Information processing system and information processing program

Abstract

To provide an information processing system and information processing program capable of optimally reducing labor and time required for a user to operate a terminal when acquiring various types of information from a plurality of information sources stored in a personal identification card such as Individual Number Card.SOLUTION: An authentication information receiving part 44A receives authentication information input by a user into a user terminal 40, and a reading part 44B reads an identity verification medium such as Individual Number card. Next, an authentication information transmission part 44C transmits the authentication information to the identity verification medium read in single reading processing by the reading part 44B. When the authentication information is authenticated in the identity verification medium, an information acquisition part 44D acquires first information of a first information source and second information of a second information source corresponding to at least the authentication information out of a plurality of information sources stored in the identity verification medium.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an information processing system and an information processing program for performing user authentication and registration using a personal identification card. [Background technology]

[0002] The My Number Card, which began to be issued in 2016, is an IC card that can be used as an ID card to verify identity, as well as for various services such as local government services and electronic applications using electronic certificates such as e-Tax. The My Number Card has a My Number (personal number) printed on its face, which is legally limited to certain administrative uses, and is equipped with an IC chip that stores electronic certificates and applications (AP) that can be used widely, including by private businesses.

[0003] The IC chip of the My Number Card stores multiple information sources, such as digital certificates for signatures used when creating and sending digital documents with digital signatures over the Internet, and digital certificates for user authentication used when logging in to websites of various government and private services. To use the digital certificates that are each an information source, authentication is required, such as by entering a PIN number set for each information source.

[0004] Here, there is known a technology for providing an authentication application service system that generates authentication data with an authentication method identifier and a user device identifier added thereto, and transmits the data to an information service system to authenticate a user (see Patent Document 1). According to the technology of Patent Document 1, an electronic certificate is used as authentication data, and a result as to whether or not the data can be used from multiple service devices (information sources) can be obtained by inputting the authentication data once. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2003-6162 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, the technology described in the above Patent Document 1 does not envisage obtaining necessary information from information sources provided by public institutions, such as digital certificates for signatures and card information input assistance applications, from personal identification cards that can be used for public personal authentication services, such as My Number cards, and it is difficult to apply the technology to such personal identification cards by simply using and adapting it.

[0007] The present invention has been made in consideration of the above circumstances, and aims to provide an information processing system and an information processing program that can effectively reduce the effort and time required for a user to operate a terminal when obtaining various information from multiple information sources stored on an identification card such as a My Number card. [Means for solving the problem]

[0008] In order to solve the above problem, the information processing system of the present invention is characterized in that it comprises an authentication information receiving unit that accepts authentication information by inputting the authentication information from a user to a user terminal, a reading unit that reads an identity verifiable medium that can be used to verify the identity of the user using the user terminal, an authentication information transmitting unit that transmits the authentication information to the identity verifiable medium read in a single reading process by the reading unit, and an information acquisition unit that acquires first information of a first information source and second information of a second information source corresponding to the authentication information stored in the identity verifiable medium when the authentication information is authenticated in the identity verifiable medium.

[0009] In addition, in order to solve the above problem, the information processing program of the present invention is characterized in that it causes a computer to function as an authentication information receiving unit that accepts authentication information by inputting the authentication information from a user to a user terminal, a reading unit that reads an identity verifiable medium that can be used to verify the identity of the user using the user terminal, an authentication information transmitting unit that transmits the authentication information to the identity verifiable medium read in a single reading process by the reading unit, and an information acquisition unit that, when the authentication information is authenticated in the identity verifiable medium, acquires at least first information of a first information source and second information of a second information source that correspond to the authentication information among a plurality of information sources stored in the identity verifiable medium. Effect of the Invention

[0010] According to the present invention, when acquiring various information from multiple information sources stored in an identification card such as a My Number card, the effort and time required for a user to operate a terminal can be suitably reduced. [Brief description of the drawings]

[0011] [Figure 1] 1 is a configuration diagram of an information processing system according to an embodiment of the present invention. [Diagram 2] 2 is a configuration diagram of an authentication server in the information processing system according to an embodiment of the present invention. FIG. [Diagram 3] FIG. 2 is a configuration diagram of a user terminal in an information processing system according to an embodiment of the present invention. [Figure 4] 11 is a flowchart for explaining an onboarding start process in user authentication registration using a public personal authentication service by an information processing system according to an embodiment of the present invention. [Diagram 5] 10 is a flowchart for explaining a user authentication registration process using a public personal authentication service that uses a user-certificate electronic certificate (first information source) in an information processing system according to an embodiment of the present invention. [Figure 6]11 is a diagram for explaining an example of a processing screen by an authentication API displayed on a user terminal of an information processing system according to an embodiment of the present invention. FIG. [Figure 7] 11 is a flowchart for explaining a user authentication and registration process using a public personal authentication service that uses a signature electronic certificate in an information processing system according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] An information processing system according to an embodiment of the present invention and its operation will be described below with reference to the drawings. Fig. 1 is a configuration diagram of an information processing system 1 according to an embodiment of the present invention. As shown in Fig. 1, the information processing system 1 according to this embodiment is composed of an authentication server 10 of a platform operator, a certificate validation server 20 of the Japan Agency for Local Government Information Systems (J-LIS), a management server 30 of a service provider operator, and a user terminal 40 of an individual user, each of which is connected via a known network 50 such as the Internet or a dedicated line network.

