JP2012203756A - Authentication device and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce both of burdens on a user and burdens on a system operator for authentication.SOLUTION: By transmitting a question regarding information related to sharing with an authentication object person to a registered opposite party in an SNS and receiving an answer, since authentication to a service can be left to others, burdens of memorizing and managing a password for authentication and a secret question and answer are reduced on both user side and system side. Also, since the authentication does not depend on a fixed password or the like, a security risk due to leakage of the password or the like is suppressed as well.

Description

  The present invention relates to user authentication in an information processing service.

  In various information processing services provided on websites and the like, user authentication has conventionally been performed by collating a user ID with a password represented by a password. The password is not limited to a password, but is collectively referred to as “password” in the present application.

JP 2009-93273 A

  However, the conventional authentication as described above has a problem that it is difficult to remember an ID and a password. In particular, in recent years, with the spread and diversification of services, one person uses a number of services, and the burden of memorizing several sets of IDs and passwords is increasing. Moreover, for security reasons, the burden on the user has increased, for example, passwords that are different for each website are required to be memorized without being written down on paper.

  As another authentication technique, there has also been a proposal for personal authentication using whether or not a question and answer regarding the content can be correctly answered using user behavior history data (referred to as a personal log) (see, for example, Patent Document 1). . This eliminates the need to memorize passwords, etc., but since it is necessary to acquire and manage action history data such as personal logs on the system side, there is a problem that the burden on development and operation on the system operator side increases. It was. Further, in Patent Document 1, a new user who is concerned that privacy may be infringed in that a part of the user's behavior extracted by the system side regardless of the user's intention at the time of authentication is disclosed to the subject or an unknown subject. There was also a problem that led to the burden of

  In addition, there is an example where the user sets secret questions and answers to reset the password when forgetting the password, but the burden of receiving and managing these secret questions and answers on the system side, In addition to the password, the user has a burden of storing these secret questions and answers, which is counterproductive in terms of reducing the burden. Moreover, whether it is a password or a secret question and answer, there is a problem that the reliability of authentication is impaired only by leakage of contents such as characters.

  In view of the above problems, an object of the present invention is to reduce both the burden on the user and the burden on the system operator for authentication.

  Based on the above object, one aspect (1) of the present invention provides a registration accepting means for accepting friend registration associated with each other as a registration partner for social networking service users, and authenticating a person to be authenticated. And a friend authentication unit that causes a registered partner who has registered the friend to perform authentication, wherein the friend authentication unit supports the creation of a question regarding the behavior of the person to be authenticated with the registered partner. A question creating means, an answer receiving means for transmitting the inputted question to the registered partner and receiving an input of an answer to the question from the registered partner, and determining success or failure of the authentication based on whether the accepted answer is correct or not And determining means.

  According to another aspect (9) of the present invention, the above aspect is captured by a category of a method, and a registration reception process for accepting friend registration associated with each other as a registration partner for social networking service users, and an authentication target person And a friend authentication process for causing a registration partner who has registered the friend and the authentication target to perform authentication for the computer, wherein the friend authentication process is performed by registering the authentication target person with respect to the authentication target person. A question creation process for supporting creation of a question regarding an action with the other party, an answer reception process for transmitting the inputted question to the registered party and receiving an input of an answer to the question from the registered party, and the received And a determination process for determining success or failure of the authentication based on whether the answer is correct or not.

  In this way, the registration partner in SNS can be asked to answer questions regarding information related to sharing with the person to be authenticated, so that the authentication to the service can be entrusted to another person, so that the user can But it reduces the burden of remembering and managing passwords for authentication, secret questions and answers. In addition, since authentication does not depend on a fixed password or the like, security risk due to leakage of the password or the like can be suppressed. In particular, if information related to behavior with a registered partner is used as information related to sharing with the person to be authenticated, it is highly possible that the registered partner can remember the information, so that excellent authentication accuracy can be obtained.

  According to another aspect (2) of the present invention, in any one of the above aspects, there is provided means for storing action history data representing a user's action in the social networking service in a predetermined action storage means, The means extracts action history data representing an action with the registered partner from the action history data stored in the action storage means, and creates the question based on the extracted action history data. .

