JP4755866B2 - Authentication system, authentication server, authentication method, and authentication program - Google Patents

Description

  The present invention relates to an authentication technique for authenticating a user's validity using a one-time password.

In recent years, identity theft of user IDs and passwords on the Internet, represented by phishing scams, has become a problem. For this reason, there is a need for a technique that ensures higher security and authenticates the validity of the user. For example, Patent Literature 1 describes a password authentication system that performs user authentication using a one-time password.
JP 2004-240637 A

  In the password authentication system described in Patent Document 1, the mobile phone performs user authentication using a one-time password acquired from an authentication server. However, in Patent Document 1, the mobile phone specifies a user ID and requests a one-time password from the authentication server. Then, the authentication server transmits a one-time password for the user ID to the requesting mobile phone. That is, when the user ID is leaked, it is synonymous with the leak of the one-time password at the same time.

  Therefore, a malicious third party can acquire a one-time password by sending the user ID to the authentication server as long as the user ID can be acquired. Accordingly, there is a possibility that a malicious third party logs in, for example, an online account and performs an unauthorized operation using the user ID and the one-time password that are illegally acquired.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a user authentication technique that reduces the risk of both a user ID and a password leaking at the same time and ensures higher security.

  In order to solve the above problem, the present invention is an authentication system having, for example, an authentication server and a business server, and the authentication server includes a first user ID for identifying a user in the authentication system, and , Receiving a user attribute table in which the second user ID for identifying the user in the business server is associated with the one-time password, and a password request including the mobile phone ID from the mobile phone, and receiving the received mobile phone Receiving means for specifying the first user ID corresponding to the telephone ID; and password generating means for generating a one-time password for the specified first user ID and storing the generated one-time password in the user attribute table; A password transmitting means for transmitting the generated one-time password to the mobile phone; Receiving the user ID and the one-time password, determining whether the received one-time password matches the one-time password of the second user ID stored in the user attribute table; Authenticating means for transmitting an authentication success message to the business server when they match. The business server receives a login request including the second user ID and the one-time password from the terminal, and receives a login acceptance unit that transmits the login request to the authentication server, and the authentication success message from the authentication server. And a login processing means for permitting the login request.

  In the present invention, it is possible to reduce the risk of leakage of the user ID and password, and to ensure higher security.

  Embodiments of the present invention will be described below.

  FIG. 1 is an overall configuration diagram of an authentication system to which an embodiment of the present invention is applied. The illustrated authentication system includes a mobile phone 1 carried by a user, a terminal 2 such as a PC (Personal Computer), an authentication server 3, and at least one business server 4. The mobile phone 1 is connected to the authentication server 3 via a predetermined base station 5 and network 6 according to the position of the mobile phone 1. The terminal 2 and the business server 4 are connected via the network 6. The authentication server 3 and the business server 4 are connected via a network 6 or a dedicated line (not shown).

  The user of this authentication system is a user who can use a system (service) provided by at least one business server 4, and a unique user ID (first user ID) is preset in the authentication system. It shall be. In addition, it is assumed that the user has registered in advance in the system of the predetermined business server 4 and has acquired a membership number (second user ID) for identifying the user in the system.

  The user always carries the mobile phone 1 and uses the mobile phone 1 to obtain a one-time password from the authentication server 3. Then, the user logs in to the system of the desired business server 4 using the terminal 2 and uses the system (service). Note that when logging into the system of the business server 4, the user inputs the one-time password acquired using the mobile phone 1 into the terminal 2.

  The mobile phone 1 includes an instruction receiving unit 11 that receives a user instruction, a location information acquisition unit 12 that acquires location information of the mobile phone 1, a password request unit 13 that requests a one-time password from the authentication server 3, and an authentication server And a display unit 14 for displaying the one-time password acquired from 3.

  In the present embodiment, the cell ID of the base station 5 is used as the position information. That is, the location information acquisition unit 12 acquires the cell ID of the base station 5 from the base station 5 with which the mobile phone 1 can communicate, and uses it as location information of the mobile phone 1 (that is, a legitimate user). . The cell ID is identification information for identifying a cover area (cell) covered by each base station 5.

  When the mobile phone 1 has a GPS (Global Positioning System) reception function, the position information acquisition unit 12 may use a GPS signal received from the GPS as position information. The mobile phone 1 has a general call function (not shown).

  The terminal 2 receives a user instruction, logs in to a desired business server 4, and uses a system provided by the server 4. The illustrated terminal 2 includes an instruction receiving unit 21 that receives various instructions from the user, and a display unit 22 that displays various types of information on the output device.

