JP4943738B2 - Recovery system and recovery method for user authentication function - Google Patents

Description

  The present invention promptly notifies a contractor of information related to unauthorized access in a transaction system having a contractor's identity authentication function, and when the authentication function is locked due to a login failure, The present invention relates to a recovery system of a personal authentication function and a recovery method for enabling recovery.

  In a transaction system such as a shopping site or Internet banking via the Internet, it is common to authenticate the contractor himself / herself by allowing the contractor to input a password when logging in to the transaction system. In order to use such a transaction system, the contractor must memorize the password correctly. If the password is forgotten, there will be a problem that the user cannot log in to the transaction system. .

  In order to deal with such a problem, for example, a method of notifying the contractor of the password when the password inputted at the time of login continuously exceeds the reference number and does not match is considered. . In order to determine whether or not a password can be notified, it is necessary to determine whether the person who attempted to log in is a legitimate contractor or a malicious third party. An invention has been disclosed in which a password is notified only to an authorized contractor by allowing them to be selected (see, for example, Patent Document 1).

JP 2002-132725 A

  The invention described in Patent Document 1 is based on the idea that if a malicious third party attempts to log in, the administrator cannot receive a notification. If personal information such as a phone number is leaked, the risk of a malicious third party receiving a password from an administrator arises by impersonating a legitimate contractor. If emphasis is placed on avoiding fraudulent transactions, it is safer to determine that unauthorized login is attempted first when there is a series of password mismatches. It is common to stop functioning.

  On the other hand, it is necessary to notify a legitimate contractor of the fact that an unauthorized login is attempted, but it is not preferable to notify all the detailed information out-of-band. Therefore, in Internet banking systems, etc., detailed information is displayed on the operation screen after login, and when notifying by e-mail to the e-mail address registered by the contractor, the contents of notification are restricted. It is common to do.

  However, since the method of displaying on the operation screen after login is based on the premise that login is performed by an authorized contractor, unauthorized access cannot be recognized unless login is performed. If the passwords are locked continuously for a mismatch, a problem arises that a legitimate contractor cannot log in because he cannot log in. On the other hand, the notification by the e-mail has a problem that the content of the notification must be limited in consideration of the risk that the e-mail is illegally acquired by a third party.

  The present invention has been made to solve such a problem, and in a transaction system such as Internet banking having a function of authenticating a contractor, information regarding unauthorized access is promptly notified to the contractor. In addition, it is an object of the present invention to provide a recovery system and recovery method for a personal authentication function that enables recovery of the authentication function by the contractor himself / herself when the authentication function is locked due to a login failure. .

  The present invention for solving such problems displays a transaction system having a contractor's identity authentication function and recovery information for re-login when the authentication function is locked due to a login failure to the transaction system. A recovery system for a personal authentication function comprising a subsystem for the authentication system, the transaction system, for each contractor, authentication information for personal authentication, a notification destination for notifying the contractor of information, Contractor information storage means for storing contractor information including at least authentication function lock presence / absence, recovery authority presence / absence, and address information specifying a storage area of the recovery information file for displaying the recovery information, and login failure If the user's operation matches a predetermined condition, the contractor information storage means has an authentication function lock for the corresponding contractor information of the corresponding contractor, Authorized, storing new address information, and sending a recovery notification including the address information to the notification destination stored in the contractor information, and specifying the address information to the subsystem Recovery information requesting means for requesting storage of a recovery information file in which recovery authority information for identifying the contractor and the recovery authority granted to the contractor is embedded in a storage area to be stored; A recovery request receiving means for receiving a recovery request for releasing the lock of the authentication function to which the recovery authority information is given from an operating terminal, and identifying a contractor from the recovery authority information given to the recovery request; The contractor information storage means refers to the contractor information of the corresponding contractor and has recovery authority. And a recovery authority determining means for determining that the recovery authority identified from the recovery authority information matches a predetermined condition by comparing with the predetermined contractor information, and that the recovery authority is a legitimate recovery request, and the recovery authority If the determination means determines that the request is a valid recovery request, the re-login screen display means for displaying the authentication information input screen for re-login on the terminal, and the authentication information input to the input screen from the terminal. When received, the authentication function lock included in the contractor information is disabled if the authentication information matches with the authentication information included in the contractor information of the corresponding contractor in the contractor information storage means. And an authentication function recovery means for updating the recovery authority to be zero, and the recovery information file stored in the subsystem is a predetermined information The recovery system is characterized in that it is set to be inaccessible even if the address information is specified when the period elapses.

  In the present invention, a subsystem for displaying recovery information is provided outside a transaction system having a personal authentication function, and an address for displaying the recovery information is assigned to each time the authentication function is locked. In this case, information necessary for recovery is accessed by notifying the address. Since the recovery information is outside the personal authentication function, the contractor can access it even after the authentication function is locked. Detailed information is not included in the notification sent to the contractor, and the contractor can access the detailed information by browsing the recovery information file of the subsystem. By setting the recovery information file to be inaccessible after a predetermined period of time, the safety of the information can be ensured.

  According to the present invention, the subsystem embeds information obtained by encrypting the address information as a recovery authority information in a recovery information file, and the recovery authority determination unit combines the recovery authority information into the contractor information. It may be characterized in that it is determined whether the request is a legitimate recovery request by collating with the address information included.

  The present invention stores an identification code for identifying a recovery authority newly set in the contractor information of the corresponding contractor in the contractor information storage unit when the recovery notification transmission unit transmits the recovery notification. The subsystem embeds the identification code as a recovery authority information in a recovery information file, and the recovery authority determination means collates the identification code given to the recovery request with the identification code included in the contractor information. Thus, it can be characterized that it is determined whether the request is a valid recovery request.

