JP7404415B2 - Authentication device and authentication method - Google Patents

Description

The present invention relates to an authentication device and an authentication method for authenticating a user who uses a service.

BACKGROUND ART Conventionally, when a user uses a service on the Internet, it is common to perform user authentication in order to prevent a third party from impersonating the user and receiving the service. On the other hand, user authentication methods are evolving day by day, and it is preferable to introduce the latest security in order to achieve higher security. However, upgrading authentication methods in services is very costly. In particular, it is common to assign one user ID to one service, and when upgrading the authentication method for multiple services, it is necessary to change the authentication method for all services, which further increases costs. becomes.

On the other hand, accounts may be linked with multiple services (for example, see Patent Document 1).
For example, in Patent Document 1, there is provided a reception means for accepting an authentication request based on first account information for using a first service, and a second account for using a second service in which the first account information is used. and an inquiry means for inquiring of the device providing the second service whether or not the second account information is registered when the second account information is associated with the information.
In this case, if the first account information and the second account information are associated, it becomes possible to receive the second service using the first account information. Furthermore, in Patent Document 1, an inquiry as to whether the second account information is registered is sent to a device that provides the second service, and an error is returned if the second account information is unregistered. As a result, if the user authentication method using the second account information is an old authentication method and the user authentication method using the first account information is a user authentication method with improved security, the second When using the service, user authentication using first account information with high security can be used. Furthermore, in Patent Document 1, the inconvenience of allowing a non-existing account of a partner to use a service is suppressed. That is, if the second account information has been deleted and the user tries to use the second service using the first account information, an error will be returned and the second service cannot be used.

JP 2019-75006 Publication

In Patent Document 1, when first account information and second account information are associated, a device that provides a second service is inquired as to whether or not the second account actually exists. As described above, if the second account information has been deleted, use of the second service using the first account information is not permitted.
On the other hand, if the first account information cannot be used due to cancellation of registration or the like, the user can receive the second service by using the second account information. However, as described above, if the user authentication method using the second account information is an old authentication method and the user authentication method using the first account information has higher security strength, the second method with lower security A user authentication method using account information will be used.

An object of the present invention is to provide an authentication device and an authentication method that can further improve security in user authentication.

The authentication device of the present disclosure includes a first provision request requesting provision of a second service using second account information by a first authentication method using first account information for receiving provision of the first service; a second provision request requesting provision of the second service using a second authentication method using account information; a linkage determination unit that determines whether or not the first account information and the second account information are linked based on a linkage database that records the first account information linked to the account information; A first provision request is received, and it is determined that the first account information and the second account information are linked, and the first account information is authenticated by the first authentication method. a service providing unit that provides the second service when the information is authenticated; and, when receiving the second provision request, transmits a transmission request requesting transmission of the first provision request to the user terminal; A transmitting section.

1 is a schematic diagram showing an authentication system according to an embodiment of the present disclosure. 7 is a flowchart showing a second user information registration process. Flowchart related to service provision processing. Flowchart related to service provision processing. Flowchart related to cancellation of cooperation due to unavailability of primary account information Flowchart of disconnection due to deletion of second account information.

An embodiment of the present disclosure will be described below.
FIG. 1 is a schematic diagram showing the authentication system of this embodiment.
In FIG. 1, the authentication system 1 includes a first service server 10, a second service server 20, a user terminal 30, and the like. These first service server 10, second service server 20, and user terminal 30 are communicably connected to each other via a network line such as the Internet.

The first service server 10 is a device that provides a first service, and provides first account information for using the first service to each user who uses the first service. Then, when providing the first service, the first service server 10 performs an authentication process (first authentication process) using a first authentication method to determine whether the first account information transmitted from the user terminal 30 is authentic. Implement.

The second service server 20 is a device that provides a second service, and associates second account information for using the second service with each user who uses the second service. Then, when providing the second service, the second service server 20 transmits the first account information transmitted from the user terminal 30 to the first service server 10, causes the first service server 10 to perform the first authentication process, and performs the first authentication process. If the account information is authentic, a second service is provided to the user using second account information associated with the first account information.
Here, the first authentication process performed by the first service server 10 is an authentication process using a user authentication method with high security strength using, for example, a one-time password, face authentication, fingerprint authentication, or the like.

