JP6076890B2 - Authentication method, authentication system, Web server, authentication program, and recording medium - Google Patents

Description

  The present invention relates to a user authentication method, an authentication system, a Web server, an authentication program, and a recording medium that perform authentication using a session key.

  Conventionally, Basic authentication is known as Web authentication (see, for example, Non-Patent Document 1). In Basic authentication, a user first accesses a Web server from a terminal, obtains a server certificate, and performs signature verification. . If there is no problem, the user terminal generates a key for encrypted communication, shares the key with the public key of the certificate, and establishes an SSL session with the Web server. At the time of initial registration, the user inputs the ID and password from the user terminal in response to a user information registration request from the Web server, and transmits the ID and password to the Web server to complete the user registration. Instead of a password, a hashed or encrypted password may be registered in the Web server as verification data. In user authentication after user registration, the user first establishes an SSL session in the same manner as during user registration. Next, in response to an ID and password request from the Web server, the user inputs the ID and password and transmits them to the Web server. The Web server determines user authentication by comparing the transmitted ID and password with the ID and password registered by the user.

“HTTP Authentication: Basic and Digest Access Authentication”, Network Working Group, [Online], [November 22, 2013 Search], Internet <http://www.ietf.org/rfc/rfc2617.txt>

  However, in the basic authentication, once the password of the user of the Web server is leaked, they may be listed and used by a malicious third party. As a result, there are cases where the user is impersonated and suffers damage, and the service provider is requested to guarantee the damage of the user. In case the password is leaked, it is recommended that the user set a different password for each Web server, but it is actually difficult to execute from the viewpoint of convenience.

  The present invention has been made in order to solve such a conventional problem, and the object of the present invention is even when the user has set the same password for a plurality of Web servers. Another object of the present invention is to provide an authentication method, an authentication system, a Web server, an authentication program, and a recording medium that can avoid spoofing authentication by a malicious third party using a password list.

In order to solve the above problems, an authentication method using an authentication system according to the present invention is an authentication method in an authentication system including a first user terminal and a Web server that communicates with the first user terminal through a network. The first user terminal transmits an authentication ID, password, and session key to the Web server, and the Web server receives the ID, password, and password received from the first user terminal. The session key is collated with the ID and password registered in advance for the first user terminal and the first session key issued during the previous authentication performed by the user of the first user terminal. And when the web server authenticates successfully as a result of the collation, the second set used for the next authentication is sent to the first user terminal. Viewed contains a step of issuing a tio down key, wherein the authentication system further includes a second user terminal communicating through the Web server and the network, the Web server, the first user terminal Issuing a temporary password in response to the request of the second user terminal, wherein the Web server transmits the ID and password of the second user terminal and the temporary password within a predetermined period from the issue Is registered as an additional terminal of the first user terminal.

In order to solve the above-described problem, an authentication system of the present invention is an authentication system including a first user terminal and a Web server that communicates with the first user terminal through a network. The user terminal includes means for transmitting an ID, password and session key for authentication to the Web server, and the Web server includes the ID, password and session key received from the first user terminal, Means for collating an ID and a password registered in advance with respect to the first user terminal and a first session key issued at the time of previous authentication by the user of the first user terminal; result of the collation, if the authentication is successful, and means for issuing a second session key used for next authentication in the first user terminal, wherein the authentication system, A second user terminal that communicates with the Web server via the network, the Web server further issuing means for issuing a temporary password in response to a request from the first user terminal; Means for registering the second user terminal that has transmitted the ID and password of the second user terminal and the temporary password within a predetermined period as an additional terminal of the first user terminal. It is characterized by.

In order to solve the above-described problem, the Web server of the present invention includes an ID, a password, and a session key received from the first user terminal, an ID and a password registered in advance for the first user terminal, and the first Means for verifying the first session key issued at the time of previous authentication by the user of the user terminal, and if the authentication is successful as a result of the verification, the first user terminal Means for issuing a second session key used for next authentication, means for issuing a temporary password in response to a request from the first user terminal, and a second user terminal within a predetermined period from the issue. Means for registering the second user terminal that has transmitted the ID and password and the temporary password as an additional terminal of the first user terminal.

  According to the present invention, even when a user sets the same password for a plurality of Web servers, it is possible to avoid spoof authentication by a malicious third party using a password list or the like. it can.

