JP7543338B2 - Authentication program, authentication system, and authentication method - Google Patents

Description

The present invention relates to an authentication program, an authentication system, and an authentication method.

Conventionally, technologies related to multiple authentication methods have been known to more easily achieve user authentication when a user uses a service.

For example, in the system described in Patent Document 1, the biometric information data generated based on the user's biometric information acquired from the user and the information acquired from the user's personal terminal match information previously registered by the user, and the system authenticates the user and generates data for processing the user's payment at affiliated stores.

JP 2006-190112 A

However, in the system described in Patent Document 1, authentication is performed only using a fixed authentication method, and authentication is not performed using an authentication method that can be flexibly set according to the user.

The present invention aims to provide an authentication program, authentication system, and authentication method that can authenticate a user using an authentication method that can be flexibly set according to the user in a face-to-face service that provides the user with a service face-to-face.

An authentication program according to one aspect of the present invention causes a computer to realize an authentication method providing unit that provides at least one authentication method information related to at least one authentication method to at least one of a provider device used by a service provider and a user device of a user based on authentication history information related to a user's authentication history and at least one user authentication information registered in advance by a user as an element of at least one authentication method for authenticating a user when providing the face-to-face service, in a face-to-face service that provides a service to a user in face-to-face, and an authentication unit that authenticates a user receiving the service based on the at least one authentication method information and at least one user authentication information corresponding to the at least one authentication method information obtained from at least one of the provider device and the user device.

An authentication system according to one aspect of the present invention includes an authentication method providing unit that provides at least one authentication method information related to at least one authentication method to at least one of a provider device used by a service provider and a user device of a user based on authentication history information related to a user's authentication history and at least one user authentication information registered in advance by the user as an element of at least one authentication method for authenticating the user when providing the face-to-face service in a face-to-face service, and an authentication unit that authenticates a user receiving the service based on the at least one authentication method information and at least one user authentication information corresponding to the at least one authentication method information acquired from at least one of the provider device and the user device.

In one aspect of the present invention, an authentication method in a face-to-face service in which a computer provides a service to a user face-to-face is provided by providing at least one authentication method information to at least one of a provider device used by a service provider and a user device of a user based on authentication history information related to the user's authentication history and at least one user authentication information registered in advance by the user as an element of at least one authentication method for authenticating the user when the face-to-face service is provided, and authenticating a user receiving the service based on the at least one authentication method information and at least one user authentication information corresponding to the at least one authentication method information obtained from at least one of the provider device and the user device.

In this invention, a "part" does not simply mean a physical means, but also includes cases where the functions of the "part" are realized by software. Furthermore, the functions of one "part" or device may be realized by two or more physical means or devices, and the functions of two or more "parts" or devices may be realized by one physical means or device.

According to the present invention, it is possible to provide an authentication program, authentication system, and authentication method that can authenticate a user using an authentication method that can be flexibly set according to the user in a face-to-face service that provides the user with a service face-to-face.

FIG. 1 is a diagram showing an overview of authentication processing in an authentication system 100 according to an embodiment of the present invention. 1 is a diagram showing a configuration of an authentication system 100 according to an embodiment of the present invention. 4 is a diagram showing an example of information stored in a user information storage unit 112. FIG. 11 is a diagram showing an example of information stored in an authentication history storage unit 121. FIG. 11 is a diagram showing an example of information stored in an authentication method storage unit 132. FIG. 4 is a flowchart showing an example of processing in the authentication system 100 according to an embodiment of the present invention.

The present invention relates to an authentication program, authentication system, and authentication method that authenticate a user when the user uses a specific service. Here, the specific service is a face-to-face service that provides a service to the user face-to-face, such as payment at an affiliated store, management of entry and exit to a specific building or area, and a service that provides a specific benefit to the user. That is, the present invention may authenticate a user who makes a payment when paying for a specific product at a store, or may authenticate a user who is able to enter or exit a building or area when managing entry and exit to the building or area. Also, a specific benefit may be provided to a user authenticated by the present invention.

The following describes an embodiment in which the present invention is applied to an authentication system that authenticates a user making a payment at a member store (i.e., a service provider).

A preferred embodiment of the present invention will be described with reference to the accompanying drawings. FIG. 1 is a diagram showing an overview of authentication processing in an authentication system 100 according to one embodiment of the present invention.

An authentication system 100, which is one embodiment of the present invention, is an information processing system realized by an authentication program, and is an information processing system that authenticates a user's payment at an affiliated store. Authentication system 100 authenticates a user's payment at an affiliated store based on information required to authenticate the user's payment at an affiliated store, which is obtained directly or indirectly from the affiliated store and the user.

First, the user provides user authentication information for authenticating the user to the authentication system 100 via the user device 300, and registers it as an element of at least one authentication method (S101). The affiliated store (provider) accepts a payment application from the user (S102), and the authentication system 100 accepts an authentication request for the user from the affiliated store (S103). Based on the authentication history information and the user authentication information registered in advance by the user, the authentication system 100 generates authentication method information on an authentication method for authenticating the user making a payment at the affiliated store, and provides it to the provider device 200 described below (S104).

