JP6407232B2 - Login authentication system, service provider and authentication server in login authentication system, service provider in login authentication system, authentication server, computer and login authentication method and program for portable terminal - Google Patents

Description

  The present invention relates to a login authentication system, a service provider and authentication server in the login authentication system, a service provider in the login authentication system, an authentication server, a computer, and a login authentication method and program for a portable terminal.

  Conventionally, when a user logs in to a highly confidential service site, a system in which a user inputs an ID and a password (PW) to log in is widely known. In addition, when a user is stolen ID and PW, a third party can impersonate the user and log in to a highly confidential service site.

  In order to cope with such a problem, a technique of performing login using biometric authentication information is also well known (see, for example, Patent Document 1).

JP 2013-174955 A

  However, the method of using biometric authentication information requires a special device for reading biometric authentication information. Therefore, for a user who does not have such a special device, a login authentication method using such biometric authentication information is inconvenient.

  The present invention has been made in view of the above circumstances, and the first terminal and the second terminal use a public key cryptosystem to perform login authentication to a service provided by a service provider together with an authentication server. The login authentication system that allows a user to log in to a highly confidential service safely without requiring input of ID and PW, service provider and authentication server in the login authentication system, service provider in the login authentication system, An object of the present invention is to provide a login authentication method and program for an authentication server, a computer, and a portable terminal.

  According to the first invention, in the login authentication system having a service provider and an authentication server, the service provider receives login request from the first user terminal, and receives the login request. In response, an identification code transmitting means for transmitting an identification code to the first user terminal, a first code receiving means for receiving the identification code signed by the first user terminal, and the received When the signature of the first user terminal of the identification code signed by the first user terminal is confirmed, the service is sent to the authentication server with the identification code and the public key of the first user terminal. Approval request sender for sending an approval request including first data signed by the provider to the authentication server The authentication server receives the approval request, and when the signature of the service provider included in the first data included in the approval request is confirmed, the authentication data is included in the first data and the identification code. A first data transmitting means for signing the authentication server, and transmitting the first data and the identification code signed by the authentication server to a second user terminal; and the first data signed by the authentication server. In response to transmission of one data and the identification code, the second user 0 terminal sends the identification code signed by the second user terminal, the public key of the second user terminal, and the second user terminal. Second data receiving means for receiving second data including the terminal information of the user terminal, and the signature of the second user terminal and the terminal information included in the received second data The authentication result information indicating the result of the approval request signed by the authentication server, and the identification code with the signature of the second user terminal signed by the authentication server. Third data transmitting means for transmitting the third data to the service provider, wherein the service provider receives the third data from the authentication server, and the received third data When the signatures of the authentication server and the second user terminal of the data are confirmed, the public key of the first user terminal signed by the authentication server and the first signature signed by the service provider Screen information transmitting means for transmitting the public key of the user terminal to the first user terminal together with the screen information after the login request. Login authentication system, it is.

  According to a second invention, in the first invention, an initial registration receiving means for receiving an initial registration request from the first user terminal, and when receiving the initial registration request, the first user terminal A login authentication system further comprising an association processing means for performing a process of associating a public key, a public key of the second user terminal, a public key of the service provider, a public key of the authentication server, and identification information of the user; is there.

  According to a third invention, in the second invention, when the service provider receives an initial registration request from the first user terminal, the association processing means is the initial stage in which the authentication server is signed. A first initial registration data transmitting unit configured to transmit first initial registration data including an identification code and an initial identification code with a signature of the service provider to the first user terminal; In response to the transmission of the first initial registration data, the initial identification code and the cipher with the signature of the first user terminal signed by the second user terminal from the second user terminal Second initial registration data including the converted user identification information, the public key of the first user terminal, the public key of the second user terminal, and the terminal information of the second user terminal First initial registration data receiving means for receiving the initial identification data with the signature of the first user terminal signed by the second user terminal included in the second initial registration data When the signatures of the first user terminal and the second user terminal of the code are confirmed and the initial identification code is confirmed, the second user terminal and the second user terminal signed by the authentication server The initial identification code with the signature of one user terminal, the encrypted identification information of the user, the public key of the first user terminal, and the public key of the second user terminal Second initial registration data transmitting means for transmitting initial registration data to the service provider, wherein the service provider receives the third initial registration data from the authentication server. When the period registration data receiving means and the signature of the first user terminal, the second user terminal and the authentication server and the user identification information included in the received third initial registration data are confirmed, A login authentication system further comprising initial registration completion screen information transmitting means for transmitting to the first user terminal together with initial registration completion screen information after an initial registration request.

  According to the fourth invention, login request receiving means for receiving a login request from a first user terminal, and identification code transmission for transmitting an identification code to the first user terminal in response to the received login request. Means, first code receiving means for receiving the identification code signed by the first user terminal, and the first user of the received identification code signed by the first user terminal. When the signature of the terminal is confirmed, an approval request is transmitted to the authentication server including an approval request including the first data signed by the service provider in the identification code and the public key of the first user terminal. And a result for the approval request signed by the authentication server from the authentication server in response to the transmission of the first data Second data reception for receiving second data including approval result information to be displayed, the identification code with the signature of the second user terminal signed with the authentication server, and the public key of the first user terminal Means, and when the signatures of the authentication server and the second user terminal of the received second data are confirmed, the public key of the first user terminal signed by the authentication server and the service provider A service provider in a login authentication system comprising: screen information transmitting means for transmitting the public key of the first user terminal signed with the first user terminal together with the screen information after the login request to the first user terminal. .

  According to the fifth invention, when the approval request is received from the service provider and the signature of the service provider included in the first data included in the approval request is confirmed, the first data and the identification code are included in the first data and the identification code. A first data transmitting means for signing an authentication server and transmitting the first data signed by the authentication server and the identification code to a second user terminal; and the first data signed by the authentication server In response to the data and the identification code, the identification code of the second user terminal signed by the second user terminal, the public key of the second user terminal, and the second user terminal A second data receiving means for receiving second data including terminal information, a signature of the second user terminal and the terminal information included in the received second data; The authentication result information indicating the result of the approval request signed by the authentication server, and the identification code with the signature of the second user terminal signed by the authentication server. An authentication server comprising third data transmitting means for transmitting third data to the service provider;

According to the sixth invention, the first user terminal, and a second user terminal, using said second user terminal, the login authentication system for login of the first user terminal In the login authentication method in the second user terminal for login processing, the first data and the identification code signed by the authentication server are received, and the first data is the disclosure of the identification code and the first user terminal. When the signature of the service provider is signed to the key, and when the signature of the authentication server and the service provider of the received first data and the identification code of the received authentication server is confirmed, A first including the identification code signed by the second user terminal, a public key of the second user terminal, and terminal information of the second user terminal; Including transmitting over data to the authentication server, a login authentication method.

