WO2013118302A1

WO2013118302A1 - Authentication management system, authentication management method, and authentication management program

Info

Publication number: WO2013118302A1
Application number: PCT/JP2012/053179
Authority: WO
Inventors: 祐寛井上; 仁國米
Original assignee: 株式会社クレスコ; 株式会社ニーモニックセキュリティ
Priority date: 2012-02-10
Filing date: 2012-02-10
Publication date: 2013-08-15

Abstract

An authentication management system, an authentication management method, and an authentication management program according to the present invention allow a user to view a one-time password by selecting an identification image that the user had registered in advance. As a result, the authentication management system, the authentication management method, and the authentication management program ensure the authenticity of the user, reduce the burden of password management by having the user recognize the identification image, and maintain a high level of security with the use of a one-time password.

Description

Authentication management system, authentication management method, and authentication management program

The present invention relates to an authentication management system, an authentication management method, and an authentication management program. In particular, the present invention relates to an authentication management system, an authentication management method, and an authentication management program using a password.

In conventional user authentication methods, passwords represented by numbers, letters and symbols are often used because of their versatility and convenience. In the case of such an authentication method, a password with a high security level is as long as possible and uses a list of irregular data, but widely used passwords such as birthdays and their names, There are many simple and easy to remember for users. Such a password can be easily imagined and easily broken by an attacker who is a malicious third party. Also, if the user does not change the password regularly and uses the same password in multiple systems, or if the password is leaked due to eavesdropping, voyeurism / spyware, etc., the damage may spread once There is.

However, if a long and complex password is required or frequent password changes are required, the security level is improved, but it is difficult to memorize the password, the password management load increases, and convenience is reduced. There was a problem that.
In order to solve these problems, various authentication methods such as a one-time password authentication method are used.
For example, in an authentication method using a one-time password, there is a method in which a different data string is generated every time authentication is performed according to a predetermined logic, the data string is visually recognized by a user, and an input is requested as a disposable password.

In the authentication method, a disposable data string is generated with a predetermined logic on a small terminal for displaying a password called a token distributed to a user or a mobile phone, and the user visually recognizes the data string and the terminal When input above, the authentication server side sends the data string to be verified against the authentication data string generated by the same logic or the disposable data string generated by the authentication server to the mobile phone etc. If you enter above, the authentication server will check both.

In addition, as a personal authentication method, a personal authentication data recording medium in which a large number of similar verification data is recorded is used, and the correct data is selected and specified from the large number of similar verification data in the personal memory, so that the identity of another person A technique for preventing authentication is proposed in Patent Document 1.

In addition, as an authentication method based on images, there is a method based on a user's memory, such as authentication by selecting a registered image of a user included in a plurality of images presented at the time of authentication. Patent Document 2 proposes a technique related to an authentication method that uses both personal information consisting of at least one unit of information and non-personal information consisting of at least one unit of information that is unknown to the principal.

Japanese Patent Laid-Open No. 2002-197065 JP 2003-228553 A

For example, the one-time password authentication method using tokens and mobile phones described above is effective for eavesdropping / voyeurism / spyware stealing, etc. What is proved by the password is the authenticity of the token or the mobile phone, and there is a problem that it does not contribute at all to determine whether it is a legitimate user or an attacker who holds it .

Also, the authentication method using images is effective for guessing attacks, etc., and uses images based on the user's memory, so it is easy to remember and the management load is reduced, but it can be used for detection and theft by eavesdropping, voyeurism, spyware, etc. There was a problem that it was vulnerable.

In view of the above circumstances, the present invention guarantees the authenticity of a user and identifies it for authentication by generating a disposable password when the user visually recognizes an identification image registered in advance by the user. An object of the present invention is to provide an authentication management system, an authentication management method, and an authentication management program that reduce the burden of managing passwords by using images and maintain a high security level by using disposable passwords. .

