JP2016184350A - Authentication information generation program, authentication information generation device and authentication information generation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication information generation program, an authentication information generation device and an authentication information generation method, capable of enhancing security of authentication information such as passwords against a list-based attack, while reducing a burden to a user.SOLUTION: A CPU is configured to: acquire, according to a generator program, a password inputted by an operation of a user of a portable terminal T into a password input column displayed in a display screen at the portable terminal T; acquire user information related to the user; acquire site information related to, for instance, a website A, accessed by the portable terminal T; and generate a new password to be used for user authentication, by utilizing the acquired password, user information and site information.SELECTED DRAWING: Figure 4

Description

  The present invention relates to a technical field such as a method for generating authentication information such as a password used for user authentication.

  In user authentication on a Web site, a user ID and password are generally used. User IDs and passwords can be stored as cookies or autocomplete, but there are security issues. Patent Document 1 discloses a login support system that does not have the trouble of inputting an ID and a password using a keyboard or a security problem. In this login support system, once logged in, the portable terminal stores the URL, ID, and password with security, and when the user logs in again, the ID and password are retrieved from the URL and displayed on the information display device. After obtaining the user authentication, the ID and password are automatically entered.

Patent No. 5298418

  By the way, there is a list attack as one method of illegal login to a Web site that performs user authentication. A list attack is an attack technique in which IDs and passwords are exploited from many websites and the information is used to log in to other websites. As a background to this, a user (user) of a website that performs user authentication uses the same ID and password combination on a plurality of websites, or uses the same password but different IDs on a plurality of websites. There is a problem that the tendency is strong. As an effective measure against the list attack, it is desirable to change the password for each Web site, but this increases the load on the user. Moreover, it is difficult to prevent the list attack even with the technique of Patent Document 1 or the like.

  Therefore, the present invention has been made in view of the above points, and an authentication information generation program and authentication information generation that can increase the security of authentication information such as passwords against list attacks while reducing the load on the user An object is to provide an apparatus and an authentication information generation method.

  In order to solve the above-mentioned problem, the invention according to claim 1 is directed to a computer that generates authentication information used for user authentication in an authentication information input field displayed on a display screen of the terminal device. First acquisition means for acquiring authentication information input by a user operation; second information for acquiring at least one of user information related to the user and access information related to an access destination of the terminal device; Using the acquisition means and the authentication information acquired by the first acquisition means and the information acquired by the second acquisition means to function as a generation means for generating authentication information used for the user authentication It is characterized by.

  According to a second aspect of the present invention, in the authentication information generation program according to the first aspect, the computer is acquired by the generation unit by the second acquisition unit and the authentication information acquired by the first acquisition unit. The authentication information is generated using the acquired user information and the access information acquired by the second acquisition means.

  According to a third aspect of the present invention, in the authentication information generation program according to the first aspect, the number of digits of authentication information that can be input in the authentication information input field is limited to a predetermined number of digits, and the generation The means generates the authentication information having a number of digits larger than the range of the predetermined number of digits.

  According to a fourth aspect of the present invention, in the authentication information generating program according to the first or second aspect, the computer is replaced with the authentication information input by the user's operation and displayed in the authentication information input field. The authentication information generated by the generating means is further made to function as a display control means for displaying in the authentication information input field.

  According to a fifth aspect of the present invention, in the authentication information generation program according to any one of the first to third aspects, the computer includes the authentication information input field in which the authentication information is input by an operation of the user. In addition, the authentication information input field displayed on the display screen further functions as display control means for displaying the authentication information generated by the generating means.

  A sixth aspect of the present invention is the authentication information generating program according to any one of the first to fifth aspects, wherein the second acquisition unit stores identification information that can identify the user. The identification information is acquired as the user information.

  The invention according to claim 7 is the authentication information generation program according to any one of claims 1 to 5, wherein the second acquisition unit is a biological information acquisition device that acquires biological information from the body of the user. The biometric information is acquired as the user information.

  The invention according to claim 8 is the authentication information generation program according to any one of claims 1 to 5, wherein the second acquisition unit includes a position detection device that detects a current position of the terminal device. Position information indicating a current position is acquired as the user information.

