JP7203707B2 - Re-authentication device, re-authentication method and re-authentication program - Google Patents

Description

The present invention relates to a re-authentication device, a re-authentication method and a re-authentication program.

2. Description of the Related Art Conventionally, there has been known a technique for providing various services via the Internet to users who have authenticated their accounts. Among such technologies, there is known a technology for recovering an account by using a question-and-answer pair that only the user knows when the user loses information used for account authentication, such as a password. . Also, there is known a technique of authenticating a user based on an answer to a question about the user's lifelog.

JP 2009-93273 A

However, the conventional technology described above leaves room for improving the convenience of account recovery.

For example, in the conventional technology described above, since it is necessary to give correct answers to questions regarding past lifelogs, account recovery cannot be performed if the user has forgotten past events. Also, if the user forgets the content of the secret question or the answer, the account cannot be recovered.

On the other hand, with recent advances in information processing technology, FIDO (Fast IDentity Online) technology has been proposed for authenticating a user without requiring the user to enter an account name, password, or the like. In such FIDO technology, if the user is requested to input various kinds of information in order to realize account recovery, there is a risk that improvement in usability will be impaired.

The present application has been made in view of the above, and an object thereof is to provide a re-authentication device, a re-authentication method, and a re-authentication program capable of improving the convenience of account recovery.

The re-authentication device according to the present application is a user who is different from the first user from the first terminal device used by the first user whose account is to be re-authenticated for receiving a predetermined web service. a determination unit for determining whether or not authentication information managed by a second user whose account has been authenticated has been acquired; and acquisition of authentication information managed by the second user from the first terminal device. a re-authentication unit that re-authenticates the account of the first user when it is determined that the first user has done so, and the determination unit detects information about the user without using information input by the user. Whether the authentication information is obtained from the first terminal device used by the first user whose account is to be re-authenticated in the web service that authenticates the user's account using the information detected by the detection device It is characterized by determining whether or not.

According to one aspect of an embodiment, the convenience of account recovery can be improved.

FIG. 1 is a diagram illustrating an example of account recovery processing according to the first embodiment. FIG. 2 is a diagram showing a configuration example of a re-authentication device according to the first embodiment. FIG. 3 is a diagram illustrating an example of an authentication database according to the first embodiment; 4 is a flowchart illustrating an example of a processing procedure of the re-authentication device according to the first embodiment; FIG. FIG. 5 is a diagram illustrating an example of account recovery processing according to the second embodiment. FIG. 6 is a diagram showing a configuration example of a re-authentication device according to the second embodiment. FIG. 7 is a diagram showing an example of an authentication database according to the second embodiment. FIG. 8 is a flow chart showing an example of the processing procedure of the re-authentication device according to the second embodiment. FIG. 9 is a diagram illustrating an example of a hardware configuration of a computer that executes programs.

Embodiments for implementing a re-authentication device, a re-authentication method, and a re-authentication program (hereinafter referred to as "embodiments") according to the present application will be described in detail below with reference to the drawings. Note that the re-authentication device, re-authentication method, and re-authentication program according to the present application are not limited to these embodiments. Also, in the following embodiments, the same parts are denoted by the same reference numerals, and overlapping descriptions are omitted.

(First embodiment)
[1. Account recovery process]
First, an example of account recovery processing realized by the re-authentication program according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of account recovery processing according to the first embodiment. In FIG. 1, when the account of the first user expires, a recovery process (an example of an account procedure) is performed to request the second user, who has a predetermined relationship (relationship) with the first user, to approve the recovery of the first user's account. ).

It should be noted that the state in which the account is invalidated is, for example, a state in which the corresponding account becomes temporarily unusable if, for example, the password is entered incorrectly more than a specified number of times when logging in to the service.

A first terminal device 10 and a second terminal device 20 shown in FIG. 1 are smart devices such as smartphones and tablet terminals, and are information processing devices used by different users. The above-described first terminal device 10 and second terminal device 20 are, for example, desktop/laptop PCs (Personal Computers), mobile phones (feature phones), stationary/portable game machines, AV (audio-visual) equipment, Information appliances or other electronic devices (gadgets) that can receive provision of information via the Internet may be used.

In the first embodiment, the user of the first terminal device 10 is a first user RU (Recovery User), and the user of the second terminal device 20 is a second user AU (Authentication User). A first user RU is a user whose account has been revoked. The second user AU is a user who is different from the first user RU and whose account has been authenticated. That is, the second terminal device 20 is an authenticated terminal. It is assumed that the first user RU and the second user AU have some trustworthy predetermined relationship. For example, in an organization such as a company, the first user RU may be an employee, and the second user AU may be the boss or colleague of the employee. Although illustration is omitted, a plurality of second user AUs and second terminal devices 20 may be provided. That is, a plurality of partners (a plurality of superiors/colleagues, a superior and a colleague, etc.) may be used as authenticators of the first user RU.

Further, the re-authentication device 100 shown in FIG. 1 is a server device that can be accessed from the first terminal device 10 and the second terminal device 20, and each user of the first terminal device 10 and the second terminal device 20 has an account. Provide a predetermined web service that requires login with. In the first embodiment, the re-authentication device 100 provides at least the first service as the web service. Further, the re-authentication device 100 manages the account of each user, and performs account recovery processing in response to a recovery request requesting account recovery.

As shown in FIG. 1, the re-authentication device 100 according to the first embodiment first receives a recovery request (an example of an execution request) for requesting account recovery from the first terminal device 10 of the first user RU whose account has been revoked. is received (step S11).

When the re-authentication device 100 receives the recovery request from the first terminal device 10 of the first user RU, the re-authentication device 100 requests the authentication of the authenticator (step S12). For example, the re-authentication device 100 estimates a second user AU having a predetermined relationship with the first user RU based on the usage history of a predetermined web service, and to request authentication of the second user AU itself.