The authentication management system of the present invention receives a connection device having a communication function used by a user and a connection request from the connection device, and acquires unique user identification information assigned to each user. A user information confirmation unit, an identification information generation unit that generates a plurality of identification images for authentication based on the acquired user identification information, and assigns random data to the plurality of identification images; and an identification information generation unit The correspondence data storage unit that temporarily holds the correspondence between the identification image and the random data generated by the user and the plurality of generated identification images are selected via the connection device, and the assigned data is It has a user authentication unit that authenticates the user by inputting it and deletes the assignment of the identification image and random data after the authentication is completed, and allows single sign-on to the system Those with an authentication device having that function.

Further, in the authentication management system of the present invention, the “authentication device” further assigns unique user identification information for each connection device or each user of the connection device when registering an authentication image in advance. It may be provided with a user identification information issuing unit that links and manages the registered identification image for authentication and user identification information.

In the authentication management system of the present invention, the “authentication device” is a computer or a server, and “user identification information” that operates as various functional units by the CPU executing programs recorded in the ROM based on various inputs. A unique identifier indicating a user or a connection device. For example, user login information. Further, the “user identification information” may be used when the authentication device makes a user connection request.

“Identification image” refers to an image used by a user for authentication. For example, it may be an image registered in advance by the user for his / her authentication, and may serve as a password. In addition, the “identification image” may be familiar to the user, such as a photograph or a picture.

“The correspondence between the identification image and the random data” refers to the connection between the identification image generated by the identification information generation unit and the data. The correspondence relationship is not only associated with the internal processing of the authentication device, but also associated with the user so that the user can visually recognize it when displayed on the connection device. For example, the correspondence may be performed by superimposing data having a correspondence relationship on the identification image.

In the authentication management system of the present invention, the “connection device” has a communication function with an authentication device, and has a communication function between a portable terminal having an image display function for image authentication and an authentication device, and for password authentication. Or an electronic terminal having an input function. Further, the connection device may include an image display function for image authentication, an input function for password authentication, and a terminal having a different communication line for image authentication and password authentication. Good.

“Mobile terminal” is a device having a communication function and a screen display function. For example, a mobile phone, a PDA, a portable computer, and the like can be given.

“Electronic terminal” is a device having a communication function and a data input function. For example, a computer, a tablet PC, a smart phone, a credit terminal, ATM, an entrance management terminal, a kiosk terminal, etc. are mentioned.

In the authentication management system of the present invention, the “user identification information issuing unit” bundles login information to a plurality of systems and basic software into one user identification information, and discloses only the user identification information to the user. You may do.

“Basic software” refers to software called an operating system for controlling a computer and making an application available.

“Login information” refers to what the user presents to the system for authentication when using the system or operation system. For example, login ID, a password, etc. are mentioned.

In the authentication management system of the present invention, the “identification information generation unit” generates an identification image including an identification image for authentication registered in advance based on the user identification information, and displays all authentication images displayed by the authentication device. Random data may be reassigned to each image.

In the authentication management system of the present invention, the “correspondence relationship storage unit” stores a correspondence relationship between the authentication image displayed on the connection device and the random data assigned by the identification information generation unit. May be.

In the authentication management system of the present invention, the “user authentication unit” uses the data input as the password and the authentication image associated with the data from the correspondence stored in the correspondence storage unit. It is also possible to check whether the authentication image registered in advance by the user having the user identification information is correctly selected by checking the user identification information. After the authentication is completed, the correspondence storage unit may be instructed to delete the correspondence between the authentication image displayed to the authenticated user and the random data.

In the authentication management method of the present invention, a connection device connection request used by a user and having a communication function is received, unique user identification information assigned to each user is obtained, and the obtained user is obtained. Based on the identification information, a plurality of identification images for authentication are generated, random data is assigned to the plurality of identification images, and the correspondence between the identification image and the random data generated by the identification information generation unit is temporarily stored. The plurality of generated identification images are selected via the connection device, and the assigned data is input to authenticate the user. The function to delete the assignment with data and to allow single sign-on to the system is realized.

