WO2019194170A1

WO2019194170A1 - Server implementing authentication using two-stage url, program recording medium, and method

Info

Publication number: WO2019194170A1
Application number: PCT/JP2019/014604
Authority: WO
Inventors: 暁子中曽根; 敏春加藤; 正之横井; 誠金井
Original assignee: 株式会社ＳｐｅｃｉａｌＭｅｄｉｃｏ
Priority date: 2018-04-03
Filing date: 2019-04-02
Publication date: 2019-10-10
Also published as: JP2019185146A; JP6435456B1

Abstract

Provided are an authentication server, a program recording medium and a method which can execute two-stage user authentication without making a user input any codes (for example, a user ID, a password or a passcode). This authentication server is a device that authenticates a user who operates a terminal, and includes: a registration table that stores, for each user ID, an address and a first URL by which a user of the user ID can be identified; a second URL generation means for, upon receiving a first page request directed to a first URL, identifying the user ID of the first page request and generating a second URL by which the user ID can be identified; a second message transmission means for transmitting a second message in which the second URL is described using the address of the user ID as the destination; and an authentication means for deeming authentication of the user ID with respect to the terminal to be successful when a second page request directed to the second URL is received from the terminal.

Description

Server, program recording medium and method for performing authentication using two-stage URL

The present invention relates to a technique in which an authentication server authenticates a user who operates a terminal.

This application claims the benefit of priority with respect to the Japanese patent application JP2018-071238 filed on April 3, 2018 under the Paris Convention. The provisions of 6 are hereby incorporated by reference in their entirety.

Generally, in order to authenticate a user who accesses a website, the user is required to input a user ID (Identifier) and a password to the terminal. Such a method is similarly adopted even in a commercial transaction site requiring high security.

On the other hand, in order to access a wallet managed by a user at a site that deals with virtual currency, for example, as described in Non-Patent Document 1, a technique for authenticating a user in two stages is applied. According to this technique, the following sequence is executed.
(S11) The user inputs “wallet ID (Identifier)” and “password” on the login screen of the terminal.
(S12) The site server authenticates the user from the input wallet ID and password, and transmits a mail describing the login state (time, IP address, browser, OS, etc.) to the user's mailbox.
(S13) The user confirms the login state described in the mail, and clicks a URL (Uniform Resource Locator) button for login permission.

By executing these steps, the site server assumes that the first authentication has succeeded for the user operating the terminal.

(S21) Next, the site server temporarily generates a 5-digit passcode and sends an SMS (Short Messaging Service) message describing the passcode to the user's smartphone (portable terminal).
(S22) The user confirms the SMS message with the smartphone, and inputs the passcode described in the SMS message on the login screen of the terminal.

By executing these steps, the site server assumes that the second authentication is successful for the user operating the terminal. The two-step authentication process as described above is intended to ensure high security and eliminate access from malicious third parties.

As another conventional technique, for example, Patent Document 1 discloses a technique that allows a user to transmit a message simply by tapping a URL displayed on a terminal. In this technique, the URL can identify the transmission source user and the destination user. When a server receives a page request for a URL, the server uses a source address identified by the URL as a source address, and an address based on the destination user identified by the URL as a destination address. Send a message.

Further, for example, Patent Document 2 discloses a technique for temporarily notifying the destination terminal of map information displaying the position of the transmission source terminal. In this technique, the server stores a first page for a first URL that can identify a transmission source terminal and a destination terminal. When the server receives a page request directed to the first URL from the transmission source terminal, the server returns the first page to the transmission source terminal. The transmission source terminal that has reproduced the first page transmits its position information to the server. On the other hand, the server generates a second page in which a map in which the position of the transmission source terminal is plotted is drawn, and a message including the second URL in the second page is identified by the first URL. Send to the terminal.

Japanese Patent No. 6182711 Japanese Patent No. 6152521

In the technology of Non-Patent Document 1 described above, the user inputs the login ID and password on the terminal screen during the first authentication, and inputs the passcode received by the smartphone on the terminal screen during the second authentication. There is a need to. That is, in the case of such two-step authentication, the user has to input the code three times on the terminal screen.

On the other hand, the inventors of the present application need to input a code (user ID, password, passcode) required for user authentication a plurality of times because all users access the same login screen URL. I thought that would occur.

Therefore, an object of the present invention is to provide an authentication server, a program recording medium, and a method capable of executing two-step user authentication without causing the user to input any code.

