JP5947358B2 - Authentication processing apparatus, method and program - Google Patents

Description

  The present invention relates to security technology. More specifically, the present invention relates to an authentication processing apparatus, method, and program for theft of authentication information in a net banking system.

  Conventionally, it has become widespread that a user uses a personal computer (PC) or a mobile phone to access a net banking system provided by a financial institution such as a bank via the Internet and use a service provided by the system. Yes. When using a net banking system, a screen for user authentication is often displayed first. Further, depending on the type of service that the user desires to use (for example, remittance), further user authentication may be required.

  While the use of such a net banking system is expanding, cases of theft of user IDs and passwords due to computer viruses and the like are frequently occurring. When a personal computer (PC) used by a user is infected with a virus, a fake screen of an authentication screen or an additional password input screen is displayed, and the user believes that the fake screen is a real screen and enters an ID or password. Even if an ID or password is stolen, or when a genuine screen is displayed, an ID or password entered when a predetermined button is pressed may be stolen.

  If an ID or password is stolen, serious damage may occur, such as unauthorized remittance from an account by a third party without the user's knowledge.

  In order to prevent such unauthorized access by a third party, a list of “bait passwords” similar to those of authorized users is prepared in advance, and the ID and password entered by the accessing user are In the case of matching with the “Decoy Password” list, it is also determined that the user is an unauthorized user (see Patent Document 1).

JP-A-6-152747

  However, even if such measures are taken, damage from password theft is reported every year. When a password is stolen by the computer virus as described above, an unauthorized remittance to a third party may occur without the knowledge of the person.

  Also, even if measures are taken to make it difficult for passwords to be stolen, new computer viruses that break the countermeasures appear and it is necessary to take new measures. It was.

  The present invention has been made in view of such a problem, and it is possible to determine input conditions for a “decoy password” and a “regular password” that may be stolen, and a user performs an operation that satisfies the input condition. Providing an apparatus and method for reducing damages such as unauthorized remittance due to password theft by allowing processing to continue only when it is performed and not performing subsequent processing when an operation that satisfies the input condition is not performed. With the goal.

  The present invention also provides an apparatus and method that makes it easy to identify a person who has made unauthorized access by notifying an Internet service provider (ISP) of necessary information when unauthorized access due to password theft is suspected. For the purpose.

An authentication processing apparatus as one aspect for solving the above problem is a first database storing user management information, wherein the management information includes the user authentication information, contract information, and the number of times of authentication. A first database including information; a second database storing the authentication information input by the user; and reading the management information from the first database, wherein the contract information of the read management information is A determination means configured to determine whether or not the number of authentication information received from the user terminal via the authentication information input screen is equal to or greater than the number indicated in the number-of-authentication-time information when indicating that there is a contract; The determination means is further configured to store the user authentication information received from the user terminal in the second database. And when the number of authentication information received from the user terminal is equal to or greater than the number indicated in the authentication time count information, the number of authentication information received from the user terminal is the number indicated in the authentication time count information Collation means configured to collate whether the read authentication information matches the user authentication information of the read management information, and the authentication information among the authentication information received from the user terminal When the authentication information input at the number indicated in the time count information does not match the user authentication information of the read management information, the verification means receives from the user terminal via the authentication information input screen the series of authentication information against the said authentication information stored in said second database is further configured to determine whether they are the same, And wherein the door.

An authentication processing apparatus according to another aspect of the present invention is a first database storing user management information, wherein the management information includes the user authentication information, contract information, and authentication time count information , The authentication time count information is dynamically determined based on a value of a one-time password associated with the user, and the management information is read from the first database and the first database, and the read When the contract information of the management information indicates that there is a contract, it is configured to determine whether or not the number of authentication information received from the user terminal via the authentication information input screen is greater than or equal to the number indicated in the authentication time count information Authentication information received from the user terminal when the number of authentication information received from the user terminal is greater than or equal to the number indicated in the authentication time count information. A verification unit configured to verify whether or not the authentication information input at the number indicated in the authentication time count information matches the user authentication information of the read management information. It is characterized by having.