In the authentication management program of the present invention, the computer receives a connection device connection request having a communication function used by a user, and obtains unique user identification information assigned to each user, and Based on the acquired user identification information, a plurality of authentication identification images are generated, a function of assigning random data to the plurality of identification images, and the identification image generated by the identification information generation unit and a random A function of temporarily holding a correspondence relationship with data, and a function of authenticating a user by selecting the plurality of generated identification images and inputting assigned data via the connection device And the function to delete the assignment of the identification image and random data after the authentication is completed, and the function to allow single sign-on to the system It is intended to.

An authentication management system, an authentication management method, and an authentication management program according to the present invention temporarily hold a correspondence between an identification image and random data, and store a plurality of identification images generated via the connection device. By selecting and inputting the assigned data, the user can be authenticated, and after the authentication is completed, the assignment of the identification image and the random data can be deleted, and single sign-on can be permitted to the system. Thereby, the authenticity of the user is ensured, and a high security level can be maintained against detection / theft by eavesdropping / voyeurism / spyware by using a disposable password.

The authentication management system, the authentication management method, and the authentication management program according to the present invention provide a plurality of systems and basic software to one user identification information when a user registers an authentication image in advance. By bundling login information, the user can use a plurality of systems by recognizing the identification image, and the management load of the password can be reduced.

相互 By mutually securing the above-mentioned mutual effects, it is possible to reduce the burden on the user and realize a comprehensive security, high availability and versatile authentication system.

The figure which shows the authentication apparatus and the apparatus for a connection in the 1st Embodiment of this invention. The figure which shows the authentication apparatus and the apparatus for connection in the 2nd Embodiment of this invention. The figure which shows the authentication apparatus and the apparatus for connection in the 3rd Embodiment of this invention. The chart which showed the processing flow of the authentication apparatus and the apparatus for connection in embodiment of this invention The chart which showed the processing flow of the user identification information grant part in embodiment of this invention The chart which showed the processing flow of the user information confirmation part in embodiment of this invention The chart which showed the processing flow of the discernment information generation part in the embodiment of the present invention The chart which showed the processing flow of the correspondence memory | storage part in embodiment of this invention The chart which showed the processing flow of the user authentication part in the embodiment of the present invention Example of identification image display screen in the embodiment of the present invention Example of password input screen in the embodiment of the present invention

The authentication management system according to the first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a system configuration diagram showing a first embodiment of an authentication management system of the present invention.

In the first embodiment, the connection device 200 having a communication function and the user of the connection device or the user of the connection device when registering the authentication image in advance in the first embodiment. Unique user identification information is assigned to the user identification information issuance unit 101 for performing management by linking the registered identification image for authentication with the user identification information, and accepting a connection request from the connection device 200 and using it. A user information confirmation unit 102 that acquires unique user identification information assigned to each person, and generates a plurality of identification images for authentication based on the acquired user identification information, and the plurality of identification images An identification information generation unit 103 that assigns random data to the correspondence information, and a correspondence relationship storage unit 104 that temporarily holds a correspondence relationship between the identification image and the random data generated by the identification information generation unit, By selecting a plurality of generated identification images and inputting the assigned data through the connection device, the user is authenticated, and after the authentication is completed, the assignment of the identification image and random data is deleted. A user authentication unit 105, and an authentication device 100.

The authentication device 100, the portable terminal 210, and the electronic terminal 220 are connected through a wired or wireless network.

The authentication device 100 is a computer or a server, and operates as various functional units when the CPU executes a program recorded in the ROM based on various inputs.

In the first embodiment, the connection device 200 performs communication between the authentication device and the mobile terminal 210 including the communication unit 211 that performs communication with the authentication device 100 and the screen display unit 212 that includes a screen display function. It is comprised from the electronic terminal 220 comprised from the communication part 221 and the input part 222 provided with an input function.

The mobile terminal 210 is a device having a communication function and a screen display function, and may be a mobile phone, a PDA, a portable computer, or the like.

The electronic terminal 220 is a device having a communication function and a data input function, and may be a computer, a tablet PC, a smartphone, a credit terminal, an ATM, an entry management terminal, a kiosk terminal, or the like.

