JP6367262B2 - Authentication system - Google Patents

Description

  Embodiments described herein relate generally to an authentication system, an authentication apparatus, and a program.

  In recent years, research on technology for authenticating an individual or a device terminal that uses communication and services via a network has been advanced. In particular, when the subject of authentication (subject) is an individual, fixed-password authentication technology using a user ID and password, biometrics (Biometrics), etc., as identity verification technology for confirming whether or not an individual is an individual Are known. In addition to such identity verification techniques, techniques for tracking the location or spatial situation and / or behavior of subjects and detecting unauthorized access are known. Such a technique is generally called risk-based authentication. For example, it is determined as a risk whether it exists in a specific space, whether it is an access from a physically movable distance from the previous access point, etc., and these are used as supplementary information for authentication.

  However, in the above risk-based authentication, there is a problem that the information verifier can grasp the information on the subject status and / or behavior (hereinafter referred to as context information) one by one and personal privacy cannot be properly protected. As another authentication technique, a pseudonym-based ID federation (Identity Federation) technique for separating an authentication verifier and a service provider is known. However, even in this ID linkage technology, when authentication is performed using subject identification information and context information, the information is centrally managed by an authentication verifier, so that personal privacy is appropriately protected. There is a problem that is not done.

Japanese Patent No. 5100366

“Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0”, [online], OASIS Security Services (SAML) TC, [Search June 1, 2016], Internet <URL: http: // docs .oasis-open.org / security / saml / v2.0 / saml-core-2.0-os.pdf> Tim Moses, “eXtensible Access Control Markup Language (XACML) Version 2.0”, [online], [Search June 1, 2016], Internet <URL: http://docs.oasis-open.org/xacml/2.0/ access_control-xacml-2.0-core-spec-os.pdf> “A Uniform Resource Identifier for Geographic Locations ('geo' URI), [online], Internet Engineering Task Force (IETF), [Search June 1, 2016], Internet <URL: https://tools.ietf.org / html / rfc5870>

  The problem to be solved by the present invention is that an authentication system and an authentication apparatus that can perform high-precision authentication while protecting subject privacy by separately acquiring and managing subject authentication information and context information And to provide a program.

  The authentication system according to the embodiment includes a first device, a second device, and a third device. The first device acquires authentication information from the authentication target. The second device performs authentication of the authentication target. The third device collects information on at least one of the status and behavior of the authentication target from the first device. The first device transmits authentication information to the second device. The second device uses the authentication information to verify the identity of the authentication target, generates a request that includes at least one of the authentication target status and behavior determination conditions, and transmits the request to the third device. The third device evaluates the determination condition using the collected information on at least one of the authentication target situation and the action, and transmits a response including the evaluation result to the second device. The second device authenticates the authentication target based on both the result of identity verification and the evaluation result included in the response.

The functional block diagram which shows the structural example of the authentication system in embodiment. The functional block diagram which shows the structural example of the agent apparatus in embodiment. The figure which shows an example of the context information in embodiment. The functional block diagram which shows the structural example of the contextual authentication apparatus in embodiment. The figure which shows an example of the request description in embodiment. The figure of the example which shows the judgment conditions contained in the request in an embodiment as a Rule element. The functional block diagram which shows the structural example of the context information collection apparatus in embodiment. The functional block diagram which shows the structural example of the context solution apparatus in embodiment. The figure which shows an example which the information memorize | stored in the subject ID information storage part of the contextual authentication apparatus in embodiment, and the information memorize | stored in the agent ID information storage part of a context resolution apparatus are cooperated via cooperation ID. The flowchart which shows an example of the flow of the process of context information collection in embodiment. The flowchart which shows an example of the flow of the authentication process in embodiment.

  Hereinafter, an authentication system according to an embodiment will be described with reference to the drawings.

