User authentication system

Abstract

To provide means for verifying the identity through a method different from conventional methods, in identity verification which is required in issuing a new password or recovering from account lockout.SOLUTION: Users do not need to memorize verification information by generating the collation information in an image code format, the verification information being required for a process of issuing a password for a user to log in to software or required for a process of recovery for a user whose account has been locked out.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a user authentication system for enabling a user to log in to software, a system, etc. that the user uses, and a method for generating information for verification. [Background technology]

[0002] Software that users log in to, such as SaaS (Software as a Service), may have a built-in function that resets a password and issues a new password in case the user forgets the password used to log in (hereinafter referred to as the "password management function"). When executing this password management function, there are several types of authentication methods, such as a type that authenticates the user by asking questions and answers using information known only to the user, separate from the login password (the "secret question type"), or a type that sends an email containing a specified URL to a pre-registered email address, etc., and authenticates the user by the fact that the URL is accessed (the "password reset email type").

[0003] The following Patent Document 1 discloses an authentication management system that appropriately combines the above-mentioned secret question method and password reset email method to enable a user to reset a password even if the user has forgotten both the password and the answer to the secret question. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-041347 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, when the conventional method is used, at least one of the problems described below occurs. (1) Like a password, the answers used in the "secret questions" rely on the user's memory. If the user ends up forgetting the answers, there is no way for the user to recover on his or her own. (2) If you forget the password to log in to the email sending and receiving system, the "password reset email system" does not allow you to check the email in the first place, so there is no room for relief.

[0006] Therefore, one of the objects of the present invention is to provide a means for enabling identity authentication, which is required for tasks such as issuing a new password or recovering an account lock, in a manner different from conventional methods. [Means for solving the problem]

[0007] The present invention, made to solve the above-mentioned problems, provides a user authentication system comprising at least a storage unit that stores a user's matching information, a code generation unit that generates an image code from which the matching information can be read, and a password issuance unit that compares the matching information read from the photographed data of the image code with the matching information stored in the storage unit, and then executes a process of issuing a new password for the user related to the matching information. In addition, the present invention may further include a code storage unit that stores the image code generated by the code generation unit in a manner that can be viewed directly or indirectly, and the code storage unit may be provided in a personal terminal owned by the user, and the personal terminal may be configured to have an identity verification function for the user. The present invention may also be configured such that the code generating section generates print data including the generated image code. The present invention may also be configured such that the verification information is generated by hashing issuance information that includes identification information of the user and information related to a process for issuing a password for the user. In addition, the present invention may be configured to further include an account recovery unit that compares the comparison information read from the photographed data of the image code with the comparison information stored in the storage unit, and then executes a recovery process for the account lock state of the user related to the comparison information. The present invention may be configured such that the image code is a one-dimensional code or a two-dimensional code. The present invention also provides a method for generating comparison information, characterized in that the comparison information required for issuing a password for a user to log in to software and / or for recovering a user whose account has been locked is generated in image code format. Effect of the Invention

[0008] According to the present invention, at least one of the following effects can be obtained. (1) Since the verification information for identity authentication required when issuing a new password or recovering an account lock is generated in the form of an image code, the user does not need to memorize the verification information. Instead, the user can proceed with the issuance of a new password simply by scanning the image code displayed on the terminal screen, thereby contributing to improved convenience in issuing passwords. (2) By storing the image code in a personal terminal having a user's identity verification function, there is no need to provide a new storage means with high security. (3) By hashing the matching information required to issue a new password and then generating an image code, the user ID and password will not be made known to the outside world even if the image code is leaked to the outside world. (4) The user authentication system according to the present invention can also be used in cases where issuing a new password is not required (for example, recovery from an account lock state for a user who has been locked out of logging into software, etc.). [Brief description of the drawings]