When the second terminal device 20 of the second user AU receives the authentication request from the re-authentication device 100, it acquires information for FIDO (Fast IDentity Online) authentication (step S13). The information for FIDO authentication is, for example, biometric information (fingerprint, hand vein, iris, etc.) of the second user AU.

Then, the second terminal device 20 of the second user AU performs FIDO authentication using the acquired information for FIDO authentication (step S14). For example, in FIDO authentication, the second terminal device 20 of the second user AU unlocks the "secret key" stored in itself by biometric authentication, and as a result of the biometric authentication, it is possible to identify the second user AU as the principal. The obtained authentication result is signed with a private key and sent to the re-authentication device 100 .

The re-authentication device 100 authenticates the authenticator (step S15). For example, the re-authentication device 100 uses the “public key” stored in itself to identify the signed authentication result sent from the second terminal device 20 of the second user AU, and to authenticate the second terminal device 20 of

The re-authentication device 100 requests the second terminal device 20 of the second user AU to authenticate (approve) the requester together with the authentication information used to log in to the first service (step S16). . 4 shows authentication information used to log in to the first service provided by the re-authentication device 100. FIG. The requester is the first user RU who is the requester of the account recovery request.

The second terminal device 20 of the second user AU authenticates the requester (step S17). That is, the second terminal device 20 of the second user AU authenticates the first user RU who is the requester of the account recovery request. As for the authentication of the first user RU, for example, the second user AU may meet the first user RU directly to confirm the identity, or the second terminal device 20 of the second user AU may authenticate the first user RU himself. FIDO authentication may be performed by acquiring information for FIDO authentication. That is, the method of authenticating the requester may be any method as long as it can confirm that the second user AU or the second terminal device 20 is the first user RU.

The second terminal device 20 of the second user AU displays the authentication information notified from the re-authentication device 100 when the identity of the first user RU can be confirmed as a result of authentication of the requester (step S18). . The first terminal device 10 of the first user RU acquires authentication information from the second terminal device 20 of the second user AU (step S19). For example, the second terminal device 20 of the second user AU displays authentication information on the screen in the form of a two-dimensional barcode or the like. The first terminal device 10 of the first user RU acquires authentication information by reading a two-dimensional barcode or the like displayed on the screen of the second terminal device 20 of the second user AU. Alternatively, the second terminal device 20 of the second user AU uses near field communication (NFC) to send the first terminal device 10 of the first user RU with the authentication information encrypted. may provide. That is, the first terminal device 10 of the first user RU acquires authentication information from the second terminal device 20 of the second user AU at a short distance where the second user AU can visually recognize the first user RU.

The first terminal device 10 of the first user RU transmits the authentication information acquired from the second terminal device 20 of the second user AU to the re-authentication device 100 (step S20).

The re-authentication device 100 confirms the authentication information received from the first terminal device 10 of the first user RU (step S21).

The re-authentication device 100 notifies the confirmation result of the authentication information to the first terminal device 10 of the first user RU (step S22). For example, as a result of checking the authentication information, if the re-authentication device 100 determines that the authentication information is official (no problem), the re-authentication device 100 notifies the authentication information confirmation result (or as the authentication information confirmation result). ) to request authentication of the first user RU.

When the first terminal device 10 of the first user RU receives the confirmation result of the authentication information from the re-authentication device 100, it acquires the information for FIDO authentication (step S23). The information for FIDO authentication is, for example, biometric information of the first user RU.

Then, the first terminal device 10 of the first user RU performs FIDO authentication using the acquired information for FIDO authentication (step S24). For example, the first terminal device 10 of the first user RU unlocks the "private key" stored in itself by biometric authentication, and as a result of the biometric authentication, the second user AU can be identified as the person himself/herself. It is signed with a private key and sent to the re-authentication device 100 .

The re-authentication device 100 re-authenticates the requester (step S25). For example, the re-authentication device 100 uses the “public key” stored in itself to identify the signed authentication result sent from the first terminal device 10 of the first user RU, and to re-authenticate the first terminal device 10 of

The re-authentication device 100 notifies the first terminal device 10 of the first user RU of the re-authentication result (step S26). Accordingly, the re-authentication device 100 permits the account recovery request from the first terminal device 10 of the first user RU, and recovers the account.

[2. Configuration of re-authentication device]
Next, the configuration of the re-authentication device 100 according to the first embodiment will be described using FIG. FIG. 2 is a diagram showing a configuration example of the re-authentication device 100 according to the first embodiment. As shown in FIG. 2 , the re-authentication device 100 has a communication section 110 , a storage section 120 and a control section 130 . Note that the re-authentication device 100 includes an input unit (for example, keyboard, mouse, etc.) that receives various operations from an administrator or the like who manages the re-authentication device 100, and a display unit (for example, a liquid crystal display, etc.) for displaying various information. ) and the like. Further, the re-authentication device 100 may receive various operations via the network N from a terminal device used by an administrator or the like.

(Regarding communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card) or the like. The communication unit 110 is connected to the network N by wire or wirelessly, and transmits and receives information to and from the first terminal device 10 and the second terminal device 20 via the network N.

(Regarding storage unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory device such as a RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or an optical disk. Storage unit 120 has authentication database 121 .

(Regarding the authentication database 121)
The authentication database 121 stores information regarding the first service. Here, FIG. 3 shows an example of the authentication database 121 according to the first embodiment. FIG. 3 is a diagram showing an example of the authentication database 121 according to the first embodiment. In the example shown in FIG. 3, the authentication database 121 includes "account ID", "registered device ID", "registered user", "user ID", "authentication information", "certifier ID", "first service action history”. Also, the first service action history has sub-items such as "usage log ID", "action history", "action date and time", and "location information".

"Account ID" indicates identification information for identifying an account in the first service. "Registered device ID" indicates identification information for identifying a device registered as a device used in the first service. "Registered user" indicates a user who holds an account. In the first embodiment, identification information such as an account ID is assumed to match reference numerals used in the description. For example, a device with a registered device ID of “20” indicates the first terminal device 10 .