Furthermore, in this embodiment, the second service server 20 is configured to be able to perform authentication processing based on a second authentication method using second account information. Note that the authentication process of the second authentication method (second authentication process) performed by the second service server 20 has an older format than the first authentication method, and for example, it uses a preset user ID and password. By inputting , it is determined whether the second account information used by the user is authentic.
Authentication processing using such an old authentication method is undesirable because there is a possibility that the second service may be illegally accessed by a third party, that is, the second service may be used by illegally using another person's second account information. Therefore, it is preferable to update the second authentication method to a new authentication method with high security strength, such as that implemented by the first service server 10. However, introducing a new authentication method increases costs. Therefore, in the present embodiment, the second service server 20 links the second account information and the first account information, as described above, and performs the first authentication process using the first account information. Then, the second service server 20 allows both the first authentication process and the second authentication process during a predetermined period of time as a transition period, and links the second account information and the first account information. After the transition period ends, the second authentication process is prohibited and only the first authentication process is allowed.
Each configuration of the authentication system 1 as described above will be described in detail below.

[Configuration of first service server 10]
The first service server 10 is configured by a computer. Note that the number of computers that constitute the first service server 10 is not particularly limited. For example, the first service server 10 may be configured by one computer, or may be a cloud server constructed by connecting a plurality of computers via a network.

As shown in FIG. 1, the first service server 10 includes a first communication section 11, a first storage section 12, a first control section 13, and the like.
The first communication unit 11 is connected to a network (Internet) via, for example, a LAN, and communicates with the second service server 20, user terminal 30, and the like.
The first storage unit 12 records various data and programs related to the provision of the first service, and various data and programs related to the implementation of the first authentication process. Note that although a configuration in which the first service server 10 includes the first storage unit 12 is illustrated, other data servers and cloud storages that are communicably connected to the first service server 10 via the network are connected to the first storage unit 12. 12.

The first storage unit 12 includes a first user database (first user DB 121), and first user information regarding users who use the first service is recorded in the first user DB 121.
The first user information includes, for example, first account information, first authentication information, first user attribute information, and the like.
The first account information is an account name (user ID) for identifying a user.
The first authentication information is information necessary for the user to perform the first authentication process using the first account information, and necessary information is recorded as appropriate according to the first authentication method. For example, when performing authentication processing using a one-time password as the first authentication method, notification destination information such as an e-mail address and a mobile phone number for notifying the one-time password may be recorded. Furthermore, in the case where face authentication or fingerprint authentication is implemented as the first authentication method, an image of the user's face or fingerprint, or a characteristic value of the image, etc. may be recorded.
The first user attribute information is information related to the user who receives the first service, and information corresponding to the content of the first service is recorded. For example, the first user attribute information includes the user's gender, age, location, preference, and behavior history on the Internet (browsing history of web pages, buying and selling history, etc.).

The first storage unit 12 also includes a first linkage database (first A cooperation DB 122) may be provided. Although an example is shown in which the first cooperation DB 122 is provided in the first storage unit 12, second account information linked with the first account information may be recorded in the first user information. Although an example is shown in which the second account information linked to the first account information is recorded, account information of a service other than the second service linked to the first account information may be further recorded.

The first control unit 13 includes an arithmetic circuit such as a CPU (Central Processing Unit) and a recording circuit such as a RAM (Random Access Memory). The first control unit 13 loads various programs recorded in the first storage unit 12 and the like into the RAM, and executes various processes in cooperation with the programs loaded into the RAM. Then, the first control unit 13 reads and executes the information processing program recorded in the first storage unit 12, so that, for example, as shown in FIG. , and the first user registration unit 133.

The first authentication processing unit 131 receives first account information from the user terminal 30 or the second service server 20, and performs a first authentication process to determine whether the first account information is authentic. For example, when the first authentication method is a one-time password, the first authentication processing unit 131 refers to the notification destination information recorded in the first authentication information of the user information corresponding to the first account information, and the one-time password. A password is generated and sent to the user terminal 30. Then, when the one-time password transmitted from the user terminal 30 is transmitted, the user's access using the first account information is permitted, that is, it is determined that the first account information is authentic.

The first service providing unit 132 provides the first service to the user terminal 30 that transmitted the first account information when the first account information is authenticated by the first authentication processing unit 131. The first service is not particularly limited, but includes, for example, various services such as search services, SNS, product buying and selling services, news distribution services, video distribution services, and services that provide a platform that integrates these multiple services. etc. may be used.