[0009] [Figure 1]FIG. 1 is a schematic diagram showing a configuration of a user authentication system according to a first embodiment. [Diagram 2] FIG. 13 is an image diagram showing the process from user registration to sending an image code. [Diagram 3] An image of the code display screen and destination input screen. [Figure 4] FIG. 13 is an image diagram showing the process from issuing an instruction to issue a new password to sending an image code. [Diagram 5] An image of the login screen and selection screen. [Figure 6] An image of the code reading screen and password setting screen. [Figure 7] An image of the code display screen including the new image code. [Figure 8] FIG. 11 is an image diagram showing an example of providing an image code in the user authentication system according to the second embodiment. [Figure 9] FIG. 13 is an image diagram of a code display screen according to the second embodiment. [Figure 10] FIG. 11 is a schematic diagram showing the configuration of a user authentication system according to a third embodiment. [Figure 11] 13A and 13B are image diagrams of a code reading screen and a password setting screen according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, embodiments of the present invention will be described with reference to the drawings. EXAMPLES

[0011] <1> Overall configuration (Fig. 1) A user authentication system A according to the present invention is a system for managing passwords used by users to log in to software. The user authentication system A of the present invention can be realized in various forms, such as being provided as being pre-integrated into the software that the user logs in to use, or being provided as independent software or an API (Application Programming Interface) that operates in conjunction with the software that the user logs in to use.

[0012] A user authentication system A according to this embodiment includes a storage unit 10, a code generating unit 20, a code storage unit 30, and a password issuing unit 40, as shown in FIG. Each part can be realized by a program installed on various information processing devices such as a server, a PC, a smartphone, or a tablet. Furthermore, each unit may be incorporated into a separate information processing device, or may be incorporated in any combination into a single information processing device. The details of each part will be explained below.

[0013] <2> Storage section (Fig. 1) The storage unit 10 has a function for storing verification information 11 of a user. The verification information 11 is information used for user authentication when resetting or reissuing a password.

[0014] <2.1> Verification information In the present invention, from the viewpoint of security protection, it is preferable that the matching information 11 includes not only information capable of identifying the user, but also other information. In this embodiment, the matching information 11 includes identification information 12 assigned to each user, as well as issuance information 13 consisting of information related to the issuance process of a password for the user that is prepared separately from the identification information 12.

[0015] <2.2> Identification information The identification information 12 is information for identifying a specific user. The identification information 12 consists of the user's email address or any string of characters using letters, numbers, symbols, etc., and is also called a "UUID (Universally Unique IDentifier)" because it is assumed to be assigned to each user.

[0016] <2.3> Publication information The issuing information 13 is information that is given to each user separately from the identification information 12, and is information that is generated in association with the process of issuing a password to the user. An example of issuing information 13 is date and time information (YYYYMMDD) indicating the date and time when a password was issued when registering a new user within the software or system, or date and time information indicating the date and time when a password was re-issued to an already registered user. In this case, the issuing information 13 can use information expressed in the so-called "YYYYMMDD format" or the like.

[0017] <2.4> How to store information for verification In the present invention, it is preferable to store the matching information 11 in a hashed form. Hashing is the process of replacing the original data with a random string of characters based on a specific calculation method. Since hashing is an irreversible conversion, the storage unit 10 stores the character strings obtained by hashing the identification information 12 and the issuing information 13 as the matching information 11.

[0018] <3> Code generation section (Figure 1) The code generating unit 20 has a function for generating an image code 21 from which the verification information 11 of the user can be read.

[0019] <3.1> Image code The image code 21 may be a one-dimensional code or a two-dimensional code. A one-dimensional code is a code that displays information in one direction, and a typical example is a barcode. A two-dimensional code is a code that displays information in two directions (horizontally and vertically), and representative examples include QR Code (registered trademark), SP Code, CP Code, Aztec Code, Semacode, and High Capacity Color Barcode.

[0020] <3.2> Image code destination In the present invention, the destination of the image code 21 transmitted by the code generating unit 20 is not limited to the user associated with the matching information 11 included in the image code 21. For example, other possible destinations of the image code 21 may include the superior of the user associated with the verification information 11 included in the image code 21, or a person in charge of security management within the company. In the present invention, the method for setting the destination of the image code 21 may be a method input and selected by the user as appropriate, or a method that is preset within the system for each user.

