JP4555002B2 - User authentication system, login request determination apparatus and method - Google Patents

Description

  The present invention relates to a technique for detecting unauthorized access, and more particularly, to a technique for detecting an unauthorized login request in a system that determines whether login is permitted or not by password authentication.

  With the development of network technology, computer systems using networks have been widely used. Password authentication is widely used as a user authentication means when logging in to a computer system. Password authentication is a simple authentication method that does not require expensive equipment, but can be easily broken due to the outflow of passwords.

  Therefore, as measures to improve the security of password authentication, the password may be forcibly changed after a certain period of time, or if the password input fails for a predetermined number of times, subsequent logins will be refused. (For example, Patent Document 1).

JP 2001-318891 A

  However, the conventional measures for improving the safety often reject the login request for the legitimate user. That is, there are many passwords that must be managed by one user, and the password of one system is frequently changed, so the password is forgotten. As a result, even a legitimate user may make a mistake in entering a password, and not all cases that are rejected are unauthorized access. Moreover, even if it is a regular user, if it is often rejected, it is not convenient.

  An object of the present invention is to easily find unauthorized access without deteriorating the usability of authorized users.

  Another object of the present invention is to deny unauthorized access without deteriorating the usability of authorized users.

  A system for user authentication using a password according to an embodiment of the present invention includes: a unit for receiving an authentication request including a password input by a user; and a plurality of rules including a rule regarding a password for the authentication request. Means for applying any one or more of the above, authentication means for determining whether the user authentication is correct according to the result of application of the rule, and application of the rule when the result of the user authentication is negative A post-authentication processing unit that executes a first action according to a result and prompts the user to re-enter a password.

  In a preferred embodiment, each of the plurality of rules includes a determination condition and a second action for determining an evaluation value when the determination condition is met. And the said authentication means may determine the right or wrong of authentication based on the said evaluation value.

  In a preferred embodiment, the post-authentication processing means, when the result of the user authentication is negative, if the evaluation value determined by applying the rule is not less than a predetermined value, the authentication request is invalid. You may make it alert | report that it is a thing.

According to one embodiment of the present invention, a login request determination device for detecting unauthorized access includes means for receiving a login request including a user ID and a password input by the user, and each user defines a plurality of user IDs. Means for storing a plurality of determination conditions for each user ID for determining the login request, plus or minus points associated with each of the plurality of determination conditions, and accumulation for each user ID Each time the log-in request is accepted by the means for holding the number of points, and each time the log-in request is accepted, the storage means is referred to and the plurality of determination conditions corresponding to the log-in request user ID included in the accepted log-in request are met. Means for determining whether or not, and as a result of the determination, one or more determination conditions are met A point accumulating unit for adding or subtracting a plus or minus point associated with the matched determination condition to the accumulated point number of the login request user ID of the holding unit; and an accumulated point of the login request user ID When the number is (1) less than or equal to the first value, the accepted login request is allowed, and when the number is greater than the first value and less than or equal to the second value, the accepted login request is rejected. And
(3) login determination means for rejecting the accepted login request and outputting information indicating that unauthorized access has been received when the value is greater than the second value.

  In a preferred embodiment, the points associated with each of the plurality of determination conditions may be determined according to the high possibility that a login request that matches each determination condition is unauthorized access.

  In a preferred embodiment, one of the plurality of determination conditions is a determination as to whether or not a password included in the accepted login request matches a regular password that allows login. The point accumulation means sets the accumulated point number of the login request user ID to a first value or less when the password included in the received login request matches the regular password. Also good.

  In a preferred embodiment, one of the plurality of determination conditions is whether or not the password included in the accepted login request matches a reset password predetermined for each user ID for resetting the accumulated points. Further, the point accumulating means sets the accumulated point number of the login request user ID to a second value or less when the password included in the accepted login request matches the accumulated point reset password. You may make it do.

  In a preferred embodiment, one or more of the plurality of determination conditions may be a comparison determination condition for comparing the content of a login request rejected in the past with the content of a login request to be determined.

