Two-element authentication system, two-element authentication method, and two-element authentication program

Abstract

A two-element authentication system (90) is provided with an additional authentication device (200). The additional authentication device (200) has an authentication operation determination unit (250). An authentication operation determination unit (250) determines an authentication operation when the number of character inputs when a user inputs a target password to the password authentication device (100) is not the minimum number of character inputs for inputting the target password. On the basis of auxiliary information indicating a job executed by the user on the password authentication device (100) when the user has entered the target password, and information acquired by the sensor (201) during a time period when the user has entered the target password, it is determined whether or not the user has entered the target password on the password authentication device (100).

Description

Technical Field

[0001] The present disclosure relates to a two-factor authentication system, a two-factor authentication method, and a two-factor authentication program. Background Art

[0002] In recent years, the use of two-factor authentication has increased in order to improve the security of authentication systems. In two-factor authentication, authentication information of the first factor is sent from a user terminal device such as a PC (Personal Computer) to an authentication device. Then, authentication information of the second factor is sent from another data processing device to the authentication device.

[0003] When two-factor authentication is used, even if an unauthorized person with malicious intent can infect the password authentication device with a virus and steal the password, the unauthorized person cannot obtain the additional authentication information. Therefore, two-factor authentication can prevent unauthorized access.

[0004] However, in conventional two-factor authentication, there is a problem that the user who performs authentication must operate both the password authentication device and the additional authentication device. In other words, in conventional two-factor authentication, there is a problem that the user's load becomes higher than that of single-factor authentication.

[0005] Non-patent document 1 discloses an additional authentication device that performs additional authentication processing when it is determined that the password authentication processing has been performed in the password authentication device through the user's password input action. The additional authentication device can realize the following two-factor authentication: it can achieve the same degree of convenience as single-factor authentication and can effectively prevent illegal access.

[0006] Prior art literature

[0007] Non-patent literature

[0008] Non-patent literature 1: Shinnosuke Nozaki, Ayumi Serizawa, Mizuho Yoshihira, Shinhiro Fujita, Yoichi Shibata, Tadakazu Yamanaka, Noriyuki Matsuda, Tetsushi Oki, Masakatsu Nishigaki, "Multi-factor authentication with multi-point observation: Implementation of multi-factor authentication based on single credential", Proceedings of Cryptography and Information Security 2022, 4B2-2. Summary of the invention

[0009] Problems to be solved by the invention

[0010] Generally speaking, when a user inputs a password, the characters are input one by one. Hereinafter, the operation of inputting a certain character is referred to as a character input operation. As a specific example, when a password such as "pass" is input, four character input operations, namely "operation of inputting character p", "operation of inputting character a", "operation of inputting character s" and "operation of inputting character s" are performed. Hereinafter, "operation of inputting character c" is represented as [c]. In addition, the number of character input operations performed from the start of password input to the completion of input is referred to as "number of character input times". In addition, the minimum number of character input operations required to input a certain password is referred to as "minimum number of character input times". As a specific example, when the password is "pass", the minimum number of character input times is 4, and the character input operation corresponding to the minimum number of character input times is [p][a][s][s].

[0011] However, sometimes the user does not input the password with the minimum number of characters. As a specific example, sometimes after the user executes [p][a][s], he mistakenly inputs [w]. Then, after the user performs the operation of deleting the character w, that is, after inputting the delete character, he executes [s]. Thereafter, the operation of deleting the character, that is, the operation of inputting the delete character, is expressed as [BS]. In this example, until the user completes the password input, six character input operations such as [p][a][w][BS][s][s] are implemented. Here, BS is the abbreviation of backspace.

[0012] Non-patent document 1 does not disclose or reveal the structure and operation when the user does not enter the password within the minimum number of character input times. That is, in Non-patent document 1, there is a problem that two-factor authentication cannot succeed when the user does not enter the password within the minimum number of character input times.

[0013] The purpose of the present disclosure is to realize a two-factor authentication system in which the first factor of authentication is password authentication, which achieves the same level of convenience as single-factor authentication and has relatively high authentication accuracy even when the user does not enter the password with the minimum number of character inputs.

[0014] Means for solving problems

[0015] The two-factor authentication system disclosed in the present invention includes a password authentication device for a user to input an object password, and an additional authentication device that monitors the password authentication device using a sensor, wherein the two-factor authentication system includes the additional authentication device, and the additional authentication device includes an authentication action determination unit that determines whether the user has input the object password into the password authentication device based on auxiliary information indicating an operation performed by the user on the password authentication device when the user inputs the object password and information obtained by the sensor during a time period when the user inputs the object password, when the number of character inputs when the user inputs the object password into the password authentication device is not a minimum number of times for inputting the object password.

[0016] Effects of the Invention

[0017] According to the present disclosure, the authentication action determination unit uses the auxiliary information and the sensor information to determine whether the user has input the object password into the password authentication device. Here, the processing of the authentication action determination unit is equivalent to the authentication of the second factor. The auxiliary information indicates the operation performed by the user on the password authentication device when the user inputs the object password. Therefore, according to the present disclosure, the following two-factor authentication system can be realized: in the two-factor authentication in which the authentication of the first factor is the password authentication, the same degree of convenience as the single-factor authentication is achieved, and even in the case where the user does not input the password with the minimum number of character inputs, the authentication accuracy is relatively high. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a diagram showing a configuration example of a two-factor authentication system 90 according to the first embodiment.

[0019] Figure 2 This is a diagram showing a functional configuration example of the authentication device 300 according to the first embodiment.

[0020] Figure 3 This is a diagram showing a functional configuration example of the password authentication device 100 according to the first embodiment.

[0021] Figure 4 This is a diagram showing a functional configuration example of the additional authentication device 200 according to the first embodiment.

[0022] Figure 5 This is a diagram showing a hardware configuration example of the computer 10 according to the first embodiment.

[0023] Figure 6 This is a flowchart showing the operation of the two-factor authentication system 90 according to the first embodiment.

[0024] Figure 7 This is a flowchart showing the operation of the two-factor authentication system 90 according to the first embodiment.

[0025] Figure 8 This is a diagram illustrating the authentication interface of implementation mode 1.

[0026] Fig. 9 This is a diagram showing a hardware configuration example of a computer 10 according to a modification of the first embodiment.

[0027] Fig.10 This is a diagram showing a functional configuration example of the password authentication device 100 according to the second embodiment.

[0028] Fig.11 This is a diagram showing a functional configuration example of an additional authentication device 200 according to a modified example of the second embodiment.

[0029] Fig.12 This is a flowchart showing the operation of the two-factor authentication system 90 according to the second embodiment.

[0030] Fig.13 This is a diagram showing a functional configuration example of an additional authentication device 200 according to a modified example of the second embodiment.

[0031] Fig.14 This is a diagram showing a configuration example of a two-factor authentication system 90 according to the third embodiment.

[0032] Fig.15 This is a diagram showing a functional configuration example of an intermediary device 400 according to the third embodiment.