[0021] <3.3> How to send image code In the present invention, the method of transmitting the image code 21 by the code generating unit 20 can be appropriately selected from various methods such as an email address, an SMS (short message), a chat tool, or other communication tools. In the present invention, the method of transmitting the image code 21 may be a method appropriately selected by the user or a method that is preset in the system for each user.

[0022] <4> Code storage section (Figure 1) The code storage unit 30 has a function of storing the image code 21 received from the code generation unit 20 . In the present invention, the code storage unit 30 can be provided in a personal terminal E (smartphone, tablet, PC, etc.) owned by the recipient of the image code 21, and it is preferable that this personal terminal E has a function for verifying the identity of the user. In recent years, smartphones, tablets, PCs, etc. used as personal devices E are equipped with identity verification functions using biometric authentication such as fingerprint authentication and facial recognition, and are configured to allow access to data stored on the personal device E after identity verification. Therefore, the personal terminal E is also suitable from the standpoint of security as a storage destination for the verification information required for reissuing a password according to the present invention.

[0023] <5> Password issuing section (Figure 1) The password issuing unit 40 has a function of issuing a new password. First, the password issuing unit 40 compares the verification information 11 read from the photographed data of the image code 21 stored in the code storage unit 30 with the verification information 11 stored in the storage unit 10 . If the result of the comparison is correct, a process of issuing a new password to the user associated with the compared comparison information 11 is executed.

[0024] In the present invention, the content of the process for issuing a new password by the password issuing unit 40 is not particularly limited. For example, the user may be able to set a new password, or the password issuing unit 40 may be able to automatically generate and set a new password.

[0025] <6> Usage image (Fig. 2 to 7) An image of how the user authentication system A according to the present invention is used will be described with reference to FIGS. In this embodiment, the server C functions as the storage unit 10, the code generation unit 20, and the password issuing unit 40 in the present invention, and the personal terminal E owned by the user B functions as the code storage unit 30 in the present invention.

[0026] (1) Premise (transmission of image code) (Fig. 2, Fig. 3) FIG. 2 is an image diagram showing the flow of processing performed when a user is registered as a premise. In order for User B to use software such as SaaS (Software as a Service), User B or a system administrator must first register as a user on the software and obtain a user ID and password required to log in. At the stage of issuing this password, server C uses this user ID as identification information 12, and further uses date and time information indicating the date and time when the password was issued as issue information 13, and generates and stores the verification information 11 by hashing these together. In this embodiment, the identification information 12 is 36 digits long, the issuing information 13 is 8 digits long, and 64 digits long is generated using the hash function "SHA-256." Then, the server C generates an image code 21 made of a readable QR code (registered trademark) from the verification information 11, and transmits it to the user B by a method of his choice.

[0027] (1.1) Screen image (Fig. 3) FIG. 3 is a diagram showing a screen image displayed on the business terminal D used by user B when the image code 21 is transmitted. The code display screen 100 shown in FIG. 3(a) displays an image code 21 and a field in which a transmission method for the image code 21 can be selected. User B may photograph and save the image code 21 displayed on the code display screen 100 using a personal terminal E owned by User B, or may receive and save the image code 21 sent by server C by appropriately selecting from “send via email,” “send via SMS,” or “send via chat app.” The destination input screen 200 shown in FIG. 3(b) is intended to be the screen that is displayed when “Send email” is selected in FIG. 3(a), and displays a field for entering the email address of the destination of the image code 21.

[0028] (1.2) Saving the image code (Fig. 2) The image code 21 sent from the server is received and stored as image data in the personal terminal E owned by user B, and user B can confirm the image data of image code 21 only when user B himself / herself accesses personal terminal E by using the identity verification function provided in personal terminal E.

