JP2019040557A - Authentication system, authentication method, authentication device, and program - Google Patents

Abstract

To improve the accuracy in authentication processing on an authentication target.SOLUTION: An authentication system 10 comprises: a data acquisition unit 111 that acquires, from a terminal of an authentication target, interested party information indicating one or more first interested parties related to the authentication target; and an authentication processing unit 114 that specifies one or more second interested parties related to the authentication target from the first interested parties on the basis of the interested party information indicating interested parties related to the first interested parties, and performs authentication processing on the authentication target on the basis of the second interested parties.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an authentication system, an authentication method, an authentication device, and a program.

  In recent years, various techniques are known as authentication processing for a person to be authenticated. For example, a technique is known in which an authentication process for an authentication target person is performed in accordance with whether or not an ID and password that match an ID and password registered in advance by the person are input from the authentication target person. There is also known a technique for performing an authentication process depending on whether or not biometric information that matches biometric information registered in advance by the person is detected from a person to be authenticated.

  However, when the authentication process is performed on the authentication subject based only on the information from the authentication subject, the information from the third party is not used for the authentication processing. May also succeed in authentication.

  Therefore, a technique for using information from a third party for authentication processing is disclosed. For example, a technology is disclosed that allows multiple third parties to inquire about approval / disapproval for a transaction request from a person to be authenticated, and enables a transaction if an answer that can be approved by one of the multiple third parties is obtained. (See Patent Document 1).

JP-A-2015-153264

  However, depending on who is selected as the third party, it is assumed that the strictness of the determination as to whether or not to authenticate the person to be authenticated differs. For this reason, it may be assumed that the authentication of the person to be authenticated should not be successful only by obtaining an answer that can be approved by a third party. Therefore, it is desired to provide a technique capable of improving the accuracy of the authentication process for the person to be authenticated.

  In order to solve the above problem, according to an aspect of the present invention, a data acquisition unit that acquires related party information indicating one or more first related parties of an authentication target person, and the first related party's Based on the party information indicating the party, the one or more second parties with the person to be authenticated as the party from the first party are identified, and based on the second party, An authentication system is provided that includes an authentication processing unit that performs an authentication process on the person to be authenticated.

  The data acquisition unit may acquire the related party information of the authentication target person from the terminal of the authentication target person.

  The data acquisition unit obtains one or more related party identification information designated in advance by the authentication target person from one or more related person identification information stored in the terminal of the authentication target person. May be acquired as person information.

  The data acquisition unit includes at least one of a phone number, an e-mail address, and an SNS account included in a contact list or communication history stored in the terminal of the authentication target, and the relationship of the authentication target May be acquired as person information.

  The authentication processing unit inquires of the person to be authenticated whether approval is permitted or not with respect to one or a plurality of third parties excluding the second party among the first parties. Among the three parties, a party who has obtained a reply indicating approval can be identified as an approver, and the authentication process can be performed based on the second party and the approver.

  The authentication processing unit may provide at least one of the face image and position information of the person to be authenticated to the terminals of the third parties at the time of the inquiry.

  The said authentication process part does not need to specify the related person who cannot obtain a reply even if it exceeds the preset time limit as the said approver.

  The authentication processing unit may perform the authentication process based on the number of the second parties.

  The authentication processing unit may perform the authentication process based on whether or not the number of second parties has reached a threshold value.

  The authentication processing unit may perform the authentication process based on a weight value corresponding to the relationship between the person to be authenticated and each of the second parties.

  The authentication processing unit may perform the authentication process based on the sum of the weight values.

  Further, according to another aspect of the present invention, it is possible to acquire related party information indicating one or more first related parties of the person to be authenticated, and related party information indicating related parties of the first related party. Based on the above, the one or more second parties having the person to be authenticated as the person concerned are identified from the first persons, and the authentication process for the person to be authenticated is based on the second party And an authentication method is provided.

  According to another aspect of the present invention, a data acquisition unit for acquiring related party information indicating one or more first related parties of the person to be authenticated, and a relationship indicating the related parties of the first related party Based on the person information, one or a plurality of second parties having the person to be authenticated as the person concerned is identified from the first person concerned, and the person to be authenticated is identified based on the second person concerned. An authentication device is provided that includes an authentication processing unit that performs authentication processing.

  According to another aspect of the present invention, the computer includes a data acquisition unit for acquiring related party information indicating one or more first related parties of the person to be authenticated, and a related party of the first related party. Based on the related party information indicating one or more, one or a plurality of second related parties whose related person is the authentication target person is identified from the first related parties, and the authentication is performed based on the second related party. There is provided a program for causing an authentication device to function as an authentication device including an authentication processing unit that performs authentication processing on a subject.