[0013] In the following embodiment, when a user who wishes to receive a service provided by a private service provider (for example, opening a bank account or registering in a digital ID application) is requested by the service provider to perform personal authentication, the user installs an information processing program including an authentication API (Application Programming Interface) provided by the platform provider in the user's own user terminal 40, and performs personal authentication through a public personal authentication service provided by the platform provider via the authentication API. Here, the public personal authentication service refers to a public service that uses electronic certificates to ensure the prevention of spoofing, tampering, and transmission repudiation, and enables identity verification and electronic application on the Internet.

[0014] The platform operator who operates the authentication server 10 is a private business operator who has been certified by the competent minister as meeting certain standards regarding information security, etc., and can be entrusted with signature verification work for the public personal authentication service by other private business operators who operate the management server 30. In this embodiment, the platform operator provides service provider operators and the like with a platform that can utilize the My Number card, which is a medium capable of personal identification, as a means of online personal identification.

[0015] The authentication server 10 performs personal authentication by accessing the certificate validation server 20 of the J-LIS, which is a certification authority. In addition, the IC chip, which is an information storage unit mounted on the My Number card, stores two electronic certificates (a user authentication electronic certificate and a signature electronic certificate) issued to individuals in the public personal authentication service as standard. The user authentication electronic certificate can be used to prove that the user operating the card is the person in question, such as when logging in to the My Number Portal or using convenience store delivery of a public certificate. The signature electronic certificate contains four pieces of information, name, address, date of birth, and gender, and can be used when applying an electronic signature to an electronic document or the like and sending it. These two electronic certificates can also be used by private businesses (such as the platform business operator in this embodiment) approved by the Minister of Internal Affairs and Communications from January 2016.

[0016] The service provider that operates the management server 30 is a business that shares information with the platform operator, utilizes a platform that can utilize the platform operator's My Number card as a means of online identity verification, and uses the My Number card to authenticate individual users as a means of online identity verification to provide various services to users.

[0017] The user terminal 40 is a terminal device used by an individual user who uses various services of a service provider to perform personal authentication, and is equipped with a function for reading information from an IC chip that is an information storage unit of a My Number card, a function for inputting information such as a PIN number by the user, a function for displaying various information such as text and images on a screen, etc. The user terminal 40 may be, for example, a mobile phone such as a smartphone, a personal computer such as a tablet or a notebook PC, or a device such as a multifunction printer.

[0018] 2 is a configuration diagram of an authentication server 10 in an information processing system 1 according to an embodiment of the present invention. The authentication server 10 includes a communication unit 11 for transmitting and receiving various information to and from the certificate validation server 20, the management server 30, and the user terminal 40, an authentication unit 12 for authenticating information on an electronic certificate and personal information (described later), an information acquisition unit 13 for acquiring personal information and the like from a plurality of information sources, and a storage unit 14 for storing information in authentication processing and the like. The certificate validation server 20 and the management server 30 are, for example, server computers, and are configured with hardware such as a communication interface for communicating with other devices, a memory, a processor, an input / output interface, a media reader, and a recording device.

[0019] Here, the information source is, for example, an electronic certificate or an application, and the information processing system 1 may have at least two or more information sources, and the user terminal 40 may acquire information from three or more information sources. More specifically, the information source is, for example, an electronic certificate (signature electronic certificate, user authentication electronic certificate, etc., hereinafter also referred to as "first information source") that can be used in the public personal authentication service possessed by the My Number card, or a predetermined application provided by a public institution (card details confirmation application, card details input assistance application, resident registration application, etc., hereinafter also referred to as "second information source").

[0020] In this embodiment, among these information sources, the case of a user authentication electronic certificate as the first information source and a card information input assistance application as the second information source, and the case of a signature electronic certificate as the first information source and a card information input assistance application as the second information source will be described as examples. For example, by using the latter two information sources, it is possible to obtain a user's electronic signature and My Number (individual number) required for opening a bank account. Note that in this embodiment, a My Number card is given as an example of an identity verification card (identification medium), but the identity verification medium may be a card-like tangible object (identification card) that is equipped with an IC chip that stores an electronic certificate issued to an individual in a public personal authentication service and can be used for identity verification. For example, it is possible to expand the scope of the current "My Number card" to include a chip-like tangible object.