When the user makes a payment at the affiliated store, the affiliated store requests the user to provide user authentication information corresponding to the authentication method information, and the user provides the corresponding user authentication information to the provider device 200 (S105). The affiliated store provides the acquired user authentication information to the authentication system 100 (S106). The authentication system 100 authenticates the user making the payment at the affiliated store based on the authentication method information and the user authentication information acquired from the provider device 200 (S107). Then, the user's payment at the affiliated store is completed (S108).

In addition, in S104, the authentication system 100 may provide authentication method information to the user device 300 described later (not shown). In this case, the authentication system 100 may authenticate the user making a payment at the affiliated store based on the authentication method information provided to the user device 300 and the user authentication information acquired from the user device 300, and provide the authentication result to the provider device 200.

The authentication method here is a method by which the authentication system 100 authenticates a user making a payment at an affiliated store. The authentication method may be, for example, an authentication method based on at least one of possession information related to possessions held by the user (e.g., an information terminal such as the user device 300), biometric information related to the user's biometrics, and memory information stored by the user.

Specifically, the possession information may be, for example, device identification information that identifies a device (e.g., an information terminal such as a smartphone) that is a possession of the user, or location information that indicates the location of the possession (e.g., distance information that indicates the distance between the possession and the provider device 200, or information that indicates GPS coordinates measured by a GPS system using a GPS (Global Positioning System) device). In addition, the possession of the user may provide the possession information to at least one of the authentication system 100 and the provider device 200 directly or indirectly via a cloud or the like as necessary by communication based on a communication standard such as BLE (Bluetooth Low Energy), UWB (Ultra Wide Band), Wi-Fi (registered trademark), or short-range wireless communication (e.g., RFID (Radio Frequency IDentification) or NFC (Near Field Communication)), or may provide the possession information to at least one of the authentication system 100 and the provider device 200 by other methods.

The biometric information may be information about the user's body, such as the user's appearance, fingerprint, palm print, voice print, iris, etc. The user may provide the user's biometric information to the provider device 200, for example, via the provider terminal 220 described below. The user may also provide the user's biometric information to the provider device 200 via the user device 300.

The stored information may be, for example, information that identifies the user in the authentication system 100, a card number used for payment, an account number, a telephone number, an account name such as an email address, a password, a signature or figure entered or selected by the user, a free-entry or multiple choice answer to a given question, or any other information that is stored by the user and can be obtained by the provider device 200. The user enters or selects the stored information through an input device provided on the provider terminal 220 installed at the affiliated store, for example, and provides the stored information to the provider device 200.

The authentication method may be an authentication method that includes at least one of possession information, biometric information, and memory information as elements. In other words, the authentication method may be an authentication method that includes only possession information, biometric information, and memory information as elements, or may be an authentication method that includes two or more of possession information, biometric information, and memory information as elements. In other words, when the authentication method is an authentication method that includes possession information and biometric information as elements, the authentication system 100 authenticates the user making a payment at an affiliated store based on the possession information and biometric information. The authentication method may also be an authentication method that includes information other than possession information, biometric information, and memory information as elements.

In this way, for example, in the case of an authentication method that uses at least one of possession information, biometric information, and stored information as elements, the user can make a payment by a so-called empty-handed payment, which allows the user to make a payment without carrying or presenting the cash or payment card used for the payment (or by carrying or presenting it without any special effort for the user). Note that here, empty-handed payment does not only include a payment made when the user is not wearing anything, but also a payment made when the user is wearing only the items that they normally wear (e.g., a smartphone) (i.e., a state equivalent to empty-handed).

Figure 2 is a diagram showing the configuration of an authentication system 100 according to one embodiment of the present invention. The authentication system 100 is a system that is communicatively connected to a provider device 200, a user device 300, and a behavior history management system 400 via a network such as the Internet. Details of the authentication system 100 will be described later.

The provider device 200 is a device used by the affiliated store. The provider device 200 includes a provider information processing system 210, which is an information processing system used by the affiliated store and is communicatively connected via a network such as the Internet, and a provider terminal 220 installed at the affiliated store. Note that while only one provider device 200 is shown in FIG. 2, if there are multiple affiliated stores, a provider device 200 is provided for each affiliated store. Also, multiple provider devices 200 may be provided at one affiliated store.

The provider information processing system 210 may be, for example, an information processing system that is communicatively connected to the authentication system 100 and the provider terminal 220, and may be an information processing system that is capable of transmitting and receiving various information to and from the authentication system 100 and the provider terminal 220.

The provider terminal 220 may be, for example, a terminal installed in an affiliated store for processing payments, and may include, for example, a cash register terminal or other terminal for reading information (e.g., barcode information or tag information attached to a product) for registering product-related information (e.g., product number, price, etc.) when making a payment, or information that is an element of a specified authentication method (e.g., possession information, biometric information, stored information). That is, the provider terminal 220 may be equipped with a reading device for reading product barcode information, tag information, etc., a detection device for detecting the user's possessions, a detection device for detecting the user's biometric information, and an input device for the user to input stored information, etc.

