JP6081857B2 - Authentication system and authentication method - Google Patents

Description

  The present invention relates to an authentication system and an authentication method for authenticating the validity of a user accessed via a network.

  In order for a user to receive services on a plurality of networks, each service providing apparatus must be accessed and authenticated for each service, which is troublesome for the user. For this reason, single sign-on has become widespread as a technique that allows a plurality of services to be received without performing re-authentication once authentication is performed.

  Single sign-on is a convenient technique for users, but there are various problems from the viewpoint of security. For example, combining with a one-time password is performed in order to maintain security strength. Furthermore, since the service can be used only by the initial authentication, there is a technique of Patent Document 1 in which authentication is performed after confirming the authentication level required by the service providing apparatus side as a device for maintaining the overall security.

JP 2007-272542 A

  However, in Patent Document 1, in the case where the authentication method has been known, there is still a risk that information on the network is eavesdropped and decrypted. If the authentication method is known, the authentication strength is also grasped.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an authentication system and an authentication method for improving security level and performing highly accurate authentication by using various authentication methods. It is in.

To achieve the above object, the present invention according to claim 1 is an authentication system comprising a terminal that accesses a plurality of service providing apparatuses that provide services, and an authentication apparatus that authenticates a user who uses the terminal. The authentication apparatus includes: a distribution unit that distributes an authentication information generation rule including a plurality of authentication logics to the terminal; and an authentication unit that receives the authentication information from the terminal and authenticates the authentication information, An authentication information generation unit configured to select any one of the plurality of authentication logics according to the authentication information generation rule and generate authentication information from the input user information using the selected authentication logic; And transmitting means for transmitting the generated authentication information to the authentication device .

The present invention according to claim 2 is an authentication system, wherein the authentication information generation means of the terminal selects an authentication logic to be used from the plurality of authentication logics using the user information and time, and the authentication The authentication means of the device receives user information together with authentication information from the terminal, and compares the authentication information generated from the authentication logic selected using the user information and time with the authentication information received from the terminal. The main point is to authenticate.

  The gist of the present invention according to claim 3 is the authentication system, wherein the distribution means of the authentication device distributes the authentication information generation rule at a predetermined timing and changes the method for generating the authentication information.

  The present invention according to claim 4 is an authentication system, wherein the terminal further includes user information accepting means for accepting any one of a plurality of types of user information, and the authentication means of the authentication device includes: When the authentication information authentication fails, the gist is to request the terminal for authentication information generated from different types of user information.

  The present invention according to claim 5 is an authentication system, wherein the authentication device includes an active machine and a spare machine, and an authentication logic used by the spare machine is different from an authentication logic used by the active machine. And

The present invention according to claim 6 is an authentication system comprising a plurality of service providing devices that provide services to a terminal and an authentication device that authenticates a user who uses the terminal, wherein the authentication device includes a plurality of authentications. A distribution unit that distributes an authentication information generation rule including logic to the service providing device; and an authentication unit that receives the authentication information from the service providing device and authenticates the authentication information. Authentication information generating means for selecting any one of the plurality of authentication logics according to the authentication information generation rule, and generating authentication information using the selected authentication logic from the user information input at the terminal; And transmitting means for transmitting the generated authentication information to the authentication device .

The present invention according to claim 7 is an authentication method performed by an authentication system comprising: a terminal that accesses a plurality of service providing apparatuses that provide services; and an authentication apparatus that authenticates a user who uses the terminal. The apparatus performs a distribution step of distributing an authentication information generation rule including a plurality of authentication logics to the terminal, and an authentication step of receiving authentication information from the terminal and authenticating the authentication information. An authentication information generation step of selecting any one of the plurality of authentication logics according to the authentication information generation rule, and generating authentication information from the input user information using the selected authentication logic; The gist is to perform a transmitting step of transmitting authentication information to the authentication device .

The present invention according to claim 8 is an authentication method performed by an authentication system including a plurality of service providing apparatuses that provide services to a terminal and an authentication apparatus that authenticates a user who uses the terminal, wherein the authentication apparatus includes: A distribution step of distributing an authentication information generation rule including a plurality of authentication logics to the service providing device; an authentication step of receiving authentication information from the service providing device and authenticating the authentication information; and The providing apparatus selects one of the plurality of authentication logics according to the authentication information generation rule, and generates authentication information using the selected authentication logic from the user information input at the terminal The gist is to perform an information generation step and a transmission step of transmitting the generated authentication information to the authentication device .

