JP4882463B2 - User authentication system and method - Google Patents

Description

  The present invention relates to a user authentication system and method using a password, and more particularly to a user authentication system and method using image information.

  In order to prevent an unauthorized user from accessing, an increasing number of cases require authentication of each logged-in user when logging into a personal computer (hereinafter referred to as a PC) or a network. As user authentication, password-based user authentication is generally used.

  FIG. 7 shows an example of a password input screen displayed when a user is authenticated using a password. At the time of user authentication, a user ID (ABCDEF in FIG. 7) is a user identification information on the password input screen of FIG. And a password (01234567 in FIG. 7) are entered, the password entered on the password entry screen in FIG. 7 is collated with the user's password stored in advance in a PC or server, and the user is authenticated.

  However, with the password-based user authentication described above, if the password is simple (for example, the user's birthday), the risk that the password can be easily guessed by others increases, and if the password is complicated, the password Not only is the input cumbersome, but the risk of the user forgetting the password increases.

Patent Document 1 discloses a password-based user authentication method that is easy to memorize and improved for a user. The user authentication method disclosed in Patent Document 1 is an authentication method using music, in which a melody is stored in accordance with the order of key input of passwords, and the key is input from the melody when the user inputs the password by key. It is an invention for judging whether the input is correct. By using the technique of Patent Document 1, it is easy for a user to memorize a long password and it is difficult for a third party to steal it.

  However, even if the security level is improved by using a long password by using the invention of Patent Document 1, even if the security level is improved by phishing that spoofs a legitimate website and exploits information such as a password. There is a possibility of receiving.

  Therefore, an object of the present invention is to provide a user authentication method and a user authentication system that can prevent password exploitation by phishing and can set a password for each application used by a user in a password-based user authentication system. To do.

A first invention for solving the above-described problem is a user authentication method using a password, the user authentication method being associated with user identification information for identifying a user as information used for user authentication. In addition to the image information used in the above, reference image information preset by the user and a reference password preset by the user are stored for each application in an arbitrary part of the image information in the form of a rectangle, a circle or the like. The server receives the request for access to the information resource of the server from the client, acquires the user identification information from the client, and transmits the image information associated with the acquired user identification information to the client to step a for displaying the image information to the client, the server, the Step b, the server, the user identification information acquired from the client to get any part of the image information from the client image which the user has specified in a form not bound rectangle or circle or it as the authentication image information Step c for collating the reference image information set in advance in the application corresponding to the information resource for which the access request has been received and the authentication image information, and the server has successfully verified the authentication image information The reference password preset in the application corresponding to the information resource that is associated with the user identification information acquired from the client and is associated with the user identification information acquired from the client only when the authentication password of the user is acquired from the client step collates the authentication password and d, Characterized in that it is performed in sequence.

Furthermore, the second invention is the user authentication method according to the first invention, wherein the server continuously fails to collate the reference image information with the authentication image information for a preset number of times. Then, the steps after step a are not executed .

Further, a third invention is the user authentication method according to the first invention or the second invention, wherein in the step a , the server adds the reference image from the image information in addition to the reference image information. The portion excluding the information is displayed in a state of being divided into a plurality of rectangles, circles, or a shape not bound thereto, and in the step b , the server selects one of the plurality of images displayed by the user. An image is acquired as the authentication image information.

Furthermore, a fourth invention is the user authentication method according to any one of the first to third inventions, wherein the application includes a plurality of reference image information and each of the reference image information. The order to be used for collation is set, and the server repeatedly executes the step b and the step c, and only when the collation using all the reference image information is successful in the set order, the server Step d is executed .