  As described above, according to the present invention, it is possible to improve the accuracy of authentication processing for a person to be authenticated.

It is a figure for demonstrating the outline | summary of embodiment of this invention. It is explanatory drawing which showed the structural example of the information processing system which concerns on the embodiment. It is a block diagram which shows the function structural example of the authentication system which concerns on the same embodiment. It is a block diagram which shows the function structural example of the terminal which concerns on the same embodiment. It is a flowchart which shows the operation example of the information processing system which concerns on the embodiment. It is a flowchart which shows the operation example of the information processing system which concerns on the embodiment. It is a flowchart which shows the operation example of the information processing system which concerns on the embodiment. It is a figure which shows the hardware constitutions of the information processing apparatus which concerns on the embodiment. It is a figure which shows the example of the correspondence of a relationship and a weight value.

  Exemplary embodiments of the present invention will be described below in detail with reference to the accompanying drawings. In the present specification and drawings, components having substantially the same functional configuration are denoted by the same reference numerals, and redundant description is omitted.

  In the present specification and drawings, a plurality of constituent elements having substantially the same or similar functional configuration are distinguished by attaching different numerals to the same reference numerals. Further, similar constituent elements of different embodiments are distinguished by attaching different alphabets after the same reference numerals. However, when there is no need to particularly distinguish each of a plurality of constituent elements having substantially the same functional configuration, only the same reference numerals are given.

(0. Overview)
First, the outline | summary of embodiment of this invention is demonstrated.

  FIG. 1 is a diagram for explaining an outline of an embodiment of the present invention. Referring to FIG. 1, users A to H are shown. User A can use terminal 20A. Similarly, users B to H can also use their own terminals (terminals 20B to 20H). As an example, FIG. 1 illustrates a case where each of the terminals 20A to 20G is a smartphone and the terminal 20H is a PC (Personal Computer). However, the type of each of the terminals 20A to 20H is not limited. For example, each of the terminals 20A to 20H may be a tablet terminal or a mobile phone.

  In the embodiment of the present invention, it is assumed that the user A is a person to be authenticated and the authentication process for the user A is performed. However, an authentication process similar to the authentication process for the user A may be performed for the users B to H. Hereinafter, the user A may be referred to as “authentication target person A”.

  The terminal 20A of the person A to be authenticated stores a contact list including one or more related party identification information. Below, the case where the telephone number contained in the telephone directory 21A as an example of a contact list is utilized as an example of related party identification information is mainly demonstrated. However, when a mail address is included in the telephone book 21A, a mail address may be used instead of the telephone number. Alternatively, when the telephone directory 21A includes an SNS (Social Networking Service) account, an SNS account may be used instead of the telephone number.

  Alternatively, a case where the terminal 20A of the person A to be authenticated stores a communication history including one or a plurality of related party identification information is also assumed. In such a case, a communication history may be used instead of the contact list. Also in such a case, one or a plurality of telephone numbers included in the communication history may be used, one or a plurality of mail addresses included in the communication history may be used, and one or more telephone numbers included in the communication history may be used. A plurality of SNS accounts may be used.

  Similarly, the terminals 20B to 20H also store corresponding phone books (phone books 21B to 21H). Here, referring to FIG. 1, the telephone book 21A stored in the terminal 20A of the person A to be authenticated includes the telephone numbers of the user C, the user F, and the user H, respectively.

  In the following, from the telephone numbers of the users C, F, and H included in the telephone directory 21A, the telephone numbers of the users C and F are related to the person A to be authenticated by the person A to be authenticated. A case where information is designated is assumed (a case where user C and user F are related persons (first related persons) of authentication target person A is assumed). This is because it is assumed that there are too many telephone numbers included in the telephone directory 21A. However, all the telephone numbers included in the telephone directory 21A may be related person information of the authentication target person A (the user C, the user F, and the user H are the related persons of the authentication target person A (first May be a related person).

  When the phone numbers of the user C and the user F are specified as the related person information of the user A to be authenticated, the phone book 21C of the user C and the phone book 21F of the user F respectively It is determined whether a telephone number is included. Referring to FIG. 1, since the telephone number of the person A to be authenticated is included in the telephone directory 21 </ b> C, it can be said that the user C also has the person A to be authenticated as a related person (the user C is the person A to be authenticated A). Is a related party (second related party).

  On the other hand, referring to FIG. 1, the telephone directory 21F does not include the telephone number of the person A to be authenticated (the user F is a person who is not related to the person A to be authenticated (third person). is there). At this time, the user F is inquired (for example, by e-mail ML) whether or not the user A can be approved. Here, it is assumed that an answer indicating that approval is possible is obtained from the user F (the user F is an approver who approves the authentication target person A).