It is a figure which shows schematic structure of the authentication system which concerns on one Embodiment of this invention. It is a functional block diagram of the 1st user terminal in the authentication system concerning one embodiment of the present invention. It is a functional block diagram of the 2nd user terminal in the authentication system concerning one embodiment of the present invention. It is a functional block diagram of the Web server in the authentication system which concerns on one Embodiment of this invention. It is a figure which shows the operation | movement flow of the authentication system which concerns on one Embodiment of this invention. It is a figure which shows the operation | movement flow of the authentication system which concerns on one Embodiment of this invention. It is a figure which shows the operation | movement flow of the authentication system which concerns on one Embodiment of this invention. It is a figure which shows the operation | movement flow of the authentication system which concerns on the modification of this invention. It is a figure which shows an example of user information DB and additional terminal request information DB in the authentication system which concerns on one Embodiment of this invention.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[System configuration]
FIG. 1 is a diagram showing a schematic configuration of an authentication system 1 according to an embodiment of the present invention. In the present embodiment, a first user terminal 11, a second user terminal 12, and a Web server 13 are connected via a network NW. The number of user terminals connected to the network NW is not limited to two and may be three or more. The terminal may be a stationary terminal as illustrated in FIG. 1 or a portable terminal that can be carried by a user.

  Hereinafter, the configurations of the first user terminal 11, the second user terminal 12, and the Web server 13 will be described more specifically.

  FIG. 2 is a functional block diagram of the first user terminal 11 in the authentication system 1 according to the embodiment of the present invention. The first user terminal 11 includes a browser processing unit 111, a communication control unit 112 that constitutes an interface for performing web communication with the web server 13, and a user interface that controls input from a user interface 113a operated by the user. The control part 113, the display control part 114 which controls the display apparatus 114a for displaying the web content which the web server 13 provides, and the memory | storage part 115 are provided. The browser processing unit 111 includes a Web protocol processing unit 1111, a request information generation unit 1112, and a Web display control unit 1113. Each function of the browser processing unit 111 according to the present invention will be described, but it should be noted that it is not intended to exclude other functions provided in the first user terminal 11. The first user terminal 11 can be configured as a computer. The first user terminal 11 stores a program describing processing contents for realizing each function of the browser processing unit 111 in the storage unit 115 of the computer, and the program is executed by a central processing unit (CPU) of the computer. Can be realized by reading out and executing.

  The web protocol processing unit 1111 has a function of establishing web communication with the web server 13. In particular, the web protocol processing unit 1111 has a function of starting a web application such as a web browser and executing authentication processing on the web server 13 through the network NW.

  The request information generation unit 1112 has a function of generating request information when transmitting a login ID and password input by a user through a Web browser to the Web server 13 and a function of generating request information at the time of logout.

  The web display control unit 1113 has a function of causing the display device 114 a to display the web content of the URL after the authentication processing is performed by the web server 13 via the display control unit 114.

  FIG. 3 is a functional block diagram of the second user terminal 12 in the authentication system 1 according to an embodiment of the present invention. The second user terminal 12 includes a browser processing unit 121, a communication control unit 122 that configures an interface for performing Web communication with the Web server 13, and a user interface that controls input from a user interface 123a operated by the user. A control unit 123, a display control unit 124 that controls a display device 124 a for displaying Web content provided by the Web server 13, and a storage unit 125 are provided. The browser processing unit 121 includes a Web protocol processing unit 1211, a request information generation unit 1212, and a Web display control unit 1213. Each function of the browser processing unit 121 according to the present invention will be described, but it should be noted that it is not intended to exclude other functions provided in the second user terminal 12. The second user terminal 12 can be configured as a computer. And the 2nd user terminal 12 stores the program which described the processing content which implement | achieves each function of the browser process part 121 in the memory | storage part 125 of the said computer, The central processing unit (CPU) of the said computer This can be realized by reading and executing this program.

  The web protocol processing unit 1211 has a function of establishing web communication with the web server 13. In particular, the web protocol processing unit 1211 has a function of starting a web application such as a web browser and executing authentication processing for the web server 13 through the network NW.

  The request information generation unit 1212 has a function of generating request information when transmitting a login ID and password input by a user through a Web browser to the Web server 13 and a function of generating request information including an ID at the time of logout. .

  The Web display control unit 1213 has a function of causing the display device 124 a to display the Web content of the URL after the authentication process is performed by the Web server 13 via the display control unit 124.

