JP6651570B2 - User authentication device for authenticating a user, a program executed in the user authentication device, a program executed in an input device for authenticating the user, a user authentication device, and a computer system including the input device - Google Patents

Description

  The present invention relates to a user authentication device for authenticating a user, a program executed in the user authentication device, a program executed in an input device for authenticating a user, a user authentication device, and a computer system including the input device.

  2. Description of the Related Art Conventionally, there has been known a user authentication technique in which a user inputs a user ID and a password in alphanumeric characters using an input device such as a keyboard to authenticate the user (for example, see Patent Document 1).

JP 2007-34952 A

  However, a user authentication technology suitable for an input device other than an input device such as a keyboard has not been established. For example, a user authentication technology suitable for an input device such as a smart speaker has not been established. A conventional user authentication technology for authenticating a user by inputting a user ID and a password in alphanumeric characters is not suitable for an input device such as a smart speaker. This is because, in the conventional user authentication technology, it is very complicated for the user to input the alphanumeric user ID and password by voice. For example, when the user speaks “kyu”, the smart speaker cannot determine whether the “kyu” expresses the number “9” or the English letter “Q”. It is quite troublesome for the user to say "numerical characters" and "alphanumeric characters" to distinguish between them. The same applies to the distinction between uppercase letters and lowercase letters. It is quite troublesome for the user to say “upper case” and “lower case” to distinguish them.

  In addition, existing smart speakers do not have a user authentication technology. For this reason, it has been necessary to individually perform user authentication for each application installed in the existing smart speaker. Similarly, existing smart speakers do not support multi-users, so it is necessary to individually support multi-users for each application installed in the existing smart speakers. These things have placed an undue burden on application developers.

  The present invention has been made in view of the above-described problem, and establishes a new user authentication technology suitable for various input devices, and implements the user authentication device equipped with the new user authentication technology, It is an object of the present invention to provide a program to be executed, a program to be executed in the input device, an authentication device, and a computer system including the input device.

  In one aspect of the present invention, a user authentication device of the present invention is a user authentication device that authenticates the user based on a user input input to an input device by a user, and the input device performs authentication based on the user input. Means for receiving the generated passcode; and means for identifying the user based on the received passcode, wherein the passcode is a combination of a predetermined number of authentication factors.

  In one embodiment of the present invention, the passcode is valid only during a predetermined validity period, and the user authentication device determines whether the predetermined validity period of the passcode has expired. Means for determining that the passcode is valid when it is determined that the predetermined validity period of the passcode has not expired, wherein the means for identifying the user includes: If the received passcode is valid, the user may be identified based on the received valid passcode.

  In one embodiment of the present invention, the user authentication device further includes means for performing processing for invalidating the passcode when it is determined that the predetermined validity period of the passcode has expired. You may.

  In one embodiment of the present invention, the user authentication device may further include a unit that automatically generates a valid passcode when the passcode is invalidated.

  In one embodiment of the present invention, the user authentication device is configured to be able to communicate with a user device used by the user, and the valid passcode is generated by the user authentication device. And transmitted from the user authentication device to the user device.

  In one embodiment of the present invention, the apparatus further comprises means for receiving, from the input device, an application ID for identifying an application started by the input device and a device ID for identifying the input device, The means for identifying a user may identify the user based on a set of user authentication information indicating a combination of the received passcode, the received application ID, and the received device ID.

  In one embodiment of the present invention, a database unit is connected to the user authentication device, and the database unit stores a plurality of pieces of user authentication registration information and a plurality of user identifiers, Each of the plurality of user identifiers is associated with one or more of the plurality of user authentication registration information, and each of the plurality of user authentication registration information is a combination of a passcode, an application ID, and a device ID. Wherein the means for identifying the user based on the set of user authentication information includes determining whether information matching the set of user authentication information exists in the stored plurality of user authentication registration information. Means for determining whether or not information matching the set of user authentication information exists in the plurality of stored user authentication registration information. The case may include means for identifying a user identifier corresponding to the information that matches the set of user authentication information in the plurality of user authentication registration information said stored.

  In one embodiment of the present invention, the passcode included in each of the plurality of pieces of user authentication registration information is a valid passcode, and the database unit includes, for each of the user authentication information stored in the database unit, The invalidated passcode may be further stored as passcode history information.

  In one embodiment of the present invention, the user input is at least one of an input by a voice of the user, an input by a touch operation of the user, an input by a gesture of the user, and an input by a line of sight of the user. You may.

  In one embodiment of the present invention, the authentication factor may be at least one of a word, a symbol, and information indicating a gesture.

  In one aspect of the present invention, a program of the present invention is a program executed in a user authentication device that performs authentication of the user based on a user input input by a user to an input device, wherein the user authentication device includes: It is configured to be able to communicate with an input device, the user authentication device includes a processor unit, the program, when executed in the processor unit, by the input device based on the user input Receiving the generated passcode and identifying the user based on the received passcode is performed by the processor unit, and the passcode has a predetermined number of authentications. It is a combination of elements.

  In one aspect of the present invention, a user authentication device of the present invention is a user authentication device that authenticates the user based on a user input input by a user to an input device, wherein the user authentication device is used by the user. Configured to be able to communicate with the user device and the input device, wherein the user authentication device receives a passcode generated by the input device based on the user input; Means for receiving the location information of the user from the user device; and means for identifying the user based on the received passcode and the received location information of the user.

  In one embodiment of the present invention, the location information of the user may indicate that the user is located within a predetermined range from the input device.

  In one embodiment of the present invention, the position information of the user includes a user identifier for identifying the user and a device ID for identifying the input device, and the user authentication device includes the input device. Means for receiving a device ID for identifying the user from the input device, wherein the means for identifying the user matches the device ID included in the position information of the user with the device ID provided from the input device. Means for determining whether or not to perform, when it is determined that the device ID included in the position information of the user and the device ID provided from the input device match, based on the received passcode The user may be identified.

  In one embodiment of the present invention, a database unit is connected to the user authentication device, the database unit stores position information of the input device, and a unit for identifying the user includes: Means for determining whether or not the user is located within a predetermined range from the input device based on the position information of the user and the position information of the input device; If it is determined that the user is located within the range, the user may be identified based on the received passcode.

  In one embodiment of the present invention, the user authentication device responds to identifying the user based at least on the received passcode and the location information of the user device. Automatically invalidating a valid passcode in response to identifying the user based at least on the received passcode and the location information of the user device. And a means for generating the information.

  In one embodiment of the present invention, the user authentication device is configured to be able to communicate with an external system that requires user authentication, and the user authentication device has identified the user. In response, the apparatus may further comprise means for providing the user identifier to the external system, whereby the user authentication device may notify the external system that the user is an authenticated user.

  In one embodiment of the present invention, the passcode may be a combination of a predetermined number of authentication factors.

  In one embodiment of the present invention, the authentication factor may be at least one of a word, a symbol, and information indicating a gesture.

  In one embodiment of the present invention, the user input is at least one of an input by a voice of the user, an input by a touch operation of the user, an input by a gesture of the user, and an input by a line of sight of the user. You may.

  In one aspect of the present invention, a program of the present invention is a program executed in a user authentication device that performs authentication of the user based on a user input input by a user to an input device, wherein the user authentication device includes: The user authentication device is configured to be able to communicate with a user device used by a user and the input device, the user authentication device includes a processor unit, and the program is executed by the processor unit, Receiving a passcode generated by the input device based on a user input; receiving the location information of the user from the user device; and receiving the received passcode and the received location information of the user. At least performing identifying the user based on Tsu be performed by the service unit.

  In one aspect of the present invention, a computer system of the present invention is a computer system that authenticates a user based on a user input input to the input device by a user, wherein the computer system includes a user authentication device, an input device The user authentication device is configured to be able to communicate with the input device, the input device generates a passcode based on the user input input to the input device , The input device provides the passcode to the user authentication device, the user authentication device identifies the user based at least on the received passcode, the passcode is a predetermined number of authentication It is a combination of elements.

  In one embodiment of the present invention, the passcode is valid only during a predetermined validity period, and the user authentication device determines whether the predetermined validity period of the passcode has expired. The user authentication device determines that the passcode is valid when it is determined that the predetermined validity period of the passcode has not expired, and identifying the user includes receiving the received passcode. Identifying the user based on the received valid passcode if the valid passcode is valid.

  In one embodiment of the present invention, the user authentication device further executes a process of invalidating the passcode when it is determined that the predetermined validity period of the passcode has expired. May be configured.

  In one embodiment of the present invention, the user authentication device may be configured to further automatically generate a valid passcode when the passcode is invalidated.

  In one embodiment of the present invention, the computer system further includes a user device used by the user, wherein the user authentication device is configured to be able to communicate with the user device, A valid passcode may be generated by the user authentication device and transmitted from the user authentication device to the user device.

  In one embodiment of the present invention, the input device is configured to be able to start an application, and the input device has an application ID for identifying an application started by the input device. Further providing a device ID for identifying the input device to the user authentication device, wherein identifying the user comprises receiving the received passcode, the received application ID, and the received device ID. And identifying the user based on a set of user authentication information indicating a combination with the user authentication information.

  In one embodiment of the present invention, a database unit is connected to the user authentication device, and the database unit stores a plurality of pieces of user authentication registration information and a plurality of user identifiers, Each of the plurality of user identifiers is associated with one or more of the plurality of user authentication registration information, and each of the plurality of user authentication registration information is a combination of a passcode, an application ID, and a device ID. And identifying the user based on the set of user authentication information includes determining whether information matching the set of user authentication information exists in the stored plurality of user authentication registration information. And it is determined that information matching the set of user authentication information exists in the stored plurality of user authentication registration information. The case may include a identifying a user identifier corresponding to the information that matches the set of user authentication information in the plurality of user authentication registration information said stored.

  In one embodiment of the present invention, the passcode included in each of the plurality of pieces of user authentication registration information is a valid passcode, and the database unit includes, for each of the user authentication information stored in the database unit, The invalidated passcode may be further stored as passcode history information.

  In one aspect of the present invention, a computer system of the present invention is a computer system that authenticates a user based on a user input input to the input device by a user, wherein the computer system includes a user authentication device, an input device And means for acquiring the position information of the user, wherein the user authentication device is configured to be able to communicate with the input device, and the input device is configured to input to the input device. Generating a passcode based on the received user input, the input device providing the passcode to the user authentication device, and means for acquiring the position information of the user, The position information of the user obtained by the obtaining means is provided to the user authentication device, and the user authentication is performed. Device may identify the user based at least on the position information of the user, wherein the received passcode said received.

  In one embodiment of the present invention, the location information of the user may indicate that the user is located within a predetermined range from the input device.

  In one embodiment of the present invention, the means for acquiring the position information of the user includes a beacon device provided in the input device, and a user device used by the user, wherein the beacon device includes: The input device automatically transmits a predetermined beacon signal within a predetermined range from the input device, the predetermined beacon signal includes a device ID for identifying the input device, and the user device transmits the predetermined beacon signal. In response to receiving, the user provided the location information of the user to the user authentication device, the location information of the user, a user identifier for identifying the user, and provided from the predetermined beacon device The input device further includes a device ID for identifying the input device to the user authentication device. The user authentication device determines whether the device ID included in the position information of the user matches the device ID provided from the input device, and determines whether the device ID included in the position information of the user matches the device ID included in the position information of the user. If it is determined that the device ID provided by the input device matches, the user may be identified based on the received passcode.