According to the seventh invention, the first user terminal, and a second user terminal, using said second user terminal, the login authentication system for login of the first user terminal In the login authentication method in the first user terminal for login processing, an initial registration request is transmitted to a service provider, and an initial identification code and a service provider signed by an authentication server in response to the transmission of the initial registration request The first initial registration data including the first initial registration data including the initial identification code to which the signature is attached is received from the service provider, and the authentication server and the service of the received first initial registration data are received. When the signature of the provider is confirmed, a QR code that can be read by the second user terminal is displayed. The QR code includes the initial identification code signed by the first user terminal and the public key of the first user terminal, and the second user terminal is displayed on the first user terminal. When the signature of the first user terminal is confirmed from the QR code, the initial identification code attached with the signature of the first user terminal signed by the second user terminal is encrypted. Initial registration data including identification information of the user, the public key of the first user terminal, the public key of the second user terminal, and the terminal information of the second user terminal is transmitted to the authentication server, and the QR After displaying the code, the public key of the first user terminal signed by the authentication server from the service provider and the public key of the first user terminal signed by the service provider are registered. Received with the screen information after the in-request and received with the screen information after the login request The public key of the first user terminal signed with the authentication server and the first signed with the service provider When the authentication server and the service provider signature of the public key of one user terminal are confirmed, after displaying the initial registration completion screen information after the login request, after displaying the initial registration completion screen information, Sending a login request to a service provider, receiving an identification code from the service provider in response to the transmitted login request, signing the first user terminal to the received identification code, and Sending the identification code signed by the user terminal to the service provider; After transmitting the identification code signed by the first user terminal to the service provider, an approval request sent by the service provider to the authentication server is allowed, and the signature of the first user terminal, the first When the signature of the second user terminal and the signature of the authentication server and the identification code are confirmed , the public key of the first user terminal signed by the service server and the signature of the service provider are signed. Receiving the public key of the first user terminal together with the screen information after the login request;
Login authentication method.

  According to the present invention, the first terminal and the second terminal use the public key cryptosystem to perform login authentication to the service provided by the service provider together with the authentication server, so that the user can input the ID and PW. Therefore, it is possible to provide a login authentication system capable of safely logging in to a highly confidential service without the need for a password.

It is a figure for demonstrating the login authentication system for performing login authentication of embodiment. It is a figure which shows the structure of computer C1. It is a figure which shows the information which each apparatus has before the initial registration process of a login authentication process. It is a figure which shows the information which each apparatus has after the initial registration process of a login authentication process. It is a figure which shows an example of customer information. It is a figure which shows the timing chart of the initial registration process of a login authentication system. It is a figure which shows the timing chart of the login authentication process of a login authentication system. It is a flowchart for demonstrating the initial registration process of service provider SP. 5 is a flowchart for explaining an initial registration process of the authentication server A. It is a flowchart for demonstrating the initial registration process of the computer C1. It is a flowchart for demonstrating the initial registration process of the user terminal C2. It is a figure which shows QR Code (trademark) C displayed on the display of computer C1. It is a flowchart for demonstrating the login process of service provider SP. 4 is a flowchart for explaining a login process of an authentication server A. It is a flowchart for demonstrating the login process of the computer C1. It is a flowchart for demonstrating the login process of the user terminal C2. It is a figure for demonstrating the conventional login method and the login method of embodiment from a security viewpoint.

Hereinafter, a login authentication system according to an embodiment of the present invention will be described with reference to the drawings. In the embodiment, a login authentication system for logging in to a highly confidential service provided by a financial institution such as a securities company will be described. However, if the login requires a service, the login authentication method of the embodiment is applied. can do.
1 Configuration of Login Authentication System FIG. 1 is a diagram for explaining a login authentication system for performing login authentication according to an embodiment.

  As shown in the figure, connected to a network 1 such as the Internet are a user computer C1, a user portable terminal C2, a service provider SP, and authentication servers A-1 to A-4 of an authentication server group AC. In addition, when it is not necessary to distinguish the authentication servers A-1 to A-4, they are abbreviated as “authentication server A”.

  The computer C1 includes a mobile computer, a laptop computer, a tablet terminal, and the like in addition to a general desktop computer. On the computer C1, for example, the login authentication method of the embodiment is executed by a login authentication program for the computer C1 that is downloaded from the service provider SP and described in JavaScript (registered trademark) that operates on a web browser.

  The mobile terminal C2 includes a smartphone, a feature phone, and the like, and is a mobile terminal that operates on an OS such as Android (registered trademark) or iOS (registered trademark). On the portable terminal C2, for example, the login authentication method of the embodiment is executed by a login authentication program for the portable terminal C2 downloaded from an application program download server (not shown).

  The service provider SP has a service provider login authentication program for performing the login process of the embodiment in addition to a service providing program for providing a service providing screen that requires login authentication such as a stock transaction screen.

  The authentication server group AC includes authentication servers A-1 to A-4. Each of the authentication servers A-1 to A-4 is connected to each other and also connected to the Internet 1. Each of the authentication servers A-1 to A-4 includes a storage device that stores the user's computer C1, the mobile terminal C2, the public key of the service provider SP, the terminal information of the mobile terminal C2, and the like. The data in the storage devices of the respective authentication servers A-1 to A-4 is kept the same by the block chain technology. In the embodiment, the authentication server A performs a login authentication process in cooperation with the computer C1, the portable terminal C2, and the service provider SP. Note that the number of authentication servers included in the authentication server group AC is not limited to four.

  The user computer C1, the portable terminal C2, the service provider SP, and the authentication servers A-1 to A-4 of the authentication server group AC have the same configuration as a general information processing apparatus. The information processing apparatus includes a memory, a CPU, a communication interface, a storage device, and the like, and the login authentication process according to the embodiment is realized by the CPU executing a program stored in the storage device of each device.

  That is, a login authentication program for the computer C1 is stored in the storage device of the computer C1, a login authentication program for the mobile terminal C2 is stored in the storage device of the mobile terminal C2, and a storage device of the service provider SP is stored in the storage device of the service provider SP. The login authentication program for the service provider SP is stored, and the login authentication program for the authentication server A is stored in the authentication server A that performs login authentication processing together with the service provider SP and the like.

  As an example, FIG. 2 shows a configuration of the computer C1.

