which is an authentication server, may have a screen with steps (multi-step proofing). For example, the next predetermined question can only be viewed after a certain question is answered.

[1-4-3. Use of the behavior log itself as an answer to the secret question]
In the present embodiment, the server device 100, which is an authentication server, registers a secret "behavior history (document)" in advance, and uses it for identity verification questions. At this time, the server device 100 registers the type and action history (document) in association with the ID.

(1) At the time of registration The server device 100 classifies the action history (document) used for identity verification questions, identifies the type, and registers the action history (document). For example, the server device 100 classifies and registers the type of action history (document) as "purchase of a bag at Y Shopping."

Additionally, the server device 100 registers, for example, "Purchase results (email) at Y Shopping" as an action history (document). This itself (e-mail content of purchase results) may be created by the user in free text.

(2) When verifying the identity When verifying the identity, the server device 100 creates options including the type linked to the ID and a dummy type, displays the options in a list, and allows the user to make a selection. For example, the server device 100 requests the user to input an "action history (document)" corresponding to the selected "type".

In addition, regarding not only the type but also the behavior history (document), the server device 100 creates options that include the behavior history (document) linked to the ID and the dummy behavior history (document) when verifying the person. , may be displayed in a list for the user to select.

Then, the server device 100 verifies the authenticity of the behavior history (document) by, for example, comparing the hash value of the behavior history (document). For example, the server device 100 calculates one hash value from the contents of multiple action histories (documents) input (or selected) by the user, compares it with pre-registered hash values (correct data), and calculates these values. Verify the authenticity of the action history (document) and verify the user's identity.

In addition, when verifying the identity for account recovery, etc., the server device 100 also asks questions to PIM (Product Information Management) systems, media systems, lifestyle tools systems, financial systems, etc. provided by business operators. may be generated. In particular, since commerce and payment users have high ARPU (Average Revenue Per User), they have a high priority for account recovery.

Further, the server device 100 may increase the priority of users who use news comments and QA services.

Additionally, users of general SNS, including messaging apps, entrust personal data such as daily activities and photos, so recovery is a high priority. There is also a strong need for recovery for users of various services that serve as a lifeline, such as email services, which involve confidential communications and personal information. The server device 100 may increase the priority of these users.

For example, in PIM services such as email and calendars, the email team uses subject information such as names of other companies' services that register email addresses to send and receive, category names such as travel and commerce that are frequently received, and reservations and purchases for those services. It is possible to apply the results of analysis of text and texts to the techniques described in the embodiments of this application.

Further, analysis results such as the theme of news followed by the user and the category of frequently viewed content can be applied to the technology described in the embodiment of the present application. In addition to these, analysis results of the history of various services such as weather, home location information, nearest station, route/boarding history, navigation service destination, etc. can be applied to the technology described in the embodiment of this application. can. You can also use information such as securities account information, stocks and investment trusts handled, bank account information, and card billing information to answer questions.

[1-5. Delegation of account recovery authority]
In this embodiment, the server device 100, which is an authentication server, may allow delegation of authority for account recovery (authority delegation) from a user to a person in a position responsible for the user's actions. For example, when performing account recovery on a terminal device of a child (authentication subject, authority delegate), the authority for account recovery may be allowed to be delegated to the child's parent (authority delegate).

An example of delegation of authority for account recovery from a child to a parent will be described with reference to FIG. FIG. 10 is an explanatory diagram showing an overview of an example of delegation of authority for account recovery from a child to a parent.

As shown in FIG. 10, a user U (U1) who is a child registers the account of another user U (U2) who is a parent as a recovery collaborator in the server device 100 which is an authentication server. (Step S40).

For example, the terminal device 10 (10A) of the user U (U1) who is a child requests the server device 100 which is the authentication server as a recovery collaborator along with the child ID indicating the user U (U1) who is a child. , transmits a parent ID indicating another user U (U2) who is a parent. The server device 100, which is an authentication server, registers a child ID indicating a child and a parent ID indicating a parent in association with each other. Thereby, the server device 100, which is an authentication server, can perform FIDO authentication of another user U (U2) who is a parent.

At this time, the server device 100, which is an authentication server, allows recovery collaborators only if it can prove that the user U (U1) who is a child has received permission from another user U (U2) who is a parent. It may also be possible to register the account of another user U (U2) who is a parent. For example, the server device 100 may communicate with the terminal device 10 (10B) of the other user U (U2) who is the parent, and request the consent of the other user U (U2) who is the parent. Alternatively, the user U (U1) who is a child may request registration after receiving permission from another user U (U2) who is a parent through short-range wireless communication between the terminal devices 10.

In addition, if the other user U (U2) who is the parent is a known user (registered user), the server device 100 that is the authentication server also uses the child ID indicating the child and the parent ID indicating the parent. It is sufficient to link and register the parent user U (U2), but if the parent user U (U2) is an unknown user (unregistered user), the parent user U (U2) The terminal device 10 (10B) may be requested to register (user registration, authenticator registration).

Subsequently, when account recovery becomes necessary, the terminal device 10 (10A) of the user U (U1), who is a child, sends a recovery request (child ID, parent ID) to the server device 100, which is an authentication server. (step S41).

For example, when account recovery becomes necessary, the terminal device 10 (10A) of the user U (U1) who is a child performs authentication in response to the operation of the user U (U1) who is a child, or automatically. A recovery request (child ID, parent ID) is sent to the server device 100, which is a server. The parent ID indicates the destination to which account recovery authority is delegated. Note that if child IDs and parent IDs are stored in a one-to-one correspondence on the server device 100 side, which is an authentication server, only the child ID may be sent as the recovery request.

Subsequently, the server device 100, which is an authentication server, generates a challenge in response to a recovery request from the terminal device 10 of the user U (U1), who is a child (step S42).

Subsequently, the server device 100, which is an authentication server, transmits a recovery permission request including a challenge and a parent ID to the terminal device 10 (10A) of the user U (U1), who is a child (step S43).

Subsequently, the terminal device 10 (10A) of the user U (U1) who is a child requests recovery permission from the server device 100 to the terminal device 10 (10B) of another user U (U2) who is a parent. The request is transmitted (transferred) (step S44).

In this embodiment, it is assumed that the parent is close to the child. For example, a user U (U1) who is a child communicates with another user U (U2) who is a parent about a server using short-range wireless communication between terminal devices 10 such as BLE (Bluetooth (registered trademark) Low Energy). A recovery permission request may be sent from the device 100.

Subsequently, the terminal device 10 (10B) of the other user U (U2), which is the parent, performs FIDO authentication (user verification using an authenticator) and sends the secret information as approval to the recovery permission request from the server device 100. The challenge is signed using the key (step S45).

Subsequently, the terminal device 10 (10B) of the other user U (U2) who is the parent sends the following message to the terminal device 10 (10A) of the user U (U1) who is the child in response to the recovery permission request. A recovery permission response including the signed challenge is transmitted (step S46).