  Thus, by automatically generating a question based on the behavior with the registered partner extracted from the behavior history data on the SNS, the burden on the user related to the question creation can be reduced.

  According to another aspect (3) of the present invention, in any one of the above aspects, there is provided means for storing action history data representing a user's action in the social networking service in a predetermined action storage means, The means accepts creation of a question regarding the behavior with the registered partner from the authentication target person, and extracts behavior history data representing the behavior with the registered partner from the behavior history data stored in the behavior storage means. The correctness of the question is verified by collation with the extracted action history data.

  In this way, for questions that have received input from the subject of authentication, by verifying the correctness based on the behavior with the registered partner extracted from the behavior history data on the SNS, whether the question content is appropriate or which is the correct answer? The burden on the user who confirms the password can be reduced and the authentication accuracy is improved.

  According to another aspect (4) of the present invention, in any one of the aspects described above, there is provided a first authentication unit that authenticates the person to be authenticated, and the predetermined authentication that is impossible to authenticate by the first authentication unit. In this case, authentication by the friend authentication means is used.

  As described above, when the first authentication means that is normally used cannot be used due to forgotten password or the like, the present invention by the registered partner is used as a preliminary second authentication means instead of the conventional secret question and answer. By using this authentication, it is possible to log in to the service quickly using a conventional method with excellent responsiveness such as password authentication.

  According to another aspect (5) of the present invention, in any one of the aspects described above, for a predetermined target to which the registration partner of the authentication target person has access authority, the registration partner temporarily accesses the authentication target person. When authority is given, authentication by the friend authentication means is used.

  In this way, if you want to temporarily grant access to a certain target to someone else, such as temporarily entering the chat room you want to enter and participating in the chat, you can select the other party as your registered partner. By authenticating, it is possible to easily authenticate the target and the other party, so both mobility and security in the operation of the service can be achieved.

  According to another aspect (6) of the present invention, in any one of the above aspects, the question creating means supports only the creation of a question regarding an action with a logged-in registered partner.

  In this way, by limiting the authenticating side to registered partners who are logged in, there is a high possibility that an answer to a question can be obtained quickly, and prompt real-time completion of authentication can be promoted.

  According to another aspect (7) of the present invention, in any one of the above aspects, when the answer to the question is not input from the registered partner within a predetermined time limit, the answer receiving unit It is characterized in that the question is transmitted again and the input of the answer to the question is accepted.

  As described above, if there is no answer within a predetermined time, the question is transmitted again and the input of the answer is received again, thereby speeding up the reply of the registered partner and the completion of the authentication.

  Another aspect (8) of the present invention is characterized in that, in any one of the aspects described above, there is provided incentive provision means for imparting a predetermined incentive to the registered partner who inputs the answer to the question.

  Thus, by giving an incentive of an answer to the certifier, the answer to the question becomes reliable and quick, and the speed and reliability of the authentication are improved.

  It should be noted that a category (method for the apparatus, program for the method, etc.) different from each of the above-described modes and more specific modes described below are also included in the present invention. For different categories, “means” shall be appropriately read as “process” or “step”. Further, the order of execution of processes and steps is not limited to the above, and can be changed as appropriate or can be processed collectively. Furthermore, the “computer” that executes each process (step) may be common or may be different for each process.

  According to the present invention, it is possible to reduce both the burden on the user and the burden on the system operator for authentication.

The functional block diagram which shows the structure of embodiment of this invention. The figure which illustrates the information (data) in the embodiment of the present invention. The flowchart which shows the process sequence in embodiment of this invention. The figure which shows the example of a screen display in embodiment of this invention. The figure which shows the example of a screen display in embodiment of this invention.

  Next, as an example of the present invention, a mode for carrying out the present invention (referred to as “embodiment”) will be described with reference to the drawings. It should be noted that assumptions common to those already described in the background art and problems are omitted as appropriate.

