JP2024052827A - Information processing device, information processing method, and program - Google Patents

Abstract

[Problem] To provide an information processing device, information processing method, and program capable of preventing unauthorized login by a third party. [Solution] An information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated, in which, when a login request is received from the second terminal device, the information processing device generates code information in which authentication information is encoded, transmits the code information to one of the first terminal device and the second terminal device, receives the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device, authenticates the second terminal device based on the authentication information, and transmits an SMS notification to the first terminal device containing an address for launching a payment application for displaying the code information. [Selected Figure] Figure 3

Description

The present invention relates to an information processing device, an information processing method, and a program.

Conventionally, authentication services that use SMS (Short Message Service) are known. For example, Patent Document 1 proposes an authentication system that transmits an SMS authentication value to a pre-registered mobile device, displays an authentication window for the user to input the SMS authentication value, and performs identity authentication based on the SMS authentication value input by the user.

JP 2019-517087 A

However, with the technology described in Patent Document 1, if the SMS authentication value is stolen from a phishing site, the phisher may be able to illegally log in.

The present invention has been made in consideration of these circumstances, and one of its objectives is to provide an information processing device, information processing method, and program that can prevent unauthorized logins by other people.

One aspect of the present invention is an information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated, the information processing device comprising: a code information generation unit that generates code information in which authentication information is encoded when a login request is received from the second terminal device; a transmission unit that transmits the code information generated by the code information generation unit to one of the first terminal device and the second terminal device; a reception unit that receives the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device; and an authentication unit that authenticates the second terminal device based on the authentication information received by the reception unit, the transmission unit being an app for making electronic payments at a store and transmitting an SMS (Short Message Service) notification containing an address for starting a payment app for displaying the code information to the first terminal device.

According to one aspect of the present invention, it is possible to provide an information processing device, an information processing method, and a program that can prevent unauthorized login by other people.

FIG. 1 is a diagram showing an example of a configuration for realizing an electronic payment service. FIG. 1 is a diagram illustrating an example of a general flow of electronic payment. FIG. 2 is a configuration diagram of a payment server 100. FIG. 11 is a diagram showing an example of the contents of user information 172. 13 is a flowchart illustrating an example of a login authentication process. FIG. 11 is a sequence diagram illustrating an example of a first authentication process. A figure showing an example of a display screen of a first user terminal device 10A on which a QR code is displayed. FIG. 11 is a sequence diagram illustrating an example of a second authentication process according to the first embodiment. A figure showing an example of a display screen of a second user terminal device 10B on which a QR code is displayed. FIG. 11 is a sequence diagram showing an example of a second authentication process according to the second embodiment.

The information processing device, information processing method, and program of the present invention will be described below with reference to the drawings. The information processing device is realized by one or more processors. In the following description, the information processing device provides an electronic payment service and is described as a "payment server", but the information processing device may provide any service that involves login, such as shopping, auctions, chat, microblogging, and others. The electronic payment service is a service that supports payments related to the purchase of goods and services at a store. A store is, for example, a physical store (real-world store) that exists in real space.

First Embodiment
[Electronic payment service]
1 is a diagram showing an example of a configuration for realizing an electronic payment service. The electronic payment service is realized mainly by a payment server 100. The payment server 100 communicates with, for example, one or more user terminal devices 10 and one or more store terminal devices 50 via a network NW. The network NW includes, for example, the Internet, a LAN (Local Area Network), a wireless base station, a provider device, and the like.

The user terminal device 10 is, for example, a portable terminal device such as a smartphone or a tablet terminal. The user terminal device 10 is a computer device having at least an optical reading function, a communication function, a display function, an input acceptance function, and a program execution function. In the following description, the components for realizing these functions are respectively referred to as a camera, a communication device, a touch panel, a CPU (Central Processing Unit), etc. In the user terminal device 10, a payment app 20 is executed by a processor such as a CPU, and the user terminal device 10 operates in cooperation with the payment server 100 to provide electronic payment services to users. The payment app 20 controls the camera, communication device, touch panel, etc.

The store terminal device 50 is installed, for example, in a store. The store terminal device 50 is a computer device having at least a product price acquisition function, an optical reading function, a program execution function, and a communication function. The store terminal device 50 includes a so-called POS (Point of Sale) device, and the product price acquisition function and the optical reading function may be realized by the POS device. The store code image 60 is placed in the store, and is a code image such as a QR code (registered trademark) printed on a paper or plastic medium. The store code image 60 may be displayed on a display placed in the store.

