Program, information processing device and information processing method

Abstract

To avoid restrictions because identification information to be registered by a user is duplicated by identification information of other users.SOLUTION: A program causes a computer to execute: an information acceptance function for accepting external identification information for identifying a service user between the user and the computer, and authentication information for performing user authentication from a user device of the user; a generation function for generating internal identification information for identifying the user by the computer on the basis of the external identification information and the authentication information; a registration function for associating the external identification information with the authentication information and with the internal authentication information to register them in an identification storage unit; a request acceptance function for accepting an authentication request which authenticates the user and is an authentication request including the external identification information and the authentication information from the user device; and an authentication function for acquiring the internal identification information from at least a portion of the external identification information and the authentication information with reference o the identification storage unit in response to the authentication request, and executing processing for authenticating the user by using the internal identification information.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a program, an information processing device, and an information processing method. [Background technology]

[0002] There is known a technology in which an email address, an arbitrary character string, or the like is registered in a system as identification information (so-called user ID, etc.) for a user to identify himself / herself, and authentication and access control are performed based on this identification information. Patent Document 1 describes an information processing device that registers a customer ID that uniquely identifies a customer upon receiving biometric authentication information of the customer from a customer terminal. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2022-145828 A Summary of the Invention [Problem to be solved by the invention]

[0004] Here, in the above-mentioned Patent Document 1, since identification information such as a user ID is unique information within the system, if a user's desired identification information has already been registered by another user, the user cannot register the desired identification information.

[0005] In view of the above problems, the present invention aims to provide a program, an information processing device, and an information processing method that prevent the identification information that a user registers to identify himself or herself from being restricted due to duplication with the identification information of other users. [Means for solving the problem]

[0006] A program according to one aspect of the present invention causes a computer to realize an information receiving function that receives, from a user device of a user of a service or a provider device of a provider providing a service, external identification information for identifying the user between the user and the computer and authentication information for performing user authentication using the external identification information, a generation function that generates internal identification information for identifying the user on the computer based on the external identification information and at least a portion of the authentication information, a registration function that associates the external identification information and at least a portion of the authentication information with the internal identification information and registers them in an identification memory unit, a request receiving function that receives, from the user device or the provider device, an authentication request for authenticating the user, the authentication request including the external identification information and the authentication information, and an authentication function that, in response to the authentication request, refers to the identification memory unit to obtain internal identification information from at least a portion of the external identification information and authentication information, and performs processing for authenticating the user using the internal identification information.

[0007] An information processing device according to one embodiment of the present invention includes an information receiving unit that receives, from a user device of a user of a service or a provider device of a provider providing a service, external identification information for identifying the user between the user and a computer and authentication information for authenticating the user using the external identification information; a generation unit that generates internal identification information for identifying the user on the computer based on the external identification information and at least a portion of the authentication information; a registration unit that associates the external identification information, at least a portion of the authentication information, and the internal identification information and registers them in an identification memory unit; a request receiving unit that receives, from the user device or the provider device, an authentication request for authenticating the user, the authentication request including the external identification information and the authentication information; and an authentication unit that, in response to the authentication request, refers to the identification memory unit to obtain internal identification information from the external identification information and at least a portion of the authentication information, and performs processing for authenticating the user using the internal identification information.

[0008] An information processing method according to one aspect of the present invention includes a computer receiving, from a user device of a user of a service or a provider device of a provider providing the service, external identification information for identifying the user between the user and the computer and authentication information for authenticating the user using the external identification information, generating internal identification information for identifying the user in the computer based on the external identification information and at least a portion of the authentication information, associating the external identification information and at least a portion of the authentication information with the internal identification information and registering them in an identification memory unit, receiving an authentication request for authenticating the user from the user device or the provider device, the authentication request including the external identification information and the authentication information, and in response to the authentication request, referencing the identification memory unit to obtain internal identification information from the external identification information and at least a portion of the authentication information, and performing processing for authenticating the user using the internal identification information. Effect of the Invention

[0009] According to the present invention, it is possible to prevent the content of identification information registered by a user to identify himself / herself from being restricted due to duplication with identification information of other users. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a system configuration of an ID management system according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram for explaining an overview of an ID management system according to an embodiment of the present invention. [Diagram 3] FIG. 1 is a diagram for explaining an overview of an ID management system according to an embodiment of the present invention. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a server device according to the present embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an example of a data configuration of an ID management system according to the present embodiment. [Figure 6] FIG. 4 is a diagram illustrating an example of the operation of the server device according to the embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of a hardware configuration of a server device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] A preferred embodiment of the present invention (hereinafter, referred to as "the present embodiment") will be described with reference to the accompanying drawings. In each drawing, the same reference numerals denote the same or similar configurations.

[0012] In the present invention, "part", "means", "apparatus" or "system" does not simply mean physical means, but also includes cases where the functions of the "part", "means", "apparatus" or "system" are realized by software. In addition, the functions of one "part", "means", "apparatus" or "system" may be realized by a combination of two or more physical means, devices or software modules, and the functions of two or more "parts", "means", "apparatus" or "systems" may be realized by one physical means, device or software module.

[0013] <1. System configuration> An example of the system configuration of an ID management system 1 according to this embodiment will be described with reference to Fig. 1. As shown in Fig. 1, the ID management system 1 manages identification information for identifying a user (hereinafter also referred to as "user ID") as a so-called digital identity, and authenticates the user (hereinafter also referred to as "user authentication") using the managed user ID. Specifically, the ID management system 1 ensures security by performing user authentication one or more times when the user uses a service (hereinafter also referred to as "linked service") linked with the ID management system 1. In other words, the user may be a customer of the linked service.