  In the embodiment of the present invention, as an example, among the first parties (user C and user F) of the person to be authenticated A, the second person having the person to be authenticated A as the person concerned like the user C. The authentication process for the person A to be authenticated is performed based on the person concerned and the approver such as the user F. For example, when the total of the number of second parties and the number of approvers who have authentication subject person A as a participant has reached the threshold value, it is assumed that authentication of authentication subject person A has succeeded.

  The outline of the embodiment of the present invention has been described above.

(1. Details of the embodiment)
First, the detail of embodiment of this invention is demonstrated.

(1-1. Configuration of Information Processing System)
A configuration example of the information processing system 1 according to the embodiment of the present invention will be described with reference to FIG. FIG. 2 is an explanatory diagram showing a configuration example of the information processing system 1 according to the embodiment of the present invention. As shown in FIG. 2, the information processing system 1 according to the embodiment of the present invention includes an authentication system 10 (authentication device) in addition to the terminals 20A to 20H shown in FIG. The terminals 20A to 20F are connected to the carrier network 32, and the authentication system 10 is connected to the Internet 31. The authentication system 10 can communicate with the terminals 20A to 20F via the Internet 31 and the carrier network 32. The authentication system 10 can communicate with the terminal 20H via the Internet 31.

  The configuration example of the information processing system 1 according to the embodiment of the present invention has been described above.

(1-2. Functional configuration of authentication system)
Next, a functional configuration example of the authentication system 10 according to the embodiment of the present invention will be described. FIG. 3 is a block diagram illustrating a functional configuration example of the authentication system 10 according to the embodiment of the present invention. As shown in FIG. 3, the authentication system 10 according to the embodiment of the present invention includes a control unit 110, a communication unit 120, and a storage unit 130.

  The control unit 110 has a function of controlling the entire operation of the authentication system 10 and may be configured by dedicated hardware, or a CPU (Central Processing Unit) built in the authentication system 10 is a ROM (Read Only Memory). ) May be realized by developing the program stored in RAM (Random Access Memory) and executing it. In addition to providing such a program, a storage medium storing such a program may also be provided.

  The control unit 110 includes a data acquisition unit 111, a registration processing unit 112, an authentication request acquisition unit 113, an authentication processing unit 114, and an authentication result providing unit 115. As will be described later, in the embodiment of the present invention, it is mainly assumed that various functional blocks included in the control unit 210 in the terminal 20 are realized by an authentication application. In such a case, the authentication system 10 provides various functions for an authenticity application. However, when these functional blocks are realized by a browser, the authentication system 10 provides various functions to the browser.

  The communication unit 120 is a communication interface for transmitting and receiving various types of information to and from the terminals 20A to 20H. For example, the communication unit 120 receives an authentication request from the terminal 20A. For example, the communication unit 120 transmits an authentication result based on the authentication request received from the terminal 20A to the terminal 20A.

  The storage unit 130 can store a program and data for operating the control unit 110. In addition, the storage unit 130 can temporarily store various data necessary for the operation of the control unit 110.

  Heretofore, the functional configuration example of the authentication system 10 according to the embodiment of the present invention has been described.

(1-3. Functional configuration of terminal)
Then, the function structural example of the terminal 20 which concerns on embodiment of this invention is demonstrated. FIG. 4 is a block diagram illustrating a functional configuration example of the terminal 20 according to the embodiment of the present invention. As illustrated in FIG. 4, the terminal 20 according to the embodiment of the present invention includes a control unit 210, a communication unit 230, a storage unit 240, an operation unit 250, and a display unit 260.

  The control unit 110 has a function of controlling the entire operation of the terminal 20, and may be configured by dedicated hardware, or a CPU built in the terminal 20 expands a program stored in the ROM into the RAM. It may be realized by executing. In addition to providing such a program, a storage medium storing such a program may also be provided.

  The control unit 210 includes an operation acquisition unit 211, a data provision unit 212, a contact destination provision unit 213, an authentication result acquisition unit 214, and a display control unit 215. In the embodiment of the present invention, it is mainly assumed that these functional blocks included in the control unit 210 are realized by an authentication application. However, these functional blocks may be realized by a browser.

  The communication unit 230 is a communication interface for transmitting and receiving various types of information to and from the authentication system 10. For example, the communication unit 230 transmits an authentication request to the authentication system 10. For example, the communication unit 230 receives an authentication result based on the authentication request from the authentication system 10.

