JP4683856B2 - Authentication program and authentication server - Google Patents

Description

  The present invention relates to an authentication program and an authentication server, and more particularly to an authentication program and an authentication server for authenticating a user who uses a predetermined service via a terminal device connected to a network.

  2. Description of the Related Art In recent years, the Internet has become widespread, and an unspecified number of computers can connect to a server that provides predetermined information and services via a network and enjoy desired information and services. However, some information and services provided by such servers may be restricted in use.

  Generally, in order to prevent unauthorized use by unauthorized persons, such information and services that have restrictions on use, such as personal information for authentication, such as user ID, when signing in An authentication method is used in which a password is input and access is permitted only when the passwords match. However, with such an authentication method, it is possible to spoof using other person's authentication information, which may cause a security problem.

For this reason, an ID unique to the terminal device is registered in advance in the authentication server, and when there is an access, the ID is acquired from the terminal device, and the personal authentication is performed by collating with the ID registered in advance. An authentication system has been proposed (see, for example, Patent Document 1).
JP 2002-82911 A (paragraph numbers [0007] to [0013], FIG. 1)

  In the conventional authentication method in which personal information for authentication is input and the input personal information is compared with the personal information held by the server, this is justified when the personal information of another person is obtained and accessed illegally. It is difficult to distinguish from access from other users. For this reason, there is a problem that not only unauthorized access is permitted, but also that unauthorized access cannot be detected.

  In addition, even in a method of performing authentication using an ID unique to a terminal device, there is a problem that unauthorized use due to impersonation cannot be prevented if the ID is known to another person. Similarly, there is a problem that when a terminal device is passed to another person due to theft or the like, unauthorized use by another person becomes possible. And once the personal information for authentication including the ID of the terminal device is passed to another person, there is a problem that it cannot be distinguished from a legitimate user and it is difficult to detect the fact of unauthorized access by another person. Furthermore, there is also a problem that access cannot be made unless the terminal device is determined, which inconveniences the user. For example, even if a legitimate user wants to use from another place due to a business trip or the like, it cannot be used unless the ID of the terminal device at that place is registered in the authentication server.

  As described above, in the conventional authentication method, if the input personal information for authentication matches, it cannot be distinguished from a legitimate user. For example, the administrator analyzes the access history to identify the legitimate user. The fact of unauthorized access can only be detected by confirming access, and there is a problem that it is difficult to detect the unauthorized access by others. Even if an unauthorized access is detected, a considerable amount of time has elapsed since the occurrence of the unauthorized access, and it is often impossible to deal with it. As described above, it is difficult to detect unauthorized access, which is a big problem in security management.

  The present invention has been made in view of these points, and an object thereof is to provide an authentication program and an authentication server capable of confirming that unauthorized access is performed based on unauthorizedly acquired personal information for authentication of others. And

In order to solve the above-described problems, the present invention provides an authentication program that causes a computer to authenticate a user who uses a predetermined service via a terminal device connected to a network.

  When an access request is input from the terminal device, the computer acquires a terminal key unique to the terminal device and personal information for user authentication from the terminal device, and authenticates the user using the personal information. To do. Then, based on the personal information of the authenticated user, the key history information registered in association with the personal information acquired together with the past terminal key with the past terminal key acquired when there was an access request in the past. Is searched for the key history information storage means. When key history information corresponding to the authenticated user's personal information is detected, the past terminal key included in this key history information is compared with the terminal key acquired in response to the access request that has just been entered. To do. When the terminal key acquired in response to the input access request does not match the past terminal key included in the detected key history information, it is detected for the terminal device that is the transmission source of the input access request. The access history information related to the terminal device corresponding to the past terminal key registered in the key history information is notified. Then, the terminal key acquired in response to the input access request is registered in the key history information in association with the personal information acquired together with this terminal key, and stored in the key history information storage means.

Moreover, in order to solve the said subject, the authentication server which performs said process sequence is provided.

Thus, according to the disclosed authentication program and authentication server , when there is an access request from a new terminal device not included in the key history information, an access request is made to the terminal device with the same personal information for authentication. Since an access history related to past use terminal devices is provided, there is an advantage that it is possible for a user to easily check whether there has been unauthorized access in the past .

Hereinafter, embodiments of the present invention will be described with reference to the drawings. First, the concept of the invention applied to the embodiment will be described, and then the specific contents of the embodiment will be described.
FIG. 1 is a conceptual diagram of the invention applied to the embodiment of the present invention.

