JP4960738B2 - Authentication system, authentication method, and authentication program - Google Patents

Description

  The present invention relates to an authentication technique for authenticating a user's validity using a one-time password.

In recent years, there has been a problem of identity theft such as user IDs and passwords on the Internet, represented by phishing scams. For this reason, there is a need for a technique that ensures higher security and authenticates the legitimacy of the user. For example, Patent Document 1 describes a one-time password authentication system that performs user authentication using a one-time password.
JP2002-259344

  In the one-time password authentication system described in Patent Document 1, a one-time password generated by a mobile phone having a one-time password generation function is input from a login screen on a user PC and transmitted to a user authentication server. Then, the user authentication server authenticates the one-time password transmitted from the user PC.

  Now, with the spread of mobile phones, the number of websites that can be accessed from mobile phones is increasing. Also, a website accessible from a mobile phone may require a one-time password to perform advanced user authentication.

  Here, depending on the model of the mobile phone, the one-time password generation function disclosed in Patent Document 1 and the browser function for accessing the Web site may not be activated at the same time. In this way, when accessing a website with a mobile phone that cannot start multiple applications simultaneously, the user once notes or memorizes the one-time password displayed on the mobile phone display, and then launches the browser function. Need to access the website. However, since the one-time password is a random character string, there is a case where a mistake is made in writing a memo or a case where it is mistakenly memorized.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to improve user convenience when accessing a website that performs advanced user authentication that requires input of a one-time password. It is to improve.

  In order to solve the above-mentioned problem, the present invention is an authentication system, in which an authentication storage that stores terminal identification information of a user terminal, a password generation key for generating a one-time password, and a user ID in association with each other. Means, session information storage means for associating and storing session information and user ID of the user terminal, and terminal identification information of the user terminal stored in the authentication storage means in a request from the user terminal Based on a password generation key corresponding to the terminal identification information stored in the authentication storage means when the request includes terminal identification information of the user terminal. A first generation unit configured to generate a first one-time password and transmit it to the user terminal; and a second one-time password from the user terminal. A password receiving means for receiving a user ID corresponding to the session information from the session information storage means, and a password generation key corresponding to the acquired user ID is specified from the authentication storage means, Whether the second generation means for generating the third one-time password based on the password generation key, the third one-time password, and the second one-time password received by the password reception means match Authentication means for verifying whether or not the authentication is successful if the two match.

  The present invention is also a one-time password authentication method performed by an authentication system, wherein the authentication system includes terminal identification information of a user terminal, a password generation key for generating a one-time password, and a user ID. An authentication storage unit that stores the information in association with each other, a session information storage unit that stores the session information and user ID of the user terminal in association with each other, and a processing unit. A step of determining whether or not the terminal identification information of the user terminal stored in the authentication storage unit is included in the authentication storage unit, and the authentication when the request includes the terminal identification information of the user terminal A first one-time password is generated based on a password generation key corresponding to the terminal identification information stored in the storage unit, and transmitted to the user terminal A first generating step, a second one-time password and session information received from the user terminal, and a password receiving step for acquiring a user ID corresponding to the session information from the session information storage unit; A second generation step of identifying a password generation key corresponding to the user ID from the authentication storage unit and generating a third one-time password based on the password generation key; the third one-time password; An authentication step is performed to verify whether the second one-time password received in the password receiving step matches, and to determine that the authentication has succeeded if they match.

  The present invention is also a one-time password authentication program executed by an authentication system, wherein the authentication system includes terminal identification information of a user terminal, a password generation key for generating a one-time password, a user ID, Are stored in association with each other, a session information storage unit for storing the session information and user ID of the user terminal in association with each other, and a processing unit. A determination step of determining whether or not the request includes the terminal identification information of the user terminal stored in the authentication storage unit; and when the request includes the terminal identification information of the user terminal, A first one-time password is generated based on a password generation key corresponding to the terminal identification information stored in the authentication storage unit, and the user A first generation step of transmitting at the end, a password receiving step of receiving a second one-time password and session information from the user terminal, and acquiring a user ID corresponding to the session information from the session information storage unit; A second generation step of identifying a password generation key corresponding to the acquired user ID from the authentication storage unit and generating a third one-time password based on the password generation key; and the third one-time password And the authentication step of verifying whether or not the second one-time password received in the password receiving step matches, and determining that the authentication is successful if they match.

