Login system, login lock method and program

Abstract

To provide a login system that is improved in terms of key theft risk, ease of equipment change, convenience, network security keys, vulnerability to hacking of lines, and usage / introduction costs.SOLUTION: A login system 1 of a login password system includes a service providing server 100 managed by a service provider, a user terminal 400 connected to the service providing server 100, a login control server 200 that controls login operations to a website provided by the service provider, and a user's smartphone 300 connected to the login control server 200. During a period in which the user is not using the service of the service providing server, the login control server 200 locks login using the user's smartphone 300 through an operation of the user's smartphone.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a login system, a login lock method, and a program. [Background technology]

[0002] Conventionally, from the standpoint of ensuring security, for example, in a user terminal, personal authentication is required when using the user terminal or browsing a website.

[0003] There are various types of personal authentication methods. For example, a technique has been disclosed in which a predetermined ID number and password are input when an authentication screen is displayed on a user terminal (see, for example, Patent Document 1).

[0004] Furthermore, for books owned by a reader, the reader registers that the reader owns the book from the authenticator terminal in a book possession authentication registration system. The book possession authentication registration system issues a book possession certificate that authenticates that the reader owns the book. The authenticator stamps or signs the book possession certificate and the book owned by the reader. A technology has been disclosed in which, when applying to purchase digital content, a digital content distribution system checks the book possession authentication registration system and calculates a discount on the price of registered digital content at the time of distribution (see, for example, Patent Document 2).

[0005] Also disclosed is a technology for performing principal component analysis on multi-dimensional correlation data relating to the correlation of biological patterns obtained from a plurality of biological samples, determining a first principal component axis of a correlation data distribution relating to the same biological sample and a first principal component axis of a correlation data distribution relating to different biological samples, projecting the multi-dimensional correlation data onto the first principal component axis of each distribution to generate one-dimensional data for each distribution, calculating a Mahalanobis distance from the distribution center of each distribution to each point of the one-dimensional data on the first principal component axis of each distribution, and determining a discrimination reference value for the Mahalanobis distance for discriminating between the same biological sample and different biological samples based on the Mahalanobis distance of each distribution calculated for the plurality of biological samples (for example, see Patent Document 3).

[0006] Furthermore, a character string generating unit 21 of the server 2 generates a character string. An information transmitting unit 22 of the server 2 transmits information including the generated character string and the unique ID to a portable information terminal owned by the user. A transmitting unit 31 of the portable information terminal 3 transmits the voice of the character string read by the user to the server through communication with the unique ID. A technology has been disclosed in which an authenticating unit 23 of the server 2 authenticates a user using the voice of the character string received from the portable information terminal (see, for example, Patent Document 4). [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2003-50781 A [Patent Document 2] JP 2004-348296 A [Patent Document 3] JP 2010-181970 A [Patent Document 4] JP 2015-99470 A Summary of the Invention [Problem to be solved by the invention]

[0008] However, as shown in FIG. 13, the possession authentication described in Patent Document 2 has the problems that, from the user's perspective, there is a high risk of key theft due to external attacks, and, from the carrier's perspective, the line is vulnerable to hacking and the usage / introduction costs are high.

[0009] As shown in FIG. 13, the biometric authentication described in Patent Document 3 has the problems that, from the user's perspective, it is difficult to change equipment, and, from the carrier's perspective, the line is vulnerable to hacking and the usage / introduction costs are high.

[0010] As shown in FIG. 13, for example, in the two-step authentication using SMS or e-mail described in Patent Document 4, from the user's perspective, there is a problem in convenience in terms of exchanging keys via SMS or e-mail, and from the business operator's perspective, there are issues in that the network security key is vulnerable and the usage / introduction costs are high.

[0011] In addition, in the two-step authentication using, for example, Authenticator or OTP described in Patent Document 4, there is a problem in terms of convenience from the user's side, and from the business's side, there is an issue that the network security key is vulnerable.

[0012] Therefore, the present invention has been made in consideration of the above-mentioned problems, and aims to provide a login system that is excellent in terms of the risk of key theft, ease of equipment changes, convenience, network security keys, vulnerability to line hacking, and usage / implementation costs. [Means for solving the problem]

[0013] Form 1: One or more embodiments of the present invention propose a login system using a login and password method, comprising a service providing server managed by a service provider, a user terminal connected to the service providing server, a login control server that controls login operations to websites provided by the service provider, and a user smartphone connected to the login control server, wherein during a period in which a user is not using a service of the service providing server, the login control server locks logins by the user terminal by operating the user smartphone.