  The storage unit 240 can store a program and data for operating the control unit 210. In addition, the storage unit 240 can temporarily store various data necessary for the operation of the control unit 210.

  The operation unit 250 receives an operation input from a user. The operation unit 250 can provide the control unit 210 with an operation received from a user. In the embodiment of the present invention, it is assumed that the operation unit 250 is a touch panel. However, the operation unit 250 may be an input device other than the touch panel (for example, a keyword and a mouse).

  The display unit 260 has a function of performing display in accordance with control by the control unit 210. For example, the display unit 260 can display the authentication result according to control by the control unit 210. Here, the form of the display unit 260 is not particularly limited. For example, the display unit 260 may be a display device such as a CRT (Cathode Ray Tube) display device, a liquid crystal display (LCD) device, an OLED (Organic Light Emitting Diode) device, or a lamp.

  The functional configuration example of the terminal 20 according to the embodiment of the present invention has been described above.

(1-4. Details of functions of information processing system)
Subsequently, the functional details of the information processing system 1 according to the embodiment of the present invention will be described with reference to FIGS. The telephone directory 21A is provided to the authentication system 10 in advance by the contact providing unit 213 in the terminal 20A, acquired by the data acquisition unit 111 in the authentication system 10, and registered in the storage unit 130 by the registration processing unit 112.

  Here, the timing at which the telephone directory 21A is provided to the authentication system 10 is not limited. For example, the telephone directory 21A may be provided to the authentication system 10 every predetermined time. Alternatively, the telephone directory 21 </ b> A may be provided to the authentication system 10 when it is confirmed whether or not the telephone book 21 </ b> A has been updated every predetermined time. Similarly, the phone books 21 </ b> B to 21 </ b> H are provided to the authentication system 10 in advance and stored in the storage unit 130 in the authentication system 10.

  In the terminal 20 </ b> A, when an authentication request is input by the authentication subject person A, the authentication request is received by the operation unit 250 and acquired by the operation acquisition unit 211. In addition, when the authentication target person A inputs an authentication level indicating the severity of authentication and a time limit from inquiry to approval approval to response, the authentication level and time limit are also received by the operation unit 250, and the operation Obtained by the obtaining unit 211.

  From the telephone directory 21A, the telephone numbers of the users C and F are designated by the person A to be authenticated. That is, the telephone numbers of the user C and the user F are stored in the storage unit 240 as related person information of the authentication target person A. The data providing unit 212 acquires related party information from the storage unit 240.

  In addition, when an inquiry about approval / disapproval is made to a related person of the authentication target person A, the related person of the authentication target person A confirms the face image of the authentication target person A and the position information of the terminal 20A. It is assumed that it becomes possible to more accurately make an answer to the approval / disapproval of the person A to be authenticated. Therefore, in addition to the related person information of the authentication target person A, the face image of the authentication target person A and the position information of the terminal 20A are also acquired by the data providing unit 212.

  The face image of the person A to be authenticated may be stored in advance by the storage unit 240. Alternatively, when the terminal 20A has a camera, the face image of the person A to be authenticated may be captured by the camera. Further, the position information of the terminal 20A may be acquired by a predetermined positioning function. The predetermined positioning function may be a positioning function based on a received signal from a GPS (Global Positioning System) satellite, or may be another positioning function.

  In the terminal 20A, the data providing unit 212 provides the authentication system 10 with an authentication request including various information (authentication level, restriction information, related party information, face image, position information). In the authentication system 10, when the authentication request is received by the communication unit 120 and the authentication request is acquired by the authentication request acquisition unit 113, various types of information are acquired from the authentication request by the authentication processing unit 114. For example, from the authentication request received from the terminal 20A, the telephone numbers of the user C and the user F are acquired as related party information.

  The authentication processing unit 114, based on the party information indicating one or more first parties related to the person A to be authenticated, includes one or more second parties having the person A to be authenticated as a party from the first party. Identify the parties involved. Specifically, the related person information of the person A to be authenticated includes the telephone numbers of the user C and the user F who are the first related persons. Here, the phone book of the user C includes the telephone number of the person A to be authenticated. Therefore, the authentication processing unit 114 specifies that the user C is a second related person who has the authentication target person A as a related person.

  On the other hand, the telephone book 21F of the user F does not include the telephone number of the person A to be authenticated. Therefore, the authentication processing unit 114 identifies the user F as an example of one or more third parties, excluding the second party among the first parties. Here, it is assumed that the authentication processing unit 114 makes an inquiry to the user F about whether or not to approve the authentication target person A, and the user F obtains an answer indicating that approval is possible. In such a case, the authentication processing unit 114 may identify the user F as an approver.

