JP7280156B2 - Re-authentication device, re-authentication method and re-authentication program - Google Patents

Description

The present invention relates to a re-authentication device, a re-authentication method and a re-authentication program.

2. Description of the Related Art Conventionally, there has been known a technique for providing various services via the Internet to users who have authenticated their accounts. Among such technologies, there is known a technology for recovering an account by using a question-and-answer pair that only the user knows when the user loses information used for account authentication, such as a password. . Also known is a technique of authenticating a user based on the answer to a question about the user's lifelog.

JP 2009-93273 A

However, the conventional technology described above leaves room for improving the convenience of account recovery.

For example, in the conventional technology described above, since it is necessary to give correct answers to questions regarding past lifelogs, account recovery cannot be performed if the user has forgotten past events. Also, if the user forgets the content of the secret question or the answer, the account cannot be recovered.

On the other hand, with recent advances in information processing technology, FIDO (Fast IDentity Online) technology has been proposed for authenticating a user without requiring the user to enter an account name, password, or the like. In such FIDO technology, if the user is requested to input various kinds of information in order to realize account recovery, there is a risk that improvement in usability will be impaired.

The present application has been made in view of the above, and aims to improve the convenience of account recovery.

A re-authentication device according to the present application receives first detection information other than location information detected by a predetermined detection means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated. an acquisition unit that acquires second sensed information other than position information sensed by a predetermined sensing means from a second terminal device that is a terminal device used by the first user and is different from the first terminal device; if received, a determination unit that determines whether or not the first detection information and the second detection information are similar, and if it is determined that the first detection information and the second detection information are similar, and a re-authentication unit that re-authenticates the account of the first user, and the acquisition unit receives the first detection information detected by the detection means of the third terminal device capable of communicating with the first terminal device. When receiving the second detection information detected by the detection means of the third terminal device capable of communicating with the second terminal device, the determination unit obtains the first detection information and the second detection information. are similar to each other .

According to one aspect of an embodiment, the convenience of account recovery can be improved.

FIG. 1 is a diagram illustrating an example of account recovery processing according to an embodiment. FIG. 2 is a diagram illustrating a configuration example of a re-authentication device according to the embodiment; FIG. 3 is a diagram illustrating an example of an authentication database according to the embodiment; 4 is a flowchart illustrating an example of a processing procedure of the re-authentication device according to the embodiment; FIG. FIG. 5 is a diagram illustrating an example of a hardware configuration of a computer that executes programs.

Embodiments for implementing a re-authentication device, a re-authentication method, and a re-authentication program (hereinafter referred to as "embodiments") according to the present application will be described in detail below with reference to the drawings. Note that the re-authentication device, re-authentication method, and re-authentication program according to the present application are not limited to these embodiments. Also, in the following embodiments, the same parts are denoted by the same reference numerals, and overlapping descriptions are omitted.

(embodiment)
[1. Account recovery process]
First, an example of account recovery processing realized by the re-authentication program according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of account recovery processing according to an embodiment. FIG. 1 illustrates a recovery process (an example of an account procedure) in which a new terminal device issues an account recovery approval request when the user loses the terminal device.

It should be noted that the state in which the account is invalidated is, for example, a state in which the corresponding account becomes temporarily unusable if, for example, the password is entered incorrectly more than a specified number of times when logging in to the service.

The first terminal device 10 and the second terminal device 20 shown in FIG. 1 are smart devices such as smartphones and tablet terminals, and are information processing devices used by the user U. As shown in FIG. In this embodiment, the first terminal device 10 is a terminal device that the user U uses. The second terminal device 20 is a terminal device that the user U purchases (acquires) and starts using after losing the first terminal device 10 .

Further, the third terminal device 30 and the fourth terminal device 40 shown in FIG. 1 are, for example, a desktop/laptop PC (Personal Computer), a mobile phone (feature phone), a stationary/portable game machine, an AV (audio visual) It is an information processing device that can be used by a user U as needed, such as a device, an information appliance, or an electronic device (gadget) that can receive provision of information via the Internet. In this embodiment, the third terminal device 30 is a wearable terminal that the user U can wear. Also, the fourth terminal device 40 is a notebook PC that can be used by the user.

Further, the re-authentication device 100 shown in FIG. 1 is a server device accessible from the first terminal device 10, the second terminal device 20, the third terminal device 30 and the fourth terminal device 40. A user U of the second terminal device 20, the third terminal device 30, and the fourth terminal device 40 is provided with a predetermined web service that requires login with an account. In an embodiment, the re-authentication device 100 provides at least the first service as the web service. Further, the re-authentication device 100 manages the account of the user U, and performs account recovery processing in response to a recovery request requesting account recovery.

As shown in FIG. 1, the first terminal device 10 requests FIDO (Fast IDentity Online) authentication to the re-authentication device 100 according to the embodiment, and the re-authentication device 100 requests the first terminal device 10 to FIDO authentication is performed (step S1).