[1. Constitution〕
In the present embodiment, as shown in FIG. 1 (configuration diagram), registration receiving means 20 that accepts friend registrations that associate users of social networking services (also referred to as “SNS”) as registration partners with each other; , An authentication apparatus 1 (also referred to as “server” or “server 1”) having a friend authentication unit 30 that causes a registration partner who has registered a friend with the authentication target person to perform authentication for the authentication target person. This server 1 authenticates the user of the SNS accessed from the terminal T, and in order to simplify the explanation, the server 1 has a function for providing the SNS (SNS providing means 40). Apart from the server that provides the SNS, it can also be realized as an independent authentication server.

  The server 1 includes at least an arithmetic control unit 6 such as a CPU, a storage device 7 such as a main memory and an auxiliary storage device, and a communication network N (for example, the Internet, a mobile phone network, a PHS network, etc.). Communication means 8 (wireless LAN adapter, communication circuit with mobile phone network or PHS network, communication gateway device, etc.). Although not shown, the terminal T1 is an electronic information device having an input / output unit using a liquid crystal display panel, a touch panel, a push button, etc. in addition to the computer configuration as described above, and includes a smartphone, a mobile phone terminal, These are tablet PCs, mobile PCs, stationary PCs, and the like. Although a small number is shown in FIG. 1, there are actually many according to the number of users.

  In the server 1, a predetermined computer program stored (installed) in the storage device 7 controls the arithmetic control unit 6 to realize elements (10, 20 and the like) such as each unit shown in FIG. Of these elements, the information storage means can be realized in the storage device 7 in any format such as various databases (also referred to as “DB”), variables such as files and arrays, various stacks and registers, and system setting values.

  Among such storage means, the password storage means 15 of the server 1 is a means for storing an authentication password (not shown) according to a conventional authentication technique. The friend storage means 25 is means for storing the contents of friend registration between SNS users in the form of friend registration data (for example, FIG. 2 (1)). The behavior storage unit 45 stores user behavior (for example, blog update, file upload, chat, etc.) on the SNS provided by the SNS providing unit 40 such as an SNS server, and behavior history data (for example, FIG. 2 (2)). It is also means for storing in the form of “history”.

  In addition, each means other than the storage means is a processing means for realizing and executing the following information processing functions / actions, but these are functional units arranged for explanation, actual hardware elements and It doesn't matter if it matches the software module.

[2. Action and effect)
A processing procedure executed by the server 1 for the operation of the present embodiment configured as described above is shown in the flowchart of FIG.
[2-1. (Outline of action and its effect)
First, as an outline of the action, when it becomes necessary on the premise that the registration accepting means 20 accepts in advance friend registration for associating each other with users of social networking services (step S21). The friend authentication means 30 performs authentication for the person to be authenticated by the registration partner who has made friend registration with the person to be authenticated (steps S12 to S20).

  This authentication is called “friend authentication”. In addition, the registration partner of friend registration that this friend authentication presupposes is not limited to friends in a narrow sense, but there is no limitation such as other people who do not know but want to know the contents of information transmission other than family and mere acquaintances. It's okay.

  And the friend authentication means 30 which performs friend authentication has the question preparation means 32, the answer reception means 35, and the determination means 38 specifically ,. Then, as a gist of friend authentication, first, information relating to sharing with the registered partner (similarly Mr. B) from the terminal T1 used by the person to be authenticated (for example, Mr. A in FIG. 1) by the question creating means 32 (here. Then, the creation of a question regarding the behavior with the registered partner is accepted on the question generation screen or the like (step S12, for example, FIG. 4). As described above, the process of accepting the creation of the question is an aspect for supporting the creation of the question. As another aspect of the support, the question may be automatically generated as described later.

  Then, the answer receiving means 35 transmits the input question to the registered partner by transmitting it to the terminal T2 used by Mr. B who is the registered partner and displays it (step S13; for example, FIG. 5). Is received from the registered partner (step S14, also in FIG. 5), and the determination means 38 determines the success or failure of the authentication based on whether the received answer is correct or not (step S18).