  As shown in the figure, in the computer C1, a CPU 12, a communication unit 13, a memory 14, an input unit 15, a storage device 16, and a display unit 17 are connected to a bus 11.

  The CPU 12 cooperates with the login authentication program 24 according to the embodiment of the present invention stored in the storage device 16 to perform the login authentication processing according to the present embodiment and also controls the entire computer C1. .

  The communication unit 13 controls communication with external devices such as the authentication server A and the service provider SP via the network 1.

  The memory 14 is used as a work area required when executing the login authentication program 24.

  The input unit 15 is an interface for inputting data and the like required when performing login authentication processing, and is, for example, a keyboard, a mouse, a touch panel, or the like.

The storage device 16 is for storing programs and data required for login authentication processing, and is a large-capacity storage device such as a hard disk drive (HDD), an optical disk drive, a DVD, or an MO. The storage device 16 stores an OS (Operating System) 21, a key information database 22, a database 23, and a login authentication program 24.
The display unit 17 is a display for displaying information necessary for processing by the login authentication program according to the present embodiment. For example, as shown in FIG. 12, the display unit 17 is used for initial registration required for login authentication. The QR code is displayed.

  The OS 21 is a program for realizing basic functions of the computer C1.

  The key information database 22 stores the key pair (secret key, public key) of the computer C1 issued by the initial registration process of the login authentication program 24.

  The database 23 stores data related to the login authentication process of the embodiment, user-related information, and the like.

  The login authentication program 24 is an application program that runs on the OS 21 and realizes login authentication processing according to the embodiment in cooperation with the CPU 12. The login authentication program 24 is a computer shown in FIGS. 6, 7, and 10. The process of the flowchart of C1 is implement | achieved.

  The login authentication program stored in the storage device of the portable terminal C2 is the processing of the flowchart of the portable terminal C2 shown in FIGS. 6, 7 and 11, and the login authentication program stored in the storage device of the service provider SP is FIG. 7 and FIG. 8, the login authentication program stored in the storage device of the authentication server A realizes the processing of the service provider SP shown in FIG. 6, FIG. 7 and FIG. .

  FIG. 3 is a diagram illustrating information held by each device before the initial registration process of the login authentication process. 3 and 4 do not show the secret key held by each device.

  As shown in the figure, before the initial registration process, the computer C1 and the portable terminal C2 hold the public key of the authentication server A and the public key of the service provider SP, and the authentication server A holds the public key of the service provider SP. The service provider SP holds the public key of the authentication server A.

  FIG. 4 is a diagram illustrating information held by each device after the initial registration process of the login authentication process.

  As shown in the figure, after the initial registration process, the computer C1 and the portable terminal C2 have the public key of the authentication server A and the public key of the service provider SP, and the authentication server A has the public key of the service provider SP and the computer C1. , The public key of the portable terminal C2, and the terminal information of the portable terminal C2, and the service provider SP has the public key of the authentication server A, the public key of the computer C1, the public key of the portable terminal C2, and customer information. ing.

  Here, the key pair (secret key and public key) of the computer C1 is issued by the browser during the initial registration process, and the key pair of the portable terminal C2 is issued by the login authentication program downloaded to the portable terminal C2. And

Customer information is stored in a customer DB (database) and depends on the service provided by the service provider. For example, customer information includes information such as user ID and PW for each customer as shown in FIG. Is stored.
2 Operation of Login Authentication System Next, an initial registration process of the login authentication system according to the embodiment will be described with reference to timing charts of FIGS. 6 and 7 and flowcharts of FIGS.
2-1 Initial Registration Process of Login Authentication Process When performing the login authentication method of the embodiment, it is necessary to perform initial registration. The computer C1 logs in to the service provided by the service provider SP using the ID and PW, and performs an initial registration process.

  FIG. 6 is a timing chart of the initial registration process of the login authentication system. FIG. 8 is a flowchart for explaining the initial registration process of the service provider SP, FIG. 9 is a flowchart for explaining the initial registration process of the authentication server A, and FIG. 10 is a flowchart for explaining the initial registration process of the computer C1. FIG. 11 is a flowchart for explaining the initial registration process of the user terminal C2.

  When performing the initial registration, the computer C1 transmits an initial registration request to the service provider SP (T1 in FIG. 6 and S41 in FIG. 10). The service provider SP determines whether an initial registration request has been received from the computer C1 (S1 in FIG. 8). If the initial registration request is received, the service provider SP generates a one-time code (OTC) for initial registration and generates the generated OTC. The service provider SP is signed (S2 in FIG. 8). OTC is, for example, a randomly determined number. Next, the service provider SP transmits the OTC signed with the service provider SP (“SP signature (OTC)”) to the authentication server A (T2 in FIG. 6 and S3 in FIG. 8). The authentication server A and the service provider SP share the OTC by T1 and T2 in FIG.

  The authentication server A determines whether or not the initial registration OTC signed by the service provider SP is received (S21 in FIG. 9), and when the initial registration OTC signed by the service provider SP is received, The signature of the service provider SP is confirmed (S22 in FIG. 9).

  When the signature of the service provider SP is confirmed, the authentication server A transmits the first initial registration data to the service provider SP (T3 in FIG. 6 and S23 in FIG. 9). Here, the first initial registration data is the OTC and SP book title (OTC) (“A signature ((OTC) + SP signature (OTC))”) signed by the authentication server A.

  On the other hand, when the signature of the service provider SP is not confirmed in the authentication server A, an initial registration failure process is performed (S24 in FIG. 9).

  The service provider SP determines whether or not the first initial registration data has been received from the authentication server A (S4 in FIG. 8). When the first initial registration data is received, the service provider SP confirms the signature of the authentication server A and The OTC is confirmed (S5 in FIG. 8).

  In S5, when the signature and OTC of the authentication server A are confirmed, the first initial registration data is transmitted to the computer C1 (T4 in FIG. 6 and S6 in FIG. 8). When the service provider SP does not confirm the signature and OTC of the authentication server A, an initial registration failure process is performed (S11 in FIG. 8).

  The computer C1 determines whether or not the first initial registration data has been received from the service provider SP (S42 in FIG. 10). When the first initial registration data is received, the signature of the authentication server A and the service provider SP are received. Is confirmed (S43 in FIG. 10). When the signature of the authentication server A and the signature of the service provider SP are confirmed, a new key pair (the private key and the public key of the computer C1) is issued in the browser of the computer C1 (S44 in FIG. 10). In the computer C1, when the signature and OTC of the authentication server A are not confirmed, an initial registration failure process is performed (S46 in FIG. 10).