[0014] The user ID includes, for example, (a) external identification information (hereinafter also referred to as "external ID") for identifying the user between the user and a computer (including a computer of the ID management system 1 and / or a system linked to the ID management system 1 (hereinafter also referred to as "linked system")), and (b) internal identification information (hereinafter also referred to as "internal ID") for identifying the user on the computer. The external ID is also information that allows the user to identify himself / herself to the computer.

[0015] The external ID may be, for example, the user's email address, an ID of a linked service such as a card number or a membership number, or any character string combining letters, numbers, symbols, etc. (for example, a nickname, etc.). The external ID does not have to be information such as a character string recognizable by the user, but may be anything that can be used as an identifier, and may be, for example, a token used for token payment or token-based authentication. This token may be, for example, another character string replacing information of a credit card that the user can use, or an authentication token such as JWT (JSON Web Token), etc. The token may be stored in a device such as the user device 200, for example.

[0016] The internal ID may be any information that can uniquely identify a user on a computer, and may be, for example, information different from the combination of the external ID and the external branch ID described below, or may be the same information as this combination. The internal ID may be, for example, any character string that combines letters, numbers, symbols, etc. Also, the internal ID may be any information that can be used as an identifier, even if it is not a character string or other information that can be recognized by the user.

[0017] The ID management system 1 includes a server device 100 that manages user IDs, a user device 200 of a user, and a provider device 300 of a provider that provides an associated service. The provider device 300 may be, for example, a device of an association system 3 for providing an associated service.

[0018] User authentication may be, for example, authentication for confirming the legitimacy of a user. User authentication may be performed once or multiple times. Performing user authentication multiple times may mean, for example, performing multi-factor authentication such as two-factor authentication using multiple authentication factors, or performing multi-stage authentication such as two-stage authentication performing authentication in stages. As another example, performing user authentication multiple times may mean performing two or more authentications with different authentication levels.

[0019] The authentication level may represent, for example, the strength of an authentication means. The authentication level may represent, for example, whether or not the authentication is multi-factor authentication. The authentication level may represent, for example, whether or not the authentication is multi-stage authentication. The authentication level may represent, for example, whether or not the authentication is multi-path authentication.

[0020] The user authentication may be, for example, authentication defined by NIST SP 800-63-3. The authentication level applied to the user authentication may be, for example, AAL (Authenticator Assurance Level) defined by NIST SP 800-63B as follows: Level 1: Of the three elements of information used for user authentication (hereafter also referred to as "authentication information") (knowledge, possession, and biometrics), one or more elements must be used, and there is a certain degree of reliability in authenticating the person. In other words, this can be achieved by performing at least single-factor authentication. Level 2: Of the three factors, multiple factors such as ID password + one-time password must be used, and there is a considerable degree of reliability in authenticating the person. Unlike level 3, level 2 can also be achieved by using software as the second factor authentication method. Level 3: Two-factor authentication, and the second factor must be authenticated using tamper-resistant hardware, providing a very high degree of reliability in authenticating the user (specifically, a PIN code + a card with an embedded IC chip (hereinafter also referred to as an "IC card") + My Number card, etc.).

[0021] The authentication information may be, for example, information possessed by the user, biometric information, and / or stored information.

[0022] The possession information may be, for example, device identification information that identifies a device (e.g., a user device 200 such as a smartphone) that is possessed by the user or information stored on an IC card, and / or location information that indicates the location of the possession.

[0023] The biometric information may be, for example, information about a user's physical appearance, fingerprint, palm print, voice print, and / or iris.

[0024] The stored information may be, for example, a user ID that identifies the user in the ID management system 1, a card number used to settle a transaction, an account number, a telephone number, an account name such as an email address, a password, a signature or figure entered or selected by the user, a free-entry or multiple-choice answer to a specified question, or any other information that is stored by the user and can be retrieved by the server device 100.

[0025] When the user authentication uses at least one of a plurality of authentication means (e.g., when multi-factor authentication or multi-stage authentication is used), the authentication information may include, for example, authentication information for each of the plurality of authentication means. The authentication means may be, for example, a means for user authentication based on possession information related to possessions held by the user, biometric information related to the biometric information of the user, or memory information stored by the user.

[0026] The server device 100, the user device 200, and the provider device 300 are connected to each other via a network N.

[0027] The server device 100 is an information processing device capable of communicating with the user device 200 and the provider device 300. The server device 100 executes a predetermined program to provide a management function for managing user IDs and an authentication function for user authentication for the linked service provided by the provider device 300.

[0028] For example, the server device 100 may provide a website of a linked service to a user. When a three-tiered web architecture or the like is adopted for providing the website, the server device 100 may be a web server, an AP server, and / or a DB server.

[0029] The provider device 300 is an information processing device used by a provider and capable of communicating with the server device 100 and the user device 200. The provider device 300 may realize a server function of providing an integrated service to a user by executing a predetermined program.

[0030] The user device 200 is an information processing device used by a user, and is, for example, a mobile device such as a smartphone, a laptop, or a tablet. The user device 200 executes a predetermined program to receive various requests from the user, to cooperate with the server device 100 and / or the provider device 300 to receive an authentication request for user authentication when logging in to an integrated service, and to output a screen of a website of the integrated service or an application dedicated to the integrated service after logging in.