  FIG. 1 is a functional block diagram showing a configuration example of an authentication system 1 in the present embodiment. The authentication system 1 authenticates the subject M that is an authentication target. The authentication system 1 is configured such that information for identifying a subject M (subject authentication element SA) and context information of the subject M (context information CI) are acquired and managed separately.

  The authentication system 1 includes an agent device 2 (first device), a contextual authentication device 3 (second device), a context information collection device 4 (third device, authentication device), and a context resolution device 5 (third device). , Authentication device). Between the agent device 2 and the context authentication device 3, between the context authentication device 3 and the context resolution device 5, between the context information collection device 4 and the context resolution device 5, and between the agent device 2 and the context information collection device. 4 is connected by an arbitrary network connection form (networks N1, N2, N3, N4). Each of the networks N1, N2, N3, and N4 is realized by, for example, wireless communication such as the Internet, short-range wireless communication such as Wi-Fi, Bluetooth (registered trademark), various wired communication, and the like.

  The agent device 2 is an arbitrary communication device that is used by the subject M and can perform communication via each network. The agent device 2 acquires the subject authentication factor SA from the subject M, transmits the subject authentication factor SA to the contextual authentication device 3 via the network N1, and receives the authentication result AR from the contextual authentication device 3. In the fixed password authentication method, the subject authentication element SA is a user ID and a password. In the challenge and response authentication method using a public key certificate, the subject authentication element SA is a public key certificate pair (a pair of a public key certificate and a private key). In the present embodiment, any authentication method may be used. Further, the agent device 2 transmits the context information CI to the context information collection device 4 via the network N4. The agent device 2 is an arbitrary communication device used in, for example, a mobile phone, a tablet terminal, a PDA (Personal Digital Assistant), a commercial facility, a factory, or the like.

  FIG. 2 is a functional block diagram showing a configuration example of the agent device 2 in the present embodiment. The agent device 2 includes an input receiving unit 20, a subject authentication client unit 21, a context basic information collection unit 22, an agent authentication element storage unit 23, a context information generation unit 24, and a communication unit 25.

  The input receiving unit 20 receives an input of the subject authentication factor SA from the subject M. The input receiving unit 20 is realized by, for example, a keyboard that functions as a user interface, a touch panel display device, a microphone, a camera, and the like. For example, the input reception unit 20 receives input of an ID and a password by the subject M when performing fixed password authentication using an ID and a password. Moreover, the input reception part 20 receives the input of the biometric information (fingerprint, a sound, etc.) of the subject M, when performing biometric authentication.

  The subject authentication client unit 21 executes predetermined authentication processing with the contextual authentication device 3. For example, the subject authentication client unit 21 transmits the subject authentication element SA input from the input receiving unit 20 to the context authentication device 3 via the communication unit 25. Further, the subject authentication client unit 21, for example, displays an authentication completion screen or a display unit (not shown) provided in the agent device 2 according to the authentication result AR received from the contextual authentication device 3 via the communication unit 25. Display the authentication failure screen.

  The context basic information collection unit 22 collects the context basic information CB necessary for generating a context record included in the context information CI. The context basic information CB is information for indicating the situation and / or behavior of the subject M. For example, the context basic information includes information (latitude, longitude, height, measurement accuracy, surveying system, direction, identification information of a specific area, etc.) on the position and movement of the subject M (agent device 2) at a specific time. . The context basic information CB may be acquired and calculated from information acquired by a sensor (position information acquisition device or the like) provided in the agent device 2 or transmission information from the outside. Note that the context record may be data expressed in a specific data format (for example, a format obtained by extending RFC5870 shown in Non-Patent Document 3) based on the context basic information CB.

  The agent authentication element storage unit 23 stores an agent authentication element AE to be added to the context basic information CB collected by the context basic information collection unit 22. The agent authentication element AE is used to generate a search code SC for enabling search of the context information CI and signature data for proving the context information CI. The agent authentication factor AE is secret information associated with the agent device 2 issued by the agent device 2. For example, the agent authentication factor AE is a random data value that is difficult to guess.

