JP6068911B2 - Authentication apparatus, authentication method, and authentication program - Google Patents

Description

  The present invention relates to an authentication apparatus, an authentication method, and an authentication program for authenticating a user who has accessed through a network.

  In recent years, there has been a problem of identity theft such as user IDs and passwords on the Internet, represented by phishing scams. For this reason, there is a need for a technique that ensures higher security and authenticates the legitimacy of the user. For example, Patent Literature 1 describes an authentication system that acquires a one-time password using a mobile terminal and performs user authentication using the acquired one-time password.

JP 2007-109122 A

  For example, a system such as a bank generally performs user authentication using an account number and a 4-digit password. In this case, since the password is 4 digits, there is a problem that it is vulnerable to brute force attacks and estimation. In response to a brute force attack of a personal identification number, measures are taken to prevent the brute force attack by locking the account so that it cannot be accessed in the case of multiple mistakes.

  However, if there is a huge number of accounts, instead of aiming for a specific account, if a brute force attack is performed on all accounts, the PIN number of either account can be easily determined. There is a risk that. Accordingly, there is a possibility that a malicious third party logs in, for example, a net banking service and performs an unauthorized operation using the account number and personal identification number obtained illegally. Therefore, in addition to the personal identification number, a means for further strengthening authentication is required.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an authentication device, an authentication method, and an authentication program for performing user authentication with higher security.

  In order to solve the above-described problem, the present invention is an authentication device that performs authentication using a personal identification number, and stores a registration pattern indicating a position of at least one selected button in a button arrangement table in which a plurality of buttons are arranged. Receiving the input information indicating the position of each button input to the button arrangement table transmitted from the terminal, and the received input information matches the registered pattern registered in the storage means Authentication means for authenticating whether or not to do.

  The present invention is an authentication device that performs authentication by a personal identification number, the storage device storing a registration pattern of buttons flicked into a button arrangement table in which a plurality of buttons are arranged, and the button arrangement transmitted from a terminal. Receiving flick input information flicked to a button in the column table, and authenticating means for authenticating whether or not the received flick input information matches a registered pattern stored in the storage means, The registered pattern and the flick input information are information indicating the position and flick direction of each button flicked in the button arrangement table.

  The present invention is an authentication method performed by a computer, wherein the computer is a computer that performs authentication based on a personal identification number, and a registration indicating a position of at least one selected button in a button arrangement table in which a plurality of buttons are arranged. A storage unit for storing a pattern; a receiving step for receiving input information indicating a position of each button input to the button arrangement table transmitted from the terminal; the received input information; and registering in the storage unit And an authentication step for authenticating whether or not the registered pattern matches.

  The present invention is an authentication method performed by a computer, wherein the computer is a computer that performs authentication based on a personal identification number, and stores a registration pattern of buttons flicked into a button arrangement table in which a plurality of buttons are arranged. A reception step of receiving flick input information flicked into a button of the button arrangement table transmitted from the terminal, and the received flick input information matches a registration pattern stored in the storage unit The registration step and the flick input information are information indicating the position and flick direction of each button flicked in the button arrangement table.

  According to the present invention, a computer that performs authentication by a personal identification number is transmitted from a terminal that stores a registration pattern indicating a position of at least one selected button in a button arrangement table in which a plurality of buttons are arranged. Function as authentication means for receiving input information indicating the position of each button input in the button arrangement table and authenticating whether or not the received input information matches the registered pattern registered in the storage means This is an authentication program.

  The present invention provides a computer that performs authentication using a personal identification number, a storage unit that stores a registration pattern of buttons flicked into a button arrangement table in which a plurality of buttons are arranged, and a button of the button arrangement table that is transmitted from a terminal. Flick input information that has been flicked is received, and the received flick input information functions as an authentication unit that authenticates whether or not the registered pattern stored in the storage unit matches. The flick input information is information indicating the position and flick direction of each button flicked in the button arrangement table.

  According to the present invention, it is possible to provide an authentication device, an authentication method, and an authentication program that perform user authentication with higher security.