  According to the present invention, when accessing a website that performs advanced user authentication that requires a one-time password, user convenience can be further improved.

  Embodiments of the present invention will be described below.

<First Embodiment>
FIG. 1 is an overall configuration diagram of an authentication system to which a first embodiment of the present invention is applied.

  The illustrated authentication system includes a mobile phone 1 or a terminal 2 such as a PC (Personal Computer) as a user terminal, and an authentication server 5. These devices 1, 2, and 5 are connected via a network such as a cellular phone network or the Internet.

  It is assumed that the user of this authentication system is a user who can use the Web site service provided by the authentication server 5 and has registered in the authentication server 5 in advance and has acquired a user ID.

  Further, it is assumed that the user accesses the website of the authentication server 5 using the mobile phone 1 or the terminal 2. When accessing the Web site of the authentication server 5 using the mobile phone 1, the user acquires a one-time password from the authentication server 5. When accessing the Web site of the authentication server 5 using the terminal 2, the user acquires a one-time password from the hardware token 3.

  The mobile phone 1 includes an instruction receiving unit that receives user instructions and a display unit that displays various types of information and screens. It is assumed that the instruction receiving unit and the display unit have the same functions as the browser.

  The terminal 2 includes an instruction receiving unit that receives various instructions from the user, and a display unit that displays various information / screens. It is assumed that the instruction receiving unit and the display unit have the same functions as the browser.

  The hardware token 3 is a device that generates a one-time password, and includes a one-time password generation key, a one-time password generation unit, and a one-time password display unit.

  The authentication server 5 authenticates an access request from a user terminal (mobile phone 1, terminal 2), and provides a predetermined service when the authentication is successful. The authentication server 5 shown in the figure generates a primary authentication unit 51 that performs primary authentication, a determination unit 52 that determines whether or not a user terminal is a mobile phone 1, and a one-time password when the user terminal is a mobile phone 1. A first generation unit 53, a one-time password request unit 54 that requests a one-time password when the user terminal is the terminal 2, a one-time password reception unit 55 that receives a one-time password from the user terminal, and an authentication A second generation unit 56 for generating the one-time password, a secondary authentication unit 57 for verifying the one-time password transmitted from the user terminal and the one-time password generated by the second generation unit, and the user terminal And a business processing unit 58 that provides a predetermined service.

  The authentication server 5 includes an authentication table 61 that stores various information necessary for authentication, and a session information table 62 that stores session information of the user terminal.

  FIG. 2 is a diagram illustrating an example of the authentication table 61. The illustrated authentication table 61 includes a user ID 201, a password 202, a mobile phone ID 203, and a one-time password generation key 204. The mobile phone ID 203 is information for specifying a mobile phone or a user who is the owner of the mobile phone, and various information can be used according to the model of the mobile phone. For example, it is conceivable to use, as the mobile phone ID 203, a machine identification number, a telephone number, user information, etc. stored in a memory of the mobile phone 1 (including an IC card removable from the mobile phone 1). It is also conceivable to use identification information issued by the carrier gateway based on the telephone number for the mobile phone ID 203.

  The one-time password generation key 204 is information for generating a one-time password, and has fixed information (seed) and variable information (counter, time information, etc.). The fixed information is a unique character string assigned to each user (or each user ID). The variable information is information for generating a different one-time password each time. For example, time information (time stamp) or the number of times of one-time password generation may be used as the variable information.