[0014] Form 2: One or more embodiments of the present invention propose a login system using a login and password method, comprising a service providing server managed by a service provider, a login control server that controls login operations to a website provided by the service provider, and a user smartphone connected to the login control server, wherein during a period in which a user is not using a service of the service providing server, the login control server locks login via the user smartphone by operating the user smartphone.

[0015] Mode 3: One or more embodiments of the present invention propose a login system characterized in that the user smartphone is connected to the login control server via a secure communication network.

[0016] Aspect 4: One or more embodiments of the present invention propose a login system characterized in that a user can set login lock / unlock for each website using the user smartphone.

[0017] Form 5: One or more embodiments of the present invention propose a login system characterized in that, if the user smartphone has a one-time authentication code, the user smartphone can log in to a desired web page using an ID and the authentication code.

[0018] Form 6: One or more embodiments of the present invention propose a program for causing a computer to execute a login lock method in a login system using a login password, the program including a service providing server, a user terminal connected to the service providing server, a login control server, and a user smartphone connected to the login control server, the program causing a computer to execute a login lock method in a login system using a login password, the login control server locking the login by the user terminal by operating the user smartphone during a period when a user is not using a service of the service providing server.

[0019] Form 7: One or more embodiments of the present invention propose a program for causing a computer to execute a login lock method in a login system using a login password, the program including a service providing server, a login control server, and a user smartphone connected to the login control server, and for causing a computer to execute the program in such a way that, during a period in which a user does not use the service of the service providing server, the login control server locks the login via the user smartphone through operation of the user smartphone. Effect of the Invention

[0020] According to one or more embodiments of the present invention, a login system can be provided that is excellent in terms of risk of key theft, ease of equipment changes, convenience, network security keys, vulnerability to line hacking, and usage / implementation costs. [Brief description of the drawings]

[0021] [Figure 1]1 is a diagram showing a configuration of a login system according to a first embodiment of the present invention. [Diagram 2] 1 is a conceptual diagram of a login system according to a first embodiment of the present invention. [Diagram 3] 1 is a conceptual diagram of a login system according to a first embodiment of the present invention. [Figure 4] 2 is a diagram illustrating a configuration of a login control server according to the first embodiment of the present invention. [Diagram 5] 1 is a diagram showing a configuration of a smartphone according to a first embodiment of the present invention. [Figure 6] FIG. 2 is a diagram showing a process of the login system according to the first embodiment of the present invention. [Figure 7] FIG. 11 is a diagram showing a configuration of a login system according to a second embodiment of the present invention. [Figure 8] FIG. 11 is a diagram illustrating a screen display of a smartphone according to a second embodiment of the present invention. [Figure 9] FIG. 11 is a diagram showing a process of a login system according to a second embodiment of the present invention. [Figure 10] FIG. 11 is a diagram showing a configuration of a login system according to a third embodiment of the present invention. [Figure 11] FIG. 11 is a conceptual diagram of a login system according to a third embodiment of the present invention. [Figure 12] FIG. 11 is a diagram illustrating a screen display of a smartphone according to a third embodiment of the present invention. [Figure 13] FIG. 13 is a comparison table of conventional examples. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, an embodiment of the present invention will be described with reference to FIGS.

[0023] <First embodiment> Hereinafter, a login system 1 according to the present embodiment will be described with reference to FIGS.

[0024] <Login System 1 Configuration> As shown in FIG. 1, a login system 1 according to this embodiment includes a service providing server 100, a login control server 200, a smartphone 300, and a user terminal 400.

[0025] The service providing server 100 is, for example, a server managed by a service provider that provides various services to users through a website. The service providing server 100 is connected to, for example, a login control server 200, a smartphone 300, a user terminal 400, and the like, which will be described later, via the Internet.

[0026] The login control server 200 controls a user's login operation between the service providing server 100 and a smartphone 300, which will be described later. The login control server 200 is connected to, for example, a service providing server 100, a smartphone 300, a user terminal 400, and the like, which will be described later, via the Internet.