  The context information generation unit 24 uses the context basic information CB input from the context basic information collection unit 22 and the agent authentication element AE extracted from the agent authentication element storage unit 23 to generate context information CI. The context information generation unit 24 transmits the context information CI to the context information collection device 4 via the communication unit 25.

  FIG. 3 is a diagram illustrating an example of the context information CI in the present embodiment. The context information CI includes, for example, a search code SC, a device name of the context resolution device 5, context data including the context basic information CB, and signature data.

  The context information generation unit 24 uniquely generates the search code SC from the agent authentication element AE and a predetermined seed value. The search code SC may be updated at regular intervals for generating the context information CI, and a method in which the relationship between the search codes SC cannot be estimated unless the agent authentication factor AE and the seed value are known. For example, a method of generating a random character string at a constant time interval such as a time synchronization one-time password, or a method using a one-way function such as S / KEY may be adopted. If it is not easy to use a common agent authentication factor for the search code SC and signature data, an independent agent authentication factor may be used.

  The communication unit 25 transmits and receives various types of information between the contextual authentication device 3 and the context information collection device 4. For example, the communication unit 25 transmits the subject authentication factor SA to the contextual authentication device 3 via the network N1 and receives the authentication result AR from the contextual authentication device 3. The communication unit 25 transmits the context information CI to the context information collection device 4 via the network N4.

  The contextual authentication device 3 performs identity verification of the subject M based on the subject authentication factor SA received from the agent device 2. Further, the context authentication device 3 generates a request RQ based on the subject authentication element SA and transmits the request RQ to the context resolution device 5. Further, the context authentication device 3 evaluates the response RP received from the context resolution device 5. The contextual authentication device 3 authenticates the subject M based on both the result of the identity verification and the evaluation result of the response RP, and transmits the authentication result AR to the agent device 2.

  FIG. 4 is a functional block diagram illustrating a configuration example of the contextual authentication device 3 in the present embodiment. The contextual authentication device 3 includes a subject authentication unit 30, a request generation unit 31, a policy storage unit 32, an ID linkage resolution unit 33, a subject ID information storage unit 34, a response evaluation unit 35, and a communication unit 36. Is provided.

  The subject authentication unit 30 verifies the subject M based on the subject authentication element SA received from the agent device 2. The subject authentication unit 30 executes an arbitrary authentication method with the agent device 2, and specifies subject identification information SI that uniquely specifies the subject M in the processing of the context authentication device 3. In this case, the subject authentication unit 30 acquires, from the subject ID information storage unit 34, the subject identification information SI associated with the subject authentication element SA received from the agent device 2. In addition, the subject authentication unit 30 generates an authentication result AR of the subject M based on the evaluation result ER input from the response evaluation unit 35 and transmits the authentication result AR to the agent device 2.

  The request generation unit 31 generates a request RQ to be transmitted to the context resolution device 5 from the subject identification information SI input from the subject authentication unit 30 and the policy P stored in the policy storage unit 32. The policy P designates a determination condition for processing for determining whether or not the context information CI associated with the subject M specified by the subject identification information SI satisfies a predetermined condition.

  FIG. 5 is a diagram illustrating an example of a request description in the present embodiment. In this example, a policy description according to the OASIS XACML V2.0 specification (Non-Patent Document 2) is used. In the AttributeValue element, the cooperation ID of the subject M linked between the context authentication apparatus 3 and the context resolution apparatus 5 is specified. This linkage ID is associated with the subject identification information SI input from the subject authentication unit 30 and is stored in the subject ID information storage unit 34. In the example shown in FIG. 5, a single policy expression is used, but it may be expressed in a separated form such as a Request element and a Policy element defined in OASIS XACML V2.0. An arbitrary request expression format may be adopted as long as elements indicating the cooperation ID associated with the subject M and the determination condition are included.