  FIG. 3 is a diagram illustrating an example of the session information table 62. The illustrated session information table 62 has a session ID 301 (session information) and a user ID 302. The session ID 301 is information for identifying the user terminal (mobile phone 1 or terminal 2) that has accessed the authentication server 5, and is uniquely assigned for each session from login to logout.

  The mobile phone 1, the terminal 2, and the authentication server 5 described above all include, for example, a CPU 901, a memory 902, an external storage device 903 such as an HDD, and an input device 904 such as a keyboard and a mouse as shown in FIG. A general-purpose computer system including an output device 905 such as a display or a printer and a communication control device 906 for connecting to a network can be used. In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of each device.

  For example, the functions of the mobile phone 1, the terminal 2, and the authentication server 5 are the CPU 901 of the mobile phone 1 in the case of the program for the mobile phone 1, the CPU 901 of the terminal 2 in the case of the program of the terminal 2, and the authentication server. In the case of the program for 5, the CPU 901 of the authentication server 5 executes the program.

  Note that the memory 902 or the external storage device 903 of the authentication server 5 is used for the authentication table 61 and the session information table 62 of the authentication server 5. Further, the authentication server 5 may be configured by a plurality of servers.

  Next, processing when accessing the Web site of the authentication server 5 from the user terminal (mobile phone 1 or terminal 2) will be described.

  5 and 6 are sequence diagrams of the access process. FIG. 7 shows an example of various screens displayed on the output device of the user terminal. FIG. 7A shows various screen examples when the user terminal is the mobile phone 1, and FIG. 7B shows various screen examples when the user terminal is the terminal 2.

  The user terminal receives a user instruction, specifies a predetermined URL (Uniform Resource Locator), accesses the Web site of the authentication server 5, and acquires a login screen provided by the authentication server 5. And a user terminal displays the login screen 71 shown, for example to Fig.7 (a) on an output device (S11).

  The login screen 71 shown in FIG. 7A is a login screen when the user terminal is the mobile phone 1 and displays a user ID input field, a password input field, and a send button. When the user terminal is the terminal 2, a login screen similar to the login screen 71 in FIG. The user inputs the user ID and password registered in the authentication table 61 in advance in the respective input fields and clicks the send button. The user terminal transmits a primary authentication request including the user ID and password to the authentication server 5 (S12).

  The primary authentication unit 51 of the authentication server 5 determines whether or not the user ID and password of the received primary authentication request exist in the authentication table 61 (see FIG. 2). It is authenticated that the access is from a different user (S13).

  If the access is from a legitimate user, the primary authentication unit 51 generates a session ID indicating that the primary authentication is successful, and registers the generated session ID together with the user ID in the session information table 62. (S14). The primary authentication unit 51 generates a unique session ID for identifying the user terminal using time information, for example. If the authentication table 61 does not exist, the primary authentication unit 51 transmits an error message to the user terminal indicating that the primary authentication has failed.

  Then, the primary authentication unit 51 transmits a predetermined menu screen and the generated session ID to the user terminal (S15). Then, the user terminal displays a menu screen on the output device (S16). A menu screen 82 in FIG. 7A is an example of a menu screen displayed on the mobile phone 1. In the illustrated menu screen, various services provided by the authentication server 5 are displayed. A service that can be used only by the primary authentication in S13 (for example, “inquiry”) and a service that requires secondary authentication (for example, “order”). )). When the user terminal is the terminal 2, a menu screen similar to the menu screen 72 in FIG.

  Here, it is assumed that the user selects a service that also requires secondary authentication (“order” in the illustrated example). Then, the user terminal transmits a service selection instruction including the selected menu number and the session ID embedded in the menu screen to the authentication server 5 (S17). When the user terminal is the mobile phone 1, the mobile phone 1 transmits the mobile phone ID stored in the memory or the like of the mobile phone 1 when transmitting information to the authentication server 5.