Furthermore, the fifth invention is a user authentication system for authenticating a user using a password, the user authentication system being connected to the server via a network, a server for storing and managing information resources, A client accessing information resources, the client comprising image display means for displaying the image information transmitted from the server, wherein the server is at least information for identifying the user. In addition to image information used for user authentication in association with user identification information, reference image information that is a partial image of the image information and the user set for each application specifying information that specifies an application used by the user and information storing means for storing a reference password and a password, the information resource And of acquiring the user identification information from the client that has an access request, and transmits the image information associated with the acquired user identification information to the client, after the image information is displayed on the client, the an authentication image acquisition unit that client of the image display means is acquired from the client image which the user has specified in any part of the not bound rectangle or circle or its form of the image information displayed as the authentication image information, the The reference image information stored in association with the application identification information of the application corresponding to the information resource received from the client and associated with the user identification information acquired from the client is collated with the authentication image information. Authenticating image collating means, and the reference password A password acquisition unit that acquires the authentication password is a password for engagement from the client associated with the user identification information acquired from the client, the application specific information of the application corresponding to the information resource that has received the access request When there is a request for access to the information resource of the server, there is a password verification unit for verifying the reference password stored in association with the authentication password, and after the authentication image acquisition unit is operated, the authentication image Only when the verification means succeeds in the verification of the authentication image information, the password acquisition means and the control means for executing user authentication using the password means are provided .

Further, a sixth invention is the user authentication system according to the fifth invention, wherein the control means provided in the server determines the number of times that the verification of the reference image information and the authentication image information has failed successively. The user authentication is not executed when the number of times of consecutive failure in storing the reference image information and the authentication image information exceeds a predetermined value.

Further, according to a seventh invention, in the user authentication system according to the fifth or sixth invention, the password acquisition means provided in the server transmits a screen for inputting the authentication password to the client. A means for obtaining the authentication password from the client.

Further, an eighth invention is the user authentication system according to the fifth or sixth invention, wherein the authentication password is stored in advance in the client, and the password verification means provided in the server is stored. The authentication password is a means for obtaining from the client.

Further, a ninth invention is the user authentication system according to any one of the fifth to eighth inventions, wherein the authentication information acquisition means provided in the server includes the reference image information, A plurality of images obtained by dividing a portion of the image information excluding the reference image information into a rectangle, a circle, or a shape not bound thereto are transmitted to the client, and a plurality of images displayed on the image display unit of the client are transmitted . It is a means for obtaining one image selected by the user from among them as the authentication image information.

Furthermore, a tenth invention is the user authentication system according to any one of the fifth to ninth inventions, wherein the information storage means provided in the server includes one piece of the application specifying information. The plurality of reference image information and the order in which each of the reference image information is used for collation are stored, and the control unit provided in the server is configured such that the authentication image acquisition unit stores the authentication image information. Each time the image is acquired, the authentication image collating unit collates the authentication image information using the reference image information in the stored order, and uses all the reference image information in the stored order. Only when the verification is successful, user authentication is performed using the password acquisition means and the password means.

  According to the present invention described above, since the image information is always displayed to the user before the user is authenticated using the password, it is difficult to perform a phishing act as a legitimate server. Further, by acquiring a part of the displayed image information as the authentication image information and collating the authentication image information, the security of the user authentication system can be further enhanced.

  Further, by storing the reference image information and the reference password in association with the application specifying information that is information specifying the application used by the user, a password can be set for each application used by the user. .

  Further, the number of times of failure of continuous verification of the reference image information and the authentication image information is stored, and when the verification of the reference image information and the authentication image information exceeds the number of times, Unauthorized access due to impersonation can be prevented by not performing authentication. In addition, security can be enhanced by using a plurality of the reference image information, and the authentication image information can be selected by selecting the authentication image information from a plurality of images obtained by dividing the image information. Can be easily selected.

  Further, by storing the authentication password in the client, the user does not need to input the authentication password, so that the long authentication password can be used.

  From here, the user authentication system according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram illustrating a client server system to which the present invention is applied. As shown in FIG. 1, the client server system includes a server 2 that stores and manages information resources, and a client 1 that connects to the server 2 via the network 3 and uses the information resources stored in the server 2. At least.

  In FIG. 1, in order to explain the present invention in an easy-to-understand manner, a single client 1 is used. In practice, a plurality of clients 1 are connected to the server 2 via the network 3. In FIG. 1, the server 2 is illustrated as if it is configured as a single server, but the server 2 may be configured as a plurality of servers including application servers. Further, in FIG. 1, devices that are not necessary for the description of the present invention, such as HUBs and routers, are omitted.