For example, the re-authentication device 100 performs FIDO authentication on the first terminal device 10 when the first terminal device 10 requests login to a predetermined web service provided by the re-authentication device 100 . In the FIDO authentication, the first terminal device 10 unlocks the "private key" stored in itself by biometric authentication, and signs the authentication result that the user U is identified as the person as a result of the biometric authentication with the private key. and send it to the re-authentication device 100 . The re-authentication device 100 authenticates the user U by identifying the signed authentication result sent from the first terminal device 10 using the "public key" stored therein.

After the FIDO authentication is successful, the first terminal device 10 requests recovery backup from the re-authentication device 100 (step S2). The re-authentication device 100 requests context information from the first terminal device 10 in response to the recovery backup request (step S3). The first terminal device 10 acquires the context information from the third terminal device 30 in response to the context information request (step S4). Similarly, the first terminal device 10 acquires context information from the fourth terminal device 40 (step S5).

The context information is, for example, identification information or the like for identifying a terminal device different from the first terminal device 10 used by the user U. That is, the context information is preferably information specific to each terminal device. In this embodiment, a third terminal device 30 and a fourth terminal device 40 are used as other terminal devices different from the first terminal device 10 .

For example, the first terminal device 10 may include an acceleration sensor, a gyro sensor, an audio sensor, and an illuminance sensor of the third terminal device 30 and the fourth terminal device 40 (hereinafter sometimes collectively referred to as "other terminal devices"). You may acquire various sensor information etc. as context information. Also, the first terminal device 10 may acquire, as context information, information indicating the user's context estimated based on various sensor information, for example. For example, the first terminal device 10 determines where the user is, whether the user is walking, whether the user is running, whether the user is driving a vehicle, whether the user is traveling by public transportation, The context information may be information indicating various arbitrary user states, such as whether the user is operating a terminal device, whether the user is reading a book, or whether the user is purchasing food or drink. It should be noted that such a user state may be a person estimated based on sensor information by another terminal device, and may be estimated from various sensor information acquired by the first terminal device 10 from another terminal device. It may be the person who did it.

For example, the first terminal device 10 receives the context information detected by the detecting means of each of the third terminal device 30 and the fourth terminal device 40 as date and time information indicating the date and time when the context information was detected/position information indicating the position. Acquire with Date/time information/location information may be included in the context information. Note that the detection means is various sensors or the like.

The first terminal device 10 provides the re-authentication device 100 with the context information acquired from each of the third terminal device 30 and the fourth terminal device 40 (step S6). For example, the first terminal device 10 provides the re-authentication device 100 with context information together with the above date/time information/location information.

The re-authentication device 100 generates a token that identifies the context information (step S7). Further, the re-authentication device 100 associates and stores the token and the context information (step S8). A token indicates identification information for identifying context information. For example, the token may utilize the time/location information described above. Any information can be adopted as the token as long as it can identify the context information. good too.

The re-authentication device 100 provides the token to the first terminal device 10 (step S9).

The first terminal device 10 registers the token provided by the re-authentication device 100 in another terminal device (step S10). The other terminal device may be either the third terminal device 30 or the fourth terminal device 40 . In this embodiment, the first terminal device 10 registers the token in the fourth terminal device 40 .

After that, the user U loses the first terminal device 10 (step S11) and newly purchases the second terminal device 20 (step S12). That is, the first terminal device 10 leaves the hand of the user U, the second terminal device 20 is activated, and the user U starts using it.

The second terminal device 20 makes an account recovery request to the re-authentication device 100 (step S13).

The re-authentication device 100 requests context information from the second terminal device 20 in response to the account recovery request (step S14).

The second terminal device 20 acquires the token and the context information from the terminal device with which the first terminal device 10 registered the token (step S15). In this embodiment, the second terminal device 20 acquires the token and context information from the fourth terminal device 40 .

The second terminal device 20 also acquires context information from the third terminal device 30 (step S16).

The second terminal device 20 provides the token and the context information to the re-authentication device 100 (step S17). In this embodiment, the second terminal device 20 provides the re-authentication device 100 with the token and context information obtained from the fourth terminal device 40 and the context information obtained from the third terminal device 30 .

The re-authentication device 100 determines whether the context information stored in association with the token is similar to the context information provided from the second terminal device 20 (step S18).

If the re-authentication device 100 determines that the context information stored in association with the token is similar to the context information provided from the second terminal device 20, the re-authentication device 100 performs FIDO authentication on the second terminal device 20 ( step S19).

[2. Configuration of re-authentication device]
Next, the configuration of the re-authentication device 100 according to the embodiment will be described using FIG. FIG. 2 is a diagram showing a configuration example of the re-authentication device 100 according to the embodiment. As shown in FIG. 2 , the re-authentication device 100 has a communication section 110 , a storage section 120 and a control section 130 . Note that the re-authentication device 100 includes an input unit (for example, keyboard, mouse, etc.) that receives various operations from an administrator or the like who manages the re-authentication device 100, and a display unit (for example, a liquid crystal display, etc.) for displaying various information. ) and the like. Further, the re-authentication device 100 may receive various operations via the network N from a terminal device used by the administrator.