The affiliated store obtains authentication method information indicating an authentication method for authenticating a user's payment from the authentication system 100 via the provider device 200 (e.g., the provider information processing system 210). In addition, when the user makes a payment at the affiliated store, the affiliated store may obtain user authentication information from the user or a user device 300 described below, for example, via the provider terminal 220, and provide the obtained user authentication information to the provider information processing system 210, or may provide the user authentication information to the authentication system 100 via the provider information processing system 210.

The affiliated store may be a so-called unmanned payment store where payment is made without the operation of a person in charge at the affiliated store (e.g., an operator who operates the provider terminal 220).

The user device 300 is a device used by a user, such as a smartphone, a tablet terminal, or a personal computer. The user accesses the authentication system 100 through the user device 300 and registers user authentication information for authenticating the user in a specific authentication method as an element of the authentication method. That is, the user can register user authentication information such as information about the user's belongings, the user's biometric information, and the user's memory information as an element of the authentication method through the user device 300. In addition, the user can provide user authentication information to at least one of the provider device 200 (e.g., the provider terminal 220) and the authentication system 100 through the user device 300 when making a payment at an affiliated store.

Note that although only one user device 300 is shown in FIG. 2, if there are multiple users, a user device 300 is provided for each user. Also, one user may have multiple user devices 300.

The behavior history management system 400 is an information processing system that manages user behavior history information related to the user's behavior history. Here, the user's behavior history includes, for example, the user's operation history of the user device 300 (e.g., application usage history, Internet search history), the location information history of the user device 300, transaction history through e-commerce sites, SNS (social networking service) usage history, and the history of misuse or trouble related to the user device 300 or a payment card used by the user.

The behavior history management system 400 may be an information processing system that corresponds to each piece of user behavior history information. That is, the behavior history management system 400 may be, for example, an information processing system that manages and operates applications in the user device 300, an information processing system that operates an e-commerce site, or an information processing system that provides SNS.

The behavior history management system 400 can provide user behavior history information to the authentication system 100. At this time, the behavior history management system 400 may provide the information itself indicating the user's behavior history, or may provide information indicating the results of an evaluation of the user's behavior history that is generated based on the information itself indicating the user's behavior history.

Note that although only one behavior history management system 400 is shown in FIG. 2, multiple information processing systems corresponding to multiple pieces of user behavior history information may be provided.

Next, the authentication system 100 will be described in detail. The authentication system 100 includes a user registration unit 111, a user information storage unit 112, an authentication history storage unit 121, a behavior history acquisition unit 122, an authentication method generation unit 131, an authentication method storage unit 132, an authentication method provision unit 133, a user authentication information acquisition unit 141, and an authentication unit 142. The computer that constitutes the authentication system 100 includes a processor and a storage area. Each unit shown in FIG. 2 can be realized, for example, by using the storage area or by the processor executing an authentication program stored in the storage area.

The user registration unit 111 accepts and registers user information including at least one user authentication information from the user device 300 as an element of at least one authentication method for authenticating a user when providing face-to-face services, and stores the information in the user information storage unit 112.

Here, the user authentication information is information that is an element of at least one authentication method for authenticating a user when providing face-to-face services, and is information for authenticating a user in the at least one authentication method. The user authentication information includes, for example, possession information, biometric information, and memory information.

That is, the user registers user authentication information as an element of at least one authentication method. Specifically, for example, the user registers his/her own biometric information (e.g., fingerprint information) as user authentication information to be used for authentication by an authentication method that uses biometric information as an element (e.g., an authentication method that uses only biometric information as an element, or an authentication method that uses biometric information and stored information as elements). Note that when registering the user authentication information, the user registration unit 111 may also acquire consent information in which the user consents to using the registered user authentication information as an element of the authentication method, and accept the registration of the user authentication information.

In addition to the user authentication information, the user information may further include information about the user. Here, the information about the user may be, for example, the user's personal information (e.g., name, address, telephone number, email address, password) and information about the card or device (e.g., user device 300) used for the user's payment (e.g., card number, device number).

The user may register all user authentication information that can be registered in the authentication system 100, or may register only the user authentication information that the user himself/herself wishes to register. This allows the user to arbitrarily select the user authentication information to register, realizing authentication processing that balances the user's security awareness with convenience in the authentication processing of payments.

The user may also register multiple pieces of user authentication information that correspond to the same element of the authentication method as the user authentication information. That is, the user may, for example, register biometric information related to a fingerprint and biometric information related to a voiceprint as biometric information that is the same element, or may register biometric information related to the fingerprints of multiple different fingers.

Figure 3 is a diagram showing an example of information stored in the user information storage unit 112. The information stored in the user information storage unit 112 includes, for example, a user ID and user authentication information, and the user authentication information includes, for example, possession information, biometric information, and memory information. Here, the user ID is information that identifies a user who uses the authentication system 100.