  FIG. 6 is an example showing the determination conditions included in the request description example in FIG. 5 as Rule elements. In this example, a determination condition as to whether or not the subject M to be determined is included in the specified circumference (value indicated by the AttributeValue element value) is shown as the Environments element. This value indicates a circumferential expression format obtained by expanding GeoURI of Non-Patent Document 3. In addition to the position information (latitude: 35.668557, longitude: 139.471814) indicated by the standard GeoURI, the distance from this position information is indicated by the r parameter value to express the circumference from a specific position. ing. In addition, this determination process is performed by a unique function that extends OASIS XACML V2.0, which is specified by the MatchId attribute value of the EnvironmentMatch element. In this Rule element, “Permit” is returned as Effect when the above condition is met. In this example, an example of the determination condition is shown, and an arbitrary determination condition may be designated as long as the policy description specification allows it.

  The ID cooperation resolution unit 33 acquires the cooperation ID associated with the subject identification information SI input from the request generation unit 31 from the subject ID information storage unit 34 and outputs it to the request generation unit 31.

  The response evaluation unit 35 evaluates the response RP received from the context resolution device 5. In the present embodiment, the response evaluation unit 35 evaluates a Response element in, for example, OASIS XACML V2.0 format, and outputs the evaluation result ER1 to the subject authentication unit 30.

  The communication unit 36 transmits and receives request RQ and response RP messages to and from the context resolution device 5.

  The context information collection device 4 receives the context information CI from the agent device 2 via the network N4, and stores the received context information CI. The context information collection device 4 transmits the context information CI from the agent device 2 to the context resolution device 5 via the network N3.

  FIG. 7 is a functional block diagram illustrating a configuration example of the context information collection device 4 in the present embodiment. The context information collection device 4 includes a context information collection unit 40 (collection unit), a context information storage unit 41, a context information extraction unit 42, and a communication unit 43.

  The context information collection unit 40 collects the context information CI from the agent device 2 via the network N4, and stores the collected context information CI in the context information storage unit 41. The network N4 may be, for example, close proximity wireless communication represented by Bluetooth Low Energy (BLE) specifications.

  The context information extraction unit 42 extracts the context information CI stored in the context information storage unit 41 and transmits it to the context resolution device 5 specified in the context information CI. At this time, signature information indicating that the context information collection device 4 has collected may be added.

  The communication unit 43 transmits the context information CI input from the context information extraction unit 42 to the context resolution device 5 via the network N3.

  The context resolution device 5 evaluates the context information CI received from the context information collection device 4 via the network N3 according to the policy included in the request RQ received from the contextual authentication device 3 via the network N2. The response RP including the result ER2 is transmitted to the contextual authentication device 3.

  FIG. 8 is a functional block diagram showing a configuration example of the context resolution device 5 in the present embodiment. The context resolution device 5 includes a request analysis unit 50 (extraction unit), a policy evaluation unit 51 (evaluation unit), a response generation unit 52 (evaluation unit), a context resolution unit 53 (extraction unit), and a search code generation unit. 54 (extraction unit), an agent ID information storage unit 55, a context information acquisition unit 56 (collection unit), a context information storage unit 57, and a communication unit 58 (evaluation unit).

  The request analysis unit 50 analyzes the request RQ received from the contextual authentication device 3 via the communication unit 58 and extracts the cooperation ID and the policy P included in the request RQ. Further, the request analysis unit 50 acquires the context information CI associated with the extracted linkage ID, and outputs a set of the context information CI and the policy P to the policy evaluation unit 51.

  The context resolution unit 53 acquires the context information CI from the context information storage unit 57 based on the search code SC associated with the cooperation ID input from the request analysis unit 50, and the request analysis unit 50 uses the acquired context information CI. Output to. In this case, the context resolution unit 53 outputs the cooperation ID to the search code generation unit, and acquires the search code SC associated with the cooperation ID from the search code generation unit. Further, the context resolution unit 53 may interpret the policy P included in the request RQ and limit the range of the context information CI output to the request analysis unit 50 in order to reduce the load on the policy evaluation unit 51. For example, if the policy P includes a condition for specifying time (such as a range from January 1, 2015 to January 10, 2015), only the context information CI that matches the condition is included in the request analysis unit 50. May be output.