  FIG. 4 is a functional block diagram of the Web server 13 in the authentication system 1 according to an embodiment of the present invention.

  The Web server 13 includes a control unit 131, a communication control unit 132 that configures an interface for performing Web communication with the first user terminal 11 and / or the second user terminal 12, and a user information DB 133 (see FIG. 9 (a)), an additional terminal request information DB 134 (FIG. 9 (b)), and a storage unit 135. The user information DB 133 (FIG. 9A) and the additional terminal request information DB 134 (FIG. 9B) may be stored outside the Web server 13 and accessed by the Web server 13 when necessary. The control unit 131 includes a Web processing unit (including a Web protocol processing unit 1311 and a session key issuing unit 1312), a verification unit 1313, a temporary password issuing unit 1314, and a timer processing unit 1315. Although each function of the control unit 131 according to the present invention will be described, it should be noted that it is not intended to exclude other functions provided in the Web server 13. The Web server 13 can be configured as a computer. The Web server 13 stores a program describing the processing contents for realizing each function of the control unit 131 in the storage unit 135 of the computer, and reads out the program by a central processing unit (CPU) of the computer. It can be realized by executing.

  The web protocol processing unit 1311 in the web processing unit has a function of establishing web communication with the first user terminal 11 and / or the second user terminal 12. In particular, the Web protocol processing unit 1311 has a function of generating session information based on request information.

  A session key issuing unit 1312 in the Web processing unit issues a session key to a user terminal that has been successfully authenticated, shares (transmits) the session key to the user terminal, and uses the session key as the ID of the user terminal. In association with the user information DB 133. The order of registration and sharing may be reversed.

  The collation unit 1313 has a function of analyzing request information received from the user terminal. Specifically, the collation unit 1313 matches the ID, password, and session key information received from the user terminal with the ID, password, and latest session key information registered and stored in the user information DB 133 in advance. It has a function to collate. If they match, the collation unit 1313 permits the login of the user as successful authentication, and does not permit the login otherwise.

  The collation unit 1313 registers and stores the terminal name, ID, password, and temporary password information received from the second user terminal 12 in association with the ID in the user information DB 133 and the additional terminal request information DB 134. It also has a function of checking whether the information matches the terminal name, ID, password, and temporary password information. If the timing coincides and the transmission timing (timer value (T)) of the second user terminal 12 is within the time limit described later, the collation unit 1313 uses the second user terminal 12 for the first use. For example, the terminal name of the second user terminal 12 is registered in the additional terminal name column of the user information DB 133. You may collate using not the timing which the 2nd user terminal 12 transmitted, but the timing which the web server 13 received, and some other timing.

  Although the case where the same verification unit 1313 performs verification of a session key or the like and verification of a temporary password or the like has been described above, these verifications may be performed by different verification units.

  The temporary password issuing unit 1314 has a function of issuing a temporary password to the first user terminal 11 when receiving a terminal addition request from the first user terminal 11. The issued temporary password is displayed on the display device 114a of the first user terminal 11 or notified by sending it to an e-mail address registered in advance by the user of the first user terminal 11.

  When the timer processing unit 1315 receives a terminal addition request from the first user terminal 11, the timer processing unit 1315 activates a timer, and the additional terminal request information DB 134 stores the ID of the first user terminal 11 and the first user. The additional terminal name received from the terminal 11, the temporary password issued by the temporary password issuing unit 1314, and the timer time limit that is a time limit for adding the additional terminal of the first user terminal 11 are registered. The timer expiration is set to a certain time, for example, from several minutes to several tens of minutes after issuing the temporary password.

[System operation]
5 to 8 are diagrams showing an operation flow of the authentication system 1 according to the embodiment of the present invention.

  FIG. 5 is a diagram illustrating a flow in which a user of a user terminal not registered in the Web server 13 performs user registration. FIG. 5 illustrates a case where the first user terminal 11 is an unregistered user terminal as an example.

  Referring to FIG. 5, the user of the first user terminal 11 that is not registered in the Web server 13 activates the Web browser via the user interface 113a of the first user terminal 11 (step S1). A connection request is transmitted to the Web server 13 (step S2). Then, the first user terminal 11 acquires a server certificate from the Web server 13 (step S3), performs signature verification (step S4), and generates a key for encrypted communication if there is no problem (step S4). S5) The key is shared with the public key of the certificate, and an SSL session is established with the Web server 13 (step S6). The process from step S1 to step S6 is called a connection process.