The user information storage unit 112 may store all user authentication information for each user ID, or may store only a portion of the user authentication information. Furthermore, the user may register multiple pieces of user authentication information that correspond to the same element of the elements of a specified authentication method as the user authentication information. That is, the user may register biometric information related to a fingerprint and biometric information related to a voiceprint as biometric information that is the same element, or may register biometric information related to the fingerprints of multiple different fingers.

The authentication system 100 stores the result of authentication by the authentication unit 142, which will be described later, in the authentication history storage unit 121 as authentication history information. FIG. 4 is a diagram showing an example of information stored in the authentication history storage unit 121. The information stored in the authentication history storage unit 121 includes, for example, an authentication history ID, authentication date information, and authentication content information.

The authentication history ID is authentication history identification information that identifies the authentication history. The authentication date information is information indicating the date of authentication. The authentication content information is information indicating the content of the authentication. The authentication date information may also include information indicating the time of authentication. Furthermore, when the authentication system 100 authenticates a user's payment at an affiliated store, the authentication content information may also be information indicating the authentication amount.

The authentication history storage unit 121 may store authentication history information acquired from an external information processing system. In this case, the authentication history storage unit 121 may store the authentication history information itself, or may store, for example, information indicating a link to the authentication history information.

The behavior history acquisition unit 122 acquires user behavior history information from the behavior history management system 400.

Here, the user behavior history information may be any information related to the history of the user's behavior, and may include, for example, information related to the user's operation history of the user device 300 (e.g., application usage history, Internet search history), information related to the location information history of the user device 300, information related to transaction history through e-commerce sites, information related to SNS usage history, and information related to the history of misuse or trouble related to the user device 300 or a payment card used by the user. Furthermore, the user behavior history information managed in the behavior history management system 400 may be information indicating the user's behavior history itself, or may be information indicating the result of an evaluation of the user's behavior history, which is generated based on information indicating the user's behavior history itself.

The behavioral history acquisition unit 122 may acquire the information itself indicating the user's behavioral history, or may acquire information indicating the result of evaluating the user's behavioral history, which is generated based on the information itself indicating the user's behavioral history. The behavioral history acquisition unit 122 may also acquire the user behavioral history information itself acquired from the behavioral history management system 400, or may acquire information indicating a link to the user behavioral history information.

The authentication method generation unit 131 generates at least one piece of authentication method information relating to at least one authentication method based on the authentication history information and at least one piece of user authentication information registered in advance by the user as an element of at least one authentication method for authenticating the user when providing face-to-face services, and stores the information in the authentication method storage unit 132.

The authentication method information here is information on at least one authentication method executed by the authentication system 100, and may be information indicating the authentication method itself, or may be information indicating elements of an authentication method that can be processed by the authentication system 100 (e.g., possession information, biometric information, memory information). The authentication method information may be information indicating whether or not to adopt as an authentication method, and may include, for example, for each authentication method or for each element of an authentication method, "Used" indicating that it is adopted as an authentication method or an element of an authentication method, or "Not Used" indicating that it is not adopted as an authentication method or an element of an authentication method. Note that the information indicating whether or not to adopt as an authentication method or an element of an authentication method is not limited to "Used" or "Not Used".

Specifically, the authentication method generation unit 131 generates authentication method information based on user authentication information that is registered in advance by the user as an element of at least one authentication method. In other words, the authentication method generation unit 131 generates at least one piece of authentication method information related to at least one authentication method among the authentication methods that have the user authentication information registered by the user as an element. This allows the user to use the authentication system 100 within the scope of the user authentication information registered by the user and the corresponding authentication method.

Furthermore, based on the authentication history information, if authentication has been performed in the past with similar content (for example, a payment amount of the same or less), the authentication method generation unit 131 can determine that there is little risk in authenticating the user with similar content, and generate authentication information corresponding to an authentication method that places a smaller burden on the user. This allows the user to be authenticated more easily with an authentication method that is flexibly set according to their own authentication history.

Furthermore, based on the authentication history information, if a similar authentication has not been performed in the past (for example, if a new high-value payment is being made this time, or if a payment is being made at an affiliated store that has not been used before), the authentication method generation unit 131 can determine that there is a high risk in authenticating the user, and can generate authentication method information corresponding to a highly secure authentication method (for example, an authentication method that combines multiple elements) taking into consideration the level of security at the time of authentication to avoid user impersonation or authentication of a payment by a user who does not have the ability to pay. This allows affiliated stores to perform authentication using an authentication method that takes security into consideration, while the authentication method can be flexibly set according to the user's authentication history.

The authentication method generation unit 131 may also calculate the number of elements (e.g., possession information, biometric information, memory information) in an authentication method used when authenticating a user at an affiliated store based on the authentication history information, and generate at least one piece of authentication method information that includes at least the calculated number of elements. Specifically, when the calculated number of elements is two, the authentication method generation unit 131 may generate, for example, authentication method information for an authentication method that includes two or more elements (e.g., an authentication method that authenticates using possession information and biometric information).