1 is an overall configuration diagram of an authentication system to which a first embodiment of the present invention is applied. It is a figure which shows an example of the account information storage part of 1st Embodiment. It is a sequence diagram which shows the process of 1st Embodiment. FIG. 5 shows an example of various screens of the first embodiment. FIG. It is a whole block diagram of the authentication system to which the 2nd Embodiment of this invention was applied. It is a figure which shows an example of the account information storage part of 2nd Embodiment. It is a sequence diagram which shows the process of 2nd Embodiment. It shows an example of various screens of the second embodiment.

  Embodiments of the present invention will be described below.

<First Embodiment>
FIG. 1 is an overall configuration diagram of an authentication system to which a first embodiment of the present invention is applied. The illustrated authentication system includes a terminal 1 such as a smartphone, a mobile phone, or a PC (Personal Computer), and an authentication server 2. The terminal 1 used by the user accepts user instructions and displays various information and screens on the output device. The authentication server 2 performs user authentication of each terminal 1 accessed via a network such as the Internet. In the present embodiment, the authentication server 2 will be described as an example of a bank server that provides net banking services such as balance inquiry and transfer via a network, but is not limited thereto.

  The illustrated authentication server 2 includes an authentication unit 21, an application unit 22, and an account information storage unit 23. The authentication unit 21 receives input information indicating the position of each button input from the terminal 1 in the button arrangement table, and whether the received input information matches the registration pattern registered in the account information storage unit 23. Authenticate whether or not. After determining that the authentication unit 21 has succeeded in authentication, the application unit 22 performs predetermined application processing such as Internet banking. Information necessary for authentication of each user who is registered in the authentication server 2 and can use the application service provided by the authentication server 2 is registered in the account information storage unit 23.

  FIG. 2 is a diagram illustrating an example of the account information storage unit 23. In the illustrated account information storage unit 23 (account information table), a store number, an account number, first authentication information, and second authentication information are stored for each user (account). It is assumed that a 4-digit password (PIN, password) is used as the first authentication information in the present embodiment.

  As the second authentication information of the present embodiment, a registration pattern (position information) indicating the position of at least one selected button in the button arrangement table in which a plurality of buttons are arranged is used. That is, as the second authentication information, the user arranges the button arrangement indicating which button in the button arrangement table has been selected (touched, pressed, etc.) in the account information storage unit 23 instead of the password. Register and remember this, and use it when logging into the authentication server 2. In the illustrated example, the coordinates indicating the position of the selected button are used as the registration pattern, but the present invention is not limited to this. The number of buttons to be selected can be selected by the user at the time of registration.

  The first authentication information and the second authentication information are set as desired by the user at the time of registration. In the present embodiment, since service is provided via the network, not only the first authentication information but also the second authentication information is used in order to realize more secure authentication.

  In the present embodiment, the authentication server 2 is a server having both an authentication function and an application function. However, the application function (application unit 22) may be separated from the authentication server 2 and made independent as another application server. .

  As the terminal 1 and the authentication server 2 described above, for example, a general-purpose computer system including a CPU, a memory, an external storage device such as an HDD, an input device, and an output device can be used. In this computer system, each function of each device is realized by the CPU executing a predetermined program loaded on the memory. For example, the functions of the terminal 1 and the authentication server 2 are implemented by the CPU of the terminal 1 in the case of a program for the terminal 1, and the CPU of the authentication server 2 in the case of a program for the authentication server 2. Is done. Further, the program for the terminal 1 and the program for the authentication server 2 can be stored in a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, a DVD-ROM, or distributed via a network. You can also.

  Next, the processing of this embodiment will be described.

  FIG. 3 is a sequence diagram of authentication processing when logging in to the authentication server 2 from the terminal 1. FIG. 4 shows an example of various screens (screen transitions) displayed on the output device (display) of the terminal 1.

  The terminal 1 accepts a user instruction and activates an authentication application (program) downloaded from the authentication server 2. Thereby, the terminal 1 displays a login screen 41 as shown in FIG. 4 on the output device, for example (S11). Note that the terminal 1 according to the present embodiment downloads an authentication application from the authentication server 2 when registering with the authentication server 2 in order to use an application service provided by the authentication server 2. Accordingly, when the user activates the authentication application installed in the terminal 1, the terminal 1 displays the login screen 41 included in the authentication application.