  The search code generation unit 54 generates a search code SC based on the cooperation ID input from the context resolution unit 53. For example, the search code generation unit 54 extracts the agent authentication element AE associated with the cooperation ID input from the context resolution unit 53 from the agent ID information storage unit 55 that stores the association ID and the agent authentication element AE in association with each other. To do. Next, the search code generation unit 54 generates a search code SC based on the extracted agent authentication element AE. For example, the search code generation unit 54 uniquely generates the search code SC from the agent authentication element AE and a predetermined seed value. The search code SC generated by the search code generation unit 54 for a specific agent authentication element AE is the same as the search code SC generated by the context information generation unit 24 of the agent device 2 for the same agent authentication element AE. It is.

  FIG. 9 shows that information stored in the subject ID information storage unit 34 of the contextual authentication device 3 and information stored in the agent ID information storage unit 55 of the context resolution device 5 are linked via a linkage ID. It is a figure which shows an example. In this example, a common ID “xhso1801osi” is stored in the subject ID information storage unit 34 and the agent ID information storage unit 55. By using this linkage ID, the information stored in the subject ID information storage unit 34 and the information stored in the agent ID information storage unit 55 can be linked.

  The context information acquisition unit 56 receives the context information CI from the context information collection device 4 and stores the received context information CI in the context information storage unit 57. The context information acquisition unit 56 and the context information storage unit 57 may be omitted, and the context resolution unit 53 may acquire the context information CI from the context information collection device 4.

  The policy evaluation unit 51 evaluates the policy P and the context information CI input from the request analysis unit 50, and outputs the evaluation result ER2 to the response generation unit 52.

  The response generation unit 52 generates a response RP using the evaluation result ER <b> 2 input from the policy evaluation unit 51, and transmits the generated response RP to the contextual authentication device 3 via the communication unit 58.

  The communication unit 58 transmits and receives request RQ and response RP messages to and from the contextual authentication device 3.

  Next, the operation of the authentication system 1 configured as described above will be described.

  FIG. 10 is a flowchart illustrating an example of a flow of context information collection processing. First, the context basic information collection unit 22 of the agent device 2 collects the context basic information CB according to a predetermined trigger (step ST1-1). Examples of the trigger include a fixed interval and when the agent device 2 detects the context information collection device 4 capable of receiving the context information CI. For example, when the BLE specification is used as the network N4, the agent device 2 can detect a collectable area of the context information collection device 4 by detecting an advertisement transmitted by the context information collection device 4. Further, when collecting the context basic information CB at regular intervals, the context basic information CI collected in the agent device 2 may be temporarily cached.

  Next, the context information generation unit 24 of the agent device 2 uses the context basic information CB input from the context basic information collection unit 22 and the agent authentication element AE extracted from the agent authentication element storage unit 23 to use the context information. CI is generated (step ST1-2). Similarly to step ST <b> 1-1, the context information generation unit 24 may generate the context information CI in advance and temporarily cache it in the agent device 2. The device name of the context resolution device 5 specified in the context information CI may be dynamically acquired from the nearby context information collection device 4.

  Next, the communication unit 25 of the agent device 2 transmits the context information CI generated by the context information generation unit 24 to the neighboring context information collection device 4 that can be transmitted (step ST1-3).

  Next, the context information collection device 4 transmits the context information CI received from the agent device 2 to the context resolution device 5 designated by the device name of the context information CI (step ST1-4).

  Next, the context information acquisition unit 56 of the context resolution device 5 stores the context information CI received from the context information collection device 4 in the context information storage unit 57, and ends the process of this flowchart (step ST1-5).

