JP7519979B2 - Authentication system, authentication terminal, authentication server, and authentication program - Google Patents

Description

The present invention relates to a multi-stage authentication system using SMS.

Conventionally, in order to improve security during user authentication, two-step authentication using SMS notification to a mobile terminal has been widely adopted (for example, see Patent Literature 1). However, in recent years, damage caused by attacks using malware that eavesdrop on SMS has been increasing.
In order to counter such attacks, two-step authentication using means other than SMS, such as authentication using an Authenticator app or FIDO (registered trademark), has been proposed.

JP 2007-058469 A

However, conventional authentication methods such as authentication using the Authenticator app or FIDO cannot be used as a primary authentication method because login is not possible when the device is lost, and a separate authentication method must be provided for when the device is lost. In addition, SMS has advantages in terms of feasibility on various devices, convenience, and cost, making it difficult to switch to other authentication methods.

The present invention aims to provide a multi-stage authentication system that improves the security of SMS authentication.

The authentication system according to the present invention includes an authentication terminal and an authentication server, and the authentication server authenticates an access from the authentication terminal in response to the access including a user ID. The authentication terminal includes a message receiving unit that receives an authentication message sent from the authentication server and presents the access to the user, an authentication request unit that accepts the input of a password described in the authentication message and transmits it to the authentication server, and a notification response unit that responds to a push notification from the authentication server for a specific application to a sender of the push notification. The authentication server includes a message sending unit that sends the authentication message to the authentication terminal using a telephone number associated with the user ID in response to the access, a request receiving unit that receives the password entered into the authentication terminal, a response receiving unit that sends the push notification to the specific application using identification information associated with the telephone number and receives a response to the push notification, and a sender verification unit that authenticates the access when the password and the sender IP address of the response are at least in the same subnet.

The authentication system according to the present invention comprises a login terminal, an authentication terminal, and an authentication server, and in response to an access from the login terminal accompanied by a user ID, the authentication server authenticates the access. The authentication terminal comprises a message receiving unit that receives an authentication message sent from the authentication server and presents the access to the user, an authentication request unit that accepts a confirmation input from the user for a page based on a URL described in the authentication message and transmits confirmation information to the authentication server, and a notification response unit that responds to a push notification from the authentication server for a specified application to a sender of the push notification. The authentication server comprises a message sending unit that transmits the authentication message to the authentication terminal by a telephone number linked to the user ID in response to the access, a request receiving unit that transmits a page based on the URL to the authentication terminal in response to a request and receives the confirmation information, a response receiving unit that issues the push notification to the specified application by identification information linked to the telephone number and receives a response to the push notification, and a sender verification unit that authenticates the access when the confirmation information and the sender IP address of the response are at least in the same subnet.

The source verification unit may authenticate the access if the entire source IP address matches.

The authentication terminal according to the present invention includes a message receiving unit that receives an authentication message sent from an authentication server by a telephone number linked to a user ID in response to an access involving a user ID and presents the message to the user, an authentication request unit that accepts input of a password written in the authentication message and sends the password to the authentication server, and a notification response unit that responds to a push notification from the authentication server for a specific application using identification information linked to the telephone number, to a sender of the push notification. When the password and the sender IP address of the response are in at least the same subnet, the access is authenticated by the authentication server.

The authentication terminal according to the present invention includes a message receiving unit that receives an authentication message sent from an authentication server by a telephone number linked to a user ID in response to an access involving a user ID from a login terminal and presents the message to the user, an authentication request unit that accepts a confirmation input from the user for a page sent from the authentication server based on a URL described in the authentication message and transmits confirmation information to the authentication server, and a notification response unit that responds to a push notification from the authentication server for a predetermined application using identification information linked to the telephone number to a sender of the push notification, and has the authentication server authenticate the access when the confirmation information and the sender IP address of the response are at least in the same subnet.

The authentication server according to the present invention includes a message sending unit that sends an authentication message containing a password to the authentication terminal by a telephone number linked to the user ID in response to an access involving a user ID from an authentication terminal, a request receiving unit that receives the password entered into the authentication terminal, a response receiving unit that sends a push notification to a specific application running on the authentication terminal by identification information linked to the telephone number and receives a response to the push notification, and a sender verification unit that authenticates the access when the password and the sender IP address of the response are at least in the same subnetwork.

The authentication server according to the present invention includes a message sending unit that sends an authentication message to an authentication terminal by a telephone number linked to a user ID in response to an access involving a user ID from a login terminal, a request receiving unit that sends a page in response to a request based on a URL described in the authentication message and receives confirmation information in response to a confirmation input from a user, a response receiving unit that sends a push notification to a specific application running on the authentication terminal by identification information linked to the telephone number and receives a response to the push notification, and a sender verification unit that authenticates the access when the confirmation information and the sender IP address of the response are at least in the same subnet.