  In the authentication program according to the present invention, the authentication server 1 and the terminal device 2 are connected via a network, and the user of the terminal device 2 is a valid user in response to a request for access to predetermined information or service from the terminal device 2. The present invention is applied to an authentication system that authenticates whether or not there is an authentication server 1. The user makes an access request to the authentication server 1 from the terminal device 2, and can be enjoyed desired information and services after being authenticated by the authentication server 1.

The operation of such an authentication system will be described.
A terminal key creation program for creating a terminal key unique to the terminal device 2 is installed in the terminal device 2 in advance. Then, the key creation process is started at a predetermined timing, such as when the first access is requested (step S11). In the key creation process, for example, a terminal key unique to the terminal device 2 is created based on the device number, date, random number, etc., and stored in the terminal key (storage device) 21. When an access request is made, the terminal key is read from the terminal key (storage device) 21 and transmitted to the authentication server 1 together with the personal information (step S12).

  When the access request from the terminal device 2 is input, the authentication server 1 acquires personal information for user authentication and a terminal key, and performs user authentication processing (step S1). The personal information (storage device) 11 stores authentication personal information such as a user ID and password of the user in advance. In the user authentication process, the personal information acquired from the terminal device 2 and the personal information stored in the personal information (storage device) 11 are collated. Also, the terminal key is checked, such as whether the terminal key has been acquired and whether the terminal key format is correct. In some cases, a terminal key to be authenticated is registered, and if it does not match with the acquired terminal key, it is not authenticated, so that only access from a terminal device having the registered terminal key is permitted. You can also If it is determined by the above check that the user is a valid user, the process proceeds to step S2. If the user is not recognized as a legitimate user, the authentication is disabled (step S8).

  If the user is authenticated, terminal key verification processing is subsequently performed (step S2). In the terminal key verification process, the key history information (storage device) 12 is searched based on the authenticated personal information, and the key history information related to this user is extracted. In the key history information, a past terminal key acquired when an access request is made is registered in association with personal information for a terminal device that has been authenticated so far and has accessed predetermined information or services. The terminal key is uniquely set for each terminal device, and the terminal device can be specified from the terminal key. When the key history information regarding this user is extracted, the terminal key acquired this time is collated with the terminal key registered in the key history information. If the terminal device used in the past and the current terminal device 2 are the same, the terminal keys match, and if they are different, the terminal keys do not match. The past terminal key to be verified is arbitrarily set according to the system. For example, when comparing with the terminal key of the last used terminal device acquired last, or when adding date information related to the acquired date to the key history information and verifying with the terminal key acquired on the current day or a predetermined period, etc. is assumed. As a result of the collation, if the terminal keys do not match, the process proceeds to step S3. If no match or key history information is detected, the process proceeds to step S4.

  If the terminal key verification result does not match, user notification processing is performed (step S3). In the user notification process, based on the key history information, a past access terminal device is notified that there has been an access request from another terminal device. Further, if necessary, access history information related to past used terminal devices that have been accessed is provided to the terminal device that has made an access request this time. The past use terminal device to be provided is arbitrarily set according to the system, as in the case of collation. As a result, the user terminal device that has been authenticated by making an access request in the past is notified that an access request has been received from another terminal device. The user of the user terminal device that has received the notification can confirm that there has been an access request from another terminal device, and can confirm whether or not this access request is illegal. Similarly, if a past use terminal device is provided to the terminal device that made the access request this time, the user who has received the provision can check whether there has been unauthorized access in the past.

  Next, after the terminal key verification process (step S2) does not result in a mismatch, and after the user notification process (step S3) is completed, an access permission process is performed (step S4). In the access permission process, the terminal key acquired this time is associated with the personal information, registered in the key history information, and stored in the key history information (storage device) 12. At this time, date information may be added to the key history information. Then, the user is permitted to access predetermined information or services.

  As described above, according to the present invention, when the terminal key is different using the terminal key unique to the terminal device, that is, when there is an access request from another terminal device, the previously authenticated terminal device is notified. This can be notified to. If the terminal device requested to access this time is unauthorized access, the user of the terminal device that has received the notification can confirm this. In addition, if a terminal device that has made a request for access this time is notified of a terminal device that has been used in the past, it can be confirmed if there has been unauthorized access in the past. Thus, according to the present invention, the fact of unauthorized access can be easily confirmed.

  Furthermore, in user authentication, user authentication is performed using a terminal key unique to the terminal device together with personal information for authentication related to the user, so that the risk of unauthorized access being authenticated can be reduced. The effect is also obtained. Since the contents of the terminal key automatically generated by the terminal device are not known to the user, the risk of leakage to the outside is low.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings, taking as an example a case in which a terminal device having a browser function is applied to a system that accesses a homepage with access restrictions via the Internet. FIG. 2 is a diagram showing a system configuration and an example configuration of an authentication server according to the embodiment of the present invention.