[0033] Fig.16 This is a diagram showing a functional configuration example of an authentication device 300 according to the third embodiment.

[0034] Fig.17 This is a flowchart showing the operation of the two-factor authentication system 90 according to the third embodiment.

[0035] Fig.18 This is a flowchart showing the operation of the two-factor authentication system 90 according to the third embodiment. DETAILED DESCRIPTION

[0036] In the description of the embodiments and the accompanying drawings, the same reference numerals are used to identify the same elements and corresponding elements. The description of the elements identified with the same reference numerals is appropriately omitted or simplified. The arrows in the figures mainly represent data flows or processing flows. In addition, "unit" may be appropriately rewritten as "circuit", "process", "step", "processing" or "circuit".

[0037] Implementation Method 1

[0038] Hereinafter, this embodiment will be described in detail with reference to the drawings.

[0039] ***Description of the structure***

[0040] Figure 1 FIG. 9 shows a configuration example of a two-factor authentication system 90 according to Embodiment 1. Figure 1 As shown, the two-factor authentication system 90 includes a password authentication device 100, an additional authentication device 200, and an authentication device 300. The plurality of devices constituting the two-factor authentication system 90 may be integrally configured as appropriate.

[0041] In most cases, password authentication is used in the authentication of the first element. Therefore, hereinafter, the authentication of the first element is referred to as "password authentication". In addition, the data processing for password authentication is referred to as "password authentication processing". In addition, the authentication information used in password authentication is referred to as "password". In addition, the user terminal device such as a PC that sends the password is referred to as a "password authentication device". In addition, the action of the user inputting the password into the password authentication device 100 is referred to as a "password input action".

[0042] In addition, the authentication of the second element is referred to as "additional authentication". In addition, the data processing for the additional authentication is referred to as "additional authentication processing". In addition, the authentication information used in the second stage or the authentication of the second element is referred to as "additional authentication information". The additional authentication information is authentication information that supplements the password authentication information. In addition, the data processing device that sends the additional authentication information is referred to as an "additional processing device".

[0043] The password authentication device 100 corresponds to a user terminal device, is a device for a user to input a target password, and performs a password authentication process. The password authentication process is a process of causing a user to input a password to the password authentication device 100 and transmitting the password input by the user to the authentication device 300.

[0044] The password is authentication information for password authentication of the first element. In the present embodiment, the password is information that is shared in advance between the user and the authentication device 300 in order to perform password authentication. Hereinafter, the password input by the user to the password authentication device 100 is referred to as the user password.

[0045] The password input operation is an operation in which the user inputs a password to the password authentication device 100. Therefore, when the password input operation is performed by the user, it can be determined that the password authentication process is performed in the password authentication device 100 based on the user's operation.

[0046] However, sometimes the number of character inputs in the password input action is not the minimum number of character inputs required. Therefore, the password authentication device 100 records information indicating the steps taken by the user when the user performed the password input action as auxiliary information. The auxiliary information is information indicating the operation performed by the user on the password authentication device 100 when the user inputs the object password. The auxiliary information may also include information indicating the operation performed by the user in which the user input an erroneous input and the operation corrected by the user in which the erroneous input was performed. A specific example of the auxiliary information is information corresponding to a series of character input operations in the password input action performed by the user, such as information used to display on the screen as "the character input operation was performed in the order of [p][a][w][BS][s][s]". The password authentication device 100 sends the recorded auxiliary information to the additional authentication device 200.

[0047] The additional authentication device 200 is equivalent to a data processing device, and has a sensor 201. The additional authentication device 200 is a device that monitors the password authentication device 100 using the sensor 201. As a specific example, the sensor 201 is at least one of a microphone and an angular velocity sensor. As a specific example, when the sensor 201 is a microphone, the additional authentication device 200 uses the information of the sound collected by the microphone as sensor information to monitor the password authentication device 100. In addition, when the sensor 201 is an angular velocity sensor, the additional authentication device 200 uses the angular velocity information obtained by the angular velocity sensor as sensor information to monitor the password authentication device 100.

[0048] The additional authentication device 200 uses auxiliary information transmitted from the password authentication device 100 independently of the password authentication device 100 to determine whether the user has entered a password based on the monitoring result of the password authentication device 100. That is, the additional authentication device 200 determines whether the password has been entered based on the user's action.

[0049] The additional authentication device 200 performs an additional authentication process when it is determined by the password input action of the user that the password authentication process is performed in the password authentication device 100. The additional authentication process is a data process that supplements the password authentication process. Specifically, as the additional authentication process, the additional authentication device 200 performs a process of generating additional authentication information and sending the generated additional authentication information to the authentication device 300.

[0050] The additional authentication information is information that is shared in advance by the authentication device 300 and the additional authentication device 200 for performing additional authentication. As a specific example, the additional authentication information is information including information indicating a 128-bit secret key generated according to the Advanced Encryption Standard (AES).

[0051] Hereinafter, the additional authentication information transmitted by the additional authentication device 200 to the authentication device 300 is referred to as user additional authentication information.

[0052] Furthermore, when it is determined that the password authentication process is not being executed in the password authentication device 100 by the password input action of the user, the additional authentication device 200 does not execute the additional authentication process.

[0053] The authentication device 300 performs user authentication by two-factor authentication. Specifically, the authentication device 300 compares the user password received from the password authentication device 100 with the registered password. The registered password is a password pre-registered in the authentication device 300. In addition, the authentication device 300 compares the user additional authentication information received from the additional authentication device 200 with the registered additional authentication information. The registered additional authentication information is the additional authentication information pre-registered in the authentication device 300. Then, the authentication device 300 integrates the comparison result of the user password and the registered password and the comparison result of the user additional authentication information and the registered additional authentication information to obtain a final authentication result.

[0054] Figure 2 FIG. 4 shows an example of the functional structure of the authentication device 300. Figure 2 As shown, the authentication device 300 has a password receiving unit 310, a password verifying unit 320, a transmission request sending unit 330, an additional authentication information receiving unit 340, an additional authentication information verifying unit 350, an authentication result determining unit 360, a password storage DB (Database) 390 and an additional authentication information DB 391.

[0055] The password receiving unit 310 receives a password from the password authentication device 100 .

[0056] The password verification unit 320 verifies whether the user password and the registered password match each other, thereby obtaining an authentication result corresponding to the password authentication.

[0057] The transmission request transmission unit 330 transmits data indicating a transmission request for user additional authentication information (hereinafter simply referred to as a transmission request) to the additional authentication device 200 .

[0058] The additional authentication information receiving unit 340 receives user additional authentication information from the additional authentication device 200 .

[0059] The additional authentication information verification unit 350 compares the registered additional authentication information with the user additional authentication information to obtain an authentication result corresponding to the additional authentication.

[0060] The authentication result determination unit 360 integrates the authentication result corresponding to the password authentication and the authentication result corresponding to the additional authentication to obtain the authentication result corresponding to the two-factor authentication. That is, the authentication result determination unit 360 determines the authentication result corresponding to the target password input to the password authentication device 100 based on the target password input to the password authentication device 100 and the result of determining whether the user has input the target password.