The user identification information issuing unit 101 performs user registration and user identification information delivery. By requiring pre-registration of a plurality of identification images at the time of user registration, the password can be complicated depending on the selection order and the number of selections of the identification images.

Also, it is possible to bundle login information to a plurality of systems and basic software into one user identification information and disclose only the user identification information to the user.

Here, basic software refers to software called an operating system for controlling a computer and making an application available.

Also, login information refers to what the user presents to the system for authentication when using the system or operation system. For example, login ID, a password, etc. are mentioned.

Furthermore, the user identification information here refers to a unique identifier indicating a user or a connection device. For example, user login information. Further, the user identification information may be used when the authentication device makes a user connection request.

The user information confirmation unit 102 serves as a reception window when a user presents user identification information and requests connection.

The identification information generation unit 103 assigns random data to the identification image received from the user information confirmation unit 102. The random data referred to here is data that can be input by an input function of the input unit 222 such as alphanumeric characters and symbols. A plurality of data may be assigned to one identification image.

The identification image is an image used by the user for authentication. For example, it may be an image registered in advance by the user for his / her authentication, and may serve as a password. The identification image may be familiar to the user, such as a photograph or a picture.

The correspondence between the identification image and random data refers to the connection between the identification image generated by the identification information generation unit and the data. The correspondence relationship is not only associated with the internal processing of the authentication device, but also associated with the user so that the user can visually recognize it when displayed on the connection device. For example, the correspondence may be performed by superimposing data having a correspondence relationship on the identification image.

Further, the identification information generation unit 103 generates an identification image display screen I1 as shown in FIG. 10 from data obtained by superimposing random data on the identification image, and displays the identification image display screen I1 on the screen display unit 212.
The identification image display screen I1 is obtained by superimposing random data on the identification image. The user can view the screen and visually recognize the data registered and assigned to the identification image.

The user visually recognizes random data superimposed on an identification image registered in advance from the displayed data, and inputs the data on the password input screen I2 as shown in FIG. The password input screen I2 has a user identification information input field and a password input field. The user inputs the data visually recognized from the identification image display screen I1 as a password in the password input field of this screen.

The correspondence relationship storage unit 104 temporarily stores the correspondence relationship generated by the identification information generation unit 103. Further, it has a deletion function, and the correspondence used for authentication can be deleted under the instruction of the user authentication unit 105. The deleted correspondence is not used for subsequent authentication.

The user authentication unit 105 authenticates the user from the password input by the user or the selected identification image. In addition, after the authentication is completed, the single sign-on function or the password manager function can be activated to permit batch login to a plurality of systems.

In the first embodiment, the user may make a connection request to the user confirmation unit 102 via the electronic terminal 220. At that time, the user confirmation unit 102 may request the user to send a message indicating that he / she does not have the portable terminal 210.

When the connection request from the electronic terminal 220 is received, the user information confirmation unit 102 acquires the user identification information from the electronic terminal 220, and the user identification information issuance unit 101 in advance based on the user identification information. The registered identification image and user identification information are transmitted to the identification information generation unit.

The identification information generation unit 103 assigns random data to the identification image received from the user information confirmation unit 102, and makes the user select whether to perform authentication by selecting an image.

When the connection request source is the electronic terminal 220, an identification image display screen I1 as shown in FIG. 10 is generated from data obtained by superimposing random data on the identification image and displayed on the electronic terminal 220. When the user selects authentication based on an image, the user authentication unit 105 directly selects an image without displaying the password input screen I2 on the input unit 222 of the electronic terminal 220. When the user does not select authentication by image, the password input screen I2 is displayed, and the user visually recognizes random data superimposed on the identification image registered in advance from the displayed data. The password is entered on the password input screen I2.

When the user selects an image directly on the electronic terminal 220, click, tap, keyboard input, reading speech recognition, or the like can be used as the selection method.