  Next, the Web server 13 requests the ID and password to be registered from the first user terminal 11 (step S7). At this point, since the first user terminal 11 is not yet registered in the Web server 13, the user of the first user terminal 11 inputs an arbitrary ID and password via the user interface 113a (step In step S9, the information is transmitted to the web server 13 via the communication control unit 112 (step S9). When receiving the ID and password from the first user terminal 11, the Web server 13 registers them in the user information DB 133 (step S10). The processing from step S7 to step 10 is called registration processing.

  Then, the Web server 13 issues a unique session key to the first user terminal 11 (step S11), and shares (transmits) it to the first user terminal 11 (step S12). The session key is registered in the user information DB 133 as the latest session key in association with the ID of the user terminal 11 (step S13). As shown in the terminal name column of FIG. 9A, the user information DB 133 may also store the terminal name of the first user terminal 11 in association with each other. When receiving the session key, the first user terminal 11 registers the session key in a storage unit such as the storage unit 115 (step S14). The Web server 13 may register the session key before sharing the session key. The processing from step S11 to step S14 is referred to as session key issuance / sharing / registration processing.

  FIG. 6 is a diagram illustrating a flow in which a user registered in the Web server 13 logs in to the Web server 13. In FIG. 6, a case where the first user terminal 11 is a registered user terminal will be described as an example.

  Referring to FIG. 6, the user of the first user terminal 11 registered in the Web server 13 performs the connection process shown in steps S21 to S26 in FIG. The description of the connection process is omitted because it overlaps with the description of the connection process (steps S1 to S6) in FIG.

  Next, the Web server 13 requests an ID and a password from the first user terminal 11 (Step S27). Since the first user terminal 11 has already been registered in the Web server 13 at this time, the user of the first user terminal 11 inputs the ID and password registered by the user through the user interface 113a. (Step S28). Then, the first user terminal 11 uses the first session key stored in the storage unit 115 (for the sake of convenience, the first session key is distinguished from the session key issued in step S33 described later). Is read (step S29), the first session key read in step S29 is transmitted to the web server 13 together with the ID and password input in step S28 (step S30). When receiving the ID, password, and first session key from the first user terminal 11, the Web server 13 checks whether the ID, password, and latest session key registered in the user information DB 133 match (Step S31). And step S32). The process from step S27 to step S32 is called a login process.

  If they match as a result of the collation, the Web server 13 issues a second session key to the first user terminal 11 assuming that the authentication is successful (step S33). Then, the Web server 13 shares (transmits) the second session key to the first user terminal 11 (step S34), and registers the second session key as the latest session key in the user information DB 133 ( Step S35). Although only the latest session key is registered in FIG. 9A, all or a part of session keys issued in the past may be registered. When receiving the first session key, the first user terminal 11 stores the first session key in the storage unit 115 (step S36). After the session key is stored, some processing such as online payment is performed between the first user terminal 11 and the Web server 13 (step S37). When the user of the first user terminal 11 tries to log in to the Web server 13 again, the flow of FIG. 6 is repeated.

  FIG. 7 is a diagram illustrating a flow in which the user of the Web server 13 additionally registers one of the two user terminals as the other additional terminal. In FIG. 7, the case where the 2nd user terminal 12 is additionally registered as an additional terminal of the 1st user terminal 11 as an example is demonstrated.

  Referring to FIG. 7, the user of the first user terminal 11 registered in the Web server 13 performs login processing with the Web server 13. The login process is the same as that described with reference to FIG. 6 (steps S27 to S32), and thus description thereof is omitted. Next, the first user terminal 11 transmits an additional terminal name (arbitrary) and a terminal addition request to the Web server 13 (step S41). Receiving the terminal addition request, the Web server 13 issues a temporary password and shares (transmits) it to the first user terminal 11 (step S42). Then, the Web server 13 activates a terminal addition processing timer (step S43) and sets a timer expiration date. The Web server 13 obtains the ID of the first user terminal 11 that transmitted the terminal addition request, the name of the additional terminal received from the first user terminal 11 (optional), the temporary password issued in step S42, and the timer expiration date. And is registered in the additional terminal request information DB 134. The timer deadline is set to a fixed time (timer deadline) of several minutes to several tens of minutes after the Web server 13 issues the temporary password. An example is shown in FIG.