  However, the authentication processing unit 114 does not identify the user F as the approver when the response indicating that the approval is not possible is obtained from the user F. Or the authentication process part 114 does not identify the user F as an approver, when an answer is not obtained from the user F even if time limit is exceeded.

  When making an inquiry to the user F, in order to make it possible to more accurately answer the approval / disapproval of the authentication target person A, the authentication processing unit 114 includes at least one of the face image and the position information of the authentication target person A May be provided to the terminal 20F of the user F. Here, it is assumed mainly that the authentication processing unit 114 provides both the face image and position information of the person A to be authenticated to the terminal 20F of the user F.

  The authentication processing unit 114 performs authentication processing based on the second related person and the approver who have the authentication target person A as the related person. More specifically, the authentication processing unit 114 performs authentication processing based on the number of second related parties and the number of approvers. For example, the authentication processing unit 114 performs the authentication process based on whether the total number of second parties and the number of approvers (hereinafter also referred to as “authentication credibility”) has reached a threshold value. Just do it. As an example, the authentication processing unit 114 may determine that the authentication has failed if the authentication credibility has not reached the threshold, and may determine that the authentication has succeeded if the authentication has reached the threshold. The threshold value may be determined according to the authentication level. For example, the threshold may be increased as the authentication level becomes stricter.

  Here, the user C is given as an example of the second related party, and the user F is given as an example of the approver. That is, the total (authentication credibility) of the number of second parties and the number of approvers is “2”. Therefore, if the threshold value is “2” or less, the authentication credibility has reached the threshold value, and it is determined that the authentication is successful. On the other hand, if the threshold value is greater than “2”, the authentication credibility has not reached the threshold value, and it is determined that the authentication has failed.

  When authentication processing is performed by the authentication processing unit 114, the authentication result (authentication failure or authentication success) and authentication credibility obtained by the authentication processing unit 114 are provided to the terminal 20A of the person A to be authenticated by the authentication result providing unit 115. Is done. In the terminal 20A, the authentication result and the authentication credibility are acquired by the authentication result acquisition unit 214, and the display on the display unit 260 is controlled by the display control unit 215.

  In the above description, the case where the authentication processing unit 114 performs the authentication process based on the second party and the approver has been mainly described. However, the authentication processing unit 114 may perform the authentication process based only on the second party. More specifically, the authentication processing unit 114 may perform authentication processing based on the number of second parties. For example, the authentication processing unit 114 may perform authentication processing based on whether or not the number of second parties has reached a threshold value. As an example, the authentication processing unit 114 may determine that the authentication has failed if the number of second parties has not reached the threshold, and may determine that the authentication has succeeded if the number has reached the threshold.

  The function details of the information processing system 1 according to the embodiment of the present invention have been described above.

(1-5. Operation of information processing system)
Subsequently, an operation example of the information processing system 1 according to the embodiment of the present invention will be described with reference to FIGS. 5 to 7 (refer to FIGS. 1 to 4 as appropriate). 5-7 is a flowchart which shows the operation example of the information processing system 1 which concerns on embodiment of this invention. The operation examples illustrated in FIGS. 5 to 7 are only examples of the operation of the information processing system 1 according to the embodiment of the present invention. Therefore, the operation of the information processing system 1 according to the embodiment of the present invention is not limited to the operation examples shown in FIGS.

  5 to 7, the terminal 20 </ b> A of the authentication target person A is indicated as “target person terminal 20 </ b> A”. In the following description with reference to FIGS. 5 to 7, “user C” and “user F” are given as examples of the first related parties, and the terminal 20F of the user F is “ It is indicated as “related party terminal 20F”. However, the first parties are not limited to the user C and the user F.

  As described above, the telephone directory 21A is provided to the authentication system 10 in advance by the contact providing unit 213 in the subject person terminal 20A, acquired by the data acquisition unit 111 in the authentication system 10, and stored in the storage unit 130 by the registration processing unit 112. It is registered. Similarly, the phone books 21 </ b> B to 21 </ b> H are provided to the authentication system 10 in advance and stored in the storage unit 130 in the authentication system 10.

  In the subject terminal 20A, when an authentication request is input by the subject person A, the authentication request is accepted by the operation unit 250 (S1) and acquired by the operation acquisition unit 211. Further, when the authentication target person A inputs an authentication level indicating the severity of authentication and a time limit from inquiry of approval / disapproval to answer, the authentication level and time limit are also accepted by the operation unit 250 (S2). ) Acquired by the operation acquisition unit 211.