The payment server 100 realizes electronic payment based on payment information received from the user terminal device 10 or the store terminal device 50. The payment server 100 performs electronic payment, for example, by increasing or decreasing the charge balance managed in association with the user ID (in other words, by depositing or withdrawing electronic money). Electronic payment may include a method that allows purchases of a larger amount than the charge balance at the time of purchase, such as revolving payment or credit payment.

Figure 2 is a diagram illustrating the general flow of electronic payment. There may be two patterns for electronic payment: pattern 1 and pattern 2. In the case of pattern 1, the payment app 20 is first launched on the user terminal device 10, and a code image such as a QR code or a barcode is displayed. The user holds (presents) the display surface of the user terminal device 10 over the store terminal device 50. The store terminal device 50 decodes the code image using an optical reading function and acquires information such as an account ID. The store terminal device 50 then generates payment information including the account ID, payment amount, store ID, etc., and transmits it to the payment server 100. Information on the payment amount has been acquired in advance by reading a barcode or manually entering the information. Based on the received information, the payment server 100 transfers the payment amount from the user's electronic payment account to the store's electronic payment account, completing the payment process.

In the case of pattern 2, the user terminal device 10 with the payment app 20 running uses an optical reading function to decode the store code image 60. The store code image 60 contains information such as the store name. The user inputs the payment amount into the user terminal device 10 on the screen displaying the store name, etc. The user terminal device 10 then generates payment information including the account ID, payment amount, store ID, etc., and transmits it to the payment server 100. The payment server 100 performs payment processing based on the received information. Note that electronic payment may be performed only in one of the above patterns. The "account ID" described in FIG. 2 may also be other information (e.g., a phone number) that can be used as user identification information.

[Payment server]
3 is a configuration diagram of the payment server 100. The payment server 100 includes, for example, a communication unit 110, a payment content providing unit 120, a payment processing unit 122, a code information generating unit 124, a determination unit 126, an authentication unit 128, an information management unit 130, and a storage unit 170. The components other than the communication unit 110 and the storage unit 170 are realized by, for example, a hardware processor such as a CPU executing a program (software). Some or all of these components may be realized by hardware (including circuitry) such as an LSI (Large Scale Integration), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a GPU (Graphics Processing Unit), or may be realized by cooperation between software and hardware. The program may be stored in advance in a storage device such as a hard disk drive (HDD) or flash memory (a storage device with a non-transient storage medium), or may be stored in a removable storage medium (non-transient storage medium) such as a DVD or CD-ROM, and installed in the storage device by inserting the storage medium into a drive device.

The storage unit 170 is a HDD, a flash memory, a RAM (Random Access Memory), etc. The storage unit 170 may be a NAS (Network Attached Storage) device that the payment server 100 can access via a network. The storage unit 170 stores information such as user information 172 and payment content information 174.

The communication unit 110 is a communication interface for connecting to the network NW. The communication unit 110 is, for example, a network interface card. The communication unit 110 has a function as a transmitting unit that transmits information via the network NW and a function as a receiving unit that receives information via the network NW.

The payment content providing unit 120 has, for example, a web server function, and provides information (content) for displaying various screens of the electronic payment service to the user terminal device 10. The payment content providing unit 120 reads out necessary content from the payment content information 174 as appropriate and provides it to the user terminal device 10. The user terminal device 10 accepts various inputs by the user while the content is being played by the payment application 20, and transmits the above-mentioned payment information and the like to the payment server 100.

The payment processing unit 122 performs payment processing based on the payment information sent by the user terminal device 10 or the store terminal device 50. The payment processing unit 122 performs payment processing while referring to the user information 172.

[User Information]
FIG. 4 is a diagram showing an example of the contents of the user information 172. The user information 172 is an example of user registration information. For example, the user information 172 is information such as an email address, a user ID, a device ID, a charge balance, a bank account, a credit card number, charge history information, and payment history information associated with an account ID (which may be omitted), in addition to the minimum phone number and password required for new registration. Information other than the phone number, password, device ID, charge balance, charge history information, and payment history information is optional information. Hereinafter, the user instance (electronic payment account) associated with this information is referred to as an account. The phone number may be used as a login ID for the electronic payment service.

The user ID is an example of user identification information used by the payment server 100 to identify a user, and is information that can be set by the user at will, such as the user's nickname. The device ID is an example of information used by the payment server 100 to identify the user terminal device 10. For example, the device ID may be information generated by combining information such as the IMEI (International Mobile Equipment Identifier), information about the manufacturer of the user terminal device 10, and the ID of the OS (Operating System).