Subsequently, the terminal device 10 (10A) of the user U (U1), who is a child, requests the terminal device 10 (10B) of another user U (U2), who is a parent, to the server device 100, which is an authentication server. A recovery permission response (signed challenge) is transmitted (transferred) from (step S47).

Next, the server device 100, which is an authentication server, verifies the signature using the public key in response to the recovery permission response (signed challenge) from the terminal device 10 (10A) of the user U (U1), who is a child. Then, the recovery collaborator is confirmed (step S48).

Next, if the server device 100, which is an authentication server, successfully verifies the signature and confirms that the other user U (U2) who is the parent is a recovery collaborator, the server device 100 performs recovery control (step S49). ).

Subsequently, the server device 100, which is an authentication server, transmits a recovery response based on the recovery control to the terminal device 10 (10A) of the user U (U1), who is a child who has made a recovery request (step S50). Thereby, the server device 100 performs account recovery of the terminal device 10 (10A) of the user U (U1) who is a child.

Note that the delegation of authority for account recovery from a child to a parent is just one example. In reality, account recovery authority may be delegated from an employee of a company to his or her superior, system administrator, or the like. Alternatively, the authority for account recovery may be delegated to a person who has lent the terminal device 10 to the user U. In other words, the authorization for account recovery may be delegated from the delegate who is the person to be authenticated to the delegatee.

Alternatively, the terminal device 10 (10A) of the user U (U1) who is a child may be used as a FIDO client, and the terminal device 10 (10B) of another user U (U2) who is a parent may be used as an authenticator. That is, the user who uses the FIDO client and the user who is verified by the authenticator may be different people.

In this manner, in this embodiment, the server device 100 manages information about the person to be authenticated and the authorized delegate designated by the person to be authenticated. Then, in response to a request for account recovery from the authentication subject, the server device 100 performs account recovery of the authentication subject with the approval of the delegatee. At this time, the server device 100 accepts registration of the account of the authorized delegate as a recovery collaborator from the authentication target, and manages the authentication target's account and the authorized delegate's account in a linked manner.

For example, in response to a recovery request from the authentication subject's terminal device, the server device 100 transmits a recovery permission request including a challenge to the authorized delegate's terminal device via the authentication subject's terminal device. Note that data is transmitted and received between the terminal device of the person to be authenticated and the terminal device of the delegatee through short-range wireless communication. As a result, the server device 100 receives a recovery permission response including a signed challenge from the terminal device of the authorized delegate via the terminal device of the authentication subject as a response to the recovery permission request. Then, if the signature verification is successful, the server device 100 performs account recovery of the person to be authenticated.

At this time, the server device 100 receives a recovery permission response including a signed challenge generated by the authorized delegate signing the challenge as approval for the recovery permission request. If the signature verification is successful, the server device 100 confirms that the authorized delegate is a recovery collaborator, and performs account recovery of the authentication subject.

For example, the server device 100 manages information about a child who is an authentication target and a parent who is a delegate. Then, in response to the account recovery request from the child, the server device 100 performs the child's account recovery with the approval of the parent. At this time, the server device 100 performs FIDO authentication on the parent.

[2. Configuration example of information processing system]
Next, the configuration of the information processing system 1 including the server device 100 according to the embodiment will be described using FIG. 11. FIG. 11 is a diagram showing a configuration example of the information processing system 1 according to the embodiment. As shown in FIG. 11, the information processing system 1 according to the embodiment includes a terminal device 10 and a server device 100. These various devices are connected via a network N so that they can communicate by wire or wirelessly. The network N is, for example, a LAN (Local Area Network) or a WAN (Wide Area Network) such as the Internet.

Furthermore, the number of devices included in the information processing system 1 shown in FIG. 11 is not limited to what is illustrated. For example, in FIG. 11, only one terminal device 10 is shown for simplification of illustration, but this is just an example and is not limited, and there may be two or more terminal devices.

The terminal device 10 is an information processing device used by the user U. For example, the terminal device 10 may be a smart device such as a smartphone or a tablet terminal, a feature phone, a PC (Personal Computer), a PDA (Personal Digital Assistant), a game console or AV device with a communication function, a car navigation system, a smart watch, or the like. These include wearable devices such as head-mounted displays, smart glasses, etc.

The terminal device 10 also supports wireless communication networks such as LTE (Long Term Evolution), 4G (4th Generation), and 5G (5th Generation), Bluetooth (registered trademark), and wireless LAN (Local The server device 100 can be connected to the network N via short-range wireless communication such as an area network) and can communicate with the server device 100.

The server device 100 is, for example, a computer such as a PC or a blade server, or a mainframe or a workstation. Note that the server device 100 may be realized by cloud computing.

[3. Configuration example of terminal device]
Next, the configuration of the terminal device 10 will be explained using FIG. 12. FIG. 12 is a diagram showing a configuration example of the terminal device 10. As shown in FIG. As shown in FIG. 12, the terminal device 10 includes a communication section 11, a display section 12, an input section 13, a positioning section 14, a sensor section 20, a control section 30 (controller), and a storage section 40. Be prepared.

(Communication Department 11)
The communication unit 11 is connected to a network N (see FIG. 11) by wire or wirelessly, and transmits and receives information to and from the server device 100 via the network N. For example, the communication unit 11 is realized by a NIC (Network Interface Card), an antenna, or the like.

(Display section 12)
The display unit 12 is a display device that displays various information such as position information. For example, the display unit 12 is a liquid crystal display (LCD) or an organic electro-luminescent display (EL display). Further, the display unit 12 is a touch panel type display, but is not limited to this.

(Input section 13)
The input unit 13 is an input device that receives various operations from the user U. For example, the input unit 13 includes buttons for inputting characters, numbers, and the like. Note that the input unit 13 may be an input/output port (I/O port), a USB (Universal Serial Bus) port, or the like. Further, when the display section 12 is a touch panel display, a part of the display section 12 functions as the input section 13. Further, the input unit 13 may be a microphone or the like that receives voice input from the user U. The microphone may be wireless.

(Positioning unit 14)
The positioning unit 14 receives a signal (radio wave) sent from a GPS (Global Positioning System) satellite, and based on the received signal, determines position information (for example, latitude and longitude). That is, the positioning unit 14 positions the terminal device 10 . Note that GPS is just one example of GNSS (Global Navigation Satellite System).

Further, the positioning unit 14 can measure the position using various methods other than GPS. For example, the positioning unit 14 may use various communication functions of the terminal device 10 to measure the position as an auxiliary positioning means for position correction and the like, as described below.

(Wi-Fi positioning)
For example, the positioning unit 14 positions the terminal device 10 using the Wi-Fi (registered trademark) communication function of the terminal device 10 or the communication network provided by each communication company. Specifically, the positioning unit 14 performs Wi-Fi communication, etc., and determines the position of the terminal device 10 by measuring the distance to nearby base stations and access points.

