JP5136843B2 - User authentication method and system - Google Patents

Description

  The present invention relates to a user authentication method and system, and more particularly to a user authentication method and system for improving security by converting authentication information and exchanging authentication information using a random number table.

  Conventionally, various services for individuals have been provided by corporate websites via the Internet. When providing such services, to identify individuals and prevent leakage of personal information, etc. Authentication processing is performed using personal identification information (or ID) or a password. As such authentication processing, a personal ID and password are generally determined in advance, and when accessing a website, both the personal ID and password are entered and registered on the server side. Only if it matches, the page is advanced to the personal page.

  In addition to such a general identity verification method, authentication using a random number table is also adopted for some or all services provided by financial institutions that require particularly high security. In other words, a random number table in which numbers or characters are randomly associated with the above ID and password is distributed to the user in advance, and when transmitting authentication information or important information via the Internet, the user uses a number in the random number table. Or convert the character and send it. Since the server side has a random number table used in advance by the user, the original authentication information can be obtained by performing reverse conversion upon receiving the authentication information or the like (see, for example, Patent Documents 1 to 3).

  By doing in this way, the security as the whole system can be improved by protecting the data transmitted / received between networks with low security from illegal acts, such as interception.

JP 2001-61012 A JP 2006-39679 A JP 2006-320508 A

  However, in a system using a conventional random number table, it is necessary to prepare a random number table predetermined for each user together with the card or separately and mail it to the users, which causes security and distribution cost problems. In particular, there is a problem that the cost becomes higher than the required quality in a field where a security level of a level corresponding to only some services or only some users is required as an option.

  The present invention has been made in view of such problems, and as an option, only for some services or some users by sending a random number table to the users via the network when necessary. It is an object of the present invention to provide a user authentication method and system capable of executing advanced authentication processing using a random number table at lower cost or man-hours.

  In order to achieve such an object, the invention described in claim 1 is an authentication server that authenticates a user who is provided with a predetermined service via a network using authentication information provided to the user. A correspondence table transmitting means for transmitting a correspondence table number for identifying a correspondence table and a character correspondence table for randomly associating characters with each other used by the user to input authentication information, and a character transmitted in advance The conversion authentication information converted by using the correspondence table and the correspondence table number of the character correspondence table used for converting the authentication information are received from the terminal device, and the conversion authentication is performed by the character correspondence table identified by the received correspondence table number. And an authentication conversion unit that reversely converts the information to acquire authentication information before conversion.

  The invention according to claim 2 is characterized in that, in the authentication server according to claim 1, the correspondence table number of the character correspondence table used for converting the authentication information is received before the conversion authentication information. .

  According to a third aspect of the present invention, in the authentication server according to the first or second aspect, the correspondence table transmitting means authenticates with the first additional authentication information different from the provided authentication information, and the character correspondence table. And a correspondence table number is transmitted.

  According to a fourth aspect of the present invention, in the authentication server according to the first, second, or third aspect, when the correspondence table transmitting means receives a character correspondence table change request from the terminal device, the transmitted character correspondence table is defined as: A different change character correspondence table and a correspondence table number for identifying the change correspondence table are transmitted.

According to a fifth aspect of the present invention, in the authentication server according to the fourth aspect , the correspondence table transmitting means performs authentication using the second additional authentication information different from the provided authentication information, and the change character correspondence table and A correspondence table number for identifying the change correspondence table is transmitted.

  The invention according to claim 6 is an authentication system for authenticating a user who is provided with a predetermined service via a network using authentication information provided to the user, and the user inputs the authentication information via the network. A character correspondence table for randomly associating characters with each other, a correspondence table receiving means for receiving a correspondence table number for identifying the correspondence table, and a conversion obtained by converting authentication information provided using the character correspondence table A terminal device including a conversion transmission means for transmitting the authentication information and the correspondence table number; a correspondence table transmission means for transmitting the character correspondence table and the correspondence table number to the terminal device via the network; and the conversion authentication information and the authentication information. The correspondence table number of the character correspondence table used for conversion is received from the terminal device, and conversion authentication is performed by the character correspondence table identified by the received correspondence table number. Characterized by comprising an authentication server including an authentication conversion means for acquiring authentication information before the conversion by the inverse transform the distribution.

  The invention according to claim 7 is the authentication system according to claim 6, wherein the correspondence table number of the character correspondence table used for converting the authentication information is received before the conversion authentication information. .

  According to an eighth aspect of the present invention, in the authentication system according to the sixth or seventh aspect, the terminal device further includes printing means for printing the received character correspondence table.