  In a preferred embodiment, the comparison determination condition includes an elapsed time from the reception or rejection time of the login request rejected in the past, or a password included in the login request rejected in the past, and the determination. It may be a comparison regarding the commonality with the password included in the target login request.

  A system for user authentication using a password according to one embodiment of the present invention stores an authentication request including a password input by a user, a means for holding a status regarding whether authentication is accepted, and an unauthorized password. And when the password included in the authentication request received by the receiving means matches the illegal password stored in the storage means, the status is set to authentication rejected, and the status is authentication rejected. In some cases, an authentication unit that always rejects an authentication request received by the receiving unit.

  In a preferred embodiment, the apparatus may further comprise means for providing a screen for the user to register the unauthorized password.

  Hereinafter, a network system for performing user authentication according to an embodiment of the present invention will be described with reference to the drawings. In the present embodiment, a case where user authentication is applied to log-in request permission / rejection determination will be described.

  FIG. 1 shows the overall configuration of a network system according to this embodiment. The system includes an authentication server 1 that performs user authentication, an application server 2 that provides a predetermined service, a monitoring terminal 3 for an administrator that monitors the system, and a plurality of clients 4 that are used by users of the system. Is provided. The authentication server 1 and the application server 2 are connected to the network 9 via an access restriction device 5 such as a firewall.

  When a login request is transmitted from the client 4 to the authentication server 1 via the access restriction device 5, the authentication server 1 determines whether or not to permit login as user authentication. And the access control apparatus 5 permits the access to the application server 2 with respect to the user in whom user authentication was successful and login was permitted. Accordingly, the user can receive a predetermined service provided by the application server 2 via the client 4. On the other hand, in the case of a user who fails user authentication and login is not permitted, access to the application server 2 cannot be performed due to access restriction by the access restriction device 5.

  Further, in the present embodiment, the authentication server 1 detects unauthorized access by a person who is not a legitimate user, for example, an unauthorized access, for example, an attack that attempts to log in, and that the access is unauthorized. An alarm such as notification to the monitoring terminal 3 is output. Hereinafter, a detailed configuration and operation will be described focusing on the authentication server 1 according to the present embodiment.

  FIG. 2 is a diagram showing a detailed configuration of the authentication server 1. The authentication server 1 is configured by a computer system including a network interface unit 11 that performs data input / output with respect to the network 9, a processor 12, and a storage device 15.

  The network interface unit 11 controls transmission / reception of data via the network 9. For example, the network interface unit 11 is configured by predetermined hardware and predetermined software that operates on the hardware, and receives a login request or the like transmitted from the client 4 via the network 9. Further, the network interface unit 11 transmits a result of login determination by a login request determination unit 14 described later to the client 4 via the network 9. Here, the login request 50 includes at least an input ID 51 and an input password 52 as shown in FIG. The input ID 51 is a string of characters, symbols, symbols, numbers, and the like input as a user ID on the login screen 100 as shown in FIG. 3B, and the input password 52 is a character input as a password, A sequence of symbols, signs and numbers.

  When the processor 12 executes a predetermined program, a table registration processing unit 13 and a login request determination unit 14 are realized. The table registration processing unit 13 and the login request determination unit 14 perform processing as described below.

  The storage device 15 stores login management information 16 for each user ID. The login management information 16 includes a rule table 161 relating to rules used for login determination in response to a login request, a password table 162 that stores a plurality of passwords, a counter 163 that stores the cumulative number of points, and a log 165 of login request determination processing. And have. The contents of the rule table 161 and the password table 162 can be registered by each user by a process (described later) executed by the table registration processing unit 13.

  An example of the rule table 161 is shown in FIG. In the rule table 161, as shown in the figure, the judgment condition application order 161a, one or more judgment conditions 161b, and an action 161c indicating processing to be executed when each judgment condition 161b is satisfied are associated with each other. It has been. When the login request determination unit 14 receives the login request 50 transmitted from the client 4 via the network interface unit 11, the login request determination unit 14 determines the determination condition for the rule table 161 corresponding to the input ID 51 included in the login request 50 according to the application order 161 a. 161b is sequentially applied, and an action 161c corresponding to the matching determination condition 161b is executed.