The charge balance is information indicating the balance of electronic money that is set by the user by transferring money to the account in advance. Methods of transfer include transfer from an ATM (Automatic Teller Machine) of a designated business (bank) or transfer from a registered bank account. The bank account and credit card number are information on the bank account or credit card number (account number, card number) that can be used to deposit money into the electronic payment service. The charge history information is a history of the user transferring money to the electronic payment service in advance to increase the charge balance. The payment history information is information indicating the details of payments made by the user for each payment (date and time, store ID of the store where the purchase was made, payment amount, etc.).

[Phishing methods]
When a user changes the model of a smartphone, for example, the user may attempt to log in to an electronic payment service using a terminal device other than the terminal device that has already been authenticated as the terminal device used by the user. In this case, the user inputs authentication information from the existing terminal device, and authentication processing of the new terminal device is performed. However, if the authentication information is illegally obtained by a third party, there is a possibility that the third party may illegally log in to the electronic payment service from the third party's terminal device. For this reason, the present embodiment aims to prevent illegal logins by a third party (e.g., a phishing criminal). Therefore, before describing the details of the processing of this embodiment, a phishing method will be described.

Phishing is a fraudulent act carried out to obtain information such as a user's login ID, password, and authentication code via the Internet. In recent years, the number of phishing sites has increased rapidly, and there is no end to the number of victims who have had their login ID, password, and authentication code stolen. This embodiment aims to reduce the number of login attempts by phishing criminals by increasing the login strength, and to discourage phishing criminals from setting up phishing sites in the first place.

Phishers obtain a user's login ID (such as a phone number) and password in the following way:
(1) Phishers trick users into accessing a fake login site and entering their login ID and password.
(2) The phisher attempts to log in to a legitimate login site from his/her terminal device using the entered login ID and password. Because the access comes from a device other than the user's terminal device, a message containing an authentication code is sent to the user's terminal device via SMS (Short Message Service) or other means to prevent unauthorized access.
(3) The phisher displays a screen on a fake login site that asks the victim to enter the authentication code sent via SMS.
(4) The phisher then uses his or her terminal device to enter the authentication code entered by the user into the fake login site into the legitimate login site, completing the login scam.

The problem with the above phishing methods is that the user ends up entering an authentication code on a fake login site. Therefore, in this embodiment, a user is only allowed to log in using a terminal device in the new environment when a terminal device (existing environment) that has already been authenticated as a terminal device used by the user and a terminal device (new environment) that has not yet been authenticated are physically close to each other. Details of this embodiment are described below.

[Login authentication process]
5 is a flowchart showing an example of a login authentication process. The process according to this flowchart is executed by the payment server 100. First, the communication unit 110 of the payment server 100 receives a login request from the user terminal device 10 (S11). The login request includes information such as a login ID (such as a telephone number), a password, and a device ID.

Next, the authentication unit 128 compares the login ID (e.g., telephone number) and password included in the login request with the user information 172 to determine whether the login authentication has been successful (S12). Specifically, the authentication unit 128 determines that the login authentication has been successful if the login ID (e.g., telephone number) included in the login request is registered in the user information 172 and the password included in the login request matches the password included in the user information 172. On the other hand, the authentication unit 128 determines that the login authentication has failed if the login ID (e.g., telephone number) included in the login request is not registered in the user information 172 or the password included in the login request does not match the password included in the user information 172.

If the authentication unit 128 determines that the login authentication has failed, it sends a login failure notification to the user terminal device 10 (S13) and terminates the processing according to this flowchart.

On the other hand, if the authentication unit 128 determines that the login authentication was successful, it compares the device ID included in the login request with the user information 172 to determine whether the login is from a new environment (S14). Here, the new environment refers to a terminal device that has not been authenticated as a terminal device used by the user. Also, the existing environment refers to a terminal device that has already been authenticated as a terminal device used by the user.

Specifically, if the device ID included in the login request does not match the device ID included in the user information 172, the authentication unit 128 determines that the login is from a new environment. On the other hand, if the device ID included in the login request matches the device ID included in the user information 172, the authentication unit 128 determines that the login is from an existing environment.

If the authentication unit 128 determines that the login is not from a new environment (i.e., that the login is from an existing environment), it sends a login success notification to the user terminal device 10 (S15) and ends the processing according to this flowchart.

On the other hand, if the authentication unit 128 determines that the login is from a new environment, the determination unit 126 determines whether or not the login is from the payment app 20 (S16). If the authentication unit 128 determines that the login is from the payment app 20, it executes a first authentication process described below (S17). On the other hand, if the authentication unit 128 determines that the login is not from the payment app 20, it executes a second authentication process described below (S18). If the login is not from the payment app 20, it is, for example, a case where the login is from a web browser.

