JP6048210B2 - Information processing apparatus and program - Google Patents

Description

  The present invention relates to an information processing apparatus and a program.

  In recent years, various authentication methods have been used. For example, PIN authentication is widely used in automated teller machines (ATMs) of banks. In addition, in Internet banking transactions, random number table authentication is used in addition to PIN authentication.

  In addition, biometric authentication (or biometric authentication) is also used to increase security. Examples of biometric authentication include face authentication, voice authentication, fingerprint authentication, iris authentication, signature authentication (handwriting authentication), and the like.

  In addition, a technique for combining a plurality of authentication methods to further increase security has been proposed. For example, Patent Literature 1 and Patent Literature 2 disclose a technique for authenticating a user when both password authentication and biometric authentication are successful.

JP 2007-48118 A JP 2007-164423 A

  However, according to the techniques disclosed in Patent Document 1 and Patent Document 2, security is improved, but input is required for each authentication of a plurality of authentication methods, which increases labor for the user. On the other hand, when a smaller number of authentication methods (for example, one authentication method) is used, the security is eventually lowered.

  For example, when one authentication method is used, if authentication data for the authentication (for example, a personal identification number, biometric authentication data, etc.) is stolen, usually unauthorized authentication is not performed. Thus, the authentication is prohibited. Therefore, in such a case, the user cannot use various services that require the authentication while the authentication is prohibited. That is, the convenience for the user is lowered.

  Therefore, it is desirable to provide a mechanism that can enhance user convenience while enhancing security in authentication.

  According to the present invention, an acquisition unit that acquires user authentication information for authentication based on a selected authentication method among a plurality of authentication methods each having a usable number of times set, and using the authentication information, And an authentication unit that performs authentication based on the selected authentication method. When a user authentication condition including that the number of usable times set for the authentication based on the selected authentication method is not exhausted and that the authentication based on the selected authentication method is successful is satisfied The user is authenticated. Further, at least when the user is authenticated, the number of usable times set in the selected authentication method is reduced.

  The plurality of authentication methods may include at least one biometric authentication method.

  The usable number of times set for each of the plurality of authentication methods is set by issuing the same number of one-time passwords as the usable number of times, and the selected authentication of the user authentication conditions is set. The fact that the available number of times set for the authentication based on the method is not exhausted means that any one-time password issued for the selected authentication method can be used, and the user authentication condition Includes successful one-time password authentication by using a one-time password issued for the selected authentication method, and at least if the user is authenticated, for the selected authentication method. The one-time password issued on may be disabled.

  In addition, even when the user is not authenticated, the one-time password issued for the selected authentication method may be disabled.

  In addition, when the one-time password authentication succeeds by using the one-time password issued for the selected authentication method and the authentication based on the selected authentication method fails, the selected authentication method The one-time password issued for the purpose may be disabled.

  In addition, when a one-time password issued for an authentication method different from the selected authentication method is used in the one-time password authentication, the one-time password issued for the other authentication method is used. The password may be disabled.

  The one-time password may be a transaction authentication number, and the one-time password authentication may be authentication based on a transaction authentication number.

  In addition, according to the present invention, the display control unit that causes the display device to display a screen for selecting the authentication method according to the user operation from among the plurality of authentication methods in which the number of times of use can be set, An acquisition unit that acquires user authentication information for authentication based on a selected authentication method among the plurality of authentication methods; and another authentication unit that performs authentication based on the selected authentication method using the authentication information A program for causing the apparatus to function as a providing unit that provides the authentication information is provided. When a user authentication condition including that the number of usable times set for the authentication based on the selected authentication method is not exhausted and that the authentication based on the selected authentication method is successful is satisfied The user is authenticated. Further, at least when the user is authenticated, the available number of times set for the selected authentication method decreases.

  In addition, according to the present invention, an information processing apparatus is provided that includes a setting unit that sets the number of usable times for each of a plurality of authentication methods when a predetermined condition is satisfied. Authentication based on the selected authentication method is performed using user authentication information for authentication based on the selected authentication method among the plurality of authentication methods. Further, a user authentication condition including that the number of usable times set for the authentication based on the selected authentication method is not exhausted and the authentication based on the selected authentication method is successful is satisfied. If so, the user is authenticated. Further, at least when the user is authenticated, the available number of times set for the selected authentication method decreases.

  In addition, the setting unit may set the usable number of times for each of the plurality of authentication methods when the predetermined condition is satisfied in response to a request from the user terminal device.

  The predetermined condition may include that the user or the terminal device is located within a predetermined area.

  The predetermined condition may include that the time is within a predetermined period.

  In addition, the predetermined condition may include success of predetermined authentication for setting a usable number of times for each of the plurality of authentication methods.

  Further, the setting unit sets the number of usable times set for each of the plurality of authentication methods by issuing the same number of one-time passwords as the number of usable times, and among the user authentication conditions, The fact that the number of usable times set for the authentication based on the selected authentication method is not exhausted means that any one-time password issued for the selected authentication method can be used. The user authentication condition includes that the one-time password authentication is successful by using the one-time password issued for the selected authentication method, and is selected if at least the user is authenticated. The one-time password issued for the authentication method may become unusable.

  Further, even when the user is not authenticated, the one-time password issued for the selected authentication method may be disabled.

  Further, when the one-time password authentication succeeds by using the one-time password issued for the selected authentication method and the authentication based on the selected authentication method fails, the selected authentication method The one-time password issued for the purpose may be disabled.

  In addition, when a one-time password issued for an authentication method different from the selected authentication method is used in the one-time password authentication, the one-time password issued for the another authentication method is used. The password may be disabled.

The one-time password is a transaction authentication number,
The one-time password authentication may be authentication using a transaction authentication number.

  According to the present invention, the computer is another device that sets the number of times of use for each of the plurality of authentication methods when a predetermined condition is satisfied, and the same number of one-time passwords as the number of times of use can be set A receiving unit that receives the issued one-time password from the other device that sets the usable number of times by issuing the issued one-time password, and any one of the issued one-time passwords A program for functioning as a providing unit that provides to another apparatus that performs one-time password authentication for a time password is provided. Authentication based on the selected authentication method is performed using user authentication information for authentication based on the selected authentication method among the plurality of authentication methods. In addition, any one-time password issued for the selected authentication method can be used, and the one-time password issued for the selected authentication method is provided to the other device. The user is authenticated when a user authentication condition including that the one-time password authentication is successful by using the one-time password and that the authentication based on the selected authentication method is successful is satisfied. The Further, at least when the user is authenticated, the one-time password issued for the selected authentication method becomes unusable.

  As described above, according to the present invention, it is possible to enhance user convenience while enhancing security in authentication.

It is explanatory drawing which shows an example of the schematic structure of the information processing system which concerns on 1st Embodiment. It is a block diagram which shows an example of a structure of the authentication server which concerns on 1st Embodiment. It is explanatory drawing for demonstrating an example of the transaction authentication number (TAN) issued for each of a some authentication system. It is explanatory drawing for demonstrating an example of the consumption result of TAN issued for each of a some authentication system. It is a block diagram which shows an example of a structure of the terminal device which concerns on 1st Embodiment. It is explanatory drawing for demonstrating an example of the authentication screen for selecting a PIN code authentication system. It is explanatory drawing for demonstrating an example of the authentication screen for selecting a random number table authentication system. It is explanatory drawing for demonstrating an example of the authentication screen for selecting a signature authentication system. It is explanatory drawing for demonstrating an example of the authentication screen for selecting a face authentication system. It is explanatory drawing for demonstrating an example of the authentication screen for selecting a voice authentication system. It is a flowchart which shows an example of the schematic flow of the information processing of the terminal device which concerns on 1st Embodiment. It is a flowchart which shows an example of the schematic flow of the information processing of the authentication server which concerns on 1st Embodiment. It is explanatory drawing which shows an example of the schematic structure of the information processing system which concerns on 2nd Embodiment. It is a block diagram which shows an example of a structure of the authentication server which concerns on 2nd Embodiment. It is a block diagram which shows an example of a structure of the terminal device which concerns on 2nd Embodiment. It is a block diagram which shows an example of a structure of the one-time ID management server which concerns on 2nd Embodiment. It is a block diagram which shows an example of a structure of the TAN issuing server which concerns on 2nd Embodiment. It is a flowchart which shows an example of the schematic flow of the information processing of the one-time ID management server which concerns on 2nd Embodiment. It is a flowchart which shows an example of the schematic flow of the information processing of the TAN issuing server which concerns on 2nd Embodiment. It is a block diagram which shows an example of the hardware constitutions of the authentication server which concerns on 1st Embodiment and 2nd Embodiment. It is a block diagram which shows an example of the hardware constitutions of the terminal device which concerns on 1st Embodiment and 2nd Embodiment.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, in this specification and drawing, about the component which has the substantially same function structure, duplication description is abbreviate | omitted by attaching | subjecting the same code | symbol.

  Thereafter, << 1. First Embodiment >>, << 2. Second Embodiment >>, << 3. Embodiments of the present invention will be described in the order of hardware configuration >>.

<< 1. First Embodiment >>
First, a first embodiment of the present invention will be described with reference to FIGS. Hereinafter, the first embodiment of the present invention is described in <1.1. Schematic configuration of information processing system>, <1.2. Configuration of authentication server>, <1.3. Configuration of terminal device>, <1.4. The process will be described in the order of process flow>.

<1.1. Schematic configuration of information processing system>
With reference to FIG. 1, a schematic configuration of an information processing system 1-1 according to the first embodiment will be described. FIG. 1 is an explanatory diagram illustrating an example of a schematic configuration of an information processing system 1-1 according to the first embodiment. Referring to FIG. 1, the information processing system 1-1 includes an authentication server 100-1 and a terminal device 200-1. The authentication server 100-1 and the terminal device 200-1 communicate with each other via the network 90.