(Regarding communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card) or the like. The communication unit 110 is connected to the network N by wire or wirelessly, and exchanges information with the first terminal device 10, the second terminal device 20, the third terminal device 30, and the fourth terminal device 40 via the network N. send and receive

(Regarding storage unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory device such as a RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or an optical disk. Storage unit 120 has authentication database 121 .

(Regarding the authentication database 121)
The authentication database 121 stores information regarding the first service. Here, FIG. 3 shows an example of the authentication database 121 according to the embodiment. FIG. 3 is a diagram showing an example of the authentication database 121 according to the embodiment. In the example shown in FIG. 3, the authentication database 121 includes "account ID", "registered device ID", "registered user", "user ID", "context information", "token", and "first service action history". It has items such as Also, the first service action history has sub-items such as "usage log ID", "action history", "action date and time", and "location information".

"Account ID" indicates identification information for identifying an account in the first service. "Registered device ID" indicates identification information for identifying a device registered as a device used in the first service. "Registered user" indicates a user who holds an account. In addition, in the embodiment, the identification information such as the account ID shall correspond to the reference numerals used in the description. For example, a device with a registered device ID of “20” indicates the first terminal device 10 .

"User ID" is identification information used to identify a user who uses an account. For example, the user ID is composed of any character string selected by the user when the user creates an account in the first service. As for the user ID, for example, an e-mail address or the like registered in the first terminal device 10, which is a registered device, may be used.

"Context information" indicates identification information for identifying a device other than the registered device. For example, when the registered device ID is the first terminal device 10 , the context information indicates identification information for identifying the third terminal device 30 or the fourth terminal device 40 other than the first terminal device 10 . That is, the context information is preferably information specific to each of the third terminal device 30 and the fourth terminal device 40 . The context information may be biometric information (fingerprint, hand vein, iris, etc.) of the user U detected by the third terminal device 30 and the fourth terminal device 40, respectively. The context information may be position information, device information, configuration information, wireless LAN (Local Area Network) authentication information, SSID (Service Set Identifier), etc. of each terminal device.

"Token" indicates identification information for identifying context information. A token is synonymous with a context ID. Note that the token may be date and time information indicating the date and time when the context information was detected, position information indicating the position at which the context information was detected, or the like.

"First service action history" indicates the action history in the first service. "Usage log ID" indicates identification information for identifying a log when the user logs in to use the first service. In the example shown in FIG. 3, it is assumed that a usage log ID is given for each session from when the user logs in to the first service until he logs out.

"Action history" indicates the action history of the user. Although not shown in FIG. 3, the items of the action history include, for example, actions of the user clicking on articles in the portal site, actions of purchasing products, and searching by inputting queries. Specific actions, such as actions, may be stored.

“Action date and time” indicates the date and time corresponding to the action history of the user. Although the example shown in FIG. 3 indicates that the action date and time is stored every 10 minutes, the action date and time may be stored in smaller units (1 minute, 1 second, etc.). "Location information" indicates location information corresponding to the action history. For example, the re-authentication device 100 continuously acquires position information detected by the first terminal device 10 (smartphone) when the user logs into the first service or while the user continues to log in, are stored in the authentication database 121 in association with each other. Note that FIG. 3 shows an example in which conceptual information such as "G011" is stored in the item of location information. , information from which position information can be estimated (for example, the IP address of the first terminal device 10, etc.), etc. are stored.

That is, in the example of FIG. 3, the first terminal device 10, which is the device identified by the registered device ID "20", is registered in the account A01 identified by the account ID "A01", and the registered user is " U01". Also, the user ID corresponding to the account A01 is "XXXX", the context information is "YYYY", and the token is "A02". In addition, logs identified by usage log IDs “B01” and “B02” are accumulated in the account A01. 12:00", and the location information of the first terminal device 10 at that time is "G011".

(Regarding the control unit 130)
The control unit 130 is, for example, a controller, and executes various programs (according to the embodiment (equivalent to an example of a re-authentication program) is executed using the RAM as a work area. Also, the control unit 130 is a controller, and is implemented by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

As shown in FIG. 2, the control unit 130 includes a registration unit 131, a transmission unit 132, an acquisition unit 133, a determination unit 134, and a re-authentication unit 135. Realize or perform an action. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 2, and may be another configuration as long as it performs the information processing described later. Moreover, the connection relationship between the processing units of the control unit 130 is not limited to the connection relationship shown in FIG. 2, and may be another connection relationship.

The registration unit 131 associates the first detection information (context information) from the first terminal device 10 with the identification information (token) for identifying the first detection information, and stores it in a predetermined storage device (the authentication database of the storage unit 120). 121).

The transmission unit 132 transmits identification information (token) to the first terminal device 10 when receiving a registration request for the first detection information (context information) from the first terminal device 10 . In addition, the transmission unit 132 transmits identification information that can be transmitted to other terminal devices (the third terminal device 30 and the fourth terminal device 40) that can communicate with the first terminal device 10. FIG.