The payment app 20 is installed on a terminal device equipped with a camera, such as a smartphone or tablet terminal. Therefore, if the login is from the payment app 20, a first authentication process is performed, which is an authentication process using the camera of the user terminal device 10 that sent the login request. On the other hand, if the login is not from the payment app 20 (for example, if the login is from a web browser), the user terminal device 10 may not be equipped with a camera. Therefore, if the login is not from the payment app 20, a second authentication process is performed, which is an authentication process that does not use the camera of the user terminal device 10 that sent the login request. Details of the first authentication process and the second authentication process are described below.

[First authentication process]
6 is a sequence diagram showing an example of the first authentication process. In explaining this sequence diagram, a terminal device (existing environment) that has already been authenticated as a terminal device used by a user is defined as a first user terminal device 10A, and a terminal device (new environment) that has not yet been authenticated is defined as a second user terminal device 10B. The following describes the first authentication process when a login request is made from the second user terminal device 10B to the payment server 100.

First, the communication unit 110 of the payment server 100 sends an SMS notification to the first user terminal device 10A, which is the existing environment (S101). The SMS notification is a notification by short message using the user's telephone number. The SMS notification includes a URL (Uniform Resource Locator) for launching the payment application 20.

When the first user terminal device 10A receives the SMS notification from the payment server 100, it launches the payment app 20 (S102). For example, the first user terminal device 10A launches the payment app 20 in response to the user selecting a URL included in the SMS notification.

Next, the code information generation unit 124 of the payment server 100 generates a QR code in which the authentication information is encoded (S103). For example, the authentication information may be time-limited information such as a one-time password. The code information generation unit 124 also transmits the generated QR code from the communication unit 110 to the first user terminal device 10A (S104). When the first user terminal device 10A receives the QR code from the payment server 100, it displays the QR code on the screen of the payment app 20 (S105).

Figure 7 is a diagram showing an example of the display screen of the first user terminal device 10A on which a QR code is displayed. As shown in Figure 7, the display screen of the first user terminal device 10A displays the QR code C and a message such as "Please read the QR code with a new terminal."

Next, the second user terminal device 10B, which is the new environment, photographs the QR code displayed on the first user terminal device 10A (S106). Specifically, the user uses the camera of the second user terminal device 10B to photograph the QR code displayed on the first user terminal device 10A.

The second user terminal device 10B also obtains authentication information by decoding the captured QR code (S107). The second user terminal device 10B then transmits the obtained authentication information to the payment server 100 (S108).

When the communication unit 110 of the payment server 100 receives the authentication information from the second user terminal device 10B, the authentication unit 128 of the payment server 100 performs a process of comparing the authentication information (S109). Specifically, the authentication unit 128 determines whether the authentication information included in the QR code sent to the first user terminal device 10A matches the authentication information received from the second user terminal device 10B. If the authentication information included in the QR code sent to the first user terminal device 10A does not match the authentication information received from the second user terminal device 10B, the authentication unit 128 transmits a login denial notification from the communication unit 110 to the second user terminal device 10B.

On the other hand, if the authentication information included in the QR code sent to the first user terminal device 10A matches the authentication information received from the second user terminal device 10B, the authentication unit 128 sends a login permission notification from the communication unit 110 to the second user terminal device 10B (S110). This allows login from the second user terminal device 10B, which is the new environment.

Then, the information management unit 130 performs an update process of the user information 172 (S111). Specifically, the information management unit 130 writes the device ID included in the login request sent from the second user terminal device 10B (i.e., the device ID of the second user terminal device 10B) into the user information 172 in association with the login ID (such as a telephone number) included in the login request.

According to the first authentication process described above, the QR code displayed on the first user terminal device 10A must be photographed by the second user terminal device 10B. In other words, authentication must be performed when the first user terminal device 10A and the second user terminal device 10B are physically close to each other, which can prevent unauthorized logins by phishing criminals.

[Second authentication process]
8 is a sequence diagram showing an example of the second authentication process according to the first embodiment. In the first authentication process described above, the payment server 100 transmits a QR code to the first user terminal device 10A, but in the second authentication process, the payment server 100 transmits a QR code to the second user terminal device 10B. This is because the second user terminal device 10B may not be equipped with a camera. The second authentication process when a login request is made from the second user terminal device 10B to the payment server 100 will be described below.

First, the communication unit 110 of the payment server 100 sends an SMS notification to the first user terminal device 10A, which is the existing environment (S201). As described above, the SMS notification is a notification by short message using the user's telephone number, and includes a URL for launching the payment application 20.

When the first user terminal device 10A receives the SMS notification from the payment server 100, it launches the payment app 20 (S202). For example, the first user terminal device 10A launches the payment app 20 in response to the user selecting a URL included in the SMS notification.

