JP6464870B2 - Authentication method, authentication program, and authentication apparatus - Google Patents

Description

  The present invention relates to an authentication method, an authentication program, and an authentication device.

  2. Description of the Related Art Conventionally, a technique for performing authentication using identification information and a password on a website or the like is known.

  In addition, for example, when the user operates the code verification device to verify the password, the rule for converting the random code into the password is notified to the user in advance, and the user receives the random code presented from the system. A technique for inputting information to be converted into a personal identification code is known (refer to Patent Document 1 below).

Japanese Patent Laid-Open No. 9-130377

  However, for example, when authentication is performed using identification information and a password on a website or the like, there is a problem in that the reliability of authentication is low, such as unauthorized access due to a third party breaking the password.

  In one aspect, an object of the present invention is to provide an authentication method, an authentication program, and an authentication device that can improve the reliability of authentication.

  According to one aspect of the present invention, registration of a rule for obtaining a code that is accepted in authentication of a subject to be authenticated is accepted, and authentication is performed depending on whether the input code conforms to the rule for which registration is accepted. An authentication method, an authentication program, and an authentication device to be executed are proposed.

  According to one embodiment of the present invention, the reliability of authentication can be improved.

FIG. 1 is an explanatory view showing an operation example by the authentication apparatus according to the present invention. FIG. 2 is an explanatory diagram illustrating an example of authentication using an ID and a password. FIG. 3 is an explanatory diagram showing an example of the system. FIG. 4 is an explanatory diagram illustrating a hardware configuration example of the authentication apparatus. FIG. 5 is an explanatory diagram illustrating a hardware configuration example of the terminal device. FIG. 6 is a block diagram illustrating a functional configuration example of the authentication apparatus according to the first embodiment. FIG. 7 is an explanatory diagram illustrating an example of a screen when the selection element is not presented to the user. FIG. 8 is an explanatory diagram of an example of registration in the database according to the first embodiment. FIG. 9 is a flowchart illustrating an example of a registration processing procedure performed by the authentication apparatus according to the first embodiment. FIG. 10 is a flowchart illustrating an exemplary authentication processing procedure performed by the authentication apparatus according to the first embodiment. FIG. 11 is a block diagram illustrating a functional configuration example of the authentication apparatus according to the second embodiment. FIG. 12 is an explanatory diagram illustrating an operation example performed by the authentication apparatus according to the second embodiment. FIG. 13 is an explanatory diagram of an example of registration in the database according to the second embodiment. FIG. 14 is an explanatory diagram illustrating a screen example when a selection element is presented to the user. FIG. 15 is a flowchart illustrating an example of a registration processing procedure performed by the authentication apparatus according to the second embodiment. FIG. 16 is a flowchart illustrating an exemplary authentication processing procedure performed by the authentication apparatus according to the second embodiment.

  Exemplary embodiments of an authentication method, an authentication program, and an authentication apparatus according to the present invention will be described below in detail with reference to the accompanying drawings.

  FIG. 1 is an explanatory view showing an operation example by the authentication apparatus according to the present invention. The authentication device 100 is a computer that performs authentication from an authenticated person such as a user or an application. Authentication is a procedure in which the message recipient confirms that the sender is the “person” in the operation of the Internet.

  Conventionally, many authentications of websites and the like are performed, for example, by comparing identification information and password indicating an authentication target registered in advance with input identification information and password. The identification information is hereinafter referred to as ID (Identifier). An example of authentication using an ID and a password will be described later with reference to FIG. In recent years, important information such as personal information such as DNA (Deoxyribonucleic Acid) analysis and financial asset information possessed by financial institutions such as banks and credit sales companies is exchanged via a website.

  In recent years, there has been an unauthorized access act in which a third party abuses a website or the like. As an unauthorized access act, for example, there are many identification code theft types in which a third party takes a user's ID and password and accesses a real website based on the taken ID and password. For example, in a method called phishing, an email pretending to be a financial institution such as a bank or a credit sales company is sent to the user, and the user is guided to a camouflaged website to take the ID and password. As described above, in the conventional authentication, when authentication is performed using an ID and a password, a third party may obtain unauthorized access by illegally obtaining the password, and the reliability of authentication is low. is there.

  Further, when notifying a user who is a subject of authentication of a rule determined in advance by the authentication system as in the prior art, there is a high possibility that the rule will be known to a third party. Therefore, if the third party knows the rules, the third party can analyze the code accepted at the time of authentication based on the rules and may be illegally accessed, and the authentication reliability is low. There is.

  Therefore, in the present embodiment, registration of a rule for obtaining a code that is accepted at the time of authentication from the authentication target is accepted, and depending on whether the authentication code input at the time of authentication conforms to the registered rule. Perform authentication. Thereby, the reliability of authentication can be improved.

  In the present embodiment, an example in which a user registers a rule in the authentication apparatus 100 will be described. Rules may be registered for it.

  First, the authentication device 100 accepts registration of a rule that obtains a code that is determined to be accepted when an authentication target is authenticated. The rule is, for example, an algorithm that allows a user or an embedded application to obtain a code. Examples of the rules include rules such as a subtraction method, a thinning method, a replacement method, a combination method, a regular expression method, and a position information method.