[0061] The password storage DB 390 stores the registered passwords. The password storage DB 390 may store a plurality of passwords corresponding to a plurality of users, respectively.

[0062] The additional authentication information DB 391 stores registered additional authentication information. The additional authentication information DB 391 may store a plurality of additional authentication information corresponding to a plurality of users.

[0063] Figure 3 FIG. 2 shows an example of a functional structure of the password authentication device 100. Figure 3 As shown, the password authentication device 100 has a storage start request sending unit 110, an authentication interface display unit 120, a character input accepting unit 130, a password input completion receiving unit 140, a password generating unit 150, a password sending unit 160, an auxiliary information generating unit 170, an auxiliary information sending unit 180 and an input character DB 190.

[0064] The storage start request transmission unit 110 transmits data indicating a request to start storing sensor information (hereinafter also referred to as a storage start request) to the additional authentication device 200 .

[0065] The authentication interface display unit 120 provides an interface for the user to input a user password.

[0066] The character input accepting unit 130 accepts input of characters from the user, and records the characters whose input has been accepted in the input character DB 190 .

[0067] The password input completion receiving unit 140 receives information indicating that the password input is completed from the user. As a specific example, when there is a "Send" button on the authentication interface, the user notifies the password authentication device 100 that the password input is completed by pressing the "Send" button.

[0068] The password creating unit 150 extracts all characters input by the user from the input character DB 190 , and creates a password by combining the extracted characters.

[0069] The password transmitting unit 160 transmits the password generated by the password generating unit 150 to the authentication device 300 as a user password.

[0070] The auxiliary information generating unit 170 extracts all characters input by the user from the input character DB 190 , and generates auxiliary information by combining the extracted characters.

[0071] The auxiliary information transmitting unit 180 transmits the auxiliary information generated by the auxiliary information generating unit 170 to the additional authentication device 200 .

[0072] The input character DB 190 is a DB that records characters input by the user.

[0073] Figure 4 FIG. 2 shows an example of a functional structure of an additional authentication device 200. Figure 4 As shown, the additional authentication device 200 has a sensor 201, a storage start request receiving unit 210, a storage stop request unit 220, a sensor information acquisition unit 230, an auxiliary information receiving unit 240, an authentication action determination unit 250, a sending request receiving unit 260, a determination result acquisition unit 270, an additional authentication information sending unit 280, a sensor information storage DB 290, a password authentication action DB 291 and an additional authentication information DB 292.

[0074] The storage start request receiving unit 210 receives data indicating a storage start request from the password authentication device 100 , and instructs the sensor 201 to monitor the password authentication device 100 according to the received data.

[0075] The storage stop request unit 220 instructs the sensor 201 to stop monitoring the password authentication device 100 .

[0076] The sensor information acquisition unit 230 acquires sensor information indicating the monitoring result of the sensor 201 from the sensor 201 , and records the acquired sensor information in the sensor information storage DB 290 .

[0077] The auxiliary information receiving unit 240 receives auxiliary information from the password authentication device 100 , and transmits the received auxiliary information to the authentication operation determination unit 250 .

[0078] The authentication action determination unit 250 uses the sensor information extracted from the sensor information storage DB 290, the auxiliary information received from the auxiliary information receiving unit 240, and the determination rule extracted from the password authentication action DB 291 to determine whether the password input action is performed by the user. The determination rule is also called the password input action determination rule. That is, the authentication action determination unit 250 monitors the password authentication device 100 using the sensor 201, and determines whether the password authentication process is performed by the password input action of the user based on the result of monitoring the password authentication device 100. The authentication action determination unit 250 is also called the password authentication action determination unit.

[0079] When the number of character inputs when the user inputs the object password to the password authentication device 100 is not the minimum number of times for inputting the object password, the authentication action determination unit 250 determines whether the user has input the object password to the password authentication device 100 based on the auxiliary information and the information obtained by the sensor 201 during the time period when the user inputs the object password. Here, the processing of the authentication action determination unit 250 is equivalent to the authentication of the second element. When determining whether the user has input the object password to the password authentication device 100, the authentication action determination unit 250 may also use a rule corresponding to the operation performed when the user inputs the object password to the password authentication device 100. As a specific example, the rule indicates a necessary operation and an interval between operations, etc.

[0080] The transmission request receiving unit 260 receives data indicating a transmission request from the authentication device 300 .

[0081] The determination result acquisition unit 270 acquires data indicating the determination result of the authentication action determination unit 250, that is, the authentication action determination result, from the authentication action determination unit 250. In addition, the determination result acquisition unit 270 acquires data indicating the transmission request from the transmission request receiving unit 260. Then, when the transmission of the user additional authentication information is requested, the determination result acquisition unit 270 instructs the additional authentication information transmitting unit 280 to transmit the user additional authentication information.

[0082] On the other hand, in at least any one of the following cases: the authentication action determination unit 250 cannot determine that the password authentication process has been performed through the user's password input action, and the sending request receiving unit 260 does not receive data indicating a sending request from the authentication device 300, the determination result acquisition unit 270 does not instruct the additional authentication information sending unit 280 to send the user additional authentication information.

[0083] The additional authentication information transmission unit 280 obtains the user additional authentication information corresponding to the authentication operation determination result from the additional authentication information DB 292 in accordance with the instruction of the determination result acquisition unit 270 , and transmits the obtained user additional authentication information to the authentication device 300 .

[0084] The sensor information storage DB 290 is a DB that records sensor information.

[0085] The password authentication action DB 291 is a DB that records the user's password input action. As a specific example, when the additional authentication device 200 uses a microphone to monitor the password authentication device 100, the sound signal a(t) = [aΔt, a2Δt, a3Δt, ..., a|a(t)|] when the user inputs the registered password is recorded. Here, the sound signal a(t) when the password is input is information that is sampled and recorded every Δt seconds for the sound pressure generated when the user performs the password input action.

[0086] The additional authentication information DB 292 stores the additional authentication information of the user.

[0087] Figure 5 The following is a hardware configuration example of the computer 10 according to the present embodiment. The password authentication device 100, the additional authentication device 200, and the authentication device 300 are each configured by the computer 10. The computer 10 may be configured by a plurality of computers.

[0088] As shown in this figure, the computer 10 is a computer having hardware such as a processor 11, a memory 12, an auxiliary storage device 13, an input / output IF (Interface) 14, and a communication device 15. These hardware are connected via a signal line 19 as appropriate.

[0089] The processor 11 is an IC (Integrated Circuit) that performs calculations and controls the hardware of the computer. As a specific example, the processor 11 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit).

[0090] The computer 10 may include a plurality of processors instead of the processor 11. The plurality of processors share the role of the processor 11.

[0091] Typically, the memory 12 is a volatile storage device, and as a specific example, is a RAM (Random Access Memory). The memory 12 is also called a main storage device or a main memory. The data stored in the memory 12 is stored in the auxiliary storage device 13 as needed.