Next, the code information generation unit 124 of the payment server 100 generates a QR code in which the authentication information is coded (S203). For example, the authentication information may be time-limited information such as a one-time password. The code information generation unit 124 also transmits the generated QR code from the communication unit 110 to the second user terminal device 10B (S204). When the second user terminal device 10B, which is the new environment, receives the QR code from the payment server 100, it displays the QR code on the display unit of the second user terminal device 10B (S205).

Figure 9 is a diagram showing an example of the display screen of the second user terminal device 10B on which a QR code is displayed. As shown in Figure 9, the display screen of the second user terminal device 10B displays the QR code C and a message such as "Please read the QR code with an existing terminal."

Next, the first user terminal device 10A, which is the existing environment, photographs the QR code displayed on the second user terminal device 10B (S206). Specifically, the user uses the camera of the first user terminal device 10A to photograph the QR code displayed on the second user terminal device 10B.

The first user terminal device 10A also obtains authentication information by decoding the captured QR code (S207). The first user terminal device 10A then transmits the obtained authentication information to the payment server 100 (S208).

When the communication unit 110 of the payment server 100 receives the authentication information from the first user terminal device 10A, the authentication unit 128 of the payment server 100 performs a process of comparing the authentication information (S209). Specifically, the authentication unit 128 determines whether the authentication information included in the QR code sent to the second user terminal device 10B matches the authentication information received from the first user terminal device 10A. If the authentication information included in the QR code sent to the second user terminal device 10B does not match the authentication information received from the first user terminal device 10A, the authentication unit 128 transmits a login denial notification from the communication unit 110 to the second user terminal device 10B.

On the other hand, if the authentication information included in the QR code sent to the second user terminal device 10B matches the authentication information received from the first user terminal device 10A, the authentication unit 128 sends a login permission notification from the communication unit 110 to the second user terminal device 10B (S210). This allows login from the second user terminal device 10B, which is the new environment.

Then, the information management unit 130 performs an update process of the user information 172 (S211). Specifically, the information management unit 130 writes the device ID included in the login request sent from the second user terminal device 10B (i.e., the device ID of the second user terminal device 10B) into the user information 172 in association with the login ID (such as a telephone number) included in the login request.

According to the second authentication process described above, it is necessary to photograph the QR code displayed on the second user terminal device 10B with the first user terminal device 10A. In other words, since authentication must be performed in a situation where the first user terminal device 10A and the second user terminal device 10B are physically close to each other, it is possible to prevent unauthorized logins by phishing criminals. Furthermore, even if the second user terminal device 10B, which is the new environment, is not equipped with a camera, unauthorized logins can be prevented.

As described above, the payment server 100 (information processing device) of the first embodiment includes a code information generating unit 124, a communication unit 110, an authentication unit 128, and a determination unit 126. When a login request is received from the second user terminal device 10B, the code information generating unit 124 generates a QR code (code information) in which authentication information is coded. The communication unit 110 transmits the generated QR code to either the first user terminal device 10A or the second user terminal device 10B, and receives authentication information obtained by photographing and decoding the QR code from the other of the first user terminal device 10A and the second user terminal device 10B. The authentication unit 128 authenticates the second user terminal device 10B based on the received authentication information. The determination unit 126 determines to which of the first user terminal device 10A and the second user terminal device 10B the QR code is to be transmitted, depending on the login method of the second user terminal device 10B. This makes it possible to prevent unauthorized login by other people.

In the first embodiment, the determination unit 126 determines whether to send the QR code to the first user terminal device 10A or the second user terminal device 10B depending on whether the login request from the second user terminal device 10B is a login request from the payment application 20. Specifically, if the login request from the second user terminal device 10B is a login request from the payment application 20, the determination unit 126 determines to send the QR code to the first user terminal device 10A, and if the login request from the second user terminal device 10B is not a login request from the payment application 20, the determination unit 126 determines to send the QR code to the first user terminal device 10A. If the login request is from the payment application 20, the second user terminal device 10B is presumed to be a mobile terminal device with a camera function, but if the login request is not from the payment application 20, it is because the login is via a WEB browser and the second user terminal device 10B is presumed to be a PC (Personal Computer) or the like that does not have a camera function. This ensures that the QR code can be photographed reliably by the user terminal device 10 equipped with a camera, ensuring reliable authentication processing.

In addition, in the first embodiment, the communication unit 110 transmits an SMS notification containing an address for launching the payment app 20 to the first user terminal device 10A prior to the generation of a QR code by the code information generation unit 124. This allows the payment app 20 to be launched without delay in the first user terminal device 10A.

Second Embodiment
In the first embodiment described above, authentication using a QR code is performed only once, whereas in the second embodiment, authentication using a QR code is performed multiple times to further strengthen security.