[0027] The smartphone 300 is a smartphone owned by a user, and when, for example, the user does not use a user terminal 400 described later, a setting is made to restrict / permit login to the user terminal 400 by a prior operation. In this embodiment, the smartphone 300 is described as an example, but the smartphone 300 may be a tablet terminal or a wearable terminal that the user can carry with them. The smartphone 300 is connected to the Internet via a secure communication network, which will be described later, and is also connected to the login control server 200.

[0028] The user terminal 400 may be, for example, a desktop computer, a notebook computer, a tablet, or the like used by a user. The user terminal 400 is connected to, for example, a service providing server 100, a login control server 200, a smartphone 300, etc., which will be described later, via the Internet.

[0029] In the login system 1 of this embodiment, as shown in FIG. 2, for example, when a lock is set on a website from the smartphone 300, the login control server 200 sets up a barrier between the login screen of the website and the service page, thereby preventing third parties other than the user from accessing the service page. When the user himself / herself uses the smartphone 300, if the user performs unlocking settings in advance using the smartphone 300, the user can use the smartphone by entering the ID and password on the login screen of the website as usual.

[0030] That is, as shown in FIG. 3, when the user is not using the smartphone 300, the smartphone 300 is set to be locked. By doing so, in the locked state, the service page cannot be reached even if the ID and password match. On the other hand, when the user uses the smartphone 300, login is possible if the lock setting is released using the smartphone 300, so the user can freely set the timing at which they can log in. Therefore, even if the ID and password information set by the user is revealed to a malicious third party due to hacking or other reasons, damage caused by impersonation can be prevented.

[0031] <Configuration of the login control server 200> The configuration of the login control server 200 in the login system 1 according to this embodiment will be described with reference to FIG.

[0032] As shown in FIG. 4, the login control server 200 according to this embodiment includes a communication unit 210, a storage unit 220, and a control unit 230.

[0033] The communication unit 210 transmits and receives information between the service providing server 100 and the smartphone 300 . Among these, the lock / unlock information received from the smartphone 300 is output to the control unit 230, which will be described later.

[0034] The storage unit 220 is configured with, for example, a RAM (Random Access Memory) and the like, and stores the lock / unlock information received from the smartphone 300 in this embodiment. Specifically, the control unit 230, which will be described later, writes the lock / unlock information received from the smartphone 300 via the communication unit 210 into the storage unit 220, so that the latest lock / unlock information is always stored. The storage unit 220 may store a database, an encrypted file, and the like.

[0035] The control unit 230 executes overall control of the login control server 200 based on a control program stored in a ROM (Read Only Memory) or the like. Specifically, the control unit 230 executes transmission and reception processing of the communication unit 210, writing information to the storage unit 220, reading information, and the like. The control program may be stored in a flash memory such as an SSD, an HDD, or the like. The control unit 230 may also include an encryption / decryption process for encrypting data and files in the storage unit 220 .

[0036] <Configuration of Smartphone 300> The configuration of the smartphone 300 in the login system 1 according to this embodiment will be described with reference to FIG.

[0037] As shown in FIG. 5, the smartphone 300 according to this embodiment includes a display unit 310, a setting unit 320, a communication unit 330, and a control unit 340. An application program is installed on the smartphone 300 according to this embodiment, and the display unit 310, the setting unit 320, the communication unit 330, and the control unit 340 function under the application program.

[0038] The display unit 310 is configured, for example, as a liquid crystal panel laminated with a touch panel layer. In this embodiment, the display unit 310 displays a setting screen and setting information of a setting unit 320, which will be described later.

[0039] The setting unit 320 performs lock / unlock settings according to the user's wishes. The user can easily set the lock / unlock function by touch operation. The setting information by the setting unit 320 is output to the control unit 340, which will be described later.

[0040] The communication unit 330 transmits and receives information to and from the login control server 200 . The communication unit 330 transmits and receives information to and from the login control server 200 via a secure communication network.

[0041] The control unit 340 executes overall control of the login control server 200 based on application programs stored in a RAM (Random Access Memory) or the like. Specifically, it executes display control processing for the display unit 310, setting information management in the setting unit 320, transmission and reception processing in the communication unit 330, writing and reading information to and from a storage unit (not shown), and the like. The application program may be stored in a flash memory such as an SSD, an HDD, or the like.