The authentication processing method executed in the authentication processing device as another aspect is the first database in which the authentication processing device stores user management information, and the management information is the user authentication information. A first database including contract information and authentication time count information; and a second database for storing the authentication information input by the user, wherein the method manages the management from the first database. When the information is read, and the contract information of the read management information indicates that there is a contract, the number of authentication information received from the user terminal via the authentication information input screen is greater than or equal to the number indicated in the authentication time count information The user authentication information received from the user terminal is stored in the second database; and When the number of authentication information received from the terminal is equal to or greater than the number indicated in the authentication time count information, the authentication information input at the time indicated by the authentication time count information among the authentication information received from the user terminal And the authentication information input at the time indicated by the number-of-authentication times information among the authentication information received from the user terminal. The authentication stored in the second database is a series of authentication information received from the user terminal via the authentication information input screen when the information and the authentication information of the user in the management information read out do not match Collating with information and determining whether or not both match .

According to another aspect of the present invention, there is provided an authentication processing method executed by the authentication processing apparatus, wherein the authentication processing apparatus is a first database storing user management information, and the management information is the user authentication. Information, contract information, and authentication time information , wherein the authentication time information comprises a first database dynamically determined based on a value of a one-time password associated with the user, The method reads the management information from the first database, and when the contract information of the read management information indicates that there is a contract, the number of authentication information received from a user terminal via an authentication information input screen is Determining whether the number of authentication information is greater than or equal to the number of times of authentication and the number of authentication information received from the user terminal is greater than or equal to the number of times of authentication If the authentication information input from the authentication information received from the user terminal is equal to the number indicated in the authentication count information, the authentication information of the user in the read management information is matched. It is characterized by providing.

  According to the present invention, it is possible to determine the input conditions of “decoy password” and “regular password” that may be stolen, and to continue the process only when the user performs an operation that satisfies the input condition. If an operation that satisfies the input conditions is not performed, the subsequent processing is not performed, so that damage such as illegal remittance due to password theft can be reduced.

  In addition, according to the present invention, when unauthorized access due to password theft is suspected, it is possible to easily identify the person who performed unauthorized access by notifying the Internet service provider (ISP) of necessary information. Become.

It is a figure explaining the outline | summary of the whole system containing the net banking system which concerns on this invention. It is a figure explaining the outline | summary of the system configuration | structure of the net banking system which concerns on this invention. It is a flowchart explaining the authentication process performed in the net banking system which concerns on this invention. It is a login screen as an example of an authentication information input screen. It is a figure explaining an example of the data item of the management information stored in management DB. It is a figure explaining an example of the data item of the input authentication information stored in input information DB. It is a functional block diagram of the net banking system concerning the present invention. It is a figure explaining the process at the time of accessing a system using authentication information, such as user ID and PW which the third party stole.

  First, the “Decoy Password” service described in this specification will be described. As the authentication information when using the conventional net banking system, a “regular user ID” and a “regular password” are used. In the present invention, it is assumed that such authentication information is stolen by a computer virus or the like, and an ID and a password are always input multiple times. Whether to input the second time is registered in the net banking system according to the present invention, and any password other than the registered number is input to the user (this will be referred to as “decoy password” in this specification). After executing the authentication request, the authentication process is performed with the normal authentication information input at the number of times. Specifically, when the number of times is three, a screen for entering authentication information (ID and password) is displayed at least three times with a message prompting for input, and an authentication request is made after entering authentication information three times or more. Authentication processing is performed only after execution. For example, an authentication request may be executed (for example, a login button is pressed) after a screen for inputting authentication information is displayed 10 times and authentication information (ID and password) is input 10 times. In this case, since the number of registrations is 3, the authentication process is performed based on the authentication information input for the third time.

  In one embodiment of the present invention, an authentication information input screen is displayed any number of times until an authentication request is executed regardless of what password is input, so that the user can input authentication information an arbitrary number of times. is there. It is necessary to enter the regular password only when the specified number of times is entered, but at other times the regular password may be entered or a non-regular password may be entered. You may make it do, and any may be sufficient.

  Further, in one embodiment of the present invention, the number of times representing the regular password input can be dynamically changed. In this embodiment, as described above, it is possible to register the number of times (static value) preset by the user, but in one embodiment of the present invention, a one-time password service is used. However, the number of times can be set dynamically.