  Subsequently, the data providing unit 212 obtains the face image of the person A to be authenticated, the position information of the target person terminal 20A, and the related person information (S3). Then, the data providing unit 212 transmits an authentication request including various types of information (authentication level, restriction information, related party information, face image, position information) to the authentication system 10 via the communication unit 230 (S4). In the authentication system 10, when the authentication request is acquired by the authentication request acquisition unit 113 via the communication unit 230 (S11), various types of information are acquired from the authentication request by the authentication processing unit 114.

  As long as there is an undetermined related party (related party identification information) in the acquired related party information (“Yes” in S12), the authentication processing unit 114 shifts the operation to S13. On the other hand, if there is no unidentified related party (related party identification information) in the acquired related party information (“No” in S12), the authentication processing unit 114 shifts the operation to S15.

  When the operation is shifted to S13, the authentication processing unit 114 has the related party information of the unidentified related party, and the related party information includes the account of the authentication target person A (for example, a telephone number). (“Yes” in S13), the authentication credibility is counted up (S14), and the operation is shifted to S12 again. In the example shown in FIG. 1, since the telephone number of the person A to be authenticated is included in the telephone directory 21C of the user C who is a person related to the person A to be authenticated, the authentication credibility is counted up by one and S12 The operation is transferred to.

  On the other hand, the authentication processing unit 114 determines that there is no related person information of an unidentified party, or when there is no account of the person A to be authenticated (for example, a telephone number) in the related party information of an unidentified party. (“No” in S13) shifts the operation to S12. In the example shown in FIG. 1, since the telephone number of the authentication target person A is not included in the telephone book 21F of the user F who is a related person of the authentication target person A, the authentication credibility is not counted up, and S12 The operation is transferred to. This control is repeated until there is no unidentified related party (related party identification information) in the acquired related party information (“No” in S12), and then the operation is shifted to S15.

  When the operation is shifted to S15, the authentication processing unit 114 performs an authentication process based on the authentication credibility and the authentication level to obtain an authentication result (authentication success or authentication failure) (S15). For example, the authentication processing unit 114 determines that the authentication is successful when the authentication credibility reaches a threshold corresponding to the authentication level. On the other hand, the authentication processing unit 114 determines that the authentication has failed when the authentication credibility has not reached the threshold corresponding to the authentication level. The authentication result and the authentication credibility are provided to the target person terminal 20A by the authentication result providing unit 115.

  In the subject terminal 20A, the authentication result acquisition unit 214 acquires the authentication result and the authentication credibility. The authentication result and the authentication credibility are displayed by the display unit 260 according to the display control by the display control unit 215 (S16). In the authentication system 10, the authentication processing unit 114 transmits an e-mail asking whether the approval is possible via the communication unit 230 to a party who does not have an account of the person A to be authenticated (for example, a telephone number) in the party information. (S17). Here, it is assumed that an e-mail is transmitted to the party terminal 20F.

  When an operation (for example, an operation of tapping a link) for designating a link described in the e-mail is input by the user F at the related party terminal 20F, the operation is received by the operation unit 250 and an operation is acquired. Acquired by the unit 211. The data providing unit 212 provides such an operation to the authentication system 10, and a page that can be reached from the link is acquired from the authentication system 10. The acquired page is displayed on the browser by the display unit 260 (S21).

  The page displayed by the display unit 260 includes the face image and position information of the person A to be authenticated. When the face image and the position information are confirmed by the user F, an answer indicating approval or disapproval by the user F is input (S22). When the answer is received by the operation unit 250, the answer is provided to the authentication system 10 by the data providing unit 212, and is acquired by the authentication processing unit 114 in the authentication system 10.

  The authentication processing unit 114 counts the number of related persons who have received an approval response within the time limit (S31). Then, the authentication processing unit 114 counts up the authentication credibility by the number of related parties whose response indicating approval is obtained within the time limit (S32). The authentication processing unit 114 performs authentication processing based on the authentication credibility and the authentication level in the same manner as the authentication processing in S15, and obtains an authentication result (authentication success or authentication failure) (S33).

  The authentication result and the authentication credibility are provided to the target person terminal 20A by the authentication result providing unit 115. In the subject terminal 20A, the authentication result acquisition unit 214 acquires the authentication result and the authentication credibility. The authentication result and the authentication credibility are displayed by the display unit 260 according to the display control by the display control unit 215 (S41).

  The operation example of the information processing system 1 according to the embodiment of the present invention has been described above.

(1-6. Hardware configuration example)
Subsequently, a hardware configuration of the information processing apparatus 900 according to the embodiment of the present invention will be described. Note that the authentication system 10 described above is assumed as an example of the information processing apparatus 900. Alternatively, the terminal 20 described above is assumed as an example of the information processing apparatus 900. That is, the hardware configuration of various apparatuses according to the embodiment of the present invention can be realized by the hardware configuration of the information processing apparatus 900 as described below.