The first user registration unit 133 performs registration processing for users who wish to be provided with the first service, and generates new user information. That is, according to the input information from the user, user information including first account information, first authentication information, and first user attribute information is generated and registered in the first storage unit 12.

[Configuration of second service server 20]
The second service server 20 is configured by a computer. Note that, like the first service server 10, the number of computers that constitute the second service server 20 is not particularly limited. For example, the second service server 20 may be configured by one computer, or the second service server 20 may be a cloud server constructed by connecting a plurality of computers via a network.

The second service server 20 corresponds to the authentication device of the present disclosure. As shown in FIG. 1, the second service server 20 includes a second communication section 21, a second storage section 22, a second control section 23, and the like.
Like the first communication unit 11, the second communication unit 21 is connected to a network (Internet) via, for example, a LAN, and communicates with the first service server 10, the user terminal 30, and the like.
The second storage unit 22 records various data and various programs related to provision of the second service, and various data and various programs related to implementation of the second authentication process. As mentioned above, in this embodiment, during a certain transition period, account authentication is possible using the second authentication process in addition to the first authentication process, but after the transition period, the second authentication process Programs may be deleted.
Further, although a configuration in which the second service server 20 includes the second storage unit 22 is illustrated, other data servers and cloud storages that are communicably connected to the second service server 20 via the network are connected to the second storage unit. 22.

The second storage unit 22 includes a second user database (second user DB 221), and second user information regarding users who use the second service is recorded in the second user DB 221.
The second user information includes, for example, second account information, second user attribute information, second authentication information, and the like.
The second account information is an account name (user ID) for identifying the user. The second account information is different from the first account information necessary for providing the first service, and the second service is provided by using the second account information. In other words, in this embodiment, the second service can be provided by performing the first authentication process using the first account information, but the second service cannot be provided only with the first account information. It is essential that the first account information and the second account information are linked.
The second user attribute information is information related to the user who receives the second service, and information corresponding to the content of the second service is recorded. For example, the second user attribute information includes the user's gender, age, location, preference, and behavior history on the Internet (browsing history of web pages, buying and selling history, etc.).

Further, the second authentication information is information necessary for the user to perform the second authentication process using the second account information, and necessary information is recorded as appropriate according to the second authentication method. As described above, in this embodiment, the second authentication process is permitted during the transition period, and after the transition period ends, login using the second authentication process is disabled. Therefore, after the transition period ends, the second authentication information does not need to be included in the second user information, and furthermore, the second authentication information does not need to be included in the second user information newly registered after the transition period. It's okay.
This second authentication information is, for example, information for implementing an authentication method that is older and has lower security strength than the first authentication information, and for example, the password linked to the second account information is recorded. Ru.

Furthermore, the second storage unit 22 is provided with a second collaboration database (second collaboration DB 222), which corresponds to the collaboration database of the present disclosure. The second cooperation DB 222 is similar to the first cooperation DB 122, and records cooperation information that records a combination of second account information and first account information that cooperates with the second account information.
Note that an example is shown in which the second storage unit 22 is provided with a second cooperation DB 222 separate from the second user DB 221 that records the second user information; One account information may be recorded. That is, the second user DB 221 in which the second user information is recorded may function as the cooperative database of the present invention. Further, account information of a service other than the first service, which is linked with the second account information, may be further recorded.

The second control unit 23 is composed of an arithmetic circuit such as a CPU, and a recording circuit such as a RAM. The second control unit 23 loads various programs recorded in the second storage unit 22 and the like into the RAM, and executes various processes in cooperation with the programs loaded into the RAM. Then, the second control unit 23 reads and executes the information processing program recorded in the second storage unit 22, so that, for example, as shown in FIG. It functions as a section 233, a second authentication processing section 234, a second service providing section 235, a transmitting section 236, a registration section 237, and the like.

The provision request accepting unit 231 accepts (receives) a provision request related to provision of the second service from the user terminal 30. These provision requests include a first provision request that requests provision of a second service by performing a first authentication process, and a second provision request that requests provision of a second service by performing a second authentication process. I have a request. The first provision request includes the first account information input by the user, and the second provision request includes the second account information input by the user.