  In known one-time password services, a device that displays a one-time password, sometimes called a token, is distributed to the user, and the user uses the value displayed on the device when entering authentication information. It was. As will be described later, in the present invention, when a user inputs authentication information to the system, an arbitrary digit (for example, one's digit) value of the one-time password displayed on the device is dynamically set as the number of times. Is possible. The net banking system according to the present invention can be configured such that an arbitrary digit value of a one-time password can be dynamically set as the number of times when a screen for inputting authentication information is opened. With this configuration, information on how many times the normal authentication information must be entered is synchronized between the user side and the system side, so the user inputs the normal authentication information according to the numerical value indicated in the token. do it. As a premise of the present embodiment, it is necessary for the user to inform the bank which digit of the one-time password is to be used.

  According to the embodiment as described above, even if the authentication information is stolen, the third party holds many combinations of user IDs and passwords that cannot access the system. In addition, since the number of times that a password is intentionally entered can be changed dynamically, even if all of a series of stolen user IDs and passwords are used in sequence, it is very difficult to gain unauthorized access. Become. For example, in the embodiment that uses a one-time password, when the user ID and password are stolen, the legitimate user ID and legitimate password were used at the time of the third input. Since there is a high possibility that a legitimate user ID and a legitimate password will have to be used when the number of times is entered (for example, the second time or the fifth time), the possibility of successful unauthorized access is significantly reduced. .

  Further, the above-described embodiments can be used in combination. For example, when the number of arbitrary digits displayed on the token is “3”, it is sufficient to input a regular user ID and password when inputting authentication information for the third time, and the user ID and password are input four times or more. The authentication request may be executed at an arbitrary timing. In this way, no matter how many times the ID and password of the same user are stolen, the number of times that the regular authentication information must be entered differs every time. It becomes extremely difficult to work.

  Hereinafter, embodiments of the present invention will be described in detail. However, those skilled in the art will understand that various embodiments that are changed in configuration and details can be realized without departing from the gist of the present invention.

  FIG. 1 is a diagram for explaining the outline of the entire system including the net banking system 120 according to the present invention. As shown in FIG. 1, user terminals 100a, 100b, 100c, 100d,... (Hereinafter referred to as “user terminal 100” for convenience of explanation) are Internet service providers (ISPs) 110a, 110b (similarly , “ISP 110”), the network banking system 120 can be accessed.

  In this specification, the term “user terminal” includes, for example, a personal computer (PC), a laptop, a tablet computer, a personal digital assistant (PDA), a user equipment (UE), a mobile station, a cellular phone, a smartphone, or Any other type of device that can operate in a wired or wireless environment may be included, but is not limited to such. That is, the user terminal 100 can be any type of device that can access the net banking system 120 via the ISP 110 in a wired and / or wireless manner.

  The ISP 110 is a known provider that can provide an Internet connection service to a user terminal 100 installed in a company or home through a communication line. The ISP 110 may be configured to receive a predetermined notification message from the net banking system 120 and store information of the user terminal 100 involved in specific access to the net banking system 120. Information of the user terminal 100 related to a specific access can be used to identify a target person of unauthorized access.

  In this embodiment, an embodiment using an Internet service provider (ISP) will be described. However, the scope of application of the present invention is not limited to this, and the function for the user terminal 100 to connect to a network such as the Internet. It does not matter as long as it provides.

  The net banking system 120 can provide the user terminal 100 with known services (for example, deposit balance inquiry, deposit / withdrawal inquiry, remittance processing such as account transfer and transfer, etc.). The net banking system 120 can transmit a predetermined notification message to the ISP 110. A process related to transmission of a predetermined notification message and a configuration therefor will be described later with reference to FIG.

  FIG. 2 is a diagram for explaining the outline of the system configuration of the net banking system 120 according to the present invention. The net banking system 120 includes a control unit 201, a main storage unit 202, an auxiliary storage unit 203, an interface (IF) unit 204, and an output unit 205 that are connected to each other by a bus 210 or the like, like a general computer. The net banking system 120 can also include a management database (DB) 206 and an input information DB 207.

  The control unit 201 is also called a central processing unit (CPU), controls each component in the net banking system 120 and calculates data, and also stores various programs stored in the auxiliary storage unit 203 in the main storage unit. 202 can be read and executed. The main storage unit 202 is also called a main memory, and can store various received data, computer-executable instructions, data after arithmetic processing by the instructions, and the like. The auxiliary storage unit 203 is a storage device typified by a hard disk (HDD) and is used when data and programs are stored for a long period of time.