  Specifically, as shown in FIG. 1A, the user transmits to the authentication apparatus 100 to register an ID indicating the authentication target and a rule associated with the ID indicating the authentication target. . Further, if the rule is associated with the ID, the registration timing of the rule and the ID may be the same or different. Then, as illustrated in FIG. 1B, the authentication device 100 accepts registration of an ID indicating the authentication target and a rule associated with the ID indicating the authentication target. The ID is not particularly limited as long as the authentication target can be uniquely identified.

  Next, the authentication device 100 performs authentication depending on whether or not the input code conforms to the rules for accepting registration. The input code is, for example, a code that is input by an authentication target during authentication. Specifically, the input code includes, for example, an ID that can identify the authentication target and an authentication code associated with the ID. The code for authentication is also called an authentication key, for example. The ID and the authentication key are input separately, for example.

  Specifically, for example, the user inputs an ID as shown in FIG. Then, as illustrated in FIG. 1D, the authentication device 100 collates whether or not the ID that has received the input is registered. When it is determined that the ID that accepted the input is registered, the authentication apparatus 100 is in a state where it can accept an authentication key as an input code, for example.

  For example, the user inputs an authentication key as shown in FIG. A user who knows the registered rules can input an authentication key determined to be accepted by the authentication. Then, for example, as illustrated in FIG. 1F, the authentication device 100 determines whether the authentication key conforms to a rule associated with an ID. For example, the authentication device 100 may determine whether the authentication key is a code that conforms to a rule. For example, the authentication device 100 may determine whether or not the authentication key matches a code generated based on the rule.

  As shown in FIG. 1G, the authentication device 100 notifies the authentication target that the authentication key has been accepted, for example, when it is determined to be compliant. On the other hand, as illustrated in FIG. 1G, the authentication device 100 notifies the authentication target that the authentication key has been rejected, for example, when it is determined that the authentication is not compliant.

  Thus, since the third party does not know the registered rules, the analysis becomes difficult. Further, since the subject to be authenticated can arbitrarily register a rule, if the rule is different for each subject to be authenticated, it is possible to make it difficult for a malicious third party to perform a means called spear phishing. Thus, the authentication mechanism itself is determined by the subject to be authenticated, so that the reliability of authentication can be improved. In addition, it is predicted that ciphers that rely on security by paying attention to the amount of calculation will be decipherable in the future when a computer with a tremendously high computing capacity such as a quantum computer is realized. Therefore, the authentication method according to the present embodiment is effective as an authentication method that does not use encryption or the like that is expected to be broken by an improvement in the amount of computer computation.

  FIG. 2 is an explanatory diagram illustrating an example of authentication using an ID and a password. As shown in FIG. 2A, the user registers an ID and a password. The system that performs authentication accepts registration of the ID and password and stores them in a storage device or the like.

  As shown in FIG. 2B, the user requests authentication by inputting an ID and a password. Then, as shown in FIG. 2C, when the system receives the input of the ID and password, the system determines whether the received ID and password are registered based on the storage device. Next, as shown in FIG. 2D, the system transmits a response indicating whether the authentication has succeeded or failed based on the determination result to the user terminal device.

  FIG. 3 is an explanatory diagram showing an example of the system. The system includes a terminal device 101 and an authentication device 100. The terminal device 101 and the authentication device 100 are connected via a network 300, for example.

  The authentication device 100 is a server, for example. Further, the authentication device 100 may be a machine such as an ATM (Automated Teller Machine). The terminal device 101 is a device that a user of the authentication device 100 has. There may be a plurality of user terminal devices 101. In the example of FIG. 3, the terminal device 101 is the terminal device 101-1 to the terminal device 101-3. The terminal device 101 may be, for example, a notebook PC (Personal Computer), a desktop PC, or a portable terminal device.

  In the example of FIG. 3, the authentication device 100 and the terminal device 101 possessed by the user are different devices, but the authentication device 100 and the terminal device 101 may be the same device. Further, the user may be able to directly operate the authentication device 100. For example, the authentication device 100 and the terminal device 101 may be the same device when registering or inputting an ID, and the authentication device 100 and the terminal device 101 may be different devices when inputting an authentication key.

(Hardware configuration example of authentication device 100)
FIG. 4 is an explanatory diagram illustrating a hardware configuration example of the authentication apparatus. The authentication apparatus 100 includes a CPU (Central Processing Unit) 401, a ROM (Read Only Memory) 402, a RAM (Random Access Memory) 403, a disk drive 404, a disk 405, and an I / F (Inter / Face) 406. And having.

  The CPU 401, the ROM 402, the RAM 403, the disk drive 404, and the I / F 406 are connected by a bus 400, respectively.

  Here, the CPU 401 governs overall control of the authentication device 100. The ROM 402 stores various programs. The program stored in the ROM 402 is loaded on the CPU 401 to cause the CPU 401 to execute the coded processing. The RAM 403 is used as a work area for the CPU 401.