  The authentication server 100-1 authenticates the user 80. In particular, the authentication server 100-1 performs authentication based on an authentication method selected from a plurality of authentication methods. For example, an authentication method is selected from the plurality of authentication methods in the terminal device 200-1, and authentication information of the user 80 for the authentication method is provided from the terminal device 200-1 to the authentication server 100-1. . Then, the authentication server 100-1 performs authentication based on the selected authentication method using the authentication information.

  Further, for example, the authentication server 100-1 performs post-authentication processing when the user 80 is authenticated. The post-authentication process is a process based on pre-authentication, such as payment processing, billing processing, and network access permission.

  The terminal device 200-1 is a device used by the user 80. In particular, the terminal device 200-1 displays a screen for selecting an authentication method from a plurality of authentication methods according to the operation of the user 80. Also, the terminal device 200-1 acquires authentication information of the user 80 for authentication based on the selected authentication method, and provides the authentication information to the authentication server 100-1.

  According to the first embodiment, it is possible to improve the convenience of the user 80 while enhancing the security in the authentication of the user 80. Thereafter, <1.2. Configuration of authentication server>, <1.3. Configuration of terminal device> and <1.4. The specific contents of the processing flow> will be described.

<1.2. Configuration of authentication server>
An example of the configuration of the authentication server 100-1 according to the first embodiment will be described with reference to FIGS. FIG. 2 is a block diagram illustrating an example of the configuration of the authentication server 100-1 according to the first embodiment. Referring to FIG. 2, the authentication server 100-1 includes a communication unit 110, a storage unit 120, and a control unit 130.

(Communication unit 110)
The communication unit 110 communicates with other devices. For example, the communication unit 110 communicates with the terminal device 200-1 via the network 90.

(Storage unit 120)
The storage unit 120 stores a program and data for the operation of the authentication server 100-1.

  For example, the storage unit 120 stores information for performing authentication based on individual authentication methods of a plurality of authentication methods. For example, in the authentication, pre-registration data (for example, personal identification number, information on characteristics of biological information, etc.) to be compared with input authentication data (for example, personal identification number, biological information) is stored.

  Further, for example, the storage unit 120 stores a one-time password issued for each authentication method of a plurality of authentication methods. For example, the one-time password is a transaction authentication number (TAN). That is, the storage unit 120 stores a TAN issued for each authentication method of a plurality of authentication methods. The TAN is stored for each user 80 in the storage unit 120. In other words, the TAN is stored in association with the user 80.

(Control unit 130)
The control unit 130 provides various functions of the authentication server 100-1. The control unit 130 includes an information acquisition unit 131, a TAN authentication unit 133, a main authentication unit 135, and a post-authentication processing unit 137.

(Information acquisition unit 131)
The information acquisition unit 131 acquires authentication information of the user 80 for authentication based on the authentication method selected from the plurality of authentication methods. For example, an authentication method is selected from the plurality of authentication methods in the terminal device 200-1, and authentication information of the user 80 for the authentication method is provided to the authentication server 100-1 by the terminal device 200-1. Then, the information acquisition unit 131 acquires the authentication information via the communication unit 110.

  The plurality of authentication methods include, for example, at least one biometric authentication method. For example, the at least one biometric authentication method includes a face authentication method, a voice authentication method, a fingerprint authentication method, an iris authentication method, or a signature authentication (handwriting authentication) method. As an example, the plurality of authentication methods include a password authentication method, a random number table authentication method, a signature authentication method (handwriting authentication method), a face authentication method, and a voice authentication method. The plurality of authentication methods may further include other authentication methods such as a password authentication method, an iris authentication method, and a card authentication method.

  The authentication information includes, for example, user identification information for identifying the user 80 (hereinafter referred to as “user ID”). The authentication information includes authentication data in a format corresponding to the selected recognition method. As an example, when the selected authentication method is a password authentication method, the authentication data is the number data acquired as the password in the terminal device 200 (that is, the number input as the password by the user 80). Data). As another example, when the selected authentication method is a face authentication method, the authentication data is captured image data of the face of the user 80 (or facial feature data extracted from the captured image data). ). The authentication information also includes, for example, authentication method identification information (hereinafter referred to as “authentication method ID”) for identifying the selected recognition method.

  In each of the plurality of authentication methods, a usable number of times is set. That is, each authentication method (for example, a password authentication method, a face authentication method, etc.) can be used as many times as possible. For example, the number of usable times is set by issuing the same number of one-time passwords as the number of usable times. More specifically, the one-time password is, for example, a transaction authentication number (TAN). Further, as an example, for each of the plurality of authentication methods, five usage times are set by issuing five TANs. Hereinafter, a specific example of this point will be described with reference to FIG.

  FIG. 3 is an explanatory diagram for explaining an example of a transaction authentication number (TAN) issued for each of a plurality of authentication methods. Referring to FIG. 3, a password authentication method, a random number table authentication method, a signature authentication method, a face authentication method, and a voice authentication method are described as a plurality of authentication methods. And five TANs issued for each of these authentication schemes are shown. For example, five TANs, TAN-1 to TAN-5, are issued for the password authentication method. Also, five TANs of TAN-6 to TAN-10 are issued for the random number table authentication method. In this way, five TANs are issued for each authentication method, and as a result, 25 TANs are issued. Thereby, each authentication method can be used only five times. For example, the password authentication method can be used by using one of TAN-1 to TAN-5. The specific mechanism of the number of times of use will be described in detail later.

  For example, the information acquisition unit 131 acquires password data for one-time password authentication. As described above, for example, the one-time password is TAN, and in this case, the one-time password authentication is authentication by TAN. That is, the information acquisition unit 131 acquires number data for authentication by TAN. More specifically, for example, the terminal device 200-1 acquires number data (number data) input as TAN by the user 80, for example, and provides the number data to the authentication server 100-1. Then, the information acquisition unit 131 acquires the number data provided by the terminal device 200-1 via the communication unit 110.

  As described above, for example, the information acquisition unit 131 acquires authentication information including a user ID, an authentication method ID, and authentication data, and number data (or password data). Then, the information acquisition unit 131 provides the acquired authentication information to the main authentication unit 135. Further, the information acquisition unit 131 provides the TAN authentication unit 133 with the user ID and authentication method ID of the acquired authentication information and the acquired number data (or password data).

(TAN authentication unit 133)
The TAN authentication unit 133 performs one-time password authentication using the acquired password data. As described above, for example, the one-time password is TAN, and in this case, the one-time password authentication is authentication by TAN. That is, the TAN authenticating unit 133 performs authentication by TAN using the acquired number data.

  Specifically, for example, the TAN authentication unit 133 is provided with a user ID, an authentication method ID, and number data by the information acquisition unit 131. Then, the TAN authenticating unit 133 acquires, from the storage unit 120, the TAN issued for the authentication method identified from the authentication method ID among the TANs of the user 80 identified from the user ID. As an example, referring again to the example of FIG. 3, when the face authentication method is identified from the authentication method ID, the TAN authentication unit 133 acquires TAN-16 to TAN-20 from the storage unit 120. Then, the TAN authenticating unit 133 compares the number data with TAN16 to TAN-20. As a result, if the number data matches any one of TAN16 to TAN-20, authentication by TAN is successful. If the number data does not match any of TAN16 to TAN-20, authentication by TAN fails.

  As described above, the TAN authenticating unit 133 performs authentication by TAN. Then, the TAN authenticating unit 133 notifies the main authenticating unit 135 of the authentication result (success or failure).

  For example, when the authentication by TAN is successful, the TAN used for the authentication becomes unusable. That is, each TAN can be used only once. For example, the TAN that has become unusable is deleted from the storage unit 120, for example. In this way, the issued TAN is consumed every time authentication by the TAN is successful.

(Main authentication unit 135)
The main authentication unit 135 performs authentication based on the selected authentication method using the authentication information.

  Specifically, for example, the main authentication unit 135 is provided with authentication information including a user ID, an authentication method ID, and authentication data by the information acquisition unit 131. Then, the main authentication unit 135 performs authentication based on the authentication method (that is, the selected authentication method) identified from the authentication method ID in the pre-registration data for authentication of the user 80 identified from the user ID. Get pre-registration data for As an example, when the selected authentication method is a password authentication method, the main authentication unit 135 acquires number data registered in advance. As another example, when the selected authentication method is a face authentication method, the main authentication unit 135 acquires face feature data registered in advance. Then, the main authentication unit 135 performs authentication based on the selected authentication method using the authentication data included in the authentication information and the acquired pre-registration data. As an example, the main authentication unit 135 compares authentication data (or data obtained from the authentication data) with the pre-registration data. If these data are matched, the authentication based on the selected authentication method succeeds, and if these data do not match, the authentication based on the selected authentication method fails.

  As described above, the main authentication unit 135 performs authentication based on the selected authentication method.

  Further, for example, the main authentication unit 135 performs authentication based on the selected authentication method when authentication by TAN (or password authentication) succeeds, and selects when authentication by TAN (or password authentication) fails. Authentication based on the specified authentication method is not performed.

-About user authentication The user 80 is authenticated when a user authentication condition is satisfied. Further, the user 80 is not authenticated when the user authentication condition is not satisfied.

  The user authentication condition includes success of authentication based on the selected authentication method. In other words, when the authentication based on the selected authentication method fails, the user authentication condition is not satisfied and the user is not authenticated.

  The user authentication condition further includes that the number of usable times set for the authentication based on the selected authentication method is not exhausted. As described above, for example, the number of usable times is set by issuing the same number of one-time passwords (for example, TAN) as the number of usable times. In this case, the fact that the usable number of times set for the authentication based on the selected authentication method of the user authentication conditions is not exhausted is that any of the user authentication conditions issued for the selected authentication method. One-time password (for example, TAN) can be used. As an example, if the selected authentication scheme is a PIN authentication scheme and the number of usable TANs issued for the PIN authentication scheme is 1, any of those issued for the PIN scheme Can be used (the number of times of use is not exhausted). As another example, if the selected authentication scheme is a PIN authentication scheme and the number of TANs issued and usable for the PIN authentication scheme is 0, any of those issued for the PIN scheme It can be said that the TAN is not usable (the number of usable times is exhausted).