  On the other hand, the user of the first user terminal 11 performs connection processing with the Web server 13 using the second user terminal 12. Since the connection process is the same as that described in FIGS. 5 and 6 (steps S1 to S6 and steps S21 to S26), description thereof is omitted. Then, the Web server 13 requests the second user terminal 12 for the additional terminal name (arbitrary), ID, password (arbitrary), and temporary password (step S44). The second user terminal 12 receives the terminal name (arbitrary), the ID of the second user terminal 12 (common to the ID of the first user terminal 11), the second user via the user interface 123a. The password of the terminal 12 (common with the password of the first user terminal 11) (optional) and the temporary password issued in step S42 are input and transmitted to the Web server 13 (step S45). In step S45, the method of transferring the temporary password issued to the first user terminal 11 to the second user terminal 12 is not manual input by the user of the first user terminal, for example, first The user terminal 11 and the second user terminal 12 may use functions such as NFC (Near Field Communication) and Bluetooth (registered trademark).

  The Web server 13 includes the terminal name (optional) of the second user terminal 12 registered in the user information DB 133 and the additional terminal request information DB 134 and the information of the second user terminal 12 received in step S45. ID (common with the ID of the first user terminal 11), password of the second user terminal 12 (common with the password of the first user terminal 11) (optional), and the temporary password issued in step S42 Whether or not they match is checked (steps S46 and S47). As a result of the collation, if the date and time (timer value (T)) at which the transmission of step S45 is performed are within the timer limit, the Web server 13 changes the second user terminal 12 to the first user terminal. 11 are registered in the user information DB 133 as additional terminals. If the timer value (T) is after the timer expiration, a timeout is set. FIG. 9A shows an example in which a terminal with terminal name: PC123 is registered as an additional terminal with ID: 001 and terminal name: PC001. FIG. 9A shows a case where there is only one additional terminal, but any number of additional terminals can be registered.

  Next, a session key issuance / sharing / registration process is performed between the Web server 13 and the second user terminal 12. The session key issuance / sharing / registration process is the same as that described with reference to FIGS. 5 and 6 (steps S11 to S14 and steps S33 to S37), and thus description thereof is omitted.

[Description of Modification of the Present Invention]
Next, a modification of the above-described embodiment will be described.

  FIG. 8 shows the connection process and session key issuance / sharing / registration process described with reference to FIGS. 5 to 7 performed in the secure area of the Web server 13 and the user terminal (first user terminal 11 or second user terminal). It is a figure which shows the flow performed using the secure area | region of 12). Here, as an example, a case where connection processing and session key issuance / sharing / registration processing are performed between the first user terminal 11 and the Web server 13 will be described.

  Referring to FIG. 8, the browser processing unit 111 of the first user terminal 11 makes a connection request to the Web processing unit of the Web server 13 via the communication control unit 112 of the first user terminal 11 (step S51). When receiving the connection request, the Web server 13 issues a server certificate in the secure area, and transmits it to the first user terminal 11 via the Web processing unit of the Web server 13 (Step S52 and Step S53). . When receiving the server certificate, the first user terminal 11 verifies the server certificate in the secure area (steps S54 and S55). Next, the first user terminal 11 generates a key for encrypted communication in the secure area (step S56), and passes the server public key to the browser processing unit 111 of the first user terminal 11 (step S57). . Then, SSL communication is started between the Web server 13 and the first user terminal 11 (step S58).

  Next, when registration processing and login processing are performed between the Web server 13 and the first user terminal 11, session key issuance / sharing / registration processing is performed. In FIG. 8, a case where the session key is registered and stored in the secure areas of the Web server 13 and the first user terminal 11 will be described. In this case, encrypted communication between the secure areas of the Web server 13 and the first user terminal 11 using an encryption key different from the encryption key used in step S58, using the public key of the Web server 13. Is started (step S59). When the web server 13 issues a session key in the secure area (step S60), the session key is shared between the secure area of the web server 13 and the secure area of the first user terminal 11 (step S61). A session key is registered and stored in each secure area (step S62 and step S63).

  According to the modification shown in FIG. 8, the convenience of logging in with a common ID and password using a plurality of terminals is not impaired. Even if the ID and password are leaked, unauthorized login can be prevented by authenticating the user using the session key or terminal name issued for each terminal. Also, even if the user loses the user terminal or the user terminal is stolen, it is necessary to verify the password etc. against the Web server, so that unauthorized login and unauthorized use can be prevented for a certain period of time. . After the loss or theft is detected, the user terminal can be immediately stopped by remote control.