  According to the present invention, it is possible to provide an authentication system and an authentication method that improve the security level and perform highly accurate authentication by using various authentication methods.

It is a whole lineblock diagram showing the composition of the authentication system concerning a 1st embodiment of the present invention. It is a functional block diagram which shows the structure of a user terminal. It is a functional block diagram which shows the structure of an authentication server. It is a sequence diagram which shows the authentication process of 1st Embodiment. It is a figure which shows an example of an authentication logic correspondence table. It is a figure which shows an example of a user information storage part. It is a figure which shows an example of an authentication information storage part. It is a functional block diagram which shows the structure of the service provision server of 2nd Embodiment. It is a sequence diagram which shows the authentication process of 2nd Embodiment.

  Hereinafter, embodiments of the present invention will be described.

<First Embodiment>
FIG. 1 is a diagram showing an overall configuration of an authentication system according to the first embodiment of the present invention.

  In the present embodiment, the user terminal holds authentication logic and generates authentication information. The illustrated authentication system includes a user terminal 1 used by a user, a plurality of service providing servers 2, a load distribution device 3, an authentication server 4 (current machine), and an authentication server 5 (standby machine). The authentication server 4 (working machine) and the authentication server 5 (standby machine) are independent, and the authentication server 5 (standby machine) is used when a failure occurs in the authentication server 4 (working machine). Further, the authentication server 4 (active machine) and the authentication server 5 (standby machine) may each be composed of a plurality of servers.

  The user terminal 1 receives user information input by the user, generates authentication information from the user information using any of the authentication logic, transmits the authentication information to the authentication server 4, and successfully authenticates the authentication information in the authentication server 4. In this case, the user logs in to at least one service providing server 2. The authentication system according to the present embodiment is a system capable of single sign-on, and can be logged in without performing authentication on each service providing server 2 individually after successful authentication on the authentication server 4. And

  The service providing server 2 provides a predetermined service to the user terminal 1 via the network. The load balancer 3 distributes data transmitted from the user terminal 1 or the service providing server 1 to the authentication server 4 which is the active machine during normal operation, and an authentication server which is a spare machine when the authentication server 4 of the active machine is faulty Data from the user terminal 1 or the service providing server 2 is distributed to 5 to ensure availability at the time of failure. Further, the load distribution device 3 distributes and allocates data so that the load among the plurality of active server authentication servers 4 (or the spare authentication server 5) operated in parallel is appropriate. The authentication servers 4 and 5 authenticate authentication information transmitted from the user terminal 1.

  FIG. 2 is a block diagram illustrating a configuration of the user terminal 1. The illustrated user terminal 1 includes an authentication information generation rule management unit 11, an input reception unit 12, an authentication information generation unit 13, a transmission unit 14, and a storage unit 15.

  The authentication information generation rule management unit 11 receives the authentication information generation rule distributed from the authentication server 4 at a predetermined timing and stores it in the storage unit 15. In the authentication information generation rule, a rule for generating authentication information such as a plurality of authentication logics (a predetermined algorithm such as a one-way function) is set.

  The input receiving unit 12 receives any user information input by the user from a plurality of different types of user information. As the user information, for example, various personal information such as a user ID (employee number), IC card information, biometric information such as a fingerprint, and an e-mail address can be used.

  The authentication information generation unit 13 selects any one of the plurality of authentication logics according to the authentication information generation rule stored in the storage unit 15 and authenticates using the authentication logic selected from the input user information. Generate information.

  The transmission unit 14 transmits the authentication information generated by the authentication information generation unit 13 to the authentication server 4 via the network.

FIG. 3 is a block diagram showing the configuration of the authentication server 4 (authentication device) . The illustrated authentication server 4 includes a distribution unit 41, an authentication unit 42, a user information storage unit 43, an authentication information storage unit 44, and an authentication logic storage unit 45.

  The distribution unit 41 distributes an authentication information generation rule including a plurality of authentication logics to each user terminal 1. The distribution unit 41 distributes the authentication information generation rule to each user terminal 1 at a predetermined timing, and changes the authentication information generation method at the predetermined timing. In the authentication information generation rule, rules for generating authentication information such as a plurality of authentication logics (for example, a one-way function), information used for selecting an authentication logic, information used for generating authentication information are set. Yes. Note that the authentication information generation rule distributed to each user terminal 1 is distributed differently for each user terminal 1.