  The determination condition 161 b defines a determination condition for determining the login request 50 transmitted from the client 4. As an example of the determination condition 161b, the input password 52 of the login request 50 and the password registered in the password table 162 are compared, the length of the input password 52 is determined, and the type of the character included in the input password 52 is determined. , Comparison of commonality between the input password 52 and the input password of the previously rejected login request, the time elapsed since the previous rejected login request was rejected or received, and the cumulative number of points and a predetermined threshold And comparisons.

  The action 161c defines a process to be executed by the login request determination unit 14 when the conditions defined in the corresponding determination conditions 161b are met. As an example of the action 161c, it is possible to set addition or subtraction of points to / from the accumulated points accumulated in the counter 163, continuation or termination of condition determination, and the like. The continuation of the condition determination is to continue the determination with respect to the determination condition 161b of the next determination order 161a. The end of the condition determination is to end at that point even if the determination is not performed for all the determination conditions 161b.

  In terms of implementation, the rule table 161 may be stored in the order of application order 161a after each determination condition 161b and action 161c are converted into scripts (rule scripts) indicating the respective contents. In this case, the login request determination unit 14 may acquire necessary parameters such as the input password 52 and execute these rule scripts in the order of application order 161a.

  The counter 163 stores the accumulated number of points accumulated according to the result of the login determination. For example, as described above, the points to be added (plus points) or the number of points to be subtracted (minus points) defined in the action 161c corresponding to the determination condition 161b that matches the login request received in the login determination are accumulated. Accumulated in points. This point is an evaluation value indicating the risk that the login request that matches each determination condition 161b is unauthorized access, and is determined according to the possibility of unauthorized access. For example, a higher positive point is given to the determination condition 161b that is judged to have a high possibility of unauthorized access if they match. Further, a positive low point is given to the determination condition 161b that is determined to be a minor mistake that is likely to be committed even by a regular user. Note that the initial value of the cumulative number of points may be, for example, a login permission threshold described later, or a predetermined value between the login permission threshold and an intermediate threshold described later.

  The login request determination unit 14 determines whether login is permitted based on the accumulated number of points in the counter 163. For example, log-in is permitted when the accumulated point is equal to or less than a predetermined log-in permission threshold, and log-in is denied when the accumulated point is higher. Further, when the accumulated point is equal to or greater than the fraud determination threshold value that is larger than the login permission threshold value, a predetermined output for notifying login and notifying that there is a high possibility of unauthorized access may be performed.

  An example of the password table 162 is shown in FIG. As shown in the figure, the password table 162 includes a regular password 162a, an unauthorized password 162b, a reset password 162c, and a past password 162d as data items. One or more passwords can be set for each password 162a-d.

  The regular password 162a is a regular password that allows login when the input password 52 matches the regular password 162a. For the regular password 162a, for example, a determination condition 1611 is defined that the input password 52 matches one of the regular passwords 162a and the accumulated point number is equal to or less than a predetermined intermediate threshold value. May be defined as an action 1612 for updating the login permission threshold and ending the determination. Here, the intermediate threshold is not less than the login permission threshold and not more than the fraud determination threshold. In this case, when the accumulated point number exceeds the intermediate threshold value, the login request determination unit 14 does not permit login even if the input password 52 matches the regular password. Therefore, when the accumulated point number exceeds the intermediate threshold value, the user needs to input a reset password described later to make the accumulated point number equal to or less than the intermediate threshold value.

  The unauthorized password 162b is a password for detecting unauthorized access. For the illegal password 162b, for example, a determination condition 1613 that the input password 52 matches the illegal password 162b is defined, and in contrast to this, an action of adding a point exceeding the illegal determination threshold to the accumulated point number and ending the determination 1614 may be defined. In this case, when the input password 52 matches the unauthorized password 162b, the login request is regarded as unauthorized access, and thereafter, even when the input password 52 matches the regular password 162a, login is not permitted. In order to allow login, the following accumulated points must be reset.

