JP7528136B2 - Authentication program, authentication system, and authentication method - Google Patents

Description

The present invention relates to an authentication program, an authentication system, and an authentication method.

Conventionally, technologies related to multiple authentication methods have been known to more easily achieve user authentication when a user uses a service.

For example, in the system described in Patent Document 1, the biometric information data generated based on the user's biometric information acquired from the user and the information acquired from the user's personal terminal match information previously registered by the user, and the system authenticates the user and generates data for processing the user's payment at affiliated stores.

JP 2006-190112 A

However, in the system described in Patent Document 1, if the biometric information acquired from the user and the information acquired from the user's personal device do not match the pre-registered information and authentication cannot be performed, data for processing the user's payment at the affiliated store is not generated. In this case, the user will be required to authenticate again using a less convenient authentication method, which may result in a situation where the user cannot be authenticated easily.

The present invention aims to provide an authentication program, an authentication system, and an authentication method that can simplify user authentication.

An authentication program according to one aspect of the present invention has a computer that implements a provider information storage unit that records at least one provider authentication method information relating to at least one authentication method for authenticating a user that can be executed by a provider of a service used by a user when the user uses the service, and a pre-priority storage unit that records pre-priority information indicating the priority of each of the at least one authentication method set in advance, and a runtime authentication method providing unit that provides at least one runtime authentication method information indicating at least one runtime authentication method, which is at least one authentication method for authenticating a user who uses the service, associated with runtime priority information indicating a predetermined priority, to a provider device used by the provider, and an authentication unit that authenticates a user who uses the service in a predetermined order of priority based on the at least one runtime authentication method information and at least one user authentication information for authenticating a user in the at least one runtime authentication method information acquired from the provider device.

An authentication system according to one aspect of the present invention includes a provider information storage unit in which at least one provider authentication method information is recorded for at least one authentication method for authenticating a user that can be executed by a provider of a service used by a user when the user uses the service, and a pre-priority storage unit in which pre-priority information indicating the respective priorities of at least one authentication method set in advance is recorded, and a runtime authentication method providing unit provides at least one runtime authentication method information indicating at least one authentication method for authenticating a user who uses the service, associated with runtime priority information indicating a predetermined priority, to a provider device used by the provider, and an authentication unit that authenticates a user who uses the service in a predetermined order of priority based on the at least one runtime authentication method information and at least one user authentication information for authenticating a user in the at least one runtime authentication method information acquired from the provider device.

In an authentication method according to one aspect of the present invention, a computer refers to a provider information storage unit in which at least one provider authentication method information is recorded for at least one authentication method for authenticating a user that is executable by a provider of a service used by a user when the user uses the service, and a pre-priority storage unit in which pre-priority information indicating the respective priorities of at least one authentication method set in advance is recorded, and provides at least one runtime authentication method information indicating at least one runtime authentication method, which is at least one authentication method for authenticating a user who uses the service, associated with runtime priority information indicating a predetermined priority, to a provider device used by the provider, and authenticates a user who uses the service in a predetermined order of priority based on the at least one runtime authentication method information and at least one user authentication information for authenticating a user in the at least one runtime authentication method information acquired from the provider device.

In this invention, a "part" does not simply mean a physical means, but also includes cases where the functions of the "part" are realized by software. Furthermore, the functions of one "part" or device may be realized by two or more physical means or devices, and the functions of two or more "parts" or devices may be realized by one physical means or device.

The present invention provides an authentication program, an authentication system, and an authentication method that can simplify user authentication.

FIG. 1 is a diagram showing an overview of authentication processing in an authentication system 100 according to an embodiment of the present invention. 1 is a diagram showing a configuration of an authentication system 100 according to an embodiment of the present invention. 4 is a diagram showing an example of information stored in a provider information storage unit 112. FIG. 4 is a diagram showing an example of information stored in a user information storage unit 114. FIG. 11 is a diagram showing an example of information stored in a pre-priority storage unit 121. FIG. 11 is a diagram showing an example of information stored in a runtime authentication method storage unit 132. FIG. 4 is a flowchart showing an example of processing in the authentication system 100 according to an embodiment of the present invention.

The present invention relates to an authentication program, authentication system, and authentication method that authenticate a user when the user uses a specific service. Here, the specific service is not limited to, but may be, for example, payment at a member store, management of entry and exit to a specific building or area, electronic contract service, and electronic authentication service. That is, the present invention may authenticate a user who makes a payment when paying for a specific product at a store, or authenticate a user who is allowed to enter or exit a building or area when managing entry and exit to the building or area. The present invention may also perform identity authentication when making an electronic contract, or identity authentication for receiving electronic approval (for example, approval of the use of specific data or of terms) or approval of the transfer of authority.

The following describes an embodiment in which the present invention is applied to an authentication system that authenticates a user making a payment at a member store (i.e., a service provider).

A preferred embodiment of the present invention will be described with reference to the accompanying drawings. FIG. 1 is a diagram showing an overview of authentication processing in an authentication system 100 according to one embodiment of the present invention.

An authentication system 100, which is one embodiment of the present invention, is an information processing system realized by an authentication program, and is an information processing system that authenticates a user's payment at an affiliated store. Authentication system 100 authenticates a user's payment at an affiliated store based on information required to authenticate the user's payment at an affiliated store, which is obtained directly or indirectly from the affiliated store and the user.

First, the affiliated store provides provider authentication method information on an authentication method that can be performed at the affiliated store when the user makes a payment at the affiliated store to the authentication system 100 through the provider device 200 used by the affiliated store and registers it (S101). In addition, the user provides user authentication information for authenticating the user to the authentication system 100 through the user device 300 and registers it (S102). Based on the provider authentication method information, the authentication system 100 provides runtime authentication method information on an authentication method for authenticating the user making a payment at the affiliated store to the provider device 200 in association with runtime priority information indicating a predetermined priority (S103).