  The I / F 406 is connected to a network 300 such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet through a communication line, and is connected to other devices via the network 300. The I / F 406 serves as an internal interface with the network 300 and controls input / output of data from other computers. For example, a modem or a LAN adapter may be employed as the I / F 406.

  The disk drive 404 controls reading / writing of data with respect to the disk 405 according to the control of the CPU 401. The disk 405 stores data written under the control of the disk drive 404. Examples of the disk 405 include a magnetic disk and an optical disk.

  The authentication device 100 may include, for example, an SSD (Solid State Drive), a keyboard, a mouse, and a display in addition to the above-described components.

(Example of hardware configuration of terminal apparatus 101)
FIG. 5 is an explanatory diagram illustrating a hardware configuration example of the terminal device. The terminal device 101 includes a CPU 501, a ROM 502, a RAM 503, a disk drive 504, and a disk 505.

  The terminal device 101 includes an I / F 506, a keyboard 507, a mouse 508, and a display 509. The CPU 501, ROM 502, RAM 503, disk drive 504, I / F 506, keyboard 507, mouse 508, and display 509 are connected by a bus 500.

  Here, the CPU 501 governs overall control of the terminal device 101. The ROM 502 stores a program such as a boot program. The RAM 503 is used as a work area for the CPU 501. The disk drive 504 controls reading / writing of data with respect to the disk 505 according to the control of the CPU 501. The disk 505 stores data written under the control of the disk drive 504. Examples of the disk 505 include a magnetic disk and an optical disk.

  The I / F 506 is connected to a network 300 such as a LAN, a WAN, or the Internet through a communication line, and is connected to other devices via the network 300. The I / F 506 controls an internal interface with the network 300 and controls data input / output from an external device. For example, a modem or a LAN adapter may be employed as the I / F 506.

  The keyboard 507 and the mouse 508 are interfaces for inputting various data by user operations, for example. The display 509 is an interface that outputs data in accordance with an instruction from the CPU 501, for example.

  Although not shown, the terminal device 101 may be provided with an input device that captures images and moving images from a camera and an input device that captures sound from a microphone. Although not shown, the terminal device 101 may be provided with an output device such as a printer. Moreover, although illustration is abbreviate | omitted, the terminal device 101 may be provided with SSD, flash ROM, etc., for example.

  Further, the terminal device 101 may not include, for example, the disk drive 504 and the disk 505 among the components described above.

<Rule types>
Here, before detailed description, the types of rules for authentication will be briefly described. If the rules that can be shared by the user and the system are complex rules, it may be difficult for the user to memorize and handle. Therefore, it is preferable that the rules for authentication are simple. Examples of the types of rules include (1) subtraction method, (2) thinning method, (3) replacement method, (4) combination method, (5) regular expression method, and (6) position information method. Here, the authentication key described in the detailed example of the rule below is an example of an authentication key accepted at the time of executing the authentication.

(1) Subtraction method The subtraction method is a method in which a character string obtained by removing a password character from an anagram character string including a password is used as an authentication key. For example, consider the following.
Password text: “Fujitsu”
Anagram character string generated by the system: “1ajtiusxFx2stab”
Authentication key: anagram character string “1ajtusxFx2stab” -password character string “Fujitsu” = “1ax2ab” is an authentication key.

(2) Thinning-out method The thinning-out method is a method of extracting a character at a specific position from an anagram character string including a password character string. The specific position is designated as additional information depending on the authentication target.
Password text: “Fujitsu”
Additional information: Thinning-out position “1522”
Anagram character string generated by the system: “1ajtiusxFx2stab”
Authentication key: “1iaa” from “1ajtiusxFx2stab” and “1522” is an authentication key.

(3) Replacement method The replacement method is a method in which a character string in which a character at a specific position in an anagram character string including a password character is replaced is used as an authentication key. The specific position is designated as additional information depending on the authentication target. For example, consider the following.
Password text: “Fujitsu”
Registered additional information: replacement position “1 → 2, 3 → 4”
Anagram character string generated by the system: “1ajtiusxFx2stab”
Authentication key: “a1tjiusxFx2stab” becomes an authentication key by the anagram character strings “1ajtiusxFx2stab” and “1 → 2, 3 → 4”.

(4) (2) Thinning method and (3) Combination method of replacement method In the combination method, the character at a specific position of the anagram character string including the password character is replaced, and the character at the specific position is replaced from the replaced character string. In this method, the extracted character string is used as an authentication key. The specific position is designated as additional information depending on the authentication target. For example, consider the following.
Password text: “Fujitsu”
Additional information: replacement position “1 → 2, 3 → 4”, thinning position “1234”
Anagram character string generated by the system: “1ajtiusxFx2stab”
Authentication key: The replacement character string “a1tiusxFx2stab” is obtained by the anagram character string “1ajtiusxFx2stab” and the replacement position “1 → 2, 3 → 4”. From the replacement character string, “a1tjusxFx2stab” and the thinning-out position “1234” make “a1tj” an authentication key.