  According to the present invention, the subsystem embeds an instruction to give the address information when transmitting a recovery request instead of the recovery authority information, and the recovery authority determining means stores the address information instead of the recovery authority information. It may be characterized in that it is received and collated with address information included in the contractor information to determine whether it is a legitimate recovery request.

  In the present invention, the method for associating the recovery authority displayed on the subsystem and the recovery request from the terminal is not particularly limited, but as described above, information obtained by encrypting address information such as URL, Use the identification code assigned for each recovery authority as a key for linking, or set the address of the previous page to be transmitted from the terminal, etc. Authority can be specified.

  Further, in the present invention, when the recovery notification transmission unit transmits a recovery notification, the expiration date of the recovery authority newly set in the contractor information of the corresponding contractor in the contractor information storage unit is stored. The recovery authority determining unit may determine that the recovery request is not a valid recovery request when an expiration time included in the contractor information has passed.

  As described above, if the recovery authority is configured to have an expiration date, it is possible to reduce the risk that recovery is performed by a person other than the regular contractor and to increase the safety of transactions.

  In the above configuration, the present invention is the transaction system, wherein the contractor information stored in the contractor information storage means identifies contractor information whose expiration date has been reached, and has the recovery authority included in the contractor information. The address information specifying means for updating address information included in the contractor information, and the recovery information file corresponding to the address information specified by the address information specifying means in the subsystem. Recovery information stopping means for transmitting a command for setting so that access is not permitted even if specified. The recovery information requesting unit requests the subsystem to store the expiration date in association with the recovery information file, and the transaction system includes the contractor information stored in the contractor information storage unit. A recovery authority erasure unit that identifies contractor information whose expiration date has arrived and updates the recovery authority included in the contractor information without updating is provided, and the subsystem includes an expiration date associated with the recovery information file The recovery information file may be provided with recovery information stopping means for setting the recovery information file to be inaccessible even if the address information of the recovery information file is specified.

  In this way, when the recovery authority is configured to have an expiration date, the recovery information file is configured to be inaccessible to the recovery information file when the expiration date is reached, so that the recovery information can be obtained by a person other than a regular contractor. It can reduce the risks referenced and increase the safety of transactions.

  Further, according to the present invention, the authentication function recovery means designates the address information for the recovery information file corresponding to the address information included in the contractor information to the subsystem when the authentication information matches. However, it is also possible to send a command for setting so that access is impossible.

  In this way, by configuring the recovery information file to be inaccessible when the authentication function is recovered by a legitimate contractor, the risk that the recovery information is referenced by other than the legitimate contractor is reduced, and the transaction Safety can be increased.

  Furthermore, the present invention can also be specified as a recovery method of the personal authentication function that is executed by the recovery system of the personal authentication function according to the present invention.

  That is, the recovery method of the personal authentication function according to the present invention includes a transaction system having a contractor's personal authentication function, and recovery information for re-login when the authentication function is locked due to a login failure to the transaction system. A recovery method of a personal authentication function executed by a subsystem for displaying an authentication information, wherein the transaction system notifies authentication information for personal authentication and information to the contractor for each contractor. Contractor information for storing contractor information including at least a notification destination for authentication, presence / absence of authentication function lock, presence / absence of recovery authority, and address information specifying a storage area of a recovery information file for displaying the recovery information A storage unit is provided, and the transaction system, when the login failure operation matches a predetermined condition, in the contractor information storage unit The authentication function lock of the contractor information of the corresponding contractor is set, the recovery authority is set, the new address information is stored, and the recovery notification including the address information is transmitted to the notification destination stored in the contractor information A recovery notification sending step, and the transaction system embeds recovery authority information for identifying the contractor and the recovery authority granted to the contractor in the storage area specified by the address information in the subsystem. Recovery information request step for requesting storage of the recovered recovery information file, and a recovery request for the transaction system to release the lock of the authentication function to which the recovery authority information is granted from a terminal operated by a contractor A recovery request receiving step for receiving the request, and the transaction system includes a request given to the recovery request. The contractor is identified from the valid authority information, the contractor information storage unit refers to the contractor information of the corresponding contractor, the recovery authority has been granted, and the recovery authority identified from the recovery authority information is predetermined. If it is confirmed that the predetermined condition is matched with the contractor information, the recovery authority determination step that determines that the request is a valid recovery request, and the transaction system performs a recovery request that is valid in the recovery authority determination step. When it is determined that there is a re-login screen display step for displaying an authentication information input screen for re-login on the terminal, and when the transaction system receives the authentication information input on the input screen from the terminal, When the authentication information matches with the authentication information included in the contractor information of the corresponding contractor in the contractor information storage unit And an authentication function recovery step that updates the authentication function lock included in the contractor information without using the recovery authority, and the subsystem stores a recovery information file stored in the subsystem. The recovery method is characterized in that, after a predetermined period of time elapses, the address information is designated so that access is disabled.

  In the recovery method of the personal authentication function according to the present invention, the subsystem includes a step of embedding information obtained by encrypting the address information as a recovery authority information in a recovery information file. The transaction system may be characterized in that the recovery authority information is compounded and collated with address information included in the contractor information to determine whether the recovery request is valid.