The authentication method generation unit 131 can also generate at least one piece of authentication method information based on the user behavior history information.

The authentication method generation unit 131 may also calculate the number of elements (e.g., possession information, biometric information, memory information) in the authentication method used when authenticating a user at an affiliated store based on the user behavior history information, and generate at least one piece of authentication method information that includes at least the calculated number of elements.

Specifically, if the authentication method generation unit 131 determines, based on the user behavior history information, for example, that there is something suspicious about the user's behavior history, it can determine that there is a high risk in authenticating the user and generate authentication information corresponding to a highly secure authentication method.

The authentication method generation unit 131 may also generate at least one piece of authentication method information in association with authentication strength information indicating the strength of authentication in the authentication method, and store the information in the authentication method storage unit 132.

Here, the authentication strength information is information indicating the authentication strength of each authentication method. The authentication strength may be determined, for example, by the number or type of elements of the authentication method (e.g., possession information, biometric information, or memory information). For example, the authentication strength information may be information indicating that an authentication method that combines multiple elements has high authentication strength and an authentication method based on only one element has low authentication strength, or, for example, an authentication method that uses biometric information as an element has high authentication strength and an authentication method that uses possession authentication as an element has low authentication strength. In other words, an authentication method with higher authentication strength indicates that it is an authentication method that can avoid user impersonation or authentication of a user who does not have the ability to pay, and an authentication method with lower authentication strength indicates that it is an authentication method that is easier for users to use.

Specifically, the authentication method generation unit 131 may store in the authentication method storage unit 132 at least one authentication method information whose authentication strength information satisfies a predetermined condition (e.g., authentication method information with the lowest authentication strength information or the highest authentication method information) among a plurality of authentication method information generated based on the authentication history information. This allows the authentication system 100 to authenticate a user with an authentication method that is easy for the user or a highly secure authentication method that takes the provider into consideration, among authentication methods that are flexibly set based on the user's authentication history.

The authentication method generating unit 131 may generate at least one piece of authentication method information including at least authentication strength information corresponding to the required authentication strength, according to the authentication strength required to authenticate the user, which is calculated based on at least one of the authentication history information and the user behavior history information. Specifically, for example, when the authentication strength required to authenticate the user, which is calculated based on at least one of the authentication history information and the user behavior history information, is "2", the authentication method generating unit 131 can generate authentication method information having authentication strength information of "2" or higher than "2". Note that the authentication strength information may be indicated by a numerical value or a symbol (e.g., "A", "B"), and the display format of the authentication strength information is not limited to this.

The authentication method generation unit 131 may generate authentication method information based on machine learning using authentication history information as an input, or, if necessary, using user behavior history information as an input. In this case, the authentication method generation unit 131 may use a machine learning model generated based on authentication history information of multiple other users who use the authentication system 100, or, if necessary, user behavior history information of multiple other users who also use the authentication system 100.

The authentication method generation unit 131 may also generate authentication method information in response to an authentication request from a user that is obtained directly or indirectly (e.g., a payment request from a user at an affiliated store).

The authentication method generation unit 131 may generate authentication method information corresponding to a predetermined condition prior to an authentication request from a user that is acquired directly or indirectly, and the authentication method provision unit 133 described later may provide the authentication method information generated in advance based on an authentication request from a user that is acquired directly or indirectly. In this case, the authentication method generation unit 131 may generate authentication method information again in response to an authentication request from a user that is acquired directly or indirectly.

Specifically, the authentication method generation unit 131 generates authentication method information in association with a predetermined condition (e.g., a condition related to a payment amount) prior to an authentication request from a user. If the authentication request from a user falls within the range of the predetermined condition corresponding to the pre-generated authentication method information (e.g., a payment request for a payment amount equal to or less than a predetermined amount), the authentication method provision unit 133 may provide the pre-generated authentication method information to at least one of the provider device 200 or the user device 300.

On the other hand, if the authentication request from the user does not fall within the range of the specified conditions corresponding to the previously generated authentication method information (for example, if the payment request is for an amount greater than a specified payment amount), the authentication method generation unit 131 may generate authentication method information again in response to the authentication request from the user.

This allows the authentication system 100 to generate authentication method information in advance within the range of authentication requests that are anticipated, and to quickly respond to authentication requests from users.

The authentication method generation unit 131 may generate the authentication method information in advance when a certain condition is met, for example, at a predetermined timing such as during system maintenance, or when a certain number of authentication attempts for a user has been reached.

Figure 5 is a diagram showing an example of information stored in the authentication method storage unit 132. The information stored in the authentication method storage unit 132 includes, for example, an authentication method ID, authentication method information, and authentication strength information, and the authentication method information includes, for example, possession information, biometric information, and memory information.