[0021] FIG. 3 is a configuration diagram of a user terminal 40 in an information processing system 1 according to an embodiment of the present invention. As shown in FIG. 3, the user terminal 40 according to this embodiment includes a communication unit 41, a display unit 42, an input unit 43, an information acquisition function unit 44, an onboarding start function unit 45, an authentication unit 46, a user authentication registration unit 47, and a login processing unit 48. The communication unit 41 transmits and receives various information to and from the authentication server 10, the management server 30, and the like via a network 50. The display unit 42 displays various information such as characters and images on a liquid crystal screen or the like. The input unit 43 is a user input interface realized by a touch panel or the like on the liquid crystal screen displayed on the display unit 42. The information acquisition function unit 44 includes an authentication information receiving unit 44A, a reading unit 44B, an authentication information transmitting unit 44C, an information acquisition unit 44D, a service selection receiving unit 44E, and a name display unit 44F. The onboarding start function unit 45 performs interactive processing with the user to perform user authentication and user authentication registration from the start of use of the authentication API. The onboarding start function unit 45 includes a restriction information display unit 45A that displays restriction information for a specific user on the display unit 42 of the user terminal 40, and a user authentication registration promotion information display unit 45B that displays information for promoting user authentication registration for the specific user on the display unit 42 of the user terminal 40. The authentication unit 46 authenticates the information on the electronic certificate and personal information in the same manner as the authentication unit 12 of the authentication server 10. The user authentication registration unit 47 performs user authentication registration of the user after the authentication process of the authentication unit 46. Then, the login processing unit 48 performs login processing of the user when authentication of the information on the electronic certificate and user authentication registration have been performed.

[0022] In the information processing system 1 according to this embodiment, the authentication unit 46 of the user terminal 40 and the authentication unit 12 of the authentication server 10 may coexist and both units may perform authentication, or only one of the devices may possess the authentication unit. Similarly, the information acquisition unit 44D of the user terminal 40 and the information acquisition unit 13 of the authentication server 10 may coexist and both units may acquire information, or only one of the devices may possess the information.

[0023] The authentication information receiving unit 44A receives authentication information (e.g., a personal identification number, a password, etc.) input by the user from the input unit 43. In this embodiment, the authentication information input by the user includes a personal identification number (first authentication information) of a signature electronic certificate related to an identity verifiable medium such as a My Number card, and a personal identification number (second authentication information) of a card information input assistance application.

[0024] The reading unit 44B brings the user terminal 40 close to an information storage unit of an identity verifiable medium that can be used for identity verification of a user (for example, an IC chip of a My Number card) to read the information. The authentication information transmission unit 44C transmits the authentication information received by the authentication information reception unit 44A to the information storage unit of the identity verifiable medium that has been read by the reading unit 44B in a single reading process of the identity verifiable medium by the user. Here, in this embodiment, the authentication information received by the authentication information reception unit 44A is authenticated by the authentication unit 46 of the user terminal 40 or the authentication unit 12 of the authentication server 10.

[0025] When the authentication information is authenticated in the personal identification medium, the information acquisition unit 44D acquires the first information (e.g., electronic signature, name, address, date of birth, gender) in the first information source corresponding to the authentication information and the second information (e.g., personal number) in the second information source stored in the information storage unit of the personal identification medium. Thus, in this embodiment, it is assumed that a plurality of pieces of information (e.g., first information, second information) are stored in the information storage unit of one personal identification medium.

[0026] The service selection receiving unit 44E selectively receives a service to be used by the user. Examples of the service to be used include various administrative procedures, opening a bank account, and booking a hotel or trip.

[0027] When the user inputs authentication information from the input unit 43 in the user terminal 40, the name display unit 44F displays the name of the first information source and the name of the second information source corresponding to the service accepted by the service selection acceptance unit 44E on the input screen displayed on the display unit 42. For example, as shown in Figs. 6(b) and 6(c) described later, the characters "user authentication electronic certificate" may be displayed above the first PIN input field as the name of the first information source, and the characters "certificate information input assistance AP" may be displayed above the second PIN input field as the name of the second information source. Here, "AP" is an abbreviation for application. By displaying the names of the information sources, the user can easily recognize the names of the information sources required depending on the service, and the user can smoothly input authentication information.

[0028] The functions of the above-mentioned components of the user terminal 40 are configured by hardware and software constituting the user terminal 40, such as a central processing unit (CPU), a microprocessor (MPU), a ROM storing programs, a RAM, etc., and are designed to perform various processes according to the programs stored in the ROM. In addition, various data are stored in a storage unit (not shown) realized by a memory or storage, such as a solid state drive (SSD) or a hard disk drive (HDD).

[0029] The following describes, with reference to the drawings, the procedure for user authentication registration using a public personal authentication service, including acquisition of information from multiple information sources, in the information processing system 1 having the configurations of Figures 1, 2, and 3. Note that an information processing program including an authentication API provided by a platform operator that provides the public personal authentication service is installed in the user's own user terminal 40, and the user can receive the personal authentication service by operating the user terminal 40.

[0030] 4 is a flowchart for explaining an onboarding start process in user authentication registration using a public personal authentication service by the information processing system 1 according to an embodiment of the present invention. When a user starts a digital identification card application installed in the user terminal 40, an explanation of the application is displayed on the display unit 42 of the user terminal 40 (step S11). On the explanation screen of the application, for example, an explanation of situations in which the digital identification card can be used, how to use it, and an explanation of the advantages of using the application are displayed on the screen.