(Beacon positioning)
Further, the positioning unit 14 may use the Bluetooth (registered trademark) function of the terminal device 10 to measure the position. For example, the positioning unit 14 measures the position of the terminal device 10 by connecting to a beacon transmitter connected by a Bluetooth (registered trademark) function.

(geomagnetic positioning)
Furthermore, the positioning unit 14 positions the terminal device 10 based on the geomagnetic pattern of the structure measured in advance and the geomagnetic sensor included in the terminal device 10 .

(RFID positioning)
Further, for example, if the terminal device 10 has an RFID (Radio Frequency Identification) tag function equivalent to a contactless IC card used at station ticket gates, stores, etc., or has a function to read an RFID tag. In this case, the location where the terminal device 10 used the terminal device 10 is recorded together with the information that the payment was made. The positioning unit 14 may measure the position of the terminal device 10 by acquiring such information. Further, the position may be determined by an optical sensor, an infrared sensor, or the like provided in the terminal device 10.

The positioning unit 14 may position the terminal device 10 using one or a combination of the above-mentioned positioning means, if necessary.

(sensor section 20)
The sensor unit 20 includes various sensors mounted on or connected to the terminal device 10. Note that the connection may be a wired connection or a wireless connection. For example, the sensors may be a detection device other than the terminal device 10, such as a wearable device or a wireless device. In the example shown in FIG. 12, the sensor unit 20 includes an acceleration sensor 21, a gyro sensor 22, an atmospheric pressure sensor 23, an air temperature sensor 24, a sound sensor 25, an optical sensor 26, a magnetic sensor 27, and an image sensor ( camera) 28.

Note that each of the sensors 21 to 28 described above is merely an example and is not limited to the above. That is, the sensor section 20 may be configured to include a portion of each of the sensors 21 to 28, or may include other sensors such as a humidity sensor in addition to or instead of each of the sensors 21 to 28. .

The acceleration sensor 21 is, for example, a three-axis acceleration sensor, and detects the physical movement of the terminal device 10, such as the moving direction, speed, and acceleration of the terminal device 10. The gyro sensor 22 detects physical movements of the terminal device 10 such as tilt in three axes directions based on the angular velocity of the terminal device 10 and the like. The atmospheric pressure sensor 23 detects the atmospheric pressure around the terminal device 10, for example.

Since the terminal device 10 is equipped with the above-mentioned acceleration sensor 21, gyro sensor 22, atmospheric pressure sensor 23, etc., it is possible to implement technologies such as pedestrian autonomous navigation (PDR) using these sensors 21 to 23, etc. It becomes possible to measure the position of the terminal device 10 using the . This makes it possible to obtain indoor position information that is difficult to obtain using positioning systems such as GPS.

For example, a pedometer using the acceleration sensor 21 can calculate the number of steps, walking speed, and distance walked. Furthermore, by using the gyro sensor 22, it is possible to know the direction of travel of the user U, the direction of the line of sight, and the inclination of the user's body. Further, from the atmospheric pressure detected by the atmospheric pressure sensor 23, it is also possible to know the floor number of the altitude Y lower where the terminal device 10 of the user U exists.

The temperature sensor 24 detects, for example, the temperature around the terminal device 10. The sound sensor 25 detects, for example, sounds around the terminal device 10. The optical sensor 26 detects the illuminance around the terminal device 10 . The magnetic sensor 27 detects, for example, the earth's magnetism around the terminal device 10. The image sensor 28 captures an image of the surroundings of the terminal device 10.

The above-mentioned atmospheric pressure sensor 23, temperature sensor 24, sound sensor 25, optical sensor 26, and image sensor 28 each detect atmospheric pressure, temperature, sound, and illuminance, and capture images of the surroundings, so that the terminal device 10 It is possible to detect the surrounding environment and situation. Furthermore, it is possible to improve the accuracy of the location information of the terminal device 10 based on the environment and situation around the terminal device 10.

(Control unit 30)
The control unit 30 includes, for example, a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM, an input/output port, etc., and various circuits. Further, the control unit 30 may be configured with hardware such as an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control section 30 includes a transmitting section 31, a receiving section 32, and a processing section 33.

(Transmission unit 31)
The transmitting unit 31 receives, for example, various information input by the user U using the input unit 13, various information detected by the sensors 21 to 28 mounted on or connected to the terminal device 10, and information measured by the positioning unit 14. The location information of the terminal device 10 and the like can be transmitted to the server device 100 via the communication unit 11.

(Receiving unit 32)
The receiving unit 32 can receive various information provided from the server device 100 and requests for various information from the server device 100 via the communication unit 11 .

(Processing unit 33)
The processing unit 33 controls the entire terminal device 10, including the display unit 12 and the like. For example, the processing unit 33 can output various information transmitted by the transmitting unit 31 and various information received from the server device 100 by the receiving unit 32 to the display unit 12 for display.

(Storage unit 40)
The storage unit 40 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or an optical disk. Ru. The storage unit 40 stores various programs, various data, and the like.

[4. Configuration example of server device]
Next, the configuration of the server device 100 according to the embodiment will be described using FIG. 13. FIG. 13 is a diagram showing a configuration example of the server device 100 according to the embodiment. As shown in FIG. 13, the server device 100 includes a communication section 110, a storage section 120, and a control section 130.

(Communication Department 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card). Further, the communication unit 110 is connected to the network N (see FIG. 11) by wire or wirelessly.

(Storage unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as an HDD, an SSD, or an optical disk. As shown in FIG. 13, the storage unit 120 includes a user information database 121, a history information database 122, an authentication information database 123, and a policy information database 124.

(User information database 121)
The user information database 121 stores user information regarding the user U. For example, the user information database 121 stores various information such as user U's attributes. FIG. 14 is a diagram showing an example of the user information database 121. In the example shown in FIG. 14, the user information database 121 includes items such as "user ID (identifier),""age,""gender,""home,""worklocation," and "interest."

“User ID” indicates identification information for identifying user U. Note that the "user ID" may be user U's contact information (telephone number, email address, etc.), or may be identification information for identifying user U's terminal device 10.

Moreover, "age" indicates the age of the user U identified by the user ID. Note that the "age" may be information indicating the specific age of the user U (for example, 35 years old, etc.), or may be information indicating the age of the user U (for example, 30s, etc.) . Alternatively, the "age" may be information indicating the date of birth of the user U, or may be information indicating the generation of the user U (for example, born in the 1980s). Furthermore, “gender” indicates the gender of the user U identified by the user ID.

Moreover, "home" indicates the location information of the home of the user U identified by the user ID. In the example shown in FIG. 14, "home" is illustrated as an abstract code such as "LC11", but it may also be latitude/longitude information or the like. Furthermore, for example, "home" may be a region name or address.

Moreover, "work place" indicates the location information of the work place (school in the case of a student) of the user U identified by the user ID. In the example shown in FIG. 14, the "work location" is illustrated as an abstract code such as "LC12," but it may also be latitude and longitude information. Further, for example, the "work location" may be a region name or address.