The user authentication unit 105 authenticates the user from the selected identification image or input password. When performing user authentication along this route, the user authentication unit 105 may restrict access when permitting connection. When the authentication is completed, the user authentication unit 105 deletes the correspondence relationship between the identification image and the random data temporarily stored for use in authentication in the correspondence relationship storage unit 104.

In the first embodiment, the processing procedure when the user uses the authentication management system according to the present invention will be described with reference to the flowchart of FIG.

When using the authentication management system according to the present invention, the user first accesses the authentication device and registers the identification image in the user identification information issuing unit 101 (flow 1). When the identification image is registered, user identification information is issued from the user identification information issuing unit 101 (flow 2). At this time, the issued user identification information and identification image are stored (flow 3).

The user who has received the delivery of the user identification information from the authentication management system issues a connection request from the mobile terminal 210 or the electronic terminal 220 to the authentication device (flow 4). Here, a process when an access is made from the mobile terminal 210 will be described as an example.

The user who made the connection request presents the user identification information to the user information confirmation unit 102 (flow 5). The presented user identification information is notified to the identification information generation 103 (flow 6), and the identification information generation unit 103 displays an identification image using an image including the registered identification information and random data corresponding to each image. A screen I1 is generated and presented.

The presented identification image display screen I1 is displayed on the screen display unit 212 of the mobile terminal 210 (flow 7). The correspondence relationship between the identification image and the random data used at this time is temporarily held in the correspondence relationship storage unit (flow 8).

From the identification image display screen I1 displayed on the mobile terminal 210, the user visually recognizes the data superimposed on the identification image registered in advance (flow 9), and the password input screen displayed on the electronic terminal 220 The password is input to I2 (flow 10). The input password data is used by the user authentication unit 105 to identify the identification image (flow 11).

The user authentication is performed from the identified identification image and the user identification information presented in flow 2 (flow 120), and if the authentication is successful, access is permitted (flow 13). At this time, the correspondence relationship held in the flow 8 is deleted in the correspondence relationship storage unit 104 and is not used for subsequent authentications.

Next, processing in each functional block will be described in detail with reference to the drawings.

User registration and user identification information delivery procedure in the user identification information delivery unit 101 will be described in detail with reference to the flowchart of FIG. The user identification information issuing unit 101 accepts registration of an identification image when an unregistered user connects using the connection device 200 (STEP 1), and issues unique user identification information for each user. (STEP 2), the user identification information and the identification image are stored (STEP 3).

For registration of an identification image, for example, both personal information consisting of at least one unit of information that the person who is authenticating and registering is familiar and non-personal information consisting of at least one unit of information that the person is not familiar with are registered in advance for personal authentication. A technique of registering and forming registration information (Japanese Patent Laid-Open No. 2003-228553) may be used.

Also, when there is an inquiry from the user authentication unit 105 (STEP 4; YES), the registered identification image is inquired from the presented user identification information and the authentication result is notified (STEP 5). If there is no inquiry from the user authentication unit 105, the process ends without performing any processing (STEP 4; NO).

The process in the user information confirmation unit 102 will be described in detail with reference to the flowchart of FIG.
When there is a connection request from the user (STEP 6; YES), the user information confirmation unit 102 acquires the presented user identification information (STEP 7), and the user in advance based on the user identification information. The user identification information registered by the identification information issuing unit 101 is transmitted to the identification information generating unit 103 (STEP 8). If there is no connection request from the user, the processing is not performed until the connection request is made, and the process continues waiting (STEP 6; NO).

The process of assigning random data to the identification image in the identification information generation unit 103 will be described in detail with reference to the flowchart of FIG. The identification information generation unit 103 does not perform processing until it receives an instruction from the user confirmation unit 102 (STEP 9; NO). When there is an instruction from the user information confirmation unit 102, the user identification information of the user who has made the connection request is received and an instruction to generate an identification image is received (STEP 9; YES).