  The server 2 stores a plurality of information resources such as information published on an in-house Web system, document information created with document creation software, and table information created with spreadsheet software.

  When the client 1 accesses the information resource of the server 2 via the network 3 in order to permit only the authorized user to use the information resource stored in the server 2, the server 2 is a user using a password. Authentication is performed, and the present invention is applied to this user authentication.

  The server 2 stores image information for each user as information used at the time of user authentication, and further selects each application used by the user when using information resources in a rectangle, a circle, or a form that is not tied to it. An arbitrary part of the image information is stored as the reference image information of the user.

  Further, the server 2 stores a reference password, which is a password set in advance by the user, for each application executed when the user uses the information resource in association with the reference image information as information used at the time of user authentication. Has been.

  For example, when a user browses information published on an in-house web system, the in-house web system becomes an application. When browsing document information or table information, the document creation software or spreadsheet software is an application. Become.

  When a user uses the information resource of the server 2, user authentication using a password is required. The server 2 transmits image information of the user to be authenticated to the client 1 before performing user authentication using the password. The image information is displayed on the display 10 of the client 1.

  Next, the server 2 allows the user to specify an arbitrary part of the image information displayed on the display 10 of the client 1 in a rectangle, a circle, or a form not bound thereto, and acquires the information specified by the user as authentication image information. To do.

  The server 2 uses the password set in this application only when the reference image information set in the application that operates when the user uses the information resource is successfully verified with the authentication image information. Only when user authentication is performed and user authentication is successful, access to the information resource is permitted using this application.

  As described above, according to the present embodiment, since the image information is always displayed on the client 2 before the user is authenticated using the password, it is difficult to carry out the phishing act pretending to be the regular server 2. Become.

  Also, let the user specify any part of the image information being played back by the client 2 in the form of a rectangle or a circle or not bound to it, obtain the specified information as authentication image information, and verify the authentication image information Can further enhance the security of user authentication.

  Since the server 2 identifies the application used by the user from the information resources used by the user, the application used by the user may be stored in the server 2 or stored in the client 1. Good.

  FIG. 2 is a block diagram of the client server system shown in FIG.

  The server 2 includes an authentication image acquisition unit 24 that acquires authentication image information from the client 2, a password acquisition unit 22 that acquires an authentication password from the client 2, an authentication image verification unit 23 that verifies authentication image information, and an authentication password. Password verification means 21 for verifying the information, information storage means 26 for storing information such as image information 261 transmitted to the client 1, and user identification information acquisition means 25 for acquiring user identification information 260 for operating the client 1. And control means 20 for controlling the entire server 2.

  The information storage means 26 of the server 2 is realized by an information storage device such as a hard disk, stores a plurality of information resources 263 used by the user, and is associated with user identification information 260 for identifying the user as information used for user authentication. A reference table 262 including image information 261 to be transmitted to the client 1 and reference image information is stored.

  FIG. 3 is a diagram for explaining the reference table 262. In the reference table 262, the user specifies in advance a part of the image information 261 in a rectangle, a circle, or a form not bound to the application specification information 264, which is information for specifying an application used by the user. The reference password 266 that is a password set in advance by the user is stored by the reference image information 265 and the password input screen shown in FIG.

  In FIG. 3, the application specifying information 264 is added to the information resource 263 accessed by the client 1 and is information for specifying an application used by the user.

  For example, when the information resource is information published by the user on the in-house Web system, the URL of the home page of the in-house Web system becomes the application specifying information 264. When the information resource is document information or table information, the document information or table is displayed. The extension added to the file name of the information becomes the application specifying information 264.

  FIG. 4 is a diagram for explaining the image information 261 and the reference image information 265 transmitted from the client 1 to the server 2. Image information 261 transmitted from the client 1 to the server is registered in the server 2 in advance by an administrator or a user.

  In addition, an arbitrary part of the image information 261 registered in the server 2 is specified in advance by the user as a rectangle, a circle, or a shape not bound thereto, and a part of the image information 261 specified by the user is the reference image information 265. Registered as

  In FIG. 4, a star figure is set as the reference image information 265 of the in-house Web system, the left eye is set as the reference image information 265 of the document creation software, and the right eye is set as the reference image information 265 of the spreadsheet software. Yes.