(5) Regular expression method The regular expression method is a method in which a user inputs a value conforming to a regular expression as an authentication key at the time of authentication. Take the following as an example. The following additional information includes an authentication key for inputting a character string other than numbers for the first to third characters, inputting a number for the fourth to fifth characters, and inputting an arbitrary character string including “a” for the sixth and subsequent characters. Indicates that it will be entered as
Additional information of regular expression: “[^ 0-9] {3} [0-9] {2} ¥ w * [a] ¥ w *”
Authentication key: For example, “fjt12sample” is an authentication key.

(6) Location information method In the method using location information, for example, the user inputs past or future location information that only the user can know before authentication, and authentication is accepted when the location information is actually obtained. It is a method such as. In such a case, for example, position information becomes a rule, and the position information actually becomes an authentication key. The location information may be, for example, the latitude and longitude obtained by GPS (Global Positioning System) of the terminal device 101 or the like, or may be the presence or absence of passage of a building gate or a ticket gate of a station. There is no particular limitation. For example, when using future location information, there is a gate on each of the right and left from the place where the user is, and the user registers information that the user passes the right gate within 5 minutes. deep. When the right gate is actually passed within 5 minutes, information indicating that the right gate has been passed is input as the authentication key, and it is determined that the authentication device 100 has received the authentication key. For example, if it does not pass the right gate within 5 minutes after input, it is determined that the authentication device 100 has rejected the authentication key (if the gate is set to anti-passback, the deterrence against unauthorized access increases) .

  As described above, in the case of the rules (1) to (4), an anagram character string is generated as an intermediate code, and an authentication code is generated as a reference code. In the case of rules such as (5) and (6), the intermediate code and the reference code are not generated. Here, Embodiment 1 shows a case where a selection element such as an intermediate code is not presented to the user as in the rules (5) and (6). A case in which a selection element such as an intermediate code is presented to the user as in rules (1) to (4) is shown in the second embodiment.

Example 1
In the first embodiment, registration of a rule for obtaining a code that is accepted at the time of authentication from a user or application that is an authentication target is accepted, and whether the authentication code input at the time of authentication conforms to the registered rule. Authenticate according to Thereby, the reliability of authentication can be improved.

(Functional configuration example of the authentication device 100 according to the first embodiment)
FIG. 6 is a block diagram illustrating a functional configuration example of the authentication apparatus according to the first embodiment. The authentication device 100 includes a storage unit 111, a registration reception unit 601, a first authentication reception unit 602, a second authentication reception unit 603, an authentication unit 604, and a notification unit 605. The processing of the control unit from the registration receiving unit 601 to the notification unit 605 is coded in a program stored in a storage device such as a ROM 402, a RAM 403, and a disk 405 that can be accessed by the CPU 401 shown in FIG. Then, the CPU 401 reads the program from the storage device and executes the process coded in the program.

  The registration receiving unit 601 receives code registration. The code is, for example, an ID that can identify the authentication target as described above. Then, the registration receiving unit 601 receives rule registration. Also, the registration receiving unit 601 receives a rule registration in association with the ID. According to the rules, since it is possible to obtain a code that determines that the authentication target is accepted at the time of authentication, the rules are also referred to as algorithms.

  FIG. 7 is an explanatory diagram illustrating an example of a screen when the selection element is not presented to the user. FIG. 7A shows an example of user registration, and FIG. 7B shows an example of user authentication.

  The screen 701 in FIG. 7A includes an ID input field, an algorithm input field, an additional information input field, and a registration button. When the user presses the registration button, the contents input in each input field are transmitted to the authentication device 100.

  For example, the registration receiving unit 601 receives registration of an ID and an algorithm and additional information in association with the ID. Then, for example, the registration receiving unit 601 stores the received ID, algorithm, and additional information in association with each other. The registration receiving unit 601 stores, for example, in the database shown in FIG.

  FIG. 8 is an explanatory diagram of an example of registration in the database according to the first embodiment. The database 800 is information for user registration. The database 800 includes fields for ID, password, algorithm, and additional information. By setting information in each field, it is stored as a record (for example, 801-1). The database 800 is stored in a storage device such as the RAM 403 and the disk 405, for example. However, in the first embodiment, no password is registered, so no information is set in the password field.

  Identification information such as the user and the terminal device 101 possessed by the user is set in the ID field. In the algorithm field, for example, information indicating the algorithm type is set. In the additional information field, information to be added when authentication is performed by an algorithm is set.

  The first authentication receiving unit 602 and the second authentication receiving unit 603 illustrated in FIG. 6 receive an input code. Here, the input code includes, for example, a first input code and a second input code. The first input code is an ID that can identify the authentication target. The second input code is an authentication key. First, the first authentication receiving unit 602 receives an ID as the first input code.

  The screen 711 in FIG. 7B has an ID input field and a send button. The user inputs the registered ID and presses the send button. As a result, the ID is transmitted to the authentication device 100. The first authentication receiving unit 602 receives an input of ID. Then, the first authentication receiving unit 602 determines whether the ID that has received the input is registered in the database 800.