  In the embodiment of the present invention, the authentication server 100 and the terminal devices 200a, 200b, 200c,. Each terminal device 200a, 200b, 200c,... Is installed with a program that creates a unique terminal key and executes a process of transmitting it to the authentication server 100 together with personal information.

  The entire authentication server 100 is controlled by a CPU (Central Processing Unit) 101. A random access memory (RAM) 102, a hard disk drive (HDD) 103, an external interface 104, and a communication interface 105 are connected to the CPU 101 via a bus 106.

  The RAM 102 temporarily stores at least part of an OS (Operating System) program and application programs to be executed by the CPU 101. The RAM 102 stores various data necessary for processing by the CPU 101. The HDD 103 stores the OS and application programs. A database 110 is connected to the external interface 104 and controls reading and writing of information data in accordance with instructions from the CPU 101. The database 110 stores personal information of users, key history information, and the like. The communication interface 105 is connected to the Internet 3 and transmits / receives data to / from a terminal device via the Internet 3.

Next, the terminal device will be described. FIG. 3 is a block diagram illustrating a hardware configuration example of the terminal device according to the present embodiment.
Similar to the authentication server 100, the entire device of the terminal device 200 is controlled by the CPU 201, and a RAM 202, a hard disk drive 203, a graphic processing device 204, an input interface 205, and a communication interface 206 are connected via a bus 207. A monitor 208 is connected to the graphic processing device 204, and an image is displayed on the screen of the monitor 208 in accordance with a command from the CPU 201. A keyboard 209 a and mouse 209 b are connected to the input interface 205, and signals sent from the keyboard 209 a and mouse 209 b are transmitted to the CPU 201 via the bus 207. The other parts are the same as the parts having the same names in the authentication server 100, and the description thereof will be omitted.

With such a hardware configuration, the processing functions of the present embodiment can be realized.
Next, the program configuration of the authentication system according to the present invention will be described. FIG. 4 is a program configuration diagram according to the embodiment of the present invention. The same parts as those in FIG. Each processing means shown in the figure is realized by a computer executing the authentication program of the present invention.

  The authentication server 100 includes a communication unit 111 that performs communication between the terminal device 200a and the terminal device 200b, a user information acquisition unit 112 that acquires personal information about the user and a terminal key, an authentication unit 113 that authenticates the user, A search unit 114 that searches for key history information, a collation unit 115 that collates with a detected past terminal key, a notification unit 116 that notifies that there is an access request from a terminal device that does not match the terminal key, and a key history are set. Each processing means of the key history setting means 117, and storage means for personal information (storage device) 11 and key history information (storage device) 12.

The communication unit 111 controls data exchange with a large number of terminal devices that request the use of a predetermined service via the Internet 3.
When the user information acquisition unit 112 inputs a service use request from the terminal device 200a via the communication unit 111, the user information acquisition unit 112 transmits document data for displaying a display screen for inputting personal information for user authentication to the terminal device 200a. As a response, the personal information, the terminal key, and predetermined items that can be collected by the browser are acquired.

  The authentication unit 113 acquires the personal information for authentication and the terminal key from the user information acquisition unit 112, compares the personal information with the personal information stored in the personal information (storage device) 11, and determines whether or not they match. Authenticate according to For example, when the personal information is a user ID and a password, the personal information (storage device) 11 is searched with the user ID of the acquired personal information, the password of the corresponding user ID is extracted, and collated with the acquired password. If they do not match, authentication is not performed. Subsequently, the terminal key is checked. The terminal key can be acquired, the terminal key format (number of digits, whether a part of the terminal key is a predetermined numerical value, etc.), etc. are checked, and if it is normal, it is recognized as a valid user. Also, a predetermined terminal key, for example, a terminal key acquired first, may be registered in advance, collated with this registered terminal key, and if they do not match, authentication may not be performed. As a result, an access request from other than a predetermined terminal device cannot be accepted. If not authenticated, this is notified to the terminal device 200a via the communication means 111. If authenticated, the personal information is sent to the search means 114.

  The search unit 114 searches the key history information (storage device) 12 based on the personal information acquired from the authentication unit 113. The area for storing the key history information is reserved in advance when registering personal information. In the search process, the key history information area corresponding to the personal information is searched, and the information is stored in the searched key history information area. Determine whether it has been. If key history information is detected, it is sent to the verification means 115. Further, a pointer indicating the calculated key history information storage area is sent to the key history setting means 117.