[0031] The network N is composed of a wireless network or a wired network. Examples of the network N include a mobile phone network, a PHS (Personal Handy-phone System) network, a wireless LAN (Local Area Network, including communication conforming to IEEE802.11 (so-called WI / Fi (registered trademark))), 3G (3rd Generation), LTE (Long Term Evolution), 4G (4th Generation), 5G (5th Generation), WiMax (registered trademark), infrared communication, visible light communication, Bluetooth (registered trademark), a wired LAN, a telephone line, a power line communication, a power line network, a network conforming to IEEE1394, etc.

[0032] <2. Overview> An overview of an example of the ID management system 1 will be described with reference to Figs. 2-3. In the example of Figs. 2-3, an example will be described in which the server device 100 plays the role of an authentication server and realizes single sign-on (hereinafter, also referred to as "SSO"). Fig. 2 describes the processing in the ID management system 1 for creating a new account for a linked service, from accepting an external ID in the ID management system 1, through generating an internal ID, to externally linking the internal ID. Fig. 3 describes the processing in the ID management system 1, from accepting a request for user authentication, through executing processing for user authentication (hereinafter, also referred to as "authentication processing"), to externally linking the result of user authentication.

[0033] 2 and 3, functions realized by the ID management system 1 are classified into, for example, the following four categories. In the ID management system 1, the classified functions cooperate with each other (including information cooperation and / or function cooperation; the same applies below). External ID management function: Acceptance and registration of external IDs, generation and registration of external branch IDs - Internal ID management function: Generation and registration of internal IDs, authentication requests for authentication function using internal IDs Authentication function: Executes user authentication process - System integration function: Integration with other systems, such as our own systems and / or other companies' systems

[0034] In this embodiment, an example will be described in which the server device 100 realizes the above four functions, but the distribution of functions realized by the ID management system 1 is not limited to this. For example, the authentication function may be realized by the provider device 300, the user device 200, or another external device.

[0035] <2-1. Create a new account> (1) As shown in Fig. 2, in order to create a new account for a linked service on the user device 200, i.e., to newly register an external ID, the user inputs the external ID and authentication information for user authentication using the external ID into a screen for creating a new account. In this example, the external ID and the authentication information are each character strings arbitrarily specified and input by the user.

[0036] (2) The user device 200 transmits the external ID and authentication information input by the user to the server device 100 (via the provider device 300 in the case where the linkage system 3 is used).

[0037] (3) The external ID management function of the server device 100 accepts an external ID and authentication information from the user device 200 or the provider device 300 .

[0038] (4) The external ID management function generates identification information for further dividing the external ID, a so-called branch number (hereinafter also referred to as an "external branch ID"), based on the received authentication information. In this example, at least a part of the authentication information is treated as the external branch ID, and specifically, the last three digits of the character string specified and input as the authentication information are treated as the external branch ID. The external ID management function links the received external ID and this generated external branch ID to the internal ID management function of the server device 100.

[0039] The external branch ID may include, for example, the following information as at least a part of the authentication information: All or part of a string of letters, numbers, symbols, etc. that the user recognizes as an ID All or part of the information stored on devices such as tokens for token payments or storage media such as IC cards that are not recognized as IDs by users All or part of the identification information for identifying a device such as the user device 200, an IC card, or an NFC tag or other device or storage medium owned by the user All or part of the digitized data, such as the user's biometric information or characteristic information calculated from the biometric information (for example, facial image feature amounts, etc.)

[0040] (5) The internal ID management function generates an internal ID based on the linked external ID and external branch ID. In this example, the internal ID management function uses a combination of the external ID and the external branch ID as a composite key (composite primary key) and generates an internal ID for each composite key. In other words, the combination of the external ID and the external branch ID can uniquely identify a user's account.

[0041] (6) The internal ID management function associates an external ID, an external branch ID, and an internal ID as user information and registers them in the identification storage unit 131 described later. The internal ID management function links the registered internal ID and authentication information corresponding to this internal ID to the authentication function. The internal ID management function also links the registered internal ID to the system linking function.

[0042] (7) The authentication function associates the linked internal ID with the authentication information of the user and registers them in the storage unit 130. Furthermore, when attribute information of the user (e.g., name, address, telephone number, email address, etc.) is linked, the authentication function may register this attribute information in the storage unit 130 as user information in association with these IDs.

[0043] The user information is information about a user. The user information may include, for example, a user ID (e.g., an external ID, an external branch ID, and / or an internal ID), user attribute information, and / or user authentication information.

[0044] (8) The system linking function links (sends) the linked internal ID to the linking system 3. In this example, the linking system 3 is an EC system 3a (referred to as the company's system in FIG. 2) of an EC site operated separately by the company that operates the ID management system 1, and a financial system 3b (referred to as the other company's system in FIG. 2) operated by an institution other than the company that operates the ID management system 1. In this case, the system linking function may also link at least a part of the user's attribute information associated with the internal ID, depending on the consent of the linking system 3 and / or the user, etc.

[0045] (9) The linking system 3 registers the linked internal IDs in respective storage devices (not shown).

[0046] <2-2. Authentication of the created account> (1) In the example of Fig. 3, the linked system 3 to be logged in is assumed to be an EC system 3a. As shown in Fig. 3, in order to log in to the EC system 3a with the account created in the example of Fig. 2 above, the user inputs an authentication request including an external ID and authentication information for performing user authentication using the external ID into the login screen of the user device 200.

[0047] (2) The user device 200 transmits an authentication request (external ID and authentication information) input by the user to the server device 100 (via the provider device 300 in the case where the request goes through the linking system 3, etc.).

[0048] (3) The external ID management function of the server device 100 receives an external ID and authentication information from the user device 200 or the provider device 300 as an authentication request.