"User ID" is identification information used to identify a user who uses an account. For example, the user ID is composed of any character string selected by the user when the user creates an account in the first service. As for the user ID, for example, an e-mail address or the like registered in the first terminal device 10, which is a registered device, may be used.

"Authentication information" indicates authentication information used to log in to the first service. In the example shown in FIG. 3, the authentication information is assumed to be a password composed of a character string arbitrarily set by the first user RU. For example, the user logs into the first service by entering a user ID and password pair associated with the account.

“Authenticator ID” is identification information used to identify an authenticator who authenticates the user. In the example shown in FIG. 3, the authenticator ID is assumed to be the account ID of the second user AU who authenticates the first user RU.

"First service action history" indicates the action history in the first service. "Usage log ID" indicates identification information for identifying a log when the user logs in to use the first service. In the example shown in FIG. 3, it is assumed that a usage log ID is given for each session from when the user logs in to the first service until he logs out.

"Action history" indicates the action history of the user. Although not shown in FIG. 3, the items of the action history include, for example, actions of the user clicking on articles in the portal site, actions of purchasing products, and searching by inputting queries. Specific actions, such as actions, may be stored.

“Action date and time” indicates the date and time corresponding to the action history of the user. Although the example shown in FIG. 3 indicates that the action date and time is stored every 10 minutes, the action date and time may be stored in smaller units (1 minute, 1 second, etc.). "Location information" indicates location information corresponding to the action history. For example, the re-authentication device 100 continuously acquires position information detected by the first terminal device 10 (smartphone) when the user logs into the first service or while the user continues to log in, are stored in the authentication database 121 in association with each other. Note that FIG. 3 shows an example in which conceptual information such as "G011" is stored in the item of location information. , information from which position information can be estimated (for example, the IP address of the first terminal device 10, etc.), etc. are stored.

That is, in the example of FIG. 3, the first terminal device 10, which is the device identified by the registered device ID "20", is registered in the account A01 identified by the account ID "A01", and the registered user is " U01". Also, the user ID corresponding to the account A01 is "XXXX", the authentication information is "YYYY", and the authenticator ID is "A02". In addition, logs identified by usage log IDs “B01” and “B02” are accumulated in the account A01. 12:00", and the location information of the first terminal device 10 at that time is "G011".

(Regarding the control unit 130)
The control unit 130 is, for example, a controller, and executes various programs (first embodiment (corresponding to an example of a re-authentication program according to ) is executed using the RAM as a work area. Also, the control unit 130 is a controller, and is implemented by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

As shown in FIG. 2, the control unit 130 includes an estimation unit 131, a provision unit 132, an acquisition unit 133, a determination unit 134, and a re-authentication unit 135. Realize or perform an action. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 2, and may be another configuration as long as it performs the information processing described later. Moreover, the connection relationship between the processing units of the control unit 130 is not limited to the connection relationship shown in FIG. 2, and may be another connection relationship.

The estimation unit 131 estimates a second user AU having a predetermined relationship with the first user RU based on the first service usage history. The relationship between the first user RU and the second user AU can be estimated from the usage status of the first service. For example, if the first user RU and the second user AU frequently contact each other via the first service/exchange some data communication, the estimation unit 131 It can be inferred to have In addition, the estimation unit 131 can estimate whether the user often acts together/usually close to each other based on the location information when the first service is used. Also, if an account recovery request is being made at a place where the first user RU and the second user AU are often together (company, school, etc.), the second user AU may It is conjectured that it could be the authenticator.

When receiving a request for account re-authentication from the first terminal device 10, the providing unit 132 provides the second terminal device 20 used by the second user AU with authentication used for logging in to the first service. provide information for

The acquiring unit 133 acquires from the first terminal device 10 authentication information that the first terminal device 10 has acquired from another terminal device. For example, the acquisition unit 133 acquires from the first terminal device 10 the authentication information that the first terminal device 10 has acquired from the second terminal device 20 .

The determination unit 134 determines whether or not the authentication information provided to the second terminal device 20 from the first terminal device 10 has been acquired. Specifically, the determination unit 134 receives a request from the first terminal device 10 used by the first user RU whose account is to be re-authenticated to receive a predetermined web service. Then, it is determined whether or not the authentication information managed by the second user AU whose account has been authenticated has been acquired.

In the first embodiment, the determination unit 134 determines whether or not the authentication information managed by the second user AU having a predetermined relationship with the first user RU has been acquired. The second user AU having a predetermined relationship with the first user RU may be, for example, the second user AU estimated by the estimation unit 131 to have a predetermined relationship with the first user RU. A second user AU registered in advance as a user having a predetermined relationship with the RU may be used. That is, the determination unit 134 may determine whether or not the authentication information managed by the second user AU estimated to have a predetermined relationship with the first user RU has been obtained. It may be determined whether or not authentication information managed by a second user AU who is registered in advance as a user having a predetermined relationship with the user has been acquired.

From another point of view, the determination unit 134 performs account re-authentication in a web service that authenticates a user's account using information detected by a detection device that detects information about the user without using information input by the user. It can also be said that it is determined whether or not authentication information has been acquired from the first terminal device 10 used by the first user RU to be authenticated.

The re-authentication unit 135 re-authenticates the account of the first user RU when it is determined that the authentication information managed by the second user AU has been acquired from the first terminal device 10 .

[3. Processing procedure]
Next, with reference to FIG. 4, a processing procedure regarding the re-authentication device 100 according to the first embodiment will be described. FIG. 4 is a flow chart showing an example of the processing procedure of the re-authentication device 100 according to the first embodiment.