  The collation means 115 obtains the key history information from the search means 114, and collates the terminal key of the terminal device 200a obtained from the user information acquisition means 114 with the past terminal key stored in the key history information. The terminal key to be collated is the terminal key used at the time of previous access or the terminal key used during the day or during a predetermined range. The terminal key to be verified is arbitrarily set according to the system. If the result of the collation is a mismatch, the collation result is transmitted to the notification means 116.

The notification unit 116 obtains the key history information and the terminal key from the verification unit 115 , and there is an access request from the terminal device specified by the terminal key to the terminal device accessed in the past specified by the key history information. Notify that. The notification is performed by e-mail or the like, for example. On the other hand, the access history information related to the terminal device that has been accessed in the past specified by the key history information is provided to the terminal device that has been requested to access this time specified by the terminal key. The access history information is displayed on the display screen of the terminal device as a usage log, for example.

  The key history setting unit 117 acquires personal information and a terminal key from the user information acquisition unit 112 and registers them as key history information in the key history information storage area indicated by the pointer acquired from the search unit 114. At this time, the current date information and information obtained from the browser are registered together as necessary.

  The terminal device 200a includes a communication unit 211 that performs communication with the authentication server 100, a display control unit 212 that displays a screen based on document data acquired from the authentication server 1, and a user input from a keyboard or the like. Input control means 213 for processing an instruction operation, transmission means 214 for transmitting authentication information to the authentication server 1 and terminal key creation means 215 for creating a terminal key, and storage of a terminal key (storage device) 21 Means. The terminal device 200b has the same configuration.

The communication unit 211 controls data exchange with the authentication server 1 via the Internet 3.
The display control means 212 has a browser function and performs control to display a display screen based on predetermined document data sent from the authentication server 1 on the display device.

  The input control unit 213 interprets a user's operation instruction input from a keyboard, a mouse, or the like according to a predetermined display screen displayed by the display control unit 212, generates predetermined input data, and sends it to the transmission unit 214. .

The transmission unit 214 transmits the access request and the terminal key and personal information stored in the terminal key (storage device) 21 to the authentication server 100 via the communication unit 211.
The terminal key creating means 215 creates a terminal key unique to the terminal device 200 a and stores it in the terminal key (storage device) 21. For example, the terminal key is uniquely set for each terminal device by combining a manufacturing number unique to the terminal device, a date, random numbers, and the like. The terminal key is created only for the first time.

  The operation of the authentication system having such a configuration will be described. In the following description, it is assumed that there has been access to a predetermined service in the past from the terminal device 200b, and this time there has been an access request from the terminal device 200a.

  The user makes an access request to a predetermined service from the terminal device 200a. For example, when the authentication program according to the present invention is installed in the terminal device 200a, a toolbar for starting the authentication processing of the present invention is generated by the authentication program and set to be displayed on the display screen. The user activates the authentication program by operating the toolbar.

  The user access request is notified to the transmission unit 214 by the input control unit 213, and the transmission unit 214 notifies the authentication server 100 of the access request via the communication unit 211. In the authentication server 100, the user information acquisition unit 112 that has input an access request via the communication unit 111 transmits a user sign-in file. The terminal device 200a acquires a sign-in file via the communication unit 211, and displays a display screen based on the file using the display control unit 212.

FIG. 5 is an example of a sign-in screen according to the embodiment of this invention.
The sign-in screen 300 according to the embodiment of the present invention includes a user ID and password input unit 301 and prompts the user to input personal information for authentication. In addition, it is possible to specify whether or not notification of access status is required as the user function definition 302. If a log used by itself (the same user ID) is required, “send usage log” 303 is selected. If not, “send usage log” 304 is selected. After these are set, by operating the sign-in 305, the transmission unit 214 can specify the personal information of the input user ID and password, the terminal key stored in the terminal key 21 and the use log presence / absence specification. Sent to.

  The information transmitted from the terminal device 200a is acquired by the user information acquisition unit 112 of the authentication server 100. The authentication unit 113 performs authentication using the transmitted personal information and the terminal key, and transmits an unapproved file for displaying an unapproved display screen for notifying approval when it is not recognized as a valid user. If authenticated, after the terminal key access status confirmation process and the key history information setting process are completed, an approval file for displaying a screen for notifying the authentication is transmitted to the terminal device 200a.

FIG. 6 is a flowchart showing a procedure of authentication processing in the embodiment of the present invention. In the figure, a processing procedure after the sign-in 305 is operated is shown.
Processing on the terminal device side will be described.

  [Step S201] When the sign-in 305 is operated and an approval request is input, authentication data generation processing for an approval request is started, and a terminal key is searched from the terminal key (storage device) 21.