  In the embodiment of FIG. 2, the embodiment in which the control unit 201, the main storage unit 202, and the auxiliary storage unit 203 are provided in the same server computer has been described. However, as another embodiment, the net banking system 120 includes the control unit 201. Further, by using a plurality of main storage units 202 and auxiliary storage units 203, parallel distributed processing by a plurality of server computers can be realized. As another embodiment, a plurality of servers for the net banking system 120 may be installed, and a plurality of servers may share one auxiliary storage unit 203.

  The IF unit 204 serves as an interface for transmitting and receiving data to and from other systems and devices, and provides an interface for receiving various commands and input data (such as various masters and tables) from the system operator. Can do. The output unit 205 can provide a display screen that displays the processed data.

  The management DB 206 is a database that stores management information of users (users) of the net banking system 120. As the management information, authentication information such as a user ID and password (PW), whether or not the “Decoy Password” service contract described above in this specification is signed, and how many times must the regular authentication information be entered? Information (number of times of authentication 506 in FIG. 5), arbitrary digit information used when using the one-time password, and the like, but are not limited to these data items.

  The input information DB 207 is a database that stores authentication information (user ID and password) actually input by the user. The stored authentication information is log information of the authentication information input by the user, and can be used as verification data when unauthorized access is suspected.

  FIG. 3 is a flowchart for explaining an authentication process executed in the net banking system 120 according to an embodiment of the present invention. In the following description, an embodiment applicable to both an embodiment in which the user uses a one-time password and an embodiment in which the user does not use is described. However, the gist of the present invention may be applied only to any of the embodiments. Please understand that this is possible.

  This processing flow starts from S301. In S301, the user uses the user terminal 100 to access the net banking system 120 via the ISP 110. When accessing the net banking system 120, an authentication information input screen (login screen) 400 as illustrated in FIG. 4 is displayed on the display or the like of the user terminal 100. In FIG. 4, the login screen 400 is shown as an example of the authentication information input screen 400. However, the present invention is not limited to this, and the input screen can input authentication information such as a user ID and a password (PW). If so, an operation screen for other purposes (for example, remittance) may be used.

  The login screen 400 of FIG. 4 includes a user ID and password input field, an OK button for further enabling entry of these authentication information, and a login button for executing an authentication request. More specifically, when the user ID and password are input on the login screen 400 and the OK button is pressed, the user can input the user ID and password as many times as desired. That is, if the user ID and password input and the OK button are pressed five times, authentication information for five times is accumulated, and authentication processing is performed only after the login button is pressed (however, the number of times of authentication 506). Must be entered more times than indicated in). Note that the names of the buttons are examples, and other names may be used as long as they perform the same function.

  In S302, authentication information such as a user ID and password (PW) is input to authentication information input screen 400 displayed on the display or the like of user terminal 100. The input authentication information is transmitted to the net banking system 120 and stored on the main storage unit 202 when the “OK” button illustrated in FIG. 4 is pressed. The input authentication information is also transmitted from the user terminal 100 to the net banking system 120 when the “login” button illustrated in FIG. 4 is pressed. In such a case, the transmitted authentication information is stored in the main storage unit. It is stored in the input information DB 207 together with the authentication information stored in 202.

  In the input information DB 207, input authentication information 600 as illustrated in FIG. 6 can be stored. The input authentication information 600 is history information (log information) such as a user ID and password (PW) actually input by the user on the authentication information input screen 400, and a third party steals the authentication information of the user and used it. In this case, it can be utilized as information for determining whether or not it is theft information.

  As illustrated in FIG. 6, the input authentication information 600 includes a contractor name 601, a user ID 602, a date and time 603, and an input PW 604, but other data items may be included. The contractor name 601 is the contractor name of the user who has accessed the net banking system 120 and is the same data as the contractor name 501 described later. The user ID 602, the date / time 603, and the input PW 604 are the user ID actually input on the authentication information input screen 400, the date / time when an event such as pressing a predetermined button such as an OK button or a login button occurs, and the actual input, respectively. PW.