  Next, the computer C1 creates a QR code including the OTC signed by C1 and the public key of the computer C1 (“C1 signature (OTC) + C1 public key”) (S45 in FIG. 10). The QR code thus displayed is displayed on the display (S46 in FIG. 10). FIG. 12 is a diagram showing the QR code C displayed on the display of the computer C1. The figure shows an example in which a message “Please read the QR code for initial registration with a mobile terminal” is displayed together with the QR code C.

  The portable terminal C2 reads the QR code displayed on the display of the computer C1, and obtains the OTC signed by C1 and the public key of the computer C1 (“C1 signature (OTC) + C1 public key”) ( T5 in FIG. 6 and S61 in FIG. 11).

The portable terminal C2 confirms the signature of the computer C1 (S62 in FIG. 11), and when the signature of the computer C1 is confirmed, transmits the second initial registration data to the authentication server A (T6 in FIG. 6, FIG. 11). S63). Here, the second initial registration data includes the following data.
-OTC with the signature of the computer C1 signed with the portable terminal C2
・ Encrypted user information (ID / PW)
-Public key of computer C1-public key of portable terminal C2-terminal information of portable terminal C2
Second initial registration data =
C2 signature (C1 signature (OTC)) + user information (ID / PW) encrypted for service provider SP + C1 public key + C2 public key + C2 terminal information. Here, the terminal information of the mobile terminal C2 is, for example, the Mac address, etc. When the signature of the computer C1 is not confirmed in the user's portable terminal C2, an initial registration failure process is performed (S64 in FIG. 11).

  After transmitting the first initial registration data to the computer C1, the authentication server A determines whether or not the second initial registration data is received (S25 in FIG. 9), and receives the second initial registration data. In this case, the signature and OTC of the computer C1 and portable terminal C2 of the second initial registration data are confirmed (S26 in FIG. 9). When the authentication server A does not confirm the signature and OTC of the computer C1 and the portable terminal C2, the initial registration failure process is performed (S24 in FIG. 9).

  If the signature and OTC of the computer C1 and the portable terminal C2 of the second initial registration data are confirmed, the terminal information of the portable terminal C2 is stored in the storage device (S27 in FIG. 9), and the service provider SP stores the third information Initial registration data is transmitted (T7 in FIG. 6, S28 in FIG. 9), and the initial registration process in the authentication server A is terminated.

Here, the third initial registration data includes the following information.
-OTC with the signature of the computer C1 signed by the authentication server A and signed by the portable terminal C2
・ Encrypted user information (ID / PW)
The public key of the computer C1, the public key of the portable terminal C2, the public key of the computer C1 signed by the authentication server A.
Third initial registration data =
A signature (C2 signature (C1 signature (OTC))) + User information encrypted for SP (ID / PW) + C1 public key + C2 public key + A signature (C1 public key )
It is.

  After transmitting the first initial registration data to the computer C1, the service provider SP determines whether or not the third initial registration data is received from the authentication server A (S7 in FIG. 8), and the third initial registration. When the data is received, authentication server A, computer C1, portable terminal C2, OTC, and user information (ID / PW) are confirmed (S8 in FIG. 8).

  In S8, when the signature of the authentication server A, the computer C1, and the portable terminal C2, the OTC and the user information (ID / PW) are confirmed, the login authentication initial registration completion page is displayed as the authentication server A signature. C1's public key ("A signature (C1 public key)") and the public key of the computer C1 signed by the service provider SP ("SP signature (C1 public key)") are transmitted to the computer C1. (T8 in FIG. 6, S9 in FIG. 8), the initial registration process in the service provider SP is terminated (S10 in FIG. 8). When the service provider SP does not confirm the signature, OTC, and user information (ID / PW) of the authentication server A, the computer C1, and the portable terminal C2, initial registration failure processing is performed (S11 in FIG. 8).

After displaying the QR code in S47, the computer C1 determines whether or not a login authentication initial registration completion page has been received from the service provider SP (S48 in FIG. 10). The signature of the service provider SP is confirmed (S49 in FIG. 10). When the signatures of the authentication server A and the service provider SP are confirmed, an initial registration completion page is displayed (S50 in FIG. 10), and the initial registration process is completed. (S52 in FIG. 10). In the computer C1, when the authentication server A and the service provider SP are not confirmed, an initial registration failure process is performed (S46 in FIG. 10).
2-2 Login Authentication Processing Next, normal login authentication processing after initial registration of the login authentication system will be described.

  FIG. 7 is a diagram illustrating a timing chart of login authentication processing of the login authentication system. FIG. 13 is a flowchart for explaining the login process of the service provider SP, FIG. 14 is a flowchart for explaining the login process of the authentication server A, FIG. 15 is a flowchart for explaining the login process of the computer C1, and FIG. It is a flowchart for demonstrating the login process of the user terminal C2.

  When performing the login process, the computer C1 transmits a login request to the service provider SP (T21 in FIG. 7 and S141 in FIG. 15). The service provider SP determines whether or not a login request has been received from the computer C1 (S101 in FIG. 13). When the login request is received, the service provider SP generates an OTC for login and transmits the generated OTC to the computer C1. (T22 in FIG. 7, S102 in FIG. 13).

  After transmitting the login request to the service provider SP, the computer C1 determines whether an OTC is received from the service provider SP (S142 in FIG. 15). When the OTC is received, the received OTC is signed by the computer C1 (“C1 signature (OTC)”) and transmitted to the service provider SP (T23 in FIG. 7 and S143 in FIG. 15).

  The service provider SP determines whether or not the OTC signed by the computer C1 is received from the computer C1 (S103 in FIG. 13). When the OTC signed by the computer C1 is received, the service provider SP confirms the signature of the computer C1 (S104 in FIG. 13). If the signature of the computer C1 is not confirmed in the service provider SP, a login failure process is performed (S106 in FIG. 13).

When the signature of the computer C1 is confirmed, the service provider SP transmits an approval request including the first data to the authentication server A (T24 in FIG. 7 and S105 in FIG. 13). Here, the first data includes the following data.
The OTC signed by the service provider SP and the public key of the computer C1, ie
First data =
Service provider SP signature (OTC + public key of computer C1)
The authentication server A determines whether or not an approval request including the first data has been received from the service provider SP (S121 in FIG. 14), and when receiving the approval request including the first data, confirms the signature of the service provider SP. (S122 in FIG. 14).

  When the signature of the service provider SP is confirmed, the first server and the OTC are signed by the authentication server A (“A signature ((OTC) + first data)”) and transmitted to the portable terminal C2 (FIG. 6 T25, S123 in FIG. 14).