[0049] (4) The external ID management function identifies an external branch ID based on the received authentication information. Specifically, the external ID management function identifies the last three digits of the string of the authentication information as the external branch ID. The external ID management function links the external ID and the external branch ID corresponding to this external ID to the internal ID management function.

[0050] (5) The internal ID management function of the server device 100 refers to the identification storage unit 131 using the external ID and the external branch ID as a composite key, and acquires an internal ID from the external ID and the external branch ID. The internal ID management function links the acquired internal ID and an authentication request to the authentication function.

[0051] (6) The authentication function of the server device 100 executes authentication processing of the user based on the linked internal ID and the authentication request. The authentication function links the result of the user authentication (e.g., authentication success or failure, etc.) together with the internal ID to the system linking function.

[0052] (7) The system linking function links (transmits) the linked internal ID and the result of the user authentication to the logged-in EC system 3a. At this time, the system linking function may also link at least a part of the user's attribute information associated with the internal ID, depending on the linked system and / or the consent of the user, etc.

[0053] (8) The EC system 3a logs in the user based on the linked internal ID and the result of the authentication process. For example, after logging in, the EC system 3a causes the user device 200 to display a home screen for each account on the EC site. Note that when the linked system 3 to which the user logs in is the financial system 3b, the EC system 3a similarly links the internal ID and the authentication result to the financial system 3b and logs in to the financial system 3b.

[0054] In the examples of Figures 2 and 3, detailed interactions between devices have been omitted to simplify the explanation, but for example, if a federation method is adopted as the SSO method, access when logging in to the EC system 3a may be redirected once via the user device 200 using the internal ID and the result of the authentication process to access the EC system 3a.

[0055] With the above configuration, the ID management system 1 can separate the internal ID that identifies the user on the computers of the ID management system 1 and the linkage system 3 from the external ID, and furthermore, can allow duplication of the external ID by making at least a part of the authentication information an external branch ID. In other words, multiple users can use the same external ID. Therefore, the ID management system 1 can avoid restrictions on the content of the external ID that a user registers to identify himself / herself due to duplication with external IDs registered by other users.

[0056] With the above configuration, the ID management system 1 can use at least a part of the authentication information as an external branch ID, eliminating the need for the user to specify and input separately or to select the contents of the ID separately on a computer. Therefore, the ID management system 1 can specify an external branch ID without the user having to take the time to consider what the external branch ID should be or having to provide a function for selecting the contents of the ID.

[0057] <3. Functional configuration> The functional configuration of the server device 100 according to the present embodiment will be described with reference to Fig. 4. As shown in Fig. 4, the server device 100 includes a control unit 110, a communication unit 120, and a storage unit .

[0058] The control unit 110 includes a receiving unit 111, a generating unit 112, a registering unit 113, and an authenticating unit 114. The control unit 110 may also include an identifying unit 115, for example.

[0059] [Reception] The reception unit 111 receives various information and / or various requests from the user device 200 and / or the provider device 300, etc. The reception unit 111 may receive various information and the like in any manner. For example, the reception unit 111 may receive a message indicating an authentication request including an external ID and authentication information from these devices and accept the information. As another example, the reception unit 111 may accept the information by having the user input the authentication information of the matching target on a screen of a website output to the user device 200. Furthermore, the reception unit 111 may accept various information and the like by having these devices use, for example, an API implemented by the server device 100 or a library of an SDK corresponding to the ID management system 1.

[0060] The reception unit 111 includes an information reception unit 111a. The information reception unit 111a receives, from a user device 200 of a user of an integrated service or a provider device 300 of a provider of an integrated service, an external ID for identifying the user and authentication information for performing user authentication using the external ID.

[0061] For example, when accepting an external ID and authentication information, the information accepting unit 111a may refer to the identification storage unit 131 to determine whether or not a combination of an external ID and at least a part of the authentication information overlaps with that combination of another user. This determination by the information accepting unit 111a may be made, for example, when accepting an external ID and authentication information as a reference request for whether or not a combination of an external ID and authentication information desired by a user can be registered in order to create a new account for the user.

[0062] For example, when it is determined that there is a duplication as a result of the above duplication determination, the information receiving unit 111a may suspend or reject the acceptance of the external ID and the authentication information. At this time, the information receiving unit 111a may notify the user device 200 or the provider device 300 that there is a duplication. This notification may include, for example, an acceptance error indicating that the acceptance of the external ID and the authentication information will be suspended or rejected.

[0063] For example, when the information receiving unit 111a determines that there is a duplication as a result of the above duplication determination, the information receiving unit 111a may change a part or all of the authentication information used in this determination to eliminate the duplication. Specifically, when the authentication information is a six-digit character string, the information receiving unit 111a may initially perform the duplication determination using the last three digits of the six-digit character string, and when it determines that there is a duplication with a combination with an external ID of another user, it may change the first three digits of the six-digit character string and perform the duplication determination again. When the information receiving unit 111a determines that there is no duplication as a result of this re-duplication determination, it may combine the first three digits after the change with the external ID and cause the generation unit 112 to generate an internal ID, or may associate the first three digits with the internal ID and cause the registration unit 113 to register it. With this configuration, even if a duplication occurs with a combination of at least a part of the external ID and the authentication information with another user, it can be eliminated by changing the authentication information, and it can be flexibly dealt with without changing the external ID. Therefore, it is possible to provide a system that is easy for users to use.

[0064] The information receiving unit 111a may receive attribute information of a user from, for example, a user device 200 of a user of an integrated service or a provider device 300 of a provider that provides an integrated service.

[0065] The receiving unit 111 includes a request receiving unit 111b. The request receiving unit 111b receives, from the user device 200 or the provider device 300, an authentication request for authenticating a user, the authentication request including an external ID and authentication information.