  When the first user terminal 11, the second user terminal 12, and the Web server 13 according to the present invention are configured by a computer, a program describing processing contents for realizing each function is stored in the computer. Alternatively, it can be realized by storing the program in an external storage unit and reading and executing the program by a central processing unit (CPU) of the computer. In addition, such a program can be distributed by selling, transferring, or lending a portable recording medium such as a DVD or a CD-ROM, and such a program is stored in a storage unit of a server on a network, for example. And the program can be distributed by transferring the program from the server to another computer via the network. In addition, a computer that executes such a program can temporarily store, for example, a program recorded on a portable recording medium or a program transferred from a server in its own storage unit. As another embodiment of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and each time the program is transferred from the server to the computer. In addition, the processing according to the received program may be executed sequentially. Therefore, the present invention is not limited to the above-described embodiments, and various modifications can be made by combining or partially deleting the same without departing from the spirit of the present invention.

  According to the present invention, impersonation authentication by a malicious third party using a password list or the like can be avoided, which is useful for authentication of a user terminal when providing some Web content.

DESCRIPTION OF SYMBOLS 1 Authentication system 11 1st user terminal 12 2nd user terminal 13 Web server 111 Browser processing part 112 Communication control part 113 User interface control part 113a User interface 114 Display control part 114a Display apparatus 115 Storage part 121 Browser processing part 122 communication control unit 123 user interface control unit 123a user interface 124 display control unit 124a display device 125 storage unit 131 control unit 132 communication control unit 133 user information DB
134 Additional terminal request information DB
135 Storage Unit 1111 Web Protocol Processing Unit 1112 Request Information Generation Unit 1113 Web Display Control Unit 1211 Web Protocol Processing Unit 1212 Request Information Generation Unit 1213 Web Display Control Unit 1311 Web Protocol Processing Unit 1312 Session Key Issuing Unit 1313 Verification Unit 1314 Temporary Password Issuing Part 1315 Timer processing part

Claims (5)

An authentication method in an authentication system comprising a first user terminal and a Web server that communicates with the first user terminal through a network,
The first user terminal transmitting an authentication ID, password, and session key to the Web server;
The Web server receives the ID, password, and session key received from the first user terminal, the ID and password registered in advance for the first user terminal, and the user of the first user terminal. Collating the first session key issued during the previous authentication;
The Web server issuing a second session key used for the next authentication to the first user terminal when the authentication is successful as a result of the verification;
Only including,
The authentication system further includes a second user terminal that communicates with the Web server through the network,
The Web server issuing a temporary password in response to a request from the first user terminal;
The second user terminal to which the Web server has transmitted the ID and password of the second user terminal and the temporary password within a predetermined period from the issue is used as an additional terminal of the first user terminal. Registering, and
An authentication method further comprising: An authentication system comprising a first user terminal and a web server that communicates with the first user terminal through a network,
The first user terminal is
Means for transmitting an authentication ID, password and session key to the Web server;
The web server
The ID, password and session key received from the first user terminal, the ID and password registered in advance for the first user terminal, and the authentication performed previously by the user of the first user terminal. Means for verifying the first session key issued at the time,
If the authentication is successful as a result of the verification, means for issuing a second session key used for the next authentication to the first user terminal;
Equipped with a,
The authentication system further includes a second user terminal that communicates with the Web server through the network,
The web server further includes:
Means for issuing a temporary password in response to a request from the first user terminal;
Means for registering the second user terminal that has transmitted the ID and password of the second user terminal and the temporary password within a predetermined period from the issue as an additional terminal of the first user terminal;
An authentication system comprising: ID, password, and session key received from the first user terminal, ID and password registered in advance for the first user terminal, and the previous authentication performed by the user of the first user terminal Means for verifying with the first session key issued to
If the authentication is successful as a result of the verification, means for issuing a second session key used for the next authentication to the first user terminal;
Means for issuing a temporary password in response to a request from the first user terminal;
Means for registering the second user terminal that has transmitted the ID and password of the second user terminal and the temporary password within a predetermined period from the issue as an additional terminal of the first user terminal;
A web server comprising: An authentication program for causing a computer to function as the Web server according to claim 3 . A recording medium on which the authentication program according to claim 4 is recorded.

Images