The acquisition unit 133 acquires first detection information detected by a predetermined detection means from the first terminal device 10 used by the first user U whose account for receiving a predetermined web service has been authenticated. For example, the acquisition unit 133 acquires first detection information detected by a detection unit included in the first terminal device 10 . The acquisition unit 133 may acquire a plurality of pieces of first detection information.

Also, the acquisition unit 133 may acquire the first detection information detected by the detection means of the third terminal device 30 that can communicate with the first terminal device 10 . Note that the third terminal device 30 may be read as the fourth terminal device 40 . At this time, the acquisition unit 133 acquires the biometric information of the user U detected by the detection means of the third terminal device 30 that the user U can wear as the first detection information. Further, the acquisition unit 133 acquires first detection information related to a device capable of communicating with the third terminal device 30, which is information detected by the detection means of the third terminal device 30 capable of communicating with the first terminal device 10. do.

Furthermore, the acquisition unit 133 acquires first detection information and identification information for identifying the first detection information. The acquisition unit 133 also acquires the first detection information and the first date/time information indicating the date and time when the first detection information was detected.

From another point of view, the acquisition unit 133 is a web service that authenticates the account of user U using information detected by a detection device that detects information about user U without using information input by user U. First detection information is acquired from the first terminal device 10 used by the first user U whose account is to be re-authenticated.

When the determination unit 134 receives the second detection information detected by the predetermined detection means from the second terminal device 20, which is the terminal device used by the first user U and is different from the first terminal device 10, , to determine whether the first detection information and the second detection information are similar. For example, when the determination unit 134 receives the second detection information detected by the predetermined detection means and the identification information from the second terminal device 20, the identification information is associated with the identification information and registered in the predetermined storage device. It is determined whether or not the first detection information and the second detection information are similar. The above-described predetermined detection means may be detection means that the second terminal device 20 has. That is, when receiving the second detection information detected by the detection means of the second terminal device 20, the determination unit 134 determines whether or not the first detection information and the second detection information are similar.

When receiving the second detection information detected by the detection means of the third terminal device 30 capable of communicating with the second terminal device 20, the determination unit 134 determines whether the first detection information and the second detection information are similar. determine whether or not The second detection information may be, for example, biometric information of the user U, or may be device information related to a device capable of communicating with the third terminal device 30 .

Note that, when receiving a plurality of second detection information, the determination unit 134 determines whether or not the plurality of first detection information and the plurality of second detection information are similar. If the number of second detection information similar to the plurality of first detection information among the plurality of second detection information exceeds a predetermined threshold, the determination unit 134 determines that the plurality of first detection information and the plurality of first detection information 2 is determined to be similar to the detection information.

Further, when the determination unit 134 receives the second detection information and the second date and time information indicating the date and time when the second detection information was detected, the first detection information and the second detection information are similar, and , determines whether or not the first date and time information and the second date and time information are similar.

The re-authentication unit 135 re-authenticates the account of the first user U when it is determined that the first detection information and the second detection information are similar. For example, if the re-authentication unit 135 determines that the first detection information and the second detection information are similar and that the first date and time information and the second date and time information are similar, the account of the first user U to re-authenticate.

[3. Processing procedure]
Next, with reference to FIG. 4, a procedure of processing related to the re-authentication device 100 according to the embodiment will be described. FIG. 4 is a flow chart showing an example of a processing procedure of the re-authentication device 100 according to the embodiment.

As shown in FIG. 4, the re-authentication device 100 determines whether or not a recovery backup request has been received (step S101). If the re-authentication device 100 does not determine that the recovery backup request has been received (No in step S101), the current processing continues until the recovery backup request is received (returns to step S101).

When the re-authentication device 100 determines that the recovery backup request has been received (Yes in step S101), the re-authentication device 100 requests context information from the requesting terminal device (step S102). In this embodiment, when the control unit 130 receives a recovery backup request from the first terminal device 10 via the communication unit 110, the acquisition unit 133 requests the first terminal device 10 for context information.

The re-authentication device 100 determines whether or not the context information has been received (step S103). If the re-authentication device 100 has not determined that the context information has been received (No in step S103), the current processing continues until the context information is received (returns to step S103).

When the re-authentication device 100 determines that the context information has been received (Yes in step S101), the re-authentication device 100 issues a token to the requesting terminal device (step S104). In this embodiment, when the acquisition unit 133 receives context information from the first terminal device 10 , the control unit 130 issues a token to the first terminal device 10 .

The re-authentication device 100 associates and registers the token and the context information (step S105). In this embodiment, the registration unit 131 associates the context information with the token and registers them in the authentication database 121 of the storage unit 120 .

The re-authentication device 100 transmits the token to the requesting terminal device (step S106). In this embodiment, the transmitter 132 transmits the token to the first terminal device 10 . The first terminal device 10 registers the token provided by the re-authentication device 100 in the fourth terminal device 40 .

The re-authentication device 100 determines whether or not the account recovery request has been accepted (step S107). For example, when the user U loses the first terminal device 10 , the user U newly purchases the second terminal device 20 . After that, the user U uses the second terminal device 20 to make an account recovery request to the re-authentication device 100 . If the re-authentication device 100 does not determine that the account recovery request has been accepted (No in step S107), the re-authentication device 100 continues the processing up to now until the account recovery request is accepted (returns to step S101).