  In the recovery method of the personal authentication function according to the present invention, when the recovery notification is transmitted by the recovery notification transmitting means, the transaction system newly adds the contractor information of the corresponding contractor in the contractor information storage unit. An identification code for identifying the set recovery authority is stored, and the subsystem includes a step of embedding the identification code as recovery authority information in a recovery information file. In the recovery authority determining step, the transaction system Can be characterized by collating the identification code given to the recovery request with the identification code included in the contractor information to determine whether it is a legitimate recovery request.

  The recovery method of the personal authentication function according to the present invention includes a step in which the subsystem embeds an instruction for giving the address information when transmitting a recovery request instead of the recovery authority information, and the recovery authority determining step The transaction system receives the address information instead of the recovery authority information, and checks with the address information included in the contractor information to determine whether it is a legitimate recovery request. You can also.

  In the recovery method of the personal authentication function according to the present invention, when the recovery notification is transmitted in the recovery notification transmission step, the transaction system stores the contractor information of the corresponding contractor in the contractor information storage unit. The expiration date of the newly set recovery authority is stored, and in the recovery authority determining step, the transaction system is valid if the recovery request reception time has passed the expiration date included in the contractor information. It can also be characterized that it is determined that the request is not a correct recovery request.

  In the above method, the method for recovering the identity authentication function according to the present invention is such that the transaction system specifies contractor information whose expiration date has been reached in the contractor information stored in the contractor information storage unit, and the contract The recovery authority included in the contractor information is updated to zero, the address information specifying step for specifying the address information included in the contractor information, and the transaction system specified in the subsystem in the address information specifying step The recovery information file corresponding to the address information may include a recovery information stop step of transmitting a command for setting to make the access impossible even if the address information is specified. In the recovery information requesting step, the transaction system requests the subsystem to store the expiration date in association with the recovery information file, and the transaction system is stored in the contractor information storage unit. The contractor information specifying the contractor information whose expiration date has been reached in the contractor information, and the recovery authority deletion step for updating the recovery authority included in the contractor information to zero, and the validity of the subsystem associated with the recovery information file A recovery information stop step for setting the recovery information file that has reached the time limit to be inaccessible even if address information of the recovery information file is specified may be provided.

  Furthermore, in the recovery method of the personal authentication function according to the present invention, in the authentication function recovery step, when the authentication information matches, the transaction system includes the address information included in the contractor information in the subsystem. For the recovery information file corresponding to, a command for setting the access information to be inaccessible even if the address information is specified may be transmitted.

  In accordance with the present invention, when a fraudulent access is made by a malicious third party in a transaction system such as Internet banking equipped with a contractor's identity authentication function, information regarding unauthorized access is promptly and securely notified to the contractor. In addition, even if the authentication function is locked due to a login failure during unauthorized access, the authentication function can be easily recovered by the contractor.

  The best mode for carrying out the present invention will be described below in detail with reference to the drawings. In addition, although the following embodiment demonstrates the example which applies this invention to the transaction system of internet banking, this embodiment is an example of this invention and the transaction system to which this invention is applied is restricted to internet banking. However, the present invention is not limited to the following description.

  FIG. 1 is a diagram showing an outline of an embodiment of a recovery system according to the present invention. FIG. 2 is a block diagram showing the configuration of the recovery system according to the present invention. FIG. 3 is a diagram showing an example of the contractor master table of the recovery system according to the present invention. FIG. 4 is a diagram showing an example of an access log table in the recovery system according to the present invention. FIG. 5 is a diagram showing an example of the recovery authority table in the recovery system according to the present invention. 6 to 13 are first to eighth diagrams showing recovery flows of the personal authentication function by the recovery system according to the present invention. 14 to 21 are flowcharts showing processing flows in the transaction system, subsystem, and terminal from when unauthorized access is performed by the recovery system according to the present invention until recovery of the personal authentication function is performed.

  An overview of an embodiment of a recovery system according to the present invention will be described with reference to FIG. The recovery system according to the present invention is provided as a function of a transaction system and a subsystem in order to execute a recovery process of a personal authentication function in a transaction system such as Internet banking. Contractors such as Internet banking operate terminals such as PCs and mobile phones, access the transaction system via the Internet, and execute various transactions.

  The transaction system is equipped with a contractor's identity authentication function. When a contractor accesses the transaction system and conducts a transaction, the contractor's number and password are entered into the terminal, and the transaction system is Make a login request. In the transaction system that has received the request, the entered contractor number and password are checked against the password corresponding to the contractor number registered in the transaction system in advance. Approve login. In the case of mismatch, considering the possibility of a password input error, the user is requested to re-enter the contractor number and password up to a predetermined number of times. If the number of mismatches exceeds a predetermined number of times, it is determined that the unauthorized access has been made by a malicious third party, and password lock is performed so that subsequent login operations are not accepted for the contractor number.

  When the password is locked, the contractor is notified that unauthorized access has been made, and the recovery authority necessary to recover the authentication function by releasing the password lock is set, and the recovery information necessary for recovery is provided. Store the file to be displayed in the subsystem. As the subsystem, a Web server connected to the Internet outside the authentication function of the transaction system is used. The notification to the contractor is made by e-mail, and the address for accessing the file is notified.

  The address for storing the file for displaying the recovery information is set for each recovery authority, and access from the outside is prohibited after a predetermined period. By setting in this way, the contents notified by the outbound e-mail are limited, while the recovery information and other detailed information can be safely notified to the contractor.

  Upon receiving notification by e-mail, the contractor knows that unauthorized access has been attempted to his / her trading account, and specifies the address specified in the e-mail to obtain detailed information. To access the subsystem. A method for accessing the subsystem is not particularly limited, and a link in which an address is embedded in an electronic mail text may be provided, or a URL may be described in the text.