When the user makes a payment at the affiliated store, the affiliated store requests the user to provide user authentication information corresponding to the authentication method with the first priority in the predetermined priority order, and the user provides the corresponding user authentication information to the provider device 200 (S104). The affiliated store provides the acquired user authentication information to the authentication system 100 (S105). The authentication system 100 authenticates the user making the payment at the affiliated store using the authentication method with the first priority in the predetermined priority order indicated by the runtime priority information, based on the runtime authentication method information and the user authentication information acquired from the provider device 200 (S106). Then, the user's payment at the affiliated store is completed (S107).

If authentication in S106 is not possible, the authentication system 100 performs authentication using an authentication method with a second priority, which is the next priority after the first priority in the predetermined priority order indicated by the runtime priority information.

The authentication method is a method by which the authentication system 100 authenticates a user making a payment at an affiliated store. The authentication method may be, for example, an authentication method based on at least one of possession information related to possessions held by the user (e.g., an information terminal such as the user device 300 described below), biometric information related to the user's biometrics, and memory information stored by the user.

Specifically, the possession information may be, for example, device identification information that identifies a device (e.g., an information terminal such as a smartphone) that is a possession of the user, or location information that indicates the location of the possession (e.g., distance information that indicates the distance between the possession and the provider device 200, or information that indicates GPS coordinates measured by a GPS system using a GPS (Global Positioning System) device). In addition, the possessions owned by the user may provide the possession information to the provider device 200 directly or indirectly via a cloud or the like as necessary, by communication based on a communication standard such as BLE (Bluetooth Low Energy), UWB (Ultra Wide Band), Wi-Fi (registered trademark), or short-range wireless communication (e.g., RFID (Radio Frequency IDentification) or NFC (Near Field Communication)), or may provide the information to the provider device 200 by other methods.

The biometric information may be information about the user's physical appearance, fingerprints, palm prints, voiceprints, irises, etc. The user may provide the user's biometric information to the provider device 200, for example, through a provider terminal 220 installed at an affiliated store, which will be described later. The user may also provide the user's biometric information to the provider device 200 through a user device 300.

The stored information may be, for example, information that identifies the user in the authentication system 100, a card number used for payment, an account number, a telephone number, an account name such as an email address, a password, a signature or figure entered or selected by the user, a free-entry or multiple-choice answer to a given question, or any other information that is stored by the user and can be obtained by the provider device 200. The user enters or selects the stored information through an input device provided on the provider terminal 220 installed at the affiliated store, for example, and provides the stored information to the provider device 200.

The authentication method may be based on at least one of possession information, biometric information, and stored information. In other words, the authentication method may be based only on possession information, biometric information, and stored information, or may be an authentication method that includes two or more of possession information, biometric information, and stored information as elements. In other words, when the authentication method is based on possession information and biometric information, the authentication system 100 authenticates the user making a payment at an affiliated store based on the possession information and biometric information. The authentication method may also be based on information other than possession information, biometric information, and stored information.

In this way, for example, in the case of an authentication method based on at least one of possession information, biometric information, and stored information, the user can make a payment by a so-called empty-handed payment, which allows the user to make a payment without carrying or presenting the cash or payment card used for the payment (or by carrying or presenting it without any special effort for the user). Note that here, empty-handed payment does not only include a payment made when the user is not wearing anything, but also a payment made when the user is wearing only the items that they normally wear (e.g., a smartphone) (i.e., a state equivalent to empty-handed).

Figure 2 is a diagram showing the configuration of an authentication system 100 according to one embodiment of the present invention. The authentication system 100 is a system that is communicatively connected to a provider device 200 and a user device 300 via a network such as the Internet. Details of the authentication system 100 will be described later.

The provider device 200 is a device used by the affiliated store. The provider device 200 includes a provider information processing system 210, which is an information processing system used by the affiliated store and is communicatively connected via a network such as the Internet, and a provider terminal 220 installed in the affiliated store. Note that while only one provider device 200 is shown in FIG. 2, if there are multiple affiliated stores, a provider device 200 is provided for each affiliated store. Also, multiple provider devices 200 may be provided in one affiliated store.

The provider information processing system 210 may be, for example, an information processing system that is communicatively connected to the authentication system 100 and the provider terminal 220, and may be an information processing system that is capable of transmitting and receiving various information to and from the authentication system 100 and the provider terminal 220.

The provider terminal 220 may be, for example, a terminal installed in an affiliated store for processing payments, and may include, for example, a cash register terminal or other terminal for reading information (e.g., barcode information or tag information attached to a product) for registering product-related information (e.g., product number, price, etc.) when making a payment, or information that is an element of a specified authentication method (e.g., possession information, biometric information, stored information). That is, the provider terminal 220 may be equipped with a reading device for reading product barcode information, tag information, etc., a detection device for detecting the user's possessions, a detection device for detecting the user's biometric information, and an input device for the user to input stored information, etc.

The affiliated store accesses the authentication system 100 through the provider device 200 (e.g., the provider information processing system 210) and registers provider authentication method information related to authentication methods that can be implemented at the affiliated store. In addition, when the user makes a payment at the affiliated store, the affiliated store may obtain user authentication information from the user or the user device 300 described below, for example, through the provider terminal 220, and provide the user authentication information to the provider information processing system 210, and may also provide the user authentication information to the authentication system 100 through the provider information processing system 210.

The affiliated store may be a so-called unmanned payment store where payment is made without the operation of a person in charge at the affiliated store (e.g., an operator who operates the provider terminal 220).

The user device 300 is a device used by a user, such as a smartphone, a tablet terminal, or a personal computer. The user accesses the authentication system 100 through the user device 300 and registers user authentication information for authenticating the user using a specified authentication method. That is, the user can register, for example, information about the user's belongings, the user's biometric information, and the user's stored information as user authentication information through the user device 300. In addition, the user can provide the user authentication information to the provider device 200 (e.g., the provider terminal 220) through the user device 300 when making a payment at an affiliated store.

Note that although only one user device 300 is shown in FIG. 2, if there are multiple users, a user device 300 is provided for each user. Also, one user may have multiple user devices 300.