  The invention described in claim 9 is the authentication information generation program according to any one of claims 1 to 5, wherein the user information is registered in a predetermined server device, and the second acquisition unit includes: The user information is acquired from the server device.

  The invention according to claim 10 is an authentication information generation device that generates authentication information used for user authentication, and is input by an operation of a user into an authentication information input field displayed on a display screen of a terminal device. A first acquisition means for acquiring authentication information; a second acquisition means for acquiring at least one of user information related to the user; and access information related to an access destination of the terminal device; And generating means for generating authentication information used for the user authentication using the authentication information acquired by the first acquiring means and the information acquired by the second acquiring means.

  The invention described in claim 11 is an authentication information generation method performed by a computer that generates authentication information used for user authentication, and an operation performed by a user in an authentication information input field displayed on a display screen of a terminal device. A second acquisition step of acquiring at least one of the user information related to the user and the access information related to the access destination of the terminal device; And generating the authentication information used for the user authentication using the authentication information acquired by the first acquisition step and the information acquired by the second acquisition step. Features.

  ADVANTAGE OF THE INVENTION According to this invention, the security of authentication information, such as a password with respect to a list attack, can be improved, reducing the load to a user.

1 is a diagram illustrating a schematic configuration example of a communication system S. FIG. (A) is a block diagram illustrating a schematic configuration example of the mobile terminal T, and (B) is a block diagram illustrating a schematic configuration example of the IC card D. It is a figure which shows the example of a display transition of the login screen in Example 1 and 2. FIG. FIG. 6 is a sequence diagram illustrating an operation example during login in the first embodiment. In Example 2, it is a sequence diagram which shows the operation example of the communication system S. FIG. 10 is a diagram illustrating a display transition example of a login screen in the third embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In addition, embodiment described below is embodiment at the time of applying this invention with respect to a communication system.

  First, a schematic configuration and functions of the communication system S will be described with reference to FIGS. 1 and 2. FIG. 1 is a diagram illustrating a schematic configuration example of the communication system S. 2A is a block diagram illustrating a schematic configuration example of the mobile terminal T, and FIG. 2B is a block diagram illustrating a schematic configuration example of the IC card D.

  As shown in FIG. 1, the communication system S is configured to include websites A to C, a portable terminal T, an IC card D, an information providing server SA, and the like, and these components are connected to a communication network NW. ing. The communication network NW is constructed by, for example, the Internet, a dedicated communication line (for example, a CATV (Community Antenna Television) line), a mobile communication network (including a base station), a gateway, and the like. Although there are many other websites A to C, illustration is omitted. The portable terminal T and the IC card D are carried for each user, for example. The information providing server SA is, for example, a server device for performing an ASP (Application Service Provider) service. In this embodiment, the information providing server SA registers user information related to the mobile terminal T and responds to a request from the mobile terminal T. Provide registered user information.

  Each of the websites A to C includes, for example, a web server, an application server that performs processing related to a predetermined service, and a database server that registers authentication information (for example, ID and password) of the user of the mobile terminal T. ing. Examples of Web sites include shopping sites, accommodation reservation sites, SNS (Social Networking Service) sites, and the like. Each Web site A to C is assigned a unique global IP address on the communication network NW. Further, the site name, account name, URL (Uniform Resource Locator), and application name (for example, service name provided by the application server) of each of the Web sites A to C are different from each other. Note that the global IP addresses, site names, URLs, and application names of the websites A to C are examples of site information related to the website. The site information is an example of access information related to the access destination of the terminal device T.

  The Web server performs login processing (user authentication) in response to a login request from the mobile terminal T that has accessed via the communication network NW. In the login process, whether or not the ID (user ID) and password included in the login request matches the ID (user ID) and password registered in advance (by a registration request from the mobile terminal T) in the database server, for example. If it is determined that they match, the login is successful. If it is determined that they do not match, the login fails. The application server executes processing related to the service requested from the mobile terminal T that has successfully logged in, and transmits information based on the processing result to the mobile terminal T through the Web server (for example, as a Web page).