  The authentication unit 42 receives authentication information from the user terminal 1, authenticates the authentication information, and transmits an authentication result to the user terminal 1.

  The user information storage unit 43 stores user information registered in advance in the authentication server 4 by the user using each user terminal 1. The authentication information storage unit 44 stores, for each user, authentication logic and authentication information used by the user. The authentication logic storage unit 45 stores a plurality of authentication logics supported by the authentication server 4.

  The spare machine authentication server 5 has the same configuration as the active machine authentication server 4. However, the plurality of authentication logics stored in the authentication logic storage unit 45 of the authentication server 4 and the plurality of authentication logics stored in the authentication logic storage unit of the authentication server 5 are different (independent). Even if the authentication logic of the authentication server 4 leaks, the authentication logic of the authentication server 5 is not inferred.

  The user terminal 1, the service providing server 2, and the authentication servers 4 and 5 described above are, for example, general-purpose computer systems that include a CPU, a memory, an external storage device such as an HDD, an input device, and an output device. Can be used. In this computer system, each function of each unit is realized by the CPU executing a predetermined program loaded on the memory. For example, each function of the user terminal 1, the service providing server 2, and the authentication servers 4 and 5 is such that the CPU of the user terminal 1 is a program for the user terminal 1 and the service providing server is a program for the service providing server 2. In the case where the two CPUs are programs for the authentication servers 4 and 5, the CPUs of the authentication servers 4 and 5 are executed. Further, the program for the user terminal 1, the service providing server 2, and the authentication server 4, 5 are stored in a computer-readable recording medium such as a hard disk, flexible disk, CD-ROM, MO, DVD-ROM. Can also be distributed over a network.

  Next, the processing of this embodiment will be described.

  FIG. 4 is a sequence diagram showing the authentication process of this embodiment.

  The distribution unit 41 of the authentication server 4 distributes the authentication information generation rule to each user terminal 1 in advance (S11). The authentication information generation rule management unit 11 of the user terminal 1 stores the distributed authentication information generation rule in the storage unit 15. In the authentication information generation rule, a rule for generating authentication information such as a plurality of authentication logics is set.

  The input receiving unit 12 of the user terminal 1 receives an authentication request for accessing any of the service providing servers 2 from the user, and displays an input screen for prompting input of user information on the display (S12). Then, the input receiving unit 12 receives any type of user information input by the user (S13).

  The authentication information generation rule is not only distributed in advance in S11, but also when the authentication request in S12 is received, the authentication information generation rule management unit 11 accesses the authentication server 4 and receives authentication information from the authentication server 4. It is good also as acquiring a production | generation rule.

  The authentication information generation unit 13 selects an authentication logic to be used in accordance with the authentication information generation rule stored in the storage unit 15 (S14). In the present embodiment, information used for selecting an authentication logic set in the authentication information generation rule is specified, and the information is input to a hash function to calculate a hash value (fixed-length pseudorandom number). In this embodiment, a hash function is used. However, an algorithm other than the hash function (which obtains a numerical value representative of the data when given data) is used to select an authentication logic. A value corresponding to the information may be calculated from the information to be used.

  For example, in the authentication information generation rule, the user information (for example, the entire user ID or the last n digits of the user ID) input in S13 is input as a text to a hash function to calculate a hash value, and the hash value It is assumed that the authentication logic is selected using the current time and the current time. In this case, the authentication information generation unit 13 inputs user information into a hash function to calculate a hash value, and acquires the current time from a clock unit (not shown). Then, an authentication logic is selected by using the authentication logic correspondence table included in the authentication information generation unit 13 and the authentication information generation rule.

  FIG. 5 shows an example of the authentication logic correspondence table. In the illustrated authentication logic correspondence table, authentication logic corresponding to each hash value and time zone is set. For example, when the hash value is “aa” and the current time is 1:30, the authentication information generation unit 13 selects the authentication logic 1-2. Thus, in the present embodiment, an authentication logic to be used is selected from the plurality of authentication logics using user information and time.

  And the authentication information production | generation part 13 produces | generates authentication information from the user information input by S13 using the authentication logic selected by S14 (S15). That is, user information is input to selected authentication logic (such as a one-way function) to generate authentication information.