  In FIG. 2, a user identification information acquisition unit 25, an authentication image acquisition unit 24, and a password acquisition unit 22 of the server 2 are each an application that operates on the client 1, for example, a program such as Microsoft's ActiveX (registered trademark). Realized. The authentication image collating unit 23 and the password collating unit 21 are applications that operate on the server 2.

  The user identification information acquisition unit 25 of the server 2 is a unit that acquires user identification information 260 that is information for identifying the user who is operating the client 1, and accesses the information resource 263 using the client 1 from the user. Is transmitted from the server 2 to the client 1.

  FIG. 5 is an example of a screen displayed when the user identification information acquisition unit 25 operates on the client. The user identification information acquisition unit 25 converts the information input in the input field 25a of FIG. Is transmitted from the client 1 to the server 2.

  The authentication image acquisition unit 24 of the server 2 displays the image information 261 associated with the user identification information 260 acquired by the user identification information acquisition unit 25 and stored in the information storage unit 26 on the display 10 of the client 1; A function of causing the user to specify an arbitrary part of the image information 261 displayed on the client 1 in a rectangle, a circle, or a form not bound thereto, and acquiring a part of the image information 261 specified by the user as reference image information 265; I have.

  FIG. 6 is an example of a screen displayed on the browser 10 when the authentication image acquisition unit 24 operates. On the screen of the client 1, the image information 261 described in FIG. 4 and a button 24a for transmitting the authentication image information designated by the user to the server 2 are displayed.

  When the user designates authentication image information, the user designates an arbitrary part of the image information 261 using the pointer 24b, and then selects the button 24a. When the button 24a is selected, a part of the image information 261 designated by the pointer 24b is transmitted to the server 2 as authentication image information.

  The authentication image collating unit 23 of the server 2 is a unit that collates the authentication image information acquired by the authentication image acquiring unit 24 with the reference image information 265 stored in association with the application specifying information 264 of the application used by the user. It is.

  When the user manually designates the authentication image information, it is desirable that the authentication image collating unit 23 collates in consideration of the designation error of the authentication image information. For example, the authentication image collating unit 23 calculates and compares the feature amount of the authentication image information and the feature amount of the reference image information 265, and if the error of each feature amount is within a preset range, the authentication image information And the reference image information 265 are determined to match.

  The password acquisition unit 22 of the server 2 is a unit that displays, for example, the password input screen shown in FIG. 7 on the client 2 and acquires information input by the user in the input field 22a of FIG.

  The password verification unit 21 of the server 2 is a unit for verifying the reference password 266 stored in association with the reference image information 265 and the authentication password acquired by the password acquisition unit 22. Since the method of verifying the password is a general-purpose technique, details are omitted.

  From here, the procedure in which the control means 20 of the server 2 performs user authentication using the means provided in the server 2 will be described. FIG. 8 is a flowchart showing a procedure for user authentication by the server 2.

  The first step S1 of this procedure is a step in which the server 2 specifies an application. In this step, when the server 2 receives an access request to the information resource 263 from the client 1, the server 2 refers to the reference table 262 and specifies an application for the information resource 263 requested to be accessed.

  The next step S2 is a step for confirming whether or not the password set in the application specified in step S1 has been verified. In this step, the server 2 checks whether information that succeeds in verifying the password set in the application is stored in the information storage unit 26.

  If information that has been successfully verified is stored, the process proceeds to step S8. If not stored, the process proceeds to step S3.

Step S <b> 3 is a step of acquiring user identification information 260 from the client 1 .

In this step, the control means 20 transmits the user identification information acquisition means 25 to the client 1, and the user identification information acquisition means 25 operates on the client 2.

  When the user identification information acquisition unit 25 operates on the client 2, for example, the screen of FIG. 5 is displayed on the display 10 of the client 2, and the user identification information acquisition unit 25 uses the information input in the input field 25a of FIG. The identification information 260 is transmitted to the server 2.