[0092] Typically, the auxiliary storage device 13 is a nonvolatile storage device, and specific examples thereof include ROM (Read Only Memory), HDD (Hard Disk Drive), or flash memory. Data stored in the auxiliary storage device 13 is loaded into the memory 12 as needed.

[0093] The memory 12 and the auxiliary storage device 13 may be integrally configured.

[0094] The input / output IF 14 is a port for connecting an input device and an output device. As a specific example, the input / output IF 14 is a USB (Universal Serial Bus) terminal. As a specific example, the input device is a keyboard and a mouse. As a specific example, the output device is a display.

[0095] The communication device 15 is a receiver and a transmitter. As a specific example, the communication device 15 is a communication chip or a NIC (Network Interface Card).

[0096] When each unit of each device communicates with other devices, etc., it can also use the input / output IF 14 and the communication device 15 as appropriate.

[0097] The auxiliary storage device 13 stores a two-factor authentication program. The two-factor authentication program is a program that enables a computer to implement the functions of each unit of each device. The two-factor authentication program is loaded into the memory 12 and executed by the processor 11. The functions of each unit of each device are implemented by software.

[0098] The data used when executing the two-factor authentication program and the data obtained by executing the two-factor authentication program are appropriately stored in the storage device. Each part of the computer 10 uses the storage device appropriately. As a specific example, the storage device is composed of at least one of the memory 12, the auxiliary storage device 13, the register in the processor 11, and the cache memory in the processor 11. In addition, the term "data" and the term "information" sometimes have the same meaning. The storage device may also be independent of the computer 10.

[0099] The functions of the memory 12 and the auxiliary storage device 13 may also be implemented by other storage devices.

[0100] The two-factor authentication program may also be recorded in a non-volatile recording medium that is readable by a computer. As a specific example, the non-volatile recording medium is an optical disk or a flash memory. The two-factor authentication program may also be provided as a program product.

[0101] ***Description of the action***

[0102] The operation procedure of each device constituting the two-factor authentication system 90 corresponds to the two-factor authentication method. In addition, the program for realizing the operation of each device constituting the two-factor authentication system 90 corresponds to the two-factor authentication program.

[0103] In the following, it is assumed that the additional authentication device 200 has a microphone as the sensor 201. In addition, the sensor information is a sound signal acquired by the microphone. In the following, the sound signal acquired by the microphone is simply referred to as a sound signal.

[0104] Figure 6 and Figure 7 2 is a flowchart showing an example of the operation of the two-factor authentication system 90. Figure 6 and Figure 7 The operation of the two-factor authentication system 90 will be described.

[0105] (Step S1.1)

[0106] The storage start request transmission unit 110 transmits data indicating a storage start request to the additional authentication device 200 .

[0107] (Step S1.2)

[0108] The authentication interface display unit 120 displays an authentication interface to the user.

[0109] As a specific example, the authentication interface display unit 120 displays Figure 8 The authentication interface is shown. Figure 8 The authentication interface shown is provided with a password input box and an authentication button. The user performs a password input action on the password input box, that is, inputs a character string as a password into the password input box. Then, the user notifies the password authentication device 100 that the password input is completed by pressing the authentication button. Below, the description related to this example is appropriately performed.

[0110] (Step S1.3)

[0111] The character input accepting unit 130 accepts input of characters from the user, and records the characters whose input has been accepted in the input character DB 190 .

[0112] As a specific example, in this step, it is assumed that the user performs [p][a][w][BS][s][s], that is, it is assumed that a character string such as p, a, w, BS, s, s is input, and it is assumed that information representing the character string is recorded in the input character DB 190. The following description is appropriately related to this example.

[0113] (Step S1.4)

[0114] The password input completion receiving unit 140 receives information indicating that the password input is completed from the user.

[0115] Here, the password input completion receiving unit 140 receives information indicating that the user has pressed the “Authentication” button on the authentication interface.

[0116] (Step S1.5)

[0117] The auxiliary information generating unit 170 generates auxiliary information by referring to the information recorded in the input character DB 190 .

[0118] Here, the auxiliary information generating unit 170 refers to the characters recorded in the input character DB 190, that is, p, a, w, BS, s, s. Furthermore, it is assumed that the auxiliary information generating unit 170 generates auxiliary information indicating at which character BS is pressed, that is, information indicating that "the user pressed BS at the 4th character" is used as auxiliary information.

[0119] (Step S1.6)

[0120] The auxiliary information transmitting unit 180 transmits the auxiliary information generated by the auxiliary information generating unit 170 to the additional authentication device 200 .

[0121] (Step S1.7)

[0122] In parallel with step S1.5, the password generating unit 150 generates a password by referring to the information recorded in the input character DB 190.

[0123] Here, the password generating unit 150 refers to characters recorded in the input character DB 190, that is, p, a, w, BS, s, s. Furthermore, since the character string corresponding to the referenced characters is "pass", the password generating unit 150 generates the character string "pass" as a password.

[0124] (Step S1.8)

[0125] The password transmitting unit 160 transmits the password generated by the password generating unit 150 to the authentication device 300 .

[0126] (Step S2.1)

[0127] The storage start request receiving unit 210 receives data indicating a storage start request, and instructs the sensor 201 to start monitoring the password authentication device 100 according to the received data.

[0128] (Step S2.2)

[0129] The sensor information acquisition unit 230 acquires sensor information from the sensor 201 .

[0130] Here, it is assumed that the sensor information acquisition unit 230 acquires information indicating the value a of one sound pressure at every sampling interval Δt.

[0131] (Step S2.3)

[0132] The sensor information acquisition unit 230 stores the acquired sensor information in the sensor information storage DB 290. Here, it is assumed that the information indicating the value a of the sound pressure acquired by the sensor information acquisition unit 230 is directly stored.

[0133] Step S2.2 and step S2.3 are repeated multiple times until step S2.5 is implemented. That is, information such as aΔt, a2Δt, a3Δt, ... is recorded in sequence in the sensor information storage DB 290 until step S2.5 is implemented.

[0134] (Step S2.4)

[0135] The auxiliary information receiving unit 240 receives auxiliary information from the password authentication device 100 , and transmits the received auxiliary information to the authentication operation determination unit 250 .

[0136] (Step S2.5)

[0137] The storage stop request unit 220 instructs the sensor 201 to end monitoring the password authentication device 100 .

[0138] (Step S2.6)

[0139] The authentication operation determination unit 250 recognizes the password input operation of the user.

[0140] The authentication action determination unit 250 obtains sensor information from the sensor information storage DB 290, obtains auxiliary information from the auxiliary information receiving unit 240, and corrects the obtained sensor information using the obtained auxiliary information. Then, the authentication action determination unit 250 determines whether the user has performed the password input action by determining whether the password input action corresponding to the corrected sensor information and the password input action obtained from the password authentication action DB 291 are consistent.

[0141] A specific example of the determination process performed by the authentication operation determination unit 250 is shown.