  The determination unit 52 checks whether or not the session ID of the received service selection instruction exists in the session information table 62 (S18). When the determination unit 52 exists in the session information table 62, the service selection instruction is regarded as being after successful primary authentication. When the determination unit 52 does not exist in the session information table 62, the service selection instruction is invalid. An error message is sent to the user terminal, assuming that it is from the user.

  When the session ID exists in the session information table 62, the determination unit 52 determines whether the service number is a service that requires secondary authentication. It is assumed that the necessity of secondary authentication is stored for each service number in the memory of the authentication server 5 or the like. In the case of a service number that does not require secondary authentication, the determination unit 52 passes the service number to the business processing unit 58, and the business processing unit 58 displays a predetermined business service screen for providing the service of the service number on the user terminal. Send.

  If the service number requires secondary authentication, the determination unit 52 determines whether or not the mobile phone ID is included in the service selection instruction (S19). When the mobile phone ID is not included (S19: None), that is, when the user terminal is the terminal 2 such as a PC, the process proceeds to the process of FIG. On the other hand, when the mobile phone ID is included (S19: Present), that is, when the user terminal is the mobile phone 1, the determination unit 52 determines whether or not the mobile phone ID and the user ID exist in the authentication table 61. Check (S20). Note that the determination unit 52 acquires a user ID corresponding to the session ID from the session information table 62.

  If it exists in the authentication table 61, the determination unit 52 acquires the password generation key set in the record and sends it to the first generation unit 53. On the other hand, when it does not exist in the authentication table 61, the determination unit 52 determines that the request is from an unauthorized user or a user who is not registered in the one-time password issuing service, and transmits an error message to the user terminal.

  The first generation unit 53 generates a one-time password by a predetermined algorithm (for example, a one-way function such as a hash function) based on the transmitted password generation key (S21).

  Then, the first generation unit 53 transmits the one-time password confirmation screen including the generated one-time password and the session ID to the user terminal (S22). For example, the user terminal displays the one-time password confirmation screen 73 of FIG. 7A on the output device (S23). When the user clicks the OK button on the screen, the user terminal transmits the displayed one-time password and the session ID embedded in the screen to the authentication server 5 (S24).

  The one-time password receiving unit 55 of the authentication server 5 checks whether or not the received session ID exists in the session information table 62 as in S18 (S25). If the session information table 62 exists, the one-time password receiving unit 55 acquires the corresponding user ID from the session information table 62. Then, the one-time password receiving unit 55 acquires a one-time password generation key corresponding to the user ID acquired from the authentication table 61 and sends it to the second generation unit 56.

  Based on the transmitted password generation key, the second generation unit 56 generates a one-time password using the same algorithm as in S21 (S26). Then, the secondary authentication unit 57 determines whether or not the one-time password received in S24 matches the one-time password generated in S26 (S27). If the one-time passwords match, the secondary authentication unit 57 authenticates that the request is from a legitimate user, and transmits a post-login screen indicating that the secondary authentication has been successful to the user terminal (S28).

  The user terminal displays, for example, a post-login screen 74 shown in FIG. 7A on the output device (S29). In the case of the illustrated screen, when the user clicks the “Next” button, the business processing unit 58 of the authentication server 5 provides the user with the service of the menu number transmitted in S17. When the one-time passwords do not match (S27), the secondary authentication unit 57 transmits an error message indicating that the secondary authentication has failed to the terminal 2.

  Next, processing when the mobile phone ID is not included (S19: None), that is, when the user terminal is the terminal 2 such as a PC will be described with reference to FIG.

  The one-time password request unit 54 of the authentication server 5 requests a one-time password from the user terminal (S41). That is, the one-time password request unit 54 transmits a one-time password input screen and a session ID to the user terminal. For example, the user terminal displays the one-time password input screen 75 of FIG. 7B on the output device (S42).

