JP5315564B2 - Password registration system, method and program - Google Patents

Description

  The present invention relates to a password registration system, method, and program.

  2. Description of the Related Art Conventionally, online banking is known in which transactions are performed by connecting a computer such as a personal computer (PC) to a bank system via a communication network such as the Internet. The online banking system receives a user ID and password input from a PC by a user who performs a transaction and performs authentication, and then receives a transaction instruction and executes a transaction process. Such authentication may be performed a plurality of times within one session. Transaction processing will not occur unless the user is correctly authenticated by the online banking system. Therefore, if the user loses the password associated with the user ID, the user cannot access the online banking system, and the user requests to apply for or issue a new password corresponding to the user ID (hereinafter referred to as “ It is simply called an application for issuance.)

  There is a demand for shortening the time required from when a password is lost to when the password is actually issued. On the other hand, it is necessary to prevent issuing a password in response to an illegal password issuance application due to “spoofing” or the like.

  The present invention has been made in view of such problems, and its purpose is to prevent issuing a password in response to an unauthorized password issuance application and to shorten the time from application to issuance. It is possible to provide a password registration system, method and program.

  In the present invention, in order to achieve such an object, the password registration system combines the first character string and the second character string received from the terminal, and transposes the elements of each character string to thereby change the password. Is generated. In addition, the password registration system outputs the password notification information including the password that masks the first character string element and the transposition rule for the first character string element to notify the user of the generated password. To do.

  In one embodiment, the second string is a random number. In one embodiment, the transposition is performed based on a random permutation.

  Furthermore, in one embodiment, the password registration system outputs password notification information to a pre-registered destination.

  The present invention can provide a password registration system, method, and program capable of preventing a password from being issued in response to an unauthorized password issuance application and reducing the time from application to issuance.

It is a figure for demonstrating schematic structure of the password registration system which concerns on one Embodiment of this invention. It is a figure for demonstrating schematic structure of the password production | generation part and output part which concern on one Embodiment of this invention. It is a figure for demonstrating an example of the record in the contract information database which cooperates with the password registration system which concerns on one Embodiment of this invention, (a) And (b) each shows the state before and after registration of a password. FIG. It is a figure for demonstrating the notification example of the new password output by the password registration system which concerns on one Embodiment of this invention, (a) is a screen example in which a user inputs a part of new password, (b) ) And (c) are diagrams showing an example of a screen displaying a notification of a new password. It is a figure for demonstrating the processing flow of the password registration system which concerns on one Embodiment of this invention.

  In the present invention, the password registration system combines the first character string received from the terminal and the second character string separately generated by the system, and generates a password by transposing each character string element. . In addition, the password registration system outputs the password notification information including the password that masks the first character string element and the transposition rule for the first character string element to notify the user of the generated password. To do.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Here, an embodiment of the present invention will be described by taking as an example a corporate online banking service whose usage contract is a corporation. In online banking for corporations, information related to the administrator of the corporate contract is registered in the contract information database in advance, and it belongs to the corporation that is engaged in transactions such as inquiries and funds transfers for corporate accounts related to the contract. A user ID, a password, and the like are registered in advance as information about each person (user) who performs.

  FIG. 1 is a diagram for explaining a schematic configuration of a password registration system 20 according to an embodiment of the present invention. Also shown in FIG. 1 is an online banking system 30 having a contract information database 32.

  The password registration system 20 includes an input unit 22, a numbering unit 24, a password generation unit 26, and an output unit 28. The input unit 22, the numbering unit 24, the password generation unit 26, and the output unit 28 can be configured as a software module, a hardware module, or a module combining software and hardware.

  The input unit 22 is connected to the terminal 10 via the network 40 and has a function of receiving information transmitted from the terminal 10 such as a PC or a mobile phone as an input. The information transmitted from the terminal 10 includes a user ID and a part of a new password (that is, a predetermined number of characters or numbers included in a new password generated by the password registration system 20). In FIG. 1, a part of a new password transmitted from the terminal 10 is shown as a character string X including four numbers 1357. The terminal 10 may be a terminal operated by an online banking service provider (for example, a bank operator) that has received a request for registration of a new password from the user, in addition to a PC or a mobile phone operated by the user.