  Further, for example, the user authentication condition includes that the one-time password authentication is successful by using the one-time password issued for the selected authentication method. As described above, for example, the one-time password is TAN, and the one-time password authentication is authentication by TAN. That is, the user authentication condition includes that the authentication by TAN is successful by using the TAN issued for the selected authentication method. In other words, when the authentication by TAN fails, the user authentication condition is not satisfied and the user is not authenticated.

  As described above, the user authentication condition is, for example, that any TAN issued for the selected authentication method can be used, and the TAN issued for the selected authentication method can be used. This includes successful authentication by TAN through use, and successful authentication based on the selected authentication method. As described above, if any TAN issued for the selected authentication method is not usable, the use of the TAN does not succeed in authentication by the TAN. In consideration of this point, the user authentication condition is that authentication by the TAN is successful by using the TAN issued for the selected authentication method, and that authentication based on the selected authentication method is successful. Including. Therefore, for example, when the authentication by TAN is successful and the authentication based on the selected authentication method is successful, the user 80 is authenticated.

  When the one-time password authentication (for example, authentication by TAN) is successful and the authentication based on the selected authentication method is successful, the main authentication unit 135 notifies the post-authentication processing unit 137 that the user has been authenticated. .

-Consumption of one-time password (for example, TAN) When at least the user 80 is authenticated, the number of usable times set in the selected authentication method decreases. Specifically, for example, as described above, the number of usable times is set by issuing the same number of one-time passwords (for example, TAN) as the number of usable times, and at least when the user 80 is authenticated, Of the one-time passwords issued for the selected authentication scheme (eg, TAN), the used one is disabled. As a result, the number of usable times decreases.

  Specifically, for example, when a TAN is issued as in the example shown in FIG. 3, the selected authentication method is a password authentication method, and authentication by TAN succeeds by using TAN-2. . Further, the authentication based on the password authentication method is successful, the user authentication condition is satisfied, and as a result, the user is authenticated. In such a case, TAN-2 becomes unusable.

  In this way, the number of times that the user can use is reduced at least when the user is authenticated. For example, a one-time password (eg, TAN) becomes unusable at least when the user is authenticated. Thereby, even if correct authentication data for a certain authentication method is leaked (for example, even if the authentication data is stolen), the number of unauthorized authentications due to the use of the authentication data can be limited. As a result, the influence of unauthorized authentication can be suppressed. That is, security can be improved.

  Also, for example, even when the user 80 is not authenticated, the one-time password (for example, TAN) issued for the selected authentication method becomes unusable.

  As an example, one-time password authentication (eg, authentication by TAN) succeeds by using a one-time password (eg, TAN) issued for the selected authentication method, and authentication based on the selected authentication method fails. In this case, the used one-time password issued for the selected authentication method becomes unusable.

  Specifically, for example, when a TAN is issued as in the example shown in FIG. 3, the selected authentication method is the face authentication method, and the use of TAN-19 succeeds in the authentication by the TAN. Further, the authentication based on the face authentication method fails, the user authentication condition is not satisfied, and as a result, the user is authenticated. Even in such a case, TAN-19 becomes unusable.

  Thus, one-time password authentication (for example, authentication by TAN) is performed by using a one-time password (for example, TAN) issued for the selected authentication method, regardless of the result of authentication based on the selected authentication method. ) Succeeds, the one-time password is disabled. As a result, it is possible to limit the number of times that each authentication method can be authenticated. As a result, it is possible to suppress the number of times that a third party user is illegally authenticated due to an unauthorized authentication attempt.

  As another example, when a one-time password issued for an authentication method different from the selected authentication method is used in the one-time password authentication, it is issued for the other authentication method. The one-time password may be disabled.

  Specifically, for example, when a TAN is issued as in the example shown in FIG. 3, the selected authentication method is the face authentication method. For authentication by TAN, the authentication method is different from the face authentication method. The TAN-21 issued for the voice authentication method, which is the authentication method of, is used. Even in such a case, the TAN 21 may become unusable. In this case, for example, authentication by TAN fails.

  As described above, when a one-time password (for example, TAN) issued for an authentication method different from the selected authentication method is used, the one-time password becomes unusable. For this reason, if the selection of the TAN or the authentication method is wrong, the one-time password becomes unusable. As a result, unauthorized authentication attempts can be further limited. And it can suppress that the user who is a 3rd party is unauthorizedly authenticated by the unauthorized authentication trial.

  For example, as described above, a one-time password (for example, TAN) becomes unusable. Then, the TAN that has become unusable is deleted from the storage unit 120, for example. In this way, a one-time password is consumed. Hereinafter, a specific example of such TAN consumption will be described with reference to FIG.

  FIG. 4 is an explanatory diagram for explaining an example of a consumption result of a transaction authentication number (TAN) issued for each of a plurality of authentication methods. Referring to FIG. 4, as in FIG. 3, as a plurality of authentication methods, a password authentication method, a random number table authentication method, a signature authentication method, a face authentication method, and a voice authentication method are described. In addition, usable TANs among TANs issued for each of these authentication methods are shown. That is, in the example shown in FIG. 4, TAN-2, TAN-3 and TAN-5 for the password authentication method among the TANs issued as shown in FIG. 3, and for the face authentication method. TAN-16 and TAN-19, and TAN-21 and TAN-22 for the voice authentication method are disabled. As described above, as a result of consuming TAN, the number of times the code number authentication method, the face authentication method, and the voice authentication method can be used decreases to 2, 3, and 3, respectively.

(Post-authentication processing unit 137)
When the user is authenticated, the post-authentication processing unit 137 executes post-authentication processing. The post-authentication process is a process based on pre-authentication, for example, billing process, settlement process, and network access permission.

  For example, the post-authentication processing unit 137 executes the post-authentication process when the main authentication unit 135 notifies that the user has been authenticated.

<1.3. Configuration of terminal device>
An example of the configuration of the authentication terminal device 200-1 according to the first embodiment will be described with reference to FIGS. FIG. 5 is a block diagram illustrating an example of a configuration of the terminal device 200-1 according to the first embodiment. Referring to FIG. 5, the terminal device 200-1 includes a communication unit 210, an input unit 220, an imaging unit 230, a sound collection unit 240, a display unit 250, a storage unit 260, and a control unit 270.

(Communication unit 210)
The communication unit 210 communicates with other devices. For example, the communication unit 210 communicates with the authentication server 100-1 via the network 90.

(Input unit 220)
The input unit 220 acquires input information according to a user operation. For example, the input unit 220 acquires touch position information in response to a touch operation on the touch panel. Further, for example, the input unit 220 acquires input information in response to an operation on another input device. Then, the input unit 220 provides the acquired input information to the control unit 270.

(Imaging unit 230)
The imaging unit 230 generates a captured image. For example, the imaging unit 230 captures a subject (for example, the face of the user 80), thereby generating a captured image in which the subject is captured. Then, the imaging unit 230 provides the generated captured image to the control unit 270.

(Sound Collection Unit 240)
The sound collection unit 240 collects sounds around the terminal device 200-1. For example, the sound collection unit 240 collects the voice of the user 80 of the terminal device 200-1. Then, the sound collection unit 240 provides the sound collection result (that is, sound data) to the control unit 270.

(Display unit 250)
The display unit 250 displays a screen to be shown to the user 80 of the terminal device 200-1. The display unit 250 displays a screen according to control by the control unit 270 (display control unit 271).

(Storage unit 260)
The storage unit 260 stores a program and data for the operation of the terminal device 200-1. For example, the storage unit 260 stores identification information (that is, a user ID) for identifying the user 80 of the terminal device 200-1.

(Control unit 270)
The control unit 270 provides various functions of the terminal device 200-1. For example, the control unit 270 provides the various functions described above by executing a program stored in the storage unit 260 or another storage medium. The control unit 270 includes a display control unit 271, a TAN acquisition unit 273, an authentication method selection unit 275, an authentication information acquisition unit 277, and an information provision unit 279.

(Display control unit 271)
The display control unit 271 controls display by the display device (that is, the display unit 250). That is, the display control unit 271 causes the display unit 250 to display a screen for showing to the user.

  In particular, the display control unit 271 displays a screen (hereinafter referred to as an “authentication screen”) for selecting an authentication method according to a user operation from a plurality of authentication methods in which the number of usable times is set. To display. Further, for example, the authentication screen is a screen for acquiring a TAN according to a user operation, and is also a screen for acquiring authentication data used for authentication based on the selected authentication method. Hereinafter, specific examples of the authentication screen will be described with reference to FIGS.

  FIG. 6 is an explanatory diagram for explaining an example of an authentication screen for selecting a password authentication method. Referring to FIG. 6, an authentication screen 50A is shown. The authentication screen 50A includes a TAN display portion 51 on which a TAN input in response to a user operation is displayed, an individual authentication method portion 53A that differs depending on the selected authentication method, and a determination button 55 for determining authentication data. A switching button 57 for switching to an authentication screen of another authentication method is included.

  The user 80 inputs a number as TAN using a touch panel or another input device. As an example, the user 80 inputs a number while viewing the paper on which the issued TAN is described. Then, the input number is displayed on the TAN display portion 51.

  Further, the user 80 inputs a personal identification number by touching a soft key included in the individual authentication method portion 53A. As a result, the entered personal identification number or the personal identification number input status (for example, how many characters have been entered) are displayed in the individual authentication method portion 53A.

  Further, the user 80 touches the authentication button 55 to determine the TAN, the authentication method, and the authentication data. As a result, the password authentication method is selected as the authentication method, and TAN and authentication data (number data) are acquired.

  Further, the user 80 switches the authentication screen to an authentication screen for selecting another authentication method by touching the switching button 57.

  FIG. 7 is an explanatory diagram for explaining an example of an authentication screen for selecting a random number table authentication method. Referring to FIG. 7, an authentication screen 50B is shown. The authentication screen 50B includes a TAN display part 51, an individual authentication method part 53B, a determination button 55, and a switching button 57. The TAN display portion 51 and the switching button 57 are as described above with reference to FIG.