Moreover, "interest" indicates the interest of the user U identified by the user ID. That is, "interest" indicates an object in which the user U identified by the user ID has a high interest. For example, "interest" may be a search query (keyword) that the user U inputs into a search engine. In the example shown in FIG. 14, one "interest" is shown for each user U, but there may be a plurality of "interests".

For example, in the example shown in FIG. 14, the age of the user U identified by the user ID "U1" is "20s", and the gender is "male". Further, for example, the user U identified by the user ID "U1" indicates that his home is "LC11". Further, for example, the user U identified by the user ID "U1" indicates that the work location is "LC12". Further, for example, the user U identified by the user ID "U1" indicates that he is interested in "sports."

Here, in the example shown in FIG. 14, abstract values such as "U1", "LC11", and "LC12" are used for illustration, but "U1", "LC11", and "LC12" have specific values. It is assumed that information such as character strings and numerical values is stored. Below, abstract values may be illustrated in diagrams related to other information as well.

Note that the user information database 121 is not limited to the above, and may store various information depending on the purpose. For example, the user information database 121 may store various information regarding the terminal device 10 of the user U. In addition, the user information database 121 includes information such as demographic (demographic attributes), psychographic (psychological attributes), geographic (geographical attributes), behavioral (behavioral attributes), etc. of user U. Information regarding attributes may also be stored. For example, the user information database 121 includes name, family composition, place of birth (locality), occupation, position, income, qualifications, type of residence (single-family house, condominium, etc.), presence or absence of a car, commuting/commuting time, commuting/commuting, etc. Memorizes information such as routes, commuter pass sections (stations, lines, etc.), frequently used stations (other than the stations closest to your home or work), lessons (location, time zone, etc.), hobbies, interests, lifestyle, etc. It's okay.

(History information database 122)
The history information database 122 stores various information related to history information (log data) indicating the actions of the user U. FIG. 15 is a diagram showing an example of the history information database 122. In the example shown in FIG. 15, the history information database 122 has items such as "user ID", "location history", "search history", "browsing history", "purchase history", and "posting history".

“User ID” indicates identification information for identifying user U. Further, “position history” indicates a position history that is a history of the user U's position and movement. Further, “search history” indicates a search history that is a history of search queries input by the user U. In addition, “browsing history” indicates a browsing history that is a history of contents that the user U has viewed. Moreover, "purchase history" indicates a purchase history that is a history of purchases by user U. Moreover, "posting history" indicates a posting history that is a history of postings by user U. Note that the "posting history" may include questions regarding user U's belongings.

For example, in the example shown in FIG. 15, the user U identified by the user ID "U1" moves as per "location history #1", searches as per "search history #1", and searches as per "view history #1". This indicates that the content is viewed according to "history #1", a predetermined product, etc. is purchased at a predetermined store etc. according to "purchase history #1", and the content is posted according to "post history #1".

Here, in the example shown in FIG. 15, abstracts such as "U1", "location history #1", "search history #1", "browsing history #1", "purchase history #1" and "posting history #1" are used. Although the figures are illustrated using ``U1'', ``Location history #1'', ``Search history #1'', ``Browsing history #1'', ``Purchase history #1'' and ``Posting history #1'', It is assumed that information such as specific character strings and numerical values is stored.

Note that the history information database 122 is not limited to the above, and may store various information depending on the purpose. For example, the history information database 122 may store the user U's usage history of a predetermined service. Further, the history information database 122 may store the user U's visit history to a physical store, visit history to a facility, or the like. Further, the history information database 122 may store the payment history of user U's payment using the terminal device 10 (electronic payment).

(Authentication information database 123)
The authentication information database 123 stores various information regarding the FIDO authentication of the user U. FIG. 16 is a diagram showing an example of the authentication information database 123. In the example shown in FIG. 16, the authentication information database 123 includes "user ID,""authenticator,""public key for attestation,""public key for authentication,""identity verification document," and "expiration date." , "questions,""correctanswers," and "authorized person."

“User ID” indicates identification information for identifying user U. Further, "authenticator" indicates an authenticator used by user U. Note that the "authenticator" may store an authenticator birth certificate document (attestation document).

Moreover, "public key for attestation" indicates the public key for attestation of the authenticator used by user U. Further, the "authentication public key" indicates the authentication public key of the authenticator used by the user U.

Moreover, the "identity verification document" indicates the identity verification document submitted by the user U. Furthermore, the "expiration date" indicates the expiration date of the identity verification document (or its written information).

In addition, "questionnaire" indicates a secret question that is dynamically created for user U's identity verification. Note that the "questionnaire" may store options as answers to the questions. Moreover, "correct answer" indicates the correct answer to the question. Note that the "correct answer" may be the document or image data (set) that is requested to be input by the user U and checked, or may be a hash value or data characteristics based on the document or image data (set). etc. may be stored.

Further, the "authorized delegate" indicates identification information for identifying another user to whom the authority is delegated from the user U when the authority for account recovery is delegated. That is, the "authority delegatee" indicates another user who is designated and registered by the user U as a target of account recovery authority delegation. For example, if the user U is a child, the authorized person is the child's parent or the like.

For example, in the example shown in FIG. 16, the public key for verifying the signature from “authenticator #1” which is the authenticator of user U identified by user ID “U1” is Key #1" and "Authentication public key #1" are registered, and user U's "identity verification document #1" will expire after "expiration date #1" and user U's identity verification document #1 will expire after "expiration date #1" has passed. If "Correct Answer #1" is answered to "Question #1" for confirmation, the user is authenticated as the user himself/herself, and when a request for account recovery is received from User U, "Authorized Delegate #1" is authenticated as the user. ” to request approval.

Here, in the example shown in FIG. 16, "U1", "authenticator #1", "public key for attestation #1", "public key for authentication #1", "identity verification document #1", Although the illustration uses abstract values such as "Deadline #1", "Question #1", "Correct Answer #1", and "Authorized Delegator #1", "U1", "Authenticator #1", " "Public key for attestation #1", "Public key for authentication #1", "Identification document #1", "Expiry date #1", "Question #1", "Correct answer #1" and "Authorized delegation Person #1" stores information such as specific character strings and numerical values.

Note that the authentication information database 123 is not limited to the above, and may store various information depending on the purpose. For example, the authentication information database 123 may store information regarding user U's authentication accuracy and identity accuracy. Further, the authentication information database 123 may store information regarding an evaluation function of identity accuracy, a determination function of attributes, and the like. Further, the authentication information database 123 may store user U's password and the like.

(Policy information database 124)
The policy information database 124 stores various information regarding the security policy of the server device 100, which is an authentication server. Security policy can be changed.

Note that the security policy may be set for each identity service, or may be set for each segment of users targeted by the service.

(Control unit 130)
Returning to FIG. 13, the explanation will be continued. The control unit 130 is a controller, and controls the server device 100 using, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field Programmable Gate Array). This is realized by executing various programs (corresponding to an example of an information processing program) stored in an internal storage device using a storage area such as a RAM as a work area. In the example shown in FIG. 13, the control unit 130 includes an acquisition unit 131, a generation unit 132, an authentication processing unit 133, a management unit 134, and a provision unit 135.