  In one embodiment of the present invention, a database unit is connected to the user authentication device, and the database unit stores location information of the input device, and acquires location information of the user. Means for including the user device, the user device comprising a GPS device, wherein the user device responds to the GPS device obtaining location information of the user device, To the user authentication device, the location information of the user includes location information of the user device, the user authentication device, based on the location information of the user and the location information of the input device, the user Is determined to be within a predetermined range from the input device, and if the user is determined to be within a predetermined range from the input device, In it may identify the user based on the received passcode.

  In one embodiment of the present invention, in response to identifying the user, the user authentication device automatically invalidates the received passcode and automatically renews the valid passcode. May be further executed.

  In one embodiment of the present invention, the computer system is configured to be able to communicate with an external system requiring user authentication, and the user authentication device responds to the identification of the user, The user identifier may be provided to the external system, so that the user authentication device notifies the external system that the user is an authenticated user.

  In one embodiment of the present invention, the external system is one of an electronic payment system that executes a payment process of the user, and a ticketless entrance system that determines whether to permit entry of the user. You may.

  In one embodiment of the present invention, the passcode may be a combination of a predetermined number of authentication factors.

  In one embodiment of the present invention, the authentication factor may be at least one of a word, a symbol, and information indicating a gesture.

  In one embodiment of the present invention, the input device is configured to be able to start an application by the user input, and the input device is configured to identify the application started by the input device. Further providing an application ID and a device ID for identifying the input device to the user authentication device, wherein the user authentication device receives the received passcode, the received application ID, and the received The user may be identified based on a set of user authentication information indicating a combination with a device ID.

  In one embodiment of the present invention, the user input is at least one of an input by a voice of the user, an input by a touch operation of the user, an input by a gesture of the user, and an input by a line of sight of the user. You may.

  In one embodiment of the present invention, the input device may be a smart speaker.

  In one aspect of the present invention, a system of the present invention includes the above-described computer system of the present invention and an external system requiring user authentication.

  In one embodiment of the present invention, the external system is one of an electronic payment system that executes a payment process of the user, and a ticketless entrance system that determines whether to permit entry of the user. You may.

  In one aspect of the present invention, a program of the present invention is a program executed on an input device for authenticating a user, and the input device can communicate with a user authentication device for authenticating a user. The input device includes a processor unit, and the program, when executed in the processor unit, generates a passcode based on a user input input to the input device by the user. And providing the passcode to the user authentication device at least by the processor unit.

  In one embodiment of the present invention, the input device is configured to start the application by a user input input by the user to the input device, and the input device is started by the input device. An application ID for identifying an application and a device ID for identifying the input device may be further provided to the user authentication device.

  In one embodiment of the present invention, the passcode may be a combination of a predetermined number of authentication factors.

  In one embodiment of the present invention, the authentication factor may be at least one of a word, a symbol, and information indicating a gesture.

  In one embodiment of the present invention, the user input is at least one of an input by a voice of the user, an input by a touch operation of the user, an input by a gesture of the user, and an input by a line of sight of the user. You may.

  In one embodiment of the present invention, the input device may be a smart speaker.

  According to the present invention, a user authentication device implementing a new user authentication technology suitable for various input devices, a program executed in the user authentication device, a program executed in the input device, the authentication device, and the input device Can be provided.

The figure which shows an example of the procedure for performing the initial authentication of a user based on the voice of the user input into the input device 220. The figure which shows an example of the procedure for performing a user's payment process based on the user's voice input into the input device 220. The figure which shows an example of the structure of the computer system 200 which implemented the new user authentication technique suitable for various input devices. The figure which shows an example of the structure of the information stored in the authentication information database part 261. The figure which shows an example of the structure of the information stored in the passcode database part 262. The figure which shows an example of the structure of the information stored in the initial authentication unnecessary database part 263. The figure which shows an example of the structure of the information stored in the input device position database part 264. FIG. 4 is a diagram illustrating an example of a flow of processing executed in a computer system 200 that performs user authentication. The figure which shows another example of the flow of the process performed in the computer system 200 which performs user authentication. Diagram showing an example of a partial flow of a process for generating a passcode The figure which shows a part of example of the flow of the process performed in the computer system 200 which performs user authentication, and the electronic payment system 270. The figure which shows a part of example of the flow of the process performed in the computer system 200 which performs user authentication, and the electronic payment system 270. The figure which shows a part of example of the flow of a process performed in the computer system 200 which performs user authentication, and the ticketless entrance system 280. The figure which shows a part of example of the flow of a process performed in the computer system 200 which performs user authentication, and the ticketless entrance system 280.

  Hereinafter, terms used in the present specification will be defined.

  “Application” refers to an application program that is installed on a device or stored on the cloud. The application program is different from a program for an operating system (OS) for controlling a basic operation of the device, and is a program for controlling an applied operation of the device.

  “Application ID” refers to an identifier for identifying an application.

  “Input device” refers to a device having an input interface for inputting information. The format of the input information does not matter. For example, the input format may be a text format, a voice format, a design format, a gesture format, or a line-of-sight format.

  “Device ID” refers to an identifier for identifying an input device. It is not essential that one device ID is assigned to one input device. A plurality of device IDs may be assigned to one input device. The number of “device IDs” assigned to one input device does not matter as long as it functions as an identifier for identifying the input device.

  “Passcode” refers to an authentication code representing a user input input to the input device. The data format of the passcode does not matter. For example, the data format of the pass code may be a character code format or a binary code format.

  “Audio passcode” refers to a passcode representing audio input to the input device.

  The “smart speaker” is an example of an input device having a voice recognition unit, and refers to a speaker having a function of responding to a command input by voice and outputting the result of executing the command in voice.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

1. New user authentication technology suitable for input device capable of voice input The applicant proposes a new user authentication technology suitable for an input device capable of voice input as an example of various input devices.

FIG. 1A shows an example of a procedure for performing initial authentication of a user based on a voice of the user input to the input device 220. Initial authentication of the user is required the first time the user uses an input device 220 that the user has not used before, or the first time the user uses an application that the user has not used before. That is, initial authentication of the user is required when at least one of the input device 220 or the application is used for the first time. User initial authentication of is performed using a user device 240 _1. Here, it is assumed that the application is installed in the input device 220. Hereinafter, each step shown in FIG. 1A will be described.

Step S101: the screen of the user device 240 _1, the voice passcode 110 required for user authentication is displayed. The user can see the voice passcode 110 and know what the currently valid voice passcode is. In the example shown in Figure 1A, voice passcode 110 displayed on the screen of the user device 240 ₁ is "Good morning Sunflower" (i.e., a combination of a word and the word "good morning", "sunflower"). Therefore, the user can recognize that the currently valid voice passcode is “Good morning sunflower”. Further, the screen of the user device 240 ₁ includes a timer 120 for informing the effective period of the voice path code 110 to the user, and a reload button 130 for re-issue the voice passcode is further displayed. The reload button 130 is configured to be selectable. When the user selects the reload button 130, valid speech passcode is currently disabled, the new voice path code is automatically generated and displayed on the screen of the user device 240 _1. This new voice passcode becomes the currently valid voice passcode.

Step S102: the user utters toward the input device 220 a voice path code 110 displayed on the screen of the user device 240 _1. The voice 140 uttered toward the input device 220 is input to the input device 220 and is recognized by the input device 220. Before the user utters the voice 140, the user utters a predetermined sentence (that is, a fixed sentence) such as “Please authenticate the user” by voice, and the input device 220 , The mode of the input device 220 may be switched to a user authentication mode (that is, a mode for recognizing a voice passcode). Alternatively, the user may utter the voice 140 in response to a request for user authentication from the input device 220 by voice output from the input device 220 such as “Please say your passcode”. Alternatively, the input device 220 may execute a process of automatically switching the mode of the input device 220 to a user authentication mode (that is, a mode for recognizing a voice passcode) when the input device 220 is activated.

Step S103: the screen of the user device 240 ₁ is displayed an area 150 for confirming authorization. When the “Yes” button in the area 150 is selected, a process of approving the user who has spoken the voice passcode as a valid user is executed. When the process of approving the user who has spoken the voice passcode as a valid user is completed, the process of authenticating the user is completed. If the “No” button in area 150 is selected, the process of approving the user who uttered the voice passcode as a valid user is not executed (as a result, the process of authenticating the user ends).

In this embodiment, it has been described that, in response to the selection of the “Yes” button in the area 150, the process of approving the user who uttered the voice passcode as a valid user is performed. However, the present invention is not limited to this. For example, the location information of the user device 240 ₁ (eg, GPS information acquired by the position sensor that the user device 240 ₁ is provided) using a processing is executed to authorize the user who uttered the speech passcode as a legitimate user You may do so. More specifically, the user device 240 position ₁ constant region (e.g., from the position of the input device 220 a certain range) in response to the presence of the legitimate user who uttered the speech passcode The process of approving as a user may be executed.

Step S104: In step S103, by completing the process of approving the user who uttered the voice passcode as a valid user, when the process of authenticating the user is completed, the user is informed that the process of authenticating the user is completed. Can be For example, by outputting a sound indicating that the process of authenticating the user has been completed (for example, a sound of “Hello, San,”) from the input device 220, the user can be notified that the process of authenticating the user has been completed. It may be. Alternatively, by displaying the text to the effect that the process of authenticating the user has completed the screen of the user device 240 _1, it may be tell that the process of authenticating the user completes the user. A setting may be made so that the user is not notified that the process of authenticating the user is completed.

When the user uses the input device 220 for the second time or later, or when the user uses the application for the second time or later, the procedure for authenticating the user is as follows: Step S101 → Step S102 → Step S104 It is. That is, the user simply utters toward the input device 220 a voice path code 110 displayed on the screen of the user device 240 _1, it is possible to complete simple user authentication.

  Further, when the user uses the input device 220 for the second time or later, or when the user uses the application for the second time or later, the user authentication is not necessarily required. For example, re-authentication may not be required during a predetermined time after the user authentication is completed.

  Thus, according to the new user authentication technique of FIG. 1A proposed by the applicant, it is possible to assign a voice passcode to the user using the input device. The user can easily authenticate the user by speaking the voice passcode toward the input device. Therefore, it can be said that this new user authentication technology is a user authentication technology suitable for an input device capable of voice input. Further, the user can speak the voice passcode toward the input device while viewing the voice passcode displayed on the user device. Therefore, the user does not need to remember information necessary for user authentication (that is, a voice passcode). Accordingly, it is possible to avoid a situation where the user cannot be authenticated because the user has forgotten information necessary for the user authentication.

  In addition, according to the new user authentication technique of FIG. 1A, when one input device is used by a plurality of users, it is possible to assign different voice passcodes to each of the plurality of users. This makes it possible to identify a plurality of users using one input device by using the voice passcode (without using voiceprint authentication of voice).

2. New user authentication technology that can be used for electronic payment The applicant proposes a new user recognition technology that can be used for electronic payment. The new user authentication technology described below with reference to FIG. 1B is intended to further improve the security of the user authentication technology described above with reference to FIG. 1A.