  The reset password 162c is a password for clearing or setting the accumulated point number held in the counter 163 to a predetermined value equal to or less than the intermediate threshold value. With regard to the reset password 162c, for example, a determination condition 1615 that the input password 52 matches the reset password 162c is defined, and on the other hand, the cumulative point number is updated to a value equal to or less than the intermediate threshold value, and the determination is finished May be defined. As a result, even if the accumulated point number exceeds the fraud determination threshold value, the accumulated point number can be lowered to the intermediate threshold value or less when the reset password is input. As a result, if the login request 50 including the regular password 162a is received next, login is permitted.

  Note that the login request determination unit 14 may notify the user of the client 4 of the cumulative degree of accumulated points. For example, it is possible to display on the screen of the client 4 to directly indicate that the cumulative number of points has increased, or to display indirectly. The indirect display may be, for example, a hidden display according to a rule known to a regular user. That is, a specific symbol or the like is displayed on the login screen 100, the display position of the login screen 100 in the entire display screen is moved to a predetermined position, the login screen 100 is displayed in a specific color, etc. Various possibilities are possible.

  The past password 162d is a password (including a one-time password) used in the past. For example, for the determination condition that the input password 52 matches the past password, an action to end the determination by adding a predetermined point to the cumulative number of points may be defined.

  The log 165 stores the received login request and the determination result for the login request. For example, as illustrated in FIG. 6, the log 165 includes items such as an input password, a result of login determination, and a date and time when a login request is received. Then, the login request determination unit 14 accumulates the determination result for each login request 50 in the log 165. The log 165 is referred to when the information regarding the past rejected login request and the past input password are used in the determination condition 161.

  Note that the above-described login permission threshold, intermediate threshold, and fraud determination threshold may be common to all user IDs or may be different for each user ID. Further, it may be dynamically changed according to the frequency of receiving unauthorized access.

  The login request determination unit 14 performs login determination based on the login management information 16 as described above for the received login request 50. As a result of the login determination, whether the login is permitted or not is transmitted to the client 4 that is the transmission source of the login request 50 via the network interface unit 11. When the accumulated point number of the input ID 51 included in the login request 50 exceeds the fraud determination threshold, an alert indicating that the risk of being attacked by unauthorized access is increasing is sent to the monitoring terminal 3. .

  Further, the login request determination unit 14 may determine whether or not the determination condition 161b is met with reference to the rule table 161 of a user ID different from the input ID 51. In particular, the determination may be made for the determination condition 161b related to password verification. Thereby, it is possible to detect a user who uses a password that matches the input password 52 included in the login request 50. It is generally considered dangerous to use a password used for an attack against another person's user ID. Therefore, such a case may be extracted and a password change recommendation may be individually notified to each user.

  Next, processing for registering the rule table 161 and the password table 162 will be described. When each user is logged in to the present system, the contents of their own rule table 161 and password table 162 can be registered according to the procedure described below.

  In response to a request from the client 4, the table registration processing unit 13 transmits data for displaying the rule registration screen 200 illustrated in FIG. 7A to the client 4 via the network interface unit 11. . The rule registration screen 200 includes a determination condition input area 220 corresponding to the application order 210 and an action input area 230. The determination condition and action input to the determination condition input area 220 and the action input area 230 may be selected from candidates prepared in advance. When the rule registration screen 200 is displayed on the client 4, the user performs predetermined inputs to the determination condition input area 220 and the action input area 230. When the application order 210 is to be changed after the determination condition or action is input to each of the input areas 220 and 230, the user selects the area to be changed and drags and drops it to the desired application order 210. You can also

  As an example of another rule registration screen 250, for example, as shown in FIG. 7B, a rule script that integrally defines determination conditions and actions may be described in the input area 260. In this case, determination conditions and actions can be freely defined by the user freely writing a script.