As shown in FIG. 4, the re-authentication device 100 determines whether a re-authentication request has been received (step S101). For example, when receiving a recovery request requesting account recovery from the first terminal device 10 of the first user RU whose account has been revoked via the communication unit 110, the control unit 130 determines that the re-authentication request has been received. do. If the re-authentication device 100 has not determined that the re-authentication request has been received (No in step S101), it continues the current process until it determines that the re-authentication request has been received (returns to step S101).

When the re-authentication device 100 determines that the re-authentication request has been received (Yes in step S101), it transmits authentication information to the requester and the corresponding authenticator (step S102). For example, when receiving a re-authentication request from the first terminal device 10 of the first user RU, the estimating unit 131 receives a second user RU having a predetermined relationship with the first user RU based on the usage history of a predetermined web service. Estimate the user AU. The providing unit 132 requests authentication of the second user AU itself to the second terminal device 20 of the second user AU, and provides authentication information used for logging in to the first service.

The re-authentication device 100 determines whether or not the authentication information has been received from the requester (step S103). For example, the acquisition unit 133 acquires the authentication information that the first terminal device 10 has acquired from the second terminal device 20 from the first terminal device 10 via the communication unit 110 . When receiving the authentication information from the first terminal device 10 of the first user RU, the obtaining unit 133 determines that the authentication information has been received from the requester. If the re-authentication device 100 has not determined that the authentication information has been received from the requester (No in step S103), the re-authentication device 100 continues the current process until it determines that the authentication information has been received from the requester (returns to step S103). ).

If the re-authentication device 100 determines that the authentication information has been received from the requester (Yes in step S103), the re-authentication device 100 re-authenticates the requester (step S104). For example, when it is determined that the first terminal device 10 has received the authentication information acquired from the second terminal device 20, the re-authentication unit 135 re-authenticates the account of the first user RU.

(Modification)
The recovery process by the re-authentication device 100 described above may be implemented in various different forms other than the above embodiment. Therefore, a modified example of the re-authentication device 100 and the recovery process will be described below.

[4. Modification 1: Use of Context Information]
First, although illustration is omitted, as Modified Example 1, a mode in which context information is used together with authentication information will be described. The context information is information indicating the situation, environment, etc., in which the terminal device is placed. Context information includes, for example, time, location, temperature, humidity, and the like. The context information may be device information and configuration information of the terminal device, wireless LAN (Local Area Network) authentication information, SSID (Service Set Identifier), and the like. If the same or similar context information is obtained from a plurality of terminal devices, it can be found that they exist at the same place or in the same vicinity.

The acquisition unit 133 acquires first context information indicating the context of one terminal device when the first terminal device 10 acquires authentication information from another terminal device, and from the second terminal device 20, the second terminal device 20 Second context information indicating the context of the second terminal device 20 when the authentication information is provided to another terminal device is further acquired.

For example, the acquisition unit 133 acquires, as the first context information, information indicating the "date and time" when the first terminal device 10 acquires the authentication information from the other terminal device, and acquires the second terminal device 10 as the second context information. Information indicating the date and time when the device 20 provided authentication information to another terminal device is acquired. As a result, the re-authentication device 100 can match the time when the first terminal device 10 of the first user RU acquired the authentication information with the time when the second terminal device 20 of the second user AU provided the authentication information. Or come to know that it is near. When the second terminal device 20 provides authentication information using a two-dimensional barcode or near field communication (NFC), the first terminal device 10 of the first user RU and the second terminal device 10 of the second user AU It can be seen that the terminal device 20 exists in the same place or in the vicinity. As a result, the credibility of authentication is further improved.

Alternatively, the acquiring unit 133 acquires, as the first context information, information indicating the “position” where the first terminal device 10 acquires the authentication information from the other terminal device, and acquires, as the second context information, the second terminal device Acquire information indicating the location where the device 20 provided the authentication information to the other terminal device. This allows the re-authentication device 100 to know that the first terminal device 10 of the first user RU and the second terminal device 20 of the second user AU are in the same place or in the vicinity. As a result, the credibility of authentication is further improved.

The determination unit 134 acquires authentication information provided to the second terminal device 20 from the first terminal device 10, and determines whether or not the first context information and the second context information correspond to each other. do.

When the re-authentication unit 135 acquires the authentication information provided to the second terminal device 20 from the first terminal device 10 and it is determined that the first context information and the second context information correspond to each other re-authenticates the account of the first user RU.

[5. Modification 2: Use of Plural Authentication Information]
Also, although illustration is omitted, as a modified example 2, a form in which a plurality of pieces of authentication information are used will be described.

The determination unit 134 acquires, from the first terminal device 10, a plurality of pieces of authentication information individually managed by a plurality of second users AU who are different users from the first user RU and whose accounts have already been authenticated. Determine whether or not At this time, the determination unit 134 receives from the first terminal device 10 a plurality of pieces of authentication information individually managed by a plurality of second users AU who are users different from the first user RU and whose accounts have been authenticated. may be determined in a "predetermined order".

The re-authentication unit 135 re-authenticates the account of the first user RU when it is determined that a plurality of pieces of authentication information have been acquired from the first terminal device 10 . At this time, the re-authentication unit 135 re-authenticates the account of the first user RU when it is determined that a plurality of pieces of authentication information have been obtained from the first terminal device 10 in a "predetermined order". good too.

(Second embodiment)
Next, a second embodiment will be described. In the above-described first embodiment, when the account of the first user is invalidated, the recovery processing of requesting the second user who has a predetermined relationship (relationship) with the first user to approve the recovery of the account of the first user. I explained an example. In the second embodiment, an example of recovery processing in which the first user's account is re-authenticated using the shared terminal of the first user and the second user when the first user's terminal device and when purchasing a new terminal will be described. .

[6. Account recovery process]
First, an example of account recovery processing realized by a re-authentication program according to the second embodiment will be described with reference to FIG. FIG. 5 is a diagram illustrating an example of account recovery processing according to the second embodiment. In FIG. 5, when the first user loses the terminal or purchases a new terminal, the recovery process (an example of the account procedure) re-authenticates the account of the first user using the shared terminal of the first user and the second user ).