  When the contractor accesses the subsystem, a file related to the recovery information stored at the designated address is displayed on the terminal. On the displayed screen, a button for performing recovery of the personal authentication function is provided, and when this button is pressed, a recovery request specifying the recovery authority set for each is made, and a valid recovery authority in the transaction system If it is confirmed that the request is based on, a re-login screen is displayed on the terminal. When the contractor enters the contractor number and password on the re-login screen and makes a re-login request, the password is checked against the password corresponding to the contractor number registered in the transaction system in advance. Login is approved.

  Note that the authentication method used in the transaction system in the present invention is not limited to password authentication, and may be based on other authentication methods such as biometric authentication using fingerprints or voice authentication. Even when the method is used, the authentication function is locked and recovered. Any subsystem can be used as long as it can display information on the accessed terminal without requiring authentication by the transaction system, and constitutes a part of a Web server used as an Internet banking system. May be.

  Next, the configuration when the recovery system according to the present invention is used in the Internet banking system will be described in detail with reference to the block diagram of FIG. 2 and an example of each table shown in FIGS.

  In FIG. 2, the recovery system according to the present invention is provided in the Internet banking transaction system 20, and cooperates with the subsystem 30 to notify the contractor of unauthorized access and recover the personal authentication function. The terminal 10 and the terminal 40 are terminal devices that can be connected to the Internet, such as a PC, a mobile phone, and a PDA, and can use the Internet banking service by accessing the transaction system 20 using a Web browser. In addition, it is possible to browse the information by accessing the subsystem 30 using a Web browser.

  The transaction system 20 is a computer system having a Web server function and a personal authentication function, and includes a CPU, a RAM, a ROM, and an HDD. Each function executed by the transaction system is executed by an application program stored in the HDD. In order to execute these application programs, hardware control such as input control and output control stored in the ROM is required. The CPU executes predetermined arithmetic processing while starting up various basic programs and causing the RAM to function as a work area for the application program. The login processing unit 22, the recovery control unit 23, and the subsystem control unit 24 of the transaction system 20 are all functionally specified. When actually executing login or recovery processing, the login processing unit 22, the recovery control unit 23, and the subsystem control unit 24 are stored in the HDD. Each stored application program is read into the RAM, and the arithmetic processing is executed by the CPU.

  The transaction system 20 includes a contractor database 21. The contractor database 21 includes a contractor master table 211, an access log table 212, and a recovery authority table 213. In the contractor master table 211, basic information of the contractor such as an account number and a password as shown in the example of FIG. 3, and in the access log table 212, for each contractor number as shown in the example of FIG. In the recovery authority table 213, information on the recovery authority when the recovery authority is set after the password lock as shown in the example of FIG. 5 is stored.

  In this example, information related to the contractor and access authority necessary for the present invention is stored in the three tables of the contractor master table 211, the access log table 212, and the recovery authority table 213. The configuration of the table provided in is not limited to this example as long as necessary information is stored in association with each other. The contractor database 21 may be provided in a physically separated computer system such as a database server different from the transaction system 20.

  The subsystem 30 is connected to the transaction system 20, and when the password lock is performed in the transaction system 20 and the recovery authority is set, the recovery information file is received in the recovery information creation unit 31 in response to a command from the transaction system 20. Create The created recovery information file is stored in a recovery information storage unit 32 that can be accessed from the terminal 10 or the like.

  The subsystem 30 is also a computer system having a Web server function, and includes a CPU, a RAM, a ROM, and an HDD. In order to execute an application program stored in the HDD, the input control stored in the ROM is used. As with the transaction system 20, the CPU performs predetermined arithmetic processing while starting various basic programs for hardware control such as output control and causing the RAM to function as a work area for the application program. is there. The recovery information creation unit 31 is functionally specified. When actually creating recovery information, the application program stored in the HDD is read into the RAM, and the arithmetic processing is executed by the CPU. The Rukoto. The subsystem 30 may be provided in a computer system that is physically the same as the transaction system 20, but may be configured to access the subsystem 30 without performing personal authentication in the transaction system 20. is necessary.

  FIG. 3 shows an example of the contractor master table 211 of the contractor database 21. The records provided for each contractor number include the contractor's basic information such as the store number of the deposit account, account number, contractor name, password used for identity authentication, and the e-mail address of the notification destination. , A flag indicating whether or not a password is locked due to unauthorized access (in this example, “1” is locked and “0” is unlocked), and the recovery authority for releasing the password lock and recovering the authentication function A flag indicating that it is given to the contractor (in this example, “1” is authorized and “0” is not authorized) is stored. If the password lock is enabled, the personal authentication function is stopped and the login request cannot be accepted.

  FIG. 4 shows an example of the access log table 212 of the contractor database 21. A table for recording a log-in request history is provided for each contractor number, and the access date, access source IP address, password verification result, and the like are stored as an access log. If the password specified in the login request matches the password specified in the contractor master table 211, “OK” is recorded in the verification result, but “NG” is recorded in the case of a mismatch, The number of consecutive “NG” is counted in the error count field. When the number of errors reaches a predetermined number, it is determined that the access is unauthorized and the password is locked.

  FIG. 5 shows an example of the recovery authority table 213 of the contractor database 21. When the number of errors in the access log table 212 exceeds a predetermined number of times, a flag indicating that a password is locked and a flag indicating that a recovery authority is provided are set as shown in FIG. Is granted. The recovery authority is specified by the contractor number, recovery information creation date, password lock date, address information, recovery authority expiration date, and the like. The address information is an address such as a URL for storing a recovery information file for letting a contractor know detailed information regarding unauthorized access and information regarding recovery authority necessary for recovery processing. Issued by the recovery control unit 23 of the transaction system 20.