  The login screen 41 of FIG. 4 includes a store number input field, an account number input field, a first authentication information (password) input field, and further includes a button array table 411. The button arrangement table is a table (matrix) in which a plurality of buttons (cells) are arranged. In the illustrated button arrangement table, buttons are arranged in 2 rows × 5 columns, and alphabets are set in order for each button.

  The user inputs an item corresponding to each input field displayed on the login screen. Specifically, the store number, the account number, and the first authentication information are set in the corresponding input fields. And a user inputs the input information for 2nd authentication information by touching (tapping) the button of the button arrangement | sequence table displayed on the login screen. That is, the user touches the button of the position of the registered pattern registered in advance in the authentication server 2.

  The login screen 42 in FIG. 4 is an example of a login screen after the user inputs each data. The terminal 1 is equipped with a touch panel, and when the terminal 1 detects that the user has touched the button, the terminal 1 presents the user with the button selected by changing the color of the touched button. To do. In the illustrated example, the user has selected four buttons B, F, H, and J.

  When the terminal 1 receives a transmission instruction such as a user clicking a login button, the authentication information is sent to the login information (store number, account number, first authentication information, input information of the button arrangement table) input to the login screen. 2 (S12). Here, coordinates are used as input information of the button arrangement table. In the example shown in FIG. 4, coordinates ((1, 2), (2, 1) corresponding to the positions of the B, F, H, and J buttons are used. ), (2,3), (2,5)) are transmitted to the authentication server 2.

  When receiving the login information, the authentication unit 21 of the authentication server 2 refers to the account information storage unit 23 and performs user authentication (S13). That is, the record of the account information storage unit 23 is specified using the store number and account number of the login information as keys, and the corresponding first authentication information and second authentication information set in the record are acquired. Then, the authentication unit 21 collates the first authentication information of the login information with the corresponding first authentication information registered in the account information storage unit 23. Further, the authentication unit 21 collates the input information in the button arrangement table of the login information with the second authentication information (registration pattern) in the account information storage unit 23.

  The first authentication information of the login information matches the first authentication information of the account information storage unit 23, and the input information of the button arrangement table of the login information and the second authentication information of the account information storage unit 23 are If they match, the authentication unit 21 determines that the login request from the terminal 1 is a login request from a valid user. The authentication unit 21 determines that the login request is valid when either the first authentication information or the second authentication information does not match, or when both the first authentication information and the second authentication information do not match. It is determined that it is not a login request from a user. Even when the record that matches the store number and account number of the login information does not exist in the account information storage unit 23, it is determined that the login request is not a login request from a valid user.

  And the authentication part 21 transmits an authentication result to the terminal 1 (S14), and the terminal 1 produces | generates and displays the screen according to an authentication result (S15). When authenticating that it is a login request from a legitimate user (when authentication is successful), the authentication unit 21 transmits an authentication result indicating that login is permitted to the terminal 1, and the terminal 1, for example, login illustrated in FIG. 4. A screen 43 indicating that the operation has succeeded is displayed. In this case, the user of the terminal 1 can use a predetermined service provided by the authentication server 2. That is, the application unit 22 of the authentication server 2 provides the terminal 1 with a net banking service such as balance inquiry and transfer processing.

  On the other hand, when authenticating that it is not a login request from a legitimate user (when authentication fails), the authentication unit 21 transmits an authentication result indicating that login failed to the terminal 1. Thereby, the terminal 1 may display a screen indicating that the login has failed, or display the login screen 41 to prompt the user to input again.

  In the present embodiment, in order to make it difficult to forget the position of the selected button of the registered pattern registered in the account information storage unit 23 of the authentication server 2, an alphabet is displayed on each button of the button arrangement table. Thus, even when the user forgets the position of the button (or in the case of wandering), the user remembers that “I selected B, F, H, J”, etc. Thus, it is possible to make it difficult to forget the position of the button of the registered pattern. Also, what is displayed on each button in the button layout table is not limited to the alphabet, but a button layout table that uses non-alphabetic characters (numbers, hiragana, katakana, kanji, symbols, etc.), figures, images, etc. It is good also as producing | generating. For example, when using a button arrangement table in which different animal images are set for each button in the button arrangement table, the user remembers the position of the registered button and “I chose a bear and a frog”. By remembering, the position of the selected button can be made more difficult to forget.