  The authentication server 3 receives the request from the mobile phone 1 and generates a one-time password. The authentication server 3 authenticates the validity of the login request received by the business server 4. As illustrated, the authentication server 3 includes a reception unit 31, a password generation unit 32, a password transmission unit 33, an authentication unit 34, a mobile phone table 35, a user attribute table 36, a location history table 37, Have

  The receiver 31 receives a one-time password generation request from the mobile phone 1. The password generation unit 32 generates a one-time password. The password transmission unit 33 transmits the one-time password generated by the password generation unit 32 to the requesting mobile phone 1. The authentication unit 34 refers to the various tables 35 to 37 and authenticates the validity of the login request received by the business server 4.

  The mobile phone table 35 is a table in which a user is associated with the mobile phone 1 owned (carried) by the user. The user attribute table 36 is a table in which a system ID and a membership number registered by the user are set in advance for each user. In the user attribute table 36, the one-time password generated by the password generation unit 32 is stored by a process described later. The mobile phone table 35 and the user attribute table 36 will be described later.

  The location history table 37 stores a history of location information of the mobile phone 1 when login is successful. The position history table 37 is assumed to store a history of position information for each user.

  The business server 4 has systems such as online banking and online shopping, and provides various services to the terminal 2. The business server 4 includes a login reception unit 41, a login processing unit 42, a business processing unit 43, and a member table 44. The login reception unit 41 receives a login request from the terminal 2. The login processing unit 42 permits or rejects the login of the terminal 2 according to the authentication result of the authentication server 3. The business processing unit 43 performs business processing such as online banking and online shopping.

  Next, the mobile phone table 35 and the user attribute table 36 of the authentication server 3 will be described.

  FIG. 2 is a diagram showing an example of the mobile phone table 35. The illustrated mobile phone table 35 includes a user ID 351, a mobile phone ID 352, and a mobile phone number 353. The user ID 351 is identification information for identifying each user in this authentication system. As the mobile phone ID 352, the machine number of the mobile phone 1 (or the phone number of the mobile phone) is used. When one user owns a plurality of mobile phones 1, a plurality of mobile phone IDs 352 and mobile phone numbers 353 are registered for one user ID 351.

  FIG. 3 is a diagram showing an example of the user attribute table 36. The illustrated user attribute table 36 includes a user ID 361, a system ID 362, a membership number 363, a one-time password 364, a one-time password expiration date 365, and position information 366. The system ID 362 is identification information for identifying a system provided by each business server 4. The member number 363 is user identification information unique to each system. For example, an account number or a credit card number may be used.

  Note that the user ID 361, the system ID 362, and the member number 363 are registered in the user attribute table 36 in advance. Further, the one-time password 364, the expiration date 365, and the position information 366 are set by the password generation unit 32 in the user attribute table 36 when the one-time password is generated.

  The mobile phone 1, terminal 2, authentication server 3, and business server 4 described above all include, for example, a CPU 901, a memory 902, an external storage device 903 such as an HDD, a keyboard, a mouse, and the like as shown in FIG. A general-purpose computer system including an input device 904, an output device 905 such as a display or a printer, and a communication control device 906 for connecting to a network can be used. In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of each device.

  For example, the functions of the mobile phone 1, the terminal 2, the authentication server 3, and the business server 4 are performed by the CPU 901 of the mobile phone 1 in the case of the program for the mobile phone 1, and the CPU 901 of the terminal 2 in the case of the program for the terminal 2. In the case of the program for the authentication server 3, the CPU 901 of the authentication server 3 executes the program. In the case of the program for the business server 4, the CPU 901 of the business server 4 executes the program. Note that the memory 902 or the external storage device 903 of the authentication server 3 is used for the mobile phone table 35, the user attribute table 36, and the location history table 37 of the authentication server 3. Further, it is assumed that the memory 902 or the external storage device 903 of the business server 4 is used for the member table 44 of the business server 4. In addition, regarding the input device 904 and the output device 905, each device is provided as necessary.

  Next, the one-time password acquisition process will be described.

  FIG. 5 is a flowchart of the one-time password acquisition process. First, the instruction receiving unit 11 of the mobile phone 1 receives a password request instruction input by the user (S11). That is, the user designates the system ID of the business server 4 at the login destination and inputs a password request instruction using an input device such as an operation button.