A's signature ((OTC) + first data) =
A's signature ((OTC) + SP's signature (OTC + C1's public key)
On the other hand, if the signature of the service provider SP is not confirmed in the authentication server A, a login failure process is performed (S129 in FIG. 14).

  When the mobile terminal C2 receives the OTC and the first data signed by the authentication server A (S161 in FIG. 16) and receives the OTC and the first data signed by the authentication server A, The signatures of the authentication server A and service provider SP are confirmed (S162 in FIG. 16).

When the signatures of the authentication server A and the service provider SP are confirmed, the second data is transmitted to the authentication server A (T26 in FIG. 6 and S163 in FIG. 16). Here, the second data includes the following data.
・ OTC signed by mobile terminal C2
-Public key of portable terminal C2-terminal information of portable terminal C
Second data = Signature of portable terminal C (OTC) + Public key of posting terminal C2
+ Terminal information of the mobile terminal C2.

  When the signatures of the authentication server A and the service provider SP are not confirmed in the portable terminal C, a login process failure process is performed (S164 in FIG. 16).

  In S123, the authentication server A determines whether the second data is received from the portable terminal C2 after transmitting the first data and the OTC signed by the authentication server A (S124 in FIG. 14). Is received, the signature and the terminal information of the portable terminal C2 are confirmed (S125 in FIG. 14). The signature of the portable terminal C2 is confirmed using the terminal information of the portable terminal stored in the storage device in the initial registration process.

  In S125, if the signature and terminal information of the portable terminal C2 are confirmed, “approval request = OK” is set. If the signature and terminal information of the portable terminal C2 are not confirmed, the third data is set as “approval request = NG”. The data is transmitted to the service provider SP (T28 in FIG. 7, S128 in FIG. 14), and the processing in the authentication server A ends.

Here, the third data includes the following data.
-Result of approval request signed by authentication server A (OK / NG)
-OTC signed by the mobile terminal C2 signed by the authentication server A
The public key of the mobile terminal C2 signed by the authentication server A, ie
Third data =
A signature (approval request result (OK / NG) + A signature (C2 signature (OTC)) + A signature (C1 public key)
After transmitting the approval request in S105, the service provider SP determines whether or not the third data is received from the authentication server A (S107 in FIG. 13), and if the third data is received from the authentication server A, the authentication server A, The signature and OTC of the computer C1 and the portable terminal C2 are confirmed (S108 in FIG. 13). If the authentication server A, the computer C1, and the portable terminal C2 have been signed and checked for OTC, it is checked whether “approval request = OK” (S109 in FIG. 13).

  If the confirmation is not made in S108 and S109, login failure processing is performed (S106 in FIG. 13).

  In S109, if “approval request = OK”, the public key of the computer C1 signed by the authentication server A and the public key of the computer C1 signed by the service provider SP are transmitted to the computer C1 together with the login completion page. (T28 in FIG. 7, S109 in FIG. 13), and the login process in the service provider SP is completed (S110 in FIG. 13).

  After transmitting the OTC signed by the computer C1 in S143 to the service provider SP (S143 in FIG. 15), the computer C1 confirms whether or not a login completion page has been received from the service provider SP (S144 in FIG. 15).

  When the login completion page is received, the signatures of the authentication server A and the service provider SP are confirmed (S145 in FIG. 15). When the signatures of the authentication server A and the service provider SP are confirmed, the login completion page is displayed ( 15 (S146 in FIG. 15), the login authentication process is terminated (S147 in FIG. 15).

If the signatures of the authentication server A and the service provider SP are not confirmed in S145, login request failure processing is performed (S148 in FIG. 15).
3 Effect Therefore, according to the login authentication system of the embodiment, the first terminal (computer C1) and the second terminal (portable terminal C2) use the public key cryptosystem and the service provider provides with the authentication server. By performing login authentication to the service, the user can safely log in to a highly confidential service without requiring input of ID and PW.

  According to the login authentication system of the embodiment, information necessary for login (the secret key of the computer C1, the secret key of the portable terminal C2) is separated from the login authentication information (user ID / PW) stored in the service provider SP. Yes.

  Therefore, even if the login authentication information (user ID / PW) stored in the service provider SP is hacked, information (public key of the computer C1 and public key of the portable terminal C2) necessary for login is not leaked.

  That is, according to the login authentication system of the embodiment, the login authentication part and the content providing part are separated using the block chain technology, and the security of the user cannot be leaked unless both are hacked at the same time. High service can be provided.

  In the separated login authentication function, the authentication servers A-1 to A-4 of the authentication server group AC are constructed by the block chain technology. This prevents falsification of the authentication server key pair (public key, secret key), service provider SP public key, computer C1 public key, portable terminal C2 public key, and terminal information stored in the authentication server A. Can do.

  Further, since the authentication servers A-1 to A-4 of the authentication server group AC are constructed by the block chain technology, a failure occurs in a specific authentication server A among the authentication servers A-1 to A-4. However, the redundancy of the service can be ensured by another authentication server A. Data for authentication of the authentication servers A-1 to A-4 is also constructed by the block chain technology and is shared among the authentication servers A-1 to A-4.

  In the central management type login authentication system, in order to be secure and ensure availability, the construction cost of the system increases. On the other hand, according to the distributed authentication system without the central administrator using the block chain technology like the login authentication system of the embodiment, it is possible to provide a login authentication system that is available and low in cost.

The login authentication system of the embodiment has the following features.
-Three-body authentication Since the computer C1, the portable terminal C2, the service provider SP, and the authentication server A mutually authenticate, it is not possible to perform fraud by hacking the individual system.
-Zero downtime By having multiple companies become certification authorities (authentication server A), the certification service can be continued even if a specific certification authority fails.
・ Absence of central administrator By managing the authentication function and data with a distributed ledger, it is possible to detect and prevent fraudulent activities such as data falsification (excluding internal fraud of the central CA).
-Mutual assistance The service provider SP can also serve as the authentication server A. Normally, if the service provider SP also serves as the authentication server A, self-audit is performed, and thus both cannot be performed. However, when there are a plurality of service providers SP and authentication servers A, the authentication server A is used for service providers SP other than itself. As a function. As a result, data can be shared between the authentication service providing side (authentication server A) and the receiving side (service provider SP).

FIG. 17 is a diagram for explaining the conventional login method and the login method of the embodiment from the viewpoint of security.
-Leakage of ID and PW In the conventional login method using ID and PW, if an ID and PW leak occur, anyone who acquires the ID and PW can access the customer's content.