[Step S202] The presence or absence of a terminal key is determined. If there is a terminal key, the process proceeds to step S204.
[Step S <b> 203] If there is no terminal key, a terminal key is created and stored in the terminal key (storage device) 21.

  [Step S204] The terminal key is read from the terminal key (storage device) 21, and authentication data is generated together with personal information and other information set by the user, transmitted to the authentication server, and an approval request is made.

Through the above processing procedure, the terminal device transmits authentication data including personal information and a terminal key to the authentication server, and transitions to a waiting state for an authentication result from the authentication server.
Next, processing on the authentication server side will be described.

[Step S101] Acquire authentication data including personal information and a terminal key, and other information, together with an approval request, from the terminal device.
[Step S102] An authentication process for determining whether or not the user is a valid user is performed based on the personal information and the terminal key. The authentication is performed by comparing the acquired personal information with previously held personal information and checking the terminal key.

  [Step S103] It is determined whether or not the user has confirmed (whether or not information that matches the personal information held can be detected). When the user cannot confirm, information data for displaying an unapproved screen for notifying unapproved is transmitted to the terminal device.

  [Step S104] If the user can confirm, the key history information is searched, and an access status confirmation process based on the key history information is performed. Note that if the usage log is not required to be transmitted, no processing is performed. Details of the access status confirmation processing will be described later.

[Step S105] The terminal key acquired this time is registered in the key history information, and information data for displaying an approval screen notifying that the user has been authenticated is transmitted to the terminal device.
Through the above processing procedure, the authentication server performs user authentication using the transmitted personal information and terminal key, notifies the access status as necessary, and returns an authentication result to the terminal device.

Processing on the terminal device side will be described. On the terminal device side, the authentication result is received and a screen corresponding to the authentication result is displayed on the display device.
[Step S205] If the authentication server receives information data for displaying an unapproved screen without being authenticated, the unapproved screen is displayed on the display device based on the information data, and the authentication process is terminated.

  [Step S206] When information data that is authenticated by the authentication server and displays the approval screen is received, the approval screen is displayed on the display device based on the information data, and the authentication processing is terminated. Thereafter, a predetermined service is started.

  By executing the above processing procedure, the user of the terminal device is authenticated, and if the authentication is not performed, an unapproved screen display is displayed. When authenticated, an approval screen display is displayed, and a desired service or data can be accessed. In addition, when authenticated, information data for confirming access status is provided to users who used this time and past users as necessary, and current and past information accessed using specified personal information. The user can check the status of access using this personal information.

  Next, access status confirmation processing by the authentication server will be described. Hereinafter, the case of the access status confirmation process for the day of access will be described. FIG. 7 is a flowchart illustrating a procedure of access status confirmation processing according to the embodiment of this invention.

The access status confirmation using the key history information is started for a user who has been authenticated and confirmed to be valid.
[Step S110] Based on the personal information, the key history information of the corresponding user is searched. In the key history information, information including the terminal key of the terminal device permitted to be accessed and the date of access is registered in association with the personal information. The area where the key history information is stored is calculated.

  [Step S111] It is determined whether key history information is stored in the key history information area calculated in step S110, that is, whether an approval request has been made so far. If a previous approval request is detected, the process proceeds to step S112. If not detected, the process proceeds to step S117.

  [Step S112] The terminal key of the terminal device for which the previous approval request has been stored stored in the key history information is collated with the terminal key acquired this time to confirm the terminal key. If they match, it is determined that the request is from the same terminal device, and the process proceeds to step S118. If they do not match, it is determined as an approval request from a different terminal device, and the process proceeds to step S113.

  [Step S113] When the terminal keys do not match, it is checked when the access request of the terminal device for which the previous approval request has been issued. In the example of the figure, it is checked whether or not the registered date (date of access) is today. If it is today, the process proceeds to step S114. If not, the process proceeds to step S116.

  [Step S114] When an access request from a terminal device whose terminal key does not match is received from another terminal device on the same day, user information relating to the user registered at the present time is provided to the terminal device and displayed. That is, a list of other terminal devices requested for access today is displayed on the terminal device requested for access this time. Thereby, the user of the terminal device that has made an access request this time can check the terminal device that has made the access request today. If there is an unauthorized access, it can be easily detected. In addition, when the setting not requiring the usage log is made, this information is not transmitted to the terminal device.

[Step S115] Subsequently, when there is an access request from another terminal device on the same day from a terminal device whose terminal key does not match, the terminal device whose terminal key does not match the other terminal device currently registered Notify that there was an access request. The notification is transmitted by e-mail or the like, for example. Users of other terminal devices can check the access status from other terminal devices.