  Then, the location information acquisition unit 12 acquires location information (cell ID) of the base station 5 from the communicable base station 5 (S12). Then, the password request unit 13 sends a password request message including the system ID received by the instruction receiving unit 11, the location information acquired by the location information acquisition unit 12, and the mobile phone ID of the mobile phone to the base station 5. (S13). It is assumed that the mobile phone ID is stored in the memory of the mobile phone 1 or an external storage device.

  Then, the receiving unit 31 of the authentication server 3 receives the password request message from the mobile phone 1. Then, the receiving unit 31 refers to the mobile phone table 35 and specifies the user ID corresponding to the mobile phone ID of the password request message (S14).

  Then, the password generation unit 32 refers to the user attribute table 36 and determines whether or not the system ID of the password request message exists in any record of the specified user ID (S15). When the system ID exists (S15: YES), the password generation unit 32 generates a one-time password by a predetermined algorithm (S16). The password generation unit 32 generates a one-time password, for example, using the time stamp of the password request message and the mobile phone ID included in the password request message as the “seed” of the authentication character string.

  And the password production | generation part 32 memorize | stores the produced | generated one-time password, an expiration date, and the received position information in the corresponding record (The record of the identified user ID and the received system ID) of the user attribute table 36. FIG. Note that the password generation unit 32 sets the time at which a predetermined time (for example, 1 minute) has elapsed from the time at which the one-time password is generated, in the user attribute table 36 as the expiration date.

  Then, the password transmission unit 33 transmits the generated one-time password to the mobile phone 1 through a communication path different from the communication path (session) from which the mobile phone 1 has transmitted the password request message (S17).

  In the present embodiment, the password transmission unit 33 transmits a one-time password using a short message service (SMS). The short message service is a service for transmitting a short text message to a mobile phone. The password transmission unit 33 refers to the mobile phone table 35 and identifies the mobile phone number of the requesting mobile phone. Then, the password transmission unit 33 transmits the password generated with the specified mobile phone number as the destination.

  Even if an unauthorized third party requests a one-time password by impersonation by transmitting a one-time password through a communication path different from the communication path accessed from the mobile phone 1 to the authentication server 3, A one-time password can be transmitted to the mobile phone 1. That is, leakage of the one-time password can be prevented.

  The mobile phone ID included in the password request message is different from the member number used when logging in to the business server 4 from the terminal 2. Therefore, even if both the one-time password and the mobile phone ID are leaked, it is not possible to log in to the business server 4 using the one-time password and the mobile phone ID. Therefore, in this authentication system, unauthorized login by a third party can be rejected, and higher security can be ensured.

  Note that the password transmission unit 33 may transmit the one-time password to the mobile phone 1 using electronic mail. In this case, it is assumed that the mail address of the mobile phone 1 is stored in the mobile phone table 35 instead of the mobile phone number 353.

  On the other hand, when the system ID does not exist (S15: NO), the password transmission unit 33 transmits an error message to the mobile phone 1 (S18). The password transmission unit 33 may transmit the error message using either the same communication path as the communication path from which the mobile phone 1 transmits the password request message or a different communication path (short message service or the like).

  The display unit 14 of the mobile phone 1 receives the one-time password or error message from the authentication server 3 and displays it on the display device (S19). When the one-time password is received, the user uses the one-time password displayed on the mobile phone 1 to perform a login process described below.

  Next, an authentication process when the terminal 2 logs in to the business server 4 will be described.

  FIG. 6 is a flowchart of authentication processing at the time of login. In FIG. 6, the processing of the business server 4 and the authentication server 3 is mainly described.

  First, the user uses the terminal 2 to access the business server 4 of the system that has acquired the one-time password, and displays a login screen of the system on the output device of the terminal 2. Then, the user inputs the membership number of the system, a general password, and a one-time password on the login screen.

  The membership number and the general password are for authenticating the user's validity within the system. The one-time password is a password acquired by the mobile phone 1 from the authentication server 3.

  And the instruction | indication reception part 21 of the terminal 2 receives the membership number, the general password, and the one-time password which the user input. Then, the instruction reception unit 21 transmits a login message including the received member number and the like to the business server 4.

  And the login reception part 41 of the business server 4 receives a login message from the terminal 2 (S31). Then, the login reception unit 41 authenticates the membership number and general password of the login message (S32). That is, the login reception unit 41 determines whether or not the received member number and general password exist in the member table 44.

  When the authentication is successful, that is, when it exists in the member table 44 (S32: YES), the login receiving unit 41 transmits the member number and the one-time password included in the login message, and the system ID to the authentication server 3. (S33).