  Returning to FIG. 3 again, in S303, when the “login” button illustrated in FIG. 4 is pressed by the user, an authentication request execution instruction is transmitted from the user terminal 100 to the net banking system 120. In response to receiving the authentication request execution instruction from the user terminal 100, the net banking system 120 uses the user identification information (for example, user ID) included in the authentication information input so far by the user as a search key. The management DB 206 is accessed, and the management information 500 illustrated in FIG. 5 stored in the management DB 206 is read out. The read management information 500 is stored on the main storage unit 202. If there are a plurality of user IDs, an error message indicating that there are a plurality of user IDs may be displayed, or the user ID having the largest number may be used as a search key. .

  FIG. 5 is a diagram for explaining the data items of the management information 500 stored in the management DB 206. The management information 500 can include a contractor name 501, account information 502, contract presence / absence 503, user ID 504, password (PW) 505, and authentication count 506. The data items of the management information 500 shown in FIG. 5 are examples, and other data items may be included.

  The contractor name 501, the account information 502, the user ID 504, and the password (PW) 505 are respectively the user name of the user who has contracted the service of the net banking system 120, and the account information (store number, subject, account number) of the user. ), A user ID and a password when using the service.

  The contract presence / absence 503 is information indicating whether or not a contract using a “decoy password” described in this specification is concluded. The number-of-authentication times 506 stores number-of-times information indicating how many times the regular authentication information has to be input. The numerical value stored in the number of times of authentication 506 is the same as the numerical value of an arbitrary digit (for example, one's digit) of the numerical value displayed on the one-time password token when the user accesses the system or a desired function (for example, , Remittance) can be configured to be stored dynamically when attempting to perform. An advantage of the embodiment using a one-time password is that the numerical value displayed in the token for the one-time password is different for each user to be distributed (in other words, different values are displayed for each user). is there. For this reason, even if a third party obtains another token, it is difficult to grasp the same numerical value as that of the stolen token. In the present invention, an embodiment that does not use a one-time password is possible, but in this case, the number of times set by the user is stored in the number of times of authentication 506.

  Returning to FIG. 3 again, in S304, the net banking system 120, when the contract presence / absence 503 in the read management information 500 indicates “contracted”, the user terminal 100 via the authentication information input screen 400. It is determined whether the number of pieces of authentication information received from the number of times is equal to or greater than the number of times indicated by the number of times of authentication 506. If it is equal to or greater than the number of times indicated in authentication time 506, the process proceeds to S306. On the other hand, if it is less than the number of times indicated in authentication time 506, the process proceeds to S305, indicating that the number of input authentication information is small. An error display is displayed on the display or the like of the user terminal 100, and this processing flow ends.

  Specifically, if information “2” is indicated in the number of times of authentication 506, the authentication information input the second time is used no matter how many times authentication information (ID, PW) is input. Authentication processing is performed, and the authentication information input for the first time and the authentication information input for the third time and thereafter are not used for the authentication processing. If authentication information is input only once, error processing in S305 is performed. Since the numerical value “2” is displayed on the one-time password token or set by the user, it is very difficult for a third party to specify which authentication information should be used. Become.

  In S306, the net banking system 120, the authentication information input through the authentication information input screen 400, the authentication information input at the number of times indicated in the authentication count 506, and the user ID 504 of the management information 500 read out. And whether PW505 matches. As described above, the authentication information input other than the number of times indicated in the number of times of authentication 506 is not used for the collation process.

  If it is determined in S307 that the user is a legitimate user as a result of the collation in S306, the process proceeds to S308. On the other hand, if it is determined that the user is not a legitimate user, the process proceeds to S309.

  In S308, net banking system 120 displays a user's desired screen (for example, a menu screen, a remittance screen, etc.) on the display or the like of user terminal 100. Thereby, the user can perform a desired operation using a desired screen.

  In S309, the net banking system 120 performs error processing such as displaying an error message indicating that the ID or PW is incorrect on the screen. As one embodiment of the error processing, only the error message screen may be displayed, and as another embodiment, a provider notification function described later with reference to FIG. 8 may be executed.