When the re-authentication device 100 determines that the account recovery request has been received (Yes in step S107), the re-authentication device 100 requests context information from the requesting terminal device (step S108). In this embodiment, when the control unit 130 receives an account recovery request from the second terminal device 20 via the communication unit 110, the acquisition unit 133 requests the second terminal device 20 for context information.

The re-authentication device 100 determines whether or not the context information and the token have been accepted (step S109). If the re-authentication device 100 has not determined that the context information and the token have been received (No in step S109), the current processing continues until the context information is received (returns to step S109).

When the re-authentication device 100 determines that the context information and the token have been received (Yes in step S109), the re-authentication device 100 determines whether or not the context information associated with the token is similar to the received context information. (Step S110). Note that "similarity" means, for example, a partial match, but may also be a complete match. In this embodiment, the second terminal device 20 acquires context information from the third terminal device 30 and acquires context information and a token from the fourth terminal device 40 . After that, the second terminal device 20 provides the re-authentication device 100 with the token and the context information obtained from the fourth terminal device 40 and the context information obtained from the third terminal device 30 . When the acquisition unit 133 receives the context information and the token from the second terminal device 20, the determination unit 134 stores the context information associated with the token in the authentication database 121 of the storage unit 120 and the context information from the second terminal device 20. Determine if it is similar to the provided context information.

The re-authentication device 100 re-authenticates the user U when determining that the context information associated with the token is similar to the received context information (Yes in step S110). In this embodiment, the re-authentication unit 135 re-authenticates the user U when the determination unit 134 determines that the context information associated with the token is similar to the received context information. As a result, the re-authentication device 100 approves the new second terminal device 20 of the user U as an account-authenticated terminal.

Conversely, if the re-authentication device 100 does not determine that the context information associated with the token is similar to the received context information (No in step S110), the re-authentication device 100 does not re-authenticate the user U. , ends the series of processes.

[4. Hardware configuration]
The first terminal device 10, the second terminal device 20, the third terminal device 30, the fourth terminal device 40, and the re-authentication device 100 in the above-described embodiment are each executed by a computer 200 configured as shown in FIG. It is realized by executing

FIG. 5 is a diagram illustrating an example of a hardware configuration of a computer that executes programs. Computer 200 includes CPU (Central Processing Unit) 201, RAM 202 (Random Access Memory), ROM (Read Only Memory) 203, HDD (Hard Disk Drive) 204, communication interface (I/F) 205, input/output interface (I/ F) 206 and a media interface (I/F) 207 .

The CPU 201 operates based on programs stored in the ROM 203 or HDD 204 and controls each unit. The ROM 203 stores a boot program executed by the CPU 201 when the computer 200 is started, a program depending on the hardware of the computer 200, and the like.

The HDD 204 stores data and the like used by programs executed by the CPU 201 . The communication interface 205 corresponds to the communication unit 110, receives data from other devices via the network N, sends the data to the CPU 201, and transmits data generated by the CPU 201 to other devices via the network N.

The CPU 201 controls output devices such as a display and a printer, and input devices such as a keyboard and a mouse, through an input/output interface 206 . The CPU 201 acquires data from the input device via the input/output interface 206 . The CPU 201 also outputs the generated data to an output device via the input/output interface 206 .

The media interface 207 reads programs or data stored in the recording medium 208 and provides them to the CPU 201 via the RAM 202 . The CPU 201 loads the program from the recording medium 208 onto the RAM 202 via the media interface 207 and executes the loaded program. The recording medium 208 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable disc), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. etc.

When the computer 200 functions as the re-authentication device 100, the CPU 201 of the computer 200 executes a program loaded on the RAM 202 to perform the registration unit 131, transmission unit 132, acquisition unit 133, determination unit 134 shown in FIG. and each function of the re-authentication unit 135 is realized. Note that the registration unit 131, the transmission unit 132, the acquisition unit 133, the determination unit 134, and the re-authentication unit 135 are each partly or wholly implemented by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). may be configured.

Further, when the computer 200 functions as each of the first terminal device 10, the second terminal device 20, the third terminal device 30 and the fourth terminal device 40, the CPU 301 of the computer 200 executes the programs loaded on the RAM 302. By doing so, each function of each of the first terminal device 10, the second terminal device 20, the third terminal device 30 and the fourth terminal device 40 is realized.

The CPU 201 of the computer 200 reads and executes the re-authentication program from the recording medium 208, but as another example, these programs may be acquired via the network N from another device.

HDD 204 corresponds to storage unit 120 and stores data similar to storage unit 120 . Also, instead of the HDD 204, a storage device such as a RAM (Random Access Memory), a semiconductor memory device such as a flash memory, an SSD (Solid State Drive), or an optical disk may be used.