  The user 80 selects each frame included in the individual authentication method portion 53B and inputs a number corresponding to the frame. This input is performed, for example, by pressing a hardware button or a software button displayed on the authentication screen 50B. As a result, the input number or the input status of the number (for example, how many characters have been input) is displayed in each frame of the individual authentication method portion 53B.

  Further, the user 80 touches the authentication button 55 to determine the TAN, the authentication method, and the authentication data. As a result, the random number table authentication method is selected as the authentication method, and TAN and authentication data (numeric data) are acquired.

  FIG. 8 is an explanatory diagram for explaining an example of an authentication screen for selecting a signature authentication method. Referring to FIG. 8, an authentication screen 50C is shown. The authentication screen 50C includes a TAN display portion 51, an individual authentication method portion 53C, a determination button 55, and a switching button 57. The TAN display portion 51 and the switching button 57 are as described above with reference to FIG.

  The user 80 signs the frame included in the individual authentication method portion 53C with a finger or a touch pen. As a result, the signature character is displayed in the frame of the individual authentication method portion 53C.

  Further, the user 80 touches the authentication button 55 to determine the TAN, the authentication method, and the authentication data. As a result, the signature authentication method is selected as the authentication method, and TAN and authentication data (signature data) are acquired.

  FIG. 9 is an explanatory diagram for explaining an example of an authentication screen for selecting a face authentication method. Referring to FIG. 9, an authentication screen 50D is shown. The authentication screen 50D includes a TAN display portion 51, an individual authentication method portion 53D, a determination button 55, and a switching button 57. The TAN display portion 51 and the switching button 57 are as described above with reference to FIG.

  The user 80 causes the imaging unit 230 to image the face of the user 80 by adjusting the orientation of the terminal device 200-1. At this time, the face to be imaged is displayed as a live view image in the individual authentication method portion 53D.

  Further, the user 80 touches the authentication button 55 to determine the TAN, the authentication method, and the authentication data. As a result, the face authentication method is selected as the authentication method, and TAN and authentication data (captured image) are acquired.

  FIG. 10 is an explanatory diagram for explaining an example of an authentication screen for selecting a voice authentication method. Referring to FIG. 10, an authentication screen 50E is shown. The authentication screen 50E includes a TAN display portion 51, an individual authentication method portion 53E, a determination button 55, and a switching button 57. The TAN display portion 51 and the switching button 57 are as described above with reference to FIG.

  The user 80 causes the sound collection unit 240 to collect sound by issuing a keyword toward the terminal device 200-1. At this time, for example, the microphone object included in the individual authentication scheme portion 53E changes its color so as to indicate that it is collecting sound.

  Further, the user 80 touches the authentication button 55 to determine the TAN, the authentication method, and the authentication data. As a result, the voice certificate method is selected as the authentication method, and TAN and authentication data (voice data) are acquired.

  For example, as described above, the display control unit 271 displays the authentication screen on the display unit 250.

  For example, the display control unit 271 causes the display unit 250 to display a screen for inputting information used in the post-authentication process. For example, when the post-authentication process is a payment process, the display control unit 271 causes the display unit 250 to display a payment information input screen for inputting payment information.

(TAN acquisition unit 273)
The TAN acquisition unit 273 acquires password data for one-time password authentication. As described above, the one-time password is TAN, and the one-time password authentication is authentication by TAN. That is, the TAN acquisition unit 273 acquires number data for authentication by TAN. The number data is TAN when input correctly.

  More specifically, for example, when the above-described authentication screens shown in FIGS. 6 to 10 are displayed, the user 80 inputs a number as TAN using a touch panel or another input device. Then, the user 80 touches the authentication button 55 to determine the TAN, the authentication method, and the authentication data. At this time, the TAN acquisition unit 273 acquires the number data of the number input as the TAN.

  As described above, the TAN acquisition unit 273 acquires number data for authentication by TAN. Then, the TAN acquisition unit 273 provides the acquired number data to the information providing unit 279.

(Authentication method selection unit 275)
The authentication method selection unit 275 selects an authentication method from the plurality of authentication methods in response to a user operation.

  More specifically, for example, the above-described authentication screens shown in FIGS. Then, the user 80 inputs authentication data and touches the authentication button 55. At this time, the authentication method selection unit 275 selects an authentication method corresponding to the authentication screen.

  As described above, the authentication method selection unit 275 selects an authentication method. Then, the authentication method selection unit 275 acquires the authentication method ID of the selected authentication method and provides the authentication method ID to the authentication information acquisition unit 277.

(Authentication information acquisition unit 277)
The authentication information acquisition unit 277 acquires authentication information of the user 80 for authentication based on an authentication method selected from the plurality of authentication methods. The authentication information includes, for example, a user ID, authentication data, and an authentication method ID.

  For example, the authentication information acquisition unit 277 acquires the user ID from the storage unit 260. For example, when the authentication method ID is provided by the authentication method selection unit 275, the authentication information acquisition unit 277 acquires the authentication method ID. Further, the authentication information acquisition unit 277 acquires authentication data as follows.

  For example, when the above-described authentication screen shown in FIGS. 6 to 10 is displayed, the user 80 performs input according to the authentication method. For example, in the example of FIG. 6, the user 80 inputs a personal identification number by touching a soft key included in the individual authentication scheme portion 53A. Then, the user 80 touches the authentication button 55. At this time, the authentication information acquisition unit 277 acquires the number data of the input number as authentication data. The authentication data is acquired in the same manner in the examples of FIGS.

  As described above, the authentication information acquisition unit 277 acquires authentication information including a user ID, authentication data, and an authentication method ID. Then, the authentication information acquisition unit 277 provides the acquired authentication information to the information providing unit 279.

(Information provider 279)
The information providing unit 279 provides authentication information to the authentication server 100-1. For example, when the authentication information is provided by the authentication information acquisition unit 277, the information provision unit 279 acquires the authentication information. Then, the information providing unit 279 causes the communication unit 210 to transmit the acquired authentication information to the authentication server 100-1.

  For example, the information providing unit 279 provides one of the issued one-time passwords to the authentication server 100-1. As described above, the one-time password is, for example, TAN. That is, the information providing unit 279 provides one of the issued TANs to the authentication server 100-1. For example, when the TAN acquisition unit 273 provides number data, the information providing unit 279 acquires the number data. The number data is TAN when correctly input. Then, the information providing unit 279 causes the communication unit 210 to transmit the acquired number data to the authentication server 100-1. As a result, TAN (number data when correctly input) can be provided to the authentication server 100-1.

  For example, the information providing unit 279 acquires information used in the post-authentication process. Then, the information providing unit 279 provides the information to the authentication server 100-1. As an example, when the post-authentication process is a payment process, the information providing unit 279 acquires the payment information in response to an input on the payment information input screen, and the communication unit 210 transmits the payment information to the authentication server 100. -1.

<1.4. Flow of processing>
Next, an example of information processing according to the first embodiment will be described with reference to FIGS. 11 and 12.

(Terminal device processing)
FIG. 11 is a flowchart illustrating an example of a schematic flow of information processing of the terminal device 200-1 according to the first embodiment.

  First, in step S501, the display control unit 271 causes the display unit 250 to display a payment information input screen for inputting payment information.

  In step S503, the information providing unit 279 acquires payment information in response to an input on the payment information input screen.

  In step S505, the display control unit 271 displays an authentication screen on the display unit 250.

  In step S507, the display control unit 271 determines whether an authentication method switching operation (that is, a touch on the switching button 57) has been performed. If there is the switching operation, the process proceeds to step S509. Otherwise, the process proceeds to step S511.

  In step S509, the display control unit 271 switches the authentication screen to an authentication screen of another authentication method.

  In step S511, the control unit 270 determines whether an authentication information determination operation (ie, a touch on the authentication button 55) has been performed. If there is such an operation, the process proceeds to step S513. Otherwise, the process returns to step S507.

  In step S513, the TAN acquisition unit 273 acquires number data for authentication by TAN.

  In step S515, the authentication method selection unit 275 selects an authentication method corresponding to the authentication screen. In addition, the authentication method selection unit 275 acquires the authentication method ID of the selected authentication method.

  In step S517, the authentication information acquisition unit 277 acquires authentication information of the user 80 for authentication based on the selected authentication method.

  In step S519, the information providing unit 279 provides authentication information, number data, and settlement information to the authentication server 100-1. Then, the process ends.

(Processing on the authentication server side)
FIG. 12 is a flowchart illustrating an example of a schematic flow of information processing of the authentication server 100 according to the first embodiment.

  First, in step S531, the information acquisition unit 131 acquires authentication information, number data, and settlement information from the terminal device 200-1 via the communication unit 110.

  In step S533, the TAN authenticating unit 133 performs authentication by TAN using the acquired number data.

  In step S535, the TAN authentication unit 133 determines whether the TAN authentication is successful. If the TAN authentication is successful, the process proceeds to step S537. Otherwise, the process proceeds to step S545.

  In step S537, the TAN corresponding to the number data used in the authentication by TAN is deleted from the storage unit 120.

  In step S539, the main authentication unit 135 performs authentication based on the selected authentication method using the acquired authentication information.

  In step S541, the main authentication unit 135 determines whether authentication based on the selected authentication method is successful. If the authentication based on the selected authentication method is successful, the process proceeds to step S543. Otherwise, the process proceeds to step S545.

  In step S543, the user is authenticated, and the post-authentication processing unit 137 performs settlement processing as post-authentication processing. Then, the process ends.

  In step S545, processing at the time of authentication failure (for example, notification of authentication failure to the terminal device 200-1) is performed. Then, the process ends.

  Although the first embodiment has been described above, according to the first embodiment, the authentication is performed based on the authentication method selected from among a plurality of authentication methods in which the number of usable times is set. In addition, when a user authentication condition including that the number of usable times set for authentication based on the selected authentication method is not exhausted and that the authentication based on the selected authentication method is successful is satisfied, The user is authenticated. Further, at least when the user is authenticated, the number of usable times set for the selected authentication method is reduced.