The authentication program according to the present invention is for causing a computer to function as the authentication server.

The present invention can improve the security of SMS authentication in a multi-stage authentication system.

11 is a diagram showing a functional configuration of an authentication system in which the authentication terminal is the same as the login terminal. 11 is a sequence diagram showing an authentication procedure when the authentication terminal is the same as the login terminal. FIG. FIG. 11 is a diagram illustrating a functional configuration of an authentication system in which an authentication terminal is different from a login terminal. 11 is a sequence diagram showing an authentication procedure when an authentication terminal is different from a login terminal. FIG.

An example of an embodiment of the present invention will now be described.
In the authentication system of this embodiment, when two-step authentication is performed by sending a one-time password or URL to an authentication terminal using SMS, the authentication system additionally verifies that the IP address is the same for the communication accompanying the SMS and the communication accompanying the separate push communication, thereby preventing attacks through SMS eavesdropping.
In addition, the term "IP addresses are the same" may mean that the entire IP address matches, but it may also mean that the subnetworks are the same when a subnet mask of, for example, 24 bits to 8 bits is set.

When two-step authentication using SMS is performed, there are the following two cases.
Case A: When the terminal attempting to log in (login terminal) and the terminal sending and receiving SMS (authentication terminal) are the same.
Case B: The login terminal and authentication terminal are different.

It is difficult to accurately distinguish between these two cases without having the user explicitly select at the start of login. However, it is possible to roughly distinguish between the two cases based on the model or screen size of the terminal (login terminal) that the user is using. In other words, it can be determined that the possibility of case A is high when the model is a smartphone, and that the possibility of case A is high when the screen size is small.
In this embodiment, the authentication server determines whether the login is in case A or B at the start of the login by having the user explicitly select it or by determining it from the terminal model or screen size, and then performs login authentication using the respective sequence.

FIG. 1 is a diagram showing the functional configuration of an authentication system 1A in case A of this embodiment, that is, in the case where the authentication terminal is the same as the login terminal.
The authentication system 1A is configured to perform SMS authentication and additional authentication when an authentication terminal 20 (login terminal) accesses an authentication server 10. Information including the telephone number of the authentication terminal 20 held by a user is registered in advance in the authentication server 10 in association with a user ID.

The authentication terminal 20 is an information processing device that can log in to the authentication server 10 and receive messages (hereinafter referred to as SMS) based on a telephone number for two-step authentication, and corresponds to a mobile terminal such as a smartphone.

In addition to an application (hereinafter referred to as a browser application) for accessing the authentication server 10, an application (hereinafter referred to as an SMS application) for receiving SMS runs on the authentication terminal 20. Furthermore, a specific application (application X) is pre-installed in the authentication terminal 20 for additional authentication.
This application X is an application that can receive push notifications from the authentication server 10, and identification information for notifications is associated with a telephone number and registered in the authentication server 10.

The control unit 11 of the authentication server 10 executes software (authentication program) stored in the memory unit 12, thereby functioning as a message sending unit 111, a request receiving unit 112, a response receiving unit 113, and a sender verification unit 114.

In response to access with a user ID from the authentication terminal 20 (browser application), the message sending unit 111 sends an authentication SMS containing a one-time password to the authentication terminal 20 using the telephone number associated with the user ID.

The request receiving unit 112 receives the one-time password entered into the authentication terminal 20 (browser application).

The response receiving unit 113 sends a push notification to a specific application (app X) using the identification information linked to the telephone number of the authentication terminal 20, and receives a response to this push notification.

If the one-time password received by the request receiving unit 112 and the source IP address of the response received by the response receiving unit 113 are identical, the sender verification unit 114 authenticates the access from the authentication terminal 20 and completes the login.

The control unit 21 of the authentication terminal 20 functions as a message receiving unit 211, an authentication request unit 212, and a notification response unit 213 by executing software (browser app, SMS app, app X) stored in the memory unit 22.

The message receiving unit 211 receives an SMS for authentication sent from the authentication server 10 by an SMS application, and presents the SMS to the user.
This SMS contains a one-time password as authentication information, and this one-time password is manually input by the user or automatically input into the browser application.

The authentication request unit 212 accepts input of the one-time password written in the authentication SMS via the browser application and transmits it to the authentication server 10.

The notification response unit 213 responds to the sender of a push notification from the authentication server 10 for app X using identification information (e.g., a terminal number) linked to the telephone number of the authentication terminal 20.