  The numbering unit 24 uses a part of a new password that is different from a part of a new password transmitted from the terminal 10 (that is, a new password generated by the password registration system 20 to a new password transmitted from the terminal 10. A predetermined number of letters or numbers included with a part). The numbering unit 24 can be configured as a random number generating unit that generates random numbers. Alternatively, the numbering unit 24 can be configured as a random number database configured to take out one from a random number table storing previously generated random numbers. In FIG. 1, a part of a new password numbered by the numbering unit 24 is shown as a character string Y including 4468 numbers.

  The password generation unit 26 generates a part of the new password (character string X = 1357) transmitted from the terminal 10 and a part of the new password (character string Y = 2468) numbered by the numbering unit 24. It has a function to combine and generate a new 8-digit password. The password generation unit 26 can be configured as a transposition processing unit having a transposition logic that changes at a predetermined time interval (for example, every hour, day, or week) or a transposition logic that changes every time. The new 8-digit password is an example, and changes the number of digits of the new password transmitted from the terminal 10 and the number of digits of the new password numbered by the numbering unit 24. Thus, a password having an arbitrary number of digits can be generated. The generated new password is stored in the contract information DB 32 in association with the user ID transmitted from the terminal 10.

  The output unit 28 has a function of generating password notification information for notifying the user of a new password generated by the password generation unit 26. Further, the output unit 28 has a function of acquiring password notification information output (destination) destination information from the contract information DB 32 and outputting the password notification information.

  On the other hand, the online banking system 30 includes a contract information database 32, an input / output unit 34, an authentication unit 36, and a transaction processing unit 38. The contract information database 32, the input / output unit 34, the authentication unit 36, and the transaction processing unit 38 can be configured as a software module, a hardware module, or a module combining software and hardware.

  The contract information database 32 is a database that stores identification information (user ID) and password (PWD) for each user in association with each other. FIG. 3 illustrates the records in the contract information database 32. As shown in FIG. 3, the contract information database 32 stores a user name, a user address, a user telephone number, a user FAX number, and a user e-mail address for each user in association with the user ID. Further, the contract information database 32 includes identification information (corporation ID) of a group (corporation) to which the user belongs, an administrator name, an administrator address, an administrator telephone number, an administrator FAX number, and an administrator e-mail about the group. Stored in association with the user.

  The input / output unit 34 is connected to the terminal 10 via the network 40 and has a function of receiving a user ID, a password, or a transaction instruction, and outputting an authentication result or a transaction result to the terminal 10.

  The authentication unit 36 has a function of authenticating a user by receiving the user ID and password input from the terminal 10 via the input / output unit 34 and inquiring to the contract information database 32.

  The transaction processing unit 38 has a function of executing a transaction instruction input from the terminal 10 via the input / output unit 34. The transaction processor 38 can be configured to cooperate with other systems, such as a billing system, to process transactions.

  FIG. 2 shows a schematic configuration of the password generation unit 26 and the output unit 28 of the password registration system 20.

  A permutation generator 262 is provided. The password generation unit 26 can also include a timer 264 that supplies time information to the permutation generation unit 262.

  The password generation unit 26 receives the character string X = 1357 from the terminal 10 and the character string Y = 2468 from the numbering unit 24 as inputs. In the present embodiment, (A) to (D) indicate letters or numbers in the first to fourth digits of the character string X, respectively.

  The permutation generator 262 generates 1 to 8 permutations and transposes characters or numbers included in the character strings X and Y. The transposed character string becomes a new password, that is, a new password for authenticating the user at the next access (hereinafter also referred to as a new password). The transposition logic of the permutation generator 262 can be configured to change according to the time information supplied from the timer 26. Alternatively, the permutation generation unit 262 can be configured to change the transposition logic randomly by using a random permutation generation unit that implements a random permutation generation algorithm. The random permutation is a permutation in which the arrangement order of r elements (r factorial number) appears at random. In FIG. 2, the numbers in [] indicate the arrangement order after transposition.