[5. effect〕
As described above, the re-authentication device 100 according to the embodiment has the acquisition unit 133 , the determination unit 134 and the re-authentication unit 135 . The acquisition unit 133 acquires first detection information detected by a predetermined detection unit from the first terminal device 10 used by the first user whose account for receiving a predetermined web service has been authenticated. When the determination unit 134 receives the second detection information detected by the predetermined detection means from the second terminal device 20, which is a terminal device used by the first user and is different from the first terminal device 10, It is determined whether or not the first detection information and the second detection information are similar. The re-authentication unit 135 re-authenticates the account of the first user when it is determined that the first detection information and the second detection information are similar. This makes it possible to implement a server that performs recovery processing using context information. As a result, the convenience of account recovery can be improved.

The acquisition unit 133 acquires the first detection information detected by the detection means of the first terminal device 10 . When receiving the second detection information detected by the detection means of the second terminal device 20, the determination unit 134 determines whether or not the first detection information and the second detection information are similar. Thereby, recovery processing using the context information detected by the terminal device can be performed.

The acquisition unit 133 acquires the first detection information detected by the detection means of the third terminal device 30 that can communicate with the first terminal device 10 . When receiving the second detection information detected by the detection means of the third terminal device 30 capable of communicating with the second terminal device 20, the determination unit 134 determines whether the first detection information and the second detection information are similar. determine whether or not As a result, it is possible to perform recovery processing using context information detected by another terminal device that can communicate with the terminal device.

The acquisition unit 133 acquires, as first detection information, biological information of the user detected by the detection means of the third terminal device 30 that can be worn by the user. When the determination unit 134 receives the second detection information, which is the biological information of the user detected by the detection unit of the third terminal device 30 capable of communicating with the second terminal device 20, the determination unit 134 determines whether the first detection information and the second It is determined whether or not the detected information is similar. Thereby, recovery processing using the context information detected by the wearable device can be performed.

The acquisition unit 133 acquires first detection information related to a device capable of communicating with the third terminal device 30, which is information detected by the detection means of the third terminal device 30 capable of communicating with the first terminal device 10. . The determination unit 134 receives second detection information regarding a device capable of communicating with the third terminal device 30, which is information detected by the detection means of the third terminal device 30 capable of communicating with the second terminal device 20. If so, it is determined whether or not the first detection information and the second detection information are similar. As a result, it is possible to perform recovery processing using context information detected by a device capable of communicating with the wearable device.

Moreover, the re-authentication device according to the embodiment further has a registration unit 131 . The registration unit 131 associates the first detection information with identification information for identifying the first detection information and registers them in a predetermined storage device. When the determination unit 134 receives the second detection information detected by the predetermined detection means and the identification information from the second terminal device 20, the determination unit 134 receives the second detection information associated with the identification information and registered in the predetermined storage device. It is determined whether or not the first detection information and the second detection information are similar. This enables re-authentication using the token.

Further, the re-authentication device according to the embodiment further includes a transmission unit 132 that transmits identification information to the first terminal device 10 when a registration request for the first detection information is received from the first terminal device 10. . This allows the server to issue the token.

The transmitting unit 132 transmits identification information that can be transmitted to other terminal devices that can communicate with the first terminal device 10 . This enables re-authentication using a token that can be registered in another terminal device.

Acquisition unit 133 acquires first detection information and identification information for identifying the first detection information. This allows the terminal device to issue the token.

Acquisition unit 133 acquires a plurality of pieces of first detection information. When receiving a plurality of second detection information, the determination unit 134 determines whether or not the plurality of first detection information and the plurality of second detection information are similar. This makes it possible to use multiple pieces of context information.

If the number of second detection information similar to the plurality of first detection information among the plurality of second detection information exceeds a predetermined threshold, the determination unit 134 determines that the plurality of first detection information and the plurality of second detections information is similar. Thereby, re-authentication can be performed when a predetermined number of pieces of detection information are compared and similar.

Acquisition unit 133 acquires first detection information and first date/time information indicating the date and time when the first detection information was detected. If the determination unit 134 receives the second detection information and the second date/time information indicating the date and time when the second detection information was detected, the first detection information and the second detection information are similar, and It is determined whether or not the first date/time information and the second date/time information are similar. The re-authentication unit 135 re-authenticates the account of the first user when it is determined that the first detection information and the second detection information are similar and the first date and time information and the second date and time information are similar. do. As a result, it is possible to perform re-authentication reflecting the commonality of the acquisition time period of the detection information.

The acquisition unit 133 is an account re-authentication target in a web service that authenticates the account of the user using information detected by a detection device that detects information about the user without using information input by the user. The first detection information is acquired from the first terminal device 10 used by the first user. Thereby, re-authentication of FIDO authentication can be performed.

As described above, some of the embodiments of the present application have been described in detail based on the drawings. It is possible to carry out the invention in other forms with modifications.

Also, the "section, module, unit" described above can be read as "means" or "circuit". For example, the registration unit can be read as registration means or a registration circuit.