According to the present invention, an authentication server for authenticating a user who operates a terminal,
For each user ID, a registration table that stores an address and a first URL that can identify the user of the user ID;
When a first page request directed to the first URL is received from the terminal, a user ID of the first page request is identified, and a second URL that can identify the user ID is generated URL generation means,
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
An authentication server is provided that includes an authentication unit that determines that the user ID has been successfully authenticated when a second page request directed to the second URL is received from the terminal.

According to an embodiment of the authentication server of the present invention, the authentication server transmits the first message describing the first URL, with the address of the user ID identified by the first URL as the destination. It is also preferable to further include one message transmission means.

According to another embodiment of the authentication server of the present invention, the second URL generation means is different as a one-time URL each time the first page request is received for the same user ID. It is also preferable to generate two URLs.

According to still another embodiment of the authentication server of the present invention, the authenticating means is configured so that the time from when the second message is transmitted by the second message transmitting means until the second page request is received. It is also preferable that the authentication of the user ID is successful only when it is less than the predetermined time.

According to still another embodiment of the authentication server of the present invention,
When receiving the first page request from the terminal, the second URL generating means generates a cookie value in the HTTP (HyperText Transfer Protocol) cookie protocol, and responds to the terminal with the cookie value. Register in the registration table in association with the user ID identified by the URL,
The authentication means has succeeded in authenticating the user ID to the terminal when the cookie value included in the second page request matches the cookie value corresponding to the user registered in the registration table. It is also preferable that

According to still another embodiment of the authentication server of the present invention,
The device address is an email address, phone number or account,
The second message is also preferably an e-mail based on the e-mail address, an SMS (Short Message Service) push message based on the telephone number, or an SNS (Social Networking Service) message based on the account. .

According to still another embodiment of the authentication server of the present invention,
The user ID is a user ID of a commercial transaction site or a block chain site, or a wallet ID of a virtual currency,
It is also preferable to authenticate the user ID without using a password.

According to the present invention, a non-transitory computer-readable recording medium that records a program executed by a computer installed in an authentication server that authenticates a user who operates a terminal,
For each user ID, a registration table that stores an address and a first URL that can identify the user of the user ID;
When a first page request directed to the first URL is received from the terminal, a user ID of the first page request is identified, and a second URL that can identify the user ID is generated URL generation means,
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
When a second page request directed to a second URL is received from a terminal, a recording medium is provided that causes a computer to function as authentication means that the user ID has been successfully authenticated.

According to the present invention, a two-step authentication method is executed by an authentication server that authenticates a user who operates a terminal. The authentication server can identify an address and a user of the user ID for each user ID. The first URL is stored, and this two-step authentication method is:
A step of identifying a user ID of the first page request and generating a second URL capable of identifying the user ID when receiving a first page request directed to the first URL from a terminal; ,
Transmitting a second message in which a second URL is described with the address of the user ID as a destination;
A two-step authentication method comprising: a step of assuming that the authentication of the user ID is successful when a second page request directed to the second URL is received from the terminal.

According to the authentication server, program recording medium, and method of the present invention, two-step user authentication can be executed without requiring the user to input any code (for example, user ID, password, or passcode).

It is a sequence diagram which shows one Embodiment of the authentication method by this invention. 2A and 2B are schematic diagrams illustrating an example of a tap operation screen at the time of first authentication in the present invention. It is a schematic diagram showing the example of the tap operation screen at the time of the 2nd authentication in this invention. It is a sequence diagram showing the 1st sequence used as the first half of the process which determines authentication based on the cookie value of a terminal. FIG. 5 is a sequence diagram showing a second sequence executed following the first sequence in FIG. 4. It is a functional block diagram which shows the function structure in one Embodiment of the authentication server by this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a sequence diagram showing an embodiment of an authentication method according to the present invention.

According to FIG. 1, the user A performs self-authentication from the terminal 2 with respect to the authentication server 1 in order to receive a predetermined service. The access destination for receiving the predetermined service may be, for example, a commercial transaction site or a block chain site, or a virtual currency wallet that requires high security. Here, in this embodiment, the authentication server 1 functions as a Web site as well as a message or mail transmission source device for the terminal 2. Further, the authentication server 1 can receive a page request based on the URL by publishing the URL of the Web site.