  Next, the second authentication receiving unit 603 receives an authentication key as the second input code. Specifically, the second authentication accepting unit 603 accepts a password from the user when, for example, the ID that accepted the input is registered in the database 800. Therefore, the screen 712 in FIG. 7B further includes a password input field and a login button in addition to the contents of the screen 711. Here, the authentication key is entered in the password entry field.

  The user inputs a password according to the registered rules and presses the login button. As a result, the password is transmitted to the authentication device 100. The algorithm registered by the user is a regular expression. The additional information is, for example, “[^ 0-9] {3} [0-9] {2} ¥ w * [a] ¥ w *”. In this additional information example, a character string other than a number is input to the first to third, a number is input to the fourth to fifth, and an arbitrary character string including “a” is used as the authentication key from the sixth. Show. A screen 713 in FIG. 7B is an example in which “fjt01sample” is input as an authentication key in the password input field. Then, the user presses the login button after inputting the authentication key.

  Then, the second authentication reception unit 603 receives a password. The authentication unit 604 determines whether the password received by the second authentication reception unit 603 is a code that conforms to an algorithm associated with the ID.

  When the notification unit 605 determines that the code conforms to the code, the notification unit 605 outputs information indicating that the code has been authenticated. For example, the notification unit 605 displays a screen after login on the terminal device 101. The terminal device 101 displays information indicating that the authentication has been successful. For example, the information indicating that the authentication has been successful may display a status in which the Web system can be used.

  When the notification unit 605 determines that the code is not compliant, the notification unit 605 notifies the user's terminal device 101 of information indicating that authentication has failed. For example, the notification unit 605 may cause the terminal device 101 to display the screen 712 in FIG. Further, the terminal device 101 outputs information indicating that the authentication unit 604 has failed to authenticate.

(Example of processing procedure performed by authentication device 100 according to embodiment 1)
FIG. 9 is a flowchart illustrating an example of a registration processing procedure performed by the authentication apparatus according to the first embodiment. The authentication device 100 accepts user information and algorithm registration (step S901). Next, the authentication device 100 registers user information in the database 800 (step S902). The user information here is information including an ID, for example. Then, the authentication apparatus 100 registers an algorithm in the database 800 in association with the user information (step S903), and ends a series of processes. Further, the algorithm may include additional information.

  FIG. 10 is a flowchart illustrating an exemplary authentication processing procedure performed by the authentication apparatus according to the first embodiment. The authentication device 100 receives an input of ID (step S1001). The authentication device 100 acquires user information including the received ID from the database 800 (step S1002). The authentication device 100 determines whether user information exists in the database 800 (step S1003).

  If it is determined in step S1003 that the user information does not exist (step S1003: No), the authentication apparatus 100 proceeds to step S1007. When it is determined that the user information exists (step S1003: Yes), the authentication device 100 receives an input of an authentication key (step S1004). Next, the authentication device 100 determines whether or not the authentication key input by the user complies with the algorithm associated with the user information (step S1005).

  When it is determined that the input authentication key is compliant with the algorithm (step S1005: Yes), the authentication device 100 notifies and displays a successful authentication (step S1006), and ends a series of processing. If it is determined that the input authentication key does not conform to the algorithm (step S1005: No), the authentication apparatus 100 notifies and displays an authentication failure (step S1007), and ends the series of processes.

  As described above in the first embodiment, the authentication apparatus 100 accepts registration of a rule for obtaining a code that is accepted at the time of authentication from a user or application that is an authentication target, and the authentication key that is input at the time of authentication. The authentication is executed depending on whether or not it complies with the registered rule. Since the authentication is performed as if the authentication key complies with the rules instead of being directly compared as in the conventional password, the reliability of the authentication can be improved.

  Further, the authentication apparatus 100 accepts registration of a rule in association with registration of an ID indicating an authentication target. As a result, there is a high possibility that the rules are different for each authentication target, and therefore it is possible to make it difficult for a malicious third party to perform spear phishing.

(Example 2)
In the second embodiment, a code that can generate a code based on a rule is registered, a reference code is generated based on the code and the rule, and authentication is executed based on a comparison between the reference code and the input code. Thereby, the reliability of authentication can be improved.

(Functional Configuration Example of Authentication Device 100 According to Second Embodiment)
FIG. 11 is a block diagram illustrating a functional configuration example of the authentication apparatus according to the second embodiment. The authentication device 100 includes a storage unit 111, a registration reception unit 1101, a first authentication reception unit 1102, a first generation unit 1103, a transmission unit 1104, a second authentication reception unit 1105, and a second generation unit 1106. , An authentication unit 1107 and a notification unit 1108. The processing of the control unit from the registration receiving unit 1101 to the notification unit 1108 is coded in a program stored in a storage device such as the ROM 402, the RAM 403, and the disk 405 that can be accessed by the CPU 401 shown in FIG. Then, the CPU 401 reads the program from the storage device and executes the process coded in the program.

  A registration receiving unit 1101 illustrated in FIG. 11 receives code registration. Also, the registration receiving unit 1101 receives a rule registration in association with the code for which the registration has been received. Examples of the rules include algorithms such as the above-described subtraction method, thinning method, replacement method, and combination method. The code includes, for example, an ID that can identify an authentication target and a code that can generate another code based on a rule. In the second embodiment, a code that can generate another code is also called a password.