  Thus, even if the correct authentication data for the authentication method is leaked (for example, even if the correct authentication data is stolen) by setting the usable number of times for the authentication method, The number of unauthorized authentications due to use can be limited. As a result, the influence of unauthorized authentication can be suppressed. That is, security is improved.

  In addition, since multiple authentication methods can be used, correct authentication data for any one of the multiple authentication methods is leaked so that unauthorized authentication is not performed. Even if this authentication is prohibited, the user 80 can perform authentication based on another authentication method. That is, user convenience is improved.

  In addition, in order to suppress the influence at the time of leakage of correct authentication data, it is conceivable to reduce the number of usable times per authentication method. Even in such a case, since a plurality of authentication methods can be used, it is easy to secure a sufficient number of times that the plurality of authentication methods can be used as a whole. Can be maintained.

  In addition, since a plurality of authentication methods can be used, the user can select an authentication method that is easy to use, and the convenience for the user can be improved.

  Thus, according to the first embodiment, it is possible to improve user convenience while enhancing security in authentication.

  For example, the plurality of authentication methods include at least one biometric authentication method.

  This makes it difficult to perform unauthorized authentication by a person other than the user who is the principal person, thereby improving security.

  In addition, for example, the number of usable times is set by issuing the same number of one-time passwords (for example, TAN) as the number of usable times. The user authentication condition includes successful one-time password authentication (for example, authentication by TAN) by using the one-time password issued for the selected authentication method.

  As a result, not only authentication based on the selected authentication method but also one-time password authentication is successful, so that the user is not authenticated, making unauthorized authentication more difficult. That is, security is further improved.

<< 2. Second Embodiment >>
Subsequently, a second embodiment of the present invention will be described with reference to FIGS.

  In the first embodiment, an example in which the user 80 inputs the TAN to the terminal device 200 while viewing the paper on which the TAN is described has been described. Such paper is delivered to the user by a highly reliable method such as mail. However, in order to deliver such paper, as an example, the user 80 visits a window (for example, at a bank), applies for TAN issuance, and waits for mailing of the paper on which the TAN is written to the home. . Thus, delivery of the issued TAN is very inconvenient for the user. Since issuing TAN also sets the number of times of use, it can be said that the setting of the number of times of use is very inconvenient for the user.

  Therefore, the second embodiment makes it possible to further improve user convenience in setting the number of times of use for each of a plurality of authentication methods. More specifically, for example, the second embodiment makes it possible to further improve user convenience in the delivery of a one-time password (eg, TAN).

  Hereinafter, the second embodiment is referred to as <2.1. Schematic configuration of information processing system>, <2.2. Configuration of authentication server>, <2.3. Configuration of Terminal Device>, <2.4. Configuration of one-time ID management server>, <2.5. Configuration of TAN issuing server>, <2.6. The process will be described in the order of process flow>.

<2.1. Schematic configuration of information processing system>
A schematic configuration of an information processing system 1-2 according to the second embodiment will be described with reference to FIG. FIG. 13 is an explanatory diagram illustrating an example of a schematic configuration of an information processing system 1-2 according to the second embodiment. Referring to FIG. 13, the information processing system 1-2 includes an authentication server 100-2, a terminal device 200-2, a one-time ID management server 300, and a TAN issuing server 400. The authentication server 100-2, the terminal device 200-2, the one-time ID management server 300, and the TAN issuing server 400 can communicate with each other via the network 90.

  The authentication server 100-2 authenticates the user 80. In particular, the authentication server 100-2 performs authentication based on an authentication method selected from a plurality of authentication methods. For example, an authentication method is selected from the plurality of authentication methods in the terminal device 200-2, and authentication information of the user 80 for the authentication method is provided from the terminal device 200-2 to the authentication server 100-2. Then, the authentication server 100-2 performs authentication based on the selected authentication method using the authentication information.

  Further, for example, the authentication server 100-2 performs post-authentication processing when the user 80 is authenticated. The post-authentication process is a process based on pre-authentication, such as payment processing, billing processing, and network access permission.

  The terminal device 200-2 is a device used by the user 80. In particular, the terminal device 200-2 displays a screen for selecting an authentication method from a plurality of authentication methods according to the operation of the user 80. Also, the terminal device 200-2 acquires the authentication information of the user 80 for authentication based on the selected authentication method, and provides the authentication information to the authentication server 100-2.

  The one-time ID management server 300 issues a one-time ID that can be used under a predetermined condition to the user 80 of the terminal device 200-2.

  Further, the TAN issuing server 400 sets the number of usable times for each of the plurality of authentication methods when a predetermined condition is satisfied. For example, when a predetermined condition is satisfied, the TAN issuing server 400 sets the usable number of times by issuing a one-time password to the user 80 of the terminal device 200-2. The one-time password is, for example, TAN. The TAN issuing server 400 provides the TAN issued to the user 80 to the terminal device 200-2 of the user 80.

  According to the second embodiment, it is possible to further improve user convenience in setting the number of times of use for each of a plurality of authentication methods. More specifically, for example, according to the second embodiment, the convenience of the user can be further improved in the delivery of a one-time password (for example, TAN). Thereafter, <2.2. Configuration of authentication server>, <2.3. Configuration of Terminal Device>, <2.4. Configuration of one-time ID management server>, <2.5. Configuration of TAN issuing server> and <2.6. The specific contents of the processing flow> will be described.

<2.2. Configuration of authentication server>
With reference to FIG. 14, an example of a configuration of the authentication server 100-2 according to the second embodiment will be described. FIG. 14 is a block diagram illustrating an example of the configuration of the authentication server 100-2 according to the second embodiment. Referring to FIG. 14, the authentication server 100-2 includes a communication unit 110, a storage unit 120, and a control unit 140.

  Here, the communication unit 110, the storage unit 120, and the TAN authentication unit 133, the main authentication unit 135, and the post-authentication processing unit 137 of the control unit 140 are the same as those in the first embodiment and the second embodiment. There is no difference between them. Therefore, here, the information acquisition unit 141 in the control unit 140 will be described.

(Information acquisition unit 141)
The information acquisition unit 141 acquires authentication information of the user 80 for authentication based on an authentication method selected from a plurality of authentication methods. For example, an authentication method is selected from the plurality of authentication methods in the terminal device 200-2, and authentication information of the user 80 for the authentication method is provided from the terminal device 200-2 to the authentication server 100-2. Then, the information acquisition unit 141 acquires the authentication information via the communication unit 110. The plurality of authentication methods and the authentication information are as described in the first embodiment.

  In each of the plurality of authentication methods, a usable number of times is set. This point is also as described in the first embodiment.

  For example, the information acquisition unit 141 acquires password data for one-time password authentication. Specifically, for example, the information acquisition unit 141 acquires number data for authentication by TAN. This point is also as described in the first embodiment.

  As described above, for example, the information acquisition unit 141 acquires authentication information including a user ID, an authentication method ID, and authentication data, and number data (or password data). Then, the information acquisition unit 141 provides the acquired authentication information to the main authentication unit 135. Further, the information acquisition unit 141 provides the TAN authentication unit 133 with the user ID and authentication method ID of the acquired authentication information and the acquired password data (that is, number data).

  Particularly in the second embodiment, the information acquisition unit 141 acquires the one-time password issued by the TAN issuing server 400. For example, the information acquisition unit 141 acquires the TAN issued by the TAN issuing server 400. Then, the information acquisition unit 141 stores the TAN in the storage unit 120.

<2.3. Configuration of terminal device>
Next, an example of the configuration of the authentication terminal device 200-2 according to the second embodiment will be described with reference to FIG. FIG. 15 is a block diagram illustrating an example of a configuration of the terminal device 200-2 according to the second embodiment. Referring to FIG. 15, the terminal device 200-2 includes a communication unit 210, an input unit 220, an imaging unit 230, a sound collection unit 240, a display unit 250, a storage unit 261, and a control unit 280.

  Here, the communication unit 210, the input unit 220, the imaging unit 230, the sound collection unit 240 and the display unit 250, and the TAN acquisition unit 273, the authentication method selection unit 275, the authentication information acquisition unit 277, and the information of the control unit 280. Regarding the providing unit 279, there is no difference between the first embodiment and the second embodiment. Therefore, here, the storage unit 261 and the display control unit 281 and the TAN receiving unit 282 of the control unit 280 will be described.

(Storage unit 261)
The storage unit 261 stores a program and data for the operation of the terminal device 200-2. For example, the storage unit 261 stores identification information (that is, a user ID) for identifying the user 80 of the terminal device 200-2.

  In particular, in the second embodiment, the storage unit 261 stores a one-time password (for example, TAN) issued by the TAN issuing server 400 to the user 80 of the terminal device 200-2. More specifically, for example, as described later, when the TAN receiving unit 282 receives the TAN issued by the TAN issuing server 400, the TAN is stored in the storage unit 261.

(TAN receiving unit 282)
The TAN receiving unit 282 receives the issued one-time password from the TAN issuing server 400. As described above, the one-time password is TAN. That is, the TAN receiving unit 282 receives the issued TAN from the TAN issuing server 400 via the communication unit 210.

  More specifically, for example, first, the TAN receiving unit 282 requests the one-time ID management server 300 to issue a one-time ID via the communication unit 210. At the time of the request, the TAN receiving unit 282 provides the user ID to the one-time ID management server 300, for example. Then, for example, the communication unit 210 receives the one-time ID from the one-time ID management server, and the TAN receiving unit 282 acquires the one-time ID.

  Next, for example, the TAN receiving unit 282 requests the TAN issuing server 400 to issue a TAN via the communication unit 210. At this time, the TAN receiving unit 282 provides the TAN issuing server 400 with the user ID and the issued one-time ID.

  Thereafter, for example, a TAN is issued by the TAN management server 400, and the TAN is provided to the terminal device 200-2. Then, the TAN receiving unit 282 receives the TAN and causes the storage unit 261 to store the TAN.

(Display control unit 281)
The display control unit 281 controls display by the display device (that is, the display unit 250). That is, the display control unit 281 causes the display unit 250 to display a screen for showing to the user.