[0066] The receiving unit 111 may receive, from the user device 200 or the provider device 300, a request to update the external ID and / or the authentication information.

[0067] The reception unit 111 includes a designation reception unit 111c. When at least one of a plurality of authentication means is used for user authentication, the designation reception unit 111c receives, from the user device 200 or the provider device 300, a designation by the user of an authentication means to be used for generating an internal ID from among the plurality of authentication means. The authentication means to be used for generating an internal ID may be, for example, one authentication means or a combination of a plurality of authentication means. The designation reception unit 111c may reflect the designation of the authentication means from the user in external branch ID rule information to be described later.

[0068] [Generation part] The generating unit 112 generates an internal ID for identifying a user based on the external ID and at least a part of the authentication information accepted by the information accepting unit 111a. The generating unit 112 may generate the internal ID from scratch by numbering or the like, or may generate the internal ID by reusing at least a part of other identification information.

[0069] The generating unit 112 may generate an external ID based on, for example, authentication information accepted by the information accepting unit 111a. Specifically, the generating unit 112 may generate a part of the authentication information as the external ID. The generating unit 112 may generate an external ID based on information indicating a generation rule such as which part of the authentication information is to be extracted as the external ID (hereinafter, also referred to as "external ID rule information"). The external ID rule information may be registered in the storage unit 130 based on, for example, a request from a user or provider, or as a setting (for example, a default) common to the ID management system 1.

[0070] For example, when the authentication information is an n-digit string, the external branch ID rule information may specify the starting position of the part to be extracted (e.g., the first digit from the beginning of the string) and the number of digits of the string to be extracted from the starting position (e.g., three digits from the starting position (this number of digits may indicate the number of characters or the number of bytes)). In addition, when multiple authentication means are used for user authentication, the external branch ID rule information may specify which of the multiple authentication means to use for authentication information. Note that the authentication information of the authentication means used to generate the external branch ID may be a combination of the respective authentication information of the multiple authentication means.

[0071] The generating unit 112 may generate (issue) an internal ID for each combination of an external ID and at least a part of the authentication information (e.g., an external branch ID, etc.). The generating unit 112 may generate an internal ID for each combination of an external ID and an external branch ID. With this configuration, if a combination of an external ID and at least a part of the authentication information can be identified, the internal ID can be identified by referring to the identification storage unit 131. Therefore, the authentication information included in the authentication request for user authentication can be reused to obtain an internal ID from the combination of external IDs.

[0072] The generating unit 112 may generate an internal ID based on information (hereinafter also referred to as "internal ID rule information") indicating a generation rule such as how to assign numbers and which part of authentication information to extract when reusing authentication information, similarly to the external ID. The internal ID rule information may be registered in the storage unit 130 based on a request from a user or provider, or as a common setting (for example, default) for the ID management system 1, for example.

[0073] The internal ID may be, for example, a combination of at least a part of the external ID and at least a part of the authentication information. Specifically, when the external ID and the external branch ID are each a character string, the internal ID may be a character string obtained by combining them. With this configuration, it is possible to easily generate an internal ID by combining the external ID and the authentication information, without providing a separate numbering system for the internal ID.

[0074] For example, when at least one of a plurality of authentication means is used for user authentication, the generation unit 112 may generate an internal ID based on at least a part of the authentication information of the authentication means designated by the user and the external ID. In this case, the internal ID rule information may specify which authentication information of the plurality of authentication means is to be used.

[0075] According to the above configuration, when multiple authentication means are used, the user can select which authentication means' authentication information is used to generate the internal ID. For example, in the case of authentication using stored information such as a password, the user may forget it and it is often necessary to update it, but on the other hand, in the case of biometric authentication, it is considered that updating is almost never necessary. In this way, the user can select the most suitable authentication information for him / herself to use for the user ID according to the characteristics of each authentication means, such as authentication information that is considered to be updated relatively infrequently.

[0076] [Registration Department] The registration unit 113 associates an external ID, at least a part of the authentication information (e.g., an external branch ID, etc.), and an internal ID for each user, and registers them in the identification storage unit 131. This internal ID may be newly generated by the generation unit 112, or may be previously registered. In the latter case, the registration unit 113 may newly register the external ID and at least a part of the authentication information in association with the previously registered internal ID.

[0077] According to the above configuration, the registration unit 113 can separate the internal ID that identifies the user on the computer of the ID management system 1 and / or the linkage system 3 from the external ID, and enable duplicate registration of the external ID. Therefore, the registration unit 113 can register the content of the external ID that the user registers to identify himself / herself, avoiding restrictions due to duplication with external IDs registered by other users.

[0078] For example, the registration unit 113 may associate the attribute information of the user accepted by the information acceptance unit 111a with the corresponding internal ID and register it in the storage unit 130. In addition, the registration unit 113 may register, for example, the authentication information of the user in the storage unit 130 in association with the internal ID, separately from at least a part of the authentication information (for an external branch ID, etc.) registered in the identification storage unit 131, in order to use it for authentication processing, etc.

[0079] The registration unit 113 may include, for example, an update unit 113a. The update unit 113a updates at least a part of the authentication information associated with the external ID and the internal ID registered in the identification storage unit 131 to at least a part of the authentication information of the authentication means identified by the identification unit 115 described later.

[0080] According to the above configuration, the authentication information of the authentication means identified based on the history (achievement) of user authentication can be used to identify the internal ID in combination with the external ID, i.e., to identify the user. Therefore, when multiple authentication means are used, the authentication information of the authentication means can be updated to the authentication information suitable for identifying the internal ID in combination with the external ID in the multiple authentication means, without the user having to take the time to input information.