  FIG. 12 is an explanatory diagram illustrating an operation example performed by the authentication apparatus according to the second embodiment. Specifically, as illustrated in FIG. 12A, the user registers an ID, a password, an algorithm, and additional information in the authentication device 100. A registration reception unit 1101 illustrated in FIG. 11 receives registration of an ID, a password, an algorithm, and additional information.

  The registration accepting unit 1101 accepts registration of ID, password, algorithm, and additional information and stores them in the database.

  FIG. 13 is an explanatory diagram of an example of registration in the database according to the second embodiment. The database 1300 is information for user registration. The database 1300 has fields for ID, password, algorithm, and additional information. By setting information in each field, it is stored as a record (for example, record 1301-1, 1301-2, etc.). The database 1300 is stored in a storage device such as the RAM 403 and the disk 405, for example.

  Identification information such as the user and the terminal device 101 possessed by the user is set in the ID field. In the password field, a password for the user or the terminal device 101 owned by the user is set. In the algorithm field, for example, information indicating the algorithm type is set. In the additional information field, information to be added when authentication is performed by an algorithm is set.

  Taking the record 1301-1 as an example, “taro” is set in the ID field, and “becky” is set in the password field. “Decimation method” is set in the algorithm field, and “258” is set in the additional information field.

  A first authentication receiving unit 1102 illustrated in FIG. 11 receives a code input. Specifically, as illustrated in FIG. 12B, the first authentication receiving unit 1102 receives, for example, an ID input.

  The first generation unit 1103 generates an intermediate code based on the code accepted for registration. The intermediate code is also referred to as an anagram character string, for example. As illustrated in FIG. 12C, the first generation unit 1103 generates an anagram character string based on, for example, a password associated with the ID. The transmission unit 1104 transmits the intermediate code to the terminal device 101 that has received the ID input. As illustrated in FIG. 12D, specifically, the transmission unit 1104 transmits an anagram character string to the terminal device 101 that has received an input code. As a result, an anagram character string that can be identified by the user is displayed, so that the user can confirm, for example, that the website is authentic before inputting the authentication key.

  As illustrated in FIG. 12E, the second generation unit 1106 generates a reference code based on the anagram character string and the algorithm associated with the ID. The reference code is a code for comparison with the input authentication key.

  Next, as illustrated in FIG. 12F, the terminal device 101 transmits an authentication key to the authentication device 100. Then, the second authentication reception unit 1105 receives an input of an authentication key.

  The authentication unit 1107 determines whether the received authentication key conforms to the rules. Specifically, for example, as illustrated in FIG. 12G, the authentication unit 1107 performs authentication by determining whether or not the received authentication key matches the generated authentication key. For example, as shown in FIG. 12H, the notification unit 1108 outputs information indicating that the authentication key has been accepted when it is determined that they match. For example, the notification unit 1108 causes the terminal device 101 to display a screen after login. The terminal device 101 displays information indicating that the authentication key has been accepted.

  For example, as illustrated in FIG. 12H, the notification unit 1108 notifies the user terminal device 101 of information indicating that the authentication key has been rejected when it is determined that they do not match. Moreover, the terminal device 101 displays information indicating that the authentication key has been rejected, for example.

  Next, a description will be given using a specific screen example.

  FIG. 14 is an explanatory diagram illustrating a screen example when a selection element is presented to the user. FIG. 14A shows an example of user registration, and FIG. 14B shows an example of user authentication.

  As shown in FIG. 14A, when an algorithm can be selected, a user registration screen 1401 includes an ID input field, a password input field, an algorithm selection field, and an additional information input field. And a registration button. In the screen 1401, “taro” is input in the ID input field, and “becky” is input in the password input field. In the screen 1401, “decimation method” is selected in the algorithm selection field, and “258” is input in the additional information input field. When the user presses the registration button, the contents input in each input field are transmitted to the authentication device 100.

  As shown in FIG. 14A, when the user recognizes the identification information indicating the algorithm, the user registration screen 1402 includes an ID input field, a password input field, and an algorithm input. It has a column. In the screen 1402, “taro” is input in the ID input field, and “becky” is input in the password input field. On the screen 1402, “exc (258)” is entered in the algorithm entry field.

  As shown in FIG. 14 (2), the authentication screen 1411 has an ID input field and a send button. The user inputs the registered ID in the ID input field and presses the send button.

  When receiving the input of the ID, the first authentication receiving unit 1102 confirms whether or not the ID is registered in the database 1300. When the ID is registered, the first generation unit 1103 generates an anagram character string based on the password stored in association with the ID. Then, the second generation unit 1106 generates an authentication key, which is a reference code, based on the anagram character string and the algorithm stored in association with the ID. The transmission unit 1104 transmits the generated anagram character string to the terminal device 101 that is the input source of the ID.