  The user inputs the one-time password displayed on the hardware token 3 on the one-time password input screen and clicks the send button. In the memory of the hardware token 3, a one-time password generation key specific to the user ID of the user who uses the hardware token 3 is set. The one-time password generation key stored in the hardware token 3 and the corresponding one-time password generation key in the authentication table 61 are the same. The hardware token 3 receives a user instruction at a predetermined timing, generates a one-time password by the same algorithm (S21, S26) as the authentication server 5, and displays it on a display device such as a display.

  Note that the means for generating the one-time password is not limited to using the hardware token 3, but when receiving a one-time password issued through another terminal, using the one-time password generating application of the mobile phone 1, etc. Can be considered.

  The user terminal transmits the one-time password input by the user and the session ID to the authentication server 5 (S43). As in S25 to S28 described in FIG. 5, the authentication server 5 checks session information, generates a one-time password, and whether the generated one-time password matches the one-time password received from the user terminal. Secondary authentication is performed, and the screen after login is transmitted to the user terminal (S44 to S47). The user terminal displays, for example, a post-login screen 76 shown in FIG. 7B on the output device (S48).

  The authentication server 5 of the present embodiment described above determines that the user terminal is a mobile phone when the request for a service selection instruction or the like transmitted from the user terminal includes a mobile phone ID, and the one-time password Is generated and sent to the mobile phone. Thereby, the user can easily transmit the one-time password displayed on the mobile phone 1 to the authentication server 5 without interrupting the access process of the authentication server 5 to the Web site. In other words, in this embodiment, user convenience can be further improved when accessing a website that performs advanced user authentication that requires the entry of a one-time password, regardless of the type of mobile phone. . In the present embodiment, even a mobile phone that does not have a one-time password generation function can easily access a Web site that requires the input of a one-time password.

  Further, the authentication server 5 according to the present embodiment determines that the user terminal is a terminal such as a PC and requests input of a one-time password when the request transmitted from the user terminal does not include the mobile phone ID. To do. As a result, in this embodiment, even if the user terminal is a mobile phone, even if the user terminal is a terminal such as a personal computer, a hardware token is used to access a Web site that requires easy input of a one-time password. can do.

  Further, the authentication server 5 of the present embodiment first performs primary authentication of the user ID and password, stores the session ID in the session information table when the primary authentication is successful, and then performs secondary authentication of the one-time password. I do. Thereby, an authentication level can be flexibly set according to the type of service.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary. For example, in the above embodiment, in S22 to S24 of the access process of FIG. 5, the authentication server 5 displays a one-time password confirmation screen on the mobile phone, and transmits the one-time password to the authentication server 5 according to a user instruction. did. However, the first generation unit 53 of the authentication server 5 transmits a redirect instruction for automatically transmitting the generated one-time password to the authentication system without displaying the one-time password confirmation screen on the mobile phone. It is good to do. Thereby, a user's convenience can be improved more.

  In addition, the authentication server 5 of the above embodiment includes the first and second generation units 53 and 56, and one generation unit generates a one-time password to be transmitted to the mobile phone 1 (FIG. 5: S21). A one-time password for authentication may be generated (FIG. 5: S26).

<Second Embodiment>
FIG. 8 is an overall configuration diagram of an authentication system to which the second exemplary embodiment of the present invention is applied.

  The illustrated authentication system includes a mobile phone 1 or a terminal 2 such as a PC (Personal Computer), a business server 7, and an authentication server 8 as user terminals. The business server 7 is connected to the mobile phone 1 and the terminal 2 via a network such as a mobile phone network or the Internet, and is connected to the authentication server 8 via a network such as a LAN.