Figure 2 is a sequence diagram showing the authentication procedure for case A of this embodiment, i.e., when the authentication terminal is the same as the login terminal.

In step S<b>1 , the user performs an operation to start logging in to the authentication server 10 on the browser running on the authentication terminal 20 .
In step S2, the authentication terminal 20 (browser) accesses the authentication server 10 and requests a login page.
In step S3, the authentication server 10 returns the login page to the authentication terminal 20.

In step S4, the user enters an ID (and password) on the displayed login page.
In step S 5 , the authentication terminal 20 (browser) transmits the input ID (and password) to the authentication server 10 .
In step S6, the authentication server 10 returns the start page for the two-step authentication to the authentication terminal 20.

In step S7, the authentication server 10 extracts the telephone number associated with the user's ID from the user information database stored in the memory unit 12, and sends an SMS including the one-time password to the authentication terminal 20 having this telephone number.

In step S8, the user views the sent SMS and reads the one-time password contained therein.
In step S9, the user inputs the read one-time password into the authentication terminal 20 (browser). Note that the reading and input of the one-time password may be performed automatically.
In step S 10 , the authentication terminal 20 (browser) transmits the input one-time password to the authentication server 10 .

In step S11, the authentication server 10 sends a push notification to the terminal number associated with the telephone number used in step S7.
In step S12, the authentication terminal 20 (application X) responds to the received push notification and accesses the sender.

In step S13, the authentication server 10 confirms that the source IP address of the one-time password in step S10 is the same as the source IP address of the access in step S12.
In step S14, the authentication server 10 transmits a post-login completion page and authentication information to the authentication terminal 20, thereby completing the login.

FIG. 3 is a diagram showing the functional configuration of an authentication system 1B in case B of this embodiment, that is, when the authentication terminal is different from the login terminal.
The authentication system 1B is configured to perform SMS authentication and additional authentication using the authentication terminal 20 when the login terminal 30 accesses the authentication server 10. Information including the telephone number of the authentication terminal 20 held by the user is registered in advance in the authentication server 10 in association with the user ID.

The authentication terminal 20 is an information processing device capable of receiving a message (hereinafter referred to as SMS) based on a telephone number for two-step authentication when the login terminal 30 logs in to the authentication server 10, and corresponds to a mobile terminal such as a smartphone.

An application for receiving SMS (hereinafter referred to as an SMS application) runs on the authentication terminal 20. Furthermore, the authentication terminal 20 has pre-installed therein an application for accessing a URL (hereinafter referred to as a browser application) and a specific application (application X) for additional authentication.
This application X is an application that can receive push notifications from the authentication server 10, and identification information for notifications is associated with a telephone number and registered in the authentication server 10.

The control unit 11 of the authentication server 10 executes software (authentication program) stored in the memory unit 12, thereby functioning as a message sending unit 111, a request receiving unit 112, a response receiving unit 113, and a sender verification unit 114.

In response to access with a user ID from the login terminal 30 (browser application), the message sending unit 111 sends an authentication SMS containing a URL to the authentication terminal 20 using the telephone number associated with the user ID.

The request receiving unit 112 sends a corresponding page in response to a request from the authentication terminal 20 (browser application) based on the URL stated in the authentication SMS, and receives confirmation information according to the confirmation input from the user.

The response receiving unit 113 sends a push notification to a specific application (app X) using the identification information linked to the telephone number of the authentication terminal 20, and receives a response to this push notification.

If the confirmation information received by the request receiving unit 112 and the source IP address of the response received by the response receiving unit 113 are the same, the source verification unit 114 authenticates the access from the login terminal 30 and completes the login.

The control unit 21 of the authentication terminal 20 functions as a message receiving unit 211, an authentication request unit 212, and a notification response unit 213 by executing software (browser app, SMS app, app X) stored in the memory unit 22.

The message receiving unit 211 receives an SMS for authentication sent from the authentication server 10 by an SMS application, and presents the SMS to the user.
This SMS contains a URL as authentication information, and a browser application is started by this URL.

The authentication request unit 212 uses a browser application to request the page with the URL listed in the authentication SMS from the authentication server 10, accepts the user's confirmation input for the returned confirmation page, and transmits the confirmation information to the authentication server 10.

The notification response unit 213 responds to the sender of a push notification from the authentication server 10 for app X using identification information linked to the telephone number of the authentication terminal 20.

Figure 4 is a sequence diagram showing the authentication procedure for case B of this embodiment, i.e., when the authentication terminal is different from the login terminal.