  Information input to each rule screen 200 and 250 in each client 4 is transmitted to the authentication server 1. In the authentication server 1, the table registration processing unit 13 registers in the rule table 161 of the login management information 16 corresponding to the user ID. At this time, the table registration processing unit 13 may convert the determination condition and action selected on the rule registration screen 200 into a rule script and then register them in the rule table 161.

  Further, the table registration processing unit 13 transmits data for displaying the password registration screen 300 as illustrated in FIG. 8 to the client 4 via the network interface unit 11 in response to a request from the client 4.

  The password registration screen 300 includes areas 310, 320, and 330 for inputting a regular password, an illegal password, and a reset password. A plurality of passwords can be entered in each of the areas 310, 320, and 330. When the password registration screen 300 is displayed on the client 4, the user inputs his / her own password in each area. As the illegal password, for example, it is preferable to set a password that is never used by the user and can be easily guessed by others. For example, when a user decides not to use his / her date of birth or employee number as a password, setting these as his / her unauthorized password increases the possibility of detecting unauthorized access. In other words, even when a user tries several passwords, there is a high possibility that he / she remembers an illegal password set by himself / herself. For this reason, it is considered that there is a low possibility that access by a regular user is determined to be unauthorized. Therefore, when it is detected that an illegal password has been input, it is highly likely that the access is an unauthorized access. At this time, a predetermined action for protecting the system (for example, the user ID) Invalidation, notification to the monitoring terminal, etc.). Furthermore, if the execution of the predetermined action for system defense as described above is established, it is also possible to expect an effect of suppressing the unauthorized access attempt to the system itself.

  Information input to the password registration screen 300 in each client 4 is transmitted to the authentication server 1. In the authentication server 1, the table registration processing unit 13 registers in the password table 162 of the login management information 16 corresponding to the user ID.

  Next, the processing procedure of the login request determination process will be described according to the flowchart shown in FIG.

  The authentication server 1 receives the login request 50 generated based on the user ID and password input by the user on the login screen 100 on the client 4 (S11).

  The login request determination unit 14 refers to the rule table 161 of the login management information 16 corresponding to the input ID 51 included in the received login request 50, and the login request 50 matches the determination condition 161b according to the determination order 161a. Judge whether or not. When the determination condition 161b is met, an action 161c corresponding to the determination condition 161b is executed (S12). At this time, when the addition or subtraction of points is defined in the action 161c, the cumulative point number of the counter 163 is added or subtracted according to the definition. Here, when executing the action 161c, the login request determination unit 14 checks whether or not “end of determination” is included in the action 161c (S13). If the determination end is not included (S13: No), the process returns to step S12, and the determination is further continued according to the determination order 161a. When the determination end is included (S13: Yes), the login request determination unit 14 refers to the counter 163 and checks whether the accumulated point number is equal to or less than the login permission threshold (here, 0) (S14). ). When the accumulated number of points is 0 (S14: Yes), the login request determination unit 14 notifies the client 4 of permission to log in (S20). As a result, a user who is permitted to log in can access the application server 2 and receive provision of a predetermined service.

  If the accumulated point number is not 0 (S14: No), it is checked whether the accumulated point number is equal to or greater than the fraud determination threshold (100 in this case) (S15). When the accumulated number of points is 100 or more (S15: Yes), the login request determination unit 14 notifies the client 4 that login is not permitted and also notifies the monitoring terminal 3 that unauthorized access has been detected. An alert is sent (S30).

  Further, when the accumulated point number is not 100 or more (S15: No), the following determination is performed for the login management information 16 having a user ID different from the input ID 51. That is, one user ID different from the input ID 51 is selected (S16). Then, it is determined whether there is a rule that matches the login request 50 with reference to the rule table 161 of the selected user ID. If there is a matching rule, information indicating that is stored in the log 165 of the login management information 16 of the selected user ID (S17). The processes of steps S16 and S17 are executed for all user IDs (S18), and after the completion, the login request determination unit 14 notifies the client 4 that login is not permitted (S20).