The first terminal device 10, the second terminal device 20, the third terminal device 30, and the fourth terminal device 40 shown in FIG. 20. In the second embodiment, users of the first terminal device 10 and the third terminal device 30 are referred to as first user RUs. A user of the second terminal device 20 is assumed to be a second user AU. The fourth terminal device 40 is a shared device that can be used by both the first user RU and the second user AU.

A re-authentication device 100a shown in FIG. 5 corresponds to the re-authentication device 100 described in the first embodiment, and is a first terminal device 10, a second terminal device 20, a third terminal device 30 and a fourth terminal device 40. It is a server device that can be accessed from, and provides each user of the first terminal device 10, the second terminal device 20, the third terminal device 30, and the fourth terminal device 40 with a predetermined web service that requires login with an account do. In the second embodiment, the re-authentication device 100a provides at least the first service as the web service. In addition, the re-authentication device 100a manages the account of each user, and performs account recovery processing in response to a recovery request requesting account recovery.

As shown in FIG. 5, first, the first terminal device 10 of the first user RU sends authentication information for authenticating the requester and authentication information for authenticating the other party to the fourth terminal device 40. Other authentication information is registered (step S1).

In addition, the second terminal device 20 of the second user AU registers, in the fourth terminal device 40, authentication information for authenticating an authenticator and other person authentication information for authenticating others. (step S2).

The fourth terminal device 40 registers each user's authentication information and other person's authentication information in the re-authentication device 100a (step S3). That is, the fourth terminal device 40 receives authentication information and other authentication information registered from each of the first terminal device 10 of the first user RU and the second terminal device 20 of the second user AU, and re-authenticates them. 100a.

When the first user RU purchases a new third terminal device 30 after losing the first terminal device 10, the first user RU operates the third terminal device 30 to authenticate the requester to the fourth terminal device 40. (step S4). As a result, the fourth terminal device 40 authenticates the first user RU who is the requester of the account recovery request. Note that the loss of the first terminal device 10 includes failure, disposal, and the like of the first terminal device 10 .

As a result of the authentication of the first user RU who is the requester, the fourth terminal device 40 provides the third terminal device 30 of the first user RU with the other authentication information of the authenticator of the first user RU ( step S5).

The third terminal device 30 of the first user RU transmits the requester's authentication information and the authenticator's other authentication information to the re-authentication device 100a (step S6).

The re-authentication device 100a re-authenticates the requester using the authentication information and the other person's authentication information (step S7).

The re-authentication device 100a re-authenticates the requester to the third terminal device 30 of the first user RU (step S8). Thereby, the re-authentication device 100 approves the third terminal device 30 of the first user RU and recovers the account. Note that the re-authentication device 100a may acquire a plurality of other authentication information and perform account recovery when each of the acquired other authentication information corresponds to the authentication information.

[7. Configuration of re-authentication device]
Next, the configuration of the re-authentication device 100a according to the first embodiment will be described using FIG. FIG. 6 is a diagram showing a configuration example of the re-authentication device 100a according to the first embodiment. As shown in FIG. 6, the re-authentication device 100a has a communication unit 110, a storage unit 120, and a control unit . The re-authentication device 100a has an input unit (for example, a keyboard, a mouse, etc.) that receives various operations from an administrator or the like who uses the re-authentication device 100a, and a display unit (for example, a liquid crystal display, etc.) for displaying various information. ).

The communication unit 110, the storage unit 120, and the control unit 130 are basically as described in the first embodiment. Note that the storage unit 120 has an authentication database 121a instead of the authentication database 121 described in the first embodiment.

(Regarding the authentication database 121a)
The authentication database 121a stores information regarding the first service. Here, FIG. 7 shows an example of the authentication database 121a according to the second embodiment. FIG. 7 is a diagram showing an example of the authentication database 121a according to the second embodiment. In the example shown in FIG. 7, the authentication database 121a includes "account ID", "registered device ID", "registered user", "user ID", "authentication information", "authenticator ID", "other authentication information" and "first service action history". Also, the first service action history has sub-items such as "usage log ID", "action history", "action date and time", and "location information".

Among the items of the authentication database 121a, "account ID", "registered device ID", "registered user", "user ID", "authentication information", "authenticator ID" and "other than "other authentication information"" The "first service behavior history" is as described in the first embodiment.

"Others authentication information" is identification information used to identify others. More specifically, the other person's authentication information is information for performing account recovery of the user indicated by the associated user ID, and is obtained by a user different from the user indicated by the associated user ID. , is information registered in a shared terminal shared by each user. If there are three or more users, the authentication database 121a may register other authentication information of a plurality of users in association with one user ID. In the example shown in FIG. 7, it is assumed that the other person's authentication information is the other person's account ID. In the second embodiment, the control unit 130 registers, in the authentication database 121a, the other person's authentication information registered respectively from the first terminal device 10 of the first user RU and the second terminal device 20 of the second user AU. .

(Regarding the control unit 130)
As shown in FIG. 6, the control unit 130 includes an estimation unit 131, a provision unit 132, an acquisition unit 133, a determination unit 134a, and a re-authentication unit 135. Realize or perform an action. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 6, and may be another configuration as long as it performs information processing described later. Moreover, the connection relationship between the processing units of the control unit 130 is not limited to the connection relationship shown in FIG. 6, and may be another connection relationship.

The estimation unit 131, the provision unit 132, the acquisition unit 133, and the re-authentication unit 135 are basically as described in the first embodiment.

The determination unit 134a determines whether or not authentication information managed by the second user AU and managed separately from information for the second user AU to receive account authentication has been acquired. In the second embodiment, the determination unit 134a determines whether or not the second user AU has obtained other authentication information managed separately from authentication information for receiving account authentication.