Next, the authentication system 100 will be described in detail. The authentication system 100 includes a provider registration unit 111, a provider information storage unit 112, a user registration unit 113, a user information storage unit 114, a pre-priority storage unit 121, a runtime authentication method generation unit 131, a runtime authentication method storage unit 132, a runtime authentication method provision unit 133, a user authentication information acquisition unit 141, and an authentication unit 142. The computer that constitutes the authentication system 100 includes a processor and a storage area. Each unit shown in FIG. 1 can be realized, for example, by using the storage area or by the processor executing an authentication program stored in the storage area.

The provider registration unit 111 accepts and registers provider information from the provider device 200, including at least one provider authentication method information relating to at least one authentication method for authenticating a user that can be executed by an affiliated store when a user makes a payment, and stores the information in the provider information storage unit 112.

Here, the provider authentication method information is information on at least one authentication method, and is information on an authentication method that can be executed at a member store in light of the member store's situation (e.g., the installation status of the provider terminal 220). In other words, for example, if a detection device for detecting possession information is not available or cannot be used at a member store, an authentication method based on possession information is an authentication method that cannot be executed at the member store, and information on an authentication method based on possession information is not included in the provider authentication method information.

The provider authentication method information may be information indicating the authentication method itself, or may be information indicating whether information indicating elements of the authentication method (e.g., possession information, biometric information, stored information) can be obtained. That is, for example, if the provider authentication method information is information indicating that possession information and biometric information can be obtained, the authentication methods that can be executed at the affiliated store indicated by the provider authentication method information are an authentication method based only on possession information, an authentication method based only on biometric information, and an authentication method based on possession information and biometric information.

In addition, the provider registration unit 111 can accept and register provider information including provider priority information indicating the priority order of at least one provider authentication method information from the provider device 200 and store it in the provider information storage unit 112.

The provider priority information is information associated with the provider authentication method information, and is referenced to generate a priority order (runtime priority information, described later) when the authentication system 100 executes at least one authentication method to authenticate a user making a payment at an affiliated store. In other words, a provider authentication method with a high priority order indicated by the provider priority information indicates that the affiliated store wishes to have it executed in preference to a provider authentication method with a low priority order and used to authenticate a user making a payment.

The affiliated store may, for example, set provider priority information to prioritize authentication methods that impose a smaller burden on the user, taking into account user convenience, or may set provider priority information to prioritize authentication methods that combine multiple elements, taking into account the level of security during authentication to avoid user impersonation or authentication of payments by users who are unable to pay. The affiliated store may also set provider priority information, taking into account user convenience and the level of security during authentication. In this way, the authentication system 100 can realize authentication of users making payments at the affiliated store, based on a priority order that takes into account the convenience of users at the affiliated store and the level of security during authentication.

The provider priority information may be information indicating the priority of provider authentication method information. In other words, the provider priority information may be information indicating the priority of each piece of information indicating the authentication method itself, or may be information indicating the priority of each piece of information indicating elements of the authentication method that can be obtained at the affiliated store (e.g., possession information, biometric information, memory information). Furthermore, the provider priority information does not have to be set by the affiliated store.

The provider priority information may also be information indicating elements that are required for authentication among information indicating elements of authentication methods that can be obtained at the affiliated store (e.g., possession information, biometric information, stored information). The provider priority information may also include information indicating that an authentication method or an element of an authentication method will not be adopted.

Figure 3 is a diagram showing an example of information stored in the provider information storage unit 112. The information stored in the provider information storage unit 112 includes, for example, a provider ID, provider authentication method information, and provider priority information, and the provider authentication method information includes, for example, possession information, biometric information, and memory information.

The provider ID is information that identifies the affiliated store registered in the authentication system 100.

The provider authentication method information may be information indicating the authentication method itself, or may be information indicating whether or not information indicating elements of the authentication method (e.g., possession information, biometric information, memory information) can be acquired (e.g., "Yes") or not (e.g., "No"). The information indicating whether or not the authentication method or elements of the authentication method can be acquired is not limited to "Yes" or "No".

The provider priority information may be information indicating the priority of the provider authentication method information. In other words, the provider priority information may be information indicating the priority of each piece of information indicating the authentication method itself, or information indicating the priority of each piece of information indicating an element of an authentication method that can be obtained at an affiliated store (e.g., possession information, biometric information, memory information). The provider priority information may be information that is required for authentication (e.g., "memory information is required") among the information indicating the elements of an authentication method that can be obtained at an affiliated store. The provider priority information may also include information indicating that the authentication method or an element of the authentication method will not be adopted (e.g., "not possible"). Note that the information indicating whether or not the authentication method or an element of the authentication method will be adopted is not limited to "possible" or "not possible".

The user registration unit 113 accepts user information including at least one piece of user authentication information from the user device 300, registers it, and stores it in the user information storage unit 114.

Here, user authentication information is information that is an element of a specific authentication method, and is information for authenticating a user in the specific authentication method. User authentication information includes, for example, possession information, biometric information, and memory information.

In addition to the user authentication information, the user information may further include information about the user. Here, the information about the user may be, for example, the user's personal information (e.g., name, address, telephone number, email address, password) and information about the card or device (e.g., user device 300) used for the user's payment (e.g., card number, device number).

The user may register all user authentication information that can be registered in the authentication system 100, or may register only the user authentication information that the user himself/herself wishes to register. This allows the user to arbitrarily select the user authentication information to register, realizing authentication processing that balances the user's security awareness with convenience in the authentication processing of payments.

The user may also register multiple pieces of user authentication information that correspond to the same element of the authentication method as the user authentication information. That is, the user may, for example, register biometric information related to a fingerprint and biometric information related to a voiceprint as biometric information that is the same element, or may register biometric information related to the fingerprints of multiple different fingers.

Figure 4 is a diagram showing an example of information stored in the user information storage unit 114. The information stored in the user information storage unit 114 includes, for example, a user ID and user authentication information, and the user authentication information includes, for example, possession information, biometric information, and memory information. Here, the user ID is information that identifies a user who uses the authentication system 100.

The user information storage unit 114 may store all user authentication information for each user ID, or may store only a portion of the user authentication information. Furthermore, the user may register, as user authentication information, multiple pieces of user authentication information that correspond to the same element among the elements of a specified authentication method. That is, the user may register biometric information related to a fingerprint and biometric information related to a voiceprint as biometric information that is the same element, or may register biometric information related to the fingerprints of multiple different fingers.