  The invention according to claim 9 is a user authentication method by an authentication server for authenticating a user who is provided with a predetermined service via a network by using authentication information provided to the user, wherein the user A character correspondence table for randomly associating characters with each other and a correspondence table transmission step for transmitting a correspondence table number for identifying the correspondence table to the terminal device, and a character correspondence table transmitted in advance. The converted conversion authentication information and the correspondence table number of the character correspondence table used to convert the authentication information are received from the terminal device, and the conversion authentication information is inversely converted by the character correspondence table identified by the received correspondence table number. And an authentication conversion step of acquiring authentication information before conversion.

  The invention according to claim 10 is a program for causing an authentication server to execute a user authentication method for authenticating a user who is provided with a predetermined service via a network using authentication information provided to the user. The authentication method includes a correspondence table transmission step of transmitting, to the terminal device, a correspondence table number for identifying a correspondence table and a correspondence table for randomly associating characters and characters, which are used by a user for inputting authentication information, via a network. The conversion authentication information converted using the character correspondence table sent in advance and the correspondence table number of the character correspondence table used for converting the authentication information are received from the terminal device, and the character identified by the received correspondence table number An authentication conversion step of reversely converting the conversion authentication information by a correspondence table to obtain authentication information before conversion.

  As described above, according to the present invention, a character correspondence table for randomly associating characters with each other and a correspondence table number for identifying the correspondence table used by the user for inputting authentication information via the network are provided to the terminal device. The correspondence table transmitting means for transmitting, the conversion authentication information converted using the character correspondence table transmitted in advance, and the correspondence table number of the character correspondence table used for converting the authentication information are received from the terminal device and received. Since it includes an authentication conversion means that reversely converts the conversion authentication information by the character correspondence table identified by the correspondence table number and obtains the authentication information before conversion, as an option for some services or some users It is possible to execute advanced authentication processing using a random number table at a lower cost or man-hour.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
(First embodiment)
FIG. 1 is a block diagram showing the entire system of this embodiment. In the present embodiment, authentication processing is executed when accessing a website providing various services via the Internet, and the method of the present invention is adopted for the processing. Any case of using and authenticating can be assumed. In the authentication process of the present embodiment, a conventional authentication process is usually used, and the process of the present invention is performed only in a predetermined case or for a predetermined user. That is, for example, a random number table is issued to users who desire higher security among users who have been given authentication information, and a user who has obtained a random number table may not use the random number table for all services, The random number table can also be used only for services that require a particularly high level of security.

  In the present embodiment, in order to explain with such an assumption, the system of the present embodiment includes a server 101 that provides services and performs an entire process of issuing authentication information such as an ID and a password, and includes authentication information for each user. A database 102 for storing various data used in the server 101 and a terminal device 103 used for a user to access a website are provided. Here, the server 101 and the terminal device 103 are connected by a network 105. The terminal device 103 may further include a printer 104 for outputting the random number table received in the present embodiment.

  Normally, when accessing the website provided by the server 101 from the terminal device 103 in such a system, the user transmits authentication information such as an ID and password from the terminal device 103 to the server 101 in order to confirm the identity of the user. If the authentication information received by the server 101 matches the authentication information stored in the database 102, it is determined whether or not to authenticate. In the present embodiment, the authentication according to the present invention is performed on the assumption of such conventional authentication. However, the present invention is not limited to this, and a system that does not need to use both an ID and a password, and other authentication information configurations are adopted. You can also. Any processing used in the present embodiment can be used for processing authentication information.

  Also in this embodiment, the authentication information is mailed together with a credit card, for example, for receiving services, or entered through the website by entering necessary information such as personal information in advance and provided via the Internet. can do.

  The overall configuration of this system is as described above, but the terminals and servers that constitute the individual systems of this embodiment must have at least the functions of a normal computer that can be connected to a network. Under such hardware conditions, the processing of the individual system of the present embodiment is executed by installing a software program on such hardware. Each software can be shown in a module configuration as shown in FIG. 2, for example, but this is merely an example, and the functions of each module are further divided into several modules or the functions of several modules are integrated. It goes without saying that modules can be envisaged. The module configuration of each individual system will be described below, but these modules are executed in cooperation with each other, and the processing of this embodiment described later is achieved.

  FIG. 2 is a block diagram showing functions mainly related to the present embodiment in the server 101 of the present embodiment. User authentication unit 201 for performing basic authentication processing, character correspondence table generation unit 202 for generating a random number table and generating a random number table number that is a correspondence table number, and correspondence table transmission for transmitting the generated random number table to the terminal device 103 The authentication conversion part 204 which reverse-converts the authentication information received from the terminal device 103 based on the part 203 and a random number table is provided.

(Server-side processing)
FIG. 3 is a flowchart illustrating an example of processing of the server according to the present embodiment. FIG. 5 is a diagram showing an example of the generated random number table, and FIG. 6 is a diagram showing an operation screen displayed on the terminal device 103 when receiving the issuance of the random number table of the present embodiment. With reference to FIGS. 3, 5, and 6, processing from generation of random number table to authentication in the present embodiment will be described. The so-called random number table is well known in this technical field. For example, as shown in FIG. 5, correspondence between numbers or characters is determined at random.