Based on the user identification information, the identification information generation unit 103 is registered in advance for personal authentication, and is an identification image that is personal information consisting of at least one unit of familiar information, and at least one unit of information that the individual does not recognize An image is generated from an identification image that is non-personal information (STEP 10), random data is assigned to all the generated images (STEP 11), and the correspondence between the identification image and the random data is correlated. The data is transmitted to the storage unit 104 and instructed to be stored (STEP 12).

Thereafter, the random data assigned in STEP 11 is superimposed on each identification image to generate an identification image display screen I1 as shown in FIG. 10, and then the connection device 200 that has made the connection request is the mobile terminal 210 or the electronic device. The terminal 220 is confirmed (STEP 13) and displayed on the terminal that has made the connection request (STEP 14).

When the connection request source is the electronic terminal 220, it is confirmed whether the electronic terminal has two communication circuits (STEP 16). When the user does not have two communication circuits, the user selects authentication by image (STEP 17). YES), the user authentication unit 105 is notified so as to authenticate with the identification image (STEP 18).

The processing procedure in the correspondence storage unit 104 will be described with reference to the flowchart of FIG. The correspondence relationship storage unit 104 is in a standby state without performing any processing until a recording instruction is received from the identification information generation unit 103 (STEP 19; NO).

When there is an instruction from the identification information generation unit 103 (STEP 19; YES), the correspondence relationship between the identification image and random data generated by the identification information generation unit 103 is temporarily recorded (STEP 20). When receiving an instruction to delete the recorded correspondence from the user authentication unit 105 (STEP 21), the deletion is executed (STEP 22). Further, when there is no deletion instruction, deletion is performed from the identification information generation unit 103 after a certain time.

The procedure of authentication processing in the user authentication unit 105 will be described with reference to the flowchart of FIG. Whether or not there is an authentication notification by image from the identification information generation unit 103 is confirmed. If there is no notification (STEP 23; YES), a password input screen as shown in FIG. 11 is displayed on the electronic terminal 220 (STEP 24).

The user visually recognizes the data superimposed on the identification image, which is personal information consisting of at least one unit of information that is registered in advance for personal authentication, and inputs it to the password input screen. It is also possible to input a PIN or a stored password. When the user authentication unit 105 receives the data input by the user (STEP 25), the user authentication unit 105 inquires the correspondence relationship storage unit 104 (STEP 26), refers to the correspondence relationship between the identification image and the random data, and inputs the data. The selected identification image is determined (STEP 27).

The identified identification image and the identification image registered in advance in the user identification information issuing unit 101 are matched (STEP 28), and if they match, the access to the system that requested the connection is permitted and the recorded correspondence The correspondence storage unit is instructed to delete the relationship (STEP 29). At this time, the single sign-on function may be activated to allow connection to other systems in a lump. If the selected identification image does not match the pre-registered identification image, the user authentication unit 105 may request the user to input the password again (STEP 28).

When there is an authentication instruction using an image from the identification information generation unit 103 (STEP 23; NO), the user authentication unit 105 instructs the user to directly select an image from the displayed identification image display screen (STEP 30). ).

User selects images by methods such as click, tap, keyboard input, and speech recognition. Whether the selected identification image is registered in advance (STEP 31), and if it matches (STEP 32; YES), permit access to the connected system and delete the recorded correspondence. Instruct the correspondence storage unit. At this time, access restriction may be applied to the user who is authenticated by the route (STEP 33).

Also, when the selected identification image does not match the pre-registered identification image, the user authentication unit 105 may request the user to input the password again (STEP 32; NO).

FIG. 2 is a system configuration diagram showing a second embodiment of the authentication management system of the present invention.

In the second embodiment, the connection device 200 having a communication function used by a user and the user of the connection device or the connection device when registering an authentication image in advance. Unique user identification information is assigned to the user identification information issuance unit 101 for performing management by linking the registered identification image for authentication with the user identification information, and accepting a connection request from the connection device 200 and using it. A user information confirmation unit 102 for acquiring unique user identification information assigned to each person, and generating a plurality of identification images for authentication based on the acquired user identification information. An identification information generation unit 103 for assigning random data to
The correspondence information storage unit 104 that temporarily holds the correspondence relationship between the identification image and the random data generated by the identification information generation unit, and the plurality of identification images generated via the connection device are selected. The authentication apparatus 100 includes a user authentication unit 105 that authenticates a user by inputting the assigned data and deletes the assignment between the identification image and the random data after the authentication is completed.