The pre-priority storage unit 121 stores pre-priority information, which is information that is set in advance in the authentication system 100 and is referenced to generate a priority order (runtime priority information, described later) when the authentication system 100 executes at least one authentication method to authenticate a user making a payment at an affiliated store. The pre-priority information may be set, for example, by an administrator who manages the authentication system 100.

The administrator who manages the authentication system 100 may, for example, set advance priority information to prioritize authentication methods that impose a smaller burden on the user, taking into account user convenience, and may also set advance priority information to prioritize authentication methods with higher security (e.g., authentication methods that combine multiple elements), taking into account the level of security during authentication to avoid user impersonation or authentication of payments by users who are unable to pay. The administrator who manages the authentication system 100 may also set advance priority information, taking into account user convenience and the level of security during authentication. In this way, the authentication system 100 can realize authentication of users who make payments at affiliated stores, based on a priority order that takes into account the convenience of users at affiliated stores and the level of security during authentication.

The advance priority information may be set before the runtime authentication method information is generated by the runtime authentication method generating unit 131 described later, or may not be set. The advance priority information may also include information indicating that the method will not be adopted as an authentication method.

Figure 5 is a diagram showing an example of information stored in the pre-priority storage unit 121. The information stored in the pre-priority storage unit 121 includes, for example, a pre-priority ID, authentication method information, and pre-priority information, and the authentication method information includes, for example, possession information, biometric information, and memory information.

The pre-priority ID is information that identifies the pre-priority information stored in the pre-priority storage unit 121.

The authentication method information is information on at least one authentication method executed by the authentication system 100, and may be information indicating the authentication method itself, or information indicating elements of the authentication method that can be processed by the authentication system 100 (e.g., possession information, biometric information, memory information). The authentication method information may be information indicating whether or not to adopt as an authentication method, and may include, for example, for each authentication method or for each element of an authentication method, "Used" indicating that it is adopted as an authentication method or an element of an authentication method, or "Not Used" indicating that it is not adopted as an authentication method or an element of an authentication method. Note that the information indicating whether or not to adopt as an authentication method or an element of an authentication method is not limited to "Used" or "Not Used".

The pre-priority information may include information indicating that the method will not be adopted as an authentication method (e.g., "not allowed").

The runtime authentication method generation unit 131 generates at least one runtime authentication method information indicating at least one authentication method when the user makes a payment at an affiliated store, associated with runtime priority information indicating a predetermined priority order, based on the provider authentication method information and the advance priority information, and stores the information in the runtime authentication method storage unit 132.

The runtime authentication method generation unit 131 can also generate at least one runtime authentication method information associated with runtime priority information indicating a predetermined priority based on the provider priority information.

The execution priority information is information indicating the priority order of execution when the authentication system 100 executes at least one authentication method to authenticate a user's payment at an affiliated store. Note that the execution priority information may also include information indicating that the method is not to be adopted as an authentication method (e.g., "not allowed").

The runtime authentication method information is information indicating authentication method information related to at least one authentication method used by the authentication system 100 to authenticate a user making a payment at an affiliated store, in association with the priority indicated by the runtime priority information. In other words, the authentication system 100 authenticates a user in the order of priority indicated by the runtime priority information, and if user authentication is successful using any of the authentication methods indicated by the runtime authentication method information, the authentication system 100 can authenticate the user making a payment at an affiliated store.

When the runtime authentication method generation unit 131 generates runtime priority information based on both the advance priority information and the provider priority information, the runtime authentication method generation unit 131 may generate runtime priority information such that the provider priority information takes precedence over the advance priority information in a specified case, or may generate runtime priority information such that the advance priority information takes precedence over the provider priority information in a specified case.

Specifically, for example, if the pre-priority information sets the "authentication method based on biometric information" as the highest priority and the provider priority information sets the "authentication method based on memory information" as the highest priority, the runtime authentication method generation unit 131 may prioritize the provider priority information over the pre-priority information and generate runtime authentication method information in which the "authentication method based on memory information" is set as the highest priority. This enables the authentication system 100 to perform authentication in the priority order desired by the member store, and realize flexible authentication processing that takes into consideration individual member stores.

Also, for example, if the advance priority information is set to "authentication methods based only on possession information are not allowed" and the provider priority information is set to the highest priority level of "authentication methods based only on possession information", the runtime authentication method generation unit 131 may prioritize the advance priority information over the provider priority information and generate runtime authentication method information set to "authentication methods based only on possession information are not allowed". This allows the authentication system 100 to be set not to accept authentication methods desired by affiliated stores, and the authentication system 100 can achieve highly convenient authentication processing while maintaining security during authentication.

The runtime authentication method generation unit 131 may also generate runtime authentication method information again when instructions from the affiliated store or the administrator of the authentication system 100 or when certain conditions are met.

Specifically, for example, when an affiliated store wishes to change the priority order based on the runtime authentication method information provided to the provider device 200 by the runtime authentication method providing unit 133 described below, and the authentication system 100 receives information instructing a change in priority order, the runtime authentication method generating unit 131 may regenerate the runtime authentication method information.

In this case, the affiliated store, for example, via the provider device 200, checks the runtime authentication method information and provides the provider priority information to the authentication system 100 again, and the provider registration unit 111 re-registers the provider priority information. Then, based on the re-registered provider priority information, the runtime authentication method generation unit 131 may re-generate the runtime authentication method information. This allows the affiliated store to request re-generation of the runtime authentication method information after checking the provided runtime authentication method information, and the authentication system 100 can realize flexible authentication processing that takes into consideration individual affiliated stores.

In addition, the operator operating the provider device 200 may re-register the provider priority information by modifying the runtime priority information by operating a specific screen displayed on the provider device 200.

In this case, all or part of the runtime priority information may be set so that it cannot be modified by the affiliated store. This allows the authentication system 100 to set a priority that the affiliated store desires, but will not accept, and the authentication system 100 can achieve highly convenient authentication processing while maintaining security during authentication.