FIG. 1B shows an example of a procedure for performing a user's electronic payment processing based on a user's voice input to the input device 220. Electronic payment processing user applications (e.g., applications for electronic payment) and the input device 220 is installed, is performed by using the user device 240 _1. Hereinafter, each step shown in FIG. 1B will be described. In FIG. 1B, the same elements as those shown in FIG. 1A are denoted by the same reference numerals.

Step S101 ': the screen of the user device 240 _1, the voice passcode 110 required for user authentication is displayed. The user can see the voice passcode 110 and know what the currently valid voice passcode is. In the example shown in FIG. 1B, voice passcode 110 displayed on the screen of the user device 240 ₁ is "Good morning Sunflower" (i.e., the combination of the word and the word "good morning", "sunflower"). Therefore, the user can recognize that the currently valid voice passcode is “Good morning sunflower”. The input device 220 is installed near a place where the user performs electronic payment (for example, in front of a cash register in a convenience store, on a counter in a restaurant, or the like). When the user desires electronic payment such as card payment or electronic money payment, a voice for notifying the payment amount and a voice for requesting the input of the passcode are output from the input device 220. In the example shown in FIG. 1B, a voice saying “It will be $ ¥. Please speak your passcode.” Is output from the input device 220. Thereby, the user can grasp the payment amount and the timing of inputting the passcode by voice.

Step S102 ': The user utters toward the input device 220 a voice path code 110 displayed on the screen of the user device 240 _1. The voice 140 uttered toward the input device 220 is input to the input device 220 and is recognized by the input device 220.

Step S103 ′: When the processing for authenticating the user is completed and the electronic payment processing for the user is completed, the user is notified that the electronic payment processing for the user is completed. For example, a sound indicating that the user's electronic payment processing has been completed (for example, a sound indicating that "payment is completed.") Is output from the input device 220, thereby notifying the user that the user's electronic payment processing has been completed. You may do so. Alternatively, by displaying the text to the effect that the electronic payment process for the user is completed on the screen of the user device 240 _1, may be informing of the settlement process of the user completes the user. A setting may be made so that the user is not notified that the electronic payment processing is completed. The user may be notified that the user's electronic payment processing has been completed, and may be notified that the passcode is automatically reloaded (newly generated). For example, by outputting a sound indicating that the passcode is automatically reloaded (for example, a sound saying “Reload passcode.”) From input device 220, it is determined that the passcode is automatically reloaded. You may make it notify a user. Alternatively, by displaying the text to the effect that the passcode is automatically reloaded on the screen of the user device 240 _1, it may be tell that the passcode is automatically reloaded to the user. A setting may be made so that the user is not notified that the passcode is automatically reloaded.

Step S104 ′: When the electronic payment processing of the user is completed, the used passcode is invalidated, and a valid passcode is newly generated. Valid passcode newly generated is displayed on the screen of the user device 240 _1. In the example shown in FIG. 1B, the used passcode “Ohayo Himawari” is invalidated and the newly generated valid passcode “Inu-macha (that is, the words“ inu ”and“ macha ”) the combination of) is displayed on the screen of the user device 240 _1.

  The user can authenticate the user by using the newly generated valid passcode “Inu-ma-cha”. This newly generated valid passcode "Inuma Mach" can be used when performing user authentication according to the procedure illustrated in FIG. 1A, and performing user authentication according to the procedure illustrated in FIG. 1B. It can also be used in cases. Similarly, a new passcode automatically generated by the user selecting the reload button 130 can also be used when authenticating the user according to the procedure shown in FIG. It can also be used when performing user authentication in the procedure shown.

  Thus, according to the new user authentication technology described above with reference to FIG. 1B, the user can easily perform the electronic payment procedure by speaking the voice passcode toward the input device. It is. Further, the user can speak the voice passcode toward the input device while viewing the voice passcode displayed on the user device. Therefore, the user does not need to remember information necessary for electronic payment (that is, a voice passcode). Therefore, it is possible to avoid a situation in which the user cannot perform the electronic payment procedure due to forgetting the information necessary for the electronic payment.

  Further, according to the new user authentication technique described above with reference to FIG. 1B, in order to perform user authentication, user position information is required in addition to a voice passcode based on a voice uttered by the user. Accordingly, even if the voice passcode is leaked to a third party for some reason (for example, a person around the user has stolen the passcode displayed on the screen of the user device), As long as the location information of the third party does not match the location information of the user, "spoofing" by the third party can be prevented. As described above, the new user authentication technology described above with reference to FIG. 1B is more effective than the user authentication technology described above with reference to FIG. 1A as a countermeasure when the voice passcode is leaked to a third party. It can be said that the security of the user authentication is further improved in the point of taking the above.

Further, the scope of use of the new user recognition technology described above with reference to FIG. 1B is not limited to electronic payment. The new user authentication technology described above with reference to FIG. 1B can be used in various systems that require higher security. For example, the new user authentication technology described above with reference to FIG. 1B can also be used in a ticketless entry system that determines whether a user is permitted to enter. Specifically, when requested speech passcode from the gate device the input device 220 is built, the user toward the passcode that appears on the screen of the user device 240 ₁ on the gate device utterance Then, a process of determining whether or not the user is permitted to enter is performed. If the user is permitted to enter, the gate is automatically opened, and the user can enter as it is. It is. The realization of such a ticketless admission system eliminates the need for ticket purchases and makes it easier to enter from the entrance, so there is no large queue that occurs at the entrance or ticket purchase window. It is possible to reduce.

  In the embodiment described above with reference to FIG. 1A, the example of the user authentication based on the voice passcode generated by the input device 220 based on the voice of the user has been described, but the present invention is not limited to this. The user authentication of the present invention is not limited to authentication using a voice passcode, but can be realized using an arbitrary passcode. The same applies to the embodiment described above with reference to FIG. 1B.

  For example, when the input device is a device having a touch-detectable screen, such as a tablet terminal, the user touches the screen from among a large number of options displayed on the screen and a plurality of predetermined areas on the screen. Is selected, an input to the input device is performed, and the user is authenticated using a passcode indicating a set of authentication factors (for example, words, symbols) corresponding to each of the selected plurality of predetermined regions. Is also good. In addition, for example, by arranging the authentication elements in the order in which a plurality of predetermined areas are selected, a permutation of the plurality of authentication elements may be used as the passcode.

  For example, if the input device is a device capable of recognizing a user's gesture, the user performs input to the input device by performing a plurality of types of gestures toward the input device, and the input device recognizes a plurality of types of input devices. User authentication may be performed using a passcode indicating a set of authentication factors (for example, information indicating a gesture) corresponding to each gesture. Further, for example, by arranging authentication elements in the order in which a plurality of types of gestures are recognized, a permutation of the plurality of authentication elements may be used as the passcode.

  For example, if the input device is a device that can recognize the position of the user's line of sight, the user performs input to the input device by moving the line of sight over some of the plurality of predetermined regions, User authentication may be performed using a passcode indicating a set of authentication factors (for example, words and symbols) corresponding to each of a plurality of positions of the user's line of sight recognized by the input device. More specifically, for example, the user indicates the position of the user's line of sight on some of the plurality of regions displayed on the VR using an input device having virtual reality (VR) technology. An input to the input device is performed by selecting a marker by leaving it for a predetermined time or more, and a path indicating a set of authentication factors (for example, words, symbols) corresponding to each of the plurality of selected predetermined regions. User authentication may be performed using a code. Also, for example, by arranging the authentication elements in the order in which the position of the user's line of sight is recognized, the permutation of the plurality of authentication elements may be used as the passcode.

2. Configuration of Computer System FIG. 2 shows an example of the configuration of a computer system 200 that implements a new user authentication technique suitable for various input devices.

Computer system 200 includes a user authentication server 210 to authenticate the user, an input device 220, the application server apparatus 230, and at least one user device ₂₄₀ 1 to 240 _N. The user authentication server 210 via the Internet 250, an input device 220, the application server apparatus 230 is configured so as to be able to communicate with each of the at least one user device ₂₄₀ 1 to 240 _N. Here, N is an integer of 1 or more.

  In the example illustrated in FIG. 2, the user authentication server device 210 includes an interface unit 211, a processor unit 212 including one or more CPUs (Central Processing Units), and a memory unit 213. The hardware configuration of the user authentication server device 210 is not particularly limited as long as the function can be realized, and may be configured by a single machine or a combination of a plurality of machines. .

Interface unit 211, an input device 220, the application server apparatus 230, and controls the communication between each of the at least one user device ₂₄₀ 1 to 240 _N.

  The memory unit 213 stores a program required to execute a process, data required to execute the program, and the like. Here, it does not matter how the program is stored in the memory unit 213. For example, the program may be preinstalled in the memory unit 213. Alternatively, the program may be installed in the memory unit 213 by being downloaded via a network such as the Internet 250, or may be installed in the memory unit 213 via a storage medium such as an optical disk or a USB. You may do so.

  The processor unit 212 controls the operation of the entire user authentication server device 210. The processor unit 212 reads out a program stored in the memory unit 213 and executes the program. Thus, the user authentication server device 210 can function as a device that executes a desired step.

  The user authentication server device 210 is connected to the database unit 260. The database section 260 includes an authentication information database section 261, a passcode database section 262, an initial authentication unnecessary database section 263, and an input device position database section 264.

  In the example illustrated in FIG. 2, the input device 220 includes an interface unit 221, a processor unit 222 including one or more CPUs (Central Processing Units), a memory unit 223, and voice recognition for recognizing a voice uttered by the user. Unit 224 and a sound output unit 225 for outputting sound. Note that the configurations of the interface unit 221, the processor unit 222, and the memory unit 223 of the input device 220 are the same as the configurations of the interface unit 211, the processor unit 212, and the memory unit 213 of the user authentication server device 210, respectively. A detailed description thereof will be omitted.

  In the example shown in FIG. 2, a beacon device 226 is attached to the input device 220. The beacon device 226 is configured to transmit a predetermined beacon signal within a predetermined range from the input device 220.

  Input device 220 may be a wireless device equipped with artificial intelligence (AI). An example of the input device 220 is a smart speaker, but the present invention is not limited to this. The input device 220 may be any type of computer having a voice recognition unit (for example, a personal computer such as a desktop PC, a laptop PC, or a notebook PC, or a mobile phone, a smartphone, a tablet terminal, a smart glass, a smart watch terminal, or the like). Portable wireless terminal). Also, although not shown in FIG. 2, the input device 220 may be capable of responding to various inputs from the user, for example, in addition to or instead of the voice recognition unit, for example, by touching by the user. It may further include a touch detection unit for detecting an operation, a gesture recognition unit for recognizing a gesture by the user, a gaze recognition unit for recognizing a position of a gaze of the user, and the like.

  The input device 220 is configured to be able to start an application. For example, when the input device 220 is a smart speaker, the activation of the application may be performed by the input device 220 recognizing an application activation instruction by a user's voice. Alternatively, when the input device 220 is a personal computer, starting the application means that the input device 220 has recognized an application start command by a user's operation (for example, the input device 220 allows the user to perform a predetermined operation by mouse operation). (Detecting that the area has been clicked).

  The application server device 230 manages an application started by the input device 220. The application may be installed on the input device 220, may be installed on the application server device 230, or may be stored on a cloud connected via a network.