The authentication method information may be any information indicating whether or not to adopt it as an authentication method, and may include, for example, for each authentication method or for each element of an authentication method, "Used" indicating that it is adopted as an authentication method or an element of an authentication method, or "Not Used" indicating that it is not adopted as an authentication method or an element of an authentication method. Note that the information indicating whether or not to adopt it as an authentication method or an element of an authentication method is not limited to "Used" or "Not Used".

The authentication strength information is information that indicates the strength of authentication for each authentication method. Note that in the diagram shown in FIG. 5, the authentication strength information is shown as a numerical value, but the display format of the authentication strength information is not limited to this and may be, for example, "A", "B", etc.

The authentication method providing unit 133 provides the authentication method information stored in the authentication method storage unit 132 to at least one of the provider device 200 and the user device 300.

The authentication method providing unit 133 may provide authentication method information to the provider device 200. In this case, the affiliated store may request the user to provide user authentication information based on the authentication method information provided to the provider device 200.

The authentication method providing unit 133 may also provide authentication method information to the user device 300. In this case, the user may provide user authentication information to the authentication system 100 through the user device 300.

The authentication method providing unit 133 may also provide authentication method information to both the provider device 200 and the user device 300.

The authentication method providing unit 133 may provide authentication method information with the lowest authentication strength among the authentication method information stored in the authentication method storage unit 132. This allows the user to be authenticated by an authentication method that is easy for the user to use among the authentication methods that are flexibly set based on the authentication history information.

The authentication method providing unit 133 may provide authentication method information with the highest authentication strength among the authentication method information stored in the authentication method storage unit 132. This allows the affiliated store to perform authentication using an authentication method with high security among the authentication methods that are flexibly set based on the authentication history information.

The user authentication information acquisition unit 141 acquires user authentication information from at least one of the provider device 200 and the user device 300 when authenticating a user making a payment at an affiliated store.

The processing of the authentication method providing unit 133 and the user authentication information acquiring unit 141 will be described with specific examples. First, as a first specific example, the processing when the authentication method providing unit 133 provides authentication method information to the provider device 200 will be described.

When authenticating a user making a payment at an affiliated store, the authentication method providing unit 133 first provides authentication method information to the provider device 200. Next, based on the provided authentication method information, the affiliated store requests the user to provide user authentication information that corresponds to the authentication method indicated by the authentication method information.

Then, the provider device 200 acquires user authentication information from the user or the user device 300 and provides it to the authentication system 100, and the user authentication information acquisition unit 141 acquires the user authentication information provided from the provider device 200.

Here, the provider device 200 may detect at least one user device 300 in the vicinity of the provider device 200 (e.g., the provider terminal 220) and provide the authentication system 100 with possession information related to the detected at least one user device 300. The provider device 200 (e.g., the provider terminal 220) may also acquire biometric information or stored information from a user and provide the acquired biometric information or stored information to the authentication system 100.

Note that if the affiliated store can obtain the user authentication information without requesting that the user provide it (for example, if the provider terminal 220 can receive the possession information transmitted from the user device 300), the affiliated store may obtain the user authentication information without requesting that the user provide it. This allows the user to provide the user authentication information without performing any special operation to provide the user authentication information, making it possible to realize a highly convenient authentication process.

Furthermore, when a user receives a request from an affiliated store to provide user authentication information, the user may provide the user authentication information to the authentication system 100 via the user device 300. This allows the user to be authenticated easily and with high security without providing the user authentication information to an external party (e.g., the provider device 200).

As a second specific example, with regard to the processing of the authentication method providing unit 133 and the user authentication information acquiring unit 141, the processing when the authentication method providing unit 133 provides authentication method information to the user device 300 will be described.

When authenticating a user making a payment at an affiliated store, the authentication method providing unit 133 first provides authentication method information to the user device 300. Next, the user provides user authentication information corresponding to the authentication method indicated by the authentication method information provided by the authentication method providing unit 133 to the authentication system 100 via the user device 300, and the user authentication information acquisition unit 141 acquires the user authentication information provided by the user device 300. This allows the user to be authenticated simply and with high security, without providing the user authentication information to an external party (e.g., the provider device 200).

As a third specific example, with regard to the processing of the authentication method providing unit 133 and the user authentication information acquiring unit 141, we will explain the processing in which the authentication method providing unit 133 provides authentication method information to both the provider device 200 and the user device 300.

When authenticating a user making a payment at an affiliated store, the authentication method providing unit 133 first provides authentication method information to both the provider device 200 and the user device 300. Based on the authentication method information provided by the authentication method providing unit 133, the affiliated store requests the user to provide user authentication information corresponding to the authentication method indicated by the authentication method information. Here, the affiliated store may request the user to only provide user authentication information that can be obtained through the provider device 200.

Meanwhile, the user provides the authentication system 100 with user authentication information corresponding to the authentication method indicated by the authentication method information provided by the authentication method providing unit 133 through the user device 300. Here, the user may provide the authentication system 100 with only the user authentication information that can be provided to the authentication system 100 through the user device 300.

Then, the user authentication information acquisition unit 141 acquires the user authentication information provided by the provider device 200 and the user device 300.