For example, the determining unit 134a determines first authentication information managed by the first user RU and used for re-authentication of the account by the second user AU, and authentication information managed by the second user AU. and whether or not the second authentication information acquired by the first terminal device 10 has been acquired from a predetermined terminal device that manages the second authentication information for the first user RU to re-authenticate the account judge.

[8. Processing procedure]
Next, with reference to FIG. 8, a processing procedure regarding the re-authentication device 100a according to the second embodiment will be described. FIG. 8 is a flow chart showing an example of the processing procedure of the re-authentication device 100a according to the second embodiment.

As shown in FIG. 8, the re-authentication device 100a determines whether or not authentication information and other-person authentication information have been received (step S201). For example, the control unit 130 receives, via the communication unit 110, the authentication information and the other person authentication information from the first terminal device 10 of the first user RU and the second terminal device 20 of the second user AU. .

When the re-authentication device 100a determines that the authentication information and the other person's authentication information have been received (Yes in step S201), the re-authentication device 100a associates the authentication information with the other person's authentication information and registers them in the authentication database 121a (step S202). ). If the re-authentication device 100a has not determined that the authentication information and the other person's authentication information have been received (No in step S201), the re-authentication device 100a does not perform the process (shifts from step S201 to step S203). Note that it is sufficient to register the same set of authentication information and other person's authentication information in the authentication database 121a once (only for the first time).

The re-authentication device 100a determines whether or not the authentication information and the other authentication information have been received from the requester (step S203). If the re-authentication device 100a has not determined that the authentication information has been received from the requester (No in step S203), the re-authentication device 100a continues the current process until it determines that the authentication information has been received from the requester (returns to step S203). ).

When the re-authentication device 100a determines that the authentication information and the other authentication information have been received from the requester (Yes in step S203), the re-authentication device 100a specifies the other authentication information of the authenticator corresponding to the requester (step S204). .

The re-authentication device 100a determines whether or not the specified other-person authentication information corresponds to the received other-person authentication information, and whether or not the requester's authentication information corresponds to the registered authentication information (step S205).

If the re-authentication device 100a determines that the specified other-person authentication information corresponds to the received other-person authentication information and that the requester's authentication information corresponds to the registered authentication information (Yes in step S205). ), re-authenticate the requester (step S206).

If the re-authentication device 100a determines that the specified other-person authentication information corresponds to the received other-person authentication information and that the requester's authentication information does not correspond to the registered authentication information (step S205). No), the requester is not re-authenticated (step S207).

[9. Hardware configuration]
The first terminal device 10, the second terminal device 20, the third terminal device 30, the fourth terminal device 40, the re-authentication device 100, and the re-authentication device 100a in the embodiment described above each have a configuration as shown in FIG. It is implemented by computer 200 executing a program.

FIG. 9 is a diagram illustrating an example of a hardware configuration of a computer that executes programs. Computer 200 includes CPU (Central Processing Unit) 201, RAM 202 (Random Access Memory), ROM (Read Only Memory) 203, HDD (Hard Disk Drive) 204, communication interface (I/F) 205, input/output interface (I/ F) 206 and a media interface (I/F) 207 .

The CPU 201 operates based on programs stored in the ROM 203 or HDD 204 and controls each unit. The ROM 203 stores a boot program executed by the CPU 201 when the computer 200 is started, a program depending on the hardware of the computer 200, and the like.

The HDD 204 stores data and the like used by programs executed by the CPU 201 . The communication interface 205 corresponds to the communication unit 110, receives data from other devices via the network N, sends the data to the CPU 201, and transmits data generated by the CPU 201 to other devices via the network N.

The CPU 201 controls output devices such as a display and a printer, and input devices such as a keyboard and a mouse, through an input/output interface 206 . The CPU 201 acquires data from the input device via the input/output interface 206 . The CPU 201 also outputs the generated data to an output device via the input/output interface 206 .

The media interface 207 reads programs or data stored in the recording medium 208 and provides them to the CPU 201 via the RAM 202 . The CPU 201 loads the program from the recording medium 208 onto the RAM 202 via the media interface 207 and executes the loaded program. The recording medium 208 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable disc), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. etc.

When the computer 200 functions as the re-authentication device 100, the CPU 201 of the computer 200 executes a program loaded on the RAM 202 to perform and each function of the re-authentication unit 135 is realized. Note that the estimation unit 131, the provision unit 132, the acquisition unit 133, the determination unit 134, and the re-authentication unit 135 are partly or wholly hardware such as ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). may be configured.

Further, when the computer 200 functions as the re-authentication device 100a, the CPU 201 of the computer 200 executes the program loaded on the RAM 202 to perform the estimation unit 131, the provision unit 132, the acquisition unit 133, the determination Each function of the unit 134a and the re-authentication unit 135 is implemented. Note that the estimation unit 131, the provision unit 132, the acquisition unit 133, the determination unit 134a, and the re-authentication unit 135 may be configured partially or wholly by hardware such as ASIC or FPGA.

Further, when the computer 200 functions as each of the first terminal device 10, the second terminal device 20, the third terminal device 30 and the fourth terminal device 40, the CPU 301 of the computer 200 executes the program loaded on the RAM 302. By doing so, each function of each of the first terminal device 10, the second terminal device 20, the third terminal device 30 and the fourth terminal device 40 is realized.

The CPU 201 of the computer 200 reads and executes the re-authentication program from the recording medium 208, but as another example, these programs may be acquired via the network N from another device.

HDD 204 corresponds to storage unit 120 and stores data similar to storage unit 120 . Also, instead of the HDD 204, a storage device such as a RAM (Random Access Memory), a semiconductor memory device such as a flash memory, an SSD (Solid State Drive), or an optical disk may be used.