The cooperation determination unit 232 determines the cooperation of account information included in the received provision request. That is, the cooperation determination unit 232 determines whether or not second account information associated (linked) with the first account information included in the received first provision request is recorded, based on the second cooperation DB 222. judge. Furthermore, the cooperation determining unit 232 determines whether first account information associated (linked) with the second account information included in the second provision request is recorded, based on the second cooperation DB 222. .

The authentication requesting unit 233 receives the first provision request during and after the transition period, and when the cooperation determining unit 232 determines that the second account information corresponding to the first account information is to be linked, the authentication requesting unit 233 provides the first provision request. 1. An authentication request including one account information is sent to the first service server 10. Furthermore, the result of the first authentication process is received from the first service server 10.

The second authentication processing unit 234 performs a second authentication process that determines whether the second account information included in the second provision request is authentic when the second provision request is received before the transition period and during the transition period. Perform processing. For example, when the second authentication method is a password, the second authentication processing unit 234 receives a password corresponding to the second account information, and if the password matches the one recorded in the second authentication information, the second authentication processing unit 234 , authenticating the second account information as authentic, that is, allowing the user to access and provide the second service using the second account information.

The second service providing unit 235 provides the second service based on the authentication result. Specifically, during and after the transition period, if the authentication requesting unit 233 receives an authentication result from the first service server 10 indicating that the first account information has been authenticated, the second service providing unit 235 A second service is provided to the user terminal 30. Further, during the transition period and before the transition period, when the second account information is authenticated by the second authentication processing section 234, the second service providing section 235 provides the second service to the user terminal 30.

The transmitter 236 transmits various information related to user authentication to the user terminal 30.
For example, if the second account information and the first account information are not linked, the transmitting unit 236 links the second account information with the second provision request during the transition period and after the transition period. Send a registration guide prompting you to register your primary account information. The transmitting unit 236 also transmits the registration guide when it is detected that the first account information linked to the second account information is no longer usable.
Further, when the second account information and the first account information are linked, the transmitting unit 236 requests transmission of the first provision request in response to reception of the second provision request during and after the transition period. Send a transmission request to that effect.

The registration unit 237 also functions as a new registration unit, a cooperation registration unit, and a cooperation cancellation unit of the present disclosure, and performs new registration and update of the second user information, update of the second cooperation DB 222, and the like. That is, when the registration unit 237 receives a new registration request to newly utilize provision of the second service from the user terminal 30, the registration unit 237 generates the second user information and registers it in the second user DB 221. Further, upon receiving the first account information to be linked to the second account information, the registration unit 237 adds the received first account information to the corresponding second account information among the linkage information recorded in the second linkage DB 222. Record in association. Further, when it is detected that the first account information cannot be used, the registration unit 237 deletes the corresponding first account information from the second cooperation DB 222. The detection of unusability of the first account information involves receiving unusability information indicating that the first account information has become unusable from the first service server 10. For example, when transmitting the first authentication process to the first service server 10, it is possible to receive unusable information, and at the timing when the first account information becomes unusable, the first service server 10 transfers the information to the second service server 20. Unavailability information may be sent to

[Configuration of user terminal 30]
The user terminal 30 is a terminal device owned by a user, and is configured by, for example, a smartphone, a tablet terminal, a computer such as a personal computer, or the like. Although illustration of the specific configuration of the user terminal 30 is omitted, it has the basic configuration of a general computer. That is, the user terminal 30 includes an input operation unit that receives user operations, a display that displays image information, a recording device that records various information, and an arithmetic circuit (such as a CPU) that processes various information.

[Authentication method]
Next, an authentication method in the authentication system 1 of this embodiment will be explained.
(registration process)
First, the second user information registration process in the second service server 20 will be described.
FIG. 2 is a flowchart showing the second user information registration process.
A user who wishes to newly receive the provision of the second service operates the user terminal 30 to transmit a new registration request requesting new registration for the use of the second service. Thereby, the second service server 20 transmits the registered content for new use registration to the user terminal 30.
For example, by downloading an application provided by the second service server 20 to the user terminal 30 and starting the application, a new registration request is sent from the user terminal 30, and registered content is sent from the second service server 20. . Alternatively, the second service server 20 may publish the registered content as a web page on the Internet. Accessing the registered content from the user terminal 30 is synonymous with the transmission unit 236 transmitting the registered content to the user terminal 30.