  As shown in FIG. 2B, the portable terminal T includes a control unit 11, a storage unit 12, a wireless communication unit 13, a GPS (Global Positioning System) receiving unit 14, an operation / display unit 15, and an IC card protocol processing unit 16. And an IC card connector 17, a SIM (Subscriber Identity Module) card 18, and a CLF (Contactless Front End) 19. The portable terminal T is an example of a terminal device in the present invention. Examples of the mobile terminal T include mobile terminals such as mobile phones and smartphones. A personal computer may be applied instead of the portable terminal T.

  The control unit 11 is configured by a CPU (Central Processing Unit) or the like. The storage unit 12 includes, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), and an NVM (Nonvolatile Memory). A flash memory or “Electrically Erasable Programmable Read-Only Memory” is applied to the NVM. The ROM or NVM in the storage unit 12 stores an OS (operating system), application software (software configured from an application program language), and the like. The application software is a program that can be downloaded from a predetermined server, for example. The application software includes an application program responsible for an instruction input function and a display function from a user, an application program responsible for a communication function via the wireless communication unit 13, a Web browser program, and data via the CLF 19 with the IC card D. An application program having a function of transmitting and receiving (including commands) is included. The application software may include a password generation program (an example of the authentication information generation program of the present invention).

  The wireless communication unit 13 includes an antenna and controls wireless communication performed with a base station of a mobile communication network or an access point of a wireless LAN. Thus, the control unit 11 can access the information providing server SA via the wireless communication unit 13 and the communication network NW. The GPS receiver 14 receives radio waves output from GPS satellites via an antenna and detects the current position (longitude and latitude) of the mobile terminal T. The GPS receiving unit 14 is an example of a position detection device in the present invention.

  The operation / display unit 15 includes, for example, a touch panel having an input function for receiving a user operation (for example, with a user's finger or pen) and a display function for displaying various display screens. Examples of the display screen include an ID and password registration screen, a password change screen, a login screen, a search screen, and various information provision screens. The password registration screen is a screen for registering the ID and password in each of the Web sites A to C. The password change screen is a screen for changing a registered password. The login screen is a screen for logging in to each of the websites A to C. An ID input field for inputting and displaying an ID and a password input field for inputting and displaying a password are displayed on the ID and password registration screen, the password change screen, and the login screen. The password input field is an example of an authentication information input field.

  The IC card protocol processing unit 16 controls communication with the SIM card 18. For example, T = 0 protocol communication defined in the ISO / IEC7816 standard is performed between the IC card protocol processing unit 16 and the SIM card 18. A CLF 19 and a SIM card 18 are connected to the IC card connector 17. For example, SWP (Single Wire Protocol) communication is performed between the CLF 19 and the SIM card 18. SWP communication is a full-duplex communication method that can simultaneously transmit in both directions. The SIM card 18 is a contact IC chip including a CPU, ROM, RAM, NVM, and I / O circuit (for example, having eight terminals C1 to C8). The CLF 19 is a non-contact IC chip that includes a CPU, RAM, ROM, nonvolatile memory, I / O circuit, and the like. The I / O circuit includes an antenna for performing the communication in the field of non-contact communication, a modulation / demodulation circuit, and the like. Accordingly, the CLF 19 can perform wireless communication (for example, non-contact communication defined by the NFC standard) with the IC card D by radio waves.