  Based on the above configuration, the operation of the recovery system according to the present invention will be described in detail using an example of the recovery flow of the personal authentication function shown in FIGS. It is assumed that the contractor number, password, etc. registered in the recovery system follow the examples of FIGS.

  As shown in FIG. 6, it is assumed that a malicious third party who operates the terminal 40 attempts unauthorized access to the transaction system 20 by specifying a contractor number (12345678). Since the password is usually not known, if you know the date of birth of the contractor, guess the password from the information, enter the contractor number and password in the terminal 40, the transaction Send a login request to the system.

  In the transaction system 20 that has received the login request, the login processing unit 22 is activated, specifies the record corresponding to the contractor number specified in the contractor master table 211, and acquires the password (xyz9999). The acquired regular password is collated with the input password, and the collation result is recorded in the access log table 212. When the passwords do not match, the number of errors is counted, and when the predetermined number of times (three times in this example) is reached, the recovery processing unit 23 is activated to set password lock and recovery authority.

  Password lock and recovery authority are set as follows. First, in the contractor master table 211, the corresponding contractor number password lock flag is updated from no lock (0) to lock (1). If the password lock flag is locked (1), even if a login request with a specified contractor number is received after that, the authentication function is stopped and whether or not the passwords match. Regardless, login is not accepted. Also, the corresponding contractor number recovery authority flag is updated from unauthorized (0) to authorized (1).

  Further, information on the newly set recovery authority is recorded in the recovery authority table 213. The contents of the information recorded as the recovery authority are not particularly limited, but a recovery information file for storing detailed information on unauthorized access and information on the recovery authority necessary for recovery processing is stored. Address information (http://subsystem.mufg.jp/12345678/0405) such as the URL to be executed and the expiration date of the recovery authority that defines the period during which the recovery information file can be accessed (April 6, 2006, 24:00) ) Is always set. Since the address information is also used for verification of recovery authority later, a unique address different for each recovery authority is assigned. In addition, a storage area of the subsystem 30 that does not require personal authentication for access is allocated to this address.

  Subsequently, as shown in FIG. 7, the transaction system 20 authenticates an e-mail notifying the address information for the contractor to acquire detailed information related to unauthorized access and information related to recovery authority necessary for recovery processing. The contractor in advance transmits to a mail address (xyz@ipv.jp) stored in the contractor master table 211 in advance. Since this e-mail is transmitted as an outbound notification, it is preferable that the e-mail does not include information that is not particularly necessary other than the address information. The method for notifying address information is not particularly limited, and a URL or the like may be described in the body of the e-mail, or a link may be embedded in the e-mail.

  Further, in the transaction system 20, the subsystem control unit 24 is activated, and a request for creating a recovery information file for causing the subsystem 30 to display detailed information related to unauthorized access and information related to the recovery authority necessary for the recovery process. Send. In the recovery information file, an address to be stored for each recovery authority is assigned to the subsystem 30, so the address set in the subsystem 30 is also notified. Since the address is set for each recovery authority, if the address is specified, it can be checked against the set access authority when confirming the access authority later, but the access authority can be confirmed smoothly. For this purpose, it is preferable to notify the sub-system 30 together with the contractor number.

  In the subsystem 30 that has received the creation request for the recovery information file, as shown in FIG. 8, the recovery information creation unit 31 is activated, and the recovery of the HTML file or the like for displaying the recovery information on the terminal operated by the contractor An information file is created. In the recovery information file, in addition to the text describing the password lock and the date and time of the lock, etc., it is required that the authorized user unlocks the password and recovers the authentication function. A recovery button is displayed. In the recovery button, address information (which may include a contractor number) received from the transaction system 20 for identifying the recovery authority is embedded, but the embedded information is preferably encrypted.

  The recovery information file created here is stored in the storage area specified by the address information received from the transaction system 20 in the recovery information storage unit 32. Since the recovery information storage unit 32 of the subsystem 30 is outside the personal authentication function of the transaction system 20, it can be accessed from the terminal 10 or the like using a Web browser even after the password is locked. It is possible.

  As shown in FIG. 9, the legitimate contractor who has received the e-mail selects the URL link displayed in the e-mail text on the terminal 10 and accesses the recovery information file of the subsystem 30. The recovery information file is displayed by the Web browser of the terminal 10, and a legitimate contractor can know detailed information about unauthorized access.

  When a legitimate contractor wants to recover the personal authentication function by releasing the password lock, a recovery button displayed on the terminal is pressed as shown in FIG. When the recovery button is pressed, a recovery request is transmitted to the transaction system 20 with the encrypted address information embedded in the recovery button.

  When the transaction system 20 receives the recovery request from the terminal 10, the operation of the recovery control unit 23 combines the encrypted address information attached to the recovery request. Since the combined address information is assigned for each recovery authority, it is possible to specify the corresponding recovery authority and the contractor master corresponding to the recovery authority. In addition, the contractor number is embedded in the recovery button together with the address information, or the contractor number is included in a part of the address information (for example, “12345678 of“ http://subsystem.mufg.jp/12345678/0405 ”). "Part"), it is possible to directly identify the contractor master corresponding to the contractor number.

  The method for specifying the recovery authority is not limited to the above method. For example, an identification code for identifying the recovery authority is assigned separately from the address information, and the identification code is stored in the recovery authority table and the recovery is performed. It may be configured to embed an identification code in the button. Also, instead of embedding the address information in the recovery button, when the recovery button is pressed, the URL of the file displayed by the referrer function of the web browser is set to be transmitted together with the recovery request. The address information may be acquired.