  As described above, in the present embodiment, the registration partner at the SNS is informed and answered (for example, FIG. 5) about the information related to the information to be shared with the person to be authenticated. Therefore, both the user and the system can reduce the burden of remembering and managing passwords for authentication, secret questions and answers. Further, since authentication does not depend on a fixed password or the like, the security risk due to leakage of the password or the like can be suppressed, and the reliability of authentication can be improved. In particular, if information related to behavior with a registered partner is used as information related to sharing with the person to be authenticated, it is highly possible that the registered partner can remember the information, so that excellent authentication accuracy can be obtained.

[2-2. (Examples of questions)
About the input mode of the question used for the above friend authentication, although you may make it input as a character string freely in a text input column etc., the mode selected from a screen is desirable. FIG. 4 shows an example of a screen for accepting the creation of a question by selection. After selecting a sentence component with GUI (graphical user interface) parts such as drop-down lists D1, D2, and D3 by a mouse cursor C or the like. , Button B1 is operated. As a result, a screen as illustrated in FIG. 5 is displayed as a pop-up window or the like on the corresponding registered partner, and a response input by operating the button B2 or B3 is requested together with the display of the question.

  The information that is shared by the question is preferably information that only two people know, but for example, the surname and nickname of the homeroom teacher in the school class where the two were classmates should be known elsewhere. There are some people, but in practice, any information that can be used for identification purposes is acceptable.

  More specifically, it may be actions taken together in the real world (for example, sports activities, dinners, meetings, etc.), but activities on a communication network such as SNS (for example, blog update on SNS, chat, image upload) Etc.), it is possible to automate processes such as generating question options and verifying the correctness of answers based on the system history (for example, FIG. 2 (2)) regarding these activities. For example, in the action history data of FIG. 2 (2), it can be seen that Mr. B (the “target element” field) and the private chat (“SNS action content” field), the options shown in FIG. You can also add “chat”.

  In addition, the specific pattern of the question is free, as in the example of FIG. 4 and FIG. 5, simply ask “Did you have lunch with Mr. A yesterday?” In addition to the authentication OK, you may be asked “What did you do with Mr. B yesterday?” And have the correct answer “Lunch” selected from multiple choices.

  For the destination (user ID, e-mail address, etc.) of the registration partner who receives the above question and becomes an certifier, read the information from the embodiment when allowing access to the friend storage means 25. In other cases, the person to be authenticated (for example, Mr. A) is allowed to input the address of the friend (Mr. B). As an example of an operation for permitting access to the friend storage means 25, the friend authentication means 30 is used as an authentication means for making a transition from a certain basic level login state to a higher level login state where, for example, the registered information can be browsed and changed. There may be cases.

[2-3. (Automatic question generation, etc.)
The action history data on the SNS can be used not only for generating question options and verifying the correctness of answers as described above, but also for automatically generating questions. In this case, the SNS providing unit 40 continuously stores the behavior history data (history) representing the user's behavior in the SNS in the behavior storage unit 45, and the question creating unit 32 is stored in the behavior storage unit 45. A history representing behavior with a registered partner is extracted from the existing history, and a question is created based on the extracted behavior history data.

  For example, you can generate questions such as “Did you chat with Mr. A last night?” From the history of when and who you chatted with, and natural language such as morphological analysis from articles and comments posted on diaries, blogs, etc. It is conceivable that a sentence such as “Mr. A and lunch” or “Mr. A and tennis” is detected by the processing technique, and the name is replaced with the other party, and the syntax is reconstructed, for example. Thus, by automatically generating a question based on the behavior with the registered partner extracted from the history on the SNS, the burden on the user related to the question creation can be reduced.

  In addition to automatic generation, it is also possible to accept the creation of a question regarding an action with a registered partner from an authentication target person, and to verify the correctness of the question by collating with the extracted history. In this case, “correct” may mean that the question itself is inappropriate for a question for which the corresponding element cannot be detected in the history, or if there is content in the history that matches the question created by the user, It may be specified that the correct answer to a question such as “Is it done” is “YES”.

  In this way, for questions that have received input from the subject of authentication, by verifying the correctness based on the behavior with the registered partner extracted from the behavior history data on the SNS, whether the question content is appropriate or which is the correct answer? The burden on the user who confirms the password can be reduced and the authentication accuracy is improved.