  First, when a user applies for issuance of a random number table on the screen as shown in FIG. 6, this request is transmitted from the terminal device 103 to the server 101, and the character correspondence table generating unit 202 generates a random number table (S301). , It may be generated in advance before the request comes. Since the user also inputs a desired random number on the screen shown in FIG. 6, the correspondence table transmission unit 203 assigns a random number to the generated random number table, or the random number table number input from the previously generated random number table. The random number table is selected and the random number table and the random number table number are transmitted to the terminal device 103 (S302). Here, when requesting the transmission of the random number table from the terminal device 103, the request can be made after confirming the identity in addition to the normal authentication information or in place of the normal authentication information. For example, in order for a user to obtain a random number table, after the user has reached a predetermined page by a normal authentication method using an ID and a password, the user has requested it by another identification method such as a birthday or a telephone number. Send the random number table after confirmation. By doing so, the random number table can be transmitted to the true user without being intercepted by the user who impersonated the random number table.

  When a random number table or the like is transmitted to the terminal device 103, it is output from the terminal device 103 and used to input authentication information on the terminal device side as described later. In the present embodiment, a so-called random number table is used as the character correspondence table. However, the present invention is not limited to this, and any technique known in the technical field that can associate characters and numbers can be used to achieve the present invention. Can be used. In addition, the random number table can be issued not only once but any number of times, and security can be further improved by using a random number table different from the previous one. In this case, a new random number table may be generated, or another random number table number that has already been generated can be designated and a different random number table can be transmitted. Even in such a case, when requesting the random number table, security can be improved by adding another authentication means as described above, or another different authentication information and method.

  For example, as shown in FIG. 5, first 1000 random number tables are generated, random number table numbers are assigned, random number numbers are first determined and transmitted to the terminal device 103 by an appropriate method, and then When the user switches to another random number table, a different random number table can be used if a different random number table number is designated. The new random number table is transmitted to the terminal device 103 in the same manner as the first time described above.

  As will be described later, when data obtained by converting authentication information based on the random number table and the random number table number of the used random number table are received from the terminal device 103 (S303), the authentication conversion unit 204 first uses the received random number table number. The used random number table is specified, and the converted authentication information is inversely converted to obtain the original authentication information (S304). Thereafter, the user authentication unit 201 performs user authentication (S305). In this way, the authentication information converted by the random number table on the terminal side is temporarily restored to the original authentication information on the server side, and authentication is performed using the original authentication information, so that such conversion is not performed. Although higher security can be obtained, the use of this embodiment can be expected to eliminate the need for a cost such as mailing a random number table in advance.

(Terminal processing)
Next, processing on the terminal side will be described. FIG. 4 is a flowchart showing an example of processing of the terminal device of this embodiment. 7 and 8 are diagrams showing operation screens displayed on the terminal device 103 when inputting authentication information using the random number table of the present embodiment. The authentication information conversion and transmission processing using the random number table of the present embodiment will be described with reference to FIGS.

  Referring to FIG. 4, first, in order for the user to enter a desired website, the terminal device 103 accesses the server 101 (S401), and when prompted to input authentication information, the user is sent a random number table transmitted in advance. Is used to convert the authentication information (S402). As shown in FIG. 8, the conversion is generally not required to be performed by a special calculation, and the authentication information set in advance is simply replaced with a corresponding character or number while looking at the random number table. However, the present invention is not limited to this, and any conversion method can be used.

  Next, when the converted authentication information is input while inputting the random number table number of the random number table used for the conversion as shown in FIG. 7, it is transmitted from the terminal device 103 to the server 101 (S403). Here, in the present embodiment, the random number table number of the random number table used before inputting the authentication information is registered, but this is held on the terminal side so that it does not have to be specified in particular thereafter, or There are various reasons such as preparing a random number table in advance on the server side and enabling reverse conversion of authentication information more quickly. However, the present invention is not limited to this. A table number can also be entered.

  When the authentication information and the random number table number converted in this way are transmitted, the server 103 receives them and executes authentication based on these information as described above. As a result, the terminal device 103 A desired service can be received.

  As described above, by applying the present invention in addition to a normal authentication method, security can be expected to be improved partially or entirely without cost and effort when providing a service.

(Second Embodiment)
In the present embodiment, the present invention is used in a different scene from the above-described first embodiment. In the present embodiment, for example, as shown in FIG. 9, by acquiring a random number table in advance and specifying or registering the random number table number, the number indicated in the image is further converted by the random number table. It can also be used for applications such as improving security. That is, in the first embodiment, when authentication information is transmitted to a user in advance at a company customer service site or the like, security is improved by using the method of the present invention. Even when authentication information is not sent in advance, security is improved by using the method of the present invention. Furthermore, it can also be combined with one-time password (OTP) authentication.