  FIG. 11 is a flowchart illustrating an example of the flow of authentication processing. First, the input receiving unit 20 of the agent device 2 receives an input of authentication information (subject authentication element SA) by the subject M (step ST2-1). For example, the input reception unit 20 receives input of the user ID and password by the subject M when performing fixed password authentication using the user ID and password. In the following, a case where fixed password authentication is performed will be described as an example. However, in the present embodiment, any authentication method may be used.

  Next, the subject authentication client unit 21 of the agent device 2 transmits the subject authentication element SA input from the input receiving unit 20 to the context authentication device 3 via the communication unit 25 (step ST2-2).

  Next, the subject authentication unit 30 of the contextual authentication device 3 authenticates the subject M based on the subject authentication element SA received from the agent device 2 (step ST2-3). The subject authentication unit 30 collates the subject authentication element SA (for example, user ID and password) received from the agent device 2 with the information stored in the subject ID information storage unit 34. When the data corresponding to the subject authentication element SA is stored in the subject ID information storage unit 34, the subject authentication unit 30 determines that the personal authentication is successful and the subject identification information SI associated with the subject authentication element SA. Is obtained from the subject ID information storage unit 34. Further, the subject authentication unit 30 outputs subject identification information SI to the request generation unit 31. The request generation unit 31 outputs the subject identification information SI to the ID cooperation resolution unit 33. Next, the ID cooperation resolution unit 33 extracts the cooperation ID associated with the subject identification information SI from the subject ID information storage unit 34 and outputs the extracted cooperation ID to the request generation unit 31. This cooperation ID is extracted by the number of context resolution apparatuses 5 to which the subject M has already been linked.

  On the other hand, if the data corresponding to the subject authentication element SA is not stored in the subject ID information storage unit 34, the subject authentication unit 30 determines that the personal authentication has failed, and sends the authentication result AR indicating the authentication failure to the agent device 2 and the process of this flowchart is terminated.

  Next, the request generation unit 31 generates a request RQ using the cooperation ID input from the ID cooperation resolution unit 33 and the policy P stored in the policy storage unit 32 (step ST2-4). The request generation unit 31 determines which policy P to apply based on the service to which the subject M requested authentication in ST2-1.

  Next, the request generation unit 31 transmits the generated request RQ to the context resolution device 5 via the communication unit 36 (step ST2-5).

  Next, the request analysis unit 50 of the context resolution device 5 analyzes the request RQ received from the contextual authentication device 3 to acquire a cooperation ID, and outputs the acquired cooperation ID to the context resolution unit 53 (step ST2- 6). The request analysis unit 50 analyzes the request RQ and acquires the policy P.

  Next, the context resolution unit 53 of the context resolution device 5 acquires the search code SC associated with the cooperation ID input from the request analysis unit 50 from the search code generation unit 54 (step ST2-7). Here, the search code generation unit 54 extracts the agent authentication element AE associated with the cooperation ID from the agent ID information storage unit 55, and generates the search code SC using the extracted agent authentication element AE.

  Next, the context resolution unit 53 extracts the context information CI associated with the search code SC from the context information storage unit 57 (step ST2-8). The context resolution unit 53 outputs the extracted context information CI to the request analysis unit 50, and the request analysis unit 50 outputs the combination of the context information CI and the policy P to the policy evaluation unit 51.

  Next, policy evaluation unit 51 evaluates policy P using the set of context information CI and policy P input from request analysis unit 50, and outputs evaluation result ER2 to response generation unit 52 (step ST2). -9).

  Next, the response generation unit 52 generates a response RP including the evaluation result ER2, and transmits the generated response RP to the contextual authentication device 3 via the communication unit 58 (step ST2-10).

  Next, the response evaluation unit 35 of the contextual authentication device 3 evaluates the response RP received from the context resolution device 5 and outputs the evaluation result ER1 to the subject authentication unit 30. The subject authentication unit 30 generates a final authentication result AR (authentication success, authentication failure) based on the evaluation result ER1 input from the response evaluation unit 35, and transmits it to the agent device 2 to perform the processing of this flowchart. The process ends (step ST2-11).