As shown in FIG. 1, the authentication server 1 of the present invention has a registration table 100.
[Registration Table 100]
The registration table 100 records, for each user ID, an address and a first URL that can identify the user of the user ID. Here, the address can be a mail address, a telephone number, or an account corresponding to the message or mail described above. For example, the following items are registered in the registration table 100.
[User ID] <-> [Address] [First URL]
A A@aaa.com http://www.SM.co.jp/A
B B@bbb.com http://www.SM.co.jp/B
C C@ccc.com http://www.SM.co.jp/C

[S0: 0th step]
The authentication server 1 sends the first message describing the first URL (http://www.SM.co.jp/A) to the address (A @ aaa) of the user A identified by the first URL. .com) as a destination. By the way, the first URL (http://www.SM.co.jp/A) is dedicated to user A and needs only to be recognized by user A, and transmission of the first message is essential. It is not something to do.

[S1: First step]
(S11) The first URL of user A (http://www.SM.co.jp/A) is displayed on the touch panel display mounted on the terminal 2 that has received the first message. Then, the activation operation (tap or click) can be performed on the first URL. In response to this activation operation, the terminal 2 transmits a page request (GET Request) toward the first URL.

FIG. 2A and FIG. 2B are schematic diagrams showing examples of a tap operation screen at the time of first authentication in the present invention.

2A, the user has tapped the first URL (http://www.SM.co.jp/A) described in the message received in step S0. In this URL, an identifier “A” that allows the user to be identified is given after the domain name, and this URL is recognized as corresponding to a page dedicated to the user A for the terminal 2.

According to FIG. 2B, the user is tapping an operation button on which an HTML (HyperText Markup Language) code is displayed on the browser. This operation button simply displays the first URL (http://www.SM.co.jp/A) for the user A so as to be visible.

Returning to FIG.
(S12) When receiving the first page request for the first URL, the authentication server 1 determines whether or not the first URL is registered in the registration table 100. If it is determined to be false, that is, unregistered, the page request is ignored.
Here, when the authentication server 1 receives a page request (HTTP Get Request) for the first URL (http://www.SM.co.jp/A), the user registered in the registration table 100 is received. A (user ID) is identified.

(S13) On the other hand, if it is determined to be true in step S12, that is, registered, a second URL capable of identifying the user ID (of user A) is generated.
At this time, for example, the following first URL and second URL correspond to the same user ID, but are different from each other.
(First URL) http://www.SM.co.jp/A
(Second URL) http://www.SM.co.jp/Axx

Even if the second URL corresponds to the same user ID, a different one-time URL is generated each time the first page request is received.
(Second URL generated at time i) http://www.SM.co.jp/Axi
(Second URL generated at time j) http://www.SM.co.jp/Axj
The generated second URL is temporarily registered in the registration table 100 in association with the user ID.

[S2: Second step]
The authentication server 1 transmits a second message in which the second URL is described with the address of the user ID as a destination. According to FIG. 1, the destination address of the second message is set to the address (A@aaa.com) of the user identified by the first URL.

When the message is, for example, an e-mail based on a mail address, the authentication server 1 has a mail client function and transmits the mail to an external SMTP server. Further, when the message is an SMS push message based on a telephone number, for example, the authentication server 1 has a telephone call function, executes a call connection sequence of the mobile telephone network, and transmits a short message. In this case, the terminal 2 needs to be a smart phone or a portable terminal that can be connected by call. Further, when the message is, for example, an SNS message based on an account, the authentication server 1 has a login function for the SNS site, and notifies the message via the site.

FIG. 3 is a schematic diagram showing an example of a tap operation screen at the time of second authentication in the present invention.

As shown in FIG. 3, the text described in the received second message is displayed on the display of the terminal 2. This message describes the following second URL, and the displayed text prompts the user to perform an activation operation (tap or click).
(Second URL) http://www.SM.co.jp/Axx
This second URL is recognized as a page dedicated to the user A for the authentication server 1.

[S3: Third step]
(S31) When the user A taps the second URL (http://www.SM.co.jp/Axx), the terminal 2 sends a second page request (GET Request) to the authentication server 1. Send.
(S32) When receiving the second page request from the terminal 2, the authentication server 1 determines whether or not the second URL is registered in the registration table 100. If it is determined to be true, that is, registered, it is assumed that the user ID has been successfully authenticated.
Here, the authentication server 1 may return a message indicating that the authentication is successful to the terminal 2 operated by the user A by a page response. By executing the above steps, the user A who operates the terminal 2 can receive provision of a predetermined service after authentication.

As another embodiment, the authentication server 1 may start a timer when the second message is transmitted in step S2. Then, only when the time until the second page request is received from the terminal 2 is equal to or shorter than the predetermined time, the user ID can be successfully authenticated. This predetermined time is set as the effective period of the one-time URL.