  And the transmission part 14 transmits the produced | generated authentication information and the user information used for the production | generation of authentication information to the authentication server 4 (S16).

  The authentication unit 42 of the authentication server 4 receives authentication information and user information from the user terminal 1 via the load balancer 3, and selects an authentication logic using the user information (S17). For example, the user identification information of the user information is specified from the user information transmitted from the user terminal 1 with reference to the user information storage unit 43.

  FIG. 6 shows an example of the user information storage unit 43. In the user information storage unit 43 shown in the figure, for each user, user identification information for uniquely identifying the user in the authentication system and a plurality of types of user information (user ID, IC card information, Fingerprint information and the like) are stored in association with each other. The authentication unit 42 specifies user identification information corresponding to the received user information with reference to the user information storage unit 43.

  Then, the authentication unit 42 reads from the authentication information storage unit 44 an authentication information table in which authentication information corresponding to the specified user identification information is set.

  FIG. 7 shows an example of the authentication information table in the authentication information storage unit 44. The authentication information table shown is held for each user identification information (user), and is generated from each user information using the time zone, at least one authentication logic used in the time zone, and the authentication logic. Each authentication information is set. It is assumed that the authentication information table and the authentication logic correspondence table (see FIG. 5) distributed to the user terminal 1 are synchronized.

  The authentication information table held on the authentication server side is set in the authentication logic correspondence table distributed to the user terminal 1 in consideration of the time required for transmission between the user terminal 1 and the authentication server 4 (transmission delay time). The authentication logic used for n hours before and after (for example, 1 hour before and after) is overlapped. For example, in the table shown in FIG. 7, as the authentication logic used in the time zone from 1 o'clock to 2 o'clock, the authentication logic 1-2 in the time zone from 1 o'clock to 2 o'clock in the authentication logic correspondence table of the user terminal 1 The authentication logic 1-1 in the time zone from 0 o'clock to 1 o'clock and the authentication logic 1-3 in the time zone from 2 o'clock to 3 o'clock thereafter are set.

  The authentication unit 42 refers to the authentication information table corresponding to the user identification information, and selects an authentication logic corresponding to the current time acquired from a clock unit (not shown). Thus, in this embodiment, an authentication logic is selected using the user information and time received from the user terminal 1.

  Then, the authentication unit 42 refers to the authentication information table, specifies authentication information corresponding to the type of user information received in S16 from each authentication information of the selected authentication logic, and receives the specified authentication information and S16. The authentication information is verified, and authentication is performed based on whether or not they match (S18). For example, when the authentication information table shown in FIG. 7 is used, if the current time is 1:35 and the user information received in S16 is a user ID, the authentication information generation unit 13 uses the authentication logic 1-1, 1 -2, 1-3 authentication information of each user ID is identified, and these authentication information and the authentication information received from the user terminal 1 in S16 are respectively collated, and any authentication information identified from the authentication information table If the authentication information received from the user terminal 1 in S16 matches, it is determined that the authentication has succeeded, and if both do not match, it is determined that the authentication has failed.

  In the authentication process of the present embodiment, when data is received during a time (for example, 2 o'clock), the authentication logic for the time zone from 1 o'clock to 2 o'clock and the authentication for the time zone from 2 o'clock to 3 o'clock are performed. Both logic can be applied.

  In the authentication process of the present embodiment, a plurality of authentication logics may be applied to the user terminal 1 within a certain time zone (for example, a time zone from 1 o'clock to 2 o'clock) as shown in FIG. As a result, even if some of the authentication logic malfunctions, there is no problem in business operation, and the availability can be kept high.

  In the authentication information table shown in FIG. 7, authentication information generated in advance is set. However, the authentication information table is a table in which the time zone and the authentication logic are stored in association with each other. The authentication logic selected in S17 may be read from the authentication logic storage unit 45, and the authentication information may be generated and collated from the user information received from the user terminal 1 in S16 as in S15.

  And the authentication part 42 transmits an authentication result to the user terminal 1 (S19). When the authentication is successful (that is, when it matches any of the authentication information), the authenticating unit 42, for example, a certificate so that the user terminal 1 can log in (single sign-on) to the plurality of service providing servers 2. Are transmitted together with the authentication result indicating that the authentication is successful.