  In this way, when the recovery authority and the contractor master that received the recovery request are specified, it is confirmed whether or not the recovery request is valid. In order to determine that the recovery request is valid, the corresponding contractor number and address information exist, the recovery authority of the contractor master is set to (1), and the recovery authority is set. Therefore, it is confirmed in the contractor master table 211 and the recovery authority table 213 whether or not these conditions are satisfied.

  When it is confirmed that all the above conditions are satisfied, as shown in FIG. 11, the transaction system 20 displays a contractor number and password input screen for re-login on the terminal 10.

  In the terminal 10 on which the re-login input screen is displayed, as shown in FIG. 12, a regular contractor inputs a contractor number (12345678) and a password (xyz9999). The entered contractor number and password are transmitted to the transaction system 20, and the entered password is checked against the password (xyz9999) stored in the contractor master table 211 specified by the contractor number (12345678). If the passwords match, it is determined that the request is a recovery request by a legitimate contractor, and a recovery process is executed by the operation of the recovery control unit 23.

  As shown in FIG. 13, the recovery process updates the contractor master password lock from locked (1) to unlocked (0) and changes the recovery authority from authorized (1) to unauthorized (0). ) Is done by updating. As a result, the password lock is released, the personal authentication function is enabled, and a legitimate contractor can log in to the transaction system 20. In addition, the count of the number of errors of the corresponding contractor recorded in the access log table 212 is cleared to “0”.

  In addition, a stop request that disables access to the recovery information file stored in the recovery information storage unit 32 is transmitted to the subsystem 30 by the operation of the subsystem control unit 24. The stop request is made by specifying the address information, and the subsystem 30 executes a process for stopping the display of the recovery information file stored at the corresponding address. The process for stopping the display is not particularly limited. For example, the recovery information file may be moved to an externally inaccessible storage area, or the recovery information file may be deleted. Good.

  It should be noted that the processing for disabling access to the recovery information file is preferably performed not only after the recovery is performed but also after the expiration date of the recovery authority has passed. Specifically, for example, the address information of the recovery authority whose expiration date has passed in the transaction system 20 is specified, and an instruction for disabling access to the recovery information file stored in the specified address information is given to the subsystem 30. It may be configured to transmit, or information related to the expiration date is transmitted together with the request for creating the recovery information file to the subsystem 30, and the expiration date for each recovery information file is stored in the subsystem 30. The subsystem 30 may be configured such that the recovery information file whose expiration date has passed is confirmed and access is disabled.

  If the password entered on the re-login input screen does not match the password of the contractor master, it is determined that the recovery request is not a valid contractor. In this case, recovery of the personal authentication function is not performed, and re-login is not approved, of course, but in order to prevent repeated re-login attempts by a malicious third party, the recovery authority is authorized. It is preferable to update from existence (1) to no authorization (0). By comprising in this way, the risk that recovery is performed illegally can be reduced and the safety of transactions can be enhanced.

  The processing flow in the transaction system, subsystem, and terminal from when unauthorized access is performed by the recovery system according to the present invention until recovery of the personal authentication function is described with reference to the flowcharts of FIGS. To do.

  FIG. 14 shows a processing flow in the transaction system until an unauthorized access is recognized and a password lock is set. In a transaction system that provides an internet banking service, when a login request to the transaction system is accepted (S01), whether or not the password specified in the login request matches the password registered in advance for the contractor who made the login request Is confirmed (S02). If the passwords match, it is determined that the login request is made by a valid contractor, an access log is recorded (S03), and the login process proceeds.

  On the other hand, if the passwords do not match, the fact that an error has occurred is recorded in the access log (S04), and one time is added to the count of the number of errors that have occurred continuously (S05). Here, it is confirmed whether the number of consecutive errors is n times (the number of times to be used as a reference for determining unauthorized access) or not (S06). For example, a login request is received again (S01).

  If the number of errors is n times or more, it is determined that the access is not an error due to an incorrect input by a legitimate contractor but an unauthorized access by a malicious third party, and the user authentication function is stopped and login is not accepted. Execute the process to make it happen. Specifically, the password lock of the contractor master specified by the contractor number is set to “Yes” (S07), and the recovery authority of the contractor master is also set to “Yes” (S08).

  Furthermore, a unique URL is assigned to each recovery authority for storing a recovery information file for notifying a legitimate contractor of detailed information regarding unauthorized access and information regarding recovery authority necessary for recovery processing (S09). . Also, for the newly set recovery authority, information such as the date and time when the password lock was performed, the assigned URL, the expiration date of the recovery authority, etc. are registered (S10). An information file creation request is transmitted (S11). Further, a recovery notification in which the URL is described is sent to the contractor by e-mail, with the e-mail address registered in advance by the contractor stored in the contractor master as a destination (S12). Note that the processing procedures of these processes (S07 to S12) after determining unauthorized access are not particularly limited to the above order.

  FIG. 15 shows a processing flow in the subsystem that has received a recovery information file creation request from the transaction system. When a recovery information file creation request is received (S21), a recovery information file is created (S22). About the creation method of the recovery information file, the layout of the display file including the text of the notification contents, the date and time when the password lock was performed, the expiration date of the recovery authority, etc. is created (S221), and specified in the recovery information file creation request. The URL is encrypted (S222). The encrypted URL is embedded in the recovery button displayed by the recovery information file (S223). The recovery information file created in this way is stored in the file path specified by the URL (S23).