Each of the at least one user device 240 ₁ to 240 _N is configured to be able to communicate with the user authentication server device 210 via the Internet 250. For example, each of the at least one user device 240 ₁ to 240 _N may be any type of computer having a communication interface (eg, a mobile wireless terminal such as a mobile phone, a smartphone, a tablet terminal, a smart glass, a smart watch terminal, or A personal computer such as a desktop PC, a laptop PC, and a notebook PC. Further, each of at least one of the user devices 240 ₁ to 240 _N may include a GPS device (not shown) for transmitting a GPS signal. Providing a GPS device allows the user device to provide location information of the user device.

  The user authentication device 210 of the computer system 200 is configured to be able to communicate via the Internet 250 with an external system that requires user authentication. Examples of external systems that require user authentication include, but are not limited to, an electronic payment system 270 that performs electronic payment processing of the user, and a ticketless entrance system 280 that determines whether to permit entry of the user. .

In the embodiment shown in FIG. 2, the user authentication server device 210 can communicate with each of the input device 220, the application server device 230, and at least one of the user devices 240 ₁ to 240 _N via the Internet 250. Although described as being present, the invention is not so limited. Any type of network can be used instead of the Internet 250. Further, in the embodiment shown in FIG. 2, the communication between the components included in the computer system 200 is realized through the same network (that is, the Internet 250), but the present invention is not limited to this. The communication between the components included in the computer system 200 may be realized through the same network, may be realized through a partially different and separate network, or may be realized through all of the separate networks. It may be realized.

  Further, in the embodiment shown in FIG. 2, the database unit 260 is provided outside the user authentication server device 210, but the mode is not limited. For example, the database unit 260 may be configured as a single external hard disk device of the user authentication server device 210, or may be configured as a storage on a cloud connected via a network. Alternatively, the database unit 260 can be provided inside the user authentication server device 210. The configuration of the database unit 260 is not limited to a specific hardware configuration. For example, the database unit 260 may be configured by a single hardware component, or may be configured by a plurality of hardware components. Furthermore, the configuration of each database unit included in the database unit 260 is not limited to a specific hardware configuration. For example, each database unit included in the database unit 260 may also be configured by a single hardware component, or may be configured by a plurality of hardware components.

  FIG. 3A shows an example of the configuration of information stored in the authentication information database unit 261.

  The authentication information database 261 stores a plurality of user authentication registration information. Each of the plurality of pieces of user authentication registration information is a set of a passcode, an application ID, and a device ID. In the example shown in FIG. 3A, a set of a passcode, an application ID, and a device ID is shown in each row. That is, in the example shown in FIG. 3A, a set of (first passcode, first application ID, first device ID) is shown on the first line, and (2nd passcode, first A set of (1 application ID, 1st device ID) is shown on the second line, and a set of (3rd passcode, 1st application ID, 2nd device ID) is on the 3rd line. , And a set of (fourth passcode, second application ID, first device ID) is shown in the fourth row.

  In the example shown in FIG. 3A, the fifth line of the authentication information database unit 261 shows only the fifth passcode. This means that the fifth passcode is a passcode generated for the initial authentication of the user. When the initial authentication of the user is completed, the user authentication server device 210 stores the application ID and the device ID on the same line as the line where the fifth passcode is stored (that is, the fifth line). This process will be described in detail with reference to FIG.

  The first to fifth passcodes are valid passcodes. For example, when the first passcode becomes invalid, the newly generated sixth passcode is replaced with the first passcode on the first line of the authentication information database unit 261. Alternatively, in the authentication information database unit 261, the user authentication server device 210 deletes the set of (first passcode, first application ID, first device ID), and deletes the set (6th passcode, first Of the application ID and the first device ID) may be newly generated.

  FIG. 3B shows an example of the configuration of information stored in the passcode database unit 262.

  The passcode database unit 262 stores information on passcodes. The information related to the passcode is associated with information for identifying the user (for example, a user ID). The passcode database unit 262 further stores valid passcodes, passcode history information, user position information, and user personal information (for example, member information).

  When the valid passcode becomes invalid, the passcode updating process is executed by the user authentication server device 210. Specifically, when the valid passcode becomes invalid, the invalidated passcode is stored in the passcode database unit 262 as passcode history information, and a new passcode is generated as a valid passcode. Then, it is stored in the passcode database unit 262.

  In this way, by storing the invalidated passcode as passcode history information in the passcode database unit 262, the user authentication server device 210 can store the valid passcode and the valid passcode. By comparing with the corresponding passcode history information, for example, user A who is currently trying to perform user authentication using a valid passcode “Inu Black Hole” uses a currently invalid passcode “Ohyou Himawari” Thus, it can be determined that the user is the same as the user A who has authenticated the user in the past.

  FIG. 3C shows an example of the configuration of information stored in the initial authentication unnecessary database unit 263.

  The initial authentication unnecessary database unit 263 stores a pair of an application ID and a device ID for which the initial authentication processing is unnecessary. In the example shown in FIG. 3C, a pair of an application ID and a device ID is shown in each row. That is, in the example shown in FIG. 3C, the pair of (first application ID, first device ID) is shown in the first row, and the pair of (first application ID, second device ID) The pair is shown on the second line, and the pair (second application ID, first device ID) is shown on the third line.

  FIG. 3D shows an example of a configuration of information stored in the input device position database unit 264.

The input device position database 264 stores information indicating the position where the input device is installed. In the example illustrated in FIG. 3D, information indicating the position where the input device is installed is indicated by a pair of the device ID of the input device and the location (latitude, longitude) of the input device. Specifically, a pair of (first device ID, (latitude α ₁ , longitude β ₁ )) is shown in the first line, and (second device ID, (latitude α ₂ , longitude β ₂₎ ) Is shown on the second line, and the (third device ID, (latitude α ₃ , longitude β ₃ ) pair is shown on the third line.

  The location (latitude and longitude) of the input device may be registered in advance and updated manually (that is, in response to an input from the user), or may be updated in real time using a GPS signal or the like. It may be automatically updated at any time.

3. Processing in Computer System FIG. 4 shows an example of the flow of processing executed in the computer system 200 for performing user authentication. These processes, for example, the user authentication server 210, an input device 220, the application server apparatus 230 is executed by the processor unit included in each of the user devices 240 _1. Each component of the computer system 200 executes the processing shown in FIG. 4 to realize the initial authentication of the user. Hereinafter, each step shown in FIG. 4 will be described.

Step S401: the user device 240 ₁ requests transmission of the passcode to the user authentication server 210. It does not matter how the requested processing is performed. For example, a process of request may be executed in response to a predetermined application program which has previously been installed on the user device 240 ₁ user launches. Alternatively, the requested process may be executed in response to an input from the user (for example, a user tapping on a predetermined area displayed on a screen that is both a display unit and an input unit). Alternatively, the requested processing may be automatically executed periodically. Further, the requesting process may be executed together with transmitting the user name input by the user. The user name is used for notifying the user of the completion of the user authentication after the completion of the user authentication by voice output of the user name. May be used. Furthermore, the user device 240 _1, when requesting the transmission of the passcode to the user authentication server 210, provides a user identifier (user ID) to the user authentication server 210. An example of a user identifier (user ID), the user device 240 _first UDID (Unique Device Identifier), is a mail address of the user device 240 ₁ is not limited to this.

Step S402: the user authentication server 210 receives a transmission request for passcode from the user device 240 _1.

  Step S403: The user authentication server device 210 generates a valid passcode in response to receiving the transmission request of the passcode. Here, the generated passcode is a unique passcode that has never been generated or used in the past. An example of a valid passcode generated in step S403 is the fifth passcode shown in the fifth line of the authentication information database unit 261 described with reference to FIG. 3A.

  Alternatively, the passcode generated in step S403 can regenerate and reuse a passcode that has been generated or used in the past by resetting the use history of the passcode after a certain period of time has elapsed. It may be something.

  Step S404: After generating a valid passcode, the user authentication server device 210 temporarily registers the passcode in the authentication information database unit 261. For example, as shown in FIG. 3A, the user authentication server device 210 updates the authentication information database unit 261 so as to generate the fifth line of the authentication information database unit 261, thereby validating the fifth passcode. Temporarily register as a passcode. At this time, the valid passcode is also stored in the passcode database unit 262 in a state associated with the user ID. Thus, the user authentication server device 210 refers to the authentication information database unit 261 and the passcode database unit 262, and recognizes that the passcode generated in step S403 is a passcode for initial authentication of the user. It is possible to recognize that the user ID received in step S401 is a user ID for initial authentication of the user.

Step S405: the user authentication server 210 provides a passcode generated in step S403 to the user apparatus 240 _1.

  In the example shown in FIG. 4, it has been described that the process of step S405 is performed after the process of step S404, but the present invention is not limited to this. The processing of step S404 may be performed after the processing of step S405.

Step S406: the user device 240 ₁ receives the passcode from the user authentication server 210.

Step S407: the user device 240 ₁ presents the passcode received at step S406 to the user. An example of this process, as described with reference to step S101 of FIG. 1A, the passcode (e.g., "good morning sunflower") is to display to the screen of the user device 240 _1.

  Note that, at an arbitrary timing after step S407 and before step S408, as described above, the process of switching the mode of the input device 220 to the user authentication mode (that is, the mode for recognizing the passcode) is executed. You may make it. Such processing can be executed in response to an arbitrary behavior of the user. For example, such a process may be executed in response to activating the input device 220 by pressing a power button of the input device 220. Alternatively, such a process may be executed in response to the user uttering a predetermined sentence (that is, a fixed sentence) such as “Please authenticate the user” by voice.

  Step S408: The input device 220 receives an input by the user (user input). The user input is, for example, an input by a voice uttered by the user, an input by a user's touch operation, or an input by a user's line of sight, but the present invention is not limited to these. The user input is a combination of a predetermined number (for example, two, three) of authentication factors (for example, words and / or symbols). The user input includes, for example, a combination of the words “good morning” and “sunflower”, a combination of the words “inu” and “black hole”, a combination of the words “curry” and “chikyu”, and “gakuko”. "," Sensei "and" Hello ", a combination of" rat "and" us ", a combination of" tora "," rabbit "and" tatsu "," right "and" The combination of gestures indicating “lower left” and “upper”, and the combination of gestures indicating “run” and “raise both hands” are not limited to these. This step corresponds to, for example, step S102 in FIG. 1A.

  Step S409: The input device 220 generates a passcode (for example, text data, binary data) based on the user input received in step S408. The passcode is a combination of a predetermined number (eg, two, three) of authentication factors (eg, words and / or symbols) and corresponds to the received user input. That is, for example, when the received user input is a combination of the words "good morning" and "sunflower" by voice, the passcode generated based on the voice is also a combination of "good morning" and "sunflower". It is a combination of words.

  As described above, by performing user authentication using a user input (particularly, voice input) of a predetermined number of combinations of words and / or symbols, a conventional user input of a combination of a plurality of alphanumeric characters (particularly, voice input) The user input required for the user authentication can be simplified as compared with the case where the user authentication is performed using ()).