  In particular, the display control unit 281 causes the display unit 250 to display a screen (that is, an authentication screen) for selecting an authentication method according to a user operation from a plurality of authentication methods in which the number of usable times is set. Further, for example, the authentication screen is a screen for acquiring a TAN according to a user operation, and is also a screen for acquiring authentication data used for authentication based on the selected authentication method.

  For example, referring to FIGS. 6 to 10 again, an authentication screen 50 is shown. The authentication screen 50 includes a TAN display part 51, an individual authentication method part 53, a determination button 55, and a switching button 57.

  In particular, in the second embodiment, the user 80 inputs a TAN by selecting one of the TANs stored in the storage unit 261. As an example, the display control unit 281 causes the display unit 250 to display the TAN stored in the storage unit 261 by pull-down in the TAN display portion 51. Then, the user 80 inputs the TAN by selecting one of the displayed TANs.

  As a result, the TAN acquisition unit 273 acquires one of the issued one-time passwords as password data for one-time password authentication. As described above, for example, the one-time password is TAN. That is, the TAN acquisition unit 273 acquires one of the issued TANs as number data for authentication by TAN. In addition, as a result, the information providing unit 279 further provides one of the above-mentioned one-time passwords among the issued one-time passwords to the authentication server 100-2.

  Other points of FIGS. 6 to 10 are the same as those described in the first embodiment. For example, the example of FIG. 6 is as follows.

  The user 80 inputs a personal identification number by touching a soft key included in the individual authentication method portion 53A. As a result, the entered personal identification number or the personal identification number input status (for example, how many characters have been entered) are displayed in the individual authentication method portion 53A.

  Further, the user 80 touches the authentication button 55 to determine the TAN, the authentication method, and the authentication data. As a result, the password authentication method is selected as the authentication method, and TAN and authentication data (number data) are acquired.

  Further, the user 80 switches the authentication screen to an authentication screen for selecting another authentication method by touching the switching button 57.

  For example, as described above, the display control unit 281 causes the display unit 250 to display the authentication screen.

  For example, the display control unit 281 causes the display unit 250 to display a screen for inputting information used in the post-authentication process. This point is also as described for the display control unit 271 according to the first embodiment.

<2.4. Configuration of one-time ID management server>
Next, an example of the configuration of the one-time ID management server 300 according to the second embodiment will be described with reference to FIG. FIG. 16 is a block diagram illustrating an example of the configuration of the one-time ID management server 300 according to the second embodiment. Referring to FIG. 16, the one-time ID management server 300 includes a communication unit 310, a storage unit 320, and a control unit 330.

(Communication unit 310)
The communication unit 310 communicates with other devices. For example, the communication unit 310 communicates with the terminal device 200-2 and the TAN issuing server 400 via the network 90.

(Storage unit 320)
The storage unit 320 stores a program and data for the operation of the one-time ID management server 300.

  For example, the storage unit 320 stores one or more one-time IDs that can be used under a predetermined condition. In addition, the storage unit 320 stores a use flag indicating whether or not each one-time ID is used, for example. In addition, the storage unit 320 stores, for example, the user ID of the user 80 that is the issue destination of each one-time ID. The storage unit 320 also stores, for example, conditions (expiration date, usable area, etc.) in which each one-time ID can be used. As an example, the storage unit 320 stores a one-time ID management table including such information.

(Control unit 330)
The control unit 330 provides various functions of the one-time ID management server 300. The control unit 330 includes a one-time ID management unit 331.

(One-time ID management unit 331)
The one-time ID management unit 331 issues a one-time ID that can be used under a predetermined condition.

  For example, the predetermined condition (hereinafter, “ID usable condition”) includes that the user 80 or the terminal device 200-2 of the user 80 is located within a predetermined area. That is, the one-time ID can be used only within a predetermined area. The predetermined area is, for example, an area included in the imaging area of the surveillance camera (for example, a predetermined area in a bank building).

  For example, the ID usable condition includes that the time is within a predetermined period. That is, the one-time ID can be used only within a certain period. The predetermined period may be a predetermined time period (for example, 12: 00 to 13:00, etc.), and a predetermined period after the one-time ID is issued (for example, after the one-time ID is issued). Within 30 minutes, etc.).

  For example, when the issuance of a one-time ID is requested from the terminal device 200-2 via the communication unit 310, the one-time ID management unit 331 receives the request. At the time of this request, the one-time ID management unit 331 acquires the user ID of the user 80 of the terminal device 200-2. Then, the one-time ID management unit 331 issues an unused one-time ID to the user 80. That is, the one-time ID management unit 331 selects a one-time ID that is not used. Then, the one-time ID management unit 331 updates the one-time ID management table for the selected one-time ID. Specifically, for example, the one-time ID management unit 331 updates the use flag stored in the storage unit 320 to indicate that the one-time ID is used, and issues the one-time ID issuance destination. The user ID of the user 80 is stored in the storage unit 320. Then, the one-time ID management unit 331 provides the selected one-time ID to the terminal device 200-2 via the communication unit 310.

  Further, the one-time ID management unit 331 monitors whether or not the ID usable condition is satisfied. As an example, the one-time ID management unit 331 confirms whether or not the terminal device 200-2 of the user 80 to which the one-time ID is issued can communicate via a predetermined access point, whereby the user 80 and the terminal device 200-2. Is monitored within a predetermined area. Also, as an example, the one-time ID management unit 331 monitors whether the time is within a predetermined period by ascertaining whether the usable period corresponding to each one-time ID has elapsed.

  Then, for example, when the ID availability condition for the user 80 is not satisfied, the one-time ID management unit 331 returns the one-time ID to a state where it is not used. For example, when the user 80 and the terminal device 200-2 are out of a predetermined area, or when the time is out of a predetermined period, the one-time ID is returned to the unused state. That is, the one-time ID management unit 331 updates the use flag stored in the storage unit 320 to indicate that the one-time ID is not used, and if necessary, through the communication unit 310, The terminal device 200-2 of the issue destination user 80 is instructed to delete the one-time ID.

  In addition, the one-time ID management unit 331 notifies the TAN issuing server 400 of the usage status of the issued one-time ID. For example, the TAN issuing server 400 requests the one-time ID management unit 331 to notify the usage status of a specific one-time ID via the communication unit 310. Then, the one-time ID management unit 331 issues TAN information via the communication unit 310, such as whether or not the specific one-time ID is used, and information such as the user ID of the user 80 to which the one-time ID is issued. The server 400 is notified.

<2.5. Configuration of TAN issuing server>
Next, an example of the configuration of the TAN issuing server 400 according to the second embodiment will be described with reference to FIG. FIG. 17 is a block diagram illustrating an example of the configuration of the TAN issuing server 400 according to the second embodiment. Referring to FIG. 17, the TAN issuing server 400 includes a communication unit 410, a storage unit 420, and a control unit 430.

(Communication unit 410)
The communication unit 410 communicates with other devices. For example, the communication unit 410 communicates with the authentication server 100-2, the terminal device 200-2, and the one-time ID management server 300 via the network 90.

(Storage unit 420)
The storage unit 420 stores a program and data for the operation of the TAN issuing server 400.

  For example, the storage unit 420 stores a TAN issued to the user 80. The storage unit 420 also stores an availability flag that indicates whether each TAN is usable or unusable.

(Control unit 430)
The control unit 430 provides various functions of the TAN issuing server 400. The control unit 430 includes a condition determination unit 431 and a usage count setting unit 433.

(Condition determining unit 431)
The condition determination unit 431 determines whether or not a predetermined condition for setting the number of usable times for each of the plurality of authentication methods is satisfied. For example, the number of usable times is set by issuing the same number of one-time passwords as the number of usable times, and the one-time password is TAN. That is, the condition determination unit 431 determines whether a predetermined condition for issuing a TAN (hereinafter referred to as “TAN issue condition”) is satisfied.

  More specifically, for example, when the terminal device 200-2 of the user 80 requests the TAN issuing server 400 to issue a TAN, the condition determination unit 431 receives a request for issuing a TAN. Then, the condition determination unit 431 determines whether the TAN issue condition is satisfied for the user 80 and the terminal device 200-2.

  For example, the TAN issue condition includes that the user 80 or the terminal device 200-2 of the user 80 is located within a predetermined area. Further, for example, the TAN issue condition includes that the time is within a predetermined period. That is, the TAN issuance condition is the same as the ID usable condition for the one-time ID.

  For example, when a TAN issuance request is issued, the user ID and the one-time ID are provided to the TAN issuing server 400 by the terminal device 200-2. Then, the condition determination unit 431 determines whether the TAN issue condition is satisfied by determining whether the provided one-time ID is used by the user 80 of the requesting terminal device 200-2. Specifically, for example, the condition determination unit 431 requests the one-time ID management server 300 to notify the usage status of the provided one-time ID. Then, the condition determination unit 431 uses the communication unit 410 to determine whether or not the one-time ID is used and information such as the user ID of the user 80 to which the one-time ID is issued as a one-time ID management server. 300 is notified. The condition determination unit 431 uses the one-time ID, and the user ID of the user 80 of the terminal device 200-2 that is the request source for TAN issuance. When it corresponds to the ID, it is determined that the provided one-time ID is used by the user 80 of the requesting terminal device 200-2. That is, the condition determination unit 431 determines that the TAN issue condition is satisfied.

  As described above, the condition determination unit 431 determines whether the TAN issue condition is satisfied. Then, the condition determination unit 431 notifies the use count setting unit 433 of the determination result (whether or not the TAN issue condition is satisfied).

  The TAN issuance conditions are not limited to the above-described conditions. As an example, the TAN issue condition may include that the predetermined authentication is successful. That is, the predetermined authentication may be performed. The TAN issue condition may include that the predetermined authentication is successful. As an example, the predetermined authentication is password authentication, password data is provided by the terminal device 200-2, and the condition determination unit 431 may perform password authentication.