(Acquisition unit 131)
The acquisition unit 131 acquires data input by the user U from the user U's terminal device 10 via the communication unit 110 . For example, the acquisition unit 131 acquires various types of registration information by the user U from the user U's terminal device 10 .

The acquisition unit 131 also acquires a search query input by the user U. For example, when the user U inputs a search query into a search engine or the like and performs a keyword search, the acquisition unit 131 acquires the search query via the communication unit 110. That is, the acquisition unit 131 acquires, via the communication unit 110, a keyword input by the user U into a search window of a search engine, site, or application.

The acquisition unit 131 also acquires user information regarding the user U via the communication unit 110. For example, the acquisition unit 131 acquires identification information indicating the user U (user ID, etc.), location information of the user U, attribute information of the user U, etc. from the terminal device 10 of the user U. Further, the acquisition unit 131 may acquire identification information indicating the user U, attribute information of the user U, etc. at the time of user U's user registration. The acquisition unit 131 then registers the user information in the user information database 121 of the storage unit 120.

Further, the acquisition unit 131 acquires various types of history information (log data) indicating the behavior of the user U via the communication unit 110. For example, the acquisition unit 131 acquires various types of history information indicating the behavior of the user U from the terminal device 10 of the user U or from various servers based on the user ID or the like. The acquisition unit 131 then registers various types of history information in the history information database 122 of the storage unit 120.

(Generation unit 132)
The generation unit 132 dynamically generates a secret question and correct answer for identity verification based on the user's behavior log. For example, the generation unit 132 specifies the format of the behavior log, and specifies and extracts question items from the behavior log. Alternatively, the generation unit 132 specifies the question items using a statistical analysis method using machine learning.

Further, the generation unit 132 extracts a question target log from among the user's multiple behavior logs, creates a question template in which one or more question items are determined from the question target log, determines a question item generation policy, and Generate questions and correct answers based on generation policy.

At this time, the generation unit 132 may generate a dummy question along with the secret question. Further, the generation unit 132 may generate a dummy answer as well as a correct answer. Further, the generation unit 132 may generate one question based on a plurality of user behavior logs.

(Authentication processing unit 133)
The authentication processing unit 133 checks the user's answer to the secret question and the correct answer to confirm the user's identity. At this time, the authentication processing unit 133 may present a dummy question to the user along with the secret question. Further, the authentication processing unit 133 presents the correct answer and dummy answers as options to the user, and allows the user to make a selection.

Note that the authentication processing unit 133 may input document or image data obtained by the user in relation to the user's actions as the user's answer to the secret question. At this time, the authentication processing unit 133 may cause the user to input email data obtained by the user in relation to the user's purchasing behavior as the user's answer to the secret question.

For example, the authentication processing unit 133 verifies the identity of the person by comparing a hash value based on the input document or image data with a hash value stored in advance as the correct answer. At this time, the authentication processing unit 133 causes the user to input data of a plurality of documents or images obtained by the user in relation to each of the user's plurality of actions as the user's answer to the secret question. The hash value based on the data is compared with the hash value stored in advance as the correct answer to verify the identity.

Alternatively, the authentication processing unit 133 checks the input document or image data with the document or image data stored in advance as the correct answer to confirm the identity. Alternatively, the authentication processing unit 133 verifies the identity of the person by comparing the characteristics of the input document or image data with the characteristics stored in advance as correct answers.

The authentication processing unit 133 also verifies the identity of the user (user U) by confirming that the personal attribute information registered in advance by the user matches the personal attribute information presented by the user.

Further, the authentication processing unit 133 determines the reliability of the authenticator based on the attestation document, and performs FIDO authentication with the reliable authenticator. For example, the authentication processing unit 133 verifies a signature using a private key of a reliable authenticator with a public key corresponding to the private key.

Furthermore, in response to a request for account recovery from the person to be authenticated (authority delegate), the authentication processing unit 133 performs account recovery of the person to be authenticated with the approval of the delegatee designated by the person to be authenticated.

For example, in response to a recovery request from the authentication subject's terminal device, the authentication processing unit 133 transmits a recovery permission request including a challenge to the authorized delegate's terminal device via the authentication subject's terminal device. Note that data is transmitted and received between the terminal device of the person to be authenticated and the terminal device of the delegatee through short-range wireless communication.

Then, the authentication processing unit 133 receives a recovery permission response including a signed challenge from the terminal device of the authorized delegate via the terminal device of the authentication subject as a response to the recovery permission request. At this time, the authentication processing unit 133 receives a recovery permission response including a signed challenge generated by the authorized delegate signing the challenge as approval for the recovery permission request.

Then, if the signature verification is successful, the authentication processing unit 133 performs account recovery of the authentication subject. At this time, if the signature verification is successful, the authentication processing unit 133 confirms that the authorized delegate is a recovery collaborator, and performs account recovery of the authentication subject.

For example, in response to a request for account recovery from a child who is an authentication target, the authentication processing unit 133 recovers the child's account with the approval of a parent who is an authorized delegate. At this time, the authentication processing unit 133 performs FIDO authentication on the parent.

(Management Department 134)
The management unit 134 continuously manages registered personal attribute information for identity verification so as to satisfy the security policy. Furthermore, when controlling access to provide identity services to users, if the personal attribute information does not satisfy the security policy, the management unit 134 initiates new authentication and identity verification processing so as to satisfy the security policy.

For example, the management unit 134 suppresses variations in the reliability of personal attribute information due to differences in identity verification methods and continuously manages the reliability of personal attribute information based on the security policy. Alternatively, the management unit 134 suppresses a decrease in the reliability of personal attribute information over time and continuously manages the reliability of personal attribute information based on the security policy.

Furthermore, when the security policy is changed, the management unit 134 continuously manages the personal attribute information so that it satisfies the changed security policy.

In addition, the management unit 134 determines that the personal attribute information does not satisfy the security policy if the expiration date of the identity verification document that is the basis of the registered personal attribute information has passed or the identity verification document has expired. It is determined that this is the case, and a new authentication and identity verification process is initiated to satisfy the security policy.

Furthermore, the management unit 134 determines the accuracy of personal attribute information for the online user being authenticated by multiplying the authentication accuracy and the identity accuracy. The authentication accuracy becomes 0 when the validity period of the authentication session established after each successful authentication attempt is exceeded. The identity accuracy varies depending on the type of personal attribute information.

The management unit 134 also stores the attestation document and continuously manages the authentication strength of the attestation document. Further, when the management unit 134 decides to strengthen security, if the already stored attestation document does not satisfy the authentication strength, the management unit 134 re-performs attestation that satisfies the authentication strength.

For example, if the authenticator no longer satisfies the security policy due to the passage of time or the discovery of a problem, the management unit 134 re-executes the attestation. Alternatively, if the authenticator no longer satisfies the security policy due to a change in the security policy, the management unit 134 re-executes the attestation.