  FIG. 8 is a diagram showing a hardware configuration of the information processing apparatus 900 according to the embodiment of the present invention. The information processing apparatus 900 includes a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM (Random Access Memory) 903, a host bus 904, a bridge 905, an external bus 906, an interface 907, , An input device 908, an output device 909, a storage device 910, and a communication device 911.

  The CPU 901 functions as an arithmetic processing device and a control device, and controls the overall operation in the information processing device 900 according to various programs. Further, the CPU 901 may be a microprocessor. The ROM 902 stores programs used by the CPU 901, calculation parameters, and the like. The RAM 903 temporarily stores programs used in the execution of the CPU 901, parameters that change as appropriate during the execution, and the like. These are connected to each other by a host bus 904 including a CPU bus or the like.

  The host bus 904 is connected to an external bus 906 such as a PCI (Peripheral Component Interconnect / Interface) bus via a bridge 905. Note that the host bus 904, the bridge 905, and the external bus 906 are not necessarily configured separately, and these functions may be mounted on one bus.

  The input device 908 includes an input means for inputting information such as a mouse, a keyboard, a touch panel, a button, a microphone, a switch, and a lever, and an input control circuit that generates an input signal based on the input by the user and outputs the input signal to the CPU 901. Etc. A user who operates the information processing apparatus 900 can input various data or instruct a processing operation to the information processing apparatus 900 by operating the input device 908.

  The output device 909 includes, for example, a CRT (Cathode Ray Tube) display device, a liquid crystal display (LCD) device, an OLED (Organic Light Emitting Diode) device, a display device such as a lamp, and an audio output device such as a speaker.

  The storage device 910 is a device for storing data. The storage device 910 may include a storage medium, a recording device that records data on the storage medium, a reading device that reads data from the storage medium, a deletion device that deletes data recorded on the storage medium, and the like. The storage device 910 is configured with, for example, an HDD (Hard Disk Drive). The storage device 910 drives a hard disk and stores programs executed by the CPU 901 and various data.

  The communication device 911 is a communication interface configured with, for example, a communication device for connecting to a network. Further, the communication device 911 may support either wireless communication or wired communication.

  The hardware configuration of the information processing apparatus 900 according to the embodiment of the present invention has been described above.

(1-7. Summary)
According to the embodiment of the present invention, the data acquisition unit 111 for acquiring related party information indicating one or more first related parties of the authentication subject person A, and the related party information indicating the related parties of the first related party Based on the above, one or a plurality of second parties who are subject to authentication A are identified from the first parties, and the authentication process for authentication subject A is performed based on the second parties An authentication system 10 including an authentication processing unit 114 is provided. According to such a configuration, it is expected that the accuracy of the authentication process for the person A to be authenticated can be improved.

  The preferred embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to such examples. It is obvious that a person having ordinary knowledge in the technical field to which the present invention pertains can come up with various changes or modifications within the scope of the technical idea described in the claims. Of course, it is understood that these also belong to the technical scope of the present invention.

  For example, in the above description, the case where an authentication request is issued from the authentication application stored in the terminal 20 and an authentication result for the authentication request is returned to the authentication application has been mainly described. However, the authentication request may be issued from a configuration different from the authenticity application, and the authentication result may be returned to a configuration different from the authentication application. For example, if an authentication request and an authentication result are exchanged between the external system and the authentication system 10, an authentication system 10 linked with the external system can also be provided.

  Further, in the above, the authentication processing unit 114 performs the authentication process based on whether or not the total of the number of second parties and the number of approvers who have the person A to be authenticated has reached the threshold value. Mainly explained the case of doing. However, the calculation of the total may take into account the relationship between the authentication target person A and the second related party and the relationship between the authentication target person A and the approver. That is, the authentication processing unit 114 may perform the authentication process based on the weight value corresponding to the relationship between the authentication target person A and each of the second related person and the approver.

  As described above, the relationship between the authentication target person A and the second related party and the relationship between the authentication target person A and the approver are considered, so that the relationship with the authentication target person A is stronger. It is expected that the reflected authentication process will be performed. More specifically, the authentication processing unit 114 may perform the authentication process based on the sum of weight values corresponding to the relationship between the authentication target person A and each of the second related person and the approver. A specific example will be described below.