When the authentication method providing unit 133 provides authentication method information to both the provider device 200 and the user device 300, the user authentication information acquiring unit 141 may acquire user authentication information provided only from either the provider device 200 or the user device 300. This allows affiliated stores and users to know which authentication method will be used even if they do not provide user authentication information to the authentication system 100.

The authentication unit 142 authenticates the user's payment at the affiliated store based on at least one piece of authentication method information and at least one piece of user authentication information obtained from at least one of the provider device 200 and the user device 300.

Specifically, for example, the authentication unit 142 authenticates a payment made by a user at an affiliated store when the user authentication information stored in the user information storage unit 112 matches the user authentication information obtained from at least one of the provider device 200 and the user device 300 in the authentication method indicated by the authentication method information.

The authentication unit 142 may also provide the authentication result to at least one of the provider device 200 and the user device 300. This allows the affiliated store and the user to confirm the authentication result and complete the user's payment at the affiliated store.

Figure 6 is a flowchart showing an example of processing in authentication system 100, which is one embodiment of the present invention.

First, the user device 300 provides user authentication information to the authentication system 100 (S601), and the user registration unit 111 registers the user authentication information (S602).

The behavior history management system 400 provides the user behavior history information to the authentication system 100 (S603), and the behavior history acquisition unit 122 acquires the user behavior history information. The authentication method generation unit 131 generates authentication method information based on the user behavior history information and the authentication history information stored in the authentication history storage unit 121 (S604).

The authentication method providing unit 133 provides the authentication method information to at least one of the provider device 200 and the user device 300 (e.g., the provider device 200) (S605). Based on the authentication method information, the provider device 200 requests the user or the user device 300 to provide user authentication information corresponding to the authentication method information (S606).

The user or the user device 300 provides user authentication information to the provider device 200 (S607). The provider device 200 provides the user authentication information to the authentication system 100, and the user authentication information acquisition unit 141 acquires the user authentication information from at least one of the provider device 200 and the user device 300 (e.g., the provider device 200) (S608). The authentication unit 142 authenticates the user's payment at the affiliated store based on the authentication method information and the user authentication information (S609).

The authentication method providing unit 133 may provide the authentication method information to the user device 300. In this case, the user may provide the user authentication information to the authentication system 100 directly or through the user device 300, and the user authentication information acquiring unit 141 may acquire the user authentication information from the user or the user device 300.

The above describes one embodiment of the present invention. The authentication system 100 provides at least one authentication method information to at least one of the provider device 200 and the user device 300 based on authentication history information and at least one user authentication information registered in advance by the user as an element of at least one authentication method, and can authenticate a user based on the at least one authentication method information provided and the user authentication information acquired from at least one of the provider device 200 and the user device 300. As a result, in a face-to-face service that provides a service to a user face-to-face, a user can be authenticated based on an authentication method that is flexibly set according to the user's authentication history.

The authentication system 100 can also provide at least one authentication method information to at least one of the provider device 200 and the user device 300 based on the user behavior history information. This allows a user to be authenticated based on an authentication method that is flexibly set according to the user's behavior history in a face-to-face service that provides a service to the user face-to-face.

The authentication system 100 can also provide at least one piece of authentication method information to at least one of the provider device 200 and the user device 300 based on authentication strength information indicating the strength of authentication in the authentication method. This allows the user to be authenticated using an authentication method that is easy for the user to use, or a highly secure authentication method that takes the provider into consideration, among authentication methods that are flexibly set based on the user's authentication history.

The authentication system 100 can also provide at least one piece of authentication method information having at least the number of elements, depending on the number of elements of at least one authentication method calculated based on at least one of the authentication history information and the user behavior history information. This allows a user to be authenticated using an authentication method having a corresponding number of elements, based on the number of elements of the authentication method that is flexibly set according to the user's authentication history and behavior history.

Furthermore, the authentication system 100 can provide at least one authentication method information having at least authentication strength information corresponding to the required authentication strength, according to the authentication strength required to authenticate the user, which is calculated based on at least one of the authentication history information and the user behavior history information. This makes it possible to authenticate a user using an authentication method having a corresponding authentication strength, based on the authentication strength required for authentication, which is flexibly set according to the user's authentication history and behavior history.

Furthermore, the authentication system 100 can authenticate a user using at least one authentication method based on at least one of possession information, biometric information, and stored information.

The authentication system 100 can also authenticate a user using an authentication method that performs authentication based on distance information indicating the distance between the user's belongings and the provider terminal 220. This allows the authentication system 100 to easily authenticate a user who is near the provider terminal 220 at the service provider.