  The next step S4 is a step in which the server 2 acquires authentication image information. When the server 2 acquires the user identification information 260, the control unit 20 sends the image information 261 and the authentication image acquisition unit 24 stored in the information storage unit 26 in association with the acquired user identification information 260 to the client 1. Send.

  The authentication image acquisition means 24 transmitted to the client 1 operates on the client 1 and displays, for example, the screen of FIG. 6 on the display 10 as the image information 261. When the user designates a part of the image information 261 with the pointer 24b and the button 24a is selected, the authentication image acquisition unit 24 transmits the part of the image information 261 designated by the user as authentication image information to the server 2. To do.

  The next step S5 is a step of collating the authentication image information. When acquiring the authentication image information from the client 1, the control unit 20 stores the authentication image information in association with the user identification information 260 acquired in step S3, and further authenticates the reference image information 265 set in the application specified in step S1. Check image information. In this step, if the collation fails, this procedure is terminated, and if the collation is successful, the process proceeds to step S6.

  Step S6 executed when the verification of the authentication image information is successful is a step of acquiring an authentication password. When the control unit 20 succeeds in comparing the authentication image information and the reference image information 265, the control unit 20 transmits the password acquisition unit 22 to the client 1, and the password acquisition unit 22 operates on the client 1.

  When the password acquisition unit 22 operates on the client 1, for example, the screen of FIG. 7 is displayed on the browser 10, the information input in the input field 22 a of FIG. 7 is acquired as an authentication password, and the acquired password is stored in the server 2. Send.

  The next step S7 is a step of verifying the authentication password. The control means 20 collates the reference password 266 set in the application identified in step S1 with the authentication password. In this step, if the collation fails, the procedure ends. If the collation succeeds, the process proceeds to step S8. In step S8, the client 1 is permitted to access the server, and the procedure ends.

  In the above-described embodiment, the control unit 20 of the server 2 stores the number of retries indicating the number of times that the verification of the authentication image information can be failed continuously, and continues the verification of the authentication image information beyond the number of retries. If it fails, it is desirable that the control unit 20 does not operate the authentication image collating unit 23.

  Furthermore, in the embodiment described above, the authentication password may be stored in the client 1. At this time, the password acquisition unit 22 is a unit for acquiring a password from the client 1.

  FIG. 9 is an example of a screen for transmitting the password stored in the client 1 when the password acquisition unit 22 is activated. When the transmission button 22b of FIG. 9 is selected, the password acquisition unit 22 is displayed. Transmits the authentication password stored in the client 2 to the server 2.

  In the present invention, the authentication image verification unit 23 and the authentication image acquisition unit 24 provided in the server 2 are changed in their respective programs to further characterize the verification method of the authentication image information and the reference image information 265. You can also.

(Modification 1)
As reference image information 265 used for user authentication, one reference image information 265 is stored for each application, but a plurality of reference image information 265 used for user authentication may be set.

  In the case of storing a plurality of reference image information 265, the information storage means 26 stores the order in which each reference image information 265 is used together with the plurality of reference image information 265 as information used for user authentication. . Note that the reference image information 265 set for each application may overlap between applications.

  FIG. 10 is a diagram showing an example when a plurality of reference image information 265 is set. In FIG. 10, for example, star-shaped reference image information 265a and round-shaped reference image information 265b are set as the reference image information 265 for the in-house Web system. The image information 265a is next round reference image information 265b.

  FIG. 11 is a flowchart for explaining a user authentication procedure using a plurality of reference image information 265. In the user authentication procedure when a plurality of reference image information 265 is stored, step S4 in the flowchart shown in FIG. And step S5 is changed.

  In the user authentication procedure when a plurality of reference image information 265 is stored, first, step S4a is executed instead of step S4. In this step, the authentication image acquisition means 24 is transmitted from the control device 20 and transmitted to the client 1. The authentication image acquisition unit 24 thus operated operates on the client 1 and displays, for example, the image information 261 described in FIG.

  Next, loop processing L1 is repeatedly executed by the number of reference image information 265 stored in the information storage means 26, and this loop processing L1 is defined in steps S5a to S5b. In step S <b> 5 a, the authentication image acquisition unit 24 acquires authentication image information with the same contents as in step S <b> 4 of FIG. 8 and transmits the acquired authentication image information to the server 2.