[0042] <Login System 1 Processing> The process of the login system 1 according to this embodiment will be described with reference to FIG.

[0043] As shown in FIG. 6, the service providing server 100 receives the ID and password entered by the user via the user terminal 400 (step S110). The ID received by the service providing server 100 is transmitted to the login control server 200 .

[0044] When the login control server 200 receives ID information from the service providing server 100, the control unit 230 searches a database (DB) in the memory unit 220 to detect whether the ID information is locked or unlocked, and transmits the detection result to the service providing server 100 via the communication unit 210 (step S120).

[0045] When the service providing server 100 receives the search result from the login control server 200, it determines whether access to the service page is in a locked state or an unlocked state (step S130). If the service providing server 100 determines that access to the service page is unlocked ("No" in step S130), it executes normal login processing and ends the processing.

[0046] On the other hand, when the service providing server 100 determines that access to the service page is locked ("YES" in step S130), it does not execute the normal login process, but executes an error process and ends the process.

[0047] <Actions and Effects> As described above, the login system 1 of this embodiment includes a service providing server 100 managed by a service provider, a user terminal 400 connected to the service providing server, a login control server 200 that controls login operations to websites provided by the service provider, and a user's smartphone 300 connected to the login control server 200, and during a period when the user is not using the services of the service providing server 100, the login control server 200 locks logins by the user terminal through operation of the user's smartphone. In other words, for example, when a lock is set on a website from the smartphone 300, the login control server 200 sets up a barrier between the login screen of the website and the service page, preventing third parties other than the user from accessing the service page. Therefore, during the period when the user is not using the services of the service providing server 100, the smartphone 300 is set to be locked. By doing so, when the service is locked, it becomes impossible to access the web page providing the service even if the ID and password match. On the other hand, if the user releases the lock setting on the smartphone 300 during the period in which the user is using the service of the service providing server 100, the user is able to log in. Therefore, the user can freely set the timing at which the user can log in. Therefore, even if the ID and password information set by the user is revealed to a malicious third party through hacking or other means, damage caused by impersonation can be prevented. Furthermore, since system vulnerabilities can be consolidated in the login control server 200, security costs can be reduced. In addition, in this embodiment, the login password method is exemplified as the authentication method, but it is also possible to coexist with other authentication methods. Furthermore, the setting of lock / unlock on the smartphone 300 can be performed simply by tapping the display, eliminating the need for complicated setting operations.

[0048] In the login system 1 according to this embodiment, the smartphone 300 is connected to a login control server via a secure communication network. In other words, a malicious third party cannot tamper with the communication data between the smartphone 300 and the login control server 200. Therefore, the security of the login system 1 can be improved.

[0049] <Second embodiment> Hereinafter, the login system 1A according to the present embodiment will be described with reference to FIG. 7 to FIG.

[0050] <Configuration of Login System 1A> As shown in FIG. 7, a login system 1A according to this embodiment includes a service providing server 100, a login control server 200, a smartphone 300A, and a user terminal 400. In addition, since the components having the same reference numerals as those in the first embodiment have the same functions, detailed description thereof will be omitted.

[0051] The smartphone 300A can set login lock / unlock for each website. That is, the smartphone 300A according to this embodiment can collectively manage the locking / unlocking of a plurality of websites. As shown in FIG. 8, the smartphone 300A can lock / unlock websites A, B, and C simply by a tap operation.

[0052] <Login System 1A Processing> The process of the login system 1A according to this embodiment will be described with reference to FIG.

[0053] As shown in FIG. 9, when a user changes the lock / unlock settings for multiple websites using the smartphone 300A, the smartphone 300 transmits information about the changes to the communication unit 210 of the login control server 200 (step S110).

[0054] When the login control server 200 receives the lock / unlock change information for a plurality of websites from the smartphone 300A, the control unit 230 overwrites and changes the information in the storage unit 220, and ends the process (step S220).

[0055] When the smartphone 300A receives a notification from the login control server 200 that the rewriting of the information in the memory unit 220 has been completed successfully, the smartphone 300A performs a process of changing the status display of each website on the display unit 310 of the smartphone 300A and terminates the process (step S230).