In addition, for example, when the pre-priority information is updated by the administrator of the authentication system 100, the runtime authentication method generation unit 131 may regenerate the runtime authentication method information based on the updated pre-priority information. This allows the priority of the authentication process to be changed flexibly in response to instructions from the administrator of the authentication system 100, and enables highly convenient authentication process to be realized while maintaining security during authentication.

In addition, for example, when a certain condition is met, such as at a predetermined timing such as during system maintenance or when a certain number of payments have been made at an affiliated store, the pre-priority information may be updated, and the runtime authentication method generation unit 131 may regenerate the runtime authentication method information based on the updated pre-priority information.

Figure 6 is a diagram showing an example of information stored in the runtime authentication method storage unit 132. Information stored in the runtime authentication method storage unit 132 includes, for example, a runtime authentication method ID, runtime authentication method information, and runtime priority information, and the runtime authentication method information includes, for example, possession information, biometric information, and memory information.

The runtime authentication method information may be any information indicating whether or not to adopt an authentication method, and may include, for example, for each authentication method or for each element of an authentication method, "Used" indicating that the method is adopted as an authentication method or an element of an authentication method, or "Not Used" indicating that the method is not adopted as an authentication method or an element of an authentication method. Note that the information indicating whether or not the method is adopted as an authentication method or an element of an authentication method is not limited to "Used" or "Not Used".

The runtime priority information may include information indicating that the method is not to be adopted as an authentication method (e.g., "not allowed").

The runtime authentication method providing unit 133 provides the runtime authentication method information stored in the runtime authentication method storage unit 132 to the provider device 200. That is, the runtime authentication method providing unit 133 refers to the provider information storage unit 112 in which at least one piece of provider authentication method information is recorded and the prior priority storage unit 121 in which prior priority information is recorded, and provides the provider device 200 with at least one piece of runtime authentication method information associated with the runtime priority information.

The runtime authentication method providing unit 133 may also provide the provider device 200 with at least one piece of runtime authentication method information associated with runtime priority information that is further generated based on the provider priority information. That is, the runtime authentication method providing unit 133 may refer to the provider information storage unit 112, which further records the provider priority information, and provide the provider device 200 with at least one piece of runtime authentication method information associated with the runtime priority information.

The user authentication information acquisition unit 141 acquires user authentication information from the provider device 200 when authenticating a user making a payment at an affiliated store.

When authenticating a user making a payment at an affiliated store, the affiliated store first requests the user to provide user authentication information corresponding to the authentication method indicated by the runtime authentication method information provided by the runtime authentication method providing unit 133.

Specifically, for example, the affiliated store requests the user to provide user authentication information required for the authentication method indicated by the runtime authentication method information that corresponds to the first priority in the priority order indicated by the runtime priority information.

The provider device 200 then acquires the user authentication information from the user device 300 or the user, and provides it to the authentication system 100. That is, the provider device 200 (e.g., the provider terminal 220) may detect at least one user device 300 in the vicinity of the provider device 200, and provide possession information related to the detected at least one user device 300 to the authentication system 100. The provider device 200 (e.g., the provider terminal 220) may also acquire biometric information or stored information from the user, and provide the acquired biometric information or stored information to the authentication system 100.

Note that if the affiliated store can obtain the user authentication information without requesting that the user provide it (for example, if the provider terminal 220 can receive the possession information transmitted from the user device 300), the affiliated store may obtain the user authentication information without requesting that the user provide it. This allows the user to provide the user authentication information without performing any special operation to provide the user authentication information, making it possible to realize a highly convenient authentication process.

Furthermore, the affiliated store may request the user to provide all or part of the user authentication information that can be obtained at the affiliated store, regardless of the priority indicated by the runtime priority information. This allows the authentication system 100 to perform processing based on the priority without the affiliated store having to determine the priority. Furthermore, even if authentication by the authentication unit 142, which will be described later, fails, there is no need to request the user to provide user authentication information again, and authentication processing that is highly convenient for the user can be realized.

The authentication unit 142 authenticates a payment made by a user at a member store in a predetermined order of priority indicated by the runtime priority information, based on at least one piece of runtime authentication method information and at least one piece of user authentication information for authenticating a user in the at least one piece of runtime authentication method information acquired from the provider device 200 through the user authentication information acquisition unit 141.

Specifically, for example, the authentication unit 142 authenticates a payment made by a user at an affiliated store when the user authentication information stored in the user information storage unit 114 matches the user authentication information obtained from the provider device 200 in the authentication method indicated by the runtime authentication method information corresponding to a predetermined priority indicated by the runtime priority information.

The process of identifying an authentication method corresponding to a predetermined priority from among the authentication methods indicated by the runtime authentication method information based on the runtime authentication method information may be performed by the authentication unit 142 or by the provider device 200.

The authentication unit 142 authenticates a user making a payment at an affiliated store using the authentication method indicated by the runtime authentication method information corresponding to the first priority in the priorities indicated by the runtime priority information. Then, if authentication is not possible using the authentication method indicated by the runtime authentication method information corresponding to the first priority, the authentication unit 142 authenticates the user making a payment at an affiliated store using the authentication method indicated by the runtime authentication method information corresponding to the second priority, which is the next priority after the first priority. In this way, the authentication unit 142 authenticates a user making a payment at an affiliated store in the order of the predetermined priorities indicated by the runtime priority information.

Here, authentication cannot be performed using the authentication method indicated by the runtime authentication method information corresponding to the first priority level, which may occur, for example, when the user authentication information acquired through the provider device 200 does not match the user authentication information registered in the user registration unit 113 or is not registered in the user registration unit 113.

Below is a specific example of how the authentication system 100 authenticates a user's payment at an affiliated store in the order of predetermined priorities indicated by the runtime priority information.

First, in a first specific example, the provider device 200 identifies an authentication method indicated by the runtime authentication method information corresponding to the first priority in the priority order indicated by the runtime priority information, acquires user authentication information (first user authentication information) required for that authentication method from the user or the user device 300, and provides it to the authentication system 100. The user authentication information acquisition unit 141 acquires the first user authentication information. The authentication unit 142 authenticates the user making a payment at the affiliated store based on the runtime authentication method information and the acquired first user authentication information.