(TAN issuing unit 433)
The TAN issuing unit 433 sets the usable number of times for each of the plurality of authentication methods when the TAN issuing condition is satisfied. For example, in response to a request from the terminal device 200-2 of the user 80, the TAN issuing unit 433 sets the usable number of times for each of the plurality of authentication methods when the AN issuing condition is satisfied.

  For example, the TAN issuing unit 433 sets the number of usable times set for each of the plurality of authentication methods by issuing the same number of one-time passwords as the number of usable times. The one-time password is, for example, TAN. That is, the TAN issuing unit 433 sets the number of times of use for each of a plurality of authentication methods by issuing a TAN.

  For example, when the condition determination unit 431 determines that the TAN issue condition is satisfied, the TAN issue unit 433 issues a TAN. More specifically, for example, when the condition determining unit 431 determines that the TAN issuing condition is satisfied, the TAN issuing unit 433 sets a new TAN as the TAN of the user 80 of the requesting terminal device 200-2. Add Then, the TAN issuing unit 433 provides the added new TAN to the requesting terminal device 200-2. Note that the TAN issuing unit 433 stops using the one-time ID used by the user 80 of the requesting terminal device 200-2 via the communication unit 410 after providing the new TAN. The management server 300 may be requested.

  For example, the TAN issuing unit 433 issues a TAN so that the same number (for example, five) of usable TANs exist in each of the plurality of authentication methods. In this case, when the TAN issued to the terminal device 200-1 has not been issued yet, or when all the TANs issued to the terminal device 200-1 become unusable, for example, as shown in FIG. Five new TANs are issued for each authentication method. On the other hand, when a part of the TAN issued to the terminal device 200-1 becomes unavailable, the same number of TANs as the unavailable TAN are issued for each authentication method. For example, as shown in FIG. 4, three TANs issued for the PIN authentication method, two TANs issued for the face authentication method, and two TANs issued for the voice authentication method are used. If it becomes impossible, three new TANs, two new TANs, and two new TANs are issued for the password authentication method, face authentication method, and voice authentication method, respectively.

  As another example, the TAN issuing unit 433 may issue the same number of TANs (for example, three) uniformly to each of the plurality of authentication methods. For example, even when there is a usable TAN as in the example of FIG. 3 and when there is a usable TAN as in FIG. 4, the TAN issuing unit 433 uniformly 3 for each authentication method. Issue one TAN.

<2.6. Flow of processing>
Next, an example of information processing according to the second embodiment will be described with reference to FIGS.

(Processing of one-time ID management server)
FIG. 18 is a flowchart illustrating an example of a schematic flow of information processing of the one-time ID management server 300 according to the second embodiment.

  First, in step S601, when the terminal device 200-2 (TAN receiving unit 282) requests the one-time ID management server 300 to issue a one-time ID, the one-time ID management unit 331 passes through the communication unit 310. A request for issuing a one-time ID is accepted.

  In step S603, the one-time ID management unit 331 selects an unused one-time ID.

  In step S605, the one-time ID management unit 331 updates the one-time ID management table for the selected one-time ID.

  In step S607, the one-time ID management unit 331 provides the selected one-time ID to the terminal device 200-2 via the communication unit 310. Then, the terminal device 200-2 (TAN receiving unit 282) acquires the one-time ID. Then, the process ends.

(Process of TAN issuing server)
FIG. 19 is a flowchart illustrating an example of a schematic flow of information processing of the TAN issuing server 400 according to the second embodiment.

  First, in step S701, when the terminal device 200-2 (TAN receiving unit 282) requests the TAN issuing server 400 to issue a TAN, the condition determining unit 431 receives a TAN issuing request. At this time, the user ID and the one-time ID are provided by the terminal device 200-2.

  In step S703, the condition determination unit 431 determines whether the TAN issue condition is satisfied by determining whether the provided one-time ID is used by the user 80 of the requesting terminal device 200-2. . If the provided one-time ID is used by the user 80 of the requesting terminal device 200-2, the process proceeds to step S705. Otherwise, the process proceeds to step S709.

  In step S705, the TAN issuing unit 433 adds a new TAN as the TAN of the user 80 of the requesting terminal device 200-2.

  In step S707, the TAN issuing unit 433 provides the added new TAN to the requesting terminal device 200-2 via the communication unit 410. Then, the process ends.

  In step S709, the condition determination unit 431 notifies the requesting terminal device 200-2 of rejection of the request for TAN issuance via the communication unit 410. Then, the process ends.

  Although the second embodiment has been described above, according to the second embodiment, a plurality of authentication methods can be used when the TAN issue condition is satisfied in response to a request from the terminal device 200-2 of the user 80. The number of times of use is set for each.

  Accordingly, it is possible to further improve user convenience in setting the number of times of use for each of a plurality of authentication methods.

  Moreover, since the setting of the number of times of use is limited to the case where the TAN issuance condition is satisfied, it is possible to suppress unauthorized authentication by issuing TAN unnecessarily and obtaining it illegally.

  Further, for example, by issuing the same number of one-time passwords (for example, TAN) as the number of usable times to each of a plurality of authentication methods, the number of usable times is set.

  This makes it possible to further improve the convenience for the user in the delivery of a one-time password (for example, TAN).

  Further, for example, the TAN issue condition includes that the user 80 or the terminal device 200-2 of the user 80 is located in a predetermined area.

  As a result, a third party who intends to obtain TAN illegally cannot obtain TAN unless he / she goes to a predetermined area (for example, an area included in the imaging area of the surveillance camera). Therefore, unauthorized acquisition of TAN can be suppressed.

  Further, for example, the TAN issue condition includes that the time is within a predetermined period.

  Thus, a third party who intends to obtain TAN illegally cannot obtain TAN unless he / she requests the issuance of TAN for a predetermined period (for example, a predetermined time period). Therefore, opportunities for unauthorized acquisition of TAN can be limited.

<< 3. Hardware configuration >>
Next, an example of the hardware configuration of each device according to the first embodiment and the second embodiment will be described with reference to FIGS.

<3.1. Hardware configuration of each server>
First, an example of a hardware configuration of each server (the authentication server 100, the one-time ID management server 300, and the TAN issuing server 400) according to the first embodiment and the second embodiment will be described with reference to FIG. . Since the hardware configuration of each server is the same, an example of the hardware configuration of the authentication server 100 will be described here.

  FIG. 20 is a block diagram illustrating an example of a hardware configuration of the authentication server 100 according to the first embodiment and the second embodiment. Referring to FIG. 20, the authentication server 100 includes a CPU (Central Processing Unit) 801, a ROM (Read Only Memory) 803, a RAM (Random Access Memory) 805, a bus 807, a storage device 809, and a communication device 811.

  The CPU 801 executes various processes in the authentication server 100. The ROM 803 stores a program and data for causing the CPU 801 to execute processing in the authentication server 100. The RAM 805 temporarily stores programs and data when the CPU 801 executes processing.

  A bus 807 connects the CPU 801, the ROM 803, and the RAM 805 to each other. A storage device 809 and a communication device 811 are further connected to the bus. The bus 807 includes, for example, a plurality of types of buses. As an example, the bus 807 includes a bus that connects the CPU 801, the ROM 803, and the RAM 805 and one or more other buses that are slower than the bus.

  The storage device 809 stores data to be temporarily or permanently stored in the authentication server 100. The storage device 809 may be, for example, a magnetic storage device such as a hard disk, or an EEPROM (Electrically Erasable and Programmable Read Only Memory), a flash memory, a MRAM (Magnetoresistive Random Access Memory). Further, non-volatile memories such as FeRAM (Ferroelectric Random Access Memory) and PRAM (Phase change Random Access Memory) may be used.

  The communication device 811 is a communication unit included in the authentication server 100 and communicates with an external device via a network (or directly). The communication device 811 may be a communication device for wired communication. In this case, for example, the communication device 811 may include a LAN terminal, a transmission circuit, and other communication processing circuits. The communication device 811 may be a communication device for wireless communication. In this case, for example, a communication antenna, an RF circuit, and other communication processing circuits may be included.

<3.2. Hardware configuration of terminal device>
Next, an example of a hardware configuration of the terminal device 200 according to the first embodiment and the second embodiment will be described with reference to FIG.

  FIG. 21 is a block diagram illustrating an example of a hardware configuration of the terminal device 200 according to the first embodiment and the second embodiment. Referring to FIG. 21, the terminal device 200 includes a CPU 901, a ROM 903, a RAM 905, a bus 907, a storage device 909, a communication device 911, a camera 913, a microphone 915, a touch panel 920, and an input device 925.

  The CPU 901 executes various processes in the terminal device 200. The ROM 901 stores a program and data for causing the CPU 901 to execute processing in the terminal device 200. The RAM 905 temporarily stores programs and data when the CPU 901 executes processing.

  A bus 907 connects the CPU 901, the ROM 903, and the RAM 905 to each other. Further, a storage device 909, a communication device 911, a camera 913, a microphone 915, and a touch panel 920 are connected to the bus. The bus 807 includes, for example, a plurality of types of buses. As an example, the bus 907 includes a bus that connects the CPU 901, the ROM 903, and the RAM 905, and one or more other buses that are slower than the bus.

  The storage device 909 stores data to be temporarily or permanently stored in the terminal device 200. The storage device 909 may be a magnetic storage device such as a hard disk, or may be a non-volatile memory such as EEPROM, flash memory, MRAM, FeRAM, and PRAM.

  The communication device 911 is a communication unit included in the terminal device 200, and communicates with an external device via a network (or directly). The communication device 911 may be a wireless communication device. In this case, for example, the communication device 911 may include a communication antenna, an RF circuit, and other communication processing circuits. The communication device 911 may be a communication device for wired communication. In this case, for example, the communication device 911 may include a LAN terminal, a transmission circuit, and other communication processing circuits.

  The camera 913 images a subject. The camera 913 includes, for example, a lens, an image sensor, an analog / digital converter, a signal processing circuit, an image processing circuit, and the like.

  In addition, the microphone 915 collects sound around the terminal device 200. The microphone 915 includes, for example, an amplifier circuit, a filter, an analog / digital converter, and the like.