[0031] As the user continues to read the explanatory screen of the app, the app screen then displays the terms of use and privacy policy of the app (step S12). As the user continues to read the explanatory text on the screen, the app screen then displays confirmation items before registration (for example, a notice that the user should have their My Number card ready) (step S13). At this time, an explanatory text may be displayed to the effect that the information input by the user will be handled securely, to inform the user that the My Number itself will not be obtained and that the input PIN will not be stored at all on the information processing system 1.

[0032] Next, when the user operates the input unit 43 of the user terminal 40 to select a service to be used, the service selection receiving unit 44E receives the user's selection of the service to be used (step S14). In the information processing system 1 of this embodiment, information on each service to be used and a combination of the first information source, the first information, the second information source, and the second information required for the user to receive the service is stored in the authentication server 10 or the management server 30, or in a database (not shown) managed by them. For example, when the service to be used by the user is opening a bank account, the service, the first / second information source, and the first / second information are a combination of data as shown below. Services: Opening a bank account · First source of information: Digital certificate for signing Primary information: electronic signature, name, address, date of birth, gender - Secondary information source: Application to assist with entering card details Second information: Personal number Then, the information acquiring unit 44D acquires the first information from the first information source and the second information from the second information source that correspond to the service to be used selected by the service selection accepting unit 44E.

[0033] Next, the user uses the PIN number of either the user authentication electronic certificate or the signature electronic certificate, which is the electronic certificate of the first information source, to perform user authentication via the public personal authentication service, and selects whether to perform user authentication registration in the service operated by the management server 30 of the service provider (step S15). Note that the signature electronic certificate has certain restrictions (e.g., age restrictions) on its acquisition or use in the public personal authentication service, while the user authentication electronic certificate has no certain restrictions on its acquisition or use in the public personal authentication service.

[0034] In addition, in addition to allowing the user to select which electronic certificate to use to receive the public personal authentication service by using a selection button or the like on the screen, it is also possible to set the public personal authentication service to be received using one of the electronic certificates by default, and if the service cannot be received from that screen, the user may transition to a screen for receiving the public personal authentication service using the other electronic certificate.

[0035] At the branch in step S15, if the user authentication and registration process is performed using a user authentication electronic certificate and a card information input assistance application, the process proceeds to the process shown in Figure 5; if the user authentication and registration process is performed using a signature electronic certificate, the process proceeds to the process shown in Figure 7.

[0036] FIG. 5 is a flowchart for explaining a user authentication and registration process using a public personal authentication service that uses a user authentication electronic certificate (first information source) in the information processing system 1 according to an embodiment of the present invention. When a user selects to perform a user authentication and registration process using the user authentication electronic certificate and the card information input assistance application, a screen is displayed on the display unit 42 of the user terminal 40, prompting the user to input a four-digit PIN (authentication information) for each of the user authentication electronic certificate and the card information input assistance application (step S21). Then, when the user inputs a four-digit PIN for each of the user authentication electronic certificate and the card information input assistance application using the input unit 43 of the user terminal 40, the input information is accepted by the authentication information acceptance unit 44A (step S22). Note that, in addition to a four-digit PIN, a password combining English characters or the like can also be used as the authentication information.

[0037] 6 is a diagram for explaining an example of a processing screen by the authentication API displayed on the user terminal 40 of the information processing system 1 according to an embodiment of the present invention. In the above-mentioned display of the input screen on the user terminal 40 (step S21) and acceptance of the input PIN (step S22), the first authentication information (PIN) corresponding to the first information source (electronic certificate for user authentication) and the second authentication information (PIN) corresponding to the second information source (face information input assistance AP) are input. Here, regarding the input of these PINs, the screen may be changed as shown in FIG. 6(a) so that each authentication information is input on a different screen, but in this embodiment, each authentication information (PIN) of four digits is input on the same screen as shown in FIG. 6(b) and FIG. 6(c).

[0038] As described above, in this embodiment, the user inputs the first authentication information and the second authentication information on a PIN input screen displayed on a single screen at the user terminal 40, and these are simultaneously accepted by the user terminal 40. That is, even if the first authentication information corresponding to the first information source and the second authentication information corresponding to the second information source are the same or not (including the case where the user mistakenly believes them to be the same), the user can input these two pieces of authentication information from a single input screen, and the authentication information accepting unit 44A can accept both of these two pieces of authentication information simultaneously, thereby making it possible to suitably reduce the effort and time required for the user to operate the terminal.

[0039] In addition to the above-mentioned aspect, the authentication information receiving unit 44A may be configured to receive the first authentication information and the second authentication information by inputting either one of the first authentication information or the second authentication information. That is, even if the first authentication information corresponding to the first information source and the second authentication information corresponding to the second information source are the same or not (including the case where the user mistakenly believes them to be the same), both the first authentication information corresponding to the first information source and the second authentication information corresponding to the second information source may be received by inputting one authentication information.

