JP6985195B2 - Authentication device, screen display method and program - Google Patents

Description

The present invention relates to an authentication device, a screen display method and a program.

Conventionally, many devices are equipped with an authentication function for confirming whether or not a user has access authority. An authentication method by inputting a user ID and a password is generally used.

A system for appropriately changing the input position of the personal identification number is known in order to improve the security in the authentication process (see, for example, Patent Document 1). Further, in order to improve security, a system that can use Chinese characters as a password is known (see, for example, Patent Document 2).

JP-A-2015-170315 Japanese Unexamined Patent Publication No. 2002-7699

In the authentication method by inputting a user ID and password, a malicious person may automatically and continuously try to input the user ID and password using a malicious program, steal the user ID and password, and log in illegally. ..

An object of the present invention is to provide an authentication device, a screen display method and a program capable of suppressing an unauthorized login using a malicious program.

In order to achieve the above object, the authentication device disclosed in the specification is an input for inputting a character string display unit for displaying a character string to be input and a character string corresponding to the content displayed on the character string display unit. The format of the authentication screen including the box, the storage means for storing the background image, the format of the authentication screen and the background image are read from the storage means, and the character string display unit included in the format of the authentication screen is displayed. An authentication screen is created by displaying a predetermined character string, a transparency process for transmitting the background image is executed on the authentication screen, and the background image and the authentication screen on which the transparency process is executed are displayed on the screen of the display device. It is characterized by having a control means for outputting.

According to the authentication device, screen display method and program of the present invention, unauthorized login using a malicious program can be suppressed.

It is a block diagram of the authentication apparatus which concerns on this embodiment. It is a figure which shows an example of the screen of the display part which displays the authentication screen. It is a flowchart which shows the process of determining a character string and a text box by a program. It is a figure which shows the example of the format of the authentication screen. It is a flowchart which shows the display process of an authentication screen. It is a figure which shows the display example of the screen of the display part after the display process of FIG. It is a flowchart which shows the display process of an authentication screen. (A) is a diagram showing a list of synonyms for user names, and (B) is a diagram showing a list of synonyms for passwords. It is a flowchart which shows the display process of an authentication screen. (A) and (B) are diagrams showing an example of changing the arrangement of a user name display unit, a password display unit, two text boxes, and a login button displayed on the authentication screen. It is a flowchart which shows the display process of an authentication screen. (A) and (B) are diagrams showing a modified example of the format of the authentication screen. It is a flowchart which shows the display process of an authentication screen. It is a flowchart which shows the authentication process.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a configuration diagram of an authentication device according to the present embodiment. The authentication device shown in FIG. 1 is a computer 1. The authentication device according to the present embodiment is not limited to the computer 1, and is, for example, a device for inputting and authenticating a password of a mobile phone, a tablet terminal, an automated teller machine (ATM), a kiosk terminal, or the like.

The computer 1 includes a CPU (Central Processing Unit) 2 as a control means for controlling the overall operation of the computer 1, a memory 3 as a storage means for storing various data, an authentication screen format, a background image, and the like, and a hard disk drive (a hard disk drive). The HDD) 4, a display unit 5 for displaying an authentication screen, a background image, and the like, an input unit 6 for inputting a user ID and a password, and a communication unit 7 for communicating with an external terminal are provided. The display unit 5 is, for example, a liquid crystal display. The input unit 6 is, for example, a keyboard, a mouse, a touch panel, or the like. The communication unit 7 is a wired or wireless communication module. The CPU 2 is connected to the memory 3, the HDD 4, the display unit 5, the input unit 6, and the communication unit 7 via the bus 8. The display unit 5, the input unit 6, and the communication unit 7 may not be built in the computer 1 but may be externally attached to the computer 1.

FIG. 2 is a diagram showing an example of the screen of the display unit 5 on which the authentication screen is displayed.

The screen 11 of the display unit 5 displays the background image 12. Then, when the computer 1 is started up or when the computer 1 is accessed, the authentication screen 13 shown in FIG. 2 is displayed on the screen 11. Normally, the authentication screen 13 is a so-called pop-up display, and is displayed in a movable state on the background image 12. The authentication screen 13 includes a text box 14 for inputting text data corresponding to a user name and a password.

The malicious program determines the character strings of the user name and password on the authentication screen 13 and the corresponding text boxes 14, and automatically continuously inputs the user ID and password into these text boxes 14.