[0142] Here, for the sake of simplicity, it is assumed that the timing of the user inputting a character is the same as the timing of the sensor 201 acquiring the sound. That is, it is assumed that the sound signal acquired by the sensor 201 when the password pass is entered is a(t)=[a1Δt, a2Δt, a3Δt, a4Δt]. Here, a1Δt represents the sound pressure acquired by the microphone when the user enters p, a2Δt represents the sound pressure acquired by the microphone when the user enters a, and a3Δt and a4Δt respectively represent the sound pressure acquired by the microphone when the user enters s. Below, the sound pressure generated when the key corresponding to a certain character c is pressed is expressed as vc. That is, the sound pressure signal acquired by the sensor 201 when the password pass is entered is a(t)=[vp, va, vs, vs].

[0143] When the password is pass, pass is 4 characters, and therefore, four sound pressure information items, namely, vp, va, vs, vs, are stored in the password authentication operation DB 291 in advance.

[0144] Here, the user executes [p][a][w][BS][s][s] on the password authentication device 100 . Therefore, the sensor information acquisition unit 230 acquires sound pressure information from the microphone in the order of vp, va, vw, vBS, vs, vs, and records the acquired sound pressure information in the sensor information storage DB 290 .

[0145] Here, when the sound pressure information vp, va, vw, vBS, vs, vs obtained from the microphone is simply compared with the sound pressure information vp, va, vs, vs recorded in the password authentication action DB291, the two are inconsistent, so it is determined that the user has not performed the password input action.

[0146] However, by using auxiliary information such as "the user pressed BS at the 4th character", the 4th sound pressure information among vp, va, vw, vBS, vs, vs corresponds to the sound pressure for deleting the character, so it can be known that the character corresponding to the 3rd sound pressure is deleted. That is, it can be known that the 3rd sound pressure and the 4th sound pressure are not necessary when the password is input with the minimum number of inputs, that is, the sound pressure information obtained when the password input action is performed with the minimum number of inputs is vp, va, vs, vs. This sound pressure information is consistent with the sound pressure information vp, va, vs, vs recorded in the password authentication action DB291. Therefore, the authentication action determination unit 250 can determine that the user has performed the password input action.

[0147] (Step S2.7)

[0148] The transmission request receiving unit 260 receives data indicating a transmission request from the authentication device 300 .

[0149] (Step S2.8)

[0150] The determination result acquisition unit 270 determines whether the determination result of the authentication operation determination unit 250 indicates a successful state. In other words, the determination result acquisition unit 270 determines whether the authentication operation determination unit 250 recognizes that the user has performed a password input operation.

[0151] If the determination result of the authentication operation determination unit 250 indicates a successful state, the additional authentication device 200 proceeds to step S2.9. In other cases, the additional authentication device 200 ends the processing of this flowchart.

[0152] (Step S2.9)

[0153] The additional authentication information transmission unit 280 acquires the user additional authentication information from the additional authentication information DB 292. In the present embodiment, the user additional authentication information is information including a 128-bit secret key generated by AES.

[0154] (Step S2.10)

[0155] The additional authentication information transmitting unit 280 transmits the acquired user additional authentication information to the authentication device 300 .

[0156] (Step S3.1)

[0157] The password receiving unit 310 receives the user password from the password authentication device 100 .

[0158] (Step S3.2)

[0159] The password verification unit 320 obtains an authentication result corresponding to the password authentication. Specifically, the password verification unit 320 obtains a password from the password storage DB 390, and determines whether the obtained password and the user password are consistent.

[0160] When the acquired password and the user password are consistent, the authentication device 300 executes step S3.3.

[0161] (Step S3.3)

[0162] The transmission request transmission unit 330 transmits data indicating a transmission request to the additional authentication device 200 .

[0163] (Step S3.4)

[0164] The additional authentication information receiving unit 340 receives user additional authentication information from the additional authentication device 200 .

[0165] (Step S3.5)

[0166] The additional authentication information verification unit 350 obtains an authentication result corresponding to the additional authentication. Specifically, the additional authentication information verification unit 350 obtains the registered additional authentication information from the additional authentication information DB 391, and determines whether the obtained registered additional authentication information and the user additional authentication information are consistent.

[0167] (Step S3.6)

[0168] The authentication result determination unit 360 integrates the authentication result corresponding to the password authentication and the authentication result corresponding to the additional authentication, thereby obtaining a final authentication result.

[0169] Specifically, when both the authentication result corresponding to the password authentication and the authentication result corresponding to the additional authentication indicate a success, the authentication result determination unit 360 sets the final authentication result to a success state. Otherwise, the authentication result determination unit 360 sets the final authentication result to a failure state.

[0170] ***Description of the Effects of Implementation Method 1***

[0171] As described above, the two-factor authentication system of this embodiment has relatively high authentication accuracy by utilizing auxiliary information even when the user fails to input the password within the minimum number of character input times.

[0172] ***Other structures***

[0173] <Modification 1>

[0174] Fig. 9 A hardware configuration example of a computer 10 according to this modification is shown.

[0175] The computer 10 includes a processing circuit 18 instead of the processor 11 , the processor 11 and the memory 12 , the processor 11 and the auxiliary storage device 13 , or the processor 11 , the memory 12 , and the auxiliary storage device 13 .

[0176] The processing circuit 18 is hardware that realizes at least a part of each unit included in the computer 10 .

[0177] The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the memory 12 .

[0178] When the processing circuit 18 is dedicated hardware, as a specific example, the processing circuit 18 is a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0179] The computer 10 may include a plurality of processing circuits instead of the processing circuit 18. The plurality of processing circuits may share the role of the processing circuit 18.

[0180] In the computer 10 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0181] As a specific example, the processing circuit 18 is implemented by hardware, software, firmware, or a combination thereof.

[0182] The processor 11, the memory 12, the auxiliary storage device 13, and the processing circuit 18 are collectively referred to as a “processing circuit.” That is, the functions of each functional component of each device are realized by the processing circuit.

[0183] The computer 10 according to other embodiments may have the same configuration as that of this modification.

[0184] Implementation Method 2

[0185] Hereinafter, mainly points different from the above-described embodiment will be described with reference to the drawings.

[0186] ***Description of the structure***

[0187] In the first embodiment, the character input accepting unit 130 may start operating without waiting for the sensor information acquiring unit 230 to start operating. That is, the user may start the password input operation or the user may complete the password input operation before the additional authentication device 200 starts monitoring the password authentication device 100. In these cases, the additional authentication device 200 fails to determine whether the user has performed the password input operation.

[0188] In the second embodiment, a configuration and operation for preventing the password input operation from being started before the additional authentication device 200 starts monitoring the password authentication device 100 will be described.

[0189] In this embodiment, the configurations of the password authentication device 100 and the additional authentication device 200 are different from those described in the first embodiment.

[0190] Fig.10 FIG. 2 shows an example of a functional configuration of the password authentication device 100 according to the present embodiment. Fig.10 As shown in FIG. 1 , the password authentication device 100 further includes an input permission receiving unit 131. Next, differences from the first embodiment will be described.