Then, if authentication cannot be performed using the authentication method indicated by the runtime authentication method information corresponding to the first priority, the authentication unit 142 notifies the provider device 200, for example, that authentication has not been performed.

The notified provider device 200 identifies the authentication method indicated by the runtime authentication method information corresponding to the second priority level next to the first priority level in the priority levels indicated by the runtime priority information, based on the runtime authentication method information, and acquires user authentication information (second user authentication information) required for the authentication method from the user or the user device 300, and provides it to the authentication system 100. The user authentication information acquisition unit 141 acquires the second user authentication information.

The authentication unit 142 authenticates the user making a payment at the affiliated store based on the runtime authentication method information and the acquired second user authentication information. This allows the affiliated store and the user to handle only the user authentication information required for each authentication process of the authentication method in a predetermined priority order, making the authentication process convenient and safe.

In addition, in a second specific example, if authentication cannot be performed using the authentication method indicated by the runtime authentication method information corresponding to the first priority, the authentication unit 142 may, for example, notify the provider device 200 of information to that effect, and may identify the authentication method indicated by the runtime authentication method information corresponding to the second priority based on the runtime authentication method information, and may notify the provider device 200 of at least one of the authentication method information and information indicating elements of the authentication method that the provider device 200 should acquire in the authentication method indicated by the authentication method information (e.g., possession information, biometric information, memory information).

Based on the notification, the provider device 200 may then obtain the necessary user authentication information from the user or the user device 300 and provide it to the authentication system 100. This allows the authentication system 100 to perform processing based on priority without the affiliated store having to determine the priority.

In addition, in a third specific example, the provider device 200 may acquire all or a part of the user authentication information that can be acquired at the affiliated store from the user or the user device 300, regardless of the priority order indicated by the runtime priority information, and provide the information to the authentication system 100. In this case, the user authentication information acquisition unit 141 acquires all or a part of the user authentication information that can be acquired at the affiliated store.

The authentication unit 142 may then identify the authentication method indicated by the runtime authentication method information that corresponds to the first priority in the priority order indicated by the runtime priority information, and authenticate the payment by the user at the affiliated store in the order of priority indicated by the runtime priority information, based on the user authentication information (first user authentication information) required for that authentication method from among all or a portion of the acquired user authentication information.

Furthermore, if authentication cannot be performed using the authentication method indicated by the runtime authentication method information corresponding to the first priority, the authentication unit 142 may identify the authentication method indicated by the runtime authentication method information corresponding to the second priority in the priority order indicated by the runtime priority information, and authenticate the user making payment at the affiliated store based on the user authentication information (second user authentication information) required for that authentication method from all or part of the acquired user authentication information. In this way, even if authentication using the authentication method with the first priority fails, the authentication system 100 can perform authentication using the authentication method with the second priority without the user and affiliated store having to perform any further operations.

In addition, in a fourth specific example, if information not acquired by the user authentication information acquisition unit 141 (e.g., possession information) is information indicating an element of an authentication method corresponding to the first priority among the authentication methods indicated by the runtime authentication method information, the authentication unit 142 may authenticate the user making a payment at an affiliated store using an authentication method corresponding to the next priority after the first priority. This allows the authentication unit 142 to flexibly change the authentication method depending on the user authentication information that the authentication system 100 can acquire from the provider device 200, and easily authenticate the user making a payment at an affiliated store.

Note that the above examples are examples of methods for authenticating a user who makes a payment at an affiliated store in the order of the predetermined priorities indicated by the runtime priority information, and methods for authenticating a user who makes a payment at an affiliated store in the order of the predetermined priorities indicated by the runtime priority information are not limited to these.

The authentication unit 142 may also identify at least one user candidate from among the multiple users based on a predetermined authentication method, and further identify a user who will make a payment from the at least one user candidate, and authenticate the user who will make a payment at the affiliated store.

Specifically, if the authentication method indicated by the runtime authentication method information is, for example, an authentication method based on possession information and/or biometric information and/or memory information, the authentication unit 142 may identify at least one user candidate from among multiple users based on the possession information, identify a user who will make a payment from the at least one user candidate based on at least one of the biometric information and/or memory information, and authenticate the user who will make a payment at the affiliated store. In this way, by performing authentication based on an authentication method that combines multiple elements, it is possible to achieve both user convenience and security during authentication, and easily authenticate users who will make payments at affiliated stores.

In this case, more specifically, for example, the authentication unit 142 identifies at least one user corresponding to at least one user device 300 as a user candidate based on the possession information of at least one user device 300 detected by the provider terminal 220. Then, based on at least one of the biometric information and memory information acquired from the user, the authentication unit 142 identifies and authenticates a user from among the user candidates who corresponds to at least one of the biometric information and memory information as a user who will make payment.

Furthermore, if the authentication method indicated by the runtime authentication method information is, for example, an authentication method based on memory information and biometric information, the authentication unit 142 may, for example, identify at least one user candidate from among multiple users based on the memory information, and identify a user who will make a payment from the at least one user candidate based on the biometric information, and authenticate the user who will make a payment at the affiliated store. In this way, by performing authentication based on an authentication method that combines multiple elements, it is possible to achieve both user convenience and authentication security, and to easily authenticate users who will make payments at affiliated stores.

In this case, more specifically, for example, the authentication unit 142 identifies at least one user corresponding to the stored information as a user candidate based on the stored information. Then, based on biometric information acquired from the user, the authentication unit 142 may identify and authenticate a user from among the user candidates corresponding to the biometric information as a user who will make payment.

In addition, if the authentication method indicated by the runtime authentication method information is, for example, an authentication method based only on possession information, the authentication unit 142 may, for example, identify at least one user candidate from among multiple users based on the possession information, and identify a user from the at least one user candidate who will make a payment based on the same possession information or further possession information acquired as necessary, and authenticate the user who will make a payment at the affiliated store. This allows the user to be authenticated for payment without providing user authentication information other than the possession information, and authentication of a user who will make a payment at an affiliated store can be performed easily, taking into consideration the convenience of the user. Note that, if only one user candidate is identified from multiple users, the user may be authenticated at the same time as being identified.