10 first terminal device 20 second terminal device 30 third terminal device 40 fourth terminal device 100 reauthentication device 110 communication unit 120 storage unit 121 authentication database 130 control unit 131 registration unit 132 transmission unit 133 acquisition unit 134 determination unit 135 re Authentication part

Claims (23)

an acquisition unit for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination unit that determines whether the first detection information and the second detection information are similar;
a re-authentication unit that re-authenticates the account of the first user when it is determined that the first detection information and the second detection information are similar ,
The acquisition unit acquires first detection information detected by a detection means included in a third terminal device capable of communicating with the first terminal device,
When receiving the second detection information detected by the detection means of the third terminal device capable of communicating with the second terminal device, the determination unit determines that the first detection information and the second detection information are similar to each other. determine whether
A re-authentication device characterized by: The acquisition unit acquires first detection information detected by a detection unit included in the first terminal device,
wherein, when receiving the second detection information detected by the detection means of the second terminal device, the determination unit determines whether the first detection information and the second detection information are similar. 2. A re-authentication device according to claim 1. The acquisition unit acquires, as the first detection information, biometric information of the user detected by a detection means included in a third terminal device wearable by the user,
When receiving the second detection information, which is the biometric information of the user detected by the detection means of the third terminal device capable of communicating with the second terminal device, the determination unit selects the first detection information and the The re-authentication device according to claim 1, wherein it is determined whether or not the second detection information is similar. The acquisition unit acquires first detection information relating to a device capable of communicating with the third terminal device, which is information detected by a detection means included in a third terminal device capable of communicating with the first terminal device,
When the determination unit receives second detection information regarding a device capable of communicating with the third terminal device, which is information detected by a detection means of a third terminal device capable of communicating with the second terminal device, , and determines whether the first detection information and the second detection information are similar to each other. a registration unit that associates and registers the first detection information and identification information for identifying the first detection information in a predetermined storage device;
When the determination unit receives, from the second terminal device, the second detection information detected by the predetermined detection means and the identification information, the identification information is associated with the identification information and registered in the predetermined storage device. The re-authentication device according to any one of claims 1 to 4 , wherein it is determined whether or not the first detection information and the second detection information are similar. an acquisition unit for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
a registration unit that associates and registers the first detection information and identification information for identifying the first detection information in a predetermined storage device;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination unit that determines whether the first detection information and the second detection information are similar;
a re-authentication unit for re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
has
When the determination unit receives, from the second terminal device, the second detection information detected by the predetermined detection means and the identification information, the identification information is associated with the identification information and registered in the predetermined storage device. Determining whether the first detection information and the second detection information are similar
A re-authentication device characterized by: 7. The apparatus according to claim 5, further comprising: a transmitting unit that transmits the identification information to the first terminal device when a request for registration of the first detection information is received from the first terminal device. recertification device. The re-authentication device according to claim 7, wherein the transmission unit transmits identification information that can be transmitted to another terminal device that can communicate with the first terminal device. The re-authentication device according to claim 5 or 6, wherein the acquisition unit acquires the first detection information and identification information for identifying the first detection information. The acquisition unit acquires a plurality of pieces of first detection information,
3. The determining unit, when receiving a plurality of the second detection information, determines whether or not the plurality of the first detection information and the plurality of the second detection information are similar. 10. The re-authentication device according to any one of 1 to 9. When the number of second detection information similar to the plurality of first detection information among the plurality of second detection information exceeds a predetermined threshold, the determination unit selects a plurality of the first detection information and a plurality of The re-authentication device according to claim 10, wherein it is determined that the second detection information is similar. The acquisition unit acquires the first detection information and first date and time information indicating the date and time when the first detection information was detected,
When the determination unit receives the second detection information and the second date and time information indicating the date and time when the second detection information was detected, the determination unit determines whether the first detection information and the second detection information are similar. and determining whether the first date and time information and the second date and time information are similar,
When it is determined that the first detection information and the second detection information are similar and the first date and time information and the second date and time information are similar, the re-authentication unit determines that the first user 12. The re-authentication device according to any one of claims 1 to 11, wherein the re-authentication device re-authenticates the account of an acquisition unit for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
a registration unit that associates and registers the first detection information and identification information for identifying the first detection information in a predetermined storage device;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination unit that determines whether the first detection information and the second detection information are similar;
a re-authentication unit for re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
has
The acquisition unit acquires the first detection information and first date and time information indicating the date and time when the first detection information was detected,
When the determination unit receives the second detection information and the second date and time information indicating the date and time when the second detection information was detected, the determination unit determines whether the first detection information and the second detection information are similar. and determining whether the first date and time information and the second date and time information are similar,
When it is determined that the first detection information and the second detection information are similar and the first date and time information and the second date and time information are similar, the re-authentication unit determines that the first user reauthorize the account of
A re-authentication device characterized by: The acquisition unit is a target of account re-authentication in a web service that authenticates the user's account using information detected by a detection device that detects information about the user without using information entered by the user. 14. The re-authentication device according to any one of claims 1 to 13 , wherein the first detection information is obtained from the first terminal device used by the first user. an acquisition unit for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
a registration unit that associates and registers the first detection information and identification information for identifying the first detection information in a predetermined storage device;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination unit that determines whether the first detection information and the second detection information are similar;