  As shown in FIG. 2B, the IC card D is mounted with a non-contact type IC chip including a CPU 21, ROM 22, RAM 23, NVM 24, I / O circuit 25, and the like. The IC card D is an example of a portable recording medium in the present invention. The I / O circuit 25 includes an antenna for performing the communication in the field of non-contact communication, a modulation / demodulation circuit, and the like. The ROM 22 or NVM 24 stores an OS, application software, and the like. The application software includes an application program having a function of receiving a command from the portable terminal T, executing a process according to the received command, and responding to the result. The application software may include a password generation program. The NVM 24 is provided with a secure storage area, and operation data (for example, a secret key) used in encryption processing or the like is stored in this storage area. This calculation data is an example of user information related to the user of the mobile terminal T, and is information that a Service-to-Self (for example, an attacker of a list attack) cannot know. Such user information is used to generate a password used for user authentication together with a password input in the password input field by a user operation. Other examples of user information include, for example, biological information (for example, a user's fingerprint, iris, face, etc.) acquired from the user's body by a biological information acquisition device. As another example of the user information, there is position information indicating the current position detected by the GPS receiver 14 (the current position of the user who owns the mobile terminal T (in other words, the current position of the mobile terminal T)). It is done. Note that the current position of the user can also be detected from the positional relationship between the mobile terminal T and the base station of the mobile communication network, for example. Other examples of user information include card numbers (an example of identification information that can identify a user) such as member cards, employee cards, and book cards owned by the user. When the member card, employee card, or book card is constituted by the IC card D, the card number is stored in the IC card D as user information. The card number may be registered in advance in the information providing server SA as user information in association with, for example, the user ID.

  In the above configuration, for example, the IC card D or the control unit 11 operates as an authentication information generating device of the present invention, and the CPU provided in the IC card D or the control unit 11 generates a password used for user authentication. Operates as a computer. The password generation program is, for example, application software that causes the CPU to function as the first acquisition unit, the second acquisition unit, the third acquisition unit, the generation unit, and the display control unit in the present invention. The password generation program is downloaded from a predetermined server such as the information providing server SA and stored in the NVM 24 or the storage unit 12, for example.

  Note that the password generation program is a script (for example, Java (registered), for example, in a structured document (for example, a document such as HTML) data constituting a Web page (for example, a login screen page) transmitted from the website A to the mobile terminal T. Trademark) script). Alternatively, the password generation program may be configured to be stored and executed in a predetermined server such as the information providing server SA. In this case, the server operates as an authentication information generation apparatus of the present invention, and the CPU of the server operates as a computer that generates a password used for user authentication.

  In accordance with the password generation program, the CPU obtains the password input by the user's operation of the mobile terminal T in the password input field displayed on the display screen of the mobile terminal T, and the user information related to the user and the mobile terminal T For example, at least one of site information related to, for example, website A (web site where user authentication is performed) accessed by the user, and at least one of the acquired password, user information, and site information is acquired. Using either of these, a new password used for user authentication is generated. Then, the CPU causes the generated new password to be displayed in the password input field instead of the password input by the user's operation and displayed in the password input field. Alternatively, the CPU displays the generated new password in the password input field displayed on the display screen separately from the password input field in which the password is input by the user's operation. The new password input in the password input field in this way is transmitted from the portable terminal T to, for example, the website A included in a normal registration request or login request.

  Next, the operation of the communication system S will be described separately in the first to fourth embodiments.

Example 1
First, Example 1 is demonstrated with reference to FIG.3 and FIG.4. The first embodiment is an example in which the IC card D operates as a password generation device. FIG. 3 is a diagram illustrating a display transition example of the login screen in the first and second embodiments. FIG. 4 is a sequence diagram illustrating an operation example during login in the first embodiment. In the following description, it is assumed that the user ID and password of the mobile terminal T are already registered in the website A. The password generation process during password registration is the same as the password generation process during login (steps S8 and S9).

  When the portable terminal T accesses the website A according to the URL of the website A designated by the user (step S1), the web server of the website A transmits a login screen page to the portable terminal T (step S2). When receiving the login screen page transmitted from the website A, the control unit 11 of the portable terminal T displays the login screen on the operation / display unit 15 by using, for example, a web browser (step S3).

  In the login screen 50 in the display example 1 (upper side) shown in FIG. 3, an ID input field 51, a password input field 52, a send button 55, and the like are displayed. On the other hand, an ID input field 51, password input fields 52 and 53, a send button 55, and the like are displayed on the login screen 50 in the display example 2 (lower side) shown in FIG. In Display Example 1, the existing login screen can be used without being corrected on the Web site A side. Note that the number of digits of a password that can be entered in the password entry field 52 may be limited to a predetermined number of digits (for example, 4 to 8 digits). The maximum number of digits within the limited range is called the maximum number of digits.