  Note that the business server 4 stores the system ID in a memory or an external storage device. Further, when the business server 4 communicates with the authentication server 3, a mutual authentication process such as an electronic signature is performed in order to prevent spoofing.

  The authentication unit 34 of the authentication server 3 receives the membership number, the one-time password, and the system ID from the business server 4. Then, the authentication unit 34 refers to the user attribute table 36 and specifies the corresponding user ID, one-time password, expiration date, and location information using the received membership number and system ID as keys (S34).

  Then, the authentication unit 34 determines whether or not the received one-time password matches the one-time password stored in the user attribute table 36. Further, the authentication unit 34 acquires the current time from a timer mechanism (not shown) of the authentication server 3 and determines whether the acquired current time has passed the expiration date stored in the user attribute table 36. (S35).

  When the one-time passwords match and are within the expiration date (S35: YES), the authentication unit 34 refers to the position history table 37, and stores the position information (when the password request message is transmitted) stored in the user attribute table 36. It is determined whether or not (position information) is a normal pattern (S36). That is, the authentication unit 34 extracts past position information of the identified user ID from the position history table 37. And it is discriminate | determined whether the positional information memorize | stored in the user attribute table 36 is contained in the user's behavior pattern (behavior range) estimated from the extracted past positional information. Note that the order of the processes in S35 and S36 is not limited to this, and the process in S35 may be performed after the process in S36.

  For example, when the position information stored in the user attribute table 36 is new position information that does not exist in the past position information, the authentication unit 34 determines that the position information is an abnormal value other than a normal pattern. It is possible.

  The authentication unit 34 plots past position information on the map data. When the position information stored in the user attribute table 36 is a position that is a predetermined distance or more away from any of the plotted positions, the authentication unit 34 sets the position information to an abnormal value other than a normal pattern. It can be discriminated.

  When it is determined that the position information is a normal pattern (S36: YES), the authentication unit 34 authenticates that the login request is from a valid user. Therefore, the authentication unit 34 transmits an OK message indicating that the authentication is successful to the business server 4 (S37). Then, the authentication unit 34 adds the position information stored in the user ID and user attribute table 36 to the position history table 37.

  On the other hand, if the one-time passwords do not match, or if the current time has expired (S35: NO), the authentication unit 34 determines that the login request is from an unauthorized third party. Therefore, the authentication unit 34 transmits an NG message indicating that the authentication has failed to the business server 4 (S38). If the position information is determined to be an abnormal value (S36: NO), the authentication unit 34 determines that the request is a login request from an unauthorized third party, and transmits an NG message to the business server 4 (S38). ).

  When the login processing unit 42 of the business server 4 receives the OK message from the authentication server 3, the login processing unit 42 permits the login from the terminal 2 and transmits a login completion screen to the terminal 2 (S39). Note that, for example, a menu of various services provided by the business processing unit 43 is displayed on the login completion screen.

  On the other hand, when receiving the NG message from the authentication server 3, the login processing unit 42 transmits a login error message indicating that the login has failed to the terminal 2 (S40). Further, when the authentication of the membership number and the general password fails (S32: NO), the login processing unit 42 transmits a login error message to the terminal 2 (S40).

  Then, the display unit 22 of the terminal 2 receives the login completion screen or the login error message and displays it on the output device. When the login completion screen is received, the instruction receiving unit 21 of the terminal 2 can receive the user's instruction and use various services provided by the business server 4 such as online banking and online shopping.

  The embodiment of the present invention has been described above.

  In this embodiment, the risk of leakage of the user ID and password can be reduced, and higher security can be ensured. That is, even if an unauthorized third party requests a one-time password by impersonation by transmitting a one-time password through a communication path different from the communication path accessed from the mobile phone 1 to the authentication server 3, A one-time password can be transmitted to the user's mobile phone 1. That is, leakage of the one-time password can be prevented.

  In the present embodiment, the password request message transmitted from the mobile phone 1 to the authentication server 3 does not include a member number used when logging in to the business server 4 from the terminal 2. Therefore, even if the communication content between the mobile phone 1 and the authentication server 3 is wiretapped and the one-time password is leaked, the user cannot log in to the business server 4. Therefore, in this authentication system, unauthorized login by a third party can be rejected, and higher security can be ensured.

  In the present embodiment, not only the one-time password but also the location information of the mobile phone 1 is used for authenticating the user at the time of login. In this way, even if a user's login information including a one-time password is scammed due to phishing, etc., it is possible to reject unauthorized third party login requests and prevent commercial transactions on unauthorized networks. it can. That is, higher security can be ensured.