FIG. 3 is a flowchart showing a process of determining a character string and a text box by a program.

First, the program acquires all pixel data of the screen 11 (S1). Next, from the RGB values of all the pixel data, it is confirmed where there is a change between the bright part and the dark part (S2). Next, it is confirmed that the RGB values of the dark part are continuous, that is, the parts where the same color is continuous (S3). This is because the frame of the character string and the text box is basically composed of black, that is, a dark part.

Then, it is confirmed whether the set of RGB values of the location detected in S3 matches the character string such as "user name" or "password" (S4). If the set of RGB values detected in S3 matches a character string such as "user name" or "password" (YES in S4), RGB in the vicinity of the character string in S4 and in the location detected in S3. Check if the set of values is rectangular (S5). When the set of RGB values in the vicinity of the character string of S4 and the location detected in S3 is a rectangle (YES in S5), it is determined that the rectangular portion is the text box 14 of the corresponding character string (S6). ).

If the set of RGB values of the location detected in S3 does not match the character string such as "user name" or "password" (NO in S4), return to S3 and check another location. If the set of RGB values in the vicinity of the character string in S4 and the location detected in S3 is not rectangular (NO in S5), return to S3 and check another location.

In this way, since the character string and the text box 14 in the authentication screen 13 of FIG. 2 can be specified by using a malicious program, unauthorized login cannot be suppressed.

Therefore, in the present embodiment, various processes are executed for the display of the authentication screen. Hereinafter, various processes executed for displaying the authentication screen will be described.

(Example 1)
FIG. 4 is a diagram showing an example of the format of the authentication screen. Here, in order to distinguish it from the authentication screen 13 of FIG. 2, the authentication screen is referred to as 15.

The format of the authentication screen 15 of FIG. 4 is stored in the memory 3 or the HDD 4 in advance. The authentication screen 15 has a user name display unit 16 that displays a character string corresponding to a "user name", a password display unit 17 that displays a character string corresponding to a "password", and a text box 18 for inputting a "user name". It is provided with a text box 19 for inputting a "password" and a login button 20. The character strings input to the text boxes 18 and 19 are hiragana, katakana, kanji, alphabets, numbers or symbols, and combinations thereof. The user name display unit 16 and the password display unit 17 function as a character string display unit that displays a character string to be input. The text box 18 and the text box 19 function as input boxes for inputting character strings corresponding to the contents displayed on the user name display unit 16 and the password display unit 17.

The initial display positions of the user name display unit 16, the password display unit 17, the text box 18, the text box 19, and the login button 20 are the positions shown in FIG. The authentication screen 15 does not have to include a part of the user name display unit 16, the password display unit 17, the text box 18, the text box 19, and the login button 20. For example, when only the input of the password is requested, the user name display unit 16 and the text box 18 may be omitted from the authentication screen 15.

FIG. 5 is a flowchart showing the display process of the authentication screen 15. FIG. 6 is a diagram showing a display example of the screen 11 after the display process of FIG.

First, the CPU 2 reads the format of the authentication screen 15 from the memory 3 or the HDD 4 (S11), displays the "user name" on the user name display unit 16 (S12), and displays the "password" on the password display unit 17 (S13). ). According to S11 to S13, the CPU 2 creates an authentication screen in which a "user name" and a "password" are displayed. After that, the CPU 2 reads the background image 12 from the memory 3 or the HDD 4 (S14). The CPU 2 executes a transparency process for transmitting the background image 12 on the authentication screen 15 (S15), outputs the background image 12 and the authentication screen 15 on which the transparency process is executed to the screen 11 of the display unit 5 (S16), and presents the present. End the process.

According to the display process of FIG. 5, as shown in FIG. 6, the authentication screen 15 on which the transparency process is executed is displayed on the screen 11 so as to overlap with the background image 12. Since the background image 12 such as a photograph passes through the character strings of the "user name" and "password" of the authentication screen 15 and the text box 18 and the text box 19, the RGB values of all the pixel data on the screen 11 change randomly. As a result, the authentication screen 15 can be discriminated by the human eye, but it becomes difficult for the program to discriminate the authentication screen 15. Therefore, the character strings of "user name" and "password" in the authentication screen 15 using the program and the text boxes 18 and text boxes 19 cannot be accurately detected, making it difficult to be attacked by a password attempt, and unauthorized login. Can be suppressed.

(Example 2)
FIG. 7 is a flowchart showing the display process of the authentication screen 15. The description of the same process as the display process of FIG. 5 will be omitted.