[2-4. Example of use)
Although the friend authentication as described above can be used as normal authentication instead of the conventional password authentication, the example of the processing procedure shown in FIG. In this example, authentication according to the present embodiment is used as a preliminary authentication means in place of the conventional secret question and answer. That is, during normal times, the first authenticating means 10 authenticates the person to be authenticated (step S11), and the predetermined authenticating by the first authenticating means 10 becomes impossible such as forgetting the password or erroneous input of a predetermined number of times. In this case (step S11: “NO”), the authentication by the friend authentication unit 30 is used (steps S12 to S20), and the password resetting unit 39 resets the password (step S21).

  As described above, when the first authentication means that is normally used cannot be used due to forgotten password or the like, the present invention by the registered partner is used as a preliminary second authentication means instead of the conventional secret question and answer. By using this authentication, it is possible to log in to the service quickly using a conventional method with excellent responsiveness such as password authentication.

[2-5. (Use for granting temporary access authority)
In addition, as another example of use, for a predetermined target (service, location, etc.) for which the registration partner of the authentication target person has access authority, when the registration partner temporarily grants access authority to the authentication target person, The person to be authenticated can also be authenticated using authentication by the friend authentication means 30. As an example of such a case, there may be a case where the other party temporarily enters the chat room that he / she wants to enter and wants to participate in the chat.

  In this way, when you want to temporarily grant access rights to a given target to others, you can easily authenticate the other party as a registered partner, so you can easily authenticate the target and the other party, so services etc. It is possible to achieve both mobility and security in operation. Also, outside of virtual scenes such as entering a chat room, a registration partner who has access authority for a specific building facility such as a toilet temporarily grants access authority to the authentication target person who is physically together. The friend authentication of the present invention can be suitably used even when it is desired to use it.

[2-6. (Registration only)
Since the friend authentication as described above depends on the action of the registered partner, if the registered partner who is requested to recognize is not aware and responds, the person to be authenticated cannot easily log in. Therefore, it is desirable that the question creating means 32 support the creation of a question (step S12) by accepting only the creation of a question regarding the action with the registered partner currently logged in. Specifically, for example, when displaying the choices of items constituting a question on a question generation screen that accepts the creation of a question (for example, FIG. 4), combinations of choices that can be selected at the same time by communicating with a server by script description, For example, it may be limited to information components related to sharing with a registered partner who is currently logged in.

  In this way, by limiting the authenticating side to registered partners who are logged in, there is a high possibility that an answer to a question can be obtained quickly, and prompt real-time completion of authentication can be promoted.

[2-7. (Remind function)
In addition, as another means of promoting friend authentication that depends on the other party, the answer receiving means 35 does not input the answer to the question within a predetermined time limit (for example, within several tens of seconds, etc.) from the registered party. If it becomes (step S15: “YES”), the question is again transmitted (reminded) to the registered partner (step S13), and an input of an answer to the question is accepted (step S14). As described above, if there is no answer within a predetermined time, the question is transmitted again and the input of the answer is received again, thereby speeding up the reply of the registered partner and the completion of authentication.

  As mentioned above, the number of times that the question is retransmitted and the input of the answer is accepted is arbitrary, but it is desirable to limit it to about several times. In the example of FIG. Once, i.e., only for the first time (step S15: “YES”), the process returns to the transmission of the question (step S13), and when the time is exceeded for the second time instead of the first time (step S15: “NO”) Is not input (step S16: “NO”), the authentication NG is guided (step S19), and the process returns to the creation of the question (step S12).

[2-8. Grant of incentives
In addition, as a means of further promoting friend authentication depending on the other party, a predetermined incentive is given to the registered party who has input the answer to the question by the incentive provision means 50 provided in the server 1 (ranking up in reputation information in the service) UP, bonus points, etc.) (step S17).

  Thus, by giving an incentive of an answer to the certifier, the answer to the question becomes reliable and quick, and the speed and reliability of the authentication are improved. In particular, if the incentive is increased according to the speed (short time) from the display of the question to the input of the answer (for example, FIG. 5), a quick answer near real time can be promoted.