  The touch panel 920 includes a touch detection surface 921 and a display surface 923.

  Touch detection surface 921 detects a touch position on touch panel 920. More specifically, for example, when the user 80 touches the touch panel 920, the touch detection surface 921 senses the touch, generates an electrical signal corresponding to the position of the touch, and applies the electrical signal to the touch position. Convert to information. The touch detection surface 921 can be formed according to an arbitrary touch detection method such as a capacitance method, a resistance film method, and an optical method, for example.

  The display surface 923 displays a screen for showing to the user 80 of the terminal device 200. The display surface 923 can be realized using, for example, a liquid crystal, an organic EL (Organic Light-Emitting Diode: OLED), a CRT (Cathode Ray Tube), or the like.

  The input device 925 acquires input information in response to a user operation. The input device 925 includes, for example, a rotary selector such as a button, a direction key, or a jog dial.

  As mentioned above, although preferred embodiment of this invention was described referring an accompanying drawing, it cannot be overemphasized that this invention is not limited to the example which concerns. It will be apparent to those skilled in the art that various changes and modifications can be made within the scope of the claims, and these are naturally within the technical scope of the present invention. Understood.

  For example, an example of issuing a one-time password (for example, TAN) to set the number of times of use for each of a plurality of authentication methods has been described, but the present invention is not limited to such an example. For example, the number of times each authentication method can be used may be set without issuing a one-time password (eg, TAN). Further, instead of the one-time password, a password with a plurality of usable times (for example, a TAN with a plurality of times of use) may be used.

  Further, although the example in which the one-time password is TAN has been described, the present invention is not limited to such an example. For example, the one-time password may be a character string instead of a number such as TAN.

  Further, although the example in which the authentication information includes the authentication method ID for identifying the selected authentication method has been described, the present invention is not limited to such an example. The authentication information may not include the authentication method ID. In this case, for example, the authentication server may identify the authentication method from the TAN. In this case, for example, when a TAN of an authentication method different from the selected authentication method is used, authentication based on the other authentication method is performed, and the authentication fails.

  Moreover, although the example in which the one-time ID is used for the determination of the TAN issue condition has been described, the present invention is not limited to such an example. For example, a one-time ID may not be used, and it may be determined whether a TAN issue condition is seen.

  Further, an example has been described in which authentication based on the selected authentication method is performed after successful one-time password authentication (for example, authentication by TAN), but the present invention is not limited to such an example. For example, one-time password authentication may be performed after successful authentication based on the selected authentication method. Further, for example, authentication based on the selected authentication method and one-time password authentication may be performed in parallel.

  In addition, an example has been described in which one-time password authentication (for example, authentication by TAN) and authentication based on the selected authentication method are performed by the same device (authentication server), but the present invention is not limited to such an example. . For example, one-time password authentication and authentication based on the selected authentication method may be performed by different devices. The final determination as to whether or not to authenticate the user may be performed by a device that performs one-time password authentication, or may be performed by a device that performs authentication based on a selected authentication method. One-time password authentication may be performed by a TAN issuing server as an example.

  Moreover, although the example in which the processing after authentication is performed by the authentication server has been described, the present invention is not limited to such an example. For example, the post-authentication process may be performed by another server (for example, a settlement server, a billing server, a communication control server, etc.).

  Further, the processing steps in the information processing of the present specification do not necessarily have to be executed in time series in the order described in the flowchart. For example, the processing steps in the information processing may be executed in an order different from the order described in the flowchart, or may be executed in parallel.

  It is also possible to create a computer program for causing hardware such as a CPU, ROM, and RAM incorporated in each server and terminal device to perform the same function as each configuration of each server and terminal device. A storage medium storing the computer program is also provided.

1 Information processing system 50 Authentication screen 51 TAN display part 53 Individual authentication method part 53
55 decision button 57 switching button 80 user 100 authentication server 110 communication unit 120 storage unit 130, 140 control unit 131, 141 information acquisition unit 133 TAN authentication unit 135 main authentication unit 137 post-authentication processing unit 200 authentication server 210 communication unit 220 input unit 230 imaging unit 240 sound collecting unit 250 display unit 260 storage unit 270 control unit 271, 281 display control unit 273 TAN acquisition unit 275 authentication method selection unit 277 authentication information acquisition unit 279 information provision unit 282 TAN reception unit 300 one-time ID management server 310 communication unit 320 storage unit 330 control unit 331 one-time ID management unit 400 TAN issue server 410 communication unit 420 storage unit 430 control unit 431 condition determination unit 433 TAN issue unit

Claims (19)

An acquisition unit that acquires user authentication information for authentication based on an authentication method selected from among a plurality of authentication methods in which the number of available times is set;
An authentication unit that performs authentication based on the selected authentication method using the authentication information;
With
When a user authentication condition including that the available number of times set for the authentication based on the selected authentication method is not exhausted and the authentication based on the selected authentication method is successful is satisfied The user is authenticated,
When at least the user is authenticated, the available number of times set in the selected authentication method decreases.
Information processing device.   The information processing apparatus according to claim 1, wherein the plurality of authentication methods include at least one biometric authentication method. The usable number of times set for each of the plurality of authentication methods is set by issuing the same number of one-time passwords as the usable number of times,
Of the user authentication conditions, that the number of usable times set for the authentication based on the selected authentication method is not exhausted, any one-time password issued for the selected authentication method Is available and
The user authentication condition includes successful one-time password authentication by using a one-time password issued for the selected authentication method,
If at least the user is authenticated, the one-time password issued for the selected authentication scheme is disabled;
The information processing apparatus according to claim 1 or 2.   The information processing apparatus according to claim 3, wherein the one-time password issued for the selected authentication method is disabled even when the user is not authenticated.   If the one-time password authentication is successful by using the one-time password issued for the selected authentication method, and the authentication based on the selected authentication method fails, for the selected authentication method The information processing apparatus according to claim 4, wherein the one-time password issued to the user is disabled.   When a one-time password issued for an authentication method different from the selected authentication method is used in the one-time password authentication, the one-time password issued for the another authentication method is The information processing apparatus according to claim 4 or 5, wherein the information processing apparatus becomes unusable. The one-time password is a transaction authentication number,
The one-time password authentication is authentication by a transaction authentication number.
The information processing apparatus according to any one of claims 3 to 6. Computer
A display control unit for displaying on the display device a screen for selecting an authentication method in accordance with a user operation from a plurality of authentication methods in which the number of available times is set;
An acquisition unit for acquiring user authentication information for authentication based on an authentication method selected from the plurality of authentication methods;
A providing unit that provides the authentication information to another device that performs authentication based on the selected authentication method using the authentication information;
Function as
When a user authentication condition including that the available number of times set for the authentication based on the selected authentication method is not exhausted and the authentication based on the selected authentication method is successful is satisfied The user is authenticated,
When at least the user is authenticated, the available number of times set in the selected authentication method decreases.
program. When a predetermined condition is satisfied, a setting unit is provided for setting the number of times that each of the plurality of authentication methods can be used,
Authentication based on the selected authentication method is performed using user authentication information for authentication based on the selected authentication method among the plurality of authentication methods,
When a user authentication condition including that the available number of times set for the authentication based on the selected authentication method is not exhausted and the authentication based on the selected authentication method is successful is satisfied The user is authenticated,
When at least the user is authenticated, the available number of times set in the selected authentication method decreases.
Information processing device.   10. The information processing according to claim 9, wherein the setting unit sets the usable number of times for each of the plurality of authentication methods when the predetermined condition is satisfied in response to a request from the terminal device of the user. apparatus.   The information processing apparatus according to claim 10, wherein the predetermined condition includes that the user or the terminal device is located within a predetermined area.   The information processing apparatus according to claim 10 or 11, wherein the predetermined condition includes that time is within a predetermined period.   The information processing apparatus according to any one of claims 10 to 12, wherein the predetermined condition includes success of predetermined authentication for setting a usable number of times for each of the plurality of authentication methods. The setting unit sets the usable number of times set for each of the plurality of authentication methods by issuing the same number of one-time passwords as the usable number of times,
Of the user authentication conditions, that the number of usable times set for the authentication based on the selected authentication method is not exhausted, any one-time password issued for the selected authentication method Is available and
The user authentication condition includes successful one-time password authentication by using a one-time password issued for the selected authentication method,
If at least the user is authenticated, the one-time password issued for the selected authentication scheme is disabled;
The information processing apparatus according to any one of claims 9 to 13.   The information processing apparatus according to claim 14, wherein the one-time password issued for the selected authentication method becomes unusable even when the user is not authenticated.   If the one-time password authentication succeeds by using the one-time password issued for the selected authentication method and the authentication based on the selected authentication method fails, the authentication method is selected. The information processing apparatus according to claim 15, wherein the one-time password issued to the user is disabled.   When a one-time password issued for an authentication method different from the selected authentication method is used in the one-time password authentication, the one-time password issued for the another authentication method is The information processing apparatus according to claim 15 or 16, wherein the information processing apparatus becomes unusable. The one-time password is a transaction authentication number,
The one-time password authentication is authentication by a transaction authentication number.
The information processing apparatus according to any one of claims 14 to 17. Computer
This is another device that sets the number of times of use for each of a plurality of authentication methods when a predetermined condition is satisfied, and sets the number of times of use by issuing the same number of one-time passwords as the number of times of use A receiving unit that receives the issued one-time password from the other device;
A providing unit that provides one of the issued one-time passwords to another device that performs one-time password authentication for the issued one-time password;
Function as
Authentication based on the selected authentication method is performed using user authentication information for authentication based on the selected authentication method among the plurality of authentication methods,
That any one-time password issued for the selected authentication scheme is usable, and the one-time password issued for the selected authentication scheme is provided to the another device, and The user is authenticated if a user authentication condition is satisfied, including successful one-time password authentication by using a one-time password and successful authentication based on the selected authentication method;
The one-time password issued for the selected authentication method becomes unavailable when at least the user is authenticated;
program.

Images