After S13, the CPU 2 randomly reads one background image 12 from the plurality of background images stored in the memory 3 or the HDD 4 in advance (S14A). By this step, the background image can be changed every time the authentication screen 15 is displayed. In addition, since the number of combinations of the authentication screen analyzed by the program and the display of the background image increases, it is less likely to be attacked by a password trial, and unauthorized login can be suppressed.

In this embodiment, it is necessary to store a large number of background images in the memory 3 or HDD 4, but for one background image 12, (i) color is replaced according to a predetermined rule, (ii) enlargement or Perform processing such as reduction processing, (iii) flipping upside down, (iv) flipping color brightness, (v) color gradation processing, (vi) copying a part of the screen, etc. Therefore, the types of the background image 12 can be increased.

(Example 3)
FIG. 8A is a diagram showing a list of synonyms for user names, and FIG. 8B is a diagram showing a list of synonyms for passwords.

The list of synonyms for the user name shown in FIG. 8A and the list of synonyms for the password shown in FIG. 8B are stored in the memory 3 or the HDD 4 in advance. The list of synonyms for the user name indicates a plurality of candidates for the character string displayed on the user name display unit 16. The password synonym list indicates a plurality of candidates for the character string displayed on the password display unit 17. When the "account name" is selected from the synonym list of FIG. 8A, the character string of the "account name" is displayed on the user name display unit 16. When the "password" is selected from the synonym list of FIG. 8B, the character string of the "password" is displayed on the password display unit 17.

FIG. 9 is a flowchart showing the display process of the authentication screen 15. The description of the same process as the display process of FIG. 5 will be omitted.

After S11, the CPU 2 randomly selects one character string from the list of synonyms for the user name stored in the memory 3 or the HDD 4, and displays the selected character string on the user name display unit 16 (S12A). .. Next, the CPU 2 randomly selects one character string from the password synonym list stored in the memory 3 or the HDD 4, and displays the selected character string on the password display unit 17 (S13A). After that, the process of S14 is executed. With S12A and S13A, the character string displayed on the user name display unit 16 and the password display unit 17 can be changed each time the authentication screen 15 is displayed. In addition, since the number of display examples of the authentication screen that the program should analyze increases, it is less likely to be attacked by a password attempt, and unauthorized login can be suppressed.

In the display process of FIG. 9, the process of S14A of FIG. 7 may be executed instead of the process of S14.

(Example 4)
10 (A) and 10 (B) are diagrams showing an example of changing the arrangement of the user name display unit 16, the password display unit 17, the text box 18, the text box 19, and the login button 20 displayed on the authentication screen 15. ..

In FIG. 4, the password display unit 17 and the text box 19 are arranged below the user name display unit 16 and the text box 18, respectively. In FIG. 10A, the password display unit 17 and the text box 19 are user names. It is arranged on the display unit 16 and the text box 18, respectively. Further, in FIG. 4, the login button 20 is arranged at the bottom, but in FIG. 10A, the login button 20 is arranged at the top. In FIG. 10B, the password display unit 17 and the text box 19 are arranged on the left side of the user name display unit 16 and the text box 18. In this way, the CPU 2 can change the display positions of the user name display unit 16, the password display unit 17, the text box 18, the text box 19, and the login button 20 displayed on the authentication screen 15.

FIG. 11 is a flowchart showing the display process of the authentication screen 15. The description of the same process as the display process of FIG. 5 will be omitted.

After S13, the CPU 2 randomly changes the display positions of the user name display unit 16 and the text box 18 in the authentication screen 15 (S17). If the user name display unit 16 and the text box 18 are displayed at distant positions, the user name input position cannot be determined. Therefore, the user name display unit 16 and the text box 18 are displayed in association with each other.

Next, the CPU 2 randomly changes the display positions of the password display unit 17 and the text box 19 in the authentication screen 15 so as not to overlap the display positions of the user name display unit 16 and the text box 18 (S18). If the password display unit 17 and the text box 19 are also displayed at distant positions, the password input position cannot be determined. Therefore, the password display unit 17 and the text box 19 are displayed in association with each other.

Next, the CPU 2 randomly changes the display position of the login button 20 in the authentication screen 15 so as not to overlap the display positions of the user name display unit 16, the text box 18, the password display unit 17, and the text box 19 (S19). ). After that, the process of S14 is executed.