[0191] The input permission receiving unit 131 receives data indicating character input permission (hereinafter simply referred to as input permission) from the additional authentication device 200 , and transmits the received data to the character input accepting unit 130 .

[0192] The character input accepting unit 130 accepts character input from the user. However, the character input accepting unit 130 does not accept character input from the user until it receives data indicating input permission from the input permission receiving unit 131. That is, the user cannot input characters to the password authentication device 100 until the character input accepting unit 130 receives data indicating input permission. As a specific example, the character input accepting unit 130 permits the user to input the target password when receiving input permission information from the additional authentication device 200. The input permission information is information indicating that password input is permitted. The character input accepting unit 130 records the characters whose input is accepted in the input character DB 190.

[0193] Fig.11 FIG. 2 shows an example of the functional configuration of the additional authentication device 200 according to the present embodiment. Fig.11 As shown in FIG. 1 , the additional authentication device 200 further includes an input permission transmitting unit 231. Next, differences from the first embodiment will be described.

[0194] The sensor information acquisition unit 230 acquires sensor information indicating the monitoring result of the sensor 201 from the sensor 201. Furthermore, the sensor information acquisition unit 230 transmits data indicating input permission to the input permission transmission unit 231 when starting to acquire the sensor information.

[0195] The input permission transmission unit 231 transmits data indicating input permission to the password authentication device 100 based on the data received from the sensor information acquisition unit 230. That is, the input permission transmission unit 231 transmits input permission information to the password authentication device 100 when the sensor 201 is operating.

[0196] ***Description of the action***

[0197] Fig.12 is a flowchart showing an example of the operation of the additional authentication device 200 and the password authentication device 100 in Embodiment 2. Fig.12 , the differences from Implementation 1 are explained.

[0198] (Step S1.1)

[0199] The storage start request transmission unit 110 transmits data indicating a storage start request to the additional authentication device 200 .

[0200] (Step S1.2)

[0201] The authentication interface display unit 120 displays an authentication interface to the user.

[0202] (Step S1.2-2)

[0203] The input permission receiving unit 131 receives data indicating input permission.

[0204] The subsequent operation example is the same as the operation example after step S1.3 in the first embodiment.

[0205] (Step S2.1)

[0206] The storage start request receiving unit 210 receives data indicating a storage start request, and instructs the sensor 201 to start monitoring the password authentication device 100 according to the received data.

[0207] (Step S2.2)

[0208] The sensor information acquisition unit 230 acquires sensor information from the sensor 201. When acquiring sensor information for the first time, the sensor information acquisition unit 230 instructs the input permission transmission unit 231 to transmit data indicating input permission to the password authentication device 100.

[0209] (Step S2.3)

[0210] The sensor information acquisition unit 230 stores the acquired sensor information in the sensor information storage DB 290 .

[0211] (Step S2.11)

[0212] The input permission transmitting unit 231 transmits data indicating input permission to the password authentication device 100 .

[0213] The other operation examples are the same as those in the first embodiment.

[0214] ***Description of the Effects of Implementation Method 2***

[0215] As described above, according to the present embodiment, the user cannot start inputting a password before the additional authentication device 200 starts monitoring the password authentication device 100. That is, according to the present embodiment, it is possible to prevent the user from starting the password input action before the additional authentication device 200 starts monitoring the password authentication device 100, and to realize a two-factor authentication system with higher authentication accuracy.

[0216] ***Other structures***

[0217] <Modification 2>

[0218] Fig.13 FIG. 2 shows an example of the functional configuration of the additional authentication device 200 according to this modification. Fig.13 As shown, the storage start request receiving unit 210 may send data indicating input permission to the input permission sending unit 231. That is, the storage start request receiving unit 210 may instruct the sensor 201 to start monitoring the password authentication device 100 and send data indicating input permission to the input permission sending unit 231.

[0219] Implementation 3

[0220] Hereinafter, mainly points different from the above-described embodiment will be described with reference to the drawings.

[0221] ***Description of the structure***

[0222] In the second embodiment, the additional authentication device 200 and the password authentication device 100 communicate directly. However, when the two communicate directly, the password authentication device 100 can understand that the additional authentication device 200 is in a communicable state when the communication with the additional authentication device 200 is successful, and can understand that the additional authentication device 200 is in a non-communicable state when the communication with the additional authentication device 200 fails. That is, in the second embodiment, there is a problem related to privacy that the password authentication device 100 can understand whether the additional authentication device 200 has been activated.

[0223] Therefore, in order to solve this problem, in the third embodiment, the additional authentication device 200 and the password authentication device 100 do not communicate directly but communicate via the intermediate device 400 .

[0224] Fig.14FIG. 9 shows an example of the structure of a two-factor authentication system 90 according to the present embodiment. Fig.14 As shown, the two-factor authentication system 90 further includes an intermediary device 400. In the present embodiment, the additional authentication device 200 and the password authentication device 100 do not communicate directly but communicate via the intermediary device 400.

[0225] The intermediary device 400 mediates the communication between the password authentication device 100 and the additional authentication device 200. It is assumed that the intermediary device 400 is always operating during the operation of the two-factor authentication system 90.

[0226] Furthermore, the configuration of the authentication device 300 of the present embodiment is different from that of the authentication device 300 of the second embodiment.

[0227] Fig.15 FIG. 4 shows an example of a functional structure of the mediation device 400. Fig.15 As shown, the intermediary device 400 has an auxiliary information receiving unit 410, an auxiliary information sending unit 420, a storage start request receiving unit 430, a storage start request sending unit 440, an input permission receiving unit 450, an input request intermediary unit 460, an input permission sending unit 470 and a communication failure information sending unit 480.

[0228] The auxiliary information receiving unit 410 receives auxiliary information from the password authentication device 100 , and transmits the received auxiliary information to the auxiliary information transmitting unit 420 .

[0229] However, when the communication between the intermediate device 400 and the additional authentication device 200 fails, the auxiliary information receiving unit 410 instructs the communication failure information transmitting unit 480 to operate.

[0230] The auxiliary information transmitting unit 420 transmits the auxiliary information received from the auxiliary information receiving unit 410 to the additional authentication device 200. That is, the auxiliary information transmitting unit 420 transmits the auxiliary information received from the password authentication device 100 to the additional authentication device 200.

[0231] The storage start request receiving unit 430 receives data indicating a storage start request from the password authentication device 100, and transmits the received data to the storage start request transmitting unit 440. In addition, the storage start request receiving unit 430 transmits information indicating that the data indicating a storage start request has been transmitted to the storage start request transmitting unit 440 (hereinafter also referred to as transmitted information) to the input request intermediary unit 460.

[0232] Storage start request transmitter 440 transmits data indicating the storage start request received from storage start request receiver 430 to additional authentication device 200. However, if communication with additional authentication device 200 fails when transmitting the data, storage start request transmitter 440 instructs communication failure information transmitter 480 to operate.