  It should be noted that the passcode is generally a permutation (i.e., a set including the order of words) or a combination (i.e., a set including the order of words) of some 20,000 words (e.g., two or three) out of about 20,000 words learned by elementary school children. , A set that does not include the order of words), but the present invention is not limited to this. The passcode may be, for example, a permutation or combination of some (eg, two or three) words of about 40,000 words that are generally learned by junior high school students, or generally by high school students. May be a permutation or combination of some (eg, two or three) of the approximately 450,000 words learned in, or generally, approximately 50,000 words learned by a college student. (For example, two or three).

  Step S410: The input device 220 provides the passcode, the application ID, and the device ID generated in step S409. Here, the application ID is an identifier of an application started by the input device 220, and the device ID is an identifier of the input device 220. As described above, the input device 220 can provide the application ID and the device ID because the input device 220 knows the application ID and the device ID. In the example illustrated in FIG. 4, the input device 220 provides the passcode, the application ID, and the device ID to the application server device 230.

  In step S410, the timing of providing the passcode, the timing of providing the application ID, and the timing of providing the device ID may be the same or different. For example, three data of a passcode, an application ID, and a device ID may be provided at different timings. Alternatively, at least two of these three data may be provided at the same timing.

  Step S411: The application server device 230 receives the passcode, the application ID, and the device ID from the input device 220 and transfers them to the user authentication server device 210. When the three data of the passcode, the application ID, and the device ID are provided at different timings, the application server device 230 sends the three data to the user authentication server device 210 in the order of the provided timings. You may make it transfer.

  Step S412: The user authentication server device 210 receives the passcode, the application ID, and the device ID. In the example shown in FIG. 4, the user authentication server device 210 receives a passcode, an application ID, and a device ID from the application server device 230.

  Step S413: The user authentication server device 210 defines a set of (pass code, application ID, device ID) as a set of user authentication information, and the pair of the application ID and the device ID in the set of user authentication information is It is determined whether a plurality of pairs of application IDs and device IDs stored in the initial authentication unnecessary database unit 263 exist in the plurality of pairs. If it is determined that the application ID and the device ID do not exist in a plurality of pairs in the initial authentication unnecessary database unit 263, the application ID and the device ID are stored in the passcode database unit 262 that match the passcode received in step S412. Identify the passcode that is Identifies the user ID corresponding to the constant passcode. Thus, in the next step S414, it is possible to specify the user device to which the user's initial authentication approval request is to be transmitted.

Step S414: the user authentication server 210 transmits an approval request for initial authentication of a user on the user device 240 _1.

Step S415: the user device 240 ₁ receives the approval request of the initial authentication of the user from the user authentication server 210.

Step S416: the user device 240 ₁ presents the approval screen of the user's initial authentication on the user device 240 _1. This step corresponds to, for example, step S103 in FIG. 1A.

Step S417: the user device 240 ₁ receives an input of the user's initial authentication authorization. This is achieved, for example, by selecting the “Yes” button in the area 150 shown in step S103 of FIG. 1A. Alternatively, this may, for example, the position information of the user apparatus 240 ₁ to indicate that the position of the user device 240 ₁ is present in a predetermined area (eg, GPS information acquired by the position sensor that the user device 240 ₁ is provided) With this, the input of the user's initial authentication approval may be made automatically.

Step S418: the user device 240 _1, in response to receiving an input of the user's initial authentication authorization, and transmits a signal indicating that approved in the user authentication server 210.

Step S419: the user authentication server 210 receives a signal indicating that approved by the user device 240 _1.

  Step S420: The user authentication server device 210 stores the set of user authentication information in step S413 in the authentication information database unit 261 as user authentication registration information. It does not matter how the storing process is executed. For example, in the storing process, the fifth line of the authentication information database unit 261 shown in FIG. 3A is deleted, and a set of user authentication information in step S413 is newly stored in the fifth line of the authentication information database unit 261. May be performed. Alternatively, the application ID and the device ID corresponding to the fifth passcode stored in the fifth line of the authentication information database unit 261 shown in FIG. 3A are supplemented in the fifth line of the authentication information database unit 261. May be performed by

Thus, the initial authentication of the user is completed. As a result of the user's initial authentication, so that the user apparatus 240 ₁ and the input device 220 are associated with each other. Therefore, when performing the authentication of the second and subsequent users, the user is able to easily realize the user authentication by reading out the passcode that is presented to the user apparatus 240 _1.

  In the embodiment described above with reference to FIG. 4, an example in which the input device 220 provides the passcode, the application ID, and the device ID to the user authentication server device 210 via the application server device 230 has been described. The invention is not limited to this. The input device 220 may directly provide the passcode, the application ID, and the device ID to the user authentication server device 210 without passing through the application server device 230. In this case, step S411 described above is skipped.

  Further, after step S420, the user authentication server device 210 causes the input device 220 to notify the user that the initial authentication has been completed (for example, a voice output of a message indicating that the initial authentication has been completed is output to the input device 220). (A command to be performed is transmitted to the input device 220).

Further, in the embodiment described above with reference to FIG. 4, an example to complete the initial authentication of the user by the user device 240 ₁ for validation request provided from the user authentication server 210 to perform authorization processing is described However, the present invention is not limited to this. In the user authentication of the present invention, authorization process in the approval request and the user equipment 240 ₁ from the user authentication server 210 may be unnecessary. For example, in response to the reception of the passcode, the application ID, and the device ID, the user authentication server device 210 receives information that matches a set of user authentication information indicating a set of the passcode, the application ID, and the device ID. It is determined whether or not it is stored in the database unit (that is, the authentication information database unit 261 and the passcode database unit 262), and the one that matches the application ID and the device ID is stored in the authentication information database unit 261. If it is determined that a passcode that matches the passcode is stored in the passcode history information in the passcode database unit 262, it is known that the user has been authenticated in the past, and the user A user identifier may be specified and the user may be authenticated.

FIG. 5 shows another example of the flow of processing executed in the computer system 200 for performing user authentication. These processes, for example, the user authentication server 210, an input device 220, the application server apparatus 230 is executed by the processor unit included in each of the user devices 240 _1. Each component of the computer system 200 executes the processing illustrated in FIG. 5, thereby realizing normal authentication of the user (that is, authentication of the user for the second time or later). Hereinafter, each step shown in FIG. 5 will be described. The detailed description of the same steps as those shown in FIG. 4 among the steps shown in FIG. 5 will be omitted. In the example shown in FIG. 5, the application server device 230 is a server device having an authentication process separate from the user authentication server device 210. The user identifier stored in the database unit connected to the authentication server device 210 is shared, whereby the application server device 230 is configured in advance to be able to identify the user using the user identifier. Shall be

  Step S501: The user authentication server device 210 automatically generates a passcode. The passcode generated in step S501 is a valid passcode. Here, the automatically generated passcode is a unique passcode that has never been generated or used in the past. This step corresponds to step S403 in FIG.

  Alternatively, the passcode generated in step S501 can regenerate and reuse a passcode that has been generated or used in the past by resetting the use history of the passcode after a certain period of time has elapsed. May be something.

  Note that a valid period can be set for each passcode. The validity period may be freely set by the user. When the validity period of the passcode expires, the passcode is invalidated. The validity period is, for example, "within 24 hours after the generation of the passcode", "until the passcode is used for user authentication", "until the request for regenerating the passcode is made by the user", and the like. But not limited to them. Therefore, the determination on the validity period of the passcode may be performed by the user authentication server device 210 before step S501. The process of determining the validity period of the passcode will be described later with reference to FIG.

  Step S502: The user authentication server device 210 updates the user authentication registration information stored in the authentication information database unit 261. It does not matter how the updating process is performed. For example, the updating process is performed by combining the passcode newly generated in step S501 with the application ID and the device ID corresponding to the invalidated passcode (the newly generated passcode, application ID, This may be executed by generating a set of (device ID) and storing the set of (newly generated passcode, application ID, device ID) in the authentication information database unit 261 as user authentication registration information. Alternatively, in the update process, in the set of (invalidated passcode, application ID, device ID) stored in the authentication information database unit 261, the invalidated passcode is replaced with the newly generated passcode. It may be performed by substitution.

  Further, a process of storing the passcode newly generated in step S501 as a valid passcode in the passcode database unit 262 is executed.

Step S503: the user authentication server 210 provides a passcode generated in step S501 to the user apparatus 240 _1. This step corresponds to step S405 in FIG.

Step S504: the user device 240 ₁ receives the passcode from the user authentication server 210. This step corresponds to step S406 in FIG.

Step S505: the user device 240 ₁ presents the passcode to the user. This step corresponds to step S407 in FIG.

  Step S506: The input device 220 receives an input (user input) by the user. This step corresponds to step S408 in FIG.

  Step S507: The input device 220 generates a passcode (for example, text data, binary data) based on the voice recognized in step S506. This step corresponds to step S409 in FIG.

  Step S508: The input device 220 provides the passcode, the application ID, and the device ID generated in step S507. This step corresponds to step S410 in FIG.

  Step S509: The application server device 230 receives the passcode, the application ID, and the device ID from the input device 220 and transfers them to the user authentication server device 210. This step corresponds to step S411 in FIG.

  Step S510: The user authentication server device 210 receives the passcode, the application ID, and the device ID. This step corresponds to step S412 in FIG.

  Step S511: The user authentication server device 210 defines a set of (passcode, application ID, device ID) as a set of user authentication information, and performs user identification processing based on the set of user authentication information. Specifically, the user authentication server device 210 stores the application ID and device ID of a plurality of pairs stored in the initial authentication unnecessary database unit 263 in the pair of the application ID and the device ID in the set of user authentication information. In the user authentication information, a pair of the application ID and the device ID in the set of user authentication information exists in the application ID and the device ID of the plurality of pairs in the initial authentication unnecessary database unit 263. If not, it is determined whether or not information matching the set of user authentication information exists in a plurality of pieces of user authentication registration information stored in the authentication information database unit 261. It is determined that information matching the set of user authentication information exists in the plurality of user authentication registration information. In this case, from among a plurality of valid passcodes stored in the passcode database unit 262, a valid passcode that matches a passcode included in a set of user authentication information is specified, and the specified valid passcode is identified. A user identifier (user ID) corresponding to the passcode is specified.

  Step S512: The user authentication server device 210 provides the user identifier. In the example shown in FIG. 5, the user authentication server device 210 provides the user identifier to the application server device 230.

  Step S513: The application server device 230 receives the user identifier from the user authentication server device 210 and transfers it to the input device 220.

  Step S514: The input device 220 receives the user identifier. In the example illustrated in FIG. 5, the input device 220 receives the user identifier from the application server device 230.

  Step S515: The input device 220 executes a process according to the user identifier and the application. It does not matter what processing is executed according to the user identifier and the application. For example, when the input device 220 has activated an application for creating and sending a mail, a process of creating and sending a mail with the user identified by the user identifier as the sender may be executed. Alternatively, when the input device 220 has activated an application for shopping, a process of ordering a product with the user identified by the user identifier as a purchaser of the product may be executed.

  Alternatively, in step S513, the application server device 230 may specify information about the user based on the received user identifier, and provide the information about the user to the input device 220. In this case, in step S514, the input device 220 may receive information about the user, and in step S515, may execute a process according to the information about the user and the application. An example of the processing according to the information about the user and the application is the same as the processing according to the user identifier and the application, and thus detailed description thereof will be omitted.