  In the embodiment described with reference to FIG. 3, the embodiment in which the authentication information transmitted from the user terminal 100 is stored in the input information DB 207 has been described. However, the embodiment of the present invention is not limited to this. Absent. In another embodiment of the present invention, authentication can be performed without storing the user ID and password input by the user in the input information DB 207. In such a case, the authentication information received from the user terminal 100 is stored on the main storage unit 202. In S303, in response to receiving the authentication request execution instruction from user terminal 100, net banking system 120 receives the user identification information (for example, user ID) included in the authentication information input so far by the user. The management DB 206 is accessed using the search key, and the management information 500 stored in the management DB 206 is read out. Thereafter, the processing after S304 is performed. In another embodiment of the present invention, authentication information stored on the main storage unit 202 is not stored in the input information DB 207 and is then discarded.

  FIG. 7 is an example of a functional block diagram of the net banking system 120 according to the present invention. As shown in FIG. 7, the net banking system 120 includes an IF control unit 701, a determination unit 702, a collation unit 703, an error processing unit 704, a management DB 206, and an input information DB 207.

  The IF control unit 701 displays a predetermined screen interface (for example, the authentication information input screen 400) on the display of the user terminal 100 in accordance with an operation performed by the user terminal 100 or when a predetermined condition is satisfied. Etc. can be displayed. Further, the IF control unit 701 can transmit the authentication information input by the user from the user terminal 100 to the net banking system 120 when a predetermined event occurs (for example, when a button on the screen is pressed).

  The determination unit 702 reads the management information 500 stored in the management DB 206, and when the contract presence / absence 503 in the read management information 500 indicates “contracted”, from the user terminal 100 via the authentication information input screen 400. It is determined whether or not the number of received authentication information is greater than or equal to the number of times indicated by the number of times of authentication 506. It should be noted that the number of times of authentication 506 is dynamically set so as to be the same as the number of an arbitrary digit (for example, the first digit) of the number displayed on the one-time password token assigned to the user. It may be configured, or a numerical value set by the user may be stored.

  Further, the determination unit 702 can store the input authentication information 600 in the input information DB 207. The input authentication information 600 is user ID and PW history information that the user actually entered on the authentication information input screen 400, and information used when a third party steals and uses the authentication information is theft information. It can be used as information for determining whether or not.

  The collation unit 703 includes the authentication information input at the number of times indicated in the authentication time number 506 among the authentication information (user ID and PW) input on the authentication information input screen 400 and the user of the read management information 500 It is verified whether the ID 504 and the PW 505 match.

  In addition, the collation unit 703 has input a series of authentication information input in the past stored in the input information DB 207 after an error such as an incorrect combination of the input user ID and PW has occurred. The input authentication information 600 can be collated to determine whether or not both match. As a result of the determination, if it is determined that they match, the collation unit 703 may transmit a notification message to the ISP 110 that there is a high possibility that the accessing user is fraudulent. it can. The input authentication information 600 input in the past may include a password entered by a legitimate user, and the fact that such a password matches is presumed that the password was stolen. Because it is possible.

  The error processing unit 704 can display an error message or an error display on the display or the like of the user terminal 100 when an error occurs such that the input ID and PW combination is incorrect.

  As described with reference to FIG. 2, the management DB 206 and the input information DB 207 are databases that store management information of users using the net banking system 120 and authentication information input by the users, respectively.

  FIG. 8 is a diagram illustrating processing when the system is accessed using authentication information such as a user ID or PW stolen by a third party. In the case of the embodiment in which the same numerical value as an arbitrary digit (for example, one's digit) of the numerical value displayed on the one-time password token is stored in the number of times of authentication 506, a series of “decoy password” and “ Even if the “authentic password” is stolen, if authentication information stolen by accessing the system by the thief is used, the value of the authentication count 506 at the time of access is the value of the authentication count 506 at the time of theft. The value is likely to be different. For example, if an arbitrary digit of the numerical value displayed on the one-time password token is any one of 0 to 9, the probability that the numerical value at the time of theft and the illegal access coincides is 1/10. Therefore, even if the thief accesses the net banking system 120 according to the flow of FIG. 3, there is a high possibility of proceeding to the error processing of S309.