[0029] (2) When you forget your password (Figures 4, 5, and 6) FIG. 4 is a conceptual diagram showing the flow of processing for issuing a new password using the image code 21 when user B has forgotten his / her password. FIG. 5 is a diagram showing screen images displayed on the business terminal D used by user B, for the processes from the login screen 300 to the reading process of the image code 21. As shown in FIG. For example, if user B forgets his / her password and is unable to log in to the software, user B selects "Forgot your password?" displayed on the login screen 300 shown in Fig. 5(a). Then, server C causes the business terminal D to display the selection screen 400 shown in Fig. 5(b). In the selection screen 400 shown in FIG. 5(b), when proceeding with the password issuance process, the user can choose between reading the image code 21 ("Read Code") or sending the URL of the password issuance page by email ("Send Reset URL by Email"). When User B selects "Read Code" and then "Continue", Server C causes the business terminal D to display the code reading screen 500 shown in FIG.

[0030] (3) Take a picture of the image code and set a new password (Figure 4, Figure 6) When user B photographs the image data of image code 21 stored in personal terminal E with a camera provided in or connected to business terminal D on code reading screen 500 shown in FIG. 6(a) so that the image data fits in display window 510, the photographed data of image code 21 is sent from business terminal D to server C. Server C reads the matching information 11 from the photographed data, compares it with the matching information 11 previously stored in server C, and if it determines that the user is valid, it displays the password setting screen 600 shown in FIG. 6(b) on the business terminal D and prompts user B to enter a new password.

[0031] In the present invention, the verification information 11 may be read from the photographed data on the business terminal D side, and the verification information 11 may be sent to the server C.

[0032] (4) Generate, save, and transmit a new image code (Fig. 4, Fig. 6, Fig. 7, Fig. 3(b)) After user B has completed inputting a new password on the password setting screen 600 shown in FIG. 6(b), server C generates and stores new matching information 11 using user B's identification information 12 and newly generated issuance information 13 based on the issuance date and time of the new password, and generates a new image code 21 using the matching information 11, and causes the business terminal D to display a new code display screen 100 shown in FIG. 7. The method of transmitting the image code 21 related to the code display screen 100 shown in FIG. 7 and the method of setting the destination are as explained in "(1) Premise" above, and therefore a detailed explanation will be omitted. In addition, if the "Save this destination (optional)" box displayed on the destination input screen 200 in FIG. 3(b) is checked, the display of the code display screen 100 shown in FIG. 7 may be omitted.

[0033] <7> summary According to the user authentication system A of this embodiment, when a user forgets the password used for logging in, the matching information 11 required to reissue a new password is provided to the user B, etc. in the form of an image code 21, so that the user B, etc. does not need to memorize the matching information 11. Furthermore, since it is possible to proceed with the process of issuing a new password simply by reading the image code 21 stored in the personal terminal E, the convenience of the password issuing process is improved. EXAMPLES

[0034] <1> Overall configuration (Fig. 8) FIG. 8 is a conceptual diagram showing the flow of management processing of the image code 21 in the second embodiment. In this embodiment, a case is shown in which the person who keeps the image code 21 of user B is a person other than user B. More specifically, the image code 21 is distributed from server C to a code manager F, not to user B himself. This code manager F is a person other than user B, and includes, for example, a system manager, a security manager, user B's superior, etc. In this embodiment, a server C functions as the storage unit 10, the code generation unit 20, and the password issuing unit 40 of the present invention, and the code storage unit 30 provided in the first embodiment is omitted.

[0035] <2> Usage image (Fig. 8, Fig. 9) An image of management of the image code 21 by the code manager F will be described with reference to FIG. First, the code administrator F logs into the system from his / her own business terminal D and selects "Code display" for the target user B from the management screen that can be viewed only by the code administrator F. Then, the server C displays the code display screen 100 shown in FIG. 9 on the business terminal D of the code administrator F. When the code administrator F selects "pdf download" from the code display screen 100, the server C generates pdf data including the image code 21 and causes the pdf data to be downloaded to the business terminal D of the code administrator F. The code administrator F stores image codes 21 of multiple users B in PDF data format on a business terminal D, and can provide the PDF data in the form of electronic data or printed paper upon request from each user B.