REFERENCE SIGNS LIST 100 Authentication system, 111 User registration unit, 112 User information storage unit, 121 Authentication history storage unit, 122 Action history acquisition unit, 131 Authentication method generation unit, 132 Authentication method storage unit, 133 Authentication method provision unit, 141 User authentication information acquisition unit, 142 Authentication unit, 200 Provider device, 210 Provider information processing system, 220 Provider terminal, 300 User device, 400 Action history management system

Claims (9)

On the computer,
an authentication method generating unit that generates, before the computer directly or indirectly acquires an authentication request from the user, at least one piece of authentication method information relating to the at least one authentication method in association with a predetermined condition according to the content of the authentication, based on authentication history information relating to the authentication history of the user and at least one piece of user authentication information registered in advance by the user as an element of at least one authentication method for authenticating the user when the face-to-face service is provided;
an authentication method providing unit that provides the at least one piece of authentication method information associated with the predetermined condition to at least one of a provider device used by a provider of the service and a user device of the user in response to the acquisition of the authentication request;
an authentication unit that authenticates the user who receives the service based on the at least one piece of authentication method information and the at least one piece of user authentication information corresponding to the at least one piece of authentication method information acquired from at least one of the provider device and the user device;
Realize this,
the authentication method generating unit regenerates the at least one authentication method information in response to the authentication request when it is determined that the content of the authentication requested by the authentication request does not match the predetermined condition;
the authentication unit authenticates the user based on the at least one authentication method information when it is determined that the content of the authentication requested by the authentication request matches the predetermined condition, and authenticates the user based on the at least one regenerated authentication method information when it is determined that the content of the authentication requested by the authentication request does not match the predetermined condition.
Certification program. The authentication program according to claim 1, wherein the authentication method generation unit generates the at least one authentication method information further based on user behavior history information relating to the behavior history of the user. the authentication method generation unit generates the at least one piece of authentication method information based on authentication strength information indicating a strength of authentication in each of a plurality of authentication methods among a plurality of authentication methods each having the at least one piece of user authentication information registered in advance as an element.
The authentication program according to claim 1 or 2. The authentication program according to any one of claims 1 to 3, wherein the authentication method generation unit calculates the number of elements of the at least one authentication method for authenticating the user based on at least one of the authentication history information and user behavior history information related to the behavior history of the user, and generates the at least one authentication method information for authenticating the user based on the number of elements. The authentication program according to claim 3, wherein the authentication method generation unit calculates an authentication strength required to authenticate the user based on at least one of the authentication history information and user behavior history information related to the behavior history of the user, and generates the at least one authentication method information including at least the authentication strength information corresponding to the required authentication strength. the at least one authentication method includes at least one authentication method based on at least one of possession information related to possessions held by the user, biometric information related to a biometric information of the user, and stored information stored by the user;
The at least one piece of user authentication information includes at least one of the possession information, the biometric information, and the memory information.
The authentication program according to any one of claims 1 to 5. The authentication program according to claim 6, wherein the possession information includes distance information indicating a distance between the possession and a provider terminal installed by the provider. an authentication method generation unit that generates, before a computer directly or indirectly acquires an authentication request from a user, at least one piece of authentication method information relating to the at least one authentication method in association with a predetermined condition according to the content of the authentication , based on authentication history information relating to an authentication history of the user and at least one piece of user authentication information registered in advance by the user as an element of at least one authentication method for authenticating the user when the face-to-face service is provided;
an authentication method providing unit that provides the at least one piece of authentication method information associated with the predetermined condition to at least one of a provider device used by a provider of the service and a user device of the user in response to the acquisition of the authentication request;
an authentication unit that authenticates the user who receives the service based on the at least one piece of authentication method information and the at least one piece of user authentication information corresponding to the at least one piece of authentication method information acquired from at least one of the provider device and the user device;
Equipped with
the authentication method generating unit regenerates the at least one authentication method information in response to the authentication request when it is determined that the content of the authentication requested by the authentication request does not match the predetermined condition;
the authentication unit authenticates the user based on the at least one authentication method information when it is determined that the content of the authentication requested by the authentication request matches the predetermined condition, and authenticates the user based on the at least one regenerated authentication method information when it is determined that the content of the authentication requested by the authentication request does not match the predetermined condition.
Authentication system. The computer
In a face-to-face service for providing a service to a user face-to-face, based on authentication history information on an authentication history of the user and at least one piece of user authentication information registered in advance by the user as an element of at least one authentication method for authenticating the user when the face-to-face service is provided, before the computer directly or indirectly acquires an authentication request from the user, generating at least one piece of authentication method information related to the at least one authentication method in association with a predetermined condition according to the content of the authentication;
providing the service to at least one of a provider device used by the provider of the service and a user device of the user;
authenticating the user who receives the service based on the at least one piece of authentication method information and the at least one piece of user authentication information corresponding to the at least one piece of authentication method information acquired from at least one of the provider device and the user device;
Including,
The generating step includes generating the at least one piece of authentication method information again in response to the authentication request when it is determined that the content of authentication requested by the authentication request does not match the predetermined condition;
The authenticating step includes authenticating the user based on the at least one authentication method information when it is determined that the content of the authentication requested by the authentication request matches the predetermined condition, and authenticating the user based on the at least one regenerated authentication method information when it is determined that the content of the authentication requested by the authentication request does not match the predetermined condition.
Authentication method.

Images