[0040] After the authentication information is received by the authentication information receiving unit 44A as described above, a reading screen for reading the identity verifiable medium by the reading unit 44B as shown in FIG. 6(d) is displayed on the display screen of the user terminal 40, and an explanation of how to read the identity verifiable medium is shown to the user. Then, the user makes the user terminal 40 read the identity verifiable medium such as a My Number card according to the contents of the explanation. Specifically, the user holds the identity verifiable medium (My Number card) that can be used for the user's identity verification over a predetermined part such as the back of the user terminal 40 once, so that the reading unit 44B of the user terminal 40 reads the identity verifiable medium (step S23). Here, "reading" the identity verifiable medium, which is the identity verifiable medium, by the user terminal 40 may be, for example, communication using NFC, the Internet, etc. between the user terminal 40 (smartphone, PC, etc.) and the identity verifiable medium. Alternatively, it may be reading a QR code (registered trademark) or the like provided on the identity verifiable medium using a camera or the like provided on the user terminal 40.

[0041] In addition, in this embodiment, the identity verification medium refers to a medium that can be used for identity verification. The identity verification medium may be a tangible medium or an intangible medium. For example, the tangible medium may be an identity verification card such as a My Number card, and the intangible medium may be an application such as a smartphone JPKI.

[0042] Then, the authentication information transmitting unit 44C transmits the authentication information input by the user and accepted by the authentication information accepting unit 44A to the personal identification card (personal identification medium) read by the reading unit 44B in one reading process (step S24). Here, the personal identification card (personal identification medium) read by the reading unit 44B in one reading process may be, for example, a personal identification medium (such as a My Number card) that has been held over or brought close to the user terminal 40 only once. It may also be a personal identification medium that has communicated with the user terminal 40 only once (the process from the start to the end of communication with the user terminal 40 is only once).

[0043] After the authentication information is received by the authentication information receiving unit 44A in this way, when the user holds the user terminal 40 over the My Number card, authentication is performed on the condition that the input PIN is correct. For example, in the authentication process here, the authentication information (information related to the PIN) is transmitted from the user terminal 40 (such as a smartphone) to the IC chip of the My Number card by, for example, NFC communication, and the authentication process is performed. Then, the information acquiring unit 44D acquires a first information source (electronic certificate for user authentication) that is usable in the public personal authentication service stored in the IC of the My Number card and does not contain personal information via the public personal authentication application of the My Number card (step S25). That is, when the authentication information is authenticated by the personal identification medium, the information acquiring unit 44D acquires the first information of the first information source and the second information of the second information source that correspond to the authentication information and are stored in the personal identification medium.

[0044] Also, in step S25, when the first authentication information is accepted by the authentication information accepting unit 44A and then authenticated by the above process, the information acquiring unit 44D acquires personal information including the four pieces of information, that is, name, address, date of birth, and gender, through a predetermined application (for example, a card details input assistance application) which is a second information source provided by a public institution such as a national government, a local government, an independent administrative institution, or a special corporation. The personal information may be only these four pieces of information, or may be information other than these four pieces of information. The predetermined application which is the second information source may be a card details input assistance application, a resident registration application, or the like, in addition to the card details input assistance application. "Provided by a public institution" may mean a case where the information is provided directly by a public institution, or a case where the information is provided indirectly via a private company, etc.

[0045] Next, the electronic certificate information and personal information acquired by the information acquisition unit 44D are transmitted from the user terminal 40 to the authentication server 10 (the information may be transmitted by the "information transmission unit (not shown)" of the user terminal 40), and the transmitted electronic certificate information and personal information are authenticated by the authentication unit 12 of the authentication server 10 (step S26). Here, the authentication unit 12 acquires information required for verification (at the time of expiration) from a public institution or a corporation managed by a public institution using an authentication device (authentication server 10), performs authenticity determination on the electronic certificate information and personal information acquired by the information acquisition unit 44D, and performs authentication if there is no fraud (the information is genuine). The function of the authentication unit 12 may be held not on the authentication server 10 side but on the client side user terminal 40 (authentication unit 46).

[0046] Then, when the authentication unit 12 authenticates the information on the electronic certificate and the personal information, the user authentication registration unit 47 performs user authentication registration for the user (step S27). By performing user authentication registration using such a public personal authentication service, the information processing system 1 can prevent unauthorized registration and easily and conveniently obtain the information on the electronic certificate and the personal information required for user authentication registration. Here, the user authentication registration may be, for example, registration of a user who uses at least a part of the information processing system 1 or a service related to the information processing system 1. In addition, in the user authentication registration, for example, personal information of the user (name, address, date of birth, gender, etc.), information on the user authentication electronic certificate (including the user authentication electronic certificate itself, information recorded in the user authentication electronic certificate, etc.), and information on the signature electronic certificate (including the signature electronic certificate itself, information recorded in the signature electronic certificate, etc.) may be registered (stored). The information recorded in the user authentication electronic certificate may be registered as information in a state separated from the user authentication electronic certificate, and the information recorded in the signature electronic certificate may be registered as information in a state separated from the signature electronic certificate.

[0047] Then, when the authentication unit 12 (or authentication unit 46) authenticates the information in the electronic certificate and the personal information, and the user authentication registration unit 47 has already performed user authentication registration, the login processing unit 48 performs login processing (step S28). In the information processing system 1, the user login can be performed in the same processing flow as the user authentication registration.