Furthermore, the management unit 134 determines the reliability strength of the public key based on the contents of the attestation document. The management unit 134 also manages the reliability strength of the public key, and requests a change of the public key when the reliability strength of the public key decreases.

For example, the management unit 134 determines that the reliability of the public key has deteriorated over time and requests that the public key be changed. Furthermore, when the validity period of the public key has expired, the management unit 134 determines that the reliability of the public key has decreased, and requests that the public key be changed. Furthermore, if the reliability strength of the public key does not satisfy the security policy, the management unit 134 determines that the reliability strength of the public key has decreased, and requests a change of the public key.

In addition, regarding the delegation of account recovery authority to another person (for example, the delegation of account recovery authority from a child to a parent), the management unit 134 manages the authentication target person (authority delegate) and the authorized delegate specified by the authentication target person. Manage information with people. For example, the management unit 134 manages information about the child who is the person to be authenticated and the parent who is the delegatee. At this time, the management unit 134 receives registration of the account of the authorized delegate as a recovery collaborator from the authentication target, and manages the authentication target's account and the authorized delegate's account in a linked manner.

(Providing unit 135)
The providing unit 135 provides the identity service to the user who has successfully passed the FIDO authentication via the communication unit 110. That is, the providing unit 135 provides the identity service to the user U, who is the user, to the terminal device 10 of the user U, who is the user.

Further, the providing unit 135 may provide screen information (input screen, etc.) to the terminal device 10 of the user U via the communication unit 110. At this time, the terminal device 10 of the user U displays an input screen or the like based on the provided screen information.

Further, the providing unit 135 may provide information regarding the success or failure of FIDO authentication to the terminal device 10 of the user U via the communication unit 110. Further, the providing unit 135 may provide various information related to FIDO authentication to the terminal device 10 of the user U via the communication unit 110.

[5. Processing procedure]
Next, a processing procedure by the server device 100 according to the embodiment will be described using FIG. 17. FIG. 17 is a flowchart showing the processing procedure according to the embodiment. Note that the processing procedure shown below is repeatedly executed by the control unit 130 of the server device 100.

As shown in FIG. 17, the authentication processing unit 133 of the server device 100 determines the reliability of the authenticator based on the attestation document, and performs FIDO authentication with the reliable authenticator (step S101).

Subsequently, the management unit 134 of the server device 100 continuously manages the registered personal attribute information for identity verification so as to satisfy the security policy (step S102).

Subsequently, during access control to provide identity services to the user, if the personal attribute information does not satisfy the security policy, the management unit 134 of the server device 100 initiates new authentication and identity verification processing to satisfy the security policy. (Step S103).

Subsequently, the management unit 134 of the server device 100 stores the attestation document and continuously manages the authentication strength of the attestation document (step S104).

Subsequently, when the management unit 134 of the server device 100 decides to strengthen security, if the already stored attestation document does not satisfy the authentication strength, it re-performs attestation that satisfies the authentication strength (step S105). .

Next, when the generation unit 132 of the server device 100 fails to authenticate and cannot access the account, the generation unit 132 generates a secret to verify the user's identity based on the user's behavior log before recovering the user's account. The question and the correct answer are dynamically generated (step S106).

Subsequently, the authentication processing unit 133 of the server device 100 checks the user's answer to the secret question and the correct answer to confirm the user's identity (step S107). For example, the authentication processing unit 133 verifies the identity of the person by comparing a hash value based on the input document or image data with a hash value stored in advance as the correct answer.

Next, the management unit 134 of the server device 100 identifies the person to be authenticated (authority delegate) and the person to be authenticated regarding the delegation of account recovery authority to another person (for example, the delegation of account recovery authority from a child to a parent). Information with the designated authorized delegate is managed (step S108).

Next, in response to the account recovery request from the authentication subject (authority delegate), the authentication processing unit 133 of the server device 100 recovers the authentication subject's account with the approval of the authorized delegate designated by the authentication subject. (Step S109).

[6. Modified example]
The terminal device 10 and server device 100 described above may be implemented in various different forms other than the above embodiments. Therefore, a modification of the embodiment will be described below.

In the above embodiment, part or all of the processing executed by the server device 100 may actually be executed by the terminal device 10. For example, the process may be completed stand-alone (by the terminal device 10 alone). In this case, it is assumed that the terminal device 10 has the functions of the server device 100 in the above embodiment. Further, in the embodiment described above, since the terminal device 10 cooperates with the server device 100, it appears to the user U that the terminal device 10 is also executing the processing of the server device 100. That is, from another point of view, it can be said that the terminal device 10 includes the server device 100.

Further, in the above embodiment, the server device 100 may perform multi-step authentication by combining FIDO authentication and other authentication. For example, the server device 100 may perform two-step authentication by combining FIDO authentication and password authentication. Alternatively, the server device 100 may perform two-step authentication by combining FIDO authentication and a secret question.

In the above embodiment, the server device 100 performs FIDO authentication by combining two or more of the three authentication elements: "knowledge information," "possession information," and "biometric information." It's okay. That is, the server device 100 may employ multi-factor authentication (MFA).

Further, in the above embodiment, the server device 100 inputs document data obtained by the user in relation to the user's actions, performs natural language processing (text analysis) on the input document data, and converts the input document data into vectors. The user's identity may be verified by comparing the value with a value stored in advance as the correct answer. That is, the server device 100 may verify the identity by comparing not only the hash value but also the vector value of the document.

Further, in the above embodiment, the server device 100 may use the search history when dynamically creating the secret question. For example, the server device 100 may verify the user's identity by comparing a hash value of a combination of multiple search queries input (or selected) by the user with pre-registered correct answer data. Note that the value is not limited to a hash value, but may be a value obtained by performing natural language processing (text analysis) on a combination of search queries and converting it into a vector.

Further, in the above embodiment, the server device 100 may manage the attestation public key, the authentication public key, and the authenticator birth certificate document (attestation document) using a blockchain (BC). For example, a distributed ledger device manages the FIDO public key. A distributed ledger device is a server device compatible with distributed ledger technology (DLT) that allows each node forming a network to manage/share the same ledger. The distributed ledger device may be one of the nodes configuring this network. Since a hash is included in each block of the blockchain, it can be verified that the public key has not been tampered with. Additionally, authentication can be performed after verifying the suitability of the public key.

[7. effect〕
As described above, the information processing device (terminal device 10 and server device 100) according to the present application confirms that the personal attribute information registered by the user in advance matches the personal attribute information presented by the user. The authentication processing unit 133 includes an authentication processing unit 133 that performs identity verification, and a management unit 134 that continuously manages registered personal attribute information for identity verification so as to satisfy a security policy.

When performing access control to provide identity services to users, if the personal attribute information does not satisfy the security policy, the management unit 134 initiates new authentication and identity verification processing so as to satisfy the security policy.