[0233] The input permission receiving unit 450 receives the input permission signal from the additional authentication device 200, and transmits the received input permission signal to the input request intermediary unit 460. If the communication between the intermediary device 400 and the additional authentication device 200 fails, the input permission receiving unit 450 does not operate.

[0234] The input request intermediary unit 460 receives the sent information from the storage start request receiving unit 430, and after k seconds have passed since the sent information was received, transmits data indicating input permission to the input permission transmitting unit 470. Here, k is an arbitrary positive number. k seconds is a specific example of the intermediary time. The time point when the input request intermediary unit 460 transmits the data indicating input permission to the input permission transmitting unit 470 is the transmission judgment time point. The transmission judgment time point is the time point when more than the intermediary time has passed since the intermediary device 400 received the storage start request information from the password authentication device 100. The storage start request information is data indicating an instruction to the additional authentication device 200 to monitor the password authentication device 100.

[0235] In addition, when k seconds have passed since the transmitted information was received and the data indicating input permission has not been received from the input permission receiving unit 450, the input request intermediary unit 460 transmits the communication failure information to the communication failure information transmitting unit 480. That is, when the input request intermediary unit 460 has not received the data indicating input permission from the input permission receiving unit 450 within the period of k seconds, the communication failure information transmitting unit 480 is instructed to perform an operation.

[0236] The input permission sending unit 470 receives data indicating input permission from the input request intermediary unit 460, and sends the received data to the password authentication device 100. As a specific example, when the intermediary device 400 receives input permission information from the additional authentication device 200 at the transmission determination time point, the input permission sending unit 470 sends the input permission information to the password authentication device 100.

[0237] The communication failure information transmission unit 480 transmits the communication failure information to the authentication device 300 when instructed to operate by at least any one of the auxiliary information transmission unit 420 , the storage start request transmission unit 440 , and the input request intermediary unit 460 .

[0238] The storage start request transmission unit 110 of the present embodiment transmits storage start request information, which is data indicating a storage start request, to the intermediate device 400 .

[0239] As a specific example, when receiving input permission information from the intermediary device 400 , the character input accepting unit 130 of the present embodiment permits the user to input a target password.

[0240] The auxiliary information transmitting unit 180 of the present embodiment transmits the auxiliary information generated by the auxiliary information generating unit 170 to the intermediate device 400 .

[0241] The storage start request receiving unit 210 of the present embodiment receives data indicating a storage start request from the intermediate device 400 .

[0242] The auxiliary information receiving unit 240 of the present embodiment receives auxiliary information from the intermediary device 400 .

[0243] The input permission transmission unit 231 of the present embodiment transmits input permission information to the intermediate device 400 when the sensor 201 is operating.

[0244] Fig.16 FIG. 2 shows an example of a functional configuration of the authentication device 300 according to the present embodiment. Fig.16 As shown in FIG. 1 , authentication apparatus 300 further includes communication failure information receiving unit 370. Next, differences from authentication apparatus 300 of Embodiment 2 will be described.

[0245] The communication failure information receiving unit 370 receives the communication failure information from the intermediate device 400 , and when receiving the communication failure information, instructs the additional authentication information verifying unit 350 to set the result of the additional authentication as failure.

[0246] The additional authentication information verification unit 350 compares the registered additional authentication information with the user additional authentication information to obtain an authentication result corresponding to the additional authentication. However, if the communication failure information receiving unit 370 instructs the additional authentication to fail, the additional authentication information verification unit 350 sets the authentication result of the additional authentication to fail.

[0247] The other functional structures are the same as those in Implementation Example 2.

[0248] ***Description of the action***

[0249] Fig.17 and Fig.18 1 is a flowchart showing an example of the operation of the two-factor authentication system 90 according to the third embodiment. Fig.17 and Fig.18 , the differences from Implementation 2 are explained.

[0250] (Step S2.1)

[0251] The storage start request receiving unit 210 receives data indicating a storage start request.

[0252] (Step S2.11)

[0253] The input permission transmission unit 231 transmits data indicating input permission to the intermediary device 400 .

[0254] (Step S2.12)

[0255] The auxiliary information receiving unit 240 receives auxiliary information from the intermediary device 400 .

[0256] (Step S1.1)

[0257] The storage start request transmission unit 110 transmits data indicating a storage start request to the intermediate device 400 .

[0258] (Step S1.6)

[0259] The auxiliary information transmitting unit 180 transmits the auxiliary information to the intermediate device 400 .

[0260] (Step S4.1)

[0261] The storage start request receiving unit 430 receives data indicating a storage start request.

[0262] (Step S4.2)

[0263] The storage start request transmission unit 440 transmits data indicating a storage start request to the additional authentication device 200 .

[0264] (Step S4.3)

[0265] The storage start request transmitter 440 determines whether the communication with the additional authentication device 200 has failed in step S4.2. If the communication with the additional authentication device 200 has failed, the intermediate device 400 proceeds to step S4.4. Otherwise, the intermediate device 400 proceeds to step S4.5 and step S4.6.

[0266] (Step S4.4)

[0267] The communication failure information transmission unit 480 transmits the communication failure information to the authentication device 300 .

[0268] (Step S4.5)

[0269] The input permission receiving unit 450 receives data indicating input permission from the additional authentication device 200 .

[0270] (Step S4.6)

[0271] In parallel with step S4.5, the input request intermediary 460 waits for k seconds.

[0272] (Step S4.7)

[0273] The input request intermediary 460 determines whether data indicating input permission is received in step S4.5. That is, the input request intermediary 460 determines whether data indicating input request is received in step S4.5 during the k seconds of waiting in step S4.6. If data indicating input permission is received in step S4.5, the intermediary device 400 proceeds to step S4.9. Otherwise, the intermediary device 400 proceeds to step S4.8.

[0274] Here, the reason why the input request intermediary unit 460 waits for k seconds is that when the input permission receiving unit 450 immediately sends data indicating input permission to the input permission sending unit 470 after receiving the input permission, the password authentication device 100 that receives the input request knows that the additional authentication device 200 is in a communicable state. That is, by making the input request intermediary unit 460 wait for k seconds regardless of whether the additional authentication device 200 is in a communicable state, it is difficult for the password authentication device 100 to grasp the state of the additional authentication device 200.

[0275] (Step S4.8)

[0276] The communication failure information transmission unit 480 transmits the communication failure information to the authentication device 300 .

[0277] (Step S4.9)

[0278] The input permission transmitting unit 470 transmits data indicating input permission to the password authentication device 100 .

[0279] (Step S4.10)

[0280] The auxiliary information receiving unit 410 receives auxiliary information from the password authentication device 100 .

[0281] (Step S4.11)

[0282] The auxiliary information transmitting unit 420 transmits the auxiliary information to the additional authentication device 200 .

[0283] (Step S4.12)

[0284] The auxiliary information transmitting unit 420 determines whether the communication with the additional authentication device 200 has failed in step S4.10. If the communication with the additional authentication device 200 has failed, the intermediate device 400 proceeds to step S4.12.