[0048] Further, in addition to the functions of the authentication unit 46 (authentication unit 12) and the information acquisition unit 44D (information acquisition unit 13), the functions of the "authentication information acceptance unit 44A" and the "user authentication registration unit 47" may be provided on the server side (authentication server 10) in addition to the functions provided on the client side user terminal 40. All of these functions may be provided on the server side, or all of them may be provided on the client side, or only some of the functions may be provided on one side.

[0049] 7 is a flowchart for explaining a user authentication and registration process using a public personal authentication service that uses a signature electronic certificate in an information processing system 1 according to an embodiment of the present invention. When a user selects to perform user authentication and registration process using a signature electronic certificate in step S15 of the onboarding start processing described above, a screen (not shown) appears on the display unit 42 of the user terminal 40 for inputting a 6- to 16-digit alphanumeric password for the signature electronic certificate (step S31).

[0050] When the user inputs a 6- to 16-digit alphanumeric password (authentication information) for the signature electronic certificate on the display screen of user terminal 40, the authentication information is accepted by authentication information accepting unit 44A (step S32).

[0051] Here, similarly to the case of using the electronic certificate for user authentication described above, the user holds an identity verification card, which is an identity verification medium that can be used to verify the user's identity, over a designated part of the user terminal 40, such as the back of the user terminal 40, and the reading unit 44B of the user terminal 40 reads the identity verification card (step S33). Then, the authentication information transmitting unit 44C transmits the authentication information input by the user and accepted by the authentication information accepting unit 44A to the personal identification card (personal identification medium) read by the reading unit 44B in one reading process (step S34).

[0052] After the authentication information is received by the authentication information receiving unit 44A, when the user holds the back of the user terminal 40 over the My Number card, authentication is performed on the condition that the entered PIN is correct. If the authentication is successful, the information acquiring unit 44D acquires information on the electronic certificate that can be used in the public personal authentication service and includes personal information (step S35). Note that the authentication process and the contents of the personal information are the same as those in the case of the electronic certificate by the above-mentioned NFC communication, and therefore will not be described here.

[0053] Next, the information (including personal information) of the electronic certificate acquired by the information acquisition unit 44D is authenticated by the authentication unit 12 of the authentication server 10 (step S36). Here, the authentication unit 12 acquires information required for verification (at the time of expiration) from a public institution or a corporation managed by a public institution using an authentication device (authentication server 10), performs authenticity determination on the information of the electronic certificate including the personal information acquired by the information acquisition unit 44D, and performs authentication if there is no fraud (it is genuine). Note that the function of the authentication unit 12 may be provided in the authentication unit 46 of the user terminal 40 on the client side, rather than on the authentication server 10 side.

[0054] Then, when the authentication unit 12 authenticates the information of the electronic certificate including personal information, the user authentication registration unit 47 performs user authentication registration for the user (step S37). Here, the contents of the user authentication registration are the same as those of the user authentication registration described above, so a detailed description will be omitted. By performing such processing in the information processing system 1, it is possible to prevent fraudulent registration in user authentication registration using the public personal authentication service, and to easily and conveniently obtain information on the electronic certificate for signature required for user authentication registration.

[0055] Then, when the authentication unit 12 (or the authentication unit 46) authenticates the information (including personal information) in the electronic certificate and the user authentication registration unit 47 has already performed user authentication registration, the login processing unit 48 performs a second login process (step S38).

[0056] In this embodiment, in step S15 of the onboarding start process, a process branch is made to determine which electronic certificate to use. In this case, when user authentication registration of one of the two is performed, user authentication registration of the other may be disabled, or user authentication registration of the other may be enabled. In addition, the difference between the two electronic certificates described above is that they are used differently depending on whether or not there is an age restriction, but restrictions may also be set based on the user's attributes, career, etc.

[0057] The effects obtained by the two user authentication registrations mentioned above are the same, and may be, for example, the ability to log in to applications in the information processing system 1, the ability to log in to applications provided by a service provider operator that has information exchange with the personal authentication service provided by the platform operator, the ability to log in to other services or use services, etc.

[0058] In the above embodiment, the first information source is an electronic certificate that can be used in a public personal authentication service, and the second information source is a predetermined application provided by a public institution. More specifically, for example, the electronic certificate of the first information source may be a signature electronic certificate, and the predetermined application of the second information source may be a card details input assistance application. In this case, the signature electronic certificate includes an electronic signature and four pieces of information (name, address, date of birth, and gender), but does not include a personal number. On the other hand, the card details input assistance application includes a personal number. Therefore, by acquiring information from the signature electronic certificate (first information) and information from the card details input assistance application (second information), information can be supplemented, and information required for the service used by the user can be acquired. Also, for example, the electronic certificate of the first information source may be a user authentication electronic certificate, and the predetermined application of the second information source may be a card details input assistance application. In this case, the user authentication electronic certificate does not include personal information (name, address, date of birth, sex, individual number), and the card details input assistance application includes personal information, so that the information can be supplemented and the user can obtain the information required for the service he or she uses. Also, for example, the electronic certificate of the first information source may be a signature electronic certificate or a user authentication electronic certificate, and the predetermined application of the second information source may be a card details confirmation application. In this case, the signature electronic certificate and the user authentication electronic certificate do not include a facial photograph, and the card details confirmation application includes a facial photograph, so that the information can be supplemented and the user can obtain the information required for the service he or she uses.