  By the login determination process described above, it is possible to perform login determination according to a rule defined by the user. In addition, as the cumulative number of points increases due to unauthorized access, an increase in the degree of risk can be detected. Furthermore, if the degree of risk increases, even if a regular password is entered, login for that user ID is refused.

  Note that a status indicating whether login is permitted or prohibited may be held instead of the cumulative number of points in the above embodiment. In this case, the initial value of the status is set to “Login Permission”, and when an unauthorized password login request is received, this status is changed to “Login Denied”, and when a reset password login request is received, it is returned to “Login Permission”. To do. When the login request for the regular password is received, the login may be permitted if the status is “login permitted”, and the login may be rejected if the status is “login denied”.

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

  For example, in the above embodiment, the risk of unauthorized access is expressed as a numerical value with the risk as a point, but the present invention is not necessarily limited to this. For example, it may be expressed by a plurality of levels indicating the risk of unauthorized access. In this case, instead of adding or subtracting the accumulated points, the level may be raised or lowered based on an appropriate rule.

  Moreover, although the said embodiment demonstrated the case where it applied to determination of a login request | requirement as an example of user authentication, the user authentication of this invention is not limited to this. For example, the present invention can be applied to general user authentication using a password for identity verification for admission control to a building or the like.

1 is an overall configuration diagram of a network system according to an embodiment of the present invention.

It is a figure which shows the detailed structure of the authentication server 1. FIG.

It is explanatory drawing about a login request | requirement.

It is a figure which shows an example of a rule table.

It is a figure which shows an example of a password table.

It is a figure which shows an example of a log.

It is a figure which shows the example of a rule registration screen.

It is a figure which shows an example of a password registration screen.

It is a flowchart which shows the procedure of a login request determination process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Authentication server, 2 ... Application server, 3 ... Monitoring terminal, 4 ... Client, 13 ... Table registration process part, 14 ... Login request determination part, 15 ... Memory | storage device, 16 ... Login management information, 161 ... Rule table, 162 … Password table.

Claims (4)

A login request determination device that detects unauthorized access,
Means for accepting a login request including a user ID and password entered by the user;
For each of a plurality of user IDs, each user himself / herself defines a plurality of determination conditions for each user ID for determining the login request, and positive or negative points associated with each of the plurality of determination conditions Means for storing
Means for holding a cumulative number of points for each user ID;
Means for referring to the storage means each time the accepting means accepts the log-in request, and determining whether or not the plurality of judgment conditions corresponding to the log-in request user ID included in the accepted log-in request are met;
As a result of the determination, when any one or more determination conditions are met, a plus or minus point associated with the matched determination condition is added to the accumulated point number of the login request user ID of the holding means. Or a point accumulating means to subtract,
When the accumulated point number of the login request user ID is (1) less than or equal to the first value, the accepted login request is permitted,
(2) When the value is greater than the first value and less than or equal to the second value, the accepted login request is rejected,
(3) login determination means for rejecting the accepted login request and outputting information indicating that unauthorized access has been received when greater than the second value ;
One of the plurality of determination conditions is a determination of whether or not the password included in the accepted login request matches a reset password that is predetermined for each user ID in order to reset the accumulated points,
The point accumulating means, when a password included in the accepted log-in request matches the accumulative point reset password, a log-in request determination for setting a cumulative point number of the log-in request user ID to be equal to or less than the second value. apparatus. The login request determination device according to claim 1, wherein the point associated with each of the plurality of determination conditions is determined according to a possibility that a login request that matches each determination condition is unauthorized access. . One of the plurality of determination conditions is a determination as to whether or not a password included in the accepted login request matches a regular password that allows login,
Said point accumulating means, the password contained in the login request received is, when matching the password of the legitimate claim 1 or 2 to set the accumulated number of points of the login request user ID below a first value The login request determination device described in 1. One or more of the plurality of determination conditions include acceptance of a login request rejected in the past or an elapsed time from a rejection time, or a password included in the login request rejected in the past, and the determination target login request determination apparatus according to claim 1 or 2 is a comparison determination condition for comparing the password included in the login request.

Images