  The business server 7 of this embodiment authenticates an access request from a user terminal (mobile phone 1, terminal 2) together with the authentication server 8, and provides a predetermined service when the authentication is successful. The business server 7 shown in the figure includes a primary authentication unit 71 that performs primary authentication, a determination unit 72 that determines whether or not the user terminal is a mobile phone 1, and a PIN that requests a PIN when the user terminal is the mobile phone 1. A request unit 73, a one-time password request unit 74 that requests a one-time password when the user terminal is the terminal 2, a one-time password reception unit 75 that receives a one-time password from the user terminal, and a one-time password are generated. A generation unit 76, a secondary authentication unit 77 that verifies the one-time password transmitted from the user terminal and the one-time password generated by the generation unit 76, a business processing unit 78 that provides a predetermined service to the user terminal, Have

  The illustrated business server 7 includes a first authentication table 79 that stores various information necessary for authentication, and a session information table 80 similar to the session information table 62 (see FIG. 3) of the first embodiment. And having.

  The authentication server 8 of the present embodiment includes a mobile phone ID verification unit 81 that receives a request from the business server 7 and verifies the mobile phone ID, and a PIN verification unit 82 that receives a request from the business server 7 and verifies the PIN. And a second authentication table 85.

  FIG. 9 is a diagram illustrating an example of the first authentication table 79 of the business server 7. The illustrated first authentication table 79 includes a user ID 111, a password 112, and a one-time password generation key 113.

  FIG. 10 is a diagram illustrating an example of the second authentication table 85 of the authentication server 8. The second authentication table 80 shown in the figure is a user ID 121, a mobile phone ID 122 (machine identification number, telephone number, user information stored in the IC memory of the mobile phone, etc.), and a password arbitrarily set by the user. PIN (Personal Identification Number) 123.

  Next, processing when accessing the Web site of the business server 7 from the user terminal (mobile phone 1 or terminal 2) will be described.

  11 and 12 are sequence diagrams of access processing.

  Since the processing from S51 to S58 in FIG. 11 is the same as the processing in the first embodiment (FIG. 5: S11 to S18), description thereof is omitted here. In the present embodiment, the processing performed by the primary authentication unit 51 and the determination unit 52 of the authentication server 5 in the first embodiment is performed by the primary authentication unit 71 and the determination unit 72 of the business server 7.

  In S <b> 59, the determination unit 72 of the business server 7 determines whether or not the service number is a service that requires secondary authentication. If the service number does not require secondary authentication, the service number is transferred to the business processing unit 78. The business processing unit 78 transmits a predetermined business service screen for providing the service of the service number to the user terminal. On the other hand, in the case of a service number that requires secondary authentication, the determination unit 72 determines whether or not a mobile phone ID is included in the service selection instruction.

  If the mobile phone ID is not included (S59: None), that is, if the user terminal is the terminal 2 such as a PC, the process proceeds to the process of FIG. On the other hand, when the mobile phone ID is included (S59: Yes), that is, when the user terminal is the mobile phone 1, the determination unit 72 transmits a verification request for the mobile phone ID and the user ID to the authentication server 8 ( S60). Note that the determination unit 72 acquires a user ID corresponding to the session ID from the session information table 80.

  The mobile phone ID verification unit 81 of the authentication server 8 checks whether or not the mobile phone ID and the user ID included in the verification request transmitted by the business server 7 exist in the second authentication table 85 (S61). If it does not exist in the second authentication table 85 (S61: NG), the mobile phone ID verification unit 81 determines that the request is from an unregistered user who has not registered in the authentication server 8, and the verification result (NG data) is transmitted to the business server 7 (S62), and the process proceeds to FIG. On the other hand, when it exists in the 2nd authentication table 85, the mobile telephone ID verification part 81 transmits a verification result (OK data) to the business server 7 (S63).

  The PIN requesting unit 73 of the business server 7 requests a PIN (password) from the user terminal (S64). That is, the PIN requesting unit 73 transmits a PIN input screen and a session ID to the user terminal. The user terminal displays a PIN input screen in which the PIN input field is set on the output device (S65).