As shown in S205 of FIG. 8, in the second authentication process of the first embodiment, a QR code is displayed on the second user terminal device 10B. However, if a phisher displays this QR code on a fake login site and a user photographs the displayed QR code with a user terminal device in the existing environment, there is a possibility that unauthorized login will be performed with the phisher's terminal device. For this reason, when displaying the QR code on the second user terminal device 10B, it is preferable to display it multiple times as quickly as possible. Note that the first authentication process of the second embodiment is the same as the first authentication process of the first embodiment, so a description thereof will be omitted. Details of the second embodiment will be described below.

Figure 10 is a sequence diagram showing an example of the second authentication process according to the second embodiment. Below, we will explain the second authentication process when a login request is made from the second user terminal device 10B to the payment server 100.

First, the communication unit 110 of the payment server 100 sends an SMS notification to the first user terminal device 10A, which is the existing environment (S301). As described above, the SMS notification is a notification by short message using the user's telephone number, and includes a URL for launching the payment application 20.

When the first user terminal device 10A receives the SMS notification from the payment server 100, it launches the payment app 20 (S302). For example, the first user terminal device 10A launches the payment app 20 in response to the user selecting a URL included in the SMS notification.

Next, the code information generating unit 124 of the payment server 100 generates a first QR code in which the first authentication information is encoded (S303). For example, the first authentication information may be time-limited information such as a one-time password. The code information generating unit 124 also transmits the generated first QR code from the communication unit 110 to the second user terminal device 10B (S304).

When the second user terminal device 10B, which is the new environment, receives the first QR code from the payment server 100, it displays the first QR code on the display unit of the second user terminal device 10B (S305). At this time, the second user terminal device 10B displays the first QR code for only a first time (e.g., 30 seconds). For example, in S304, the second user terminal device 10B may receive information about the first time together with the first QR code from the payment server 100, and display the first QR code for only a time according to the received information about the first time.

Next, the first user terminal device 10A, which is the existing environment, photographs the first QR code displayed on the second user terminal device 10B (S306). Specifically, the user uses the camera of the first user terminal device 10A to photograph the first QR code displayed on the second user terminal device 10B.

The first user terminal device 10A also obtains the first authentication information by decoding the captured first QR code (S307). The first user terminal device 10A then transmits the obtained first authentication information to the payment server 100 (S308).

When the communication unit 110 of the payment server 100 receives the first authentication information from the first user terminal device 10A, the authentication unit 128 of the payment server 100 performs a comparison process of the first authentication information (S309). Specifically, the authentication unit 128 determines whether the first authentication information included in the first QR code sent to the second user terminal device 10B matches the first authentication information received from the first user terminal device 10A. If the first authentication information included in the first QR code sent to the second user terminal device 10B does not match the first authentication information received from the first user terminal device 10A, the authentication unit 128 transmits a login denial notification from the communication unit 110 to the second user terminal device 10B.

On the other hand, if the first authentication information included in the first QR code sent to the second user terminal device 10B matches the first authentication information received from the first user terminal device 10A, the code information generation unit 124 generates a second QR code in which second authentication information different from the first authentication information is encoded (S310). For example, the second authentication information may be time-limited information such as a one-time password. In addition, the code information generation unit 124 transmits the generated second QR code from the communication unit 110 to the second user terminal device 10B (S311).

When the second user terminal device 10B, which is the new environment, receives the second QR code from the payment server 100, it displays the second QR code on the display unit of the second user terminal device 10B (S312). At this time, the second user terminal device 10B displays the second QR code for a second time (e.g., 5 seconds) that is shorter than the first time. For example, in S311, the second user terminal device 10B may receive information about the second time along with the second QR code from the payment server 100, and display the second QR code for a time according to the received information about the second time.

When photographing the first QR code in S306, as this is the first photograph, the first QR code is displayed for a relatively long time (e.g., 30 seconds) taking into consideration the startup time of the camera function. On the other hand, when photographing the second QR code in S313, as the camera function has already started, the display time of the second QR code is set to a short time (e.g., 5 seconds). This makes it possible to more reliably prevent the second authentication information from being illegally obtained by phishers.

Next, the first user terminal device 10A, which is the existing environment, photographs the second QR code displayed on the second user terminal device 10B (S313). Specifically, the user uses the camera of the first user terminal device 10A to photograph the second QR code displayed on the second user terminal device 10B.

The first user terminal device 10A also obtains second authentication information by decoding the captured second QR code (S314). The first user terminal device 10A then transmits the obtained second authentication information to the payment server 100 (S315).