  In the button arrangement table shown in FIG. 4, the number of buttons is 10 and the arrangement is 2 rows × 5 columns. However, the arrangement is not limited to this, and the authentication strength increases as the number of buttons increases. Can do.

  In the present embodiment, the terminal 1 downloads the authentication application from the authentication server 2 in advance and starts the authentication application, thereby displaying the login screen on the terminal 1 without accessing the authentication server 2. . However, the authentication server 2 may generate a login screen as shown in FIG. 4 in response to a login request transmitted from the terminal 1 and transmit it to the terminal 1.

  In the first embodiment described above, in addition to the first authentication using the first authentication information (password), the second authentication using the second authentication information is performed twice. By performing such a double authentication process, in the present embodiment, higher security can be ensured, and a brute force attack on the personal identification number can be effectively protected.

In the present embodiment, a registration pattern indicating the position of at least one selected button is used as authentication information in a button arrangement table in which a plurality of buttons are arranged. Here, since the number and position of the buttons selected by the user as the registration pattern are arbitrarily determined by the user, the possible patterns are 2 ^N when the number of buttons is N. Therefore, by performing double authentication processing using the second authentication information (registration pattern) together with the first authentication information (password), the authentication strength can be dramatically increased and higher security can be ensured. Can do.

  Further, in the present embodiment, the second authentication information is input by directly touching the button of the button arrangement table, so that the input load on the user can be reduced and the convenience for the user can be improved. . Further, in this embodiment, since the visual pattern of the button arrangement table is used for the authentication information, there is an advantage that it is easy to remember and difficult to forget.

<Second Embodiment>
Next, a second embodiment of the present invention will be described.

  FIG. 5 is an overall configuration diagram of an authentication system to which the second exemplary embodiment of the present invention is applied. The illustrated authentication system includes a terminal 1 and an authentication server 3 similar to those in the first embodiment. The authentication server 3 performs user authentication of each terminal 1 accessed via a network such as the Internet. In the present embodiment, the authentication server 3 is described below by taking a bank server that provides a net banking service as an example, as in the first embodiment, but is not limited thereto.

  The second embodiment is different from the first embodiment in that, as the second authentication information, a button registration pattern that is flicked into the button arrangement table is used. The illustrated authentication server 3 includes an authentication unit 31, an application unit 32, and an account information storage unit 33. The authentication unit 31 receives the flick input information flicked to the button of the button arrangement table transmitted from the terminal 1, and the received flick input information and the registration pattern stored in the account information storage unit 33 are Authenticates whether they match. The registered pattern and flick input information are information indicating the position and flick direction of each button flicked in the button arrangement table.

  After determining that the authentication unit 31 has succeeded in authentication, the application unit 32 performs predetermined application processing such as Internet banking. In the account information storage unit 33, information necessary for authentication of each user who is registered in the authentication server 3 and can use the application service provided by the authentication server 3 is registered.

  FIG. 6 is a diagram illustrating an example of the account information storage unit 33. In the illustrated account information storage unit 33 (account information table), a store number, an account number, first authentication information, and second authentication information are stored for each user (account). It is assumed that a 4-digit password (PIN, password) is used as the first authentication information in the present embodiment.

  As the second authentication information of the present embodiment, a button registration pattern (information indicating the position of each button and the direction of the flick) that is flicked into a button arrangement table in which a plurality of buttons are arranged is used. That is, the user registers a registration pattern of which button in the button arrangement table is tapped and flicked in which direction in the account information storage unit 33 instead of the password, and remembers this. And used when logging into the authentication server 3. In the illustrated example, coordinates are used as position information indicating the position of the button, and arrows are used as information indicating the direction of the flick. However, the present invention is not limited to this. In addition, it is assumed that the user can select any number of buttons for flick input at the time of registration.

  The first authentication information and the second authentication information are set as desired by the user at the time of registration. In the present embodiment, since service is provided via the network, not only the first authentication information but also the second authentication information is used in order to realize more secure authentication.

  In the present embodiment, the authentication server 3 is a server having both an authentication function and an application function, but the application function (application unit 32) may be separated from the authentication server 3 and made independent as another application server. .

  Next, the processing of this embodiment will be described.