In the login method of the embodiment, the keys (public key and private key) of the computer C1 and the portable terminal C2 are used, and access to the customer's private key is permitted in the embodiment by biometric authentication. So secure.
-Server hacking In the conventional login method, if hacking occurs on the server and customer authentication information (ID and PW) is stolen, the same damage as ID and PW leakage occurs.

In the login method according to the embodiment, the secret information of the customer necessary for the login authentication is not held on the server side, so that the authentication information does not leak even if the server is hacked.
-Site Impersonation With the conventional login method, when a customer connects to an impersonation site and inputs an ID and PW, the ID and PW may be stolen.

  In the login method of the embodiment, impersonation becomes impossible by performing communication with a signature.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

  The method described in the embodiment is a program that can be executed by a computer (computer), for example, a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, MO, etc.), It can be stored in a recording medium such as a semiconductor memory (ROM, RAM, flash memory, etc.), or transmitted and distributed via a communication medium. The program stored on the medium side includes a setting program that configures software means (including not only the execution program but also a table and data structure) in the computer. A computer that implements this apparatus reads a program recorded on a recording medium, constructs software means by a setting program as the case may be, and executes the above-described processing by controlling the operation by this software means. The recording medium referred to in this specification is not limited to distribution, but includes a storage medium such as a magnetic disk or a semiconductor memory provided in a computer or a device connected via a network.

  DESCRIPTION OF SYMBOLS 1 ... Network, C1 ... Computer, C2 ... Portable terminal, AC ... Authentication server group, A, A-1 to A-4 ... Authentication server, SP ... Service provider.

Claims (28)