At this time, if it is before the transition period (step S101: YES), the second service server 20 performs user authentication by second authentication processing in providing the second service. Therefore, the transmitter 236 transmits the second account information and the first registration content that prompts the user to register a password to the user terminal 30 (step S102).
Then, upon receiving the second account information and password from the user terminal 30, the registration unit 237 uses the received password as second authentication information and generates second user information including the second account information and second authentication information. and registers it in the second user DB 221 (step S103).
Further, the first registered content may further prompt the user to input the second user attribute information. In this case, the registration unit 237 receives the second user attribute information input by the user according to the first registered content, and records it in the generated second user information (step S104). Note that the second user attribute information does not need to be received at the time of registering the second user information, and may be received at any timing when the user desires to be provided with the second service.

On the other hand, during the transition period, the second authentication process is permitted, but it is necessary to prompt the user to perform the first authentication process in order to transition to the first authentication process. Furthermore, after the transition period, the second authentication process is prohibited, and only the first authentication process is performed for user authentication.
Therefore, if it is during the transition period or after the transition period (step S101: NO), the transmitter 236 sends the second registration content (corresponding to the registration guide of the present disclosure) requesting registration of the first account information to the user terminal 30. (Step S105).

At this time, second registered content may be sent to the user terminal 30 that allows selection of whether to use existing first account information or to generate new first account information.
For example, when the user selects to newly register the first account information for the second registered content, the user terminal 30 accesses the registration guide content for the first user information provided by the first service server 10. . When the user inputs necessary information according to the registration guidance content, the first user registration unit 133 of the first service server 10 generates first user information including first account information, and also creates a first account. The information is transmitted to the second service server 20 and the user terminal 30.
Furthermore, when the user selects to register the already created first account information for the second registered content, the first account information input by the user is transferred from the user terminal 30 to the second service server 20. Sent.

The registration unit 237 of the second service server 20 selects a first account linked to the second account information from either the first service server 10 or the user terminal 30 based on the user's action on the second registered content transmitted in step S105. Information is received (step S106).
Then, the registration unit 237 newly generates second user information including new second account information and registers it in the second user DB 221 (step S107).
The registration unit 237 also registers cooperation information in which the second account information generated in step S107 and the first account information received in step S106 are combined in the second cooperation DB 222 (step S108).
Normally, when user registration is performed, various types of registered information are sent to the user terminal 30 of the registered user, but in this embodiment, during user registration after the transition period, the information linked to the user One account information may be sent to the user terminal 30, and the second account information may not be sent. By not transmitting the second account information, leakage of the second account information to a third party is suppressed.

(Service provision processing)
Next, service provision processing related to provision of the second service by the second service server 20 will be explained.
3 and 4 are flowcharts related to service provision processing.
When receiving the second service, the user operates the user terminal 30 to access predetermined content provided by the second service server 20. Thereby, the second service server 20 transmits to the user terminal 30 login guidance content that causes a login screen to be displayed.
At this time, if it is before the transition period (step S201: YES), the transmitter 236 transmits the second account information and the first login content prompting the user to input the password to the user terminal 30 (step S202). .
Then, when the provision request reception unit 231 receives a second provision request requesting provision of the second service using the second account information and second authentication information (for example, a password) from the user terminal 30 (step S203), the second The authentication processing unit 234 performs a second authentication process and determines whether the combination of the second account information and password is appropriate (step S204).
If the determination in step S204 is NO, the transmitter 236 returns an error to the user terminal 30 and returns to step S202.
If the determination in step S204 is YES, the second service providing unit 235 provides the user terminal 30 with a second service based on the second user information including the second account information (step S205: service providing step).

On the other hand, if it is not before the transition period (step S201: NO), the transmitting unit 236 sends the user terminal 30 a second account information that can select either the input of the first account information or the input of the second account information. The login content is transmitted (step S206). When the first account information is input by the user, the user terminal 30 transmits a first provision request including the first account information to the second service server 20. When the second account information is input by the user, the user terminal 30 transmits a second provision request including the second account information to the second service server 20.