  As shown in FIG. 14 (2), the authentication screen 1412 has an ID input field, a send button, a transmitted anagram character string, an authentication key input field, and a login button. Here, since the algorithm is a thinning method and the additional information is “258”, for example, the user extracts the second, fifth, and eighth characters from the left from the displayed anagram character string. More specifically, the user extracts “zce” from the anagram character string “vzodcqbekyvi”. Then, as shown in FIG. 14 (2), as shown in a screen 1413, the user inputs the extracted “zce” into the authentication key input field and presses the login button.

  Then, the second authentication receiving unit 1105 receives an authentication key. Next, the authentication unit 1107 executes authentication for the received ID by determining whether or not the received authentication key matches the generated authentication key. When it is determined that the received authentication key matches the generated authentication key, the notification unit 1108 notifies the ID input source terminal device 101 to display that the authentication is successful. . When it is determined that the received authentication key and the generated authentication key do not match, the notification unit 1108 notifies the ID input source terminal device 101 to display that the authentication has failed. .

(Example of processing procedure performed by authentication device 100 according to Embodiment 2)
FIG. 15 is a flowchart illustrating an example of a registration processing procedure performed by the authentication apparatus according to the second embodiment. The authentication device 100 accepts user information and algorithm registration (step S1501). The user information here includes, for example, an ID and a password. The algorithm here may include additional information, for example. Next, the authentication device 100 registers user information (step S1502). The authentication device 100 registers the algorithm in association with the user information (step S1503), and ends the series of processes.

  FIG. 16 is a flowchart illustrating an exemplary authentication processing procedure performed by the authentication apparatus according to the second embodiment. The authentication device 100 accepts input of an ID (step S1601). Next, the authentication device 100 acquires user information including the ID received from the database 1300 (step S1602). Then, the authentication device 100 determines whether user information exists (step S1603).

  When it is determined that the user information does not exist (step S1603: No), the authentication device 100 proceeds to step S1610. When it is determined that user information exists (step S1603: Yes), the authentication apparatus 100 generates an anagram character string (step S1604), and proceeds to steps S1605 and S1607. The double lines here indicate that they are parallel.

  In step S1605, the authentication device 100 transmits the anagram character string to the terminal device 101 that is the input source of the ID for display (step S1605). The authentication device 100 accepts the input of the authentication key (step S1606), and proceeds to step S1608. In step S1607, the authentication apparatus 100 generates an authentication key (step S1607), and proceeds to step S1608. Following step S1606 and step S1607, authentication apparatus 100 determines whether the authentication key that has received the input matches the generated authentication key (step S1608).

  When it is determined that the received authentication key matches the generated authentication key (step S1608: Yes), the authentication device 100 notifies and displays a successful authentication (step S1609), and ends the series of processes. If it is determined that the received authentication key does not match the generated authentication key (step S1608: No), the authentication apparatus 100 notifies and displays an authentication failure (step S1610), and ends the series of processes.

  In the present embodiment, the user registers a rule for the authentication apparatus 100. However, the present invention is not limited to this, and an embedded application executed by the user's terminal apparatus 101 is included in the authentication apparatus 100 as described above. Rules may be registered for it.

  Specifically, the embedded application may register the authentication function as a rule for the authentication device 100, for example. Examples of a language for developing an embedded application include “.NET” and “JAVA (registered trademark)”.

  In “.NET”, source code provided as an external file from an embedded application can be dynamically compiled and executed. Therefore, the embedded application can register the authentication function itself with the authentication device 100 and perform dynamic compilation and execution. In addition, “JAVA” can dynamically compile and execute JAVA code as in “.NET”. Therefore, the embedded application can register the authentication function itself with the authentication device 100 and perform dynamic compilation and execution.

  As described above with reference to the second embodiment, the authentication apparatus 100 registers a code that can generate a code based on a rule, generates a reference code based on the code and the rule, and generates a reference code and an input code. Authenticate based on the comparison. In this way, by comparing the generated reference code with the input code, it is more difficult for third parties to analyze than directly comparing the input content with the stored content like a password. Can do. Therefore, the reliability of authentication can be improved.

  Further, the authentication device 100 accepts the registration of the rule in association with the code that accepted the registration. As a result, there is a high possibility that the rules are different for each authentication target, and therefore it is possible to make it difficult for a malicious third party to perform spear phishing.

  Further, the authentication device 100 generates an intermediate code based on the code for which registration has been accepted, transmits the generated intermediate code to the terminal device 101 that is the input source of the ID, and receives an authentication key. Accordingly, when a user of a website or the like to be authenticated inputs an authentication key, it can be confirmed that the authentication target of the website or the like is genuine. For example, when the code for which registration has been accepted is not included in the intermediate code or when the intermediate code is not displayed, it can be determined that the authentication target is a fake object.

  Further, the subtraction method, the replacement method, the thinning method, the combination method of replacement and thinning, and the like can be handled more easily by the user than, for example, storing a complicated password.

  The authentication method described in this embodiment can be realized by executing a prepared authentication program on a computer such as a personal computer or a workstation. This authentication program is recorded on a computer-readable recording medium such as a magnetic disk, an optical disk, or a USB (Universal Serial Bus) flash memory, and is executed by being read from the recording medium by the computer. The authentication program may be distributed via the network 300 such as the Internet.