  The control unit 11 of the mobile terminal T inputs and displays the ID in the ID input field 51 according to the operation of the user of the mobile terminal T (see FIGS. 3A and 3D), and the password in the password input field 52. Input and display (see FIGS. 3B and 3E) (step S4). When a password is input by a user's operation, for example, as shown in FIGS. 3B and 3E, a balloon display 54 for prompting the user to generate a password is displayed. The balloon display 54 may be performed when an input password is selected by a user drag operation (at this time, the selected password is held in the clipboard).

  When the user touches “Generate” in the balloon display 54, the control unit 11 of the mobile terminal T determines that there is an instruction for generation (step S5: YES), and displays site information related to the accessed website A. Obtain (step S6). For example, the URL, global IP address, site name, or application name of Web site A is acquired as the site information. Here, the site name and application name of Web site A are included in the login screen page received from Web site A, for example. If the ID used for user authentication differs between at least two websites, the ID input in the ID input field 51 may be acquired as site information.

  Next, the control unit 11 of the mobile terminal T transmits a password request command to the IC card D via the CLF 19 (step S7). This password request command includes the password input in the password input field 52 in step S4, the site information acquired in step S6, and the like.

  When the password request command transmitted from the portable terminal T is received by the IC card D, the CPU 21 of the IC card D activates the password generation program, acquires the password and site information from the received password request command, and Then, user information (for example, a secret key) is acquired from the NVM 24 (step S8).

  Next, the CPU 21 of the IC card D generates a new password used for user authentication using the password, site information, and user information acquired in step S8. For example, the CPU 21 assigns a password, site information, and user information to a hash function defined by the password generation program and calculates the new password (hereinafter referred to as “new password”). Is generated) (step S9). Here, it is desirable that the number of digits of the generated new password is larger than the maximum number of digits of the password that can be entered in the password input field 52. In this case, in the password generation process at the time of password registration, a new password having a number of digits larger than the maximum limit number of digits of the password that can be entered in the password input field 52 is registered in the Web site A in advance. Thereby, the security of a password can be improved. For example, when a “one site” that stores IDs and passwords in a database is attacked and a large number of IDs and passwords are leaked, the leaked IDs and passwords are used to log in to “another site” . A malicious attacker will attempt to log in using the acquired ID and password. However, for example, the password input field 52 cannot input all digits of the password, and therefore cannot attempt to log in ( (In other words, the frequency of attacks from malicious attackers will decrease). As a result, it is possible to greatly reduce the load on the server side for checking whether or not the correct password is present.

  Next, the CPU 21 of the IC card D transmits the new password generated in step S9 to the portable terminal T via the I / O circuit 25 as a response to the command (step S10), whereby the new password is entered in the password input field. (Step S11). Thereby, for example, as shown in FIG. 3C, the generated new password is input and displayed in the password input field 52 instead of the password input and displayed in the password input field 52 (that is, overwrite display). Is done. Alternatively, as shown in FIG. 3F, the generated new password is input and displayed in the password input field 53.

  When the user touches the transmission button 55 on the login screen 50, for example, the control unit 11 of the mobile terminal T determines that there is a transmission instruction (in this case, a login instruction) (step S12: YES), and the login request is wirelessly transmitted. It transmits to the website A via the communication unit 13 (step S13). This login request includes the input ID and the generated new password. The website A executes a login process in response to a login request from the mobile terminal T (step S14). In this login process, it is determined whether or not the ID and new password included in the login request match the previously registered ID and new password. If it is determined that they match, the login is successful and does not match. If it is determined, login fails.

  As described above, according to the first embodiment, the IC card D acquires the password input in the password input field, acquires user information related to the user, and is related to the website where user authentication is performed. Site information to be acquired, and a new password used for user authentication is generated using the acquired password, user information, and site information. As a result, the user only has to input simple passwords (passwords that are easy to remember) used on a plurality of websites (there is no need to remember passwords for each of the plurality of websites). Furthermore, since the new password can be made different among a plurality of Web sites, the security of the password against the list attack can be increased. Furthermore, according to the first embodiment, since a new password is generated using a secret key that cannot be output from the IC card D (information that cannot be known by the Service-to-Self), the security of the password can be further enhanced.