In the second embodiment, the connection device 200 includes a communication unit 211 that performs communication with the authentication device 100, a communication unit 221, a screen display unit 212 that includes a screen display function, and an input unit 222 that includes an input function. An electronic terminal 230 is included.

In addition, the communication unit 211 and the communication unit 212 included in the electronic terminal 230 are physically or logically different communication circuits, and communication on each circuit is not mixed.

The authentication device 100 and the electronic terminal 230 are connected through a wired or wireless network.

In the second embodiment, the electronic terminal 230 includes the communication unit 211, the screen display unit 212, the communication unit 221, and the input unit 222 that the portable terminal 210 and the electronic terminal 220 in the first embodiment have in one terminal. Each having the same functions as those of the first embodiment, and the registration processing in the user identification information issuing unit 101 and the user information confirmation unit that the portable terminal 210 performed in the first embodiment. The connection request to 102 and the identification image display screen I1 are displayed.

In the second embodiment, the authentication device 100 has a function equivalent to that of the first embodiment, and in the first embodiment, the communication circuit 211 and the screen display unit 212 included in the mobile terminal 210 are provided in the second embodiment. In the first embodiment, the communication circuit 221 and the input unit 222 included in the electronic terminal 220 are treated as those included in the electronic terminal 230 in the second embodiment. The process is the same.

FIG. 3 is a system configuration diagram showing a third embodiment of the authentication management system of the present invention.
In the third embodiment, the connection device 200 having a communication function used by a user and the user of the connection device or the connection device when the authentication image is registered in advance. Unique user identification information is assigned to the user identification information issuance unit 101 for performing management by linking the registered identification image for authentication with the user identification information, and accepting a connection request from the connection device 200 and using it. A user information confirmation unit 102 for acquiring unique user identification information assigned to each person, and generating a plurality of identification images for authentication based on the acquired user identification information. An identification information generation unit 103 that assigns random data to the data, and a correspondence relationship storage unit 104 that temporarily holds the correspondence between the identification image and the random data generated by the identification information generation unit. The user is authenticated by selecting a plurality of generated identification images and inputting the assigned data via the authentication device 111 and the connection device 200, and after the authentication is completed, The service providing apparatus 110 includes a user authentication unit 105 that deletes assignment with random data.

3rd Embodiment isolate | separates the function of the user authentication part 105 with which the authentication apparatus 111 was provided in 1st Embodiment, and is set as the service provision apparatus 110. FIG.

The authentication device 111, the service providing device 110, the portable terminal 210, and the electronic terminal 220 are connected through a wired or wireless network.

In the third embodiment, the connection device 200 includes a communication unit 211 that performs communication with the authentication device 100 and a mobile terminal 210 that includes a screen display unit 212 having a screen display function, and communication that performs communication with the authentication device. It is comprised from the electronic terminal 220 comprised from the part 221 and the input part 222 provided with an input function.

The authentication device 111 and the service providing device 110 are computers or servers, and operate as various functional units when the CPU executes programs recorded in the ROM based on various inputs.

In the third embodiment, the connection device 200, the portable terminal 210, and the electronic terminal 220 have functions equivalent to those of the first embodiment. In the first embodiment, user identification information is provided to the authentication device 111. The unit 101, the user confirmation unit 102, the identification information generation unit 103, and the correspondence relationship storage unit 104 are also included in the authentication device 111 in the third embodiment, and the service authentication device 105 is included in the user authentication unit 105. The processing between the functions is the same.

An authentication management system with comprehensive security and availability and practicality that is much higher than conventional solutions while reducing the burden on users by mutually securing the above mutual effects. Can be realized.