<Matching cookie values based on browser>
According to FIGS. 1 to 3 described above, the terminal 2 transmits a page request to the authentication server 1 and receives a page response from the authentication server 1 using both the first URL and the second URL. That is, the first page is displayed on the browser activated at the time of the first authentication, and the second page is also displayed on the same browser at the time of the second authentication.

Therefore, the authentication server 1 may store a cookie value unique to the user in the browser displayed by the first page response at the time of the first authentication. In this case, the terminal 2 transmits a second page request including the cookie value to the authentication server 1 during the second authentication. The authentication server 1 determines whether or not the cookie value included in the second page request is stored in the registration table 100 at the time of the first authentication. If it is determined to be true, that is, the cookie value is stored, the authentication is successful, but if it is determined that the cookie value is not stored in the registration table 100, the authentication fails. Can be determined.

FIG. 4 is a sequence diagram showing a first sequence that is the first half of the process of determining authentication based on the cookie value of the terminal.

The first sequence shown in FIG. 4 is obtained by replacing step S12 in FIG. 1 with steps S121, S122, and S123 shown below as compared with the sequence in FIG.
(S121) Upon receiving an HTTP Get Request for http://www.SM.co.jp/A, the authentication server 1 determines whether or not the URL is registered in the registration table 100. .
(S122) If it is determined to be true in S121, the authentication server 1 generates a cookie value (A1B2C3D4) for the user A and registers it in the registration table 100 in association with the user A. The cookie value is determined by the authentication server 1 as a value unique to the user.
(S123) The authentication server 1 returns a first page response including the “cookie value” generated in S122 to the terminal 2. As a result, the terminal 2 activates the browser and stores the received “cookie value” in the browser.

FIG. 5 is a sequence diagram showing a second sequence executed subsequent to the first sequence in FIG.

The second sequence shown in FIG. 5 is obtained by replacing steps S31 and S32 in FIG. 1 with steps S31 and S32 shown below as compared with the sequence in FIG.
(S31) The terminal 2 transmits an HTTP Get Request directed to http://www.SM.co.jp/Axx. Here, the cookie value (A1B2C3D4) stored in the browser activated in S123 is included in the HTTP Get Request to be transmitted.
(S32) When the authentication server 1 receives the HTTP Get Request, the URL (http://www.SM.co.jp/Axx) and the cookie value (A1B2C3D4) are registered in the registration table 100. It is determined whether or not. If it is determined to be true, that is, registered, authentication is successful, but if it is false, that is, it is determined that the cookie value is not stored in the registration table 100, it is determined that authentication has failed.

FIG. 6 is a functional block diagram showing a functional configuration in an embodiment of the authentication server according to the present invention.

According to the embodiment shown in FIG. 6, the authentication server 1 includes a registration table 100, a first message transmission unit 101, a second URL generation unit 11, a second message transmission unit 12, and an authentication unit. 13. These functional components are realized by a processor having a computer function installed in the authentication server 1 executing an authentication program according to the present invention stored in a memory in the authentication server 1. Further, the processing flow shown by connecting these functional components by arrows is understood as an authentication method according to the present invention.

The registration table 100 stores, for each user ID, an address and a first URL that can identify the user (see FIG. 1 described above). The first message transmission unit 101 transmits the first message describing the first URL, with the address of the user ID identified by the first URL as a destination (see S0 in FIG. 1 described above). ).

When receiving the first page request for the first URL from the terminal 2, the second URL generation unit 11 identifies the user ID and generates a second URL that can identify the user ID. (See S1 in FIG. 1). The second message transmission unit 12 transmits the second message in which the second URL is described, with the address of the user ID as a destination (see S2 in FIG. 1).

When the authentication unit 13 receives the second page request for the second URL from the terminal 2, it is assumed that the user ID has been successfully authenticated (see S3 in FIG. 1).

As described above in detail, according to the authentication server, program, and method of the present invention, two-step user authentication is performed without requiring the user to input any code (for example, user ID, password, or passcode). can do.

As described above, according to the present invention, user authentication can be executed with only two stages of URL taps. Here, the operation effect of the invention described in Non-Patent Document 1 is compared with the operation effect of the present invention.
(1) The invention described in Non-Patent Document 1 inputs a user ID and a password at the time of the first authentication, but the present invention only taps the first URL dedicated to the user ID. . This brings about the same effect as the fact that only the user knows the user ID and password. In fact, the first URL is dedicated to the user and can only be known by the user (first step) ).
(2) The invention described in Non-Patent Document 1 transmits an SMS message by telephone call to the user's smartphone at the time of the second authentication. In this respect, the present invention also performs the same message transmission. (Second step).
(3) In the invention described in Non-Patent Document 1, the pass code of the SMS message is input to the site at the time of the second authentication. However, the present invention provides a one-time second URL dedicated to the user ID. Just tap. This brings about the same effect as that of validating the passcode in one time. In fact, the second URL is valid only in one time (third step).