  The user information may be a card number such as a member card, employee card, or book card owned by the user. In this case, in step S8, the CPU 21 of the IC card D acquires the card number from, for example, the NVM 24, and generates a new password used for user authentication using the acquired password, card number, and site information. To do. Alternatively, the card number may be registered in the information providing server SA in association with the ID. In this case, in step S6, the control unit 11 acquires a card number from the information providing server SA using the ID as a key, acquires site information related to the website A, the acquired card number and site information, and In step S7, the input password is included in the password generation request and transmitted to the IC card D. Thereby, the CPU 21 of the IC card D acquires the password, card number, and site information from the received password request command, and generates a new password using these.

  Or it is good also as biometric information (for example, a user's fingerprint, an iris, a face, etc.) acquired as a user information, for example from a user's body by a biometric information acquisition device. In this case, in step S6, the control unit 11 acquires biological information from the biological information acquisition device via the CLF 19 or the like, acquires site information related to the website A, and acquires the acquired biological information and site information. And the input password are included in the password generation request and transmitted to the IC card D in step S7. Thereby, CPU21 of IC card D acquires a password, biometric information, and site information from a received password demand command, and generates a new password using these. In this case, a certain allowable error range is set for the new password match determination in the user authentication. Since such biometric information is also information that cannot be known by the Service-to-Self, it is possible to further increase the security of the new password.

  Or it is good also as positional information which shows the present position detected by GPS receiving part 14 grade | etc., As user information. Here, the user registers a password at a specific location (for example, a location where a terminal that performs accounting or the like is installed in the company) (that is, a new password specialized for the specific location). Is registered). In this case, in step S6, the control unit 11 acquires the position information from the GPS reception unit 14 and the like, acquires the site information related to the website A, the acquired position information and site information, and the input In step S7, the password is included in the password generation request and transmitted to the IC card D. Thereby, the CPU 21 of the IC card D acquires the password, the position information, and the site information from the received password request command, and generates a new password using these. If a new password for login is generated at a location other than the user's location at the time of password registration using a new password specialized for a specific location, login failure can be caused. In this case, a certain allowable error range is set for the new password match determination in the user authentication.

  In the first embodiment, the IC card D is configured to execute the password generation process. However, instead of the IC card D, a predetermined server such as the information providing server SA may execute the password generation process. .

(Example 2)
Next, Example 2 will be described with reference to FIGS. 3 and 5. The second embodiment is an example in which the control unit 11 of the mobile terminal T operates as a password generation device. FIG. 5 is a sequence diagram illustrating an operation example of the communication system S in the second embodiment. In addition, the process of step S21-S26 shown in FIG. 5 is the same as the process of step S1-S6 shown in FIG.

  In step S <b> 26 illustrated in FIG. 5, the control unit 11 of the mobile terminal T activates a password generation program and acquires site information related to the website A. Next, the control unit 11 of the mobile terminal T transmits a user information transmission request command to the IC card D via the CLF 19 (step S27). In this case, the CPU 21 of the IC card D acquires the card number from the NVM 24, for example (step S28), and transmits the acquired card number to the portable terminal T via the I / O circuit 25 as user information (step S29). ).

  Alternatively, in step S27, the control unit 11 of the portable terminal T may transmit a user information transmission request command (including the user ID) to the information providing server SA via the wireless communication unit 13 and the communication network NW. In this case, the information providing server SA acquires a card number using the ID included in the command as a key (step S28), and uses the acquired card number as user information to the portable terminal T via the I / O circuit 25. Transmit (step S29).

  Alternatively, in step S27, the control unit 11 of the mobile terminal T may transmit a user information transmission request command to the biological information acquisition apparatus via the CLF 19, for example. In this case, the biometric information acquisition apparatus acquires biometric information from the user's body (step S28), and transmits the acquired biometric information to the portable terminal T as user information (step S29).

  And the control part 11 of the portable terminal T acquires the user information transmitted from IC card D, information provision server SA, or a biometric information acquisition apparatus (step S30). In addition, the control part 11 may acquire the positional information from the GPS receiving part 14 grade | etc., As user information.