  When authentication fails (that is, when the authentication information does not match), the authentication unit 42 inputs user information of a type different from the user information input in S13 together with the authentication result indicating that authentication has failed, A message requesting the user to transmit the authentication information generated from the user information to the authentication server 4 again may be transmitted to the user terminal 1. As described above, in this embodiment, input of a plurality of types of user information can be accepted, and any one of a plurality of authentication logics can be authenticated based on a hash value calculated using the user information. Since logic is selected, high availability can be ensured by selecting another authentication logic even if a logical failure occurs in some authentication logic.

  When receiving the authentication result indicating that the authentication is successful, the transmission unit 14 of the user terminal 1 transmits a login request to at least one service providing server 2 (S20, S21). This login request includes, for example, a certificate for permitting login transmitted from the authentication server, and the service providing server 2 permits login using the certificate or the like, and gives a predetermined service to the user. Provided to the terminal 1.

  In the above-described selection of the authentication logic in S14 of FIG. 5, the user information input in S13 is used as information input to the hash function. However, the information is not limited to user information. For example, information obtained by adding an IP address assigned to the user terminal 1 to the user information may be input to the hash function. By calculating a hash value using an IP address that is dynamically assigned every time the network is accessed, the authentication strength can be further increased. In this case, in S15, authentication information is generated from the information in which the IP address is added to the user information by using the selected authentication logic. In S16, the IP address is transmitted to the authentication server 4 together with the authentication information and the user information. It is good to do.

  In the first embodiment described above, the authentication server 4 distributes the authentication information generation rule to each user terminal 1, and each user terminal 1 selects one of the plurality of authentication logics according to the authentication information generation rule. The authentication information is generated from the user information input by the user using the selected authentication logic, and is transmitted to the authentication server 4. Thus, in this embodiment, by using various authentication methods, the security level can be improved and highly accurate authentication can be performed.

  Also, in this embodiment, by selecting one of a plurality of authentication logics, the authentication logic to be used is changed, and the authentication logic infers even by looking at the authentication information flowing on the network. This can be prevented. In addition, availability can be improved by enabling authentication with a plurality of authentication logics. Further, by dynamically changing the authentication logic, it is difficult to specify the decryption method, and misuse due to wiretapping of authentication information can be prevented.

  In this embodiment, an authentication logic to be used is selected from a plurality of authentication logics using user information and time input by the user, and authentication information is generated using the selected authentication logics. Thereby, even if the user information input by the user is the same, the authentication logic selected in accordance with the time is different, so that the method for generating authentication information can be changed.

  In this embodiment, the user inputs arbitrary user information from a plurality of different types of user information, selects the authentication logic to be used from the plurality of authentication logics using the user information, and selects Authentication information is generated using the authentication logic. Thereby, since the authentication logic selected when a user inputs different types of user information differs, the method for generating authentication information can be changed.

  In the present embodiment, the authentication server 4 can change the method for generating authentication information at a predetermined timing by distributing the authentication information generation rule to each user terminal 1 at a predetermined timing. Also, by distributing different authentication information generation rules for each user terminal 1, the method for generating authentication information can be changed for each user terminal 1.

  Further, the authentication server 4 of this embodiment includes an active machine and a spare machine, and the authentication logic used by the spare machine is different from the authentication logic used by the active machine. Thereby, availability can be improved.

<Second Embodiment>
In the second embodiment of the present invention, not the user terminal 1 but the service providing server 2 holds the authentication logic and generates authentication information. As in the authentication system of the first embodiment (see FIG. 1), the authentication system of the present embodiment is a user terminal 1, a plurality of service providing servers 2, a load distribution device 3, and an authentication server 4 (active machine). ) And an authentication server 5 (preliminary machine).

  FIG. 8 is a block diagram showing the configuration of the service providing server 2 of the present embodiment. The service providing server 2 illustrated includes an authentication information generation rule management unit 21, a login request reception unit 22, an authentication information generation unit 23, a transmission unit 24, a service provision unit 25, and a storage unit 26.

  The authentication information generation rule management unit 21 receives the authentication information generation rule distributed from the authentication server 4 at a predetermined timing and stores it in the storage unit 26. The authentication information generation rule is the same as that of the first embodiment, and a rule for generating authentication information such as a plurality of authentication logics is set.

  The login request receiving unit 22 receives any user information input by the user from a plurality of different types of user information from the user terminal 1. As the user information, for example, various personal information such as a user ID (employee number), IC card information, biometric information such as a fingerprint, and an e-mail address can be used.