  Note that the recovery information file creation process described in S221 to S223 is performed in the transaction system. In the subsystem, the recovery information file received from the transaction system is simply stored in the URL specified from the transaction system. It is good as well.

  FIG. 16 shows a processing flow in the terminal operated by the contractor who has received the recovery notification from the transaction system. When the recovery notification is received (S31) and the URL displayed in the mail is selected by the contractor (S32), the recovery information file specified by the URL is browsed. Performed (S33). If no URL is selected (S32), the process ends.

  FIG. 17 shows a processing flow in the subsystem that accepts access to the recovery information file from the terminal operated by the contractor. When the subsystem receives access from the terminal (S41), the recovery information file is read from the file path specified by the URL (S42) and displayed on the terminal operated by the contractor (S43).

  FIG. 18 shows a processing flow in the terminal operated by the contractor in which the recovery information is displayed by the recovery information file of the subsystem. The recovery information is displayed by the recovery information file on the operation screen of the terminal operated by the contractor (S51), and when the recovery button displayed in a part of the recovery information is pressed (S52), it is embedded in the recovery button. A recovery request with the encrypted URL is transmitted to the transaction system (S53). If the recovery button is not pressed (S52), the process is terminated as it is.

  FIG. 19 shows a processing flow in the transaction system that has received the recovery request from the terminal operated by the contractor. When the transaction system receives the recovery request (S61), the encrypted URL attached to the recovery request is decrypted (S62). It is checked whether or not the combined URL matches the URL for which the recovery authority is set (S63). If there is no matching URL, an error occurs.

  If there is a matching URL, the contractor number of the corresponding contractor is specified from the combined URL, and it is confirmed whether the contractor number exists in the contractor master (S64). An error occurs if the contractor number does not exist. If the contractor number exists, it is checked whether the recovery authority of the corresponding contractor master exists (S65), or whether it falls within the expiration date of the corresponding recovery authority (S66). If it does not fall into either one, an error occurs. If it is confirmed that all of these conditions are met, an input screen for re-login is displayed on the operation screen of the terminal operated by the contractor (S67).

  FIG. 20 shows a processing flow in the terminal operated by the contractor on which the input screen for re-login is displayed. When the re-login screen is displayed on the contractor's terminal (S71) and the contractor number and password entered by the contractor are received (S72), the re-login specifying the received contractor number and password is specified for the transaction system. A request is transmitted (S73).

  FIG. 21 shows a processing flow in the transaction system that has received a re-login request from the terminal operated by the contractor. The transaction system receives the re-login request (S81), and specifies the contractor number and password specified in the login request (S82). A password registered in advance for the identified contractor number is acquired from the contractor master, and it is verified whether it matches the identified password (S83). If they match, it is determined that the request is a re-login request from a valid contractor, and the following recovery process is executed.

  First, the contractor master is updated without password lock (S84), and updated without recovery authority (S85). Subsequently, the access log error count is cleared (S86), and a request to hide the recovery information file stored in the subsystem is sent to the subsystem (S87). By such recovery processing, the password lock is released and the identity authentication function is restored, making it possible to conduct transactions as usual.

  On the other hand, if the passwords do not match, it is determined that the re-login request is invalid, and the recovery authority is updated so that subsequent recovery requests cannot be accepted (S88). An error screen is displayed on the operating terminal (S89), and the process ends.

It is a figure which shows the outline | summary of embodiment of the recovery system concerning this invention. It is a block diagram which shows the structure of the recovery system concerning this invention. It is a figure which shows an example of the contractor master table of the recovery system concerning this invention. It is a figure which shows an example of the access log table in the recovery system concerning this invention. It is a figure which shows an example of the recovery authority table in the recovery system concerning this invention. It is a 1st figure which shows the flow of recovery of a personal authentication function by the recovery system concerning this invention. It is a 2nd figure which shows the recovery flow of a personal authentication function by the recovery system concerning this invention. It is a 3rd figure which shows the flow of recovery of a personal authentication function by the recovery system concerning this invention. It is a 4th figure which shows the flow of recovery of a personal authentication function by the recovery system concerning this invention. It is a 5th figure which shows the recovery flow of a personal authentication function by the recovery system concerning this invention. It is a 6th figure which shows the flow of recovery of a personal authentication function by the recovery system concerning this invention. It is a 7th figure which shows the flow of recovery of a personal authentication function by the recovery system concerning this invention. It is an 8th figure which shows the recovery flow of a personal authentication function by the recovery system concerning this invention. It is a 1st flowchart which shows the processing flow of the transaction system in the recovery system concerning this invention. It is a 1st flowchart which shows the processing flow of a subsystem in the recovery system concerning this invention. It is a 1st flowchart which shows the processing flow of the terminal which a contractor operates in the recovery system concerning this invention. It is a 2nd flowchart which shows the processing flow of a subsystem in the recovery system concerning this invention. It is a 2nd flowchart which shows the processing flow of the terminal which a contractor operates in the recovery system concerning this invention. It is 2 flowcharts which show the processing flow of the transaction system in the recovery system concerning this invention. It is a 3rd flowchart which shows the processing flow of the terminal which a contractor operates in the recovery system concerning this invention. It is a 3rd flowchart which shows the processing flow of the transaction system in the recovery system concerning this invention.