  In FIG. 2, the third digit (c) “5” of character string X is transposed to the first digit of the new password, and the first digit “2” of character string Y is the fourth digit of the new password. Has been transposed to the eyes. The new password is supplied to the contract information database 32 and the output unit 28. In the present embodiment, an example is shown in which the original order of elements in the character strings X and Y is not maintained, but the original order of elements in the character strings X and / or Y is transposed. You may do it.

  The output unit 28 includes a replacement unit 282, a password notification information generation unit 283, a printer 284, a dial / voice output unit 286, a dial / facsimile output unit 288, and an e-mail output unit 290. When a user presents identity verification information and is provided with password notification information at an online banking service provider's branch (for example, a bank counter), the operator who receives the request operates the output unit 28. The communication output unit 292 may be configured to output password notification information to the terminal.

  The replacement unit (masking unit) 282 has a function of performing masking by replacing the elements (a) to (d) of the character string X in the new password with * marks. This prevents the new password from being known by a third party other than the user who has input the character string X.

  The password notification information generation unit 283 has a function of generating password notification information for notifying the user of a new password. Here, the information notified to the user includes a new password partially masked, and the fact that elements (a) to (e) of the character string input by the user are entered in the masked portion. The password notification information generation unit 283 generates password notification information in a format such as an image data file, an HTML file, or a VoiceXML file.

  FIG. 4A shows an example of an input screen when the user inputs the character string X, and FIGS. 4B and 4C show examples of display of password notification information, respectively. FIG. 4C is a display example of password notification information when the permutation generating unit 262 is configured to transpose while maintaining the original order of the elements (A) to (D) in the character string X. is there.

  Referring again to FIG. 2, the password notification information, together with the output destination (destination) information acquired from the contract information database 32, the printer 284, dial / voice output unit 286, dial / facsimile output unit 288, and e-mail output unit 290 is provided to at least one of the 290s to notify the user. For example, the output unit 28 acquires the address of the user or administrator registered in advance as the output destination (destination) information of the password notification information, and supplies it to the printer 284 or a telegram system (not shown) together with the password notification information. Thus, the password notification information can be output in a form suitable for sending by mail or telegram. Alternatively, the output unit 28 acquires the telephone number or facsimile number of the user or administrator from the contract information DB 32 as the output destination of the password notification information, and the dial / voice output unit 286 or the dial / facsimile output unit 288 together with the password notification information. The password notification information may be output in a form suitable for being sent by voice or facsimile. As a further alternative, the output unit 28 acquires the user or administrator's e-mail address as the output destination of the password notification information from the contract information DB 32, and supplies it to the e-mail output unit 290 together with the password notification information. You may comprise so that it may output in the form of mail. In any case, the output unit 28 obtains information related to the user or information registered in advance from the contract information DB 32, and outputs the password notification information by using this as the output destination of the password notification information. By using an address or the like registered in advance in association with the user as an output destination (destination), it is possible to prevent a password from being changed by a third party impersonation.

  An example of password registration processing in the password registration system will be described with reference to FIG.

  In step S102, the input unit 22 receives a user ID (for example, 12345567890) and a part of the new password (character string X = 1357) from the terminal 10 via the network 40.

  In step S104, the numbering unit 24 numbers a part of the new password (character string Y = 2468).

  In step S106, the password generation unit 26 combines and transposes a part of the new password (character string X) received by the input unit 22 and a part of the new password (character string Y) numbered by the numbering unit 24. A new password (57821463) is generated.

  In step S <b> 108, the generated new password is stored in the contract information database 32 in association with the user ID received by the input unit 22. FIGS. 3A and 3B show states before and after re-registration of the user password associated with the user ID = 1345567890.

  In step S110, the output unit 28 outputs the generated new password.