  In such a case, in S801, the net banking system 120 (collation unit 703) determines whether or not the series of authentication information input matches authentication information input in the past stored in the input information DB 207. . If they do not match, it is highly possible that you are not a theft, so display an error on the screen (for example, “The combination of ID and PW is incorrect. Please enter again.”) finish. On the other hand, if they match, there is a high possibility that the thief has accessed using the authentication information stolen, so the net banking system 120 (verification unit 703) has illegal access to the ISP 110 by the accessing user. It is possible to transmit a notification message indicating that there is a high possibility that As a result, the ISP 110 can easily identify which access user is performing an illegal act.

  As another embodiment of the present invention, other than the number of times indicated by the number of times of authentication 506, an embodiment in which a regular password cannot be input is also possible. According to such an embodiment, even if a person who tries to perform unauthorized access (theft) attempts to access the system using only a combination of a regular ID and a regular password, unauthorized access is prevented. It becomes possible.

  In the above-described embodiment, the embodiment has been described in which the user ID and the password are input once on the authentication information input screen (login screen) 400 illustrated in FIG. 4 and the OK button or the login button is pressed once. However, as another embodiment of the present invention, a plurality of areas for inputting a user ID and a password are displayed on the authentication information input screen (login screen) 400, and the user ID and the password are respectively input to the plurality of input areas. It is also possible to configure the user to press the OK button or the login button once. According to such an embodiment, on the authentication information input screen (login screen) 400, for example, five user IDs and passwords are input, and then the OK button and the login button are pressed once. Therefore, it becomes difficult for the theft to know which user ID and password are legitimate.

  Although the principle of the present invention has been described above with reference to exemplary embodiments, those skilled in the art will appreciate that various embodiments that change in configuration and details can be realized without departing from the spirit of the present invention. Will understand. That is, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or storage medium.

100 User terminal 101 Internet service provider (ISP)
DESCRIPTION OF SYMBOLS 102 Net banking system 201 Control part 202 Main storage part 203 Auxiliary storage part 204 Interface (IF) part 205 Output part 206 Management database (DB)
207 Input information database (DB)
400 Authentication information input screen (login screen)
500 Management information 501, 601 Contractor name 502 Account information 503 Contract existence 504, 602 User ID
505, 604 Password (PW)
506 Number of times of authentication 600 Input authentication information 603 Date and time 701 IF control unit 702 Judgment unit 703 Verification unit 704 Error processing unit

Claims (15)