[10. effect〕
As described above, the re-authentication device 100 according to the embodiment has the determination unit 134 and the re-authentication unit 135 . The determination unit 134 determines whether the first terminal device 10 used by the first user (first user RU) whose account is to be re-authenticated for receiving a predetermined web service has a different use from the first user. It is determined whether or not authentication information managed by a second user (second user AU) whose account has been authenticated has been acquired. The re-authentication unit 135 re-authenticates the account of the first user when it is determined that the authentication information managed by the second user has been acquired from the first terminal device 10 . As a result, it is possible to realize a server that performs recovery using trust, and improve the convenience of account recovery.

The determination unit 134 determines whether authentication information managed by a second user having a predetermined relationship with the first user has been acquired. As a result, it is possible to perform recovery taking into account the relationship between users.

Moreover, the re-authentication device 100 according to the embodiment further has an estimation unit 131 . The estimating unit 131 estimates a second user having a predetermined relationship with the first user based on the usage history of the predetermined web service. The determination unit 134 determines whether authentication information managed by a second user who is presumed to have a predetermined relationship with the first user has been acquired. As a result, it is possible to estimate the relationship between users from the web service usage history.

The determination unit 134 determines whether authentication information managed by a second user registered in advance as a user having a predetermined relationship with the first user has been acquired. Thereby, it is possible to correspond to pre-registration of users having a predetermined relationship.

The determination unit 134 uses information detected by a detection device that detects information about the user without using information input by the user to authenticate the account of the user in a web service. It is determined whether or not the authentication information has been acquired from the first terminal device 10 used by the first user. This makes it possible to confirm that the authentication information has been acquired from the first terminal device 10 after re-authentication by FIDO authentication, for example.

Further, the re-authentication device 100 according to the embodiment further has a providing unit 132 and an acquiring unit 133 . When receiving a request for re-authentication of the account from the first terminal device 10, the providing unit 132 provides the authentication information to the second terminal device 20 used by the second user. The acquisition unit 133 acquires from the first terminal device 10 the authentication information that the first terminal device 10 has acquired from another terminal device. The determination unit 134 determines whether or not the authentication information provided to the second terminal device 20 has been acquired from the first terminal device 10 . This makes it possible to specifically implement account recovery processing.

The acquisition unit 133 acquires the first context information indicating the context of the one terminal device when the first terminal device 10 acquires the authentication information from the other terminal device, and the second terminal device 20 from the second terminal device. and second context information indicating the context of the second terminal device 20 when the second terminal device 20 provides the authentication information to another terminal device. The determination unit 134 acquires the authentication information provided to the second terminal device 20 from the first terminal device 10, and determines whether the first context information and the second context information correspond to each other. determine whether or not The re-authentication unit 135 acquires the authentication information provided to the second terminal device 20 from the first terminal device 10, and if the first context information and the second context information correspond to each other, If so, re-authenticate the first user's account. As a result, account recovery processing can be performed in consideration of the commonality of contexts.

The acquisition unit 133 acquires information indicating the date and time when the first terminal device 10 acquired the authentication information from another terminal device as the first context information, and acquires the second terminal device 10 as the second context information. Information indicating the date and time when the device 20 provided the authentication information to another terminal device is acquired. As a result, account recovery processing can be performed in consideration of time as a context.

Acquisition unit 133 acquires, as the first context information, information indicating the position where the first terminal device 10 acquired the authentication information from another terminal device, and acquires the second terminal device 10 as the second context information. Information indicating the location where the device 20 provided the authentication information to the other terminal device is acquired. As a result, the account recovery process can be performed considering the location as a context.

The determination unit 134 determines whether authentication information managed by the second user and managed separately from information for the second user to be authenticated for the account has been acquired. do. As a result, information for authenticating others can be registered separately from information for authenticating oneself, and account recovery processing can be performed using, for example, a shared device.

The determination unit 134 determines the first authentication information managed by the first user and for the second user to re-authenticate the account, and the authentication information managed by the second user. second authentication information acquired by the first terminal device 10 from a predetermined terminal device that manages the second authentication information for the first user to re-authenticate the account. determine whether or not This makes it possible to perform account recovery processing using, for example, a shared device.

The determination unit 134 retrieves, from the first terminal device 10, a plurality of authentication information individually managed by a plurality of second users who are different from the first user and whose accounts have been authenticated. is acquired. The re-authentication unit 135 re-authenticates the account of the first user when it is determined that the plurality of pieces of authentication information have been acquired from the first terminal device 10 . This enables authentication by a plurality of authenticators.

The determination unit 134 retrieves, from the first terminal device 10, a plurality of authentication information individually managed by a plurality of second users who are different from the first user and whose accounts have been authenticated. are acquired in a predetermined order. The re-authentication unit 135 re-authenticates the account of the first user when it is determined that the plurality of pieces of authentication information have been obtained from the first terminal device 10 in the predetermined order. Thereby, when performing authentication by a plurality of authenticators, it is possible to perform authentication by considering the order of authentication information.

As described above, some of the embodiments of the present application have been described in detail based on the drawings. It is possible to carry out the invention in other forms with modifications.

Also, the "section, module, unit" described above can be read as "means" or "circuit". For example, the estimating unit can be read as estimating means or an estimating circuit.

10 first terminal device 20 second terminal device 30 third terminal device 40 fourth terminal device 100, 100a re-authentication device 110 communication unit 120 storage unit 121, 121a authentication database 130 control unit 131 estimation unit 132 provision unit 133 acquisition unit 134 , 134a determination unit 135 re-authentication unit

Claims (15)