  [Step S116] When the access request from the terminal device whose terminal key does not match is not today, information data for causing the terminal device to display the previous user status regarding the user of the previous approval request is transmitted. The terminal device displays the previous access status on the display device based on this information data.

[Step S117] Since the confirmation process of the access status is completed, the terminal key that has made the approval request this time is registered as the login terminal key.
[Step S118] Date information relating to today's date is set.

[Step S119] The login terminal key and today's date information are registered in the key history information and stored in the key history (storage device) 12.
By executing the above processing procedure, the terminal device that made the access request this time is provided with information about the terminal device that made the previous access request, or information about other terminal devices that made the access request today, Displayed on the display screen. Thereby, the user of this terminal apparatus can confirm the access status of the other terminal apparatus accessed with the same user ID today.

  In addition, information regarding the terminal device that has made the access request this time is transmitted to other terminal devices that have accessed today. Thereby, the user of another terminal device can confirm the access status to another terminal device accessed with the same user ID.

  In this way, the access status is notified to both the terminal device that has accessed this time and the terminal device that has accessed so far, and the access status can be confirmed by both. Thereby, users of both terminal devices can easily confirm whether or not unauthorized access has been performed.

  In the above description, the access status of the current day is notified. However, if the range to be checked is expanded in the process of step S113, the access status of the past predetermined period including the current date can be checked.

Here, an example of a display screen that provides each access status is shown.
FIG. 8 is an example of an access status confirmation screen of another terminal device according to the embodiment of the present invention. This screen is displayed based on the information generated in step S114, and provides the user with information regarding the terminal device that requested access today using the same user ID.

  The access status confirmation screen 800 presents information related to the terminal device requested to access using the same user ID as the user ID specified this time, together with the warning mark 801. In the example shown in the figure, the IP address 802 and the browser name 803 of the terminal device that made the access request are displayed on the screen. As a result, the user can check the access status using the same user ID, and can check whether the access request made is legitimate by the IP address 802 or the like.

  FIG. 9 is an example of the previous user status confirmation screen according to the embodiment of the present invention. This screen is displayed based on the information generated in step S116, and informs the user about the terminal device that made the previous access request using the same user ID (different from the terminal device that made the current access). provide.

  In the previous user status confirmation screen 900, the previous sign-in date and time 902 and the previous use IP address 903 are displayed on the screen as the usage record 901. Thereby, the user can confirm the last access situation using the same user ID.

  Furthermore, if the access status is confirmed by the above processing procedure and it is confirmed that an unauthorized access is made using the same user ID from another terminal device that is not recognized, access from the other terminal device is forced. Can also be prohibited.

  FIG. 10 is an example of a forced sign-out screen according to the embodiment of this invention. For example, this screen is activated from the access status confirmation screen shown in FIG. A user who has confirmed access from another terminal device in FIG. 8 opens a forced sign-out screen 1000 by performing a predetermined operation. When the access from other terminal devices is forcibly stopped, the forced sign-out selection button 1001 is operated.

This makes it possible to eliminate unauthorized access.
The above processing functions can be realized by a server computer and a client computer. In that case, a server program describing the processing content of the function that the authentication server should have and a client program describing the processing content of the function that the terminal device should have are provided. By executing the server program on the server computer, the processing function of the authentication server is realized on the server computer. Further, the processing function of the terminal device is realized on the client computer by executing the client program on the client computer.

  The server program and client program describing the processing contents can be recorded on a computer-readable recording medium. Examples of the computer-readable recording medium include a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory. Examples of the magnetic recording device include a hard disk device (HDD), a flexible disk (FD), and a magnetic tape. Optical disks include DVD (Digital Versatile Disc), DVD-RAM, CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), and the like. Magneto-optical recording media include MO (Magneto-Optical disk).

  When distributing server programs and client programs, for example, portable recording media such as DVDs and CD-ROMs on which the programs are recorded are sold. It is also possible to store the client program in a storage device of the server computer and transfer the client program from the server computer to the client computer via a network.

  The server computer that executes the server program stores, for example, the server program recorded on the portable recording medium in its own storage device. Then, the server computer reads the server program from its own storage device and executes processing according to the server program. The server computer can also read the server program directly from the portable recording medium and execute processing according to the server program.

  The client computer that executes the client program stores, for example, the client program recorded on the portable recording medium or the client program transferred from the server computer in its own storage device. Then, the client computer reads the client program from its own storage device and executes processing according to the client program. The client computer can also read the client program directly from the portable recording medium and execute processing according to the client program. Further, each time the client program is transferred from the server computer, the client computer can sequentially execute processing according to the received client program.