  The authentication information generation unit 23 selects one of the plurality of authentication logics according to the authentication information generation rule stored in the storage unit 26 and selects the authentication logic selected from the user information transmitted from the user terminal 1 Authentication information is generated using.

  The transmission unit 24 transmits the authentication information generated by the authentication information generation unit 23 to the authentication server 4 via the network.

  In the present embodiment, since the service providing server 2 holds the authentication information generation rule distributed from the authentication server 4 and generates the authentication information, the user terminal 1 of the present embodiment has the first function shown in FIG. Among the functions of the user terminal 1 of the embodiment, the input terminal 12 receives any user information input by the user from a plurality of different types of user information. The authentication server 4 of this embodiment is the same as the authentication server 4 of the first embodiment, but the distribution unit 41 distributes the authentication information generation rule to each service providing server 2.

  Next, the processing of this embodiment will be described.

  FIG. 9 is a sequence diagram showing the authentication processing of this embodiment.

  The distribution unit 41 of the authentication server 4 distributes the authentication information generation rule to each service providing server 2 in advance (S31). The authentication information generation rule management unit 21 of the service providing server 2 stores the distributed authentication information generation rule in the storage unit 26. The distribution unit 41 distributes authentication information generation rules that differ for each service providing server 2 at a predetermined timing.

  The login request receiving unit 22 of the service providing server 2 receives a login request from the user (S32), and displays an input screen for prompting input of user information (S33). The input receiving unit of the user terminal 1 receives any type of user information input by the user and transmits it to the service providing server 2 (S34).

  The authentication information generation rule is not only distributed in advance in S31, but the authentication information generation rule management unit 21 accesses the authentication server 4 at the timing when the authentication request in S32 is received. It is good also as acquiring a production | generation rule.

  The authentication information generation unit 23 reads the authentication information generation rule stored in the storage unit 26 and selects an authentication logic to be used (S35). Specifically, information used for selecting an authentication logic included in the authentication information generation rule is specified, and the information is input to a hash function to calculate a hash value. The selection of the authentication logic is the same as S14 in FIG. 4 of the first embodiment.

  And the authentication information production | generation part 23 produces | generates authentication information from the user information received from the user terminal 1 by S34 using the authentication logic selected by S35 (S36). That is, user information is input to selected authentication logic (such as a one-way function) to generate authentication information.

  Then, the transmission unit 24 transmits the generated authentication information and the user information used for generating the authentication information to the authentication server 4 (S37).

  The authentication unit 42 of the authentication server 4 receives the authentication information and the user information from the service providing server 2 via the load balancer 3, selects an authentication logic using the user information (S38), Authentication is performed (S39). Since the selection of the authentication logic (S38) and the authentication (S39) are the same as S17 and S18 of FIG. 4 of the first embodiment, description thereof is omitted here.

  And the authentication part 42 transmits an authentication result to the service provision server 2 (S40). When the authentication is successful (that is, when the authentication information matches), the authentication unit 42 uses, for example, a certificate so that the user terminal 1 can log in (single sign-on) to the plurality of service providing servers 2. The result is transmitted to the service providing server 2 together with the authentication result indicating that the authentication is successful.

  When the service providing unit 25 of the service providing server 2 receives the authentication result indicating that the authentication is successful, the service providing unit 25 permits the user terminal 1 to log in and transmits a login completion notification to the user terminal 1 (S41). Thereby, the service providing unit 25 of the service providing server 2 provides a predetermined service to the user terminal 1. In addition, the service providing unit 25 transmits the certificate received from the authentication server 4 together with the login completion notification to the user terminal 1, so that the user terminal 1 receives the certificate at the time of a login request to another service providing server 2. Can be logged in without performing authentication processing.

  On the other hand, when the authentication fails (that is, when the authentication information does not match), the authentication unit 42 of the authentication server 4 includes the authentication result indicating that the authentication has failed and the user information of a type different from the user information input in S34. And a message requesting that the authentication information generated from the user information be transmitted again to the authentication server 4 may be transmitted to the service providing server 2. Thereby, the transmission unit 24 of the service providing server 2 transmits the message to the user terminal 1 and prompts the user to input other types of user information.