Note that according to the present invention, different authentication URLs dedicated to the user ID are used in both step S1 and step S3. This corresponds to performing an input operation with different user ID and password twice in light of Non-Patent Document 1. Therefore, the present invention can be superior to the invention described in Non-Patent Document 1 in terms of ensuring security.

Further, according to the present invention, even if the first URL dedicated to the user ID leaks, the message including the one-time second URL reaches only the terminal 2 of the legitimate user. As described above, according to the present invention, the user ID and the password are concealed by the first URL and the second URL dedicated to the user ID, and the security of user authentication can be improved.

Furthermore, according to the present invention, the user can be authenticated simply by tapping the two authentication URLs displayed on the terminal 2, there is no need to start a specific application on the terminal 2, and There is no need to access another Web site separately.

As described above, the present invention ensures the same or higher security as compared with the invention described in Non-Patent Document 1, but provides the user with the first URL and the second URL. It only requires an operation of tapping the URL twice once in total.

For the various embodiments of the present invention described above, various changes, modifications, and omissions in the technical idea and scope of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

DESCRIPTION OF SYMBOLS 1 Authentication server 100 Registration table 101 1st message transmission part 11 2nd URL production | generation part 12 2nd message transmission part 13 Authentication part 2 Terminal

Claims

An authentication server for authenticating a user who operates a terminal,
For each user ID (Identifier), a registration table that stores an address and a first URL (Uniform Resource Locator) that can identify the user of the user ID;
When a first page request directed to a first URL is received from the terminal, a user ID of the first page request is identified, and a second URL that can identify the user ID is generated. 2 URL generation means;
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
An authentication server, comprising: an authentication unit that determines that the authentication of the user ID is successful when a second page request directed to the second URL is received from the terminal.
The first message transmitting means for transmitting the first message describing the first URL to the address of the user ID identified by the first URL as a destination. Authentication server.
The second URL generation unit generates a different second URL as a one-time URL each time a first page request is received for the same user ID. 1. The authentication server according to 1.
The authentication means is concerned only when the time from when the second message is sent by the second message sending means until the second page request is received is less than or equal to a predetermined time. The authentication server according to claim 1, wherein the ID authentication is successful.
When receiving the first page request from the terminal, the second URL generating means generates a cookie value in HTTP (HyperText Transfer Protocol) cookie protocol, and returns the cookie value to the terminal. Register in the registration table in association with the user ID identified by the first URL;
The authentication means authenticates the user ID to the terminal when the cookie value included in the second page request matches the cookie value corresponding to the user registered in the registration table. The authentication server according to claim 1, wherein the authentication server is successful.
The address of the terminal is an email address, a phone number or an account,
The second message is an e-mail based on the e-mail address, an SMS (Short Message Service) push message based on the telephone number, or an SNS (Social Networking Service) message based on the account. The authentication server according to claim 1.
The user ID is a user ID of a commercial transaction site or a block chain site, or a wallet ID of a virtual currency,
The authentication server according to claim 1, wherein the user ID is authenticated without using a password.
A non-transitory computer-readable recording medium that records a program executed by a computer installed in an authentication server that authenticates a user who operates a terminal,
For each user ID, a registration table that stores an address and a first URL that can identify the user of the user ID;
When a first page request directed to a first URL is received from the terminal, a user ID of the first page request is identified and a second URL that can identify the user ID is generated. 2 URL generation means;
Second message transmitting means for transmitting a second message in which a second URL is described, with the address of the user ID as a destination;
A recording medium that, when receiving a second page request for a second URL from the terminal, causes a computer to function as authentication means that the authentication of the user ID is successful.
A two-step authentication method executed by an authentication server for authenticating a user who operates a terminal, wherein the authentication server includes, for each user ID, an address and a first URL that can identify the user of the user ID. And the two-step authentication method is:
When receiving a first page request directed to a first URL from the terminal, a step of identifying a user ID of the first page request and generating a second URL that can identify the user ID When,
Transmitting a second message in which a second URL is described with the address of the user ID as a destination;
A two-step authentication method, comprising: when the second page request for the second URL is received from the terminal, the authentication of the user ID is successful.