  The following additional notes are disclosed with respect to the embodiment described above.

(Supplementary note 1)
Accept registration of rules that will give you a code that will be accepted in the subject authentication,
Authenticate depending on whether the input code conforms to the rules that accepted registration,
An authentication method characterized by executing processing.

(Appendix 2) The computer
Accepting registration of a code that can identify the authentication target,
Execute the process,
In the process of accepting the registration of the rule,
Accepting registration of the rule in association with registration of the identifiable code;
The authentication method according to Supplementary Note 1, characterized in that:

(Supplementary note 3)
Accept registration of code that can generate the accepted code based on the rules that accepted registration,
A reference code is generated based on the rule that has accepted registration and the code that has accepted registration.
Execute the process,
In the process of executing the authentication,
Performing authentication based on a comparison between the input code and the generated reference code;
The authentication method according to Supplementary Note 1, characterized in that:

(Supplementary Note 4) The code that has received registration includes a code that can identify the authentication target,
In the process of accepting the registration of the rule,
Accepting registration of the rule in association with registration of the code that has accepted registration;
The authentication method according to supplementary note 3, characterized by:

(Supplementary Note 5) The code that has received registration includes a code that can identify the subject to be authenticated,
The computer is
Receiving a first input code that is different from the input code (hereinafter referred to as a “second input code”) and capable of identifying the authentication target;
The code including the first input code, and generating an intermediate code based on the code for which registration is accepted,
The generated intermediate code is transmitted to the terminal device that has input the first input code,
Receiving the input of the second input code after transmission of the intermediate code;
Execute the process,
In the process of generating the reference code,
Without generating the reference code based on the code and the rules that have received registration, generate the reference code based on the generated intermediate code and the rules,
In the process of executing the authentication,
Performing authentication based on a comparison between the second input code and the generated reference code;
5. The authentication method according to appendix 3 or 4, wherein

(Appendix 6) In an authentication method for executing authentication based on a comparison between an input code and a reference code,
Accept code registration,
Accept registration of rules that generate other code based on the code that accepted the registration,
Based on the rules for accepting registration, generate another code corresponding to the code for accepting registration,
Setting the generated other code as the reference code;
An authentication method, wherein a computer executes processing.

(Appendix 7)
Accept registration of rules that will give you a code that will be accepted in the subject authentication,
Authenticate depending on whether the input code conforms to the rules that accepted registration,
An authentication program characterized by causing processing to be executed.

(Appendix 8) Accepting registration of a rule that provides a code that is accepted in the authentication of the subject to be authenticated,
Authenticate depending on whether the input code conforms to the rules that accepted registration,
An authentication apparatus comprising a control unit.

DESCRIPTION OF SYMBOLS 100 Authentication apparatus 101 Terminal apparatus 111 Memory | storage part 601,1101 Registration reception part 602,1102 1st authentication reception part 603,1105 2nd authentication reception part 604,1107 Authentication part 605,1108 Notification part 800,1300 Database 1103 1st production | generation part 1104 Transmission unit 1106 Second generation unit

Claims (4)

Computer
Accept registration of rules that will give you a code that will be accepted in the subject authentication,
Accepting registration of a code that can generate the accepted code based on the rule that accepted registration, including a first input code that can identify the authentication target;
Receiving input of the first input code;
The code including the first input code, and generating an intermediate code based on the code for which registration is accepted,
The generated intermediate code is transmitted to the terminal device that has input the first input code,
Receiving the input of the second input code after the transmission of the intermediate code,
Based on the generated intermediate code and the rules, a reference code is generated,
Performing authentication based on a comparison between the second input code and the generated reference code;
An authentication method characterized by executing processing. In the process of accepting the registration of pre-Symbol rule,
Accepting registration of the rule in association with registration of the code that has accepted registration;
The authentication method according to claim 1, wherein: On the computer,
Accept registration of rules that will give you a code that will be accepted in the subject authentication,
Accepting registration of a code that can generate the accepted code based on the rule that accepted registration, including a first input code that can identify the authentication target;
Receiving input of the first input code;
The code including the first input code, and generating an intermediate code based on the code for which registration is accepted,
The generated intermediate code is transmitted to the terminal device that has input the first input code,
Receiving the input of the second input code after the transmission of the intermediate code,
Based on the generated intermediate code and the rules, a reference code is generated,
Performing authentication based on a comparison between the second input code and the generated reference code;
An authentication program characterized by causing processing to be executed. Accept registration of rules that will give you a code that will be accepted in the subject authentication,
Accepting registration of a code that can generate the accepted code based on the rule that accepted registration, including a first input code that can identify the authentication target;
Receiving input of the first input code;
The code including the first input code, and generating an intermediate code based on the code for which registration is accepted,
The generated intermediate code is transmitted to the terminal device that has input the first input code,
Receiving the input of the second input code after the transmission of the intermediate code,
Based on the generated intermediate code and the rules, a reference code is generated,
Performing authentication based on a comparison between the second input code and the generated reference code;
An authentication apparatus comprising a control unit.

Images