  In the second embodiment described above, the authentication server 4 distributes the authentication information generation rule to each service providing server 2, and each service providing server 2 selects one of a plurality of authentication logics according to the authentication information generation rule. An authentication logic is selected, authentication information is generated from user information input by the user using the selected authentication logic, and is transmitted to the authentication server 4. Thus, in this embodiment, by using various authentication methods, the security level can be improved and highly accurate authentication can be performed. Also in the second embodiment, the same effect as in the first embodiment can be obtained.

  In addition, this invention is not limited to the said embodiment, Many deformation | transformation are possible within the range of the summary.

1: User terminal 11: Authentication information generation rule management unit 12: Input reception unit 13: Authentication information generation unit 14: Transmission unit 15: Storage unit 2: Service providing server 21: Authentication information generation rule management unit 22: Login request reception unit 23: Authentication information generation unit 24: Transmission unit 25: Service providing unit 26: Storage unit 3: Load distribution device 4, 5: Authentication server 41: Distribution unit 42: Authentication unit 43: User information storage unit 44: Authentication information storage unit 45: Authentication logic storage unit

Claims (8)

An authentication system comprising: a terminal that accesses a plurality of service providing devices that provide services; and an authentication device that authenticates a user who uses the terminal,
The authentication device
A distribution means for distributing an authentication information generation rule including a plurality of authentication logics to the terminal;
Receiving authentication information from the terminal, and authenticating means for authenticating the authentication information,
The terminal
An authentication information generating unit that selects any one of the plurality of authentication logics according to the authentication information generation rule, and generates authentication information using the selected authentication logic from input user information;
An authentication system comprising: a transmission unit configured to transmit the generated authentication information to the authentication device . The authentication system according to claim 1,
The authentication information generating means of the terminal selects an authentication logic to be used from the plurality of authentication logics using the user information and time,
The authentication unit of the authentication device receives user information together with authentication information from the terminal, and generates authentication information generated from an authentication logic selected using the user information and time, and authentication information received from the terminal. An authentication system characterized by verification by verification. The authentication system according to claim 1 or 2,
The authentication system is characterized in that the distribution means of the authentication device distributes the authentication information generation rule at a predetermined timing and changes a method for generating authentication information. The authentication system according to any one of claims 1 to 3,
The terminal
A user information receiving means for receiving any one of the plurality of types of user information;
The authentication unit of the authentication device requests authentication information generated from different types of user information from the terminal when authentication of authentication information fails. The authentication system according to any one of claims 1 to 4,
The authentication device includes an active machine and a spare machine,
The authentication system used by the spare machine is different from the authentication logic used by the active machine. An authentication system comprising a plurality of service providing devices that provide services to a terminal, and an authentication device that authenticates a user who uses the terminal,
The authentication device
A distribution means for distributing an authentication information generation rule including a plurality of authentication logics to the service providing device;
Receiving authentication information from the service providing apparatus, and authenticating means for authenticating the authentication information,
The service providing apparatus includes:
Authentication information generating means for selecting any one of the plurality of authentication logics according to the authentication information generation rule, and generating authentication information using the selected authentication logic from the user information input at the terminal; ,
An authentication system comprising: a transmission unit configured to transmit the generated authentication information to the authentication device . An authentication method performed by an authentication system comprising: a terminal that accesses a plurality of service providing apparatuses that provide services; and an authentication apparatus that authenticates a user who uses the terminal,
The authentication device
A distribution step of distributing an authentication information generation rule including a plurality of authentication logics to the terminal;
Receiving authentication information from the terminal and authenticating the authentication information, and
The terminal
An authentication information generation step of selecting any authentication logic from the plurality of authentication logics according to the authentication information generation rule, and generating authentication information using the selected authentication logic from input user information;
And a transmitting step of transmitting the generated authentication information to the authentication device . An authentication method performed by an authentication system comprising a plurality of service providing devices that provide services to a terminal and an authentication device that authenticates a user who uses the terminal,
The authentication device
A distribution step of distributing an authentication information generation rule including a plurality of authentication logics to the service providing device;
Receiving authentication information from the service providing apparatus and performing an authentication step of authenticating the authentication information;
The service providing apparatus includes:
An authentication information generation step of selecting any one of the plurality of authentication logics according to the authentication information generation rule, and generating authentication information using the selected authentication logic from the user information input at the terminal; ,
And a transmitting step of transmitting the generated authentication information to the authentication device .

Images