More specifically, in step S112, the replacement unit 282 masks a part of the new password, and in step S114, the password notification information generation unit 283 inputs the partly masked new password and the masked portion by the user. Password notification information including the fact that the elements (a) to (d) of the character string entered are generated. In step S116, the output unit 28 acquires information on the output destination (destination) from the contract information database 32. In step S118 , the printer 284, the dial / voice output unit 286, the dial / facsimile output unit 288, and the e-mail output unit. At least one of 290 outputs password notification information.

  The embodiment of the present invention has been described above by taking the corporate online banking service as an example, but the present invention can also be applied to an online banking service for individuals. Further, the present invention is not limited to the online banking service, but can be applied to other services that perform password authentication.

10 terminal 20 password registration system 22 input unit 24 numbering unit (random number generator)
26 Password generation part (transposition processing part)
262 Permutation generator (random permutation generator)
H.264 Timer 28 Output unit 282 Replacement unit 283 Password notification information generation unit 30 Online banking system 32 Contract information database 34 Input / output unit 36 Authentication unit 38 Transaction processing unit 40, 42 Network

Claims (15)

A password registration system for registering user passwords,
Means for receiving a user identifier and a first character string from a terminal;
A character string generating means for generating a second character string;
Password generating means for generating a password by transposing elements of the first character string and the second character string, and recording the password in association with the user identifier;
Output means for outputting password notification information including a password masking the element of the first character string and the transposition rule for the element of the first character string to notify the user of the generated password And a password registration system comprising:   2. The password registration system according to claim 1, wherein the output unit outputs the password notification information to a destination related to the user registered in advance in the storage unit.   The password registration system according to claim 1, wherein the password generation unit includes a transposition logic that changes at a predetermined time interval.   The password registration system according to claim 1, wherein the password generation unit includes a random permutation generation unit, and the transposition is performed based on a random permutation. The output means includes
Masking means for masking an element of the first character string included in the password;
And a password notification information generating means for generating password notification information including a password masking the first character string element and the transposition rule for the first character string element. Item 5. A password registration system according to items 1 to 4. A method for registering a user password in a password registration system,
The input means receives the user identifier and the first character string from the terminal;
The character string generation means generates a second character string;
Password generating means transposes the elements of the first character string and the second character string to generate a password;
The password generation means records the generated password in association with the user identifier in a storage means;
In order for the output means to notify the user of the generated password, password notification information including a password masking the element of the first character string and the transposition rule for the element of the first character string A method comprising: outputting.   7. The method according to claim 6, wherein outputting the password notification information includes outputting the password notification information to a destination associated with the user registered in advance in the storage unit. .   The method according to claim 6, wherein generating the password includes changing the transposition rule by a predetermined time interval. The password generation means includes random permutation generation means,
Generating the password The method of claim 6 wherein said password generating means, the transposition, characterized in that it includes performing on the basis of the random permutation.
The output means includes a masking means and a password notification information generating means,
Outputting the password notification information includes:
Masking means masks an element of the first character string included in the password;
The password notification information generating means includes generating a password notification information including a password masking the element of the first character string and the transposition rule for the element of the first character string. The method according to claim 6. A program for registering user passwords,
Means for receiving a user identifier and a first character string from a terminal;
A character string generating means for generating a second character string;
Password generating means for generating a password by transposing elements of the first character string and the second character string, and recording the password in association with the user identifier;
Output means for outputting password notification information including a password masking the element of the first character string and the transposition rule for the element of the first character string to notify the user of the generated password A program characterized by functioning as a program.   The program according to claim 11, wherein the output unit outputs the password notification information to a destination associated with the user registered in advance in the storage unit.   The program according to claim 11, wherein the password generation unit has a transposition logic that changes at a predetermined time interval.   The program according to claim 11, wherein the password generation unit includes a random permutation generation unit, and the transposition is performed based on a random permutation. The output means includes
Masking means for masking an element of the first character string included in the password;
And a password notification information generating means for generating password notification information including a password masking the first character string element and the transposition rule for the first character string element. Item 15. The program according to items 11 to 14.

Images