When the communication unit 110 of the payment server 100 receives the second authentication information from the first user terminal device 10A, the authentication unit 128 of the payment server 100 performs a process of verifying the second authentication information (S316). Specifically, the authentication unit 128 determines whether the second authentication information included in the second QR code sent to the second user terminal device 10B matches the second authentication information received from the first user terminal device 10A. If the second authentication information included in the second QR code sent to the second user terminal device 10B does not match the second authentication information received from the first user terminal device 10A, the authentication unit 128 transmits a login denial notification from the communication unit 110 to the second user terminal device 10B.

On the other hand, if the second authentication information included in the second QR code sent to the second user terminal device 10B matches the second authentication information received from the first user terminal device 10A, the authentication unit 128 sends a login permission notification from the communication unit 110 to the second user terminal device 10B (S317). This allows login from the second user terminal device 10B, which is the new environment.

Then, the information management unit 130 performs an update process of the user information 172 (S318). Specifically, the information management unit 130 writes the device ID included in the login request sent from the second user terminal device 10B (i.e., the device ID of the second user terminal device 10B) into the user information 172 in association with the login ID (such as a telephone number) included in the login request.

According to the second embodiment described above, as in the first embodiment, unauthorized login by a third party can be prevented. Furthermore, according to the second embodiment, the code information generating unit 124 generates a first QR code (first code information) in which the first authentication information is coded, and then generates a second QR code (second code information) in which second authentication information different from the first authentication information is coded. If both the authentication based on the first QR code and the authentication based on the second QR code are successful, the authentication unit 128 authenticates the second user terminal device 10B as a terminal device used by the user. This makes it possible to more reliably prevent unauthorized login by phishing perpetrators.

Furthermore, according to the second embodiment, the time during which the second QR code (second code information) can be photographed is shorter than the time during which the first QR code (first code information) can be photographed. This makes it possible to more reliably prevent the second authentication information from being illegally obtained by phishing criminals.

In the second embodiment, as an example, authentication based on the first QR code and the second QR code is performed in the second authentication process, but this is not limited to this. For example, authentication based on the first QR code and the second QR code may be performed in the first authentication process. This is because, even if a phisher can photograph the QR code displayed on the first user terminal device 10A, which is the existing environment, displaying the QR code as quickly and multiple times as possible is effective in preventing unauthorized login. In this case, the communication unit 110 of the payment server 100 may transmit the first QR code and the second QR code to the first user terminal device 10A, and the second user terminal device 10B may photograph the first QR code and the second QR code displayed on the first user terminal device 10A, and the authentication unit 128 of the payment server 100 may authenticate the second user terminal device 10B as a terminal device used by the user when both the authentication based on the first QR code and the authentication based on the second QR code are successful.

In the first and second embodiments, the communication unit 110 sends an SMS notification containing an address for launching the payment app 20 to the first user terminal device 10A prior to the generation of a QR code by the code information generation unit 124, but this is not limited to the above. For example, the communication unit 110 may send a push notification for launching the payment app 20 to the first user terminal device 10A prior to the generation of a QR code by the code information generation unit 124. The push notification is a message that can be sent directly to the first user terminal device 10A, and is displayed on the first user terminal device 10A together with a notification sound. In this case, the user will launch the payment app 20 on the first user terminal device 10A based on the push notification.

In addition, in the first and second embodiments, the explanation is given on the assumption that the payment app 20 is installed in the first user terminal device 10A. However, if the payment app 20 is not installed in the first user terminal device 10A, the communication unit 110 may send an SMS notification to the first user terminal device 10A to install the payment app 20. This enables the use of the payment app 20 in the first user terminal device 10A, and makes it possible to launch the camera function from the payment app 20, etc.

In addition, in the first and second embodiments, the communication unit 110 may transmit location information based on the IP (Internet Protocol) address of the second user terminal device 10B or information regarding the purpose of the login (e.g., the service to which the user is attempting to log in) to the first user terminal device 10A and display it. This allows the user who owns the first user terminal device 10A to determine whether or not an unauthorized login is being attempted by a phisher.

In addition to the authentication process of the first and second embodiments, the authentication unit 128 may acquire location information of the first user terminal device 10A and location information of the second user terminal device 10B, and determine that the first user terminal device 10A and the second user terminal device 10B are operated by the same person when the distance between the first user terminal device 10A and the second user terminal device 10B is within a predetermined distance. The location information may be information obtained by a Global Positioning System (GPS), for example. The authentication unit 128 may determine whether the first user terminal device 10A and the second user terminal device 10B are operated by the same person based on sensor information (such as the degree of inclination of the user terminal device at the time of operation, temperature information, and humidity information) obtained from the first user terminal device 10A and the second user terminal device 10B in addition to the location information.