(Supplementary note 1) In an authentication program for authenticating a user who uses a predetermined service via a terminal device connected to a network,
On the computer,
At the time of an access request from the terminal device, a terminal key unique to the terminal device created by the terminal device is acquired together with personal information for authentication of the user to authenticate the user,
When the user is authenticated, based on the personal information, key history information in which a past terminal key acquired when the user requested access in the past is registered in association with the personal information is stored. Search the key history information storage means,
When the key history information about the user is detected, the past terminal key included in the key history information is compared with the terminal key acquired this time,
If they do not match, the past use terminal device corresponding to the detected past terminal key is notified that an access request based on the personal information has been made,
The terminal key acquired this time is registered in the key history information and stored in the key history information storage means.
An authentication program characterized by causing a procedure to be executed.

(Supplementary Note 2) In the procedure of collating the past terminal key included in the key history information with the terminal key acquired this time,
The computer according to claim 1, wherein the computer is caused to execute a process of checking a previous terminal key when the access request was last made by the user included in the key history information and the terminal key acquired this time. Certification program.

(Supplementary Note 3) In a procedure for notifying that there is an access request based on the personal information from the terminal device whose terminal key does not match,
The computer according to claim 1, wherein the terminal device that has made the access request this time is caused to execute a process of providing access history information related to the past user terminal device registered in the key history information. Authentication program.

(Additional remark 4) In the procedure which registers the said key log | history information, the said computer is made to perform the process which stores the date information with the said access request | requirement with the said terminal key,
In the procedure for notifying that there has been an access request based on the personal information from the terminal device that does not match the terminal key, the terminal key matching process is performed only for the key history information whose date information is the current day. The authentication program according to appendix 1, wherein the authentication program is executed.

(Supplementary Note 5) In a procedure for notifying that there is an access request based on the personal information from the terminal device whose terminal key does not match,
The supplementary note 4, wherein the computer is caused to execute a process of notifying an access request by the terminal device only to the past use terminal device whose date information of the key history information is the current day. Authentication program.

(Supplementary Note 6) In a procedure for notifying that there is an access request based on the personal information from the terminal device whose terminal key does not match,
5. The authentication program according to claim 4, wherein the computer causes the terminal device that has made the access request this time to execute a process of notifying the user terminal device that the date information of the key history information is the current day. .

  (Supplementary Note 7) In the procedure for notifying that there is an access request based on the personal information from the terminal device whose terminal key does not match, the computer detects that the date information of the key history information is the current day. 5. The authentication program according to appendix 4, characterized in that if it does not exist, a process notified by the user terminal device at the time of the previous access request is executed.

(Supplementary Note 8) In the procedure of notifying that there is an access request based on the personal information from the terminal device whose terminal key does not match,
Notifying the computer that there was an access request based on the personal information, and inquiring whether or not to permit access of the terminal device that made the access request,
The authentication program according to appendix 1, wherein when an access denial of the terminal device is input, a process of denying the access of the terminal device is executed.

(Supplementary Note 9) The computer stores in advance the terminal key of the predetermined terminal device in association with the user as a registered terminal key,
Note that in the procedure of authenticating the user, the computer collates the terminal key acquired this time with the registered terminal key, and executes a process of authenticating the user only when they match. 1. The authentication program according to 1.

(Supplementary Note 10) In an authentication program for connecting to an authentication server for authenticating a user who uses a predetermined service via a network and authenticating the user,
On the computer,
When a request to start using the predetermined service by the user is input, a terminal key storage unit that stores a terminal key unique to the terminal device is searched,
If the terminal key is detected, the terminal key is sent to the authentication server with personal information for authentication related to the user,
If the terminal key is not detected, the terminal key is created and stored in the terminal key storage means, and a procedure for transmitting the terminal key and the personal information to the authentication server is executed. An authentication program.