[0081] The update unit 113a may update the external ID and / or the authentication information based on, for example, an update request accepted by the request acceptance unit 111b. Also, the update unit 113a may update the external branch ID based on, for example, an update request accepted by the request acceptance unit 111b.

[0082] [Authentication section] The authentication unit 114 executes authentication processing of a user in response to an authentication request received by the reception unit 111. Specifically, the authentication unit 114 refers to the identification storage unit 131, and acquires an internal ID associated with the external ID and at least a part of the authentication information included in the authentication request. Then, the authentication unit 114 executes authentication processing using the acquired internal ID.

[0083] For example, as an authentication process, the authentication unit 114 may determine whether or not the user is the intended user by comparing the authentication information of the user to be matched, which is included in the authentication request, with the authentication information of the match source registered in advance in the storage unit 130. If the authentication unit 114 determines that the user is the intended user as a result of this determination, it may determine that the authentication is successful, and on the other hand, if it determines that the user is not the intended user, it may determine that the authentication is unsuccessful.

[0084] [Specific part] The identifying unit 115 refers to the history storage unit 132 that stores authentication history information indicating a history of user authentication during a predetermined period, and identifies an authentication means to be used for generating an internal ID from among the multiple authentication means based on the authentication history information. For example, the identifying unit 115 may identify from among the multiple authentication means an authentication means that has been used most frequently for user authentication during a predetermined period based on the authentication history information. As another example, the identifying unit 115 may identify from among the multiple authentication means an authentication means that has had the most successful authentications during a predetermined period based on the authentication history information.

[0085] [Communications Department] The communication unit 120 transmits and receives various information and / or various requests between the user device 200 and / or the provider device 300, etc., via the network N. The communication unit 120 may transmit, for example, information indicating the generated internal ID to the linkage system 3. The communication unit 120 may also transmit, for example, information indicating the result of user authentication by the authentication unit 114 to the device (the user device 200 or the provider device 300) that is the request source of the authentication request accepted by the request acceptance unit 111b and / or to a device of the linkage system 3, etc.

[0086] [Storage] The storage unit 130 stores various information such as identification information such as an external ID, an external branch ID, or an internal ID, or user attribute information or authentication information. The storage unit 130 may store various data and information by using a database management system (DBMS), or may store various data and information by using a file system. When using a DBMS, for example, a table may be provided for each of the above information, and each piece of information may be managed by associating the tables with each other.

[0087] The storage unit 130 includes an identification storage unit 131. The identification storage unit 131 stores identification information such as an external ID, an external branch ID, and / or an internal ID in association with each other. The storage unit 130 may also include, for example, a history storage unit 132. The history storage unit 132 stores authentication history information.

[0088] <4. Data configuration example> An example of the data configuration of a user ID will be described with reference to Fig. 5. In this example, an example in which a user and an internal ID are associated on a one-to-one basis will be described, but the association between a user and an internal ID is not limited to this. As another example, in cases where one user has multiple accounts, a user and an internal ID may be associated on a one-to-many basis.

[0089] As shown in FIG. 5, for example, an internal ID may be associated with each combination of an external ID and an external branch ID. For example, even if the external ID values ​​of the internal IDs "U0001", "U0002" and "U0003" are all the same character string as "Aoyama", the external branch IDs may be different from each other, such as "345", "890888" and "999", and therefore may be registered. Furthermore, one internal ID may be associated with multiple external IDs. For example, the internal ID "U0001" may be associated with the external ID "Aoyama" (issuer: ID management system 1) and the external ID "Minato777" (issuer: linkage system 3), respectively. In this way, one internal ID may be capable of linking multiple external IDs. These multiple external IDs may be issued by different multiple issuers, or may be issued by the same issuer.

[0090] The external branch ID may be, for example, (1) the last three digits of the authentication information (password (indicated as "PW" in FIG. 5)), (2) the last three digits of the authentication information (information read from an IC card (indicated as "IC card" in FIG. 5)), or (3) a combination of (1) and (2) above. Items of external branch ID rule information indicating the method of generating such external branch IDs (indicated as the numerical parameters "01", "02", and "03" in the example of FIG. 5) may be associated with internal IDs, etc.

[0091] Although not shown in FIG. 5, for example, identification information of a user's account created in the federated system 3 or another system (in other words, the federated service or another service) may be further associated with the internal ID.

[0092] According to the above configuration, even if the external ID or authentication information is changed, it is possible to deal with it by updating the association with the internal ID, or updating the value of the external ID or external branch ID with the changed value. Therefore, even if the external ID, etc. is changed, it is possible to deal with it without changing the internal ID used on the computer.

[0093] <5. Example of operation> An example of the operation of the ID management system 1 will be described with reference to Fig. 6. Note that the order of processing and the unit of processing shown in Fig. 6 are merely an example and may be changed as appropriate.

[0094] Fig. 6(a) is a flow diagram of a scene in which an external ID is newly registered. As shown in Fig. 6(a), the information receiving unit 111a of the server device 100 receives an external ID and authentication information for performing user authentication using the external ID from the user device 200 of the user of the linked service or the provider device 300 of the provider that provides the linked service to the user (S10). The generating unit of the server device 100 generates an internal ID for identifying the user in a computer such as the server device 100 based on the external ID and at least a part of the authentication information (S11). The registering unit 113 of the server device 100 associates the external ID, at least a part of the authentication information, and the internal ID and registers them in the identification storage unit 131 (S12).