Then, the provision request reception unit 231 receives a provision request transmitted from the user terminal 30, and determines whether or not a first provision request has been received as the provision request (step S207: provision request reception step).
If it is determined as YES in step S207, the cooperation determination unit 232 refers to the second cooperation DB 222 and determines whether there is second account information that is to be cooperated with the first account information included in the first provision request. (Step S208: Cooperation determination step).

If the determination in step S208 is NO (if the first account information linked to the second account information does not exist), the transmitter 236 returns an error to the user terminal 30, executes step S105, and 30, the second registration content is sent to prompt the user to register the first account information.

If the determination in step S208 is YES, the authentication request unit 233 transmits an authentication request requesting a first authentication process together with the first account information to the first service server 10 (step S209). Thereby, the first authentication processing unit 131 of the first service server 10 performs a first authentication process based on the received authentication request, and returns the authentication result to the second service server 20.

Then, the second service server 20 receives the authentication result from the first service server 10 (step S210), and determines whether the first account information is authenticated (step S211).
If it is determined as YES in step S211, the service providing step of step S205 is implemented, and the second service providing unit 235 provides a second user information based on the second user information including the second account information linked to the first account information. Two services are provided to the user terminal 30.
If the determination in step S211 is NO, an error is returned to the user terminal 30 and the process returns to step S206.

Further, if it is determined NO in step S207, that is, if the provision request reception unit 231 receives the second provision request, the cooperation determination unit 232 cooperates with the second account information based on the second cooperation DB 222. It is determined whether there is first account information (step S212).
If the determination in step S212 is YES and the transition period is in progress (step S213: YES), the processes from step S203 to step S205 are executed to provide the second service through the second authentication process. . At this time, the transmitter 236 may transmit guidance information to the user terminal 30 indicating that only the first authentication process will be authenticated after the transition period ends.

Further, if the determination is YES in step S212 and the transition period has passed (step S213: NO), the transmitter 236 sends the user terminal 30 a first provision using the first account information. A transmission request requesting transmission of the request is returned (step S214: request transmission step), and the process returns to step S206. At this time, the first account information may be included in the transmission request, so that the user can confirm the first account information linked with the second account information and transmit the first provision request in step S206.

On the other hand, if the determination in step S212 is NO, the transmitting unit 236 transmits registration guidance urging the user terminal 30 to register the first account information to be linked with the second account information (step S215).
Then, upon receiving the first account information from the user terminal 30 (step S216), the registration unit 237 registers it in the second cooperation DB 222 as the first account information to be linked with the second account information (step S217).

If it is during the transition period (step S218: YES), the processes from step S203 to step S205 are executed, and the second service is provided by the second authentication process. At this time, the transmitter 236 may transmit guidance information to the user terminal 30 indicating that only the first authentication process will be authenticated after the transition period ends.
If the transition period has passed (step S218: NO), the process returns to step S206.
Note that if the second account information included in the second provision request is not recorded in the second user DB 221 and the second cooperation DB 222, an error is returned to the user terminal 30 and the process returns to step S206.

(Cooperation cancellation processing)
In this embodiment, when the first account information becomes unusable in the first service server 10, the linkage with the second account information linked to the first account information is canceled.
FIG. 5 is a flowchart related to cancellation of cooperation due to unavailability of first account information.
In the first service server 10, when the first account information becomes unusable due to registration deletion of the first account information by the user or freezing of the first account information due to unauthorized use, etc., the first service server 10 The first account information that has become unusable is transmitted to the second service server 20.
The registration unit 237 of the second service server 20 detects the unusability of the first account information by receiving the unusable first account information from the first service server 10 (step S301), and detects the unusability of the first account information (step S301). The corresponding first account information is deleted from the second linkage DB 222, and the linkage between the second account information and the first account information is canceled (step S302). In step S302, the linkage between the second account information and the first account information is canceled.
Note that the first account information that has become unusable is sent from the first service server 10 to the second service server 20 at the same time that the first account information becomes unusable. Detection is not limited to this. For example, when the authentication request unit 233 transmits the authentication request to the first service server 10 in step S209, the first service server 10 receives information regarding the state (deletion or freeze) of the first account information included in the authentication request. Unavailability of the first account information may be detected by receiving this.
As a result, the user is restricted from providing the second service using the first authentication process during and after the transition period.