[3. Other embodiments]
In addition, the said embodiment is only an illustration and this invention includes what is illustrated below and other embodiment other than that. For example, the configuration diagrams, data diagrams, flowcharts, and the like in the present application are merely examples, and the presence / absence of each element, the order of the arrangement and processing execution, and the specific contents can be changed as appropriate. As an example, in the processing procedure of FIG. 3, the same authentication OK screen (step S20) is transitioned in both password authentication (step S11) and friend authentication (steps S12 to S18), but this is simplified for explanation. In fact, in login by friend authentication, it is conceivable to log in to the service in a state where only limited functions such as a special login for setting a password can be accessed.

  In addition, a configuration in which the individual means shown in FIG. 1 and the like are realized by separate and independent facilities is also common, and depending on the function of the server or the terminal, an external platform or the like may be connected to an API (Application Program Interface). ) And network computing (so-called cloud etc.), and the configuration can be flexibly changed. Furthermore, each element such as means relating to the present invention may be realized by other information processing mechanisms such as a physical electronic circuit as well as a computer control unit.

1 Authentication device (server)
6 arithmetic control unit 7 storage device 8 communication unit 15 password storage unit 10 first authentication unit 20 registration reception unit 25 friend storage unit 30 friend authentication unit 32 question creation unit 35 answer reception unit 38 determination unit 39 password resetting unit 40 SNS Provision means 45 Action storage means 50 Incentive provision means B1, B2, B3 Button C Mouse cursor D1, D2, D3 Drop-down list N Communication network T (T1, T2) Terminal

Claims (9)

Registration acceptance means for accepting friend registrations associated with each other as social partners for social networking service users;
Friend authentication means for causing the authentication partner and the registered partner who has registered the friend to perform authentication for the authentication target person,
An authentication device having
The friend authentication means
Accepting question creation means for supporting creation of a question regarding an action with the registered partner for the person to be authenticated;
An answer receiving means for transmitting the inputted question to the registered partner and receiving an input of an answer to the question from the registered partner;
Determination means for determining success or failure of authentication based on whether or not the accepted answer is correct;
An authentication apparatus comprising: Means for storing behavior history data representing user behavior in the social networking service in a predetermined behavior storage means;
The question creating means extracts action history data representing an action with the registered partner from the action history data stored in the action storage means, and creates the question based on the extracted action history data. The authentication apparatus according to claim 1, wherein: Means for storing behavior history data representing user behavior in the social networking service in a predetermined behavior storage means;
The question creation means accepts creation of a question regarding an action with the registered partner from the authentication target person, and behavior history data representing an action with the registered partner from the behavior history data stored in the behavior storage means The authentication apparatus according to claim 1, wherein the question is verified by verifying with the extracted action history data. Having a first authentication means for authenticating the person to be authenticated;
The authentication apparatus according to any one of claims 1 to 3, wherein authentication by the friend authentication unit is used in a predetermined case where authentication by the first authentication unit becomes impossible.   The authentication by the friend authentication means is used when the registration partner of the person to be authenticated has access authority to the person to be authenticated, when the registration partner temporarily grants access authority to the person to be authenticated. The authentication device according to any one of claims 1 to 4.   The authentication apparatus according to any one of claims 1 to 5, wherein the question creation unit supports only the creation of a question related to an action with a logged-in registered partner.   When the answer to the question is not input from the registered partner within a predetermined time limit, the answer receiving means transmits the question to the registered partner again and receives an input of the answer to the question. The authentication device according to any one of claims 1 to 6.   The authentication apparatus according to any one of claims 1 to 7, further comprising an incentive granting unit that grants a predetermined incentive to the registered partner who inputs the answer to the question. Registration acceptance processing for accepting friend registrations associated with each other as users of social networking services,
A friend authentication process for causing an authentication target person to perform authentication with a registration partner who has registered the friend with the authentication target person;
Is an authentication method executed by a computer,
The friend authentication process
A question creation process for accepting creation of a question regarding information related to sharing with the registered partner from the person to be authenticated;
An answer reception process for transmitting the inputted question to the registered partner and receiving an input of an answer to the question from the registered partner;
A determination process for determining success or failure of authentication based on whether the received answer is correct or not;
An authentication method comprising:

Images