From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination unit that determines whether authentication information managed by a user has been acquired;
a re-authentication unit that re-authenticates the account of the first user when it is determined that the authentication information managed by the second user has been acquired from the first terminal device ,
The determination unit is a target of account re-authentication in a web service that authenticates the user's account using information detected by a detection device that detects information about the user without using information entered by the user. A re- authentication device that determines whether or not the authentication information has been acquired from the first terminal device used by the first user. From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination unit that determines whether authentication information managed by a user has been acquired;
a re-authentication unit that re-authenticates the account of the first user when it is determined that the authentication information managed by the second user has been acquired from the first terminal device;
a providing unit that provides the authentication information to a second terminal device used by the second user when a request for re-authentication of the account is received from the first terminal device;
an acquisition unit configured to acquire, from the first terminal device, authentication information acquired by the first terminal device from another terminal device;
The re- authentication device, wherein the determination unit determines whether or not the authentication information provided to the second terminal device is acquired from the first terminal device. The acquisition unit acquires first context information indicating a context of the first terminal device when the first terminal device acquires the authentication information from another terminal device, and the second terminal device from the second terminal device. further acquiring second context information indicating the context of the second terminal device when the terminal device provides the authentication information to another terminal device;
The determination unit acquires authentication information provided from the first terminal device to the second terminal device, and determines whether the first context information and the second context information correspond to each other. to determine
The re-authentication unit acquires authentication information provided from the first terminal device to the second terminal device, and is determined to correspond to the first context information and the second context information. 3. The re-authentication device according to claim 2 , wherein the account of the first user is re-authenticated if The acquisition unit acquires, as first context information, information indicating a date and time when the first terminal device acquired the authentication information from another terminal device, and acquires, as the second context information, the second terminal device. 4. The re-authentication device according to claim 3 , wherein the device acquires information indicating a date and time when the authentication information was provided to another terminal device. The acquisition unit acquires, as first context information, information indicating a position where the first terminal device acquired the authentication information from another terminal device, and acquires, as the second context information, the second terminal device. 4. The re-authentication device according to claim 3 , wherein information indicating a position where said authentication information is provided to another terminal device is obtained. From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination unit that determines whether authentication information managed by a user has been acquired;
a re-authentication unit for re-authenticating the account of the first user when it is determined that the authentication information managed by the second user has been obtained from the first terminal device;
has
The determination unit includes first authentication information managed by the first user and used by the second user to re-authenticate the account, and authentication managed by the second user. second authentication information obtained by the first terminal device from a predetermined terminal device that manages the second authentication information for the first user to re-authenticate the account. A re- authentication device characterized by determining whether or not. Any one of claims 1 to 6 , wherein the determination unit determines whether authentication information managed by a second user having a predetermined relationship with the first user has been acquired. 1. A re-authentication device according to claim 1. an estimating unit that estimates a second user having a predetermined relationship with the first user based on the usage history of the predetermined web service;
8. The determining unit determines whether authentication information managed by a second user who is presumed to have a predetermined relationship with the first user has been acquired. recertification device. 3. The determining unit determines whether authentication information managed by a second user registered in advance as a user having a predetermined relationship with the first user has been obtained. 8. The re-authentication device according to 7 . A re-authentication method executed by a re-authentication device,
From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination step of determining whether or not the authentication information managed by the user has been acquired;
a re-authentication step of re-authenticating the account of the first user when it is determined that the authentication information managed by the second user has been acquired from the first terminal device ,
In the determination step, the target of account re-authentication in a web service that authenticates the user's account using information detected by a detection device that detects information about the user without using information entered by the user Determining whether the authentication information has been acquired from the first terminal device used by the first user
A re-authentication method characterized by: From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination procedure for determining whether or not authentication information managed by a user has been obtained;
When it is determined that the authentication information managed by the second user has been acquired from the first terminal device, causing a computer to execute a re-authentication procedure for re-authenticating the account of the first user ,
In the determination procedure, the target of account re-authentication in a web service that authenticates the user's account using information detected by a detection device that detects information about the user without using information entered by the user Determining whether the authentication information has been acquired from the first terminal device used by the first user
A recertification program characterized by: A re-authentication method executed by a re-authentication device,
From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination step of determining whether or not the authentication information managed by the user has been acquired;
a re-authentication step of re-authenticating the account of the first user when it is determined that the authentication information managed by the second user has been acquired from the first terminal device;
a providing step of providing the authentication information to a second terminal device used by the second user when a request for re-authentication of the account is received from the first terminal device;
an acquisition step of acquiring from the first terminal device authentication information acquired by the first terminal device from another terminal device;
including
In the determination step, it is determined whether or not authentication information provided to the second terminal device has been acquired from the first terminal device.
A re-authentication method characterized by: From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination procedure for determining whether or not authentication information managed by a user has been obtained;
a re-authentication procedure for re-authenticating the account of the first user when it is determined that the authentication information managed by the second user has been acquired from the first terminal device;
a provision procedure for providing the authentication information to a second terminal device used by the second user when a request for re-authentication of the account is received from the first terminal device;
an acquisition procedure for acquiring, from the first terminal device, authentication information acquired by the first terminal device from another terminal device;
on the computer, and
In the determination step, it is determined whether or not the authentication information provided to the second terminal device is acquired from the first terminal device.
A recertification program characterized by: A re-authentication method executed by a re-authentication device,
From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination step of determining whether or not the authentication information managed by the user has been acquired;
a re-authentication step of re-authenticating the account of the first user when it is determined that the authentication information managed by the second user has been obtained from the first terminal device;
including
In the determination step, first authentication information managed by the first user and used for re-authentication of the account by the second user, and authentication managed by the second user second authentication information obtained by the first terminal device from a predetermined terminal device that manages the second authentication information for the first user to re-authenticate the account. determine whether
A re-authentication method characterized by: From the first terminal device used by the first user whose account is to be re-authenticated to receive a predetermined web service, a user who is different from the first user and whose account has been authenticated 2 a determination procedure for determining whether or not authentication information managed by a user has been obtained;
a re-authentication procedure for re-authenticating the account of the first user when it is determined that the authentication information managed by the second user has been acquired from the first terminal device;
on the computer, and
In the determination procedure, first authentication information managed by the first user and used for re-authentication of the account by the second user, and authentication managed by the second user second authentication information obtained by the first terminal device from a predetermined terminal device that manages the second authentication information for the first user to re-authenticate the account. determine whether
A recertification program characterized by:

Images