As a method of randomly changing the display position in S17 to S19, for example, a method of selecting the coordinate data of one display position from the coordinate data of a plurality of display positions stored in the memory 3 or the HDD 4, or the randam function. There is a method of calculating the coordinate data of the display position using.

From S17 to S19, the display positions of the user name display unit 16, the password display unit 17, the text box 18, the text box 19, and the login button 20 can be changed each time the authentication screen 15 is displayed. In addition, since the number of display examples of the authentication screen analyzed by the program increases, it is less likely to be attacked by a password attempt, and unauthorized login can be suppressed.

In the display process of FIG. 11, the process of S12A and S13A of FIG. 9 may be executed instead of the process of S12 and S13. Further, in the display process of FIG. 11, the process of S14A of FIG. 7 may be executed instead of the process of S14.

(Example 5)
12 (A) and 12 (B) are diagrams showing a modified example of the format of the authentication screen 15.

The authentication screen 15 of FIG. 12A is a dummy display that displays a character string corresponding to the “dummy” in addition to the user name display unit 16, the password display unit 17, the text box 18, the text box 19, and the login button 20. A unit 21 and a text box 22 for inputting a character string corresponding to the "dummy" are provided.

The authentication screen 15 of FIG. 12B includes a user name display unit 16, a password display unit 17, a text box 18, a text box 19, and a login button 20, as well as a dummy text box 23 in which a character string cannot be input. ing.

In this way, the CPU 2 can add the dummy display unit 21, the text box 22, or the text box 23 to the authentication screen 15. When the input is executed in the text box 22 or the text box 23, the CPU 2 may determine that the attack is by a malicious program.

FIG. 13 is a flowchart showing the display process of the authentication screen 15. The description of the same process as the display process of FIG. 11 will be omitted.

After S19, the CPU 2 has a dummy display unit 21 and a text box 22 in the authentication screen 15 so as not to overlap with the display positions of the user name display unit 16, the text box 18, the password display unit 17, the text box 19, and the login button 20. Alternatively, a text box 23 is added (S20). After that, the process of S14 is executed.

Since the dummy display unit 21 and the text box 22 or the text box 23 are added to the authentication screen 15, the number of display examples of the authentication screen analyzed by the program increases, the attack by password trial is less likely to occur, and unauthorized login is suppressed. can do.

In the display process of FIG. 13, instead of the processes of S12 and S13, the processes of S12A and S13A of FIG. 9 may be executed. Further, in the display process of FIG. 13, the process of S14A of FIG. 7 may be executed instead of the process of S14.

(Example 6)
In this embodiment, the authentication process executed after the authentication screen 15 of FIG. 12A is displayed on the screen 11 will be described. Here, the display process of FIG. 13 is assumed, but the display process may be any one of FIGS. 5, 7, 9, and 11.

FIG. 14 is a flowchart showing the authentication process. It is assumed that the authentication screen 15 of FIG. 12A is displayed on the screen by the display process of FIG.

First, the CPU 2 determines whether or not the cursor is located in the text box 18 (S31).

When the cursor is located in the text box 18 (YES in S31), the CPU 2 randomly selects one from a plurality of background images stored in the memory 3 or the HDD 4, and reads out the selected background image 12 (S32). ). The CPU 2 executes a transparency process for transmitting the background image 12 on the authentication screen 15 (S33), and outputs the background image 12 and the authentication screen 15 on which the transparency process is executed to the screen 11 of the display unit 5 (S34). After that, the procedure returns to S31.

If the cursor is not located in the text box 18 (NO in S31), the CPU 2 determines whether or not the cursor is located in the text box 19 (S35). If the cursor is in the text box 19 (YES in S35), the procedure proceeds to S32.

If the cursor is not located in the text box 19 (NO in S35), the CPU 2 determines whether or not the cursor is located in the text box 22 (S36). If the cursor is in the text box 22 (YES in S36), the procedure proceeds to S32.

If the cursor is not located in the text box 22 (NO in S36), the CPU 2 determines whether or not the login button 20 has been pressed (S37). If the login button 20 is not pressed (NO in S37), the procedure returns to S31. When the login button 20 is pressed (YES in S37), the CPU 2 executes an authentication process based on the character strings input in the text boxes 18 and 19 (S38), and displays the authentication result on the screen of the display unit 5. Output to 11 (S39), and this process ends.