An authentication processing device,
A first database for storing user management information, wherein the management information includes the user authentication information, contract information, and authentication time count information;
A second database that stores the authentication information entered by the user;
When the management information is read from the first database, and the contract information of the read management information indicates that there is a contract, the number of authentication information received from the user terminal via the authentication information input screen is the number of times of authentication. A determination unit configured to determine whether the number is greater than or equal to the number indicated in the information, wherein the determination unit stores the authentication information of the user received from the user terminal in the second database. A determination means further comprising:
When the number of authentication information received from the user terminal is equal to or greater than the number indicated in the authentication time count information, the authentication entered when the number of authentication information received from the user terminal is the number indicated in the authentication time count information Verification means configured to verify whether the information and the authentication information of the user in the read management information match ,
When the authentication information input at the number indicated in the authentication time count information among the authentication information received from the user terminal does not match the authentication information of the user in the read management information, The authentication information input screen is further configured to collate a series of authentication information received from the user terminal with the authentication information stored in the second database and determine whether or not they match. An authentication processing device. Depending on the determination that they match, the verification unit is further configured to send notification messages to the Internet service provider, the authentication processing apparatus according to claim 1. The notification message is a message indicating that unauthorized access is being performed,
The authentication information stored in the second database is used as verification data when unauthorized access is suspected .
The authentication processing device according to claim 2 . The authentication processing device according to claim 1, wherein the authentication time count information is dynamically determined based on a value of a one-time password associated with the user. An authentication processing device,
A first database for storing user management information, wherein the management information includes user authentication information, contract information, and authentication time count information, and the authentication time count information is associated with the user. A first database dynamically determined based on the value of the one-time password being
A second database that stores the authentication information entered by the user;
When the management information is read from the first database, and the contract information of the read management information indicates that there is a contract, the number of authentication information received from the user terminal via the authentication information input screen is the number of times of authentication. A determination unit configured to determine whether the number is greater than or equal to the number indicated in the information, wherein the determination unit stores the authentication information of the user received from the user terminal in the second database. A determination means further comprising:
When the number of authentication information received from the user terminal is equal to or greater than the number indicated in the authentication time count information, the authentication entered when the number of authentication information received from the user terminal is the number indicated in the authentication time count information Verification means configured to verify whether the information matches the user authentication information of the read management information;
An authentication processing apparatus comprising: An authentication processing device,
A first database for storing user management information, wherein the management information includes user authentication information, contract information, and authentication time count information, and the authentication time count information is associated with the user. A first database dynamically determined based on the value of the one-time password being
When the management information is read from the first database, and the contract information of the read management information indicates that there is a contract, the number of authentication information received from the user terminal via the authentication information input screen is the number of times of authentication. Determining means configured to determine whether the number is greater than or equal to the number indicated in the information;
When the number of authentication information received from the user terminal is equal to or greater than the number indicated in the authentication time count information, the authentication entered when the number of authentication information received from the user terminal is the number indicated in the authentication time count information An authentication processing apparatus comprising: a verification unit configured to verify whether the information matches the authentication information of the user in the read management information. An authentication processing method executed in the authentication processing device,
The authentication processing device includes:
A first database for storing user management information, wherein the management information includes the user authentication information, contract information, and authentication time count information;
A second database that stores the authentication information entered by the user, the method comprising:
When the management information is read from the first database, and the contract information of the read management information indicates that there is a contract, the number of authentication information received from the user terminal via the authentication information input screen is the number of times of authentication. Determining whether the number is greater than or equal to the number indicated in the information, wherein the user authentication information received from the user terminal is stored in the second database;
When the number of authentication information received from the user terminal is equal to or greater than the number indicated in the authentication time count information, the authentication entered when the number of authentication information received from the user terminal is the number indicated in the authentication time count information Verifying whether the information matches the user's authentication information in the read management information ;
The authentication information input screen when the authentication information input at the number indicated in the authentication time count information among the authentication information received from the user terminal does not match the user authentication information of the read management information Checking a series of authentication information received from the user terminal via the authentication information stored in the second database and determining whether or not they match.
An authentication processing method comprising: Depending on the determination that they match, further comprising, authentication processing method according to claim 7 to send a notification message to the Internet service provider. The notification message is a message indicating that unauthorized access is being performed,
The authentication information stored in the second database is used as verification data when unauthorized access is suspected .
The authentication processing method according to claim 8 . The authentication processing method according to claim 7 , wherein the authentication time count information is dynamically determined based on a value of a one-time password associated with the user. The program for making a computer perform the method as described in any one of Claims 7 thru | or 10 . An authentication processing method executed in the authentication processing device,
The authentication processing device includes:
A first database for storing user management information, wherein the management information includes user authentication information, contract information, and authentication time count information, and the authentication time count information is associated with the user. A first database dynamically determined based on the value of the one-time password being
A second database for storing the authentication information input by the user;
The method comprises:
When the management information is read from the first database, and the contract information of the read management information indicates that there is a contract, the number of authentication information received from the user terminal via the authentication information input screen is the number of times of authentication. Determining whether the number is greater than or equal to the number indicated in the information, wherein the user authentication information received from the user terminal is stored in the second database;
When the number of authentication information received from the user terminal is equal to or greater than the number indicated in the authentication time count information, the authentication entered when the number of authentication information received from the user terminal is the number indicated in the authentication time count information Checking whether the information and the user authentication information in the read management information match.
An authentication processing method comprising: A program for causing a computer to execute the method according to claim 12. An authentication processing method executed in the authentication processing device,
The authentication processing device includes:
A first database for storing user management information, wherein the management information includes user authentication information, contract information, and authentication time count information, and the authentication time count information is associated with the user. A first database dynamically determined based on the value of the one-time password being
The method
When the management information is read from the first database, and the contract information of the read management information indicates that there is a contract, the number of authentication information received from the user terminal via the authentication information input screen is the number of times of authentication. Determining whether it is greater than or equal to the number indicated in the information;
When the number of authentication information received from the user terminal is equal to or greater than the number indicated in the authentication time count information, the authentication entered when the number of authentication information received from the user terminal is the number indicated in the authentication time count information information and the authentication processing method and a collating whether the authentication information of the user of the read management information match. A program for causing a computer to execute the method according to claim 14 .

Images