  Step S5b next to the loop processing is a step of collating the authentication image information. When acquiring the authentication image information from the client 1, the control unit 20 collates the reference image information 265 that is set in the application and whose use order is the number of times of the loop processing with the authentication image information.

  In this step, if the verification fails, this procedure is terminated. If the collation is successful and the loop processing has already been repeatedly executed for the number of reference image information 265, the process proceeds to step S6 in FIG. 8, and if the loop processing has not been repeatedly executed for the number of reference image information 265, the loop processing is performed. Process L1 is executed.

  For example, in the example shown in FIG. 10, the authentication image image acquired first and the star-shaped reference image information 265a are collated, and only when the collation is successful, the authentication image information acquired next and the circular reference image. Information 265b is collated. When the verification using the circular reference image information 265 b is successful, the control unit 10 transmits the password acquisition unit 22 to the client 1. If the password verification is successful, the client 1 is permitted to use the in-house Web system.

(Modification 2)
Furthermore, in the present invention, the means by which the authentication image acquisition means 24 acquires authentication image information can also be changed. In the above-described embodiment, the authentication image information is acquired by the user specifying an arbitrary part of the image information in a rectangle, a circle, or a form not bound thereto. Authentication image information may be acquired by selecting an image.

  That is, the portion obtained by removing the reference image information 265 from the image information 261 is divided into a plurality of shapes such as a rectangle, a circle, or a shape not bound thereto, and a plurality of fragments of the reference image information 265 and the image information 261 are displayed at the same time. One such image may be acquired as authentication image information.

  Also in this modification, a plurality of reference image information 265 can be set. As described above, the plurality of set reference image information 265 is provided with a collation order, and the control means 10 sets the password acquisition means 22 to the client 1 only when the reference image information 265 is selected in the order. Send to.

  FIG. 12 is an example of the image information 261 displayed in a fragmented manner. FIG. 12A illustrates the image information 261 before being fragmented. The image information 261 in FIG. 12A is an image obtained by combining circles, squares, triangles, rhombuses, and stars. As the reference image information 265, round reference image information 265c and star reference image information 265d are set. The order of collation is assumed to be round reference image information 265c first and star reference image information 265d next.

  FIG. 12B is a diagram illustrating an image displayed on the display 10 when acquiring authentication image information. As shown in FIG. 12B, when collating, the image information 261 is displayed in a state where a circle, a square, a triangle, a diamond, and a star are separated. Then, only when the user selects a round shape and a star shape in order, it is determined that the reference image information 265 has been successfully collated, and the control means 20 activates the password acquisition means 11.

The figure explaining a client server system. The block diagram of a client server system. The figure explaining a reference table. The figure explaining image information. An example of the screen displayed on a browser when a user identification information acquisition means operate | moves. An example of the screen displayed on a browser when an authentication image acquisition means operates. An example of a password input screen. The flowchart which showed the procedure in which a server authenticates a user. An example of a screen for transmitting a password stored in a client. The figure which showed an example when several reference image information was set. The flowchart explaining the procedure of user authentication using several reference image information. An example of image information displayed in a fragmented manner.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Client 10 Display 2 Server 20 Control means 21 Password verification means 22 Password acquisition means 23 Authentication image verification means 24 Authentication image acquisition means 25 User identification information acquisition means 26 Information storage means 260 User identification information 261 Image information 262 Reference table 263 Information resources H.264 Application specific information 265 Reference image information 266 Reference password 3 Network

Claims (10)