The management unit 134 suppresses variations in the reliability of personal attribute information due to differences in identity verification methods and continuously manages the reliability of personal attribute information based on the security policy.

The management unit 134 suppresses a decrease in the reliability of personal attribute information over time and continuously manages the reliability of personal attribute information based on the security policy.

When the security policy is changed, the management unit 134 continuously manages the personal attribute information so that it satisfies the changed security policy.

The management unit 134 determines that the personal attribute information does not satisfy the security policy if the expiration date of the identity verification document that is the basis of the registered personal attribute information has passed or the identity verification document has expired. and initiates new authentication and identity verification processes to meet security policies.

The management unit 134 determines the accuracy of personal attribute information for the online user being authenticated by multiplying the authentication accuracy and the identity accuracy. The authentication accuracy becomes 0 when the validity period of the authentication session established after each successful authentication attempt is exceeded. The identity accuracy varies depending on the type of personal attribute information.

In addition, from another perspective, the information processing device (terminal device 10 and server device 100) according to the present application judges the reliability of the authenticator based on the attestation document, and performs FIDO authentication with the reliable authenticator. The authentication processing unit 133 includes an authentication processing unit 133 that performs the authentication, and a management unit 134 that stores the attestation document and continuously manages the authentication strength of the attestation document.

When the management unit 134 decides to strengthen security, if the already stored attestation document does not satisfy the authentication strength, it re-performs attestation that satisfies the authentication strength.

The management unit 134 re-executes attestation when the authenticator no longer satisfies the security policy due to the passage of time or the discovery of a problem.

The management unit 134 re-executes attestation when the authenticator no longer satisfies the security policy due to a change in the security policy.

The management unit 134 determines the reliability strength of the public key based on the contents of the attestation document.

The authentication processing unit 133 verifies the signature using the private key of the authenticator with the public key corresponding to the private key. The management unit 134 manages the reliability strength of the public key, and requests a change of the public key when the reliability strength of the public key decreases.

For example, the management unit 134 determines that the reliability of the public key has deteriorated over time and requests that the public key be changed.

Furthermore, when the validity period of the public key has expired, the management unit 134 determines that the reliability of the public key has decreased, and requests that the public key be changed.

Furthermore, if the reliability strength of the public key does not satisfy the security policy, the management unit 134 determines that the reliability strength of the public key has decreased, and requests a change of the public key.

In addition, from another perspective, the information processing device (terminal device 10 and server device 100) according to the present application dynamically generates a secret question and correct answer for identity verification based on the user's behavior log. It includes a generation unit 132 and an authentication processing unit 133 that verifies the user's identity by comparing the user's answer to the secret question with the correct answer.

For example, the generation unit 132 specifies the format of the behavior log, and specifies and extracts question items from the behavior log.

Alternatively, the generation unit 132 specifies the question items using a statistical analysis method using machine learning.

The generation unit 132 extracts a question target log from a plurality of user behavior logs, creates a question template in which one or more question items are determined from the question target log, determines a question item generation policy, and creates a question item generation policy. Generate questions and correct answers based on.

The generation unit 132 generates a dummy question as well as a secret question. The authentication processing unit 133 presents a dummy question to the user along with the secret question.

The generation unit 132 generates dummy answers as well as correct answers. The authentication processing unit 133 presents the correct answer and dummy answers as options to the user, and allows the user to select.

The generation unit 132 generates one question based on a plurality of user behavior logs.

The authentication processing unit 133 causes the user to input document or image data obtained by the user in relation to the user's actions as the user's answer to the secret question.

The authentication processing unit 133 compares the input document or image data with the document or image data stored in advance as the correct answer to verify the identity.

The authentication processing unit 133 verifies the identity of the user by comparing the hash value based on the data of the input document or image with the hash value stored in advance as the correct answer.

The authentication processing unit 133 allows the user to input data of a plurality of documents or images obtained by the user in relation to each of the user's plurality of actions as the user's answer to the secret question, and inputs the data of the plurality of documents or images based on the data of the plurality of documents or images. The hash value is compared with the hash value stored in advance as the correct answer to verify the identity.

The authentication processing unit 133 verifies the identity of the person by comparing the characteristics of the input document or image data with the characteristics stored in advance as correct answers.

The authentication processing unit 133 causes the user to input email data obtained by the user in relation to the user's purchasing behavior as the user's answer to the secret question.

In addition, from another point of view, the information processing device (terminal device 10 and server device 100) according to the present application includes a management unit 134 that manages information about the person to be authenticated and the authorized delegate designated by the person to be authenticated; In response to a request for account recovery from the authentication subject, an authentication processing unit 133 is provided that performs account recovery of the authentication subject with the approval of the delegatee.

The management unit 134 receives registration of the account of the authorized delegate as a recovery collaborator from the authentication target, and manages the authentication target's account and the authorized delegate's account in a linked manner.

In response to the recovery request from the authentication subject's terminal device, the authentication processing unit 133 transmits a recovery permission request including a challenge to the authorized delegate's terminal device via the authentication subject's terminal device, and receives the recovery permission request. In response to this, a recovery permission response including a signed challenge is received from the delegatee's terminal device via the authentication subject's terminal device, and if the signature verification is successful, the authentication subject's account is recovered. .

The authentication processing unit 133 receives a recovery permission response that includes a signed challenge generated by the authorized delegate signing the challenge as approval for the recovery permission request.

If the signature verification is successful, the authentication processing unit 133 confirms that the authorized delegate is a recovery cooperator, and performs account recovery of the authentication subject.

Data is transmitted and received between the terminal device of the person to be authenticated and the terminal device of the person to be authorized by short-range wireless communication.

The management unit 134 manages information about the child who is the person to be authenticated and the parent who is the delegatee. In response to a request for account recovery from a child, the authentication processing unit 133 performs account recovery for the child with the approval of the parent. At this time, the authentication processing unit 133 performs FIDO authentication on the parent.

By using any one or a combination of the above-described processes, the information processing apparatus according to the present application can provide a method of dynamically creating a secret question in authentication technology.

[8. Hardware configuration]
Further, the terminal device 10 and the server device 100 according to the embodiments described above are realized by, for example, a computer 1000 having a configuration as shown in FIG. 18. The following will explain the server device 100 as an example. FIG. 18 is a diagram showing an example of a hardware configuration. The computer 1000 is connected to an output device 1010 and an input device 1020, and a calculation device 1030, a primary storage device 1040, a secondary storage device 1050, an output I/F (Interface) 1060, an input I/F 1070, and a network I/F 1080 are connected to a bus. 1090.

The arithmetic unit 1030 operates based on programs stored in the primary storage device 1040 and the secondary storage device 1050, programs read from the input device 1020, and performs various processes. The arithmetic device 1030 is realized by, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or the like.