  FIG. 9 is a diagram illustrating an example of the correspondence between the relationship and the weight value. Referring to FIG. 9, “parents”, “siblings”, and “friends” are listed as examples of the relationship between the second related person and the approver based on the person A to be authenticated. The relationship “parent” “3” is given as an example of the weight value corresponding to “”, “2” is given as an example of the weight value corresponding to the relationship “brother and sister”, and “ 1 ". Thus, a larger weight value may be associated with a stronger relationship.

  For example, similarly to the above-described example, it is assumed that “user C” exists as an example of the second related party and “user F” exists as an example of the approver. Then, it is assumed that “Father” is input in advance as the relationship of “User C” by the authentication target person A, and “Friend” is input in advance as the relationship of “User F”. In this case, the authentication processing unit 114 has a weight value “3” corresponding to the relationship “Father” × number of people “1” = “3” and a weight value “1” corresponding to the relationship “friend” × number of people “1”. = ”1” and the total “4” may be subjected to authentication processing depending on whether or not the threshold value corresponding to the authentication level has been reached.

  Note that the authentication processing unit 114 may consider only the relationship between the authentication target person A and the second related person who has the authentication target person A as a related person when there is no approver. That is, the authentication processing unit 114 may perform the authentication process based on the weight value corresponding to the relationship between the authentication target person A and the second related party. More specifically, the authentication processing unit 114 may perform the authentication process based on the sum of weight values corresponding to the relationship between the authentication target person A and the second related party.

DESCRIPTION OF SYMBOLS 1 Information processing system 10 Authentication system 110 Control part 111 Data acquisition part 112 Registration process part 113 Authentication request acquisition part 114 Authentication process part 115 Authentication result provision part 120 Communication part 130 Storage part 20 Terminal 210 Control part 211 Operation acquisition part 212 Data provision Unit 213 Contact providing unit 214 Authentication result acquisition unit 215 Display control unit 230 Communication unit 240 Storage unit 250 Operation unit 260 Display unit

Claims (14)

A data acquisition unit for acquiring related party information indicating one or more first related persons of the person to be authenticated;
Based on the party information indicating the party of the first party, one or more second parties having the authentication subject as a party are identified from the first party, and the second An authentication processing unit that performs an authentication process on the person to be authenticated based on
An authentication system comprising: The data acquisition unit acquires the related party information of the authentication target person from the terminal of the authentication target person.
The authentication system according to claim 1. The data acquisition unit obtains one or more related party identification information designated in advance by the authentication target person from one or more related person identification information stored in the terminal of the authentication target person. To obtain as user information,
The authentication system according to claim 2. The data acquisition unit includes at least one of a phone number, an e-mail address, and an SNS account included in a contact list or communication history stored in the terminal of the authentication target, and the relationship of the authentication target To obtain as user information,
The authentication system according to claim 2. The authentication processing unit
An inquiry is made to one or more third parties, excluding the second party among the first parties, as to whether or not to approve the person to be authenticated, and among the third parties Identifying an authorized person who has obtained a response indicating approval as an authorized person, and performing the authentication process based on the second interested person and the authorized person.
The authentication system according to claim 1. The authentication processing unit provides, at the time of the inquiry, at least one of the face image and position information of the person to be authenticated to the terminals of the third parties.
The authentication system according to claim 5. The authentication processing unit does not identify a person who cannot obtain an answer even if a preset time limit is exceeded as the approver,
The authentication system according to claim 5. The authentication processing unit performs the authentication process based on the number of the second parties.
The authentication system according to claim 1. The authentication processing unit performs the authentication processing based on whether or not the number of the second parties has reached a threshold value.
The authentication system according to claim 8. The authentication processing unit performs the authentication processing based on a weight value corresponding to the relationship between the person to be authenticated and each of the second parties.
The authentication system according to claim 1. The authentication processing unit performs the authentication process based on the sum of the weight values.
The authentication system according to claim 10. Obtaining party information indicating one or more first parties of the person to be authenticated;
Based on the party information indicating the party of the first party, one or more second parties having the authentication subject as a party are identified from the first party, and the second Performing an authentication process for the person to be authenticated based on
Including authentication methods. A data acquisition unit for acquiring related party information indicating one or more first related persons of the person to be authenticated;
Based on the party information indicating the party of the first party, one or more second parties having the authentication subject as a party are identified from the first party, and the second An authentication processing unit that performs an authentication process on the person to be authenticated based on
An authentication device comprising: Computer
A data acquisition unit for acquiring related party information indicating one or more first related persons of the person to be authenticated;
Based on the party information indicating the party of the first party, one or more second parties having the authentication subject as a party are identified from the first party, and the second An authentication processing unit that performs an authentication process on the person to be authenticated based on
A program for causing an authentication device to function.

Images