A user authentication method using a password, wherein the user authentication method relates to user identification information for identifying a user as information used for user authentication, in addition to image information used for user authentication, and optionally A server that stores, for each application, reference image information preset by the user and a reference password preset by the user in a form that is not bound to a part of a rectangle, circle, or the like. When the access request is received from the client, the user identification information is acquired from the client, the image information associated with the acquired user identification information is transmitted to the client, and the image information is displayed on the client. step a, the server is also laid rectangles or circles of any part of the image information Step b obtained from the client image which the user has specified in the form which is not bound by it as the authentication image information, the server is associated with the user identification information acquired from the client, the information resource that has received the access request Step c for collating the reference image information set in advance with the corresponding application and the authentication image information, and only when the server succeeds in the verification of the authentication image information, the authentication password of the user is Step d, which collates the reference password with the authentication password in advance, which is associated with the user identification information obtained from the client and associated with the information resource that has received the access request , A user characterized by being executed Authentication method. 2. The user authentication method according to claim 1, wherein after the server continuously fails a predetermined number of times in the comparison between the reference image information and the authentication image information, the server performs the steps after step a. A user authentication method characterized by not executing a step. 3. The user authentication method according to claim 1, wherein, in the step a , in addition to the reference image information , the server uses a rectangle, a circle, or a portion obtained by removing the reference image information from the image information. In the step b , the server obtains, as the authentication image information, one image selected by the user from among the plurality of displayed images. A user authentication method characterized by the above. 4. The user authentication method according to claim 1, wherein a plurality of the reference image information and an order in which each of the reference image information is used for collation are set in the application, The server repeatedly executes the step b and the step c , and executes the step d only when the collation using all the reference image information is successful in the set order. User authentication method. A user authentication system for authenticating a user using a password, the user authentication system comprising: a server for storing and managing information resources; and a client connected to the server via a network and accessing the information resources The client includes at least image display means for displaying the image information transmitted from the server , and the server is associated with at least user identification information, which is information for identifying the user, In addition to the image information used for authentication, for each application specifying information for specifying an application used by the user, reference image information that is a part of the image information and a reference password that is a password set by the user are stored. and an information storage means is, the request to access the resource The client acquires the user identification information from, and transmits the image information associated with the acquired user identification information to the client, after the image information is displayed on the client, the image display of the client an authentication image acquisition means means to acquire from the client image which the user has specified any portion in the rectangular or circular or it not bound form of the image information displayed as the authentication image information, the acquired from the client Authentication image collating means for collating the reference image information stored in association with the application specifying information of the application corresponding to the information resource that is associated with user identification information and that has received an access request, and the authentication image information And a password for verification with the reference password. Password acquisition means for acquiring de a is an authentication password from the client, associated with the user identification information acquired from the client, associated with the application identification information of the application corresponding to the information resource that has received the access request When there is a request for access to the information resource of the server, there is a password verification unit that verifies the stored reference password and the authentication password, and after the authentication image acquisition unit is activated, the authentication image verification unit A user authentication system comprising: a password acquisition unit and a control unit that executes user authentication using the password unit only when verification of authentication image information is successful. 6. The user authentication system according to claim 5 , wherein the control means provided in the server stores the number of times that the reference image information and the authentication image information have failed to be matched successively, and the reference image information and the A user authentication system characterized in that user authentication is not executed when the number of consecutive failures in verification with authentication image information exceeds a predetermined value. The user authentication system according to claim 5 or 6 , wherein the password acquisition means provided in the server transmits the authentication password from the client by transmitting a screen for inputting the authentication password to the client. A user authentication system which is a means for obtaining. In the user authentication system according to claim 5 or claim 6, wherein the authentication password is stored in advance in the client, the password verification means provided in the server obtains the stored the authentication password from the client A user authentication system characterized by being a means. A user authentication system according to any one of claims 8 from claim 5, wherein the authentication information acquiring means provided in said server, in addition to the reference picture information, except for the reference image information from the image information One image selected by the user from among a plurality of images displayed on the image display means of the client is transmitted to the client a plurality of images obtained by dividing the portion into a rectangle, a circle, or a shape not bound thereto. Is a means for acquiring the authentication image information as the authentication image information. A user authentication system according to any one of claims 9 claims 5, in the information storage means provided in the server, associated with one of the application-specific information, a plurality of the reference picture information And the order in which each of the reference image information is used for verification is stored, and the control means provided in the server is configured so that each time the authentication image acquisition means acquires the authentication image information, the authentication image verification means Verifies the authentication image information using the reference image information in the stored order, and acquires the password only when the verification using all the reference image information is successful in the stored order. And a user authentication system using the password means.

Images