In step S21, the user performs an operation to start logging in to the authentication server 10 using a browser running on the login terminal 30.
In step S22, the login terminal 30 (browser) accesses the authentication server 10 and requests a login page.
In step S23, the authentication server 10 returns the login page to the login terminal 30.

In step S24, the user enters an ID (and password) on the displayed login page.
In step S25, the login terminal 30 (browser) transmits the input ID (and password) to the authentication server 10.
In step S26, the authentication server 10 returns a start page for the two-step authentication to the login terminal 30.

In step S27, the authentication server 10 extracts the telephone number associated with the user's ID from the user information database stored in the memory unit 12, and sends an SMS including a URL for two-step authentication to the authentication terminal 20 having this telephone number.

In step S28, the user selects (tap) the URL written in the sent SMS, and requests the browser of the authentication terminal 20 to open the page of this URL.
In step S29, the authentication terminal 20 (browser) requests the authentication server 10 for the page of the specified URL.
In step S30, the authentication server 10 returns a two-step authentication confirmation page to the authentication terminal 20.

In step S31, the user performs a confirmation operation (tap a button) on the confirmation page displayed on the browser of the authentication terminal 20.
In step S32, the authentication terminal 20 (browser) transmits to the authentication server 10 confirmation information indicating that a confirmation operation has been performed by the user.
In step S33, the authentication server 10 returns a two-step authentication confirmation completion page to the authentication terminal 20.

In step S34, the authentication server 10 sends a push notification to the terminal number associated with the telephone number used in step S27.
In step S35, the authentication terminal 20 (application X) responds to the received push notification and accesses the sender.

In step S36, the authentication server 10 confirms that the source IP address of the confirmation information in step S32 is the same as the source IP address of the access in step S35.
In step S37, the user refreshes the two-step authentication start page (tap the button) or waits for an automatic refresh, whereby the login terminal 30 (browser) checks the authentication status with the authentication server 10.
In step S38, the authentication server 10 transmits a page for after login completion and the authentication information to the login terminal 30, thereby completing the login.

In the sequence of Case A (Figure 2) or the sequence of Case B (Figure 4), the communication for additional authentication (within the dashed frame) may be performed at any time after the input of the user ID (step S5 or S25) and before the verification of the sender (step S13 or S36).

According to this embodiment, the authentication system 1 (1A or 1B) improves the authentication strength by verifying that the IP address of the access source to the authentication server 10 accompanying the SMS authentication is the same subnet as the response of the push notification to the application X pre-installed in the authentication terminal 20. That is, when an attacker intercepts the SMS transmitted to the authentication terminal 20 and attempts unauthorized login, the login fails because the subnet of the IP address of the access source does not match the IP address of the application X.
Therefore, the authentication system 1 can improve the security of SMS authentication in a multi-stage authentication system.
Furthermore, the authentication system 1 can more strictly verify that the terminals are the same by verifying that the IP addresses match entirely, thereby improving security.

In addition, in case B, where the authentication terminal 20 used for sending and receiving SMS is different from the login terminal 30, if a one-time password is entered into the login terminal 30 as in case A, no communication of an authentication request from the authentication terminal 20 to the authentication server 10 occurs, and therefore the authentication server 10 cannot obtain an IP address for additional authentication.
Therefore, the authentication server 10 can verify the identity of the IP address even in case B by notifying the authentication terminal 20 of the URL in SMS authentication and generating communication from the confirmation screen.

The above-mentioned embodiment can, for example, realize SMS authentication that is resistant to malware attacks and reduce the damage caused by unauthorized access, which can contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most favorable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

In the above embodiment, the identity of the IP address is verified between the authentication request communication (one-time password or confirmation information) from the authentication terminal 20 to the authentication server 10 and the communication from application X, but this is not limited to the above. In case A, multiple communications occur from the authentication terminal 20 to the authentication server 10, so the authentication server 10 may verify the identity of the IP address between the communication from application X and any other communication.

In the above embodiment, app X is an application different from the SMS app, but for example, if an SMS app with an RCS function is being used on the authentication terminal 20, app X and the SMS app may be the same. In this case, the push notification may also serve as the transmission of an SMS, or the transmission of an SMS may also serve as the push notification.

In the above embodiment, it has been described that whether the case is case A or case B is determined in advance, but there are cases where this is misinterpreted as follows.
If the case is determined to be B but is actually A, the user's UX will be somewhat worsened but the authentication itself will be successful.
If the case is determined to be A but is actually B, authentication fails even though the user is performing the correct operation. Therefore, when authentication fails, the authentication server 10 notifies the user that additional authentication is required to strengthen security, and requests an additional two-step authentication with higher strength, such as telephone authentication.