The primary storage device 1040 is a memory device such as a RAM (Random Access Memory) that temporarily stores data used by the calculation device 1030 for various calculations. Further, the secondary storage device 1050 is a storage device in which data used by the calculation device 1030 for various calculations and various databases are registered, and includes a ROM (Read Only Memory), an HDD (Hard Disk Drive), and an SSD (Solid Disk Drive). This is realized using flash memory, etc. The secondary storage device 1050 may be a built-in storage or an external storage. Further, the secondary storage device 1050 may be a removable storage medium such as a USB (Universal Serial Bus) memory or an SD (Secure Digital) memory card. Further, the secondary storage device 1050 may be a cloud storage (online storage), a NAS (Network Attached Storage), a file server, or the like.

The output I/F 1060 is an interface for transmitting information to be output to the output device 1010 that outputs various information such as a display, a projector, and a printer. (Digital Visual Interface) and HDMI (registered trademark) (High Definition Multimedia Interface). Further, the input I/F 1070 is an interface for receiving information from various input devices 1020 such as a mouse, keyboard, keypad, button, scanner, etc., and is realized by, for example, a USB or the like.

Further, the output I/F 1060 and the input I/F 1070 may be wirelessly connected to the output device 1010 and the input device 1020, respectively. That is, output device 1010 and input device 1020 may be wireless devices.

Moreover, the output device 1010 and the input device 1020 may be integrated like a touch panel. In this case, the output I/F 1060 and the input I/F 1070 may also be integrated as an input/output I/F.

Note that the input device 1020 is, for example, an optical recording medium such as a CD (Compact Disc), a DVD (Digital Versatile Disc), or a PD (Phase change rewritable disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), or a tape. It may be a device that reads information from a medium, a magnetic recording medium, a semiconductor memory, or the like.

Network I/F 1080 receives data from other devices via network N and sends it to computing device 1030, and also sends data generated by computing device 1030 to other devices via network N.

Arithmetic device 1030 controls output device 1010 and input device 1020 via output I/F 1060 and input I/F 1070. For example, the arithmetic device 1030 loads a program from the input device 1020 or the secondary storage device 1050 onto the primary storage device 1040, and executes the loaded program.

For example, when the computer 1000 functions as the server device 100, the arithmetic unit 1030 of the computer 1000 realizes the functions of the control unit 130 by executing a program loaded onto the primary storage device 1040. Further, the arithmetic device 1030 of the computer 1000 may load a program obtained from another device via the network I/F 1080 onto the primary storage device 1040, and execute the loaded program. Furthermore, the arithmetic unit 1030 of the computer 1000 may cooperate with other devices via the network I/F 1080, and may call and use program functions, data, etc. from other programs of other devices.

[9. others〕
Although the embodiments of the present application have been described above, the present invention is not limited to the contents of these embodiments. Further, the above-mentioned components include those that can be easily assumed by those skilled in the art, those that are substantially the same, and those that are in a so-called equivalent range. Furthermore, the aforementioned components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the constituent elements can be made without departing from the gist of the embodiments described above.

Further, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed manually. All or part of this can also be performed automatically using known methods. In addition, information including the processing procedures, specific names, and various data and parameters shown in the above documents and drawings may be changed arbitrarily, unless otherwise specified. For example, the various information shown in each figure is not limited to the illustrated information.

Furthermore, each component of each device shown in the drawings is functionally conceptual, and does not necessarily need to be physically configured as shown in the drawings. In other words, the specific form of distributing and integrating each device is not limited to what is shown in the diagram, and all or part of the devices can be functionally or physically distributed or integrated in arbitrary units depending on various loads and usage conditions. Can be integrated and configured.

For example, the server device 100 described above may be realized by a plurality of server computers, and depending on the function, it may be realized by calling an external platform etc. using an API (Application Programming Interface), network computing, etc. Can be changed flexibly.

Furthermore, the above-described embodiments and modifications can be combined as appropriate within a range that does not conflict with the processing contents.

Further, the above-mentioned "section, module, unit" can be read as "means", "circuit", etc. For example, the acquisition unit can be read as an acquisition means or an acquisition circuit.

1 Information processing system 10 Terminal device 100 Server device 110 Communication unit 120 Storage unit 121 User information database 122 History information database 123 Authentication information database 124 Policy information database 130 Control unit 131 Acquisition unit 132 Generation unit 133 Authentication processing unit 134 Management unit 135 Providing department

Claims (15)

a generation unit that dynamically generates a secret question and correct answer for identity verification based on the user's behavior log;
an authentication processing unit that verifies the user's identity by comparing the user's answer to the secret question with the correct answer;
An information processing device comprising: The information processing device according to claim 1, wherein the generation unit specifies a format of the behavior log, and specifies and extracts question items from the behavior log. The information processing device according to claim 1 or 2, wherein the generation unit specifies the question items by a statistical analysis method using machine learning. The generation unit extracts a question target log from a plurality of user behavior logs, creates a question template in which one or more question items are determined from the question target log, determines a question item generation policy, and generates a question item from the question target log. The information processing device according to claim 1 or 2, wherein the information processing device generates a question and a correct answer based on a generation policy. The generation unit generates a dummy question along with the secret question,
The information processing apparatus according to claim 1 or 2, wherein the authentication processing unit presents the dummy question to the user along with the secret question. The generation unit generates a dummy answer along with the correct answer,
The information processing apparatus according to claim 1 or 2, wherein the authentication processing unit presents the dummy answer as an option to the user along with the correct answer, and allows the user to make a selection. The information processing device according to claim 1 or 2, wherein the generation unit generates one question based on a plurality of user behavior logs. 3. The authentication processing unit inputs document or image data obtained by the user in relation to the user's actions as the user's answer to the secret question. Information processing device. The information processing according to claim 8, wherein the authentication processing unit verifies the identity by comparing a hash value based on data of the inputted document or image with a hash value stored in advance as a correct answer. Device. The authentication processing unit inputs data of a plurality of documents or images obtained by the user in relation to each of the plurality of actions of the user as the user's answer to the secret question, and 9. The information processing device according to claim 8, wherein the hash value based on the data is compared with a hash value stored in advance as a correct answer to confirm the identity. The information processing device according to claim 8, wherein the authentication processing unit verifies the identity of the person by comparing input document or image data with document or image data stored in advance as a correct answer. . 9. The information processing apparatus according to claim 8, wherein the authentication processing unit verifies the identity by comparing features of the data of the input document or image with features stored in advance as correct answers. The information processing device according to claim 8, wherein the authentication processing unit causes the user to input email data obtained by the user in relation to the user's purchasing behavior as the user's answer to the secret question. . An information processing method executed by an information processing device, the method comprising:
a generation step of dynamically generating a secret question and a correct answer for identity verification based on the user's behavior log;
an authentication processing step of verifying the user's identity by comparing the user's answer to the secret question with the correct answer;
An information processing method characterized by comprising: a generation procedure for dynamically generating a secret question and correct answer for identity verification based on a user's behavior log;
an authentication procedure for verifying the user's identity by comparing the user's answer to the secret question with the correct answer;
An information processing program that causes a computer to execute.

Images