  The user inputs a PIN registered in the authentication server 8 in advance on the PIN input screen. The user terminal transmits the PIN entered by the user and the session ID to the business server 7 (S66). The PIN request unit 73 of the business server 7 checks whether or not the received session ID exists in the session information table 80 (S67). If it exists in the session information table 80, the PIN request unit 73 sends a verification request for the PIN and user ID to the authentication server 8 (S68). It is assumed that the PIN request unit 73 acquires a user ID corresponding to the session ID from the session information table 80.

  The PIN verification unit 82 of the authentication server 8 checks whether the PIN and user ID transmitted by the business server 7 exist in the second authentication table 85 (S69), and uses the verification result (OK or NG) as the business. It transmits to the server 7 (S70). If the verification result is OK, the secondary authentication unit 77 of the business server 7 authenticates that the request is from a legitimate user, and transmits a secondary authentication screen indicating that the secondary authentication is successful to the user terminal. (S71). For example, the user terminal displays a post-login screen 74 shown in FIG. 7A on the output device (S72).

  When the mobile phone ID is not included, that is, when the user terminal is a terminal 2 such as a PC (S59: None), the mobile phone ID is not registered in the second authentication table of the authentication server 8. The process in the case (S61: NG) is as shown in FIG. The processes from S81 to S88 in FIG. 12 are the same as the processes in the first embodiment (FIG. 6: S41 to S48), and thus description thereof is omitted here. In the present embodiment of FIG. 12, the processing performed by the one-time password request unit 54, the one-time password reception unit 55, the second generation unit 56, and the secondary authentication unit 57 of the authentication server 5 in the first embodiment This is performed by the one-time password request unit 74, the one-time password reception unit 75, the generation unit 76, and the secondary authentication unit 77 of the server 7.

  The business server 7 and the authentication server 8 of the present embodiment described above determine that the user terminal is a mobile phone if the request such as a service selection instruction transmitted from the user terminal includes a mobile phone ID. Require PIN input instead of one-time password. The user can respond to the secondary authentication by inputting the PIN without interrupting the access process of the authentication server 5 to the Web site. That is, in the present embodiment, user convenience can be further improved when accessing a website that performs necessary advanced user authentication regardless of the model of the mobile phone. Further, in the present embodiment, even a mobile phone that does not have a one-time password generation function can easily access a website that performs advanced user authentication.

  Further, the business server 7 and the authentication server 8 according to the present embodiment determine that the user terminal is a terminal such as a PC when the mobile phone ID is not included in the request transmitted from the user terminal, and the one-time Require password entry. As a result, in this embodiment, the user terminal is not limited to a mobile phone, and even if the user terminal is a terminal such as a personal computer, a hardware token is used to create a website that requires a one-time password. Can be accessed.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary. For example, in the above embodiment, when the mobile phone ID is registered in the second authentication table in S61 of the access process of FIG. 11 (S61: OK), the PIN input screen is transmitted to the user terminal (S64). ). However, the business server 7 generates a one-time password as in the first embodiment, transmits a one-time password confirmation screen to the user terminal (FIG. 5: S21 to S24), and then displays the PIN input screen as the user terminal. It is good also as transmitting to.

1 is an overall configuration diagram of an authentication system to which a first embodiment of the present invention is applied. It is a figure which shows an example of an authentication table. It is a figure which shows an example of a session information table. It is a figure which shows the hardware structural example of each apparatus. It is a sequence diagram of an access process. It is a sequence diagram of an access process. It is an example of various screens of a user terminal. It is a whole block diagram of the authentication system to which the 2nd Embodiment of this invention was applied. It is a figure which shows an example of a 1st authentication table. It is a figure which shows an example of a 2nd authentication table. It is a sequence diagram of an access process. It is a sequence diagram of an access process.