  Next, the control unit 11 of the mobile terminal T acquires the password input in step S24, and uses the acquired password, the site information acquired in step S26, and the user information acquired in step S30, As in the first embodiment, a new password used for user authentication is generated (step S31).

  Next, the control unit 11 of the portable terminal T displays the new password generated in step S31 in the password input field (step S32). As a result, for example, as shown in FIG. 3C, the generated new password is entered and displayed in the password entry field 52 instead of the password entered and displayed in the password entry field 52. Alternatively, as shown in FIG. 3F, the generated new password is input and displayed in the password input field 53. In addition, the process of step S33 to S35 shown in FIG. 5 is the same as the process of step S12 to S14 shown in FIG.

  As described above, according to the second embodiment, the control unit 11 of the mobile terminal T acquires the password input in the password input field, acquires user information related to the user, and performs user authentication. Site information related to the Web site is acquired, and a new password used for user authentication is generated using the acquired password, user information, and site information. As in the first embodiment, it is possible to increase the password security against a list attack while reducing the password input load on the user. Furthermore, according to the second embodiment, password security can be enhanced without using the IC card D.

  In the second embodiment, the control unit 11 of the mobile terminal T is configured to execute the password generation process, but the SIM card 18 may execute the password generation process instead of the control unit 11. In this case, the SIM card 18 operates as a password generation device.

Example 3
In the first and second embodiments, the case where the login screen is displayed when the mobile terminal T accesses the website A according to the URL of the website A specified by the user has been described as an example. As another example, when an application program installed on the mobile terminal T is activated, for example, a site selection screen for displaying a plurality of websites for sale of merchandise is displayed on the operation / display unit 15. is there. For example, site information acquired from a predetermined server by an application program is displayed on the site selection screen. In this case, when a Web site is designated by the user on the site selection screen, a login screen is displayed by starting a password generation program installed on the mobile terminal T for general use.

  FIG. 6 is a diagram illustrating a display transition example of the login screen according to the third embodiment. The login screen 60 shown in FIG. 6 displays an ID input field 61, a password input field 62, a site information display field 63, and the like. In the site information display field 63, site information (for example, application name, URL, etc.) related to the Web site designated by the user is displayed.

  When the control unit 11 of the mobile terminal T inputs an ID in the ID input field 61 and a password in the password input field 62 as shown in FIG. The password request command including the input password and the site information related to the Web site designated by the user is transmitted to the IC card D. Then, as described in the first embodiment, the CPU 21 of the IC card D generates a new password used for user authentication by using the password, the site information, and the user information, and sends it to the mobile terminal T. Send. As a result, as shown in FIG. 6B, the generated new password is entered and displayed in the password entry field 62 instead of the password entered and displayed in the password entry field 62.

  Alternatively, the control unit 11 of the mobile terminal T inputs an ID in the ID input field 61 and a password in the password input field 62 as shown in FIG. 6A according to the operation of the user of the mobile terminal T. Then, as described in the second embodiment, the user information transmitted from the IC card D, the information providing server SA, or the biological information acquisition device is acquired, and the input password, the site information, and the user information are acquired. To generate a new password used for user authentication. As a result, as shown in FIG. 6B, the generated new password is entered and displayed in the password entry field 62 instead of the password entered and displayed in the password entry field 62.

Example 4
In the first to third embodiments, the input password, the user information, and the site information are used to generate a new password that is used for user authentication. The user information may be used to generate a new password used for user authentication. For example, there are cases where the user uses different biometric information for each site, such as biometric information A (thumb fingerprint) on the website A and biometric information B (little finger fingerprint) on the website B. In this case, the CPU generates a new password used for user authentication for the website A by using the input password and the biometric information A (thumb fingerprint) as user information. On the other hand, the CPU generates a new password used for user authentication for the website B by using the input password and the biometric information B (little finger fingerprint) as user information. In addition to this, for example, the location information A (user's home) on the website A and the location information B (company where the user works) on the website B are used separately for each site. There may be. In this case, the CPU generates a new password used for user authentication for the website A by using the input password and the position information A (user's home) as user information. On the other hand, the CPU generates a new password used for user authentication for Web site B using the input password and position information B (company where the user works) as user information. In these cases, the site information described above is not necessary for generating a new password.