  In the embodiment described above with reference to FIG. 5, an example in which the user authentication server device 210 provides the user identifier to the input device 220 via the application server device 230 has been described, but the present invention is not limited to this. Not done. The user authentication server device 210 may directly provide the user identifier to the input device 220 without going through the application server device 230. In this case, step S513 described above is skipped.

  Further, in the user identification process of step S511 in FIG. 5, the user identification process is performed based on the user's location information and / or the user's personal information (for example, member information) in addition to a set of user authentication information. You may. As a result, even when there are few variations of the passcode, for example, only users in a specific area (for example, in Japan) are to be authenticated, and only users who have a predetermined membership are to be authenticated. By doing so, it is possible to sufficiently realize user identification for user authentication.

  As described above, the user is authenticated based on the set of the (passcode, application ID, device ID), and the user identifier associated with the passcode is provided to the application server device 230 and eventually to the input device 220. Even if 220 is a device that activates a plurality of applications, the user authentication server device 210 can perform user authentication for each application by performing similar processing for each application. Thereby, it is possible to perform user authentication across a plurality of applications.

  In the embodiment described with reference to FIGS. 4 and 5, an example of user authentication based on a set of user authentication information indicating a set of (passcode, application ID, device ID) has been described. The invention is not limited to this. User authentication may be realized based only on a unique passcode in which the same thing does not exist elsewhere. The unique passcode may be, for example, a passcode that is a single authentication factor or a passcode that is a combination of a predetermined number of authentication factors. Alternatively, the user authentication may be realized based on a combination of a unique passcode and an application ID, or a combination of a unique passcode and a user ID. When user authentication is realized based on a combination of a unique passcode and an application ID or a combination of a unique passcode and a device ID, the user authentication server device 210 Compared to the case where authentication is realized, the accuracy of user authentication can be improved, and past actions of the user (for example, which input device has been logged in in the past) can be processed by the input device after user authentication. It is possible to reflect on

  When the application server device 230 does not have a separate authentication process from the user authentication server device 210 (that is, when the user authentication in the user authentication server device 210 is responsible for the user authentication of the application server device 230). Since the provision of the user identifier means that the user identifiable by the user identifier has been authenticated, the input device 220 identifies the user by using the user identifier, so that the user authenticated It is possible to specify a user.

  FIG. 6 illustrates an example of a partial flow of a process of generating a passcode. This processing is executed by, for example, the processor unit 212 included in the user authentication server device 210. Hereinafter, each step shown in FIG. 6 will be described in detail.

  Step S601: A process for determining whether a predetermined validity period of the passcode has expired is executed. If the result of the determination is “Yes”, the process proceeds to step S602, and if the result of the determination is “No”, the process returns to step S601.

  Step S602: A process of invalidating the passcode is executed. This process includes, for example, storing a valid passcode as passcode history information in the passcode database unit 262 to make the valid passcode an invalid passcode.

  Steps S501, S502, and S602 described above are performed in a state where the user is associated with a specific user ID. That is, the new generation of the passcode in step S501 and the update of the user authentication registration information in step S502 are processes executed for the user ID associated with the passcode that is invalidated in step S602.

7A and 7B show an example of a flow of processing executed in the computer system 200 for performing user authentication and the electronic payment system 270. In the following description, FIG. 7A and FIG. 7B are collectively referred to as FIG. Process shown in FIG. 7, for example, the user authentication server 210, an input device 220, the beacon device 226, the application server apparatus 230, the user device 240 ₁ is executed by the processor unit included in each of the electronic payment system 270. Each component of the computer system 200 and the electronic payment system 270 execute the processing shown in FIG. 7, so that the electronic payment processing of the user can be realized. Hereinafter, each step shown in FIG. 7 will be described. In the example shown in FIG. 7, the user identifier stored in the database unit connected to the user authentication server device 210 is shared between the user authentication server device 210 and the electronic payment system 270. The electronic payment system 270 is configured in advance so that a user can be specified using a user identifier.

  Step S701: The user authentication server device 210 automatically generates a passcode. This step corresponds to step S501 in FIG.

  Step S702: The user authentication server device 210 updates the user authentication registration information stored in the authentication information database unit 261. This step corresponds to step S502 in FIG.

Step S703: the user authentication server 210 provides a passcode generated in step S701 to the user apparatus 240 _1. This step corresponds to step S503 in FIG.

Step S704: the user device 240 ₁ receives the passcode from the user authentication server 210. This step corresponds to step S504 in FIG.

Step S705: the user device 240 ₁ presents the passcode to the user. This step corresponds to step S505 in FIG.

  Step S706: The input device 220 receives an input (user input) by the user. This step corresponds to step S506 in FIG.

  Step S707: The input device 220 generates a passcode (for example, text data, binary data) based on the voice recognized in step S706. This step corresponds to step S507 in FIG.

  Step S708: The input device 220 provides the passcode generated in step S707, the application ID, and the device ID. This step corresponds to step S508 in FIG.

  Step S709: The application server device 230 receives the passcode, the application ID, and the device ID from the input device 220 and transfers them to the user authentication server device 210. This step corresponds to step S509 in FIG.

  Step S710: The user authentication server device 210 receives the passcode, the application ID, and the device ID. This step corresponds to step S510 in FIG.

Step S711: The beacon device 226 provides a predetermined beacon signal within a predetermined range from the beacon device 226 (or the input device 220 provided with the beacon device 226). If the user device is located within the predetermined range, the user device can receive the beacon signal, but if the user device is not located within the predetermined range, , The user equipment is not capable of receiving the beacon signal. As described above, the beacon device 226 determines whether the user device (eg, the user device 240 ₁ ) is in a predetermined range only when the user device (eg, the user device 240 ₁ ) is located within a predetermined range from the input device 220. Can be provided. In the example shown in FIG. 7, it is assumed that the user device 240 ₁ is located from the input device 220 within a predetermined range.

Step S712: the user device 240 ₁ receives a predetermined beacon signal from a beacon device 226. This predetermined beacon signal may include the device ID of the input device 220.

Step S713: the user device 240 _1, in response to receiving a predetermined beacon signal, to provide location information of the user to the user authentication server 210. Position information of this user is information indicating the position of the user, in fact, is information indicating the position of the user device 240 ₁ used by the user (i.e., the position of the user, used by the user It assumes that the user device 240 substantially the _first position equal to be). Location information of the user is information based on predetermined beacon signal provided from the input device 220 within a predetermined range, the user apparatus 240 ₁ that is used by the user is located from the input device 220 within a predetermined range Is shown. Location information of the user, and the device ID of the input device 220 provided by the beacon device 226, a user identifier for identifying the user (e.g., user device 240 _first UDID, or e-mail address of the user device 240 ₁₎ and May be included.

Step S714: the user authentication server 210 receives the location information of the user from the user device 240 _1.

Step S715: The user authentication server device 210 defines the set of (passcode, application ID, device ID) received in step S710 as one set of user authentication information, and sets one set of user authentication information and user location information. Performs a user identification process based on. Specifically, the user authentication server device 210
(A) Determine whether a pair of an application ID and a device ID in a set of user authentication information exists in a plurality of pairs of an application ID and a device ID stored in the initial authentication unnecessary database unit 263. Judge,
(B) If it is determined that a pair of an application ID and a device ID in a set of user authentication information exists in a plurality of pairs of application IDs and device IDs in the initial authentication unnecessary database unit 263, It is determined whether or not information matching the set of user authentication information exists in a plurality of pieces of user authentication registration information stored in the authentication information database unit 261.
If the information that matches the (c) a set of user authentication information is determined to be present in the plurality of user authentication registration information based on the user identifier provided by the user device 240 _1, the position information of the user And whether the device ID provided by the input device 220 matches the device ID included in the
(D) If it is determined that the device ID included in the position information of the user and the device ID provided from the input device 220 match, a plurality of valid passcodes stored in the passcode database unit 262 are stored. Among them, identify a valid passcode that matches the passcode included in the set of user authentication information,
(E) Specify a user identifier (user ID) corresponding to the specified valid passcode.

  Step S716: The user authentication server device 210 provides the user identifier to the electronic payment system 270. Thereby, the user authentication server device 210 notifies the electronic payment system 270 that the user is an authenticated user.

  Step S717: The electronic payment system 270 receives the user identifier from the user authentication server device 210.

  Step S718: The electronic payment system 270 performs a user electronic payment process based on the received user identifier. It does not matter how the electronic payment system 270 executes the electronic payment processing of the user. For example, the electronic payment system 270 identifies the user's account and the payment amount based on the received user identifier, and executes a process of withdrawing the amount corresponding to the payment amount from the user's account. Payment processing may be achieved.

  Step S719: The user authentication server device 210 provides the message to the application server device 230. The message is provided in a format that can be output by the input device 220 (for example, a format that can output audio, a format that can output image). The provided message may be, for example, a message that informs the user that the payment process of the user has been completed, and / or the passcode is automatically reloaded (ie, the passcode received in step S710 is invalidated). , A valid passcode is automatically newly generated).

  Step S720: The application server device 230 receives the message from the user authentication server device 210, and transfers the received message to the input device 220.

  Step S721: The input device 220 receives a message from the application server device 230.

  Step S722: The input device 220 executes processing for reproducing the message received in step S721. This step corresponds to, for example, step 103 'in FIG. 1B.

  Step S723: The user authentication server device 210 executes a process of automatically invalidating the passcode received in step S710. The processing in this step is the same as the processing in step S602 in FIG.

  Step S724: The user authentication server device 210 executes a process of automatically newly generating a valid passcode. The processing in this step is the same as the processing in step 701 in FIG.

  In the above-described embodiment, the processing in steps S711 to S714 is described to be executed after the processing in steps S701 to S710, but the present invention is not limited to this. The processing in steps S711 to S714 may be executed before the processing in steps S701 to S710, or may be executed in time parallel with part of the processing in steps S701 to S710.

  In the above-described embodiment, the processing in steps S716 to S724 is described as being executed in the order of steps S716 to S718, steps S719 to S722, and steps S723 to S724, but the present invention is not limited to this. The order of execution of steps S716 to S718, steps S719 to S722, and steps S723 to S724 is arbitrary.

FIG. 8A and FIG. 8B show an example of a flow of processing executed in the computer system 200 for performing user authentication and the ticketless entry system 280. In the following description, FIG. 8A and FIG. 8B are collectively referred to as FIG. Processing shown in FIG. 8, for example, the user authentication server 210, an input device 220, the application server apparatus 230, the user device 240 ₁ is executed by the processor unit included in each of the ticket-less entry system 280. Each component of the computer system 200 and the ticketless entrance system 280 execute the processing shown in FIG. 8, so that ticketless entrance requiring higher security can be realized. Hereinafter, each step shown in FIG. 8 will be described. In the example illustrated in FIG. 8, the user identifier stored in the database unit connected to the user authentication server device 210 is shared between the user authentication server device 210 and the ticketless entrance system 280. Accordingly, the ticketless entrance system 280 is configured in advance so that a user can be specified using a user identifier. The user device 240 ₁ is assumed to have a GPS device.

  Step S801: The user authentication server device 210 automatically generates a passcode. This step corresponds to step S701 in FIG.

  Step S802: The user authentication server device 210 updates the user authentication registration information stored in the authentication information database unit 261. This step corresponds to step S702 in FIG.

Step S803: the user authentication server 210 provides a passcode generated in step S701 to the user apparatus 240 _1. This step corresponds to step S703 in FIG.