In a login authentication system having a service provider and an authentication server,
The service provider
Login request receiving means for receiving a login request from the first user terminal;
An identification code transmitting means for transmitting an identification code to the first user terminal in response to the received login request;
First code receiving means for receiving the identification code signed by the first user terminal;
When the signature of the first user terminal of the received identification code signed by the first user terminal is confirmed, the identification code and the public key of the first user terminal are sent to the authentication server. And an approval request transmitting means for transmitting an approval request including the first data signed by the service provider to the authentication server,
The authentication server is
When the approval request is received, and the signature of the service provider included in the first data included in the approval request is confirmed, the authentication server is signed to the first data and the identification code, and the authentication is performed. First data transmitting means for transmitting the first data and the identification code signed by a server to a second user terminal;
In response to the transmission of the first data and the identification code signed by the authentication server, the identification code signed by the second user terminal is sent from the second user terminal, Second data receiving means for receiving second data including a public key of the user terminal and terminal information of the second user terminal;
Approval result information indicating a result of the approval request signed by the authentication server when the signature of the second user terminal and the terminal information included in the received second data are confirmed, and the authentication server And third data transmitting means for transmitting the third data including the identification code with the signature of the second user terminal signed with the service provider to the service provider,
The service provider
Third data receiving means for receiving the third data from the authentication server;
When the signatures of the authentication server and the second user terminal of the received third data are confirmed, the public key of the first user terminal signed by the authentication server and the signature of the service provider are And a screen information transmitting means for transmitting the public key of the first user terminal to the first user terminal together with the screen information after the login request. Initial registration receiving means for receiving an initial registration request from the first user terminal;
When the initial registration request is received, the public key of the first user terminal, the public key of the second user terminal, the public key of the service provider, the public key of the authentication server, and the user identification information are mutually The login authentication system according to claim 1, further comprising association processing means for performing association processing. The association processing means includes
The service provider
When an initial registration request is received from the first user terminal, first initial registration data including an initial identification code signed by the authentication server and an initial identification code signed by the service provider Comprising first initial registration data transmitting means for transmitting to the first user terminal;
The authentication server is
In response to the transmission of the first initial registration data, the initial identification code and the cipher with the signature of the first user terminal signed by the second user terminal from the second user terminal Receiving first initial registration data including the converted user identification information, the public key of the first user terminal, the public key of the second user terminal, and the terminal information of the second user terminal Initial registration data receiving means,
The first user terminal and the second user terminal of the initial identification code with the signature of the first user terminal signed by the second user terminal included in the second initial registration data When the signature of the user terminal is confirmed and the initial identification code is confirmed, the initial identification with the signature of the second user terminal signed by the authentication server and the signature of the first user terminal A second initial transmission for transmitting to the service provider third initial registration data including a code, the encrypted user identification information, the public key of the first user terminal, and the public key of the second user terminal Registration data transmission means,
The service provider
Second initial registration data receiving means for receiving the third initial registration data from the authentication server;
If the signature and user identification information of the first user terminal, the second user terminal and the authentication server included in the received third initial registration data are confirmed, initial registration after the initial registration request Initial registration completion screen information transmitting means for transmitting to the first user terminal together with completion screen information;
The login authentication system according to claim 2. The service provider
The login authentication system according to claim 1, further comprising a storage unit that stores the public key of the first user terminal, the public key of the second user terminal, the public key of the authentication server, and user identification information in association with each other. .   The login authentication system according to claim 4, wherein user-related information related to a service provided by the service provider is further associated with identification information of the user.   The authentication server stores a public key of the first user terminal, a public key of the second user terminal, a public key of the service provider, and terminal information of the second user terminal stored in association with each other. The login authentication system according to claim 1, further comprising a unit.   The login authentication system according to claim 1, wherein the third data includes a public key of the first user terminal signed by the authentication server.   4. The login authentication system according to claim 3, wherein the third initial registration data includes a public key of the first user terminal signed by the authentication server. Login request receiving means for receiving a login request from the first user terminal;
An identification code transmitting means for transmitting an identification code to the first user terminal in response to the received login request;
First code receiving means for receiving the identification code signed by the first user terminal;
When the signature of the first user terminal of the received identification code signed by the first user terminal is confirmed, a service provider is provided for the identification code and the public key of the first user terminal. An approval request transmitting means for transmitting an approval request including the first data signed by the authentication server,
In response to the transmission of the first data, approval result information indicating a result for the approval request signed by the authentication server from the authentication server, and a signature of the second user terminal signed by the authentication server Second data receiving means for receiving second data including the attached identification code and the public key of the first user terminal;
When the signatures of the authentication server and the second user terminal of the received second data are confirmed, the public key of the first user terminal signed by the authentication server and the signature of the service provider are A service provider in a login authentication system, comprising: screen information transmission means for transmitting the public key of the first user terminal that has been made to the first user terminal together with screen information after the login request. When an initial registration request is received from the first user terminal, first initial registration data including an initial identification code signed by the authentication server and an initial identification code signed by the service provider First initial registration data transmitting means for transmitting to the first user terminal;
After the transmission of the first initial registration data, the second user terminal signed by the authentication server and the initial identification code signed by the first user terminal, encrypted user identification Second initial registration data receiving means for receiving second initial registration data including information, the public key of the first user terminal and the public key of the second user terminal from the authentication server;
If the signature of the first user terminal, the second user terminal and the authentication server and the identification information of the user included in the received second initial registration data are confirmed, the initial stage after the initial registration request The service provider according to claim 9, further comprising initial registration completion screen information transmitting means for transmitting to the first user terminal together with registration completion screen information.   The service provider according to claim 9, further comprising a storage unit that stores the public key of the first user terminal, the public key of the second user terminal, the public key of the authentication server, and user identification information in association with each other.   The service provider according to claim 11, wherein user related information related to a service provided by the service provider is further associated with identification information of the user. When the approval request is received from the service provider, and the signature of the service provider included in the first data included in the approval request is confirmed, the authentication server is signed to the first data and the identification code, and the authentication is performed. First data transmitting means for transmitting the first data and the identification code signed by a server to a second user terminal;
In response to the first data and the identification code signed by the authentication server, the identification code signed by the second user terminal and the second user terminal are sent from the second user terminal. Second data receiving means for receiving second data including the public key of the second terminal information and the terminal information of the second user terminal;
Approval result information indicating a result of the approval request signed by the authentication server when the signature of the second user terminal and the terminal information included in the received second data are confirmed, and the authentication server An authentication server comprising: third data transmission means for transmitting the third data including the identification code with the signature of the second user terminal signed with the service provider to the service provider. In response to the transmission of the first initial registration data including the initial identification code signed by the authentication server and the initial identification code signed by the service provider, the second user terminal sends a second The initial identification code with the signature of the first user terminal signed by the user terminal, the encrypted user identification information, the public key of the first user terminal, the second user terminal First initial registration data receiving means for receiving second initial registration data including a public key and terminal information of the second user terminal;
The first user terminal and the second user terminal of the initial identification code with the signature of the first user terminal signed by the second user terminal included in the second initial registration data When the signature of the user terminal is confirmed and the initial identification code is confirmed, the initial identification with the signature of the second user terminal signed by the authentication server and the signature of the first user terminal A first initial registration data including a code, the encrypted identification information of the user, a public key of the first user terminal, and a public key of the second user terminal; The authentication server according to claim 13, further comprising initial registration data transmission means.   The authentication server includes a storage unit in which a public key of the first user terminal, a public key of the second user terminal, a public key of the service provider, and terminal information of the second user terminal are stored in association with each other The authentication server according to claim 13, comprising:   The authentication server according to claim 13, wherein the third data includes a public key of a first user terminal signed by the authentication server.   The authentication server according to claim 14, wherein the third initial registration data includes a public key of the first user terminal signed by the authentication server. A first user terminal, and a second user terminal, using said second user terminal, the second user login process in login authentication system for login of the first user terminal In the login authentication method on the terminal
Receiving first data and an identification code signed by an authentication server, wherein the first data is data signed by a service provider on the identification code and the public key of the first user terminal;
The identification code signed by the second user terminal when the signatures of the authentication server and the service provider of the received first data and the identification code signed by the authentication server are confirmed. includes transmitting first data including a public key and the terminal information of the second user terminal of the second user terminal to the authentication server,
Login authentication method. When initial registration of the login authentication system is performed, the initial identification code signed by the first user terminal and the public key of the first user terminal are read,
When the signature of the first user terminal is confirmed, the initial identification code with the signature of the first user terminal on which the signature of the second user terminal is attached, the encrypted user's signature Transmitting initial registration data including identification information, a public key of the first user terminal, a public key of the second user terminal, and terminal information of the second user terminal;
The login authentication method according to claim 18.   The login authentication method according to claim 19, wherein the reading includes reading an initial identification code signed by the first user terminal and a QR code including the public key of the first user terminal. A first user terminal, and a second user terminal, using said second user terminal, the first user login process in login authentication system for login of the first user terminal In the login authentication method on the terminal,