10 Terminal 20 Transaction System 21 Contractor Database 211 Contractor Master Table 212 Access Log Table 213 Recovery Authority Table 22 Login Processing Unit 23 Recovery Control Unit 24 Subsystem Control Unit 30 Subsystem 31 Recovery Information Creation Unit 32 Recovery Information Storage Unit 40 Terminal

Claims (7)

A personal authentication function comprising a transaction system having a contractor's identity authentication function and a subsystem for displaying recovery information for re-login when the authentication function is locked due to a login failure to the transaction system. A recovery system, wherein the transaction system comprises:
For each contractor, authentication information for personal authentication, a notification destination for notifying the contractor of information, presence / absence of authentication function lock, presence / absence of recovery authority, and recovery information file for displaying the recovery information The contractor information storage means for storing the contractor information including at least the address information designating the storage area;
When the login failure operation meets a predetermined condition, the contractor information storage means has a contractor information authentication function lock of the corresponding contractor, has recovery authority, stores new address information, and stores the contract Recovery notification transmission means for transmitting a recovery notification including the address information to the notification destination stored in the person information,
Request that the subsystem store a recovery information file in which recovery authority information for identifying the recovery authority granted to the contractor and the contractor is embedded in a storage area specified by the address information Recovery information requesting means,
A recovery request receiving means for receiving a recovery request for unlocking the authentication function given the recovery authority information from a terminal operated by a contractor;
Identify the contractor from the recovery authority information given to the recovery request, refer to the contractor information of the corresponding contractor in the contractor information storage means, have recovery authority, and from the recovery authority information When the identified recovery authority is compared with predetermined contractor information to confirm that it matches a predetermined condition, a recovery authority determination unit that determines that the recovery authority is a legitimate recovery request;
When determining that the recovery authority determination means is a valid recovery request, a re-login screen display means for displaying an authentication information input screen for re-login on the terminal;
When the authentication information input on the input screen is received from the terminal, the authentication information matches with the authentication information included in the contractor information of the corresponding contractor in the contractor information storage unit. And an authentication function recovery means for updating the authentication function lock included in the contractor information without using the recovery authority,
The recovery system, wherein the recovery information file stored in the subsystem is set to be inaccessible even if the address information is specified when a predetermined period has elapsed. The subsystem embeds information obtained by encrypting the address information as recovery authority information in a recovery information file,
The said recovery authority determination means combines the said recovery authority information, collates with the address information contained in the said contractor information, and determines whether it is a legitimate recovery request | requirement of Claim 1 characterized by the above-mentioned. Recovery system. When the recovery notification transmitting means transmits a recovery notification, an identification code for identifying the recovery authority newly set in the contractor information of the corresponding contractor in the contractor information storage means is stored,
The subsystem embeds the identification code as recovery authority information in a recovery information file,
The said recovery authority determination means determines whether it is a legitimate recovery request by collating the identification code given to the said recovery request with the identification code contained in the said contractor information. Recovery system. The subsystem embeds an instruction to give the address information when transmitting a recovery request instead of the recovery authority information,
The recovery authority determining unit receives the address information instead of the recovery authority information, and compares the address information with the address information included in the contractor information to determine whether it is a legitimate recovery request. The recovery system according to claim 1. When the recovery notification transmission unit transmits a recovery notification, the expiration date of the recovery authority newly set in the contractor information of the corresponding contractor in the contractor information storage unit is stored,
The recovery authority determination unit determines that the recovery request is not a legitimate recovery request when an expiration time included in the contractor information has passed. The recovery system described in If the authentication information matches, the authentication function recovery means cannot access the subsystem even if the address information is specified for the recovery information file corresponding to the address information included in the contractor information. The recovery system according to any one of claims 1 to 5, wherein a command for setting to be transmitted is transmitted. Personal authentication executed by a transaction system having a contractor authentication function and a subsystem for displaying recovery information for re-login when the authentication function is locked due to a login failure to the transaction system. A function recovery method,
The transaction system includes, for each contractor, authentication information for authenticating the user, a notification destination for notifying the contractor of information, presence / absence of authentication function lock, presence / absence of recovery authority, and recovery information And a contractor information storage unit for storing contractor information including at least address information specifying a storage area of a recovery information file for displaying,
When the transaction system fails to log in to meet a predetermined condition, the contractor information storage unit has a contractor information authentication function lock for the corresponding contractor information, has a recovery authority, and has new address information. A recovery notification transmission step of storing and transmitting a recovery notification including the address information to a notification destination stored in the contractor information;
The transaction system stores a recovery information file in which recovery authority information for identifying the recovery authority granted to the contractor and the contractor is embedded in the storage area specified by the address information in the subsystem. A recovery information requesting step for requesting storage;
The transaction system receives a recovery request from the terminal operated by the contractor to receive a recovery request for unlocking the authentication function given the recovery authority information; and
The transaction system identifies the contractor from the recovery authority information given to the recovery request, refers to the contractor information of the corresponding contractor in the contractor information storage unit, and has recovery authority, And when the recovery authority identified from the recovery authority information is compared with the predetermined contractor information to confirm that it matches the predetermined condition, a recovery authority determination step for determining that it is a legitimate recovery request;
When the transaction system determines that the recovery authority determination step is a valid recovery request, a re-login screen display step for displaying an authentication information input screen for re-login on the terminal;
When the transaction system receives the authentication information input on the input screen from the terminal, the authentication information is collated with the authentication information included in the contractor information of the corresponding contractor in the contractor information storage unit. If they match, the authentication function recovery step for updating the authentication function lock included in the contractor information without using the recovery authority is provided.
The recovery method is characterized in that the subsystem sets the recovery information file stored in the subsystem to be inaccessible even if the address information is specified when a predetermined period has elapsed.

Images