Step S804: the user device 240 ₁ receives the passcode from the user authentication server 210. This step corresponds to step S704 in FIG.

Step S805: the user device 240 ₁ presents the passcode to the user. This step corresponds to step S705 in FIG.

  Step S806: The input device 220 receives an input (user input) by the user. This step corresponds to step S706 in FIG.

  Step S807: The input device 220 generates a passcode (for example, text data, binary data) based on the voice recognized in step S706. This step corresponds to step S707 in FIG.

  Step S808: The input device 220 provides the passcode generated in step S707, the application ID, and the device ID. This step corresponds to step S708 in FIG.

  Step S809: The application server device 230 receives the passcode, the application ID, and the device ID from the input device 220 and transfers them to the user authentication server device 210. This step corresponds to step S709 in FIG.

  Step S810: The user authentication server device 210 receives the passcode, the application ID, and the device ID. This step corresponds to step S710 in FIG.

Step S812: the user device 240 ₁ receives the GPS signals. This can, for example, GPS device included in the user device 240 ₁ (not shown) is accomplished by receiving GPS signals from the satellites.

Step S813: the user device 240 _1, in response to receiving the GPS signals, to provide location information of the user to the user authentication server 210. Position information of this user is information indicating the position of the user, in fact, is information indicating the position of the user device 240 ₁ used by the user (i.e., the position of the user, used by the user It assumes that the user device 240 substantially the _first position equal to be). The position information of the user is generated by a GPS device (not shown) based on a GPS signal, for example. The user position information is represented by, for example, (latitude, longitude).

Step S814: the user authentication server 210 receives the location information of the user from the user device 240 _1.

Step S815: The user authentication server device 210 defines the set of (passcode, application ID, device ID) received in step S810 as one set of user authentication information, and sets one set of user authentication information and user location information. And performs a user identification process. Specifically, the user authentication server device 210
(A) Determine whether a pair of an application ID and a device ID in a set of user authentication information exists in a plurality of pairs of an application ID and a device ID stored in the initial authentication unnecessary database unit 263. Judge,
(B) If it is determined that a pair of an application ID and a device ID in a set of user authentication information exists in a plurality of pairs of application IDs and device IDs in the initial authentication unnecessary database unit 263, It is determined whether or not information matching the set of user authentication information exists in a plurality of pieces of user authentication registration information stored in the authentication information database unit 261.
(C) If it is determined that information matching the set of user authentication information exists in the plurality of pieces of user authentication registration information, the position information of the user received in step S814 and the input device position database unit 264 It is determined whether the user is located within a predetermined range from the input device 220, based on the position information of the input device 220 stored in the
(D) If it is determined that the user is located within a predetermined range from the input device 220, the user authentication information is included in a set of user authentication information among a plurality of valid passcodes stored in the passcode database unit 262. Identify a valid passcode that matches the
(E) Specify a user identifier (user ID) corresponding to the specified valid passcode.

  Step S816: The user authentication server device 210 provides the user identifier to the ticketless entrance system 280. As a result, the user authentication server device 210 notifies the ticketless entrance system 280 that the user is an authenticated user.

  Step S817: The ticketless entrance system 280 receives the user identifier from the user authentication server device 210.

  Step S818: The ticketless entry system 280 executes a user entry permission process based on the received user identifier. It does not matter how the ticketless admission system 280 executes the user admission processing. For example, the ticketless admission system 280 determines whether the user identified by the received user identifier is on the list based on a list of users who can enter the ticketless admission system 280, and If it is determined that the user identified by the given user identifier is on the list, the user is allowed to enter and the gate is opened to achieve the user's entrance permission process. Good.

  Step S819: The user authentication server device 210 provides the message to the application server device 230. The message is provided in a format that can be output by the input device 220 (for example, a format that can output audio, a format that can output image). The message provided may be, for example, a message telling the user that the user has been confirmed to be admitted, and / or the passcode may be automatically reloaded (ie, at step S710). The received passcode is invalidated, and a valid passcode is automatically newly generated).

  Step S820: The application server device 230 receives the message from the user authentication server device 210, and transfers the received message to the input device 220.

  Step S821: The input device 220 receives a message from the application server device 230.

  Step S822: The input device 220 executes processing for reproducing the message received in step S821.

  Step S823: The user authentication server device 210 executes a process of automatically invalidating the passcode received in step S810. The processing in this step is the same as the processing in step S602 in FIG.

  Step S824: The user authentication server device 210 executes a process of automatically newly generating a valid passcode. The processing in this step is the same as the processing in step 801 in FIG.

In step S815 of the above embodiment, based on the position information of the user apparatus 240 ₁ and the location information of the user based on the GPS signals received by the input device 220 stored in the input device position database 264 It has been described that it is determined whether the user is located within a predetermined range from the input device 220, but the present invention is not limited to this. For example, the position information of the user based on the GPS signal by the user apparatus 240 ₁ has received the position information of the input device 220 based on the GPS signals received by the input device 220 with different GPS device and a GPS device provided in the user device 240 ₁ Based on the above, it may be determined whether or not the user is located within a predetermined range from the input device 220. Specifically, also an input device 220, like the user equipment 240 ₁ includes a GPS device, an input device 220 receives a GPS signal (e.g., a GPS device provided in the input device 220 A GPS signal is received from a satellite), and the input device 220 responds to the reception of the GPS signal. Is provided to the user authentication server device 210, and the user authentication server device 210 compares the position information of the user with the position information of the input device 220 to determine whether the user is within a predetermined range from the input device 220. The determination may be made as to whether or not the answer is NO.

  In the above-described embodiment, the processing in steps S812 to S814 is described to be executed after the processing in steps S801 to S810, but the present invention is not limited to this. The processing in steps S812 to S814 may be performed before the processing in steps S801 to S810, or may be performed in time parallel with part of the processing in steps S801 to S810.

  In the above-described embodiment, the processing in steps S816 to S824 has been described as being executed in the order of steps S816 to S818, steps S819 to S822, and steps S823 to S824, but the present invention is not limited to this. The order of execution of steps S816 to S818, steps S819 to S822, and steps S823 to S824 is arbitrary.

  Note that, in the embodiment illustrated in FIG. 7, the electronic payment processing of the user using the beacon device 226 has been described, but the present invention is not limited to this. For example, the user's electronic payment processing may be executed using the GPS device described with reference to FIG. In this case, in the embodiment of FIG. 7, by executing steps S801 to 804 shown in FIG. 8 instead of steps S701 to S704 shown in FIG. 7, the settlement processing of the user using the GPS device is achieved and Can be realized.

  Further, in the embodiment illustrated in FIG. 8, the ticketless entry processing using the GPS device has been described, but the present invention is not limited to this. For example, the ticketless entry process may be executed using the beacon device 226 described with reference to FIG. In this case, in the embodiment of FIG. 8, steps S701 to S704 shown in FIG. 7 are executed instead of steps S801 to S804 shown in FIG. Can be achieved and realized.

  In the embodiment described above with reference to FIGS. 7 and 8, an example of user authentication based on a set of user authentication information indicating a set of (passcode, application ID, device ID) and position information of the user will be described. However, the present invention is not limited to this. User authentication may be realized based only on a unique passcode and the position information of the user, which are not identical. The unique passcode may be, for example, a passcode that is a single authentication factor or a passcode that is a combination of a predetermined number of authentication factors. Alternatively, the user authentication may be realized based on a combination of the unique passcode and the application ID and the position information of the user, or a combination of the unique passcode and the user ID and the position information of the user. When the user authentication is realized based on the combination of the unique passcode and the application ID and the position information of the user, or the combination of the unique passcode and the device ID and the position information of the user, the user authentication server device 210 Compared with the case where user authentication is realized based only on a unique passcode and the user's location information, the accuracy of user authentication can be improved, and the user's past actions (for example, (Login from the device) can be reflected in the processing of the input device after the user authentication.

  In the embodiment described above with reference to FIGS. 4, 5, 6, 7, and 8, the processing of each step shown in FIGS. 4, 5, 6, 7, and 8 is performed by the processor unit. Although the present invention has been described as being realized by a program stored in the memory unit, the present invention is not limited to this. At least one of the processes of each step shown in FIGS. 4, 5, 6, 7, and 8 may be a hardware configuration such as a control circuit.

  As described above, the present invention has been exemplified using the preferred embodiment of the present invention, but the present invention should not be construed as being limited to this embodiment. It is understood that the scope of the present invention should be construed only by the claims. It is understood that those skilled in the art can implement equivalent ranges based on the description of the present invention and common general knowledge from the description of the specific preferred embodiments of the present invention.

  The present invention includes a user authentication device that implements a new user authentication technology suitable for various input devices, a program executed by the user authentication device, a program executed by the input device, the authentication device, and the input device. It is useful as providing a computer system or the like.

Reference Signs List 200 computer system 210 user authentication server device 220 input device 230 application server device 240 ₁ to 240 _N user device 250 internet 260 database unit 270 electronic payment system 280 ticketless entrance system

Claims (30)