Explanation of symbols

  1: mobile phone, 2: terminal, 3: hardware token, 5: authentication server, 51: primary authentication unit, 52: discrimination unit, 53: first generation unit, 54: one-time password request unit, 55: One-time password receiving unit, 56: second generation unit, 57: secondary authentication unit, 58: business processing unit, 61: authentication table, 62: session information table

Claims (7)

An authentication system,
Authentication storage means for storing terminal identification information of a user terminal, a password generation key for generating a one-time password, and a user ID in association with each other;
Session information storage means for storing session information of the user terminal and a user ID in association with each other;
Determining means for determining whether or not the request from the user terminal includes terminal identification information of the user terminal stored in the authentication storage means;
When the request includes terminal identification information of the user terminal, a first one-time password is generated based on a password generation key corresponding to the terminal identification information stored in the authentication storage unit, First generation means for transmitting to the user terminal;
Password receiving means for receiving a second one-time password and session information from the user terminal, and obtaining a user ID corresponding to the session information from the session information storage means;
A second generation unit that identifies a password generation key corresponding to the acquired user ID from the authentication storage unit, and generates a third one-time password based on the password generation key;
Authentication means for verifying whether or not the third one-time password matches the second one-time password received by the password receiving means, and determining that the authentication is successful if they match. An authentication system characterized by this. The authentication system according to claim 1,
The second one-time password received by the password receiving unit is the first one-time password generated by the first generation unit or the one-time password input by the user at the user terminal. Authentication system. The authentication system according to claim 1,
An authentication system, further comprising: a one-time password request means for transmitting a request instruction for requesting a one-time password to the user terminal when the request does not include the terminal identification information of the user terminal. The authentication system according to claim 1,
The first generation means transmits to the user terminal a redirect instruction for transmitting the generated first one-time password to the authentication system. The authentication system according to claim 1,
Receiving a primary authentication request including a user ID from the user terminal, and generating the session information indicating that the primary authentication is successful when the user ID is stored in the authentication storage unit; An authentication system further comprising primary authentication means for storing the information in the session information storage means. A one-time password authentication method performed by an authentication system,
The authentication system includes:
An authentication storage unit that stores terminal identification information of a user terminal, a password generation key for generating a one-time password, and a user ID in association with each other;
A session information storage unit that stores session information of the user terminal and a user ID in association with each other, and a processing unit;
The processor is
A determination step of determining whether or not the request from the user terminal includes terminal identification information of the user terminal stored in the authentication storage unit;
When the request includes terminal identification information of the user terminal, a first one-time password is generated based on a password generation key corresponding to the terminal identification information stored in the authentication storage unit, A first generating step for transmitting to the user terminal;
A password receiving step of receiving a second one-time password and session information from the user terminal, and acquiring a user ID corresponding to the session information from the session information storage unit;
A second generation step of identifying a password generation key corresponding to the acquired user ID from the authentication storage unit, and generating a third one-time password based on the password generation key;
An authentication step is performed to verify whether or not the third one-time password matches the second one-time password received in the password reception step, and to determine that the authentication is successful if they match. An authentication method characterized by this. A one-time password authentication program executed by the authentication system,
The authentication system includes:
An authentication storage unit that stores terminal identification information of a user terminal, a password generation key for generating a one-time password, and a user ID in association with each other;
A session information storage unit that stores session information of the user terminal and a user ID in association with each other, and a processing unit;
In the processing unit,
A determination step of determining whether or not the request from the user terminal includes terminal identification information of the user terminal stored in the authentication storage unit;
When the request includes terminal identification information of the user terminal, a first one-time password is generated based on a password generation key corresponding to the terminal identification information stored in the authentication storage unit, A first generating step for transmitting to the user terminal;
A password receiving step of receiving a second one-time password and session information from the user terminal, and acquiring a user ID corresponding to the session information from the session information storage unit;
A second generation step of identifying a password generation key corresponding to the acquired user ID from the authentication storage unit, and generating a third one-time password based on the password generation key;
An authentication step for verifying whether or not the third one-time password matches the second one-time password received in the password reception step, and determining that the authentication is successful if they match An authentication program characterized by

Images