[0059] In the information processing system 1 according to the present embodiment, when the first information is information on the user certification electronic certificate or information on the signature electronic certificate, and the second information is personal information in the card details input assistance application, the authentication unit 46 authenticates at least one of the information on the user certification electronic certificate acquired by the information acquisition unit 44D, the personal information, and the information on the signature electronic certificate. When the authentication unit 46 authenticates the information on the user certification electronic certificate and the personal information, or the information on the signature electronic certificate, the user authentication registration unit 47 performs user authentication registration for the user. Furthermore, when the authentication unit 46 authenticates the information on the user certification electronic certificate or the information on the signature electronic certificate, and the user authentication registration has already been performed by the user authentication registration unit 47, the login processing unit 48 performs login processing.

[0060] In this way, user authentication registration can be performed by authenticating the information in the user authentication electronic certificate and the personal information in the card details input assistance application or the information in the signature electronic certificate by the authentication unit 46. On the other hand, login processing can be performed by authenticating the information in the user authentication electronic certificate or the information in the signature electronic certificate. In other words, in login processing, it is not necessary for the authentication unit 46 to authenticate the personal information in the card details input assistance application, and it is sufficient for the authentication unit 46 to authenticate either the information in the user authentication electronic certificate or the information in the signature electronic certificate. Furthermore, user authentication registration and login processing are possible whether or not the personal information (second information) in the card details input assistance application acquired by the information acquisition unit 44D is used.

[0061] The configuration of the information processing system 1, the authentication server 10, and the user terminal 40 described in this embodiment are merely examples, and may be changed without going beyond the scope of the present invention. The flow of processing in the information processing system 1 is also merely an example, and it is possible to delete unnecessary processing steps, add new processing steps, and replace processing steps without going beyond the scope of the present invention. In this embodiment, information stored in a My Number card is used, but the present invention is not limited to this.

[0062] Below, examples of reference forms are given. 1. An authentication information receiving unit that receives authentication information input by a user to a user terminal; A reading unit that reads an identity verifiable medium that can be used to verify the identity of the user by the user terminal; an authentication information transmitting unit that transmits the authentication information to the identity verifiable medium read by the reading unit in one reading process; an information acquisition unit that acquires, when the authentication information is authenticated in the personal identification medium, first information of a first information source and second information of a second information source that correspond to the authentication information and are stored in the personal identification medium; An information processing system comprising: 2. The information processing system according to claim 1, wherein the identity verifiable medium is a tangible object. 3. The information processing system described in 2., wherein the tangible object is an identification card equipped with an IC chip that stores an electronic certificate issued to an individual in a public personal authentication service and that can be used for identity verification. 4. The method further includes a service selection receiving unit for receiving a selection of a service to be used by the user, The information acquisition unit acquires the first information of the first information source and the second information of the second information source corresponding to the service selected by the service selection reception unit. 1. The information processing system according to claim 1. 5. The information processing system described in 4., further characterized in that it further comprises a name display unit that displays the name of the first information source and the name of the second information source corresponding to the service accepted by the service selection accepting unit on an input screen where the authentication information is input from the user to the user terminal. 6. The first information source is an electronic certificate available in a public personal authentication service; The second information source is a predetermined application provided by a public institution. 1. The information processing system according to claim 1. 7. The electronic certificate is a signature electronic certificate, The predetermined application is a card information input assistance application. 6. The information processing system according to claim 6. 8. The electronic certificate is a user authentication electronic certificate, The predetermined application is a card information input assistance application. 6. The information processing system according to claim 6. 9. The electronic certificate is a signature electronic certificate, The predetermined application is a card information confirmation application. 6. The information processing system according to claim 6. 10. The electronic certificate is a user authentication electronic certificate, The predetermined application is a card information confirmation application. 6. The information processing system according to claim 6. 11. The authentication information includes first authentication information corresponding to the first information source and second authentication information corresponding to the second information source; The information processing system described in 1. is characterized in that the authentication information receiving unit receives the first authentication information and the second authentication information when the user inputs either the first authentication information or the second authentication information into the user terminal. 12. The authentication information includes first authentication information corresponding to the first information source and second authentication information corresponding to the second information source; The authentication information receiving unit simultaneously receives the first authentication information and the second authentication information by the user inputting the first authentication information and the second authentication information on one input screen displayed on the user terminal. 1. The information processing system according to claim 1. 13. The first information is information on a user authentication electronic certificate or information on a signature electronic certificate, and the second information is personal information in a card information input assistance application or personal information in a card information confirmation application, an authentication unit that authenticates at least one of the information of the user-certification electronic certificate acquired by the information acquisition unit, the personal information in the card information input assistance application, the personal information in the card information confirmation application, and the information of the signature electronic certificate; a user authentication registration unit that performs user authentication registration for the user when the authentication unit authenticates the information on the user-certification electronic certificate and the personal information in the card information input assistance application or the personal information in the card information confirmation application, or the information on the signature electronic certificate; a login processing unit that performs a login process when the authentication unit has authenticated the information on the user-certification electronic certificate or the information on the signature electronic certificate and the user authentication registration unit has already performed the user authentication registration; 1. The information processing system according to claim 1, further comprising: 14. Computers an authentication information receiving unit that receives authentication information input by a user to a user terminal; A reading unit that reads an identity verifiable medium that can be used to verify the identity of the user by the user terminal; an authentication information transmitting unit that transmits the authentication information to the identity verifiable medium read by the reading unit in one reading process; an information acquisition unit that acquires, when the authentication information is authenticated in the personal identification medium, first information of a first information source and second information of a second information source corresponding to at least the authentication information among a plurality of information sources stored in the personal identification medium; An information processing program that functions as a [Explanation of symbols]