[0095] FIG. 6(b) is a flow diagram of a scene where user authentication is performed using the external ID, authentication information, and internal ID registered in FIG. 6(a). As shown in FIG. 6(b), the request receiving unit 111b of the server device 100 receives an authentication request for user authentication, which includes the external ID and authentication information, from the user device 200 or the provider device 300 (S20). In response to this authentication request, the authentication unit 114 of the server device 100 refers to the identification storage unit 131 and acquires an internal ID from at least a part of the external ID and the authentication information (S21). The authentication unit 114 executes authentication processing using this internal ID (S22). The communication unit 120 of the server device 100 transmits the result of the authentication processing, i.e., information indicating the result of the user authentication, to the requesting user device 200 or the provider device 300, etc. (S23).

[0096] <5. Hardware configuration> 7, an example of a hardware configuration in which the above-mentioned server device 100 is realized by a computer 800 will be described. Note that the functions of each device can also be realized by dividing them into a plurality of devices.

[0097] As shown in FIG. 7, a computer 800 includes a processor 801, a memory 803, a storage device 805, an input I / F unit 807, a data I / F unit 809, a communication I / F unit 811, and a display device 813.

[0098] The processor 801 controls various processes in the computer 800 by executing programs stored in the memory 803. For example, each functional unit included in the control unit 110 of the server device 100 can be realized by the processor 801 executing a program temporarily stored in the memory 803.

[0099] The memory 803 is a storage medium such as a RAM (Random Access Memory), etc. The memory 803 temporarily stores the program code of the program executed by the processor 801 and data required when the program is executed.

[0100] The storage device 805 is a non-volatile storage medium such as a hard disk drive (HDD) or a flash memory. The storage device 805 stores an operating system and various programs for implementing the above-mentioned configurations. In addition, the storage device 805 can store a table for registering various information such as identification information such as an external ID, an external branch ID, or an internal ID, or user attribute information or authentication information, and a DB for managing the table. Such programs and data are loaded into the memory 803 as necessary and are referred to by the processor 801.

[0101] The input I / F unit 807 is a device for receiving input from a user. Specific examples of the input I / F unit 807 include a keyboard, a mouse, a touch panel, various sensors, and a wearable device. The input I / F unit 807 may be connected to the computer 800 via an interface such as a Universal Serial Bus (USB).

[0102] The data I / F unit 809 is a device for inputting data from outside the computer 800. A specific example of the data I / F unit 809 is a drive device for reading data stored in various storage media. The data I / F unit 809 may be provided outside the computer 800. In that case, the data I / F unit 809 is connected to the computer 800 via an interface such as a USB.

[0103] The communication I / F unit 811 is a device for performing data communication via the Internet N, either wired or wirelessly, with an external device of the computer 800. The communication I / F unit 811 may be provided outside the computer 800. In that case, the communication I / F unit 811 is connected to the computer 800 via an interface such as a USB.

[0104] The display device 813 is a device for displaying various types of information. Specific examples of the display device 813 include a liquid crystal display, an organic EL (Electro-Luminescence) display, and a display of a wearable device. The display device 813 may be provided outside the computer 800. In that case, the display device 813 is connected to the computer 800 via, for example, a display cable. In addition, when a touch panel is adopted as the input I / F unit 807, the display device 813 can be configured integrally with the input I / F unit 807.

[0105] It should be noted that the present embodiment is an example for explaining the present invention, and is not intended to limit the present invention to the embodiment. In addition, the present invention can be modified in various ways without departing from the gist of the invention. Furthermore, a person skilled in the art can adopt an embodiment in which each element described below is replaced with an equivalent, and such an embodiment is also included in the scope of the present invention.

[0106] The components of the server device described in the above embodiment are assumed to realize a predetermined process in cooperation with other hardware by the processor 801 executing a program stored in the storage device 805. In other words, these components are assumed to be software or firmware, and also corresponding hardware, and in both concepts, they are also described as "functions," "means," "parts," "processing circuits," "units," or "modules," and can be interpreted as each of these.

[0107] [Variations] Although the present invention has been described based on the above embodiment, the following cases are also included in the present invention.

[0108] [Variation 1] *User authentication can be performed by an external device In the above embodiment, an example has been described in which the ID management system 1 (specifically, the server device 100) performs the function of user authentication, but the user authentication according to the present invention is not limited to this. For example, the server device 100 may cooperate with a third-party system or other authentication server to execute authentication information matching, which is part of the user authentication function. In this case, for example, the authentication unit 114 of the server device 100 may transfer an authentication request received from the user device 200 to the authentication server as the authentication process. Next, the authentication unit 114 may receive a result of matching the authentication information from the authentication server as the authentication process and as a response to the authentication request. Then, the authentication unit 114 may determine whether the authentication is successful or unsuccessful based on the result of the matching as the authentication process.

[0109] [Variation 2] At least a part of each component included in the server device 100 according to the above embodiment may be included in the user device 200, the provider device 300, and / or other devices. For example, the user device 200 may have all or a part of the functions of the authentication unit 114 included in the control unit 110 of the server device 100.

[0110] [Variation 3] *User IDs and history information can be stored in an external system device. In the above embodiment, an example was shown in which the identification storage unit for storing the user ID and the storage unit for storing the user information are storage units of the server device 100, but the present invention is not limited to this. For example, at least a part of these storage units may be provided in devices of the linked system 3 or other systems.

[0111] [Variation 4] *Check for duplication including other system IDs such as company IDs (external ID + authentication information can be registered even if they are the same In the above embodiment, an example was described in which an internal ID is identified by at least a partial combination of an external ID and authentication information, that is, an account of a user is identified, but the present invention is not limited to this. For example, if the combination of an external ID and authentication information input by user A overlaps with the combination of another user B, identification information of the account of user A created in the linked system 3 or another system (hereinafter, also referred to as "other system ID") may be further combined (or the other system ID may be used instead of the authentication information).