[0036] <3> Other destinations Although not shown in the figure, if a system administrator is selected as the code administrator F in Figure 8, the PDF data may not be stored on the system administrator's business terminal D, but may instead be sent by email to each user B or each user B's superior. In this case, the user may select "Send Email" on the code display screen 100 shown in FIG. 9 and input the email address of the user or superior into the destination email address field.

[0037] <4> summary According to the user authentication system A of this embodiment, when a user B forgets the password used for logging in, the image code 21 for reissuing the password can be provided to a person other than the user B, thereby making it possible to manage passwords in accordance with the security standards of each company. EXAMPLES

[0038] <1> Overall configuration (Fig. 10) FIG. 10 is a diagram showing an overall configuration of a user authentication system A in the third embodiment. The user authentication system A of this embodiment further includes an account recovery unit 50 in addition to the configuration of the first embodiment, and assumes a case in which an image code 21 is used as a means of recovering an account lock for a user B whose account is locked.

[0039] <2> Account recovery section (Figure 10) The account recovery unit 50 has a function of performing account recovery processing for user B whose account has been locked. In this embodiment, "account lock" refers to a state in which login by user B associated with a user ID is restricted when authentication fails multiple times consecutively due to incorrect input of a user ID or password during login, etc. In this embodiment, the "account lock recovery process" refers to a state in which the login restriction state of user B associated with the user ID is lifted, allowing login with the previous password.

[0040] The account recovery unit 50 compares the verification information 11 read from the photographed data of the image code 21 stored in the code storage unit 30 with the verification information 11 stored in the storage unit 10. If the result of the comparison is correct, the account lock recovery process is executed for user B associated with the compared comparison information 11.

[0041] In addition, in the user authentication system A according to the present embodiment, the password issuing unit 40 may be configured to issue a new password to the user B in parallel with the “account lock recovery process” performed by the account recovery unit 50.

[0042] <3> Account screen image (Figure 11) FIG. 11(a) is an image of a code reading screen 500 displayed by server C to user B whose account is locked, and FIG. 11(b) is an image of a password setting screen 600 for setting a new password after matching the matching information 11. The operations performed by user B on each screen in FIG. 11 are the same as those described in the first embodiment, and therefore a detailed description thereof will be omitted.

[0043] <4> summary According to the user authentication system A of this embodiment, the image code 21 can also be used as a means for recovering from an account lock, and therefore, is highly versatile. [Explanation of symbols]

[0044] A: User authentication system B: User C: Server D: Business terminal E: Personal device F: Code Administrator 10: Storage section 11: Verification information 12: Identification information 13: Publication information 20: Code generation section 21: Image code 30: Code storage section 40: Password issuing department 50: Account Recovery Department 100: Code display screen 200: Destination input screen 300:Login screen 400: Selection screen 500: Code reading screen 510: Display window 600: Password setting screen

Claims

1. A storage unit that stores user verification information; a code generating unit that generates an image code from which the verification information can be read; a password issuing unit that compares the verification information read from the photographed data of the image code with the verification information stored in the storage unit, and then executes a process of issuing a new password for a user related to the verification information; At least User authentication system.

2. A code storage unit that stores the image code generated by the code generation unit in a directly or indirectly viewable manner, The code storage unit is provided in a personal terminal owned by the user, The personal terminal has a function for verifying the identity of the user.

2. The user authentication system according to claim 1.

3. The code generating unit generates print data including the generated image code.

2. The user authentication system according to claim 1.

4. The verification information is information obtained by hashing issuance information including identification information of the user and information related to a password issuance process for the user.

2. The user authentication system according to claim 1.

5. an account recovery unit that compares the verification information read from the photographed data of the image code with the verification information stored in the storage unit, and then executes a process for recovering the account of the user related to the verification information from a locked state; The present invention further comprises:

2. The user authentication system according to claim 1.

6. The image code is a one-dimensional code or a two-dimensional code.

2. The user authentication system according to claim 1.

7. The method is characterized in that verification information required for issuing a password for a user to log in to software and / or for recovering a locked user's account is generated in the form of an image code. How matching information is generated.

Images