  In the present embodiment, the cell ID of the base station 5 is used as the location information of the mobile phone 1. Thereby, even if the user carrying the mobile phone 1 is in the building or underground, the cell ID can be received from the base station 5. Further, the mobile phone 1 does not need to have a GPS reception function. Thereby, in this embodiment, a user's legitimacy can be authenticated at lower cost.

  Further, in the present embodiment, the authentication server 3 centrally manages user authentication information, and performs user authentication with higher accuracy in response to a request from each business server 4. As a result, the load of authentication processing on the business server side can be reduced, and more efficient authentication processing can be performed.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary. For example, the authentication system of the above embodiment includes one or a plurality of business servers 4, and the authentication server 3 can authenticate login requests to the plurality of business servers 4. However, the authentication server 3 and the business server 4 may correspond one-to-one, and the authentication server 3 may authenticate only one business server 4. In this case, system IDs such as a password request message and a user attribute table are not necessary.

  In the above embodiment, if the location information is different from the normal pattern in the authentication process at the time of login, an NG message is transmitted (FIG. 6: S38). However, in this case, for example, the authentication server 3 may transmit a warning message to the business server 4, and the business server 4 may perform predetermined error processing. For example, when receiving a warning message, the business server 4 permits login and transmits a login completion screen to the terminal 2. Then, the business server 4 may store the log information of the warning message in a memory or an external storage device, and inquire about a legitimate user later.

  In the present embodiment, in the authentication process at the time of login, the business server 4 transmits the member number included in the login message to the authentication server 3 (FIG. 6: S33). However, the business server 4 may transmit an intermediate ID for federation that links the membership number and the user ID. In this case, the business server 4 converts the intermediate ID into a user ID and performs an authentication process. In addition, when performing login processing from the terminal 2, the user may input an intermediate ID instead of a membership number on the login screen.

  In this embodiment, the authentication server 3 accepts a request from the business server 4 and authenticates the validity of the user who made the login request. However, the business server 4 itself may acquire information necessary for authentication from the authentication server and authenticate the user's validity. In this case, the business server 4 transmits the member number and the system ID to the authentication server 3 and receives the corresponding one-time password, expiration date and location information from the authentication server 3 in the authentication process at the time of login (FIG. 6: S33). Then, the business server 4 authenticates the legitimacy of the logged-in user using the information acquired from the authentication server 3 (S34 to S38). In this case, it is assumed that the business server 4 holds the position history table 37.

  In the one-time password acquisition process (see FIG. 5), the user may input a password when inputting a password request instruction. Then, the mobile phone transmits a password request message including a personal identification number, and the authentication server 3 refers to a personal identification number table (not shown) and generates a one-time password when the personal identification numbers match.

1 is a diagram illustrating an overall configuration of an authentication system to which an embodiment of the present invention is applied. It is a figure which shows an example of a mobile telephone table. It is a figure which shows an example of a user attribute table. It is a figure which shows the hardware structural example of each apparatus. It is a flowchart of the acquisition process of a one-time password. It is a flowchart of the authentication process at the time of login.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1: Mobile phone, 11: Instruction reception part, 12: Position information acquisition part, 13: Password request transmission part, 14: Display part, 2: Terminal, 21: Instruction reception part, 22: Display part, 3: Authentication server, 31: Receiving unit, 32: Password generating unit, 33: Password transmitting unit, 34: Authentication unit, 35: Mobile phone table, 36: User attribute table, 37: Location history table, 4: Business server, 41: Login receiving unit 42: Login processing unit 43: Business processing unit 44: Member table 5: Base station 6: Network

Claims (5)