In the first and second embodiments, the payment server 100 performs the authentication process, but this is not limited to the above. For example, an authentication server may be constructed as an information processing device that performs the authentication process, separate from the payment server 100.

The above describes the form for carrying out the present invention using an embodiment, but the present invention is not limited to such an embodiment, and various modifications and substitutions can be made without departing from the spirit of the present invention.

10 User terminal device 20 Payment application 50 Store terminal device 60 Store code image 100 Payment server 110 Communication unit (transmitter, receiver)
120 Payment content providing unit 122 Payment processing unit 124 Code information generating unit 126 Determination unit 128 Authentication unit 130 Information management unit 170 Storage unit

Claims (12)

An information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated,
a code information generating unit that generates code information obtained by encoding authentication information when a login request is received from the second terminal device;
a transmission unit that transmits the code information generated by the code information generation unit to one of the first terminal device and the second terminal device;
a receiving unit that receives the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device;
an authentication unit that authenticates the second terminal device based on the authentication information received by the receiving unit;
Equipped with
The transmission unit is an application for performing electronic payment at a store, and transmits to the first terminal device a Short Message Service (SMS) notification including an address for launching a payment application for displaying the code information.
Information processing device. An information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated,
a code information generating unit that generates code information obtained by encoding authentication information when a login request is received from the second terminal device;
a transmission unit that transmits the code information generated by the code information generation unit to one of the first terminal device and the second terminal device;
a receiving unit that receives the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device;
an authentication unit that authenticates the second terminal device based on the authentication information received by the receiving unit;
Equipped with
The transmission unit transmits to the first terminal device a push notification for activating a payment application for performing electronic payment at a store and for displaying the code information.
Information processing device. a determination unit that determines whether the code information is to be transmitted to the first terminal device or the second terminal device depending on a login method of the second terminal device;
3. The information processing device according to claim 1. the determination unit determines to which of the first terminal device and the second terminal device the code information is to be transmitted, depending on whether the login request from the second terminal device is a login request from a payment application for performing electronic payment at a store.
4. The information processing device according to claim 3. When the login request from the second terminal device is a login request from the payment application, the determination unit determines to transmit the code information to the first terminal device;
When the login request from the second terminal device is not a login request from the payment application, the determination unit determines to transmit the code information to the second terminal device.
5. The information processing device according to claim 4. When the payment app is not installed in the first terminal device, the transmission unit transmits an SMS notification to the first terminal device for causing the first terminal device to install the payment app.
5. The information processing device according to claim 4. the code information generating unit generates first code information in which the first authentication information is encoded, and then generates second code information in which second authentication information different from the first authentication information is encoded;
the authentication unit authenticates the second terminal device as a terminal device used by the user when both the authentication based on the first code information and the authentication based on the second code information are successful.
3. The information processing device according to claim 1. a time during which the second code information can be photographed is shorter than a time during which the first code information can be photographed;
8. The information processing device according to claim 7. An information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated,
generating code information in which authentication information is encoded when a login request is received from the second terminal device;
Transmitting the code information to one of the first terminal device and the second terminal device;
receiving the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device;
authenticating the second terminal device based on the received authentication information;
an application for performing electronic payment at a store, the application sending an SMS (Short Message Service) notification to the first terminal device, the SMS notification including an address for launching a payment application for displaying the code information;
Information processing methods. An information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated,
generating code information in which authentication information is encoded when a login request is received from the second terminal device;
Transmitting the code information to one of the first terminal device and the second terminal device;
receiving the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device;
authenticating the second terminal device based on the received authentication information;
a push notification for starting a payment application for performing electronic payment at a store and displaying the code information is sent to the first terminal device;
Information processing methods. An information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated,
generating code information in which authentication information is encoded when a login request is received from the second terminal device;
transmitting the code information to one of the first terminal device and the second terminal device;
receiving the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device;
authenticating the second terminal device based on the received authentication information;
an application for performing electronic payment at a store, the application causing the first terminal device to transmit an SMS (Short Message Service) notification including an address for launching a payment application for displaying the code information;
program. An information processing device capable of communicating with a first terminal device that has already been authenticated as a terminal device used by a user and a second terminal device that has not yet been authenticated,
generating code information in which authentication information is encoded when a login request is received from the second terminal device;
transmitting the code information to one of the first terminal device and the second terminal device;
receiving the authentication information obtained by photographing and decoding the code information from the other of the first terminal device and the second terminal device;
authenticating the second terminal device based on the received authentication information;
an application for performing electronic payment at a store, the application causing the first terminal device to transmit a push notification for activating a payment application for displaying the code information;
program.

Images