In addition, if the authentication method indicated by the runtime authentication method information is, for example, an authentication method based only on biometric information, the authentication unit 142 may, for example, identify at least one user candidate from among multiple users based on the biometric information, and identify a user from the at least one user candidate who will make a payment based on the same biometric information or further biometric information acquired as necessary, and authenticate the user who will make a payment at the affiliated store. This allows the user to be authenticated for payment without providing user authentication information other than the biometric information, and authentication of a user who will make a payment at an affiliated store can be performed easily, taking into account the convenience of the user. Note that, if only one user candidate is identified from multiple users, the user may be authenticated at the same time as being identified.

In addition, if the authentication method indicated by the runtime authentication method information is, for example, an authentication method based only on stored information, the authentication unit 142 may, for example, identify at least one user candidate from among multiple users based on the stored information, and identify a user from the at least one user candidate who will make a payment based on the same stored information or further stored information acquired as necessary, and authenticate the user who will make a payment at the affiliated store. This allows the user to be authenticated for payment without providing user authentication information other than the stored information, and authentication of a user who will make a payment at an affiliated store can be performed easily, taking into account the convenience of the user. Note that, if only one user candidate is identified from multiple users, the user may be authenticated at the same time as being identified.

Figure 7 is a flowchart showing an example of processing in authentication system 100, one embodiment of the present invention.

First, the provider device 200 provides provider information including provider authentication method information and provider priority information to the authentication system 100 (S701), and the provider registration unit 111 registers the provider information (S702). In addition, the user device 300 provides user information including user authentication information to the authentication system 100 (S703), and the user registration unit 113 registers the user information (S704).

The runtime authentication method generation unit 131 generates runtime authentication method information based on the provider authentication method information, the provider priority information, and the pre-priority information that is set in advance (S705). The runtime authentication method provision unit 133 provides the runtime authentication method information to the provider device 200 (S706).

The authentication unit 142 or the provider device 200 identifies an authentication method with a predetermined ranking based on the runtime authentication method information (S707). The provider device 200 requests the user to provide user authentication information required for the authentication method with the predetermined ranking (S708). The provider device 200 acquires the user authentication information from the user or the user device 300 (S709). In this case, the provider device 200 may acquire, for example, biometric information or stored information from the user, or may acquire possession information from the user device 300.

The user authentication information acquisition unit 141 acquires user authentication information from the provider device 200 (S710). The authentication unit 142 authenticates the user making a payment at the affiliated store based on the runtime authentication method information and the user authentication information acquired from the provider device 200 (S711). If the authentication is successful (S711: Yes), the user's payment at the affiliated store is completed (S712). If the authentication is unsuccessful (S711: No), the processes of S707 to S711 are performed using the authentication method corresponding to the next priority indicated by the runtime priority information.

The above describes one embodiment of the present invention. The authentication system 100 refers to the provider information storage unit 112 in which provider authentication method information is recorded and the prior priority storage unit 121 in which prior priority information is recorded, and provides at least one runtime authentication method information associated with runtime priority information indicating a predetermined priority to the provider device 200, and can authenticate a user who uses a service in a predetermined order of priority based on the at least one runtime authentication method information and the user authentication information acquired from the provider device 200. This allows the authentication system 100 to perform authentication sequentially using an authentication method that is simple for the user and the service provider, and can easily perform user authentication. This also allows the user to perform empty-handed payment when applied to a mode of authenticating a user making a payment at an affiliated store.

Furthermore, if the authentication system 100 is unable to authenticate a user who uses a service using an authentication method corresponding to the first priority in the priorities indicated by the runtime priority information, the authentication system 100 can authenticate the user who uses the service using an authentication method corresponding to the next priority after the first priority. As a result, even if the authentication system 100 is unable to authenticate a user using an authentication method corresponding to a specific priority, the authentication system 100 can easily authenticate the user by sequentially authenticating the user using an authentication method that is simple for the user and the service provider.

The authentication system 100 can also provide the provider device 200 with at least one runtime authentication method information associated with runtime priority information indicating a predetermined priority, by referring to a provider information storage unit that further records provider priority information indicating the priority of each of at least one provider authentication method information. This makes it possible to easily authenticate a user based on a priority order that takes into account the priority of the authentication method at the service provider.

Furthermore, the authentication system 100 can authenticate a user using at least one authentication method based on at least one of possession information, biometric information, and stored information.

The authentication system 100 can also authenticate a user using an authentication method that performs authentication based on distance information indicating the distance between the user's belongings and the provider terminal 220. This allows the authentication system 100 to easily authenticate a user who is near the provider terminal 220 at the service provider.

The authentication system 100 can also identify at least one user candidate from among a plurality of users based on the possession information, and identify a user from among the user candidates who will use the service based on at least one of the biometric information and the stored information, and authenticate the user who will use the service. This allows authentication based on an authentication method that combines multiple elements, making it possible to easily authenticate users while achieving both convenience and security during authentication.

The authentication system 100 can also identify at least one user candidate from among multiple users based on biometric information, identify a user from among the user candidates who will use the service based on stored information, and authenticate the user who will use the service.

The authentication system 100 can also identify at least one user candidate from among a plurality of users based on the stored information, identify a user from among the user candidates who will use the service based on the biometric information, and authenticate the user who will use the service.

The authentication system 100 can also accept and register user information including at least one piece of user authentication information from the user device 300. This allows the user to be easily authenticated by the authentication system 100, which handles everything from registering the user authentication information to the authentication process.

The authentication system 100 can also accept and register provider information including at least one provider authentication method information from the provider device 200. This allows the service provider to easily receive user authentication using the authentication system 100, which handles everything from registering provider information to authentication processing.

Note that the present embodiment is intended to facilitate understanding of the present invention, and is not intended to limit the interpretation of the present invention. The present invention may be modified or improved without departing from the spirit of the present invention, and equivalents thereof are also included in the present invention.