  FIG. 7 is a sequence diagram of authentication processing when logging into the authentication server 3 from the terminal 1. FIG. 8 shows an example of various screens displayed on the output device of the terminal 1.

  The terminal 1 accepts a user instruction and activates an authentication application (program) downloaded from the authentication server 3. Accordingly, the terminal 1 displays a login screen 81 as shown in FIG. 8 on the output device, for example (S21). Note that an authentication application is downloaded from the authentication server 3 to the terminal 1 of the present embodiment when registering with the authentication server 3 for use of an application service provided by the authentication server 3. Accordingly, when the user activates the authentication application installed in the terminal 1, the terminal 1 displays the login screen 81 included in the authentication application.

  The login screen 81 of FIG. 8 includes a store number input field, an account number input field, a first authentication information (password) input field, and further includes a button array table 811. The button arrangement table is a table (matrix) in which a plurality of buttons (cells) are arranged. In the illustrated button arrangement table, buttons are arranged in 2 rows × 4 columns.

  The user inputs an item corresponding to each input field displayed on the login screen. Specifically, the store number, the account number, and the first authentication information are set in the corresponding input fields. Then, the user flicks the button at the registered position into the button arrangement table displayed on the login screen using the registration pattern registered in advance in the authentication server 3, thereby inputting the second authentication information input information. Enter.

  The login screen 82 in FIG. 8 is an example of a login screen when the user inputs each data. The terminal 1 is equipped with a touch panel. First, the user presses and holds (tap) a button for flick input. When the terminal 1 detects that it has been touched, it displays up, down, left, and right arrows 821 (information set for the buttons) corresponding to the directions around the touched buttons. The user flicks (shifts) the information to be input on the button. The terminal 1 detects such a flick input and sets an arrow displayed in the flicked direction to the button. In the example shown in the figure, the user flicks three buttons, and an arrow is set for each button flicked.

  When the terminal 1 receives a transmission instruction such as a user clicking a login button, the authentication information is sent to the login information (store number, account number, first authentication information, input information of the button arrangement table) input to the login screen. 3 (S22). Here, as the input information of the button arrangement table, coordinates indicating the position of the button and a flick direction (an arrow in the illustrated example) are used. In the case of the login screen 82 shown in FIG. 8, “(1,1): ↑”, “(2,3): ←”, and “(2,4): ↓” are displayed as authentication servers for the three buttons flicked. 3 to send.

  Upon receiving the login information, the authentication unit 31 of the authentication server 3 refers to the account information storage unit 33 and performs user authentication (S23). That is, the record of the account information storage unit 33 is specified using the store number and account number of the login information as keys, and the corresponding first authentication information and second authentication information set in the record are acquired. Then, the authentication unit 31 collates the first authentication information of the login information with the corresponding first authentication information registered in the account information storage unit 33.

  Further, the authentication unit 31 collates the input information in the button arrangement table of login information with the second authentication information in the account information storage unit 33.

  When the first authentication information of the login information and the first authentication information of the account information storage unit 33 match, and the input information of the login information and the second authentication information of the account information storage unit 33 match, The authentication unit 31 determines that the login request from the terminal 1 is a login request from a valid user. In addition, the authentication unit 31 determines that the login request is valid when either the first authentication information or the second authentication information does not match, or when both the first authentication information and the second authentication information do not match. It is determined that it is not a login request from a user. Even when the record that matches the store number and the account number of the login information does not exist in the account information storage unit 33, it is determined that the login request is not a login request from a valid user.

  And the authentication part 31 transmits an authentication result to the terminal 1 (S24), and the terminal 1 produces | generates and displays the screen according to an authentication result (S25). When authenticating that it is a login request from a legitimate user (when authentication is successful), the authentication unit 31 transmits an authentication result indicating that login is permitted to the terminal 1, and the terminal 1 is, for example, the login of FIG. A screen 83 indicating that the data has been successfully displayed is displayed. In this case, the user of the terminal 1 can use a predetermined service provided by the authentication server 3. That is, the application unit 32 of the authentication server 3 provides the terminal 1 with a net banking service such as a balance inquiry and a transfer process.

  On the other hand, when authenticating that it is not a login request from a legitimate user (when authentication fails), the authentication unit 31 transmits an authentication result indicating that login failed to the terminal 1. As a result, the terminal 1 may display a screen indicating that the login has failed, or display the login screen 81 to prompt the user to input again.