[0112] Specifically, first, when a combination of an external ID and authentication information overlaps, the generation unit 112 may generate an internal ID based on a combination of the external ID, at least a part of the authentication information, and the other system ID (or a combination of the external ID and the other system ID). Next, the registration unit 113 may associate the external ID, at least a part of the authentication information, and the other system ID (or the external ID and the other system ID) with the internal ID and register them in the identification storage unit 131. Next, the request reception unit 111b may receive an authentication request including the external ID, the other system ID, and the authentication information from the user device 200 or the like. Then, in response to this authentication request, the authentication unit 114 may refer to the identification storage unit 131 to obtain an internal ID from the external ID, at least a part of the authentication information, and the other system ID (or the external ID and the other system ID), and perform authentication processing of the user using the internal ID.

[0113] According to the above configuration, even if a combination of an external ID and authentication information overlaps with a combination of another user, it can be registered without any restrictions. [Explanation of symbols]

[0114] 1...ID management system, 100...server device, 110...control unit, 111...reception unit, 112...generation unit, 113...registration unit, 114...authentication unit, 115...identification unit, 120...communication unit, 130...storage unit, 200...user device, 300...provider device, 800...computer, 801...processor, 803...memory, 805...storage device, 807...input I / F unit, 809...data I / F unit, 811...communication I / F unit, 813...display device.

Claims

1. On the computer, an information receiving function for receiving, from a user device of a user of a service or a provider device of a provider providing the service, external identification information for identifying the user between the user and the computer, and authentication information for performing user authentication using the external identification information; a generating function for generating internal identification information for identifying the user on the computer based on the external identification information and at least a part of the authentication information; a registration function for registering the external identification information, at least a part of the authentication information, and the internal identification information in an identification storage unit in association with each other; a request receiving function for receiving an authentication request for authenticating the user from the user device or the provider device, the authentication request including the external identification information and the authentication information; an authentication function of, in response to the authentication request, referring to the identification storage unit, acquiring the internal identification information from at least a part of the external identification information and the authentication information, and executing a process for authenticating the user using the internal identification information; program.

2. The generating function generates the internal identification information for each combination of the external identification information and at least a portion of the authentication information. The program according to claim 1.

3. The internal identification information is a combination of at least a portion of the external identification information and at least a portion of the authentication information.

3. The program according to claim 1 or 2.

4. When receiving the external identification information and the authentication information, the information receiving function refers to the identification storage unit to determine whether or not a combination of the external identification information and at least a part of the authentication information overlaps with the combination of another user, and if it is determined that there is an overlap, it suspends or rejects the acceptance of the external identification information and the authentication information, and notifies the user device or the provider device of the existence of the overlap.

3. The program according to claim 1 or 2.

5. when receiving the external identification information and the authentication information, the information receiving function refers to the identification storage unit to determine whether or not a combination of the external identification information and at least a part of the authentication information overlaps with the combination of another user, and when it is determined that there is an overlap, modifies a part or all of the authentication information to eliminate the overlap.

3. The program according to claim 1 or 2.

6. When the user authentication uses at least one of a plurality of authentication means, the authentication information includes authentication information for each of the plurality of authentication means, causing the computer to realize a designation receiving function for receiving, from the user device or the provider device, designation by the user of an authentication means to be used for generating the internal identification information from among the plurality of authentication means; The generating function generates the internal identification information based on at least a part of the authentication information of the specified authentication means and the external identification information.

3. The program according to claim 1 or 2.

7. When the user authentication uses at least one of a plurality of authentication means, the authentication information includes authentication information for each of the plurality of authentication means, The computer includes: a specification function of referring to a history storage unit that stores authentication history information indicating a history of the user authentication during a predetermined period, and specifying an authentication means to be used for generating the internal identification information from among the plurality of authentication means based on the authentication history information; an updating function for updating at least a part of the authentication information associated with the external identification information and the internal identification information registered in the identification storage unit to at least a part of the authentication information of the specified authentication means; 3. The program according to claim 1 or 2.

8. an information receiving unit that receives, from a user device of a user of a service or a provider device of a provider providing the service, external identification information for identifying the user between the user and a computer, and authentication information for performing user authentication using the external identification information; a generating unit that generates internal identification information for identifying the user in the computer based on the external identification information and at least a part of the authentication information; a registration unit that associates the external identification information, at least a part of the authentication information, and the internal identification information with each other and registers them in an identification storage unit; a request receiving unit that receives an authentication request for authenticating the user from the user device or the provider device, the authentication request including the external identification information and the authentication information; an authentication unit that, in response to the authentication request, refers to the identification storage unit, acquires the internal identification information from at least a part of the external identification information and the authentication information, and executes a process for authenticating the user using the internal identification information. Information processing device.

9. The computer receiving, from a user device of a user of a service or a provider device of a provider providing the service, external identification information for identifying the user between the user and the computer, and authentication information for performing user authentication using the external identification information; generating internal identification information for identifying the user in the computer based on the external identification information and at least a part of the authentication information; registering the external identification information and at least a part of the authentication information in an identification storage unit in association with the internal identification information; receiving an authentication request for authenticating the user from the user device or the provider device, the authentication request including the external identification information and the authentication information; in response to the authentication request, referring to the identification storage unit, acquiring the internal identification information from at least a part of the external identification information and the authentication information, and executing a process for authenticating the user using the internal identification information; Information processing methods.

Images