(Additional remark 11) In the authentication server which authenticates the user who uses a predetermined service via the terminal device connected to a network,
Personal information storage means for storing personal information for authentication related to the user;
Key history information storage means for storing key history information in which a terminal key unique to the terminal device created by the terminal device acquired from the terminal device is registered in association with the personal information;
Authentication means for acquiring the personal information and the terminal key from the terminal device, and authenticating the user by comparing the personal information with the personal information stored in the personal information storage means;
Search means for searching the key history information stored in the key history information storage means based on the personal information;
When the key history information related to the user is detected by the search means, collation means for collating a past terminal key included in the key history information with the terminal key acquired this time,
When a mismatch between the past terminal key and the terminal key is detected by the verification unit,
Notifying means for notifying that there has been an access request based on the personal information to a past user terminal device corresponding to the past terminal key;
Key history setting means for registering the terminal key in the key history information and storing it in the key history information storage means;
An authentication server comprising:

(Supplementary note 12) In a terminal device connected via a network to an authentication server for authenticating a user who uses a predetermined service,
Terminal key storage means for storing a terminal key unique to the terminal device;
When a request to start using the predetermined service by the user is input, it is determined whether or not the terminal key is stored in the terminal key storage means. If the terminal key is not stored, the terminal key is created, and the terminal Terminal key creation means for storing in the key storage means;
Transmitting means for transmitting the terminal key to the authentication server together with personal information for authentication related to the user acquired from the user;
A terminal device comprising:

It is a conceptual diagram of the invention applied to embodiment of this invention. It is the figure which showed the system configuration | structure of embodiment of this invention, and the example of a structure of the authentication server. It is a block diagram which shows the hardware structural example of the terminal device of this Embodiment. It is a program block diagram of embodiment of this invention. It is an example of the sign-in screen of embodiment of this invention. It is the flowchart which showed the procedure of the authentication process in embodiment of this invention. It is the flowchart which showed the procedure of the access condition confirmation process of embodiment of this invention. It is an example of the access condition confirmation screen of the other terminal device of embodiment of this invention. It is an example of the last user status confirmation screen of an embodiment of the invention. It is an example of the forced sign-out screen of the embodiment of the present invention.

Explanation of symbols

1, 100 Authentication server 2, 200, 200a, 200b, 200c Terminal device 11 Personal information (storage device)
12 Key history information (storage device)
21 Terminal key (storage device)
DESCRIPTION OF SYMBOLS 111 Communication means 112 User information acquisition means 113 Authentication means 114 Search means 115 Verification means 116 Notification means 117 Key history setting means 211 Communication means 212 Display control means 213 Input control means 214 Transmission means 215 Terminal key creation means

Claims (4)

In an authentication program for authenticating a user who uses a predetermined service via a terminal device connected to a network,
On the computer,
When an access request is input from the terminal device, a terminal key unique to the terminal device and personal information for user authentication are acquired from the terminal device, and the user is authenticated using the personal information. ,
Based on the personal information of the authenticated user, stored is key history information registered in association with the personal information acquired together with the past terminal key acquired in the past when there was an access request. The key history information storage means to be searched,
When key history information corresponding to the personal information of the authenticated user is detected, a past terminal key included in the key history information and a terminal key acquired in response to the input access request are obtained. Match
When the terminal key acquired in response to the input access request does not match the past terminal key included in the detected key history information, for the terminal device that is the transmission source of the input access request, Notifying access history information related to the terminal device corresponding to the past terminal key registered in the detected key history information,
The terminal key acquired in response to the input access request is registered in the key history information in association with the personal information acquired together with the terminal key, and stored in the key history information storage unit.
An authentication program characterized by causing a procedure to be executed. When registering the terminal key acquired in response to the input access request in the key history information, the personal information acquired together with the terminal key together with the terminal key date information regarding the date on which the input access request was made Storing it in the key history information in association with the information,
The verification with the terminal key acquired in response to the input access request is performed only for the past terminal key registered in the key history information where the date information is the current day,
The authentication program according to claim 1. If the terminal device that has notified the access history information is instructed to prohibit access to the terminal device corresponding to the terminal key registered in the access history information, the access to the terminal device is prohibited.
The authentication program according to claim 1.   In an authentication server that authenticates a user who uses a predetermined service via a terminal device connected to a network,
  When an access request is input from the terminal device, a terminal key unique to the terminal device and personal information for user authentication are acquired from the terminal device, and the user is authenticated using the personal information. Authentication means;
  Based on the personal information of the authenticated user, stored is key history information registered in association with the personal information acquired together with the past terminal key acquired in the past when there was an access request. Search means for searching the key history information storage means to be performed;
  When key history information corresponding to the personal information of the authenticated user is detected, a past terminal key included in the key history information and a terminal key acquired in response to the input access request are obtained. Matching means for matching;
  When the terminal key acquired in response to the input access request does not match the past terminal key included in the detected key history information, for the terminal device that is the transmission source of the input access request, Notification means for notifying access history information related to a terminal device corresponding to a past terminal key registered in the detected key history information;
  A key history setting means for registering the terminal key acquired in response to the input access request in the key history information in association with the personal information acquired together with the terminal key, and storing the key history information in the key history information storage means;
  An authentication server comprising:

Images