DESCRIPTION OF SYMBOLS 100 Authentication apparatus 101 User identification information issuing part 102 User information confirmation part 103 Identification information generation part 104 Correspondence relationship memory | storage part 105 User authentication part 110 Service provision apparatus 200 Connection apparatus 210 Portable terminal 211 Communication part 212 Screen display part 220 Electronic terminal 221 Communication unit 222 Input unit 230 Electronic terminal

Claims

A connection device having a communication function used by a user;
A user information confirmation unit that receives a connection request from the connection device and acquires unique user identification information assigned to each user;
Based on the acquired user identification information, an identification information generation unit that generates a plurality of identification images for authentication and assigns random data to the plurality of identification images;
A correspondence relationship storage unit that temporarily generates a correspondence relationship between the identification image and random data generated by the identification information generation unit;
The user is authenticated by selecting the generated plurality of identification images and inputting the assigned data via the connection device, and after the authentication is completed, the identification image and random data are assigned. A user authentication section to be deleted;
An authentication management system including an authentication device having a function of permitting single sign-on to the system.
The authentication device further assigns unique user identification information for each connection device or each user of the connection device when the authentication image is registered in advance, and the registered authentication identification image. The authentication management system according to claim 1, further comprising a user identification information issuing unit that performs management by linking the user identification information with the user identification information.
The user identification information issuing unit bundles login information to a plurality of systems and basic software into one user identification information, and discloses only the user identification information to the user. The authentication management system according to claim 2.
The identification information generating unit has a function of displaying an authentication image including an authentication image registered in advance based on the user identification information, and all the authentication images displayed by the authentication device. 4. The authentication management system according to claim 1, wherein the authentication management system has a function of allocating random data.
The correspondence storage unit is a correspondence relationship between user identification information of the connection device that has made a connection request, an authentication image displayed for the connection device, and random data assigned by the identification information generation unit. 5. The authentication management system according to claim 1, wherein the authentication management system has a function of storing the password.
The user authentication unit matches the data input as a password with the correspondence stored in the correspondence storage unit, compares the authentication image associated with the data with the user identification information, and A function for confirming whether an authentication image registered in advance by a user having user identification information is correctly selected, and displayed to a user who has been authenticated against the correspondence storage unit after the authentication is completed 6. The authentication management system according to claim 1, wherein the authentication management system has a function of instructing deletion of a correspondence relationship between the authentication image and random data.
The connection device has a communication function with the authentication device, and has a communication function with the portable device having a function of displaying the authentication image and the authentication device, and has an input function for password authentication. The authentication management system according to claim 1, comprising an electronic terminal.
The connection device includes a terminal having an image display function for the image authentication, an input function for the password authentication, and having different communication lines for the image authentication and the password authentication. The authentication management system according to claim 7, wherein the authentication management system is provided.
The authentication device has a function of performing authentication by directly selecting an authentication image in the user authentication unit, and has a function of restricting access rights to a user who has not performed password authentication. The authentication management system according to claim 1, wherein the authentication management system is one.
Accepting a connection device connection request having a communication function used by a user,
Obtaining unique user identification information assigned to each user;
Based on the acquired user identification information, generate a plurality of identification images for authentication, assign random data to the plurality of identification images,
Temporarily holding the correspondence between the identification image and random data generated by the identification information generation unit,
The user is authenticated by selecting the generated plurality of identification images and inputting the assigned data via the connection device, and after the authentication is completed, the identification image and random data are assigned. Authentication management method to delete and allow single sign-on to the system.
A function of accepting a connection device connection request used by a user and having a communication function in a computer, and obtaining unique user identification information assigned to each user;
A function of generating a plurality of identification images for authentication based on the acquired user identification information, and assigning random data to the plurality of identification images;
A function for temporarily holding the correspondence between the identification image and random data generated by the identification information generation unit;
By selecting the generated plurality of identification images via the connection device and inputting the assigned data, the user is authenticated, and after the authentication is completed, the assignment of the identification image and random data is deleted. Function to
An authentication management program that realizes the function that allows single sign-on to the system.