  In this embodiment, the information set to the button by flick input is an arrow, but the present invention is not limited to this. Characters other than arrows (alphabet, numbers, hiragana, katakana, kanji, symbols, etc.), figures, images, etc. may be set as buttons by flick input. As a result, the position of the button and the direction of the flick input can be made more difficult to forget.

  In the present embodiment, the arrow set to the button is transmitted as the information indicating the flick direction of the button arrangement table of the login information. However, the identification information indicating the flick direction instead of the arrow (for example, left: 1, top: 2, right: 3, bottom: 4, etc.) may be transmitted. In this case, identification information indicating the flick direction is also set in the second authentication information in the account information storage unit 33.

  Further, although the button arrangement table shown in FIG. 8 is an array of 8 rows and 2 rows × 4 columns, it is not limited to this, and the authentication strength increases as the number of buttons increases. it can.

  In the present embodiment, the terminal 1 downloads the authentication application from the authentication server 3 in advance, and starts the authentication application, thereby displaying the login screen on the terminal 1 without accessing the authentication server 3. . However, the authentication server 3 may generate a login screen as shown in FIG. 8 in response to a login request transmitted from the terminal 1 and transmit it to the terminal 1.

  In the second embodiment described above, in addition to the first authentication using the first authentication information (password), the second authentication using the second authentication information is performed twice. By performing such a double authentication process, in the present embodiment, higher security can be ensured, and a brute force attack on the personal identification number can be effectively protected.

In the present embodiment, in a button arrangement table in which a plurality of buttons are arranged, a registration pattern of buttons flicked is used as authentication information. Here, since the number and position of the buttons selected by the user as the registration pattern are arbitrarily determined by the user, the available pattern is 5 ^{N where} N is the number of buttons. Therefore, by performing double authentication processing using the second authentication information (registration pattern) together with the first authentication information (password), the authentication strength can be dramatically increased and higher security can be ensured. Can do.

  In the present embodiment, the second authentication information is input by directly flicking the button of the button arrangement table, so that the user's input load can be reduced and the convenience of the user can be improved. it can. That is, various inputs can be realized with few screen operations. Further, in this embodiment, since the visual pattern of the button arrangement table is used for the authentication information, there is an advantage that it is easy to remember and difficult to forget.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary.

1: terminal,
2, 3: Authentication server 22, 31: Authentication unit 22, 32: Application unit 23, 33: Account information storage unit

Claims (3)

An authentication device that performs authentication using a personal identification number,
Storage means for storing a registered pattern of buttons flicked into a button arrangement table in which a plurality of buttons are arranged;
Flick input information flicked to the button of the button arrangement table transmitted from the terminal is received, and it is authenticated whether or not the received flick input information matches the registered pattern stored in the storage means And an authentication means for
The registered pattern and the flick input information are information indicating a position and a flick direction of each button flicked in the button arrangement table ,
Information indicating that the button is a flick input button is set in the button that is flicked in the button arrangement table . An authentication method performed by a computer,
The computer is a computer that performs authentication by a personal identification number,
A storage unit for storing a registered pattern of buttons flicked into a button arrangement table in which a plurality of buttons are arranged is provided.
A reception step of receiving flick input information flicked to a button of the button arrangement table transmitted from the terminal;
Performing the authentication step of authenticating whether or not the received flick input information matches the registered pattern stored in the storage unit;
The registration pattern and the flick input information, Ri information der indicating the direction of the position and the flick of the buttons that are flick input in the button sequence listing,
An authentication method, wherein information indicating that the button is flicked is set in the button flicked in the button arrangement table . A computer that authenticates with a PIN
Storage means for storing a registered pattern of buttons flicked into a button arrangement table in which a plurality of buttons are arranged;
Flick input information flicked to the button of the button arrangement table transmitted from the terminal is received, and it is authenticated whether or not the received flick input information matches the registered pattern stored in the storage means Function as an authentication means,
The registration pattern and the flick input information, Ri information der indicating the direction of the position and the flick of the buttons that are flick input in the button sequence listing,
An authentication program characterized in that information indicating that the button has been flicked is set in the button flicked in the button arrangement table .

Images