a re-authentication unit for re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
has
The acquisition unit is a target of account re-authentication in a web service that authenticates the user's account using information detected by a detection device that detects information about the user without using information entered by the user. Acquiring the first detection information from the first terminal device used by the first user who is
A re-authentication device characterized by: A re-authentication method executed by a re-authentication device,
an acquisition step of acquiring first sensed information other than location information sensed by a predetermined sensing means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination step of determining whether or not the first detection information and the second detection information are similar;
a re-authentication step of re-authenticating the account of the first user when it is determined that the first sensed information and the second sensed information are similar ,
In the acquisition step, acquiring first detection information detected by a detection means included in a third terminal device capable of communicating with the first terminal device,
In the determination step, when the second detection information detected by the detection means of the third terminal device capable of communicating with the second terminal device is received, the first detection information and the second detection information are similar. determine whether
A re-authentication method characterized by: an acquisition procedure for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination procedure for determining whether or not the first detection information and the second detection information are similar;
causing a computer to execute a re-authentication procedure for re-authenticating the account of the first user when it is determined that the first sensed information and the second sensed information are similar ;
In the acquisition step, acquiring first detection information detected by a detection means included in a third terminal device capable of communicating with the first terminal device,
In the determination procedure, when the second detection information detected by the detection means of the third terminal device capable of communicating with the second terminal device is received, the first detection information and the second detection information are similar to each other. determine whether
A recertification program characterized by : A re-authentication method executed by a re-authentication device,
an acquisition step of acquiring first sensed information other than location information sensed by a predetermined sensing means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
a registration step of associating the first detection information with identification information for identifying the first detection information and registering them in a predetermined storage device;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination step of determining whether or not the first detection information and the second detection information are similar;
a re-authentication step of re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
including
In the determination step, when the second detection information detected by the predetermined detection means and the identification information are received from the second terminal device, the identification information is associated with the identification information and registered in the predetermined storage device. Determining whether the first detection information and the second detection information are similar
A re-authentication method characterized by: an acquisition procedure for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
a registration procedure for associating the first detection information with identification information for identifying the first detection information and registering the same in a predetermined storage device;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination procedure for determining whether or not the first detection information and the second detection information are similar;
a re-authentication procedure for re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
on the computer, and
In the determination procedure, when the second detection information detected by the predetermined detection means and the identification information are received from the second terminal device, the identification information is associated with the identification information and registered in the predetermined storage device. Determining whether the first detection information and the second detection information are similar
A recertification program characterized by: A re-authentication method executed by a re-authentication device,
an acquisition step of acquiring first sensed information other than location information sensed by a predetermined sensing means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination step of determining whether or not the first detection information and the second detection information are similar;
a re-authentication step of re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
including
In the obtaining step, the first detection information and first date and time information indicating the date and time when the first detection information was detected are obtained;
In the determining step, if the second detection information and the second date/time information indicating the date and time when the second detection information was detected are received, the first detection information and the second detection information are similar. and determining whether the first date and time information and the second date and time information are similar,
In the re-authentication step, when it is determined that the first detection information and the second detection information are similar and the first date and time information and the second date and time information are similar, the first user reauthorize the account of
A re-authentication method characterized by: an acquisition procedure for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination procedure for determining whether or not the first detection information and the second detection information are similar;
a re-authentication procedure for re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
on the computer, and
In the obtaining step, the first detection information and first date and time information indicating the date and time when the first detection information was detected are obtained,
In the determination procedure, when the second detection information and the second date/time information indicating the date and time when the second detection information was detected are received, the first detection information and the second detection information are similar. and determining whether the first date and time information and the second date and time information are similar,
In the re-authentication procedure, if it is determined that the first detection information and the second detection information are similar and the first date and time information and the second date and time information are similar, the first user reauthorize the account of
A recertification program characterized by: A re-authentication method executed by a re-authentication device,
an acquisition step of acquiring first sensed information other than location information sensed by a predetermined sensing means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination step of determining whether or not the first detection information and the second detection information are similar;
a re-authentication step of re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
including
In the acquisition step, the target of account re-authentication in a web service that authenticates the user's account using information detected by a detection device that detects information about the user without using information entered by the user Acquiring the first detection information from the first terminal device used by the first user who is
A re-authentication method characterized by: an acquisition procedure for acquiring first detected information other than location information detected by a predetermined detecting means from a first terminal device used by a first user whose account for receiving a predetermined web service has been authenticated;
When the second detection information other than the position information detected by the predetermined detection means is received from the second terminal device which is the terminal device used by the first user and is different from the first terminal device, the a determination procedure for determining whether or not the first detection information and the second detection information are similar;
a re-authentication procedure for re-authenticating the account of the first user when it is determined that the first detection information and the second detection information are similar;
on the computer, and
In the acquisition procedure, the target of account re-authentication in a web service that authenticates the user's account using information detected by a detection device that detects information about the user without using information entered by the user. Acquiring the first detection information from the first terminal device used by the first user who is
A recertification program characterized by:

Images