When the linkage between the second account information and the first account information is canceled in step S302, the transmitter 236 executes step S105 and sends the first account information to the user terminal 30 of the user whose linkage has been canceled. Send registration guidance to encourage information collaboration. Note that the registration guide sent here may be, for example, an email containing a transition URL to the second registered content.

FIG. 6 is a flowchart of cancellation of cooperation due to deletion of second account information.
The second service server 20 receives a deletion request for account deletion of second user information from the user terminal 30 (step S401).
The registration unit 237 deletes the second user information of the second account information included in the deletion request from the second user DB 221 (step S402), and deletes the corresponding cooperation information recorded in the second cooperation DB 222 (step S402). S403).
As a result, even if a first provision request including first account information is received, there is no second account information corresponding to the first account information, and provision of the second service to the user terminal 30 is restricted.

[Actions and effects of this embodiment]
The second control unit 23 of the second service server 20 (authentication device) of the present embodiment reads and executes the program recorded in the second storage unit 22, thereby controlling the provision request reception unit 231, cooperation determination unit 232, It functions as two service providing units 235 and a transmitting unit 236.
The provision request reception unit 231 receives either a first provision request requesting provision of a second service through a first authentication process or a second provision request requesting provision of a second service through a second authentication process. Receive from terminal 30. The cooperation determining unit 232 determines whether the first account information and the second account information are linked based on the second cooperation DB 222. The second service providing unit 235 receives the first provision request, determines that the first account information and second account information are linked, and authenticates the first account information by the first authentication process. In this case, the second service is provided to the user terminal 30. The transmitter 236 transmits a transmission request requesting transmission of the first provision request to the user terminal 30 when the second provision request is received during or after the transition period.

In this embodiment, even if the security strength of the second authentication process is low, the first authentication process with higher security strength can be used without changing the authentication method of the second authentication process. It is possible to improve security in providing two services. At this time, there is no need to update the user authentication program in the second service server 20 or reinstall a user authentication program using a new authentication method, and there is no need to update the second user DB 221 accordingly. Therefore, user authentication for providing the second service can be performed at low cost and with high security.
This is particularly effective when switching from an old authentication method to a new authentication method with higher security. By linking the primary account information and secondary account information during the specified transition period, the User authentication can be unified through authentication processing, making it possible to easily introduce high security.
In addition, there are conventional services that link accounts of other services and provide a second service using that account, but even if the link is canceled, it is still possible to log in using the other account. Since it is also possible to log in using the second account information, the security strength is weak. In contrast, in this embodiment, after the transition period, the second authentication process using the second account information is no longer possible, and only the first authentication process using the first account information linked to the second account information is permitted. Not done. Therefore, high security strength can be maintained by disallowing the second authentication process.

In this embodiment, when the first account information linked to the second account information does not exist, the transmitter 236 sends a registration guide urging registration of the first account linked to the second account information.
This allows the user to be informed that the second service cannot be provided without performing the first authentication process using the first account information, and prompts the user to register the first account information to be linked to the second account information. be able to. Therefore, even during the transition period, the transition from the second authentication process to the first authentication process proceeds quickly, and the second service using the first authentication process with high security strength can be provided more quickly.

In this embodiment, the registration unit 237 also functions as a cooperation cancellation unit. That is, when the registration unit 237 detects that the first account information linked to the second account information is unusable, it deletes the first account information linked to the second account information from the second linkage DB 222.
This restricts the use of the second service using fraudulent first account information, thereby further improving security.

Further, the transmitting unit 236 sends a registration guide to the user terminal that prompts the user to register other first account information to be linked to the second account information when the link between the first account information and the second account information is canceled. Send to 30.
Thereby, the user can continue to receive the second service by using other first account information.

Further, the registration unit 237 functions as a new registration unit and a cooperative registration unit. Then, after the transition period, when receiving a new registration request from the user terminal 30 requesting new registration for the use of the second service, the transmitter 236 transmits the first account information to be linked to the newly generated second account information. A second registration content prompting registration is transmitted to the user terminal 30. When the registration unit 237 receives the transmission of the first account information from the user terminal 30, it newly generates second user information including the second account information, and stores the second account information and the first account information in the second cooperation DB 222. Register cooperation information including.