  In addition, the CPU uses the input password and site information related to the website A (at least one of a service name, an account name, a URL, and an IP address) to use the user for the website A. You may comprise so that the new password used for authentication may be produced | generated. In this case, the above-described user information is not necessary for generating a new password. In addition to the above, the new password can be generated by a combination of the input password and various information.

  In the above embodiment, a password is used as an example of authentication information. However, the present invention can also be applied to authentication information other than a password.

11 Control unit 12 Storage unit 13 Wireless communication unit 14 GPS reception unit 15 Operation / display unit 16 IC card protocol processing unit 17 IC card connector 18 SIM card 19 CLF
21 CPU
22 ROM
23 RAM
24 NVM
25 I / O circuits A to C Web site D IC card T Mobile terminal SA Information providing server NW Communication network

Claims (11)

A computer that generates authentication information used for user authentication
First acquisition means for acquiring authentication information input by an operation of a user of the terminal device in an authentication information input field displayed on the display screen of the terminal device;
Second acquisition means for acquiring at least one of user information related to the user and access information related to an access destination of the terminal device; and authentication information acquired by the first acquisition means; An authentication information generation program that functions as a generation unit that generates authentication information used for the user authentication using the information acquired by the second acquisition unit. The computer,
The generation unit uses the authentication information acquired by the first acquisition unit, the user information acquired by the second acquisition unit, and the access information acquired by the second acquisition unit, and uses the authentication information. The authentication information generation program according to claim 1, wherein: The number of digits of authentication information that can be entered in the authentication information input field is limited to a predetermined number of digits,
The authentication information generation program according to claim 1, wherein the generation unit generates the authentication information having a number of digits larger than the range of the predetermined number of digits. The computer,
In place of the authentication information input by the user's operation and displayed in the authentication information input column, the authentication information generated by the generating unit is further functioned as a display control unit for displaying in the authentication information input column. The authentication information generation program according to claim 1 or 2, characterized by the above. The computer,
Display control means for displaying the authentication information generated by the generating means in an authentication information input field displayed on the display screen separately from the authentication information input field in which the authentication information is input by an operation of the user The authentication information generation program according to any one of claims 1 to 3, further comprising a function.   The said 2nd acquisition means acquires the said identification information as said user information from the portable recording medium which memorize | stores the identification information which can identify the said user, The any one of Claim 1 thru | or 5 characterized by the above-mentioned. The authentication information generation program described.   The said 2nd acquisition means acquires the said biometric information as said user information from the biometric information acquisition apparatus which acquires biometric information from the said user's body, The Claim 1 thru | or 5 characterized by the above-mentioned. Authentication information generation program.   The said 2nd acquisition means acquires the positional information which shows the said present position as said user information from the position detection apparatus which detects the present position of the said terminal device, Any one of Claim 1 thru | or 5 characterized by the above-mentioned. Authentication information generation program described in 1. The user information is registered in a predetermined server device,
The authentication information generation program according to claim 1, wherein the second acquisition unit acquires the user information from the server device. An authentication information generation device that generates authentication information used for user authentication,
First acquisition means for acquiring authentication information input by a user operation in an authentication information input field displayed on the display screen of the terminal device;
Second acquisition means for acquiring at least one of user information related to the user and access information related to an access destination of the terminal device;
Generating means for generating authentication information used for the user authentication using the authentication information acquired by the first acquisition means and the information acquired by the second acquisition means;
An authentication information generating apparatus comprising: An authentication information generation method performed by a computer that generates authentication information used for user authentication,
A first acquisition step of acquiring authentication information input by a user operation in an authentication information input field displayed on the display screen of the terminal device;
A second acquisition step of acquiring at least one of user information related to the user and access information related to an access destination of the terminal device;
Using the authentication information acquired in the first acquisition step and the information acquired in the second acquisition step to generate authentication information used for the user authentication;
An authentication information generation method comprising:

Images