A user authentication device that authenticates the user based on a user input input by the user to an input device,
A database unit is connected to the user authentication device,
The database section stores a plurality of user authentication registration information and a plurality of user identifiers, and each of the plurality of user identifiers is associated with one or more of the plurality of user authentication registration information. Has been
Each of the plurality of user authentication registration information is a combination of a passcode, an application ID, and a device ID,
Means for receiving a passcode generated by the input device based on the user input;
Means for receiving, from the input device, an application ID for identifying an application started by the input device, and a device ID for identifying the input device;
Means for identifying the user based on a set of user authentication information indicating a combination of the received passcode, the received application ID, and the received device ID,
The passcode is valid only for a predetermined validity period,
The user authentication device,
Means for determining whether the predetermined validity period of the passcode has expired,
Means for determining that the passcode is valid, when it is determined that the predetermined validity period of the passcode has not expired,
Means for performing a process of invalidating the passcode when it is determined that the predetermined validity period of the passcode has expired,
Means for automatically and automatically generating a valid passcode when the passcode is invalidated;
Further comprising
Means for identifying the user based on the set of user authentication information,
Means for determining whether or not information matching the set of user authentication information is present in the stored plurality of user authentication registration information;
In no event information that matches the set of user authentication information it is determined to be present in the plurality of user authentication registration information said stored, when the received passcode is valid, the received Means for identifying a user identifier corresponding to information that matches the set of user authentication information in the stored plurality of user authentication registration information , based on the valid passcode .
The user authentication device, wherein the passcode is a combination of a predetermined number of authentication factors. The user authentication device is configured to be able to communicate with a user device used by the user,
The user authentication device according to claim 1 , wherein the valid passcode is generated by the user authentication device and transmitted from the user authentication device to the user device. A user authentication device that authenticates the user based on a user input input by the user to an input device,
A database unit is connected to the user authentication device,
The database section stores a plurality of user authentication registration information and a plurality of user identifiers, and each of the plurality of user identifiers is associated with one or more of the plurality of user authentication registration information. Has been
Each of the plurality of user authentication registration information is a combination of a passcode, an application ID, and a device ID,
Means for receiving a passcode generated by the input device based on the user input;
Means for receiving, from the input device, an application ID for identifying an application started by the input device, and a device ID for identifying the input device;
Means for identifying the user based on a set of user authentication information indicating a combination of the received passcode, the received application ID, and the received device ID
With
Means for identifying the user based on the set of user authentication information,
Means for determining whether or not information matching the set of user authentication information is present in the stored plurality of user authentication registration information;
If it is determined that information matching the set of user authentication information is present in the stored plurality of user authentication registration information, the set of the plurality of stored user authentication registration information is determined. Means for identifying a user identifier corresponding to information matching the user authentication information;
Including
The passcode is a combination of a predetermined number of authentication factors,
The passcode included in each of the plurality of user authentication registration information is a valid passcode,
It said database unit, for each user authentication information stored in the database unit, passcode disabled is further stored as history information of the passcode, the user authentication device. Wherein the user input is input by the user voice, input by touching of the user, input by a gesture of the user is at least one of the inputs according to the line of sight of the user, any one of claims 1 to 3 A user authentication device according to claim 1. Wherein the authentication element, word, symbol, at least one of information indicating a gesture, the user authentication device according to any one of claims 1-4. A program executed in a user authentication device that performs authentication of the user based on a user input input to an input device by a user,
The user authentication device is configured to be able to communicate with the input device,
The user authentication device includes a processor unit,
A database unit is connected to the user authentication device,
The database section stores a plurality of user authentication registration information and a plurality of user identifiers, and each of the plurality of user identifiers is associated with one or more of the plurality of user authentication registration information. Has been
Each of the plurality of user authentication registration information is a combination of a passcode, an application ID, and a device ID,
When the program is executed in the processor unit,
Receiving a passcode generated by the input device based on the user input;
Receiving, from the input device, an application ID for identifying an application started by the input device, and a device ID for identifying the input device;
Identifying the user based on a set of user authentication information indicating a combination of the received passcode, the received application ID, and the received device ID. Let
The passcode is valid only for a predetermined validity period,
The processor unit includes:
Determining whether the predetermined validity period of the passcode has expired,
When it is determined that the predetermined validity period of the passcode has not expired, determining that the passcode is valid,
When it is determined that the predetermined validity period of the passcode has expired, performing a process of invalidating the passcode,
When the passcode is invalidated, a new valid passcode is automatically generated automatically.
Causing the processor unit to further execute
Identifying the user based on the set of user credentials comprises:
Determining whether information matching the set of user authentication information is present in the stored plurality of user authentication registration information;
In no event information that matches the set of user authentication information it is determined to be present in the plurality of user authentication registration information said stored, when the received passcode is valid, the received Identifying a user identifier corresponding to information that matches the set of user authentication information in the stored plurality of user authentication registration information based on the valid passcode .
The program, wherein the passcode is a combination of a predetermined number of authentication factors. A user authentication device that authenticates the user based on a user input input by the user to an input device,
The user authentication device is configured to be able to communicate with the user device and the input device used by the user,
The user authentication device,
Means for receiving a passcode generated by the input device based on the user input;
Means for receiving the position information of the user from the user device, wherein the position information of the user includes a user identifier for identifying the user, and a device ID for identifying the input device, When,
Means for receiving from the input device a device ID for identifying the input device,
Means for determining whether the device ID included in the user's location information matches the device ID provided from the input device,
Means for identifying the user based on the received passcode, when it is determined that the device ID included in the user's location information matches the device ID provided from the input device. Authentication device. The user authentication apparatus according to claim 7 , wherein the position information of the user indicates that the user is located within a predetermined range from the input device. The user authentication device,
In response to identifying the user based at least on the received passcode and the location information of the user, means for performing a process of automatically invalidating the received passcode,
And in response to identifying the user based at least on the position information of the user and the received passcode, and means for newly automatically generate a valid passcode claims 7 to 9. The user authentication device according to any one of 8 . The user authentication device is configured to be able to communicate with an external system that requires user authentication,
The external system is a system different from the user authentication device,
The user authentication device further includes means for providing a user identifier for identifying the user to the external system in response to identifying the user, whereby the user authentication device The user authentication device according to any one of claims 7 to 9 , which notifies the external system that the user is an authenticated user. The user authentication according to claim 10 , wherein the external system is one of an electronic payment system that executes a payment process of the user, and a ticketless entrance system that determines whether to permit entry of the user. apparatus. The passcode is a combination of an authentication element of a predetermined number, the user authentication device according to any one of claims 7-11. The user authentication device according to claim 12 , wherein the authentication factor is at least one of information indicating a word, a design, and a gesture. The user input according to any one of claims 7 to 13 , wherein the user input is at least one of an input by a voice of the user, an input by a touch operation of the user, an input by a gesture of the user, and an input by a line of sight of the user. A user authentication device according to claim 1. A program executed in a user authentication device that performs authentication of the user based on a user input input to an input device by a user,
The user authentication device is configured to be able to communicate with the user device and the input device used by the user,
The user authentication device includes a processor unit,
When the program is executed in the processor unit,
Receiving a passcode generated by the input device based on the user input;
Receiving the position information of the user from the user device, wherein the position information of the user includes a user identifier for identifying the user and a device ID for identifying the input device, When,
The user authentication device receives a device ID for identifying the input device from the input device,
Determining whether the device ID included in the user's location information matches the device ID provided from the input device;
When it is determined that the device ID included in the position information of the user matches the device ID provided from the input device, identifying the user based on the received passcode. A program that causes the processor unit to do the above. A computer system for performing authentication of the user based on a user input input to an input device by a user,
The computer system includes a user authentication device and an input device,
The user authentication device is configured to be able to communicate with the input device,
A database unit is connected to the user authentication device,
The database section stores a plurality of user authentication registration information and a plurality of user identifiers, and each of the plurality of user identifiers is associated with one or more of the plurality of user authentication registration information. Has been
Each of the plurality of user authentication registration information is a combination of a passcode, an application ID, and a device ID,
The input device is configured to be able to start an application,
The input device generates a passcode based on the user input input to the input device,
The input device provides the user authentication device with the passcode, an application ID for identifying an application activated by the input device, and a device ID for identifying the input device,
The user authentication device identifies the user based on a set of user authentication information indicating a combination of the received passcode, the received application ID, and the received device ID,
The passcode is valid only for a predetermined validity period,
The user authentication device determines whether the predetermined validity period of the passcode has expired,
The user authentication device, when it is determined that the predetermined validity period of the passcode has not expired, determines that the passcode is valid,
The user authentication device performs a process of invalidating the passcode when it is determined that the predetermined validity period of the passcode has expired,
When the user authentication device invalidates the passcode, a new valid passcode is automatically generated automatically,
The passcode is a combination of a predetermined number of authentication factors,
Identifying the user based on the set of user credentials comprises:
Determining whether information matching the set of user authentication information is present in the stored plurality of user authentication registration information;
In no event information that matches the set of user authentication information it is determined to be present in the plurality of user authentication registration information said stored, when the received passcode is valid, the received Identifying a user identifier corresponding to information that matches the set of user authentication information in the stored plurality of user authentication registration information based on the obtained valid passcode . The computer system further comprises a user device used by the user,
The user authentication device is configured to be able to communicate with the user device,
17. The computer system according to claim 16 , wherein the valid passcode is generated by the user authentication device and transmitted from the user authentication device to the user device. A computer system for performing authentication of the user based on a user input input to an input device by a user,
The computer system includes a user authentication device and an input device,
The user authentication device is configured to be able to communicate with the input device,
A database unit is connected to the user authentication device,
The database section stores a plurality of user authentication registration information and a plurality of user identifiers, and each of the plurality of user identifiers is associated with one or more of the plurality of user authentication registration information. Has been
Each of the plurality of user authentication registration information is a combination of a passcode, an application ID, and a device ID,
The input device is configured to be able to start an application,
The input device generates a passcode based on the user input input to the input device,
The input device provides the user authentication device with the passcode, an application ID for identifying an application activated by the input device, and a device ID for identifying the input device,
The user authentication device identifies the user based on a set of user authentication information indicating a combination of the received passcode, the received application ID, and the received device ID,
The passcode is a combination of a predetermined number of authentication factors,
Identifying the user based on the set of user credentials comprises:
Determining whether information matching the set of user authentication information is present in the stored plurality of user authentication registration information;
If it is determined that information matching the set of user authentication information is present in the stored plurality of user authentication registration information, the set of the plurality of stored user authentication registration information is determined. Specifying a user identifier corresponding to information matching the user authentication information;
Including
The passcode included in each of the plurality of user authentication registration information is a valid passcode,
Wherein the database unit, for each user authentication information stored in the database unit, passcode disabled is further stored as history information of the passcode, a computer system. A computer system for performing authentication of the user based on a user input input to an input device by a user,
The computer system includes a user authentication device, an input device, and a unit for acquiring position information of the user, wherein the unit for acquiring position information of the user includes a beacon provided in the input device. A device and a user device used by the user,
The user authentication device is configured to be able to communicate with the input device,
The beacon device automatically transmits a predetermined beacon signal within a predetermined range from the input device, wherein the predetermined beacon signal includes a device ID for identifying the input device,
The user device, in response to receiving the predetermined beacon signal, provides the user location information of the user to the user authentication device, the location information of the user, a user identifier for identifying the user and And a device ID provided from the predetermined beacon device,
The input device generates a passcode based on the user input input to the input device,
The input device provides the passcode and a device ID for identifying the input device to the user authentication device,
The means for obtaining the position information of the user provides the user authentication device with the position information of the user obtained by the means for obtaining the position information of the user,
The user authentication device determines whether a device ID included in the position information of the user matches a device ID provided from the input device, and determines a device ID included in the position information of the user and the input. A computer system that identifies the user based on the received passcode when it is determined that the device ID provided by the device matches the device ID. 20. The computer system according to claim 19 , wherein the location information of the user indicates that the user is located within a predetermined range from the input device. The user authentication device, in response to identifying the user,
Automatically revoking the received passcode;
21. The computer system according to claim 19 or claim 20 , further comprising automatically generating a new valid passcode. The computer system is configured to be able to communicate with an external system that requires user authentication,
The external system is a system different from the computer system,
In response to identifying the user, the user authentication device provides a user identifier for identifying the user to the external system, whereby the user authentication device determines that the user is an authenticated user. The computer system according to any one of claims 19 to 21 , wherein the computer system notifies the external system of the fact. 23. The computer system according to claim 22 , wherein the external system is one of an electronic payment system that executes payment processing of the user, and a ticketless entrance system that determines whether to permit entry of the user. . The passcode is a combination of the authentication element of a predetermined number, the computer system according to any one of claims 19-23. The computer system according to claim 24 , wherein the authentication factor is at least one of information indicating a word, a design, and a gesture. The user input, the input voice of a user, input by touching of the user, input by a gesture of the user is at least one of the input by the line of sight of the user, any one of claims 19-25 A computer system according to claim 1. The computer system according to any one of claims 19 to 26 , wherein the input device is a smart speaker. A computer system according to any one of claims 19 to 21 , 24 to 27 ,
An external system requiring user authentication, the external system comprising: an external system that is different from the computer system. A computer system according to claim 22 or claim 23 ,
And the external system requiring the user authentication. 30. The external system according to claim 28 or 29 , wherein the external system is one of an electronic payment system that executes a payment process of the user, and a ticketless entrance system that determines whether to permit entry of the user. The described system.

Images