[0063] 1. Information Processing Systems 10 Authentication Server 12, 46 Authentication Department 13, 44D Information acquisition section 40 User terminal 44 Information Acquisition Function Unit 44A Authentication Information Reception Department 44B Reading unit 44C Authentication information transmission unit 44E Service Selection Reception 44F Name display area 47 User authentication registration section 48 Login processing section

Claims

1. an authentication information receiving unit that receives authentication information input by a user to a user terminal; A reading unit that reads an identity verifiable medium that can be used to verify the identity of the user by the user terminal; an authentication information transmitting unit that transmits the authentication information to the identity verifiable medium read by the reading unit in one reading process; an information acquisition unit that acquires, when the authentication information is authenticated in the personal identification medium, first information of a first information source and second information of a second information source that correspond to the authentication information and are stored in the personal identification medium; An information processing system comprising:

2. 2. The information processing system according to claim 1, wherein the identity verifiable medium is a tangible object.

3. 3. The information processing system according to claim 2, wherein the tangible object is an identity verification card that is equipped with an IC chip storing an electronic certificate issued to an individual in a public personal authentication service and that can be used for identity verification.

4. A service selection receiving unit that receives a selection of a service to be used by the user, The information acquisition unit acquires the first information of the first information source and the second information of the second information source corresponding to the service selected by the service selection reception unit.

2. The information processing system according to claim 1 .

5. The information processing system according to claim 4, further comprising a name display unit that displays the name of the first information source and the name of the second information source corresponding to the service accepted by the service selection accepting unit on an input screen on which the authentication information from the user is input to the user terminal.

6. the first information source is an electronic certificate available in a public personal authentication service; The second information source is a predetermined application provided by a public institution.

2. The information processing system according to claim 1 .

7. the electronic certificate is a signature electronic certificate, The predetermined application is a card information input assistance application.

7. The information processing system according to claim 6.

8. The electronic certificate is a user authentication electronic certificate, The predetermined application is a card information input assistance application.

7. The information processing system according to claim 6.

9. the electronic certificate is a signature electronic certificate, The predetermined application is a card information confirmation application.

7. The information processing system according to claim 6.

10. The electronic certificate is a user authentication electronic certificate, The predetermined application is a card information confirmation application.

7. The information processing system according to claim 6.

11. the authentication information includes first authentication information corresponding to the first information source and second authentication information corresponding to the second information source; The information processing system according to claim 1, characterized in that the authentication information receiving unit receives the first authentication information and the second authentication information when the user inputs either the first authentication information or the second authentication information into the user terminal.

12. the authentication information includes first authentication information corresponding to the first information source and second authentication information corresponding to the second information source; The authentication information receiving unit simultaneously receives the first authentication information and the second authentication information by the user inputting the first authentication information and the second authentication information on one input screen displayed on the user terminal.

2. The information processing system according to claim 1 .

13. The first information is information on a user authentication electronic certificate or information on a signature electronic certificate, and the second information is personal information in a card details input assistance application or personal information in a card details confirmation application, an authentication unit that authenticates at least one of the information of the user-certification electronic certificate acquired by the information acquisition unit, the personal information in the card information input assistance application, the personal information in the card information confirmation application, and the information of the signature electronic certificate; a user authentication registration unit that performs user authentication registration for the user when the authentication unit authenticates the information on the user-certification electronic certificate and the personal information in the card information input assistance application or the personal information in the card information confirmation application, or the information on the signature electronic certificate; a login processing unit that performs a login process when the authentication unit has authenticated the information on the user-certification electronic certificate or the information on the signature electronic certificate and the user authentication registration unit has already performed the user authentication registration; The information processing system according to claim 1 , further comprising:

14. Computer, an authentication information receiving unit that receives authentication information input by a user to a user terminal; A reading unit that reads an identity verifiable medium that can be used to verify the identity of the user by the user terminal; an authentication information transmitting unit that transmits the authentication information to the identity verifiable medium read by the reading unit in one reading process; an information acquisition unit that acquires, when the authentication information is authenticated in the personal identification medium, first information of a first information source and second information of a second information source corresponding to the authentication information among a plurality of information sources stored in the personal identification medium; An information processing program that functions as a

Images