[0285] (Step S4.13)

[0286] The communication failure information transmission unit 480 transmits the communication failure information to the authentication device 300 .

[0287] (Step S3.7)

[0288] In parallel with step S3 . 1 , the communication failure information receiving unit 370 receives communication failure information from the mediation device 400 .

[0289] (Step S3.8)

[0290] The additional authentication information verification unit 350 determines whether the communication failure information is received in step S3.7. If the communication failure information is received in step S3.7, the authentication device 300 proceeds to step S3.9. Otherwise, the authentication device 300 proceeds to step S3.5.

[0291] (Step S3.9)

[0292] The additional authentication information verification unit 350 sets the authentication result corresponding to the additional authentication as failure.

[0293] The other operation examples are the same as those in the second embodiment.

[0294] ***Description of the Effects of Implementation Method 3***

[0295] As described above, according to the present embodiment, the password authentication device 100 and the additional authentication device 200 communicate via the intermediate device 400, thereby realizing the two-factor authentication system 90 which takes privacy into consideration and has higher authentication accuracy.

[0296] ***Other Implementations***

[0297] The above-described embodiments may be freely combined, arbitrary components of the embodiments may be modified, or arbitrary components of the embodiments may be omitted.

[0298] In addition, the embodiment is not limited to the contents described in Embodiments 1 to 3, and various changes can be made as needed. The steps described using flowcharts and the like can also be appropriately changed.

[0299] Description of symbols

[0300] 10: Computer; 11: Processor; 12: Memory; 13: Auxiliary storage device; 14: Input / output IF; 15: Communication device; 18: Processing circuit; 19: Signal line; 90: Two-factor authentication system; 100: Password authentication device; 110: Storage start request sending unit; 120: Authentication interface display unit; 130: Character input receiving unit; 131: Input permission receiving unit; 140: Password input completion receiving unit; 150: Password creation unit; 160: Password sending unit; 170: Auxiliary information creation unit; 180: Auxiliary information sending unit; 190: Input character DB; 200: Additional authentication device; 201: Sensor; 210: Storage start request receiving unit; 220: Storage stop request unit; 230: Sensor information acquisition unit; 231: Input permission sending unit; 240: Auxiliary information receiving unit; 250: Authentication action determination unit; 260: 1. Sending request receiving unit; 270: determination result obtaining unit; 280: additional authentication information sending unit; 290: sensor information storage DB; 291: password authentication action DB; 292: additional authentication information DB; 300: authentication device; 310: password receiving unit; 320: password verification unit; 330: sending request sending unit; 340: additional authentication information receiving unit; 350: additional authentication information verification unit; 360: authentication result determination unit; 370: communication failure information receiving unit; 390: password storage DB; 391: additional authentication information DB; 400: intermediary device; 410: auxiliary information receiving unit; 420: auxiliary information sending unit; 430: storage start request receiving unit; 440: storage start request sending unit; 450: input permission receiving unit; 460: input request intermediary unit; 470: input permission sending unit; 480: communication failure information sending unit.

Claims

1. A two-factor authentication system comprising a password authentication device for a user to input a target password, and an additional authentication device for monitoring the password authentication device using a sensor, wherein: The two-factor authentication system includes an additional authentication device, which includes an authentication action determination unit. The authentication action determination unit determines whether the user has input the object password into the password authentication device based on auxiliary information indicating an operation performed by the user on the password authentication device when the user inputs the object password and information obtained by the sensor during a time period when the user inputs the object password, when the number of character inputs when the user inputs the object password into the password authentication device is not a minimum number of times for inputting the object password.

2. The two-factor authentication system according to claim 1, wherein: The auxiliary information includes information indicating that the user has performed a task of erroneously inputting and that the user has corrected the erroneously inputting.

3. The two-factor authentication system according to claim 1 or 2, wherein: The authentication operation determination unit uses a rule corresponding to a task executed when the target password is input to the password authentication device, when determining whether the user has input the target password to the password authentication device.

4. The two-factor authentication system according to any one of claims 1 to 3, wherein: The two-factor authentication system further includes an authentication device including an authentication result determination unit that determines an authentication result corresponding to the object password input to the password authentication device based on the object password input to the password authentication device and a result of determining whether the user has input the object password.

5. The two-factor authentication system according to any one of claims 1 to 4, wherein: The password authentication device comprises: an auxiliary information producing unit that produces the auxiliary information; and The auxiliary information transmitting unit transmits the generated auxiliary information to the additional authentication device.

6. The two-factor authentication system according to any one of claims 1 to 5, wherein: The additional authentication device further includes an input permission transmitting unit that transmits input permission information indicating that password input is permitted to the password authentication device when the sensor is operating. The password authentication device further includes a character input accepting unit that permits the user to input the target password when receiving the input permission information from the additional authentication device.

7. The two-factor authentication system according to any one of claims 1 to 4, wherein: The two-factor authentication system further includes an intermediary device that mediates communication between the password authentication device and the additional authentication device. The additional authentication device further includes an input permission transmitting unit that transmits input permission information indicating that input of a password is permitted to the intermediary device when the sensor is operating. The password authentication device comprises: an auxiliary information producing unit, which produces the auxiliary information; an auxiliary information sending unit, which sends the prepared auxiliary information to the intermediary device; as well as a storage start request sending unit that sends storage start request information indicating an instruction for the additional authentication device to monitor the password authentication device to the intermediate device, The intermediary device has: an input permission sending unit that sends the input permission information to the password authentication device when the intermediary device receives the input permission information from the additional authentication device at a sending determination time point, wherein the sending determination time point is a time point that has passed more than the intermediary time since the intermediary device received the storage start request information from the password authentication device; as well as an auxiliary information sending unit that sends the auxiliary information received from the password authentication device to the additional authentication device, The password authentication device further includes a character input accepting unit that permits the user to input the target password when receiving the input permission information from the intermediary device.

8. A two-factor authentication method in a two-factor authentication system, the two-factor authentication system comprising a computer as a password authentication device for a user to input a target password, and a computer as an additional authentication device for monitoring the password authentication device using a sensor, wherein: The computer serving as the additional authentication device determines whether the user has input the object password into the password authentication device based on auxiliary information indicating an operation performed by the user on the password authentication device when the user inputs the object password and information obtained by the sensor during a time period when the user inputs the object password, when the number of character inputs when the user inputs the object password into the password authentication device is not a minimum number of times for inputting the object password.

9. A two-factor authentication program in a two-factor authentication system, the two-factor authentication system comprising a computer as a password authentication device for a user to input a target password, and a computer as an additional authentication device for monitoring the password authentication device using a sensor, wherein: The two-factor authentication program causes the computer serving as the additional authentication device to perform the following authentication action determination processing: when the number of character inputs when the user inputs the object password into the password authentication device is not a minimum number of times for inputting the object password, it is determined whether the user has input the object password into the password authentication device based on auxiliary information indicating an operation performed by the user on the password authentication device when the user inputs the object password and information obtained by the sensor during a time period when the user inputs the object password.

Images