100 Authentication system, 111 Provider registration unit, 112 Provider information storage unit, 113 User registration unit, 114 User information storage unit, 121 Pre-priority storage unit, 131 Runtime authentication method generation unit, 132 Runtime authentication method storage unit, 133 Runtime authentication method provision unit, 141 User authentication information acquisition unit, 142 Authentication unit, 200 Provider device, 220 Provider terminal, 300 User device

Claims (13)

An authentication program for enabling a computer to realize an authentication system for authenticating a user who uses a service, comprising:
The computer includes:
a runtime authentication method providing unit that refers to a provider information storage unit in which at least one provider authentication method information relating to at least one authentication method for authenticating the user, which is executable by a provider of the service when the user uses the service , and provider priority information indicating a priority order desired by the provider for each of the at least one provider authentication method information, and a preliminary priority storage unit in which preliminary priority information indicating a priority order of each of the at least one authentication method that is set in advance by an administrator of the authentication system is recorded , and provides to a provider device used by the provider at least one runtime authentication method information indicating at least one runtime authentication method which is the at least one authentication method when authenticating the user who uses the service, the runtime authentication method information being associated with the provider authentication method information, the provider priority information, and runtime priority information indicating a predetermined priority order based on the preliminary priority information;
an authentication unit that authenticates the user who uses the service in the order of the predetermined priority based on the at least one piece of runtime authentication method information and at least one piece of user authentication information for authenticating a user in the at least one piece of runtime authentication method information acquired from the provider device;
A certification program that achieves this. 2. The authentication program according to claim 1, wherein, when a first authentication for authenticating the user when using the service based on the at least one runtime authentication method information corresponding to a first priority in the predetermined priorities is not possible, the authentication unit performs a second authentication for authenticating the user using the service based on the at least one runtime authentication method information corresponding to a second priority next to the first priority in the predetermined priorities and the at least one user authentication information for authenticating the user in the at least one runtime authentication method corresponding to the second priority . a user authentication information acquisition unit configured to acquire the user authentication information including first user authentication information required in the first authentication and second user authentication information required in the second authentication,
the authentication unit, after acquiring the user authentication information, performs the first authentication based on the first user authentication information, and when the authentication corresponding to the first priority order cannot be performed, performs the second authentication based on the second user authentication information.
The authentication program according to claim 2 . The computer further realizes a user authentication information acquisition unit that acquires user authentication information required for the second authentication,
the authentication unit performs the second authentication without performing the first authentication when user authentication information required for the second authentication is not an element of a runtime authentication method for the first authentication.
The authentication program according to claim 2 . the at least one authentication method includes at least one authentication method based on at least one of possession information related to possessions held by the user, biometric information related to a biometric information of the user, and stored information stored by the user;
The at least one piece of user authentication information includes at least one of the possession information, the biometric information, and the memory information.
The authentication program according to any one of claims 1 to 4 . The authentication program according to claim 5 , wherein the possession information includes distance information indicating a distance between the possession and a provider terminal installed by the provider. The user includes a plurality of users,
The authentication program according to claim 5 or 6, wherein the authentication unit identifies at least one user candidate from among the plurality of users based on the possession information, and identifies a user from the at least one user candidate who will use a service based on at least one of the biometric information and the memory information , and authenticates the user who will use the service. The user includes a plurality of users,
The authentication program according to any one of claims 5 to 7, wherein the authentication unit identifies at least one user candidate from among the plurality of users based on the biometric information, and identifies a user who uses a service from among the at least one user candidate based on the stored information, and authenticates the user who uses the service. The user includes a plurality of users,
The authentication program according to any one of claims 5 to 8, wherein the authentication unit identifies at least one user candidate from among the plurality of users based on the stored information, and identifies a user who will use a service from among the at least one user candidate based on the biometric information, and authenticates the user who will use the service. The computer includes:
and further realizing a user registration unit that receives and registers user information including the at least one piece of user authentication information from a user device used by the user.
The authentication program according to any one of claims 1 to 9 . The computer includes:
a provider registration unit that receives provider information including the at least one provider authentication method information from the provider device and registers the provider information.
The authentication program according to any one of claims 1 to 10 . An authentication system for authenticating a user who uses a service, comprising:
a runtime authentication method providing unit that refers to a provider information storage unit in which at least one provider authentication method information relating to at least one authentication method for authenticating the user, which is executable by a provider of the service when the user uses the service , and provider priority information indicating a priority order desired by the provider for each of the at least one provider authentication method information, and a preliminary priority storage unit in which preliminary priority information indicating a priority order of each of the at least one authentication method that is set in advance by an administrator of the authentication system is recorded , and provides to a provider device used by the provider at least one runtime authentication method information indicating at least one runtime authentication method which is the at least one authentication method when authenticating the user who uses the service, the runtime authentication method information being associated with the provider authentication method information, the provider priority information, and runtime priority information indicating a predetermined priority order based on the preliminary priority information;
an authentication unit that authenticates the user who uses the service in the order of the predetermined priority based on the at least one piece of runtime authentication method information and at least one piece of user authentication information for authenticating a user in the at least one piece of runtime authentication method information acquired from the provider device;
An authentication system comprising: 1. A computer-implemented authentication method for implementing an authentication system for authenticating a user who uses a service, comprising:
The computer,
referring to a provider information storage unit in which at least one provider authentication method information relating to at least one authentication method for authenticating the user, which is executable by a provider of the service when the user uses the service, and provider priority information indicating a priority order desired by the provider for each of the at least one provider authentication method information , and a preliminary priority storage unit in which preliminary priority information indicating a priority order for each of the at least one authentication method set in advance by an administrator of the authentication system is recorded, providing to a provider device used by the provider at least one runtime authentication method information indicating at least one runtime authentication method which is the at least one authentication method when authenticating the user who uses the service, the runtime authentication method information being associated with the provider authentication method information, the provider priority information, and runtime priority information indicating a predetermined priority order based on the preliminary priority information;
authenticating the user who uses the service in the order of the predetermined priority based on the at least one provider authentication method information and at least one user authentication information for authenticating a user in the at least one runtime authentication method information acquired from the provider device;
Authentication method.

Images