  According to at least one embodiment described above, the context authentication device 3 that acquires and holds the authentication information (person information) of the subject M, and the context information collection device 4 that acquires and holds the context information CI (context resolution device). 5), the authentication information of the subject M and the context information CI can be physically separated and held. Further, since the request RQ and the response RP transmitted / received between the context authentication device 3 and the context resolution device 5 are specified by the linkage ID, the context information collection device 4 holds information on the subject M. There is no need. Further, the context authentication device 3 authenticates the subject M based on both the result of identity verification of the subject M and the evaluation result included in the response RP. Thereby, highly accurate authentication can be performed while protecting the privacy of the subject M.

  The method described in the above embodiment is a program that can be executed by a computer as a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), optical disk (CD-ROM, DVD, etc.), magneto-optical disk (MO). ), And can be distributed in a storage medium such as a semiconductor memory.

  In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form. In addition, an OS (operating system) operating on a computer based on an instruction of a program installed on the computer from a storage medium, MW (middleware) such as database management software, network software, or the like realizes the above-described embodiment. A part of each process may be executed. Furthermore, the storage medium in the present embodiment is not limited to a medium independent of a computer, but also includes a storage medium that downloads and stores or temporarily stores a program transmitted via a LAN, the Internet, or the like.

  Further, the number of storage media is not limited to one, and the case where the processing in the above embodiment is executed from a plurality of media is also included in the storage medium in this embodiment, and the medium configuration may be any configuration. The computer in this embodiment executes each process in the above embodiment based on a program stored in a storage medium, and a single device such as a personal computer or a plurality of devices are connected to a network. Any configuration such as a system may be used. In addition, the computer in the present embodiment is not limited to a personal computer, and includes an arithmetic processing device, a microcomputer, and the like included in an information processing device. Yes.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 1 ... Authentication system, 2 ... Agent apparatus, 3 ... Contextual authentication apparatus, 4 ... Context information collection apparatus, 5 ... Context resolution apparatus, 20 ... Input reception part, 21 ... Subject authentication client part, 22 ... Context basic information collection part , 23 ... Agent authentication element storage unit, 24 ... Context information generation unit, 25 ... Communication unit, 30 ... Subject authentication unit, 31 ... Request generation unit, 32 ... Policy storage unit, 33 ... ID cooperation resolution unit, 34 ... Subject ID Information storage unit 35 ... Response evaluation unit 36 ... Communication unit 40 ... Context information collection unit 41 ... Context information storage unit 41, 42 ... Context information extraction unit 43 ... Communication unit 50 ... Request analysis unit 51 ... Policy evaluation unit, 52 ... response generation unit, 53 ... context resolution unit, 54 Search code generating unit, 55 ... agent ID information storage unit, 56 ... context information acquisition unit, 57 ... context information storage unit, 58 ... communication unit 58, M ... subject, N1, N2, N3, N4 ... Network

Claims (2)

A first device for obtaining authentication information from an authentication target;
A second device for performing authentication of the authentication target;
A third device that collects information about at least one of the status and behavior of the authentication target from the first device;
An authentication system comprising:
The first device transmits the authentication information to the second device;
The second device performs identity verification of the authentication target using the authentication information, and at least one determination condition of the status and action of the authentication target, and both the second device and the third device Generating a request including the cooperation ID held by the second device among the cooperation IDs held in advance, and transmitting the request to the third device.
The third device extracts information associated with the linkage ID included in the request received from the second device from the collected information on at least one of the authentication target situation and action, and the extracted information To evaluate the determination condition, and send a response including the evaluation result to the second device,
The second apparatus is an authentication system in which the authentication target is authenticated based on both the result of the identity verification and the evaluation result included in the response.   The authentication system according to claim 1, wherein the information related to at least one of the status and action of the authentication target includes position information of the authentication target.

Images