Send an initial registration request to the service provider,
In response to the transmission of the initial registration request, first initial registration data including first initial registration data including an initial identification code signed by the authentication server and an initial identification code signed by the service provider. From the service provider,
When the signature of the authentication server and the service provider of the received first initial registration data is confirmed, a QR code that can be read by the second user terminal is displayed, and the QR code is Including the initial identification code signed by the first user terminal, the public key of the first user terminal, and the second user terminal from the QR code displayed on the first user terminal If the signature of one user terminal is confirmed, the initial identification code with the signature of the first user terminal signed by the second user terminal, the encrypted user identification information, Transmitting initial registration data including the public key of the first user terminal, the public key of the second user terminal, and terminal information of the second user terminal to the authentication server;
After displaying the QR code, a login request for the public key of the first user terminal signed by the authentication server and the public key of the first user terminal signed by the service provider from the service provider With the screen information after
The authentication server of the public key of the first user terminal signed by the authentication server and the public key of the first user terminal signed by the service provider received together with the screen information after the login request And when the signature of the service provider is confirmed, display initial registration completion screen information after the login request,
After displaying the initial registration completion screen information , send a login request to the service provider,
In response to the transmitted login request, an identification code is received from the service provider;
The first user terminal is signed on the received identification code, and the identification code on which the first user terminal is signed is transmitted to the service provider,
After sending the identification code signed by the first user terminal to the service provider, an approval request sent by the service provider to the authentication server is permitted, and the signature of the first user terminal, When the signature of the second user terminal, the signature of the authentication server, and the identification code are confirmed , the public key of the first user terminal and the signature of the service provider that are signed by the authentication server from the service provider are Receiving the public key of the first user terminal that has been made together with the screen information after the login request;
Login authentication method.   In a login authentication method in a login authentication system having a service provider and an authentication server,
  The service provider
  Receive a login request from the first user terminal,
  In response to the received login request, an identification code is transmitted to the first user terminal,
  Receiving the identification code signed by the first user terminal;
  When the signature of the first user terminal of the received identification code signed by the first user terminal is confirmed, the identification code and the public key of the first user terminal are sent to the authentication server. And sending an approval request including the first data signed by the service provider to the authentication server,
  The authentication server is
  When the approval request is received, and the signature of the service provider included in the first data included in the approval request is confirmed, the authentication server is signed to the first data and the identification code, and the authentication is performed. Transmitting the first data and the identification code signed by a server to a second user terminal;
  In response to the transmission of the first data and the identification code signed by the authentication server, the identification code signed by the second user terminal is sent from the second user terminal, Receiving second data including a public key of the user terminal and terminal information of the second user terminal;
  Approval result information indicating a result of the approval request signed by the authentication server when the signature of the second user terminal and the terminal information included in the received second data are confirmed, and the authentication server Transmitting the third data including the identification code with the signature of the second user terminal signed with the service provider,
  The service provider
  Receiving the third data from the authentication server;
  When the signatures of the authentication server and the second user terminal of the received third data are confirmed, the public key of the first user terminal signed by the authentication server and the signature of the service provider are Transmitting the public key of the first user terminal that has been made to the first user terminal together with screen information after the login request;
Login authentication method.   In the login authentication method of the service provider in a login authentication system having a service provider and an authentication server,
  Receive a login request from the first user terminal,
  In response to the received login request, an identification code is transmitted to the first user terminal,
  Receiving the identification code signed by the first user terminal;
  When the signature of the first user terminal of the received identification code signed by the first user terminal is confirmed, the identification code and the first user terminal are disclosed to the authentication server. Sending an authorization request including first data signed by the service provider in the key to the authentication server;
  In response to the transmission of the first data, approval result information indicating a result for the approval request signed by the authentication server from the authentication server, and a signature of the second user terminal signed by the authentication server Receiving second data including the attached identification code and the public key of the first user terminal;
  When the signatures of the authentication server and the second user terminal of the received second data are confirmed, the public key of the first user terminal signed by the authentication server and the signature of the service provider are Transmitting the public key of the first user terminal that has been made to the first user terminal together with screen information after the login request;
Service provider login authentication method in the login authentication system.   In the login authentication method of the authentication server in the login authentication system having a service provider and an authentication server,
  When an approval request is received from a service provider and the signature of the service provider included in the first data included in the approval request is confirmed, the authentication server is signed on the first data and the identification code, and Transmitting the first data and the identification code signed by the authentication server to the second user terminal;
  In response to the first data and the identification code signed by the authentication server, the identification code signed by the second user terminal and the second user terminal are sent from the second user terminal. Receiving the second data including the public key and the terminal information of the second user terminal,
  Approval result information indicating a result of the approval request signed by the authentication server when the signature of the second user terminal and the terminal information included in the received second data are confirmed, and the authentication server Transmitting the third data including the identification code with the signature of the second user terminal signed with the service provider to the service provider;
Login authentication method of the authentication server in the login authentication system.   In a login authentication program used in the service provider in a login authentication system having a service provider and an authentication server,
  To login service provider
  Receiving a login request from the first user terminal,
  In response to the received login request, the first user terminal is sent an identification code,
  Receiving the identification code signed by the first user terminal;
  When the signature of the first user terminal of the received identification code signed by the first user terminal is confirmed, the identification code and the first user terminal are disclosed to the authentication server. Sending an authorization request including first data signed by the service provider in the key to the authentication server;
  In response to the transmission of the first data, approval result information indicating a result for the approval request signed by the authentication server from the authentication server, and a signature of the second user terminal signed by the authentication server Receiving the second data including the attached identification code and the public key of the first user terminal;
  When the signatures of the authentication server and the second user terminal of the received second data are confirmed, the public key of the first user terminal signed by the authentication server and the signature of the service provider are The public key of the first user terminal that has been made is transmitted to the first user terminal together with the screen information after the login request,
Login authentication program.   In a login authentication program used in the authentication server in a login authentication system having a service provider and an authentication server,
  In the authentication server of the login authentication system,
  When an approval request is received from a service provider and the signature of the service provider included in the first data included in the approval request is confirmed, the authentication server is signed on the first data and the identification code, and Sending the first data and the identification code signed by the authentication server to a second user terminal;
  In response to the first data and the identification code signed by the authentication server, the identification code signed by the second user terminal and the second user terminal are sent from the second user terminal. Receiving the second data including the public key and the terminal information of the second user terminal,
  Approval result information indicating a result of the approval request signed by the authentication server when the signature of the second user terminal and the terminal information included in the received second data are confirmed, and the authentication server Transmitting the third data including the identification code with the signature of the second user terminal signed with the service provider to the service provider;
Login authentication program.   The first user terminal and the second user terminal, and using the second user terminal, the second user terminal in the login authentication system for logging in the first user terminal,
  Receiving the first data signed by the authentication server and the identification code, wherein the first data is data signed by a service provider on the identification code and the public key of the first user terminal;
  The identification code signed by the second user terminal when the signatures of the authentication server and the service provider of the received first data and the identification code signed by the authentication server are confirmed. , Causing the authentication server to transmit first data including a public key of the second user terminal and terminal information of the second user terminal.
  Login authentication program.   A first user terminal and a second user terminal, and using the second user terminal, the first user terminal in the login authentication system for logging in the first user terminal,
  Send an initial registration request to the service provider,
  In response to the transmission of the initial registration request, a first initial registration including first initial registration data including an initial identification code signed by an authentication server and an initial identification code signed by the service provider. Receiving data from the service provider;
  When the signature of the authentication server and the service provider of the received first initial registration data is confirmed, a QR code that can be read by the second user terminal is displayed, and the QR code is Including the initial identification code signed by the first user terminal, the public key of the first user terminal, and the second user terminal from the QR code displayed on the first user terminal If the signature of one user terminal is confirmed, the initial identification code with the signature of the first user terminal signed by the second user terminal, the encrypted user identification information, Initial registration data including a public key of the first user terminal, a public key of the second user terminal, and terminal information of the second user terminal is transmitted to the authentication server;
  After displaying the QR code, a login request for the public key of the first user terminal signed by the authentication server and the public key of the first user terminal signed by the service provider from the service provider With the screen information after
  The authentication server of the public key of the first user terminal signed by the authentication server and the public key of the first user terminal signed by the service provider received together with the screen information after the login request And when the signature of the service provider is confirmed, display initial registration completion screen information after the login request,
  After displaying the initial registration completion screen information, send a login request to the service provider,
  In response to the transmitted login request, an identification code is received from the service provider;
  The first user terminal is signed on the received identification code, and the identification code on which the first user terminal is signed is transmitted to the service provider,
  After sending the identification code signed by the first user terminal to the service provider, an approval request sent by the service provider to the authentication server is permitted, and the signature of the first user terminal, When the signature of the second user terminal, the signature of the authentication server, and the identification code are confirmed, the public key of the first user terminal and the signature of the service provider that are signed by the authentication server from the service provider are Receiving the public key of the first user terminal that has been made together with the screen information after the login request;
Login authentication program.