As a result, after the transition period, the first account information is registered when registering to use the second service, and only user authentication by the first authentication process using the first account information is permitted. Therefore, by suppressing implementation of the second authentication process with low security strength, security can be improved. Further, in this embodiment, second account information is generated for use of the second service, but the second account information is not transmitted to the user terminal 30 (not notified to the user). This prevents the inconvenience of the second account information being leaked to a third party, and further improves security.

[Modified example]
The present invention is not limited to the above-described embodiments, and the present invention includes modifications, improvements, and configurations obtained by appropriately combining the embodiments to the extent that the objects of the present invention can be achieved. be.

(Modification 1)
In the above embodiment, an example was shown in which the first authentication method has higher security strength than the second authentication method, but it is sufficient that the first authentication method is at least equal to or higher than the second authentication method.

(Modification 2)
In the above embodiment, an example is shown in which a transition period is provided, but the configuration may be such that the transition period is not provided and the second authentication process is prohibited at a predetermined timing.

(Modification 3)
In the above embodiment, when newly registering the second account information, in step S105, the second registered content that allows the user to select whether to use the existing first account information or to newly generate the first account information is provided. In either case, upon receiving the first account information, the registration unit 237 generated the second account information and linked the first account information and the second account information.
On the other hand, when using existing first account information, in order to determine whether the first account information received by the first service server 10 from the user terminal 30 is appropriate, the first service server You may also send an authentication request to Then, when the first account information is authenticated by the first authentication process by the first service server 10, generation of second account information and linkage of the first account information with the generated second account information are performed. You may.

1... Authentication system, 10... First service server, 20... Second service server (authentication device), 23... Second control unit, 30... User terminal, 221... Second user database, 222... Second cooperation database, 231 . . . Provision request reception unit, 232 .

Claims (6)

A first provision request requesting provision of a second service using second account information using a first authentication method using first account information for receiving provision of the first service, and an authentication method using said second account information. a second provision request requesting provision of the second service using a second authentication method having a lower security strength than the first authentication method from a user terminal;
Whether or not the first account information and the second account information are linked based on a linkage database that records the second account information and the first account information linked to the second account information. a cooperation determination unit that determines whether
The first provision request is received, and it is determined that the first account information and the second account information are linked, and the first account information is authenticated by the first authentication method. a service providing unit that provides the second service when the account information is authenticated;
a transmitting unit that transmits a transmission request requesting transmission of the first provision request to the user terminal when the second provision request is received;
An authentication device comprising: The transmitting unit transmits a registration guide prompting registration of the first account information to be linked to the second account information when the first account information linked to the second account information does not exist.
The authentication device according to claim 1. The system further includes a linkage cancellation unit that detects unusability of the first account information linked to the second account information and deletes the first account information linked to the second account information from the linkage database. ,
The authentication device according to claim 1 or claim 2. The transmitting unit transmits registration guidance to the user terminal to prompt registration of other first account information to be linked to the second account information when the linkage is canceled by the linkage canceling unit.
The authentication device according to claim 3. a new registration unit that newly generates the second account information;
a cooperation registration unit that records the first account information to be linked to the second account information registered in the cooperation database;
When the transmitter receives a new registration request requesting a new registration for the second service, the transmitter transmits a registration guide prompting registration of the first account information to be linked to the newly generated second account information,
The new registration unit generates the second account information when receiving the first account information from the user terminal,
The cooperation registration unit associates the generated second account information with the first account information received from the user terminal.
The authentication device according to any one of claims 1 to 4. A method for authenticating a user using a computer, the method comprising:
The computer includes a provision request receiving unit, a cooperation determining unit, a service providing unit, and a transmitting unit,
The provision request receiving unit receives a first provision request requesting provision of a second service using second account information using a first authentication method using first account information for receiving provision of the first service; 2. A second provision request that requests provision of the second service using a second authentication method that uses account information and has lower security strength than the first authentication method is received from the user terminal. a provision request receiving step;
The linkage determination unit determines whether the first account information and the second account information are linked based on the linkage database that records the second account information and the first account information linked to the second account information. a cooperation determination step for determining whether or not the
The service providing unit receives the first provision request and determines that the first account information and the second account information are linked, and provides the first account information according to the first authentication method. a service provision permission unit that permits provision of the second service when the first account information is authenticated through authentication processing;
a request transmitting step in which the transmitter, when receiving the second provision request, transmits a transmission request requesting transmission of the first provision request to the user terminal;
Authentication method to implement.

Images