According to the authentication process of FIG. 14, the background image 12 is changed every time the cursor is located in the text box 18, the text box 19, or the text box 22 (YES → S32 in S31, S35, and S36). Since the background image 12 changes each time the user name and password are input, the program analyzes the character strings displayed on the user name display unit 16, the password display unit 17, and the dummy display unit 21, as well as the text box 18 and the text box 19. And it becomes necessary to redo the analysis of the position of the text box 22. Therefore, it is less likely to be attacked by a password trial, and unauthorized login can be suppressed.

(Example 7)
It is assumed that a keylogger is loaded into computer 1 as a malicious program. In this case, the key code is logged and the user name and password input indicated by the combination of alphabets and numbers is stolen. Therefore, the CPU 2 accepts the input of Japanese characters as the user name and password.

For example, when "tarou" is entered as the user name and the conversion key is pressed, the keylogger gets the log. However, since the conversion pattern differs depending on the PC environment, it is accurate from the log alone which character ("Taro", "Taro", "Taro", "Taro", etc.) the input of "tarou" was finally converted. I can't judge.

Therefore, by accepting the input of Japanese characters as the user name and password, even if the user name and password are stolen by the keylogger, unauthorized login can be suppressed.

As described above, according to the present embodiment, the computer 1 inputs a character string display unit (16, 17) for displaying a character string to be input and a character string corresponding to the display of the character string display unit. Authentication is performed by displaying a predetermined character string on the format of the authentication screen 15 including the boxes (18, 19), the memory 3 or HDD 4 for storing the background image 12, and the character string display unit included in the format of the authentication screen 15. A CPU 2 is provided which creates a screen 15, executes a transparency process for transmitting the background image 12 on the authentication screen 15, and outputs the background image 12 and the authentication screen 15 on which the transparency process is executed to the screen 11 of the display unit 5. .. Therefore, it is not possible to detect the character string and the input box in the character string display unit in the authentication screen 15 using a malicious program, it is less likely to be attacked by a password attempt, and unauthorized login can be suppressed.

The present invention is not limited to the above-described embodiment, and can be variously modified and implemented within a range that does not deviate from the gist thereof.

1 computer 2 CPU
3 memory 4 HDD
5 Display section 11 Screen 12 Background image 15 Authentication screen 16 User name display section 17 Password display section 18, 19 Text box

Claims (6)

A storage means for storing a format of an authentication screen including a character string display unit that displays a character string to be input and an input box for inputting a character string corresponding to the content displayed in the character string display unit, and a background image. When,
The format of the authentication screen and the background image are read from the storage means, a predetermined character string is displayed on the character string display unit included in the format of the authentication screen to create an authentication screen, and the background image is transmitted. An authentication device including a control means for executing a transparency process to be performed on the authentication screen and outputting the background image and the authentication screen on which the transparency process is executed to the screen of the display device. The first aspect of the present invention is characterized in that the storage means includes a plurality of the background images, the control means selects one background image from the plurality of background images, and the selected background image is read out from the storage means. The listed authentication device. The storage means includes a list including a plurality of candidates for a character string displayed on the character string display unit, and the control means selects one character string from the plurality of candidates and the selected character string. The authentication device according to claim 1 or 2, wherein is displayed on the character string display unit. The authentication device according to any one of claims 1 to 3, wherein the control means adds a dummy input box and / or a dummy character string display unit in the format of the authentication screen. A storage means for storing a format of an authentication screen including a character string display unit that displays a character string to be input and an input box for inputting a character string corresponding to the content displayed in the character string display unit, and a background image. A screen display method performed by a computer equipped with
The computer
The format of the authentication screen and the background image are read from the storage means,
A predetermined character string is displayed on the character string display unit included in the format of the authentication screen to create an authentication screen.
A transparency process for making the background image transparent is executed on the authentication screen, and the authentication screen is executed.
A screen display method comprising outputting the background image and an authentication screen on which the transparency process is executed to the screen of a display device. A storage means for storing a format of an authentication screen including a character string display unit that displays a character string to be input and an input box for inputting a character string corresponding to the content displayed in the character string display unit, and a background image. To a computer equipped with
The first step of reading the format of the authentication screen and the background image from the storage means, and
The second step of displaying a predetermined character string on the character string display unit included in the format of the authentication screen to create an authentication screen, and
The third step of executing the transparency process for making the background image transparent on the authentication screen, and
A program characterized by executing a fourth step of outputting the background image and the authentication screen on which the transparency process is executed to the screen of the display device.

Images