In addition, if the IP address identity determination fails due to an HTTP proxy or NAT, etc., authentication will fail even if the user is operating correctly, and the authentication server 10 will similarly handle this by requesting additional authentication.

The authentication method by authentication system 1 is realized by software. When realized by software, the programs that make up this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded.

Reference Signs List 1, 1A, 1B Authentication system 10 Authentication server 11 Control unit 12 Storage unit 20 Authentication terminal 21 Control unit 22 Storage unit 30 Login terminal 111 Message transmission unit 112 Request reception unit 113 Response reception unit 114 Transmission source verification unit 211 Message reception unit 212 Authentication request unit 213 Notification response unit

Claims (9)

An authentication system comprising an authentication terminal and an authentication server, the authentication server authenticating an access accompanied by a user ID from the authentication terminal,
The authentication terminal includes:
a message receiving unit that receives an authentication message transmitted from the authentication server and presents the message to a user;
an authentication request unit that receives an input of a password described in the authentication message and transmits the password to the authentication server;
a notification response unit that responds to a sender of a push notification from the authentication server for a predetermined application,
The authentication server,
a message sending unit that sends the authentication message to the authentication terminal by a telephone number associated with the user ID in response to the access;
a request receiving unit for receiving the password input to the authentication terminal;
a response receiving unit that sends the push notification to the predetermined application using identification information associated with the telephone number and receives a response to the push notification;
and a source verification unit that authenticates the access when the password and a source IP address of the response are at least in the same subnet. An authentication system comprising a login terminal, an authentication terminal, and an authentication server, wherein the authentication server authenticates an access accompanied by a user ID from the login terminal,
The authentication terminal includes:
a message receiving unit that receives an authentication message transmitted from the authentication server and presents the message to a user;
an authentication request unit that receives a confirmation input from the user for a page based on a URL described in the authentication message and transmits the confirmation information to the authentication server;
a notification response unit that responds to a sender of a push notification from the authentication server for a predetermined application,
The authentication server,
a message sending unit that sends the authentication message to the authentication terminal by a telephone number associated with the user ID in response to the access;
a request receiving unit that transmits a page based on the URL to the authentication terminal in response to a request and receives the confirmation information;
a response receiving unit that sends the push notification to the predetermined application using identification information associated with the telephone number and receives a response to the push notification;
a source verification unit that authenticates the access when the source IP address of the confirmation information and the response are at least in the same subnetwork. The authentication system according to claim 1 or 2, wherein the sender verification unit authenticates the access if the entire sender IP address matches. a message receiving unit that receives an authentication message transmitted from an authentication server by a telephone number associated with the user ID in response to an access using the user ID, and presents the message to the user;
an authentication request unit that receives an input of a password described in the authentication message and transmits the password to the authentication server;
a notification response unit that responds to a sender of a push notification from the authentication server for a predetermined application using identification information associated with the telephone number,
An authentication terminal, the access of which is authenticated by the authentication server when the password and the source IP address of the response are at least in the same subnetwork. a message receiving unit that receives an authentication message transmitted from an authentication server by a telephone number associated with a user ID in response to an access from a login terminal using the user ID, and presents the message to the user;
an authentication request unit that receives a confirmation input from the user for a page transmitted from the authentication server based on a URL described in the authentication message, and transmits the confirmation information to the authentication server;
a notification response unit that responds to a sender of a push notification from the authentication server for a predetermined application using identification information associated with the telephone number,
an authentication terminal that causes the authentication server to authenticate the access when the source IP addresses of the confirmation information and the response are at least in the same subnetwork; a message sending unit that sends an authentication message including a password to the authentication terminal by a telephone number associated with the user ID in response to an access from the authentication terminal including the user ID;
a request receiving unit for receiving the password input to the authentication terminal;
a response receiving unit that sends a push notification to a predetermined application running on the authentication terminal using identification information associated with the telephone number, and receives a response to the push notification;
an origin verification unit that authenticates the access when the password and the origin IP address of the response are at least in the same subnetwork. a message sending unit that sends an authentication message to an authentication terminal by a telephone number associated with the user ID in response to an access from a login terminal accompanied by the user ID;
a request receiving unit that transmits a page in response to a request based on a URL described in the authentication message and receives confirmation information in response to a confirmation input from a user;
a response receiving unit that sends a push notification to a predetermined application running on the authentication terminal using identification information associated with the telephone number, and receives a response to the push notification;
an origin verification unit that authenticates the access when the confirmation information and the source IP address of the response are at least in the same subnetwork. An authentication program for causing a computer to function as the authentication server according to claim 6. An authentication program for causing a computer to function as the authentication server according to claim 7.

Images