It is a block diagram which shows the whole system of this embodiment. It is a block diagram mainly shown about the function in the server of this embodiment mainly related to this embodiment. It is a flowchart which shows the process by the side of the server of this embodiment. It is a flowchart which shows the process by the side of the terminal device of this embodiment. It is a figure which shows an example of the random number table of this embodiment. It is a figure which shows an example of the input screen by the side of the terminal device of this embodiment. It is a figure which shows an example of the input screen by the side of the terminal device of this embodiment. It is a figure which shows an example of the input screen by the side of the terminal device of this embodiment. It is a figure which shows an example of the input screen by the side of the terminal device of this embodiment.

Explanation of symbols

101 Server 102 Database 103 Terminal Device 104 Printer 105 Network 201 User Authentication Unit 202 Character Correspondence Table Generation Unit 203 Correspondence Table Transmission Unit 204 Authentication Conversion Unit

Claims (10)

An authentication server that authenticates a user who is provided with a predetermined service via a network using authentication information provided to the user,
A correspondence table transmitting means for transmitting, to the terminal device, a character correspondence table for randomly associating characters and characters, and a correspondence table number for identifying the correspondence table, which the user uses for inputting authentication information, via the network;
The conversion authentication information converted using the character correspondence table transmitted in advance and the correspondence table number of the character correspondence table used for converting the authentication information are received from the terminal device, and the received correspondence table number is An authentication server comprising: an authentication conversion unit that reversely converts the conversion authentication information using a character correspondence table that is identified to obtain authentication information before conversion.   The authentication server according to claim 1, wherein the correspondence table number of the character correspondence table used to convert the authentication information is received before the conversion authentication information.   3. The correspondence table transmitting means performs authentication using first additional authentication information different from the provided authentication information, and transmits the character correspondence table and the correspondence table number. The listed authentication server.   The correspondence table transmission means, upon receiving a character correspondence table change request from the terminal device, transmits a changed character correspondence table different from the transmitted character correspondence table and a correspondence table number for identifying the change correspondence table. The authentication server according to claim 1, 2, or 3. The correspondence table transmitting means performs authentication using second additional authentication information different from the provided authentication information, and transmits the change character correspondence table and a correspondence table number for identifying the change correspondence table. The authentication server according to claim 4 . An authentication system for authenticating a user who is provided with a predetermined service via a network using authentication information provided to the user,
A correspondence table receiving means for receiving a character correspondence table for randomly associating characters with each other and a correspondence table number for identifying the correspondence table, which the user uses to input authentication information, and the character correspondence table; A terminal device that includes conversion authentication information obtained by converting the provided authentication information using a conversion conversion means for transmitting the correspondence table number;
Correspondence table transmission means for transmitting the character correspondence table and the correspondence table number to the terminal device via the network, the conversion authentication information and the correspondence table number of the character correspondence table used for converting the authentication information. An authentication server comprising: an authentication conversion unit that receives from the terminal device and reverse-converts the conversion authentication information by a character correspondence table identified by the received correspondence table number to obtain authentication information before conversion. An authentication system characterized by that.   The authentication system according to claim 6, wherein the correspondence table number of the character correspondence table used for converting the authentication information is received before the conversion authentication information.   The authentication system according to claim 6, wherein the terminal device further includes a printing unit that prints the received character correspondence table. A user authentication method using an authentication server that authenticates a user who is provided with a predetermined service via a network using authentication information provided to the user,
A correspondence table transmission step of transmitting, to the terminal device, a character correspondence table for randomly associating characters and characters, and a correspondence table number for identifying the correspondence table, which the user uses for inputting authentication information, via the network;
The conversion authentication information converted using the character correspondence table transmitted in advance and the correspondence table number of the character correspondence table used for converting the authentication information are received from the terminal device, and the received correspondence table number is A user authentication method comprising: an authentication conversion step of acquiring the authentication information before conversion by reversely converting the conversion authentication information using a character correspondence table to be identified. A program for causing an authentication server to execute a user authentication method for authenticating a user who is provided with a predetermined service via a network using authentication information provided to the user, the user authentication method comprising:
A correspondence table transmission step of transmitting, to the terminal device, a character correspondence table for randomly associating characters and characters, and a correspondence table number for identifying the correspondence table, which the user uses for inputting authentication information, via the network;
The conversion authentication information converted using the character correspondence table transmitted in advance and the correspondence table number of the character correspondence table used for converting the authentication information are received from the terminal device, and the received correspondence table number is An authentication conversion step of reversely converting the conversion authentication information by an identified character correspondence table to obtain authentication information before conversion.

Images