An authentication system having an authentication server and a plurality of business servers,
The authentication server is
A user attribute table in which a first user ID for identifying a user in the authentication system, a second user ID for identifying a user in each business server, and a one-time password are associated;
Receiving means for receiving a password request including a mobile phone ID from a mobile phone and identifying a first user ID corresponding to the received mobile phone ID;
Password generating means for generating a one-time password for the identified first user ID and storing the generated one-time password in the user attribute table;
Password transmitting means for transmitting the generated one-time password to the mobile phone;
The second user ID and the one-time password are received from each business server, and whether or not the received one-time password matches the one-time password of the second user ID stored in the user attribute table And an authentication means for transmitting an authentication success message to the business server when the one-time password matches,
Each business server
Login acceptance means for receiving a login request including the second user ID and the one-time password from the terminal and transmitting the login request to the authentication server;
When receiving the authentication success message from the authentication server, it has a, a login processing unit to allow the login request,
The password request further includes location information of the mobile phone,
The authentication server is
For each of the first user IDs, there is further provided a location history table in which location information of the mobile phone when logged in in the past is stored,
The password generation means stores position information included in the password request in the user attribute table,
The authentication means determines whether or not the position information stored in the user attribute table is normal based on the corresponding past position information in the position history table, and if successful, sends an authentication success message to the business server The authentication system characterized by transmitting to . The authentication system according to claim 1,
The authentication system characterized in that the password transmission means transmits the generated password to the mobile phone using a short message service or an e-mail different from the communication path through which the reception means has received the password request. The authentication server in an authentication system having an authentication server and a plurality of business servers,
A user attribute table in which a first user ID for identifying a user in the authentication system, a second user ID for identifying a user in each business server, and a one-time password are associated;
Receiving means for receiving a password request including a mobile phone ID from a mobile phone and identifying a first user ID corresponding to the received mobile phone ID;
Password generating means for generating a one-time password for the identified first user ID and storing the generated one-time password in the user attribute table;
Password transmitting means for transmitting the generated one-time password to the mobile phone;
The second user ID and the one-time password are received from each business server, and whether or not the received one-time password matches the one-time password of the second user ID stored in the user attribute table to determine, have a, an authentication unit to send an authentication success message to the business server if the one-time password matches,
The password request further includes location information of the mobile phone,
The authentication server is
For each of the first user IDs, there is further provided a location history table in which location information of the mobile phone when logged in in the past is stored,
The password generation means stores position information included in the password request in the user attribute table,
The authentication means determines whether or not the position information stored in the user attribute table is normal based on the corresponding past position information in the position history table, and if successful, sends an authentication success message to the business server An authentication server characterized by transmitting to . An authentication method for an authentication system having an authentication server and a plurality of business servers,
The authentication server is
A user attribute table in which a first user ID for identifying a user in the authentication system, a second user ID for identifying a user in each business server, and a one-time password are associated, and processing And
The processor is
Receiving a password request including a mobile phone ID from a mobile phone, and specifying a first user ID corresponding to the received mobile phone ID;
Generating a one-time password for the identified first user ID, and storing the generated one-time password in the user attribute table;
A password transmission step of transmitting the generated one-time password to the mobile phone;
The second user ID and the one-time password are received from each business server, and whether or not the received one-time password matches the one-time password of the second user ID stored in the user attribute table And performing an authentication step of transmitting an authentication success message to the business server when the one-time password matches,
The processing unit of each business server
A login acceptance step of receiving a login request including the second user ID and the one-time password from the terminal and transmitting the login request to the authentication server;
When receiving the authentication success message from the authentication server, you have rows and login processing steps, a to allow the login request,
The password request further includes location information of the mobile phone,
The authentication server further includes a location history table in which location information of the mobile phone at the time of login in the past is stored for each first user ID,
The password generation step stores location information included in the password request in the user attribute table;
The authentication step determines whether or not the position information stored in the user attribute table is normal based on the corresponding past position information in the position history table, and if successful, sends an authentication success message to the business server The authentication method characterized by transmitting to . An authentication program executed by the authentication server in an authentication system having an authentication server and a plurality of business servers,
The authentication server is a user that associates a first user ID for identifying a user in the authentication system, a second user ID for identifying a user in the business server, and a one-time password. An attribute table and a processing unit;
In the processing unit,
Receiving a password request including a mobile phone ID from a mobile phone, and specifying a first user ID corresponding to the received mobile phone ID;
Generating a one-time password for the identified first user ID, and storing the generated one-time password in the user attribute table;
A password transmission step of transmitting the generated one-time password to the mobile phone;
The second user ID and the one-time password are received from each business server, and whether or not the received one-time password matches the one-time password of the second user ID stored in the user attribute table And an authentication step of transmitting an authentication success message to the business server when the one-time password matches ,
The password request further includes location information of the mobile phone,
The authentication server further includes a location history table in which location information of the mobile phone at the time of login in the past is stored for each first user ID,
The password generation step stores location information included in the password request in the user attribute table;
The authentication step determines whether or not the position information stored in the user attribute table is normal based on the corresponding past position information in the position history table, and if successful, sends an authentication success message to the business server An authentication program characterized by being transmitted to .

Images