[0056] <Actions and Effects> As described above, in the login system 1A according to the present embodiment, the user can set login lock / unlock for each website using the smartphone 300A. In other words, generally, it is possible to centrally manage locking / unlocking for a plurality of websites that have a plurality of methods for generating authentication codes using SMS, email, application programs, etc. and for receiving authentication codes. In addition, when a common ID is used to access multiple websites, as in the case of Open ID, it is possible to recognize whether users of multiple linked websites are the same person. However, it does not permit which user resources can be accessed across multiple websites, or what operations can be performed. Therefore, if a user is hacked by a malicious third party, there is no way to prevent access to a specific website. However, in the login system 1A of this embodiment, multiple websites can be individually locked, so that specific important websites can be locked, thereby controlling them to effectively prevent malicious third parties from logging in.

[0057] <Third embodiment> Hereinafter, a login system 1B according to the present embodiment will be described with reference to FIGS.

[0058] <Configuration of Login System 1B> As shown in FIG. 10, a login system 1B according to this embodiment includes a service providing server 100, a login control server 200, a smartphone 300B, and a user terminal 400. In addition, since the components having the same reference numerals as those in the first and second embodiments have the same functions, detailed description thereof will be omitted.

[0059] When the user's smartphone 300B has a one-time authentication code, the user's smartphone 300B can log in to a desired web page using only the ID. As shown in FIG. 11, when the user's smartphone 300B has a one-time authentication code, a route different from that in the first and second embodiments is provided, making it possible to log in to a desired web page using only the ID. As shown in FIG. 12, when the user's smartphone 300B has a one-time authentication code, the authentication code ("987654" in FIG. 11) is displayed on the display unit 310. In this case, regardless of whether the web page is locked or not, in the example of Figure 12, even if it is website B or website C, it is possible to log in to the desired web page with only the ID, without needing a password. If a user terminal 400 is available, the authentication code can be input into the user terminal 400 . In addition, since the login control server 200 has the ID and URL information of the locked web page, the login control server 200 can automatically perform the work of the user explicitly acquiring an authentication code and inputting the authentication code into the web page via the smartphone on behalf of the user. This allows the user to log in to the web page with only the ID.

[0060] <Actions and Effects> As described above, in the login system 1B of this embodiment, if the user's smartphone 300B has a one-time authentication code, the user can use the smartphone 300B to log in to a desired web page using only the ID. This is realized because the smartphone 300B can centrally manage a plurality of websites, as described in the second embodiment. Therefore, if the smartphone 300B has a one-time authentication code, the user can easily browse a desired website without any trouble.

[0061] <Application Example 1> In the first embodiment, a system including a user terminal 400 and a user's smartphone 300 was described. However, even if the system includes only the smartphone 300, it is possible to obtain the same functions as the system of the first embodiment as long as the smartphone 300 has the functions of the user terminal 400. This is because, if the services of the service providing server 100 can be used with a general browser, the browser of the smartphone 300 can also be used. In addition, in the above system, for example, in the third embodiment, an authentication code can be passed to a web page without the user having to enter it in the smartphone 300, so that the user can log in with just their ID. In addition, since the login control server 200 has the ID and URL information of the locked web page, the login control server 200 can automatically perform the work of the user explicitly acquiring an authentication code and inputting the authentication code into the web page via the smartphone on behalf of the user. This allows the user to log in to the web page with only the ID. In either case, the web page is logged in using an ID and authentication code, so security is as strong as that of the password method.

[0062] <Application Example 2> In the login systems 1, 1A, and 1B according to the present embodiment, the number of user terminals that can log in simultaneously with one account is limited to one, thereby making it possible to deal with hacking by a malicious third party during login.

[0063] <Application example 3> In the login systems 1, 1A, and 1B according to this embodiment, an even more secure system can be constructed by adding a function for sending an email to the smartphones 300, 300A, and 300B when the lock is released (locked → unlocked), an SMS notification function, and an SNS notification function such as LINE.

[0064] The login systems 1, 1A, 1B of the present invention can be realized by recording the processing of the smartphones 300, 300A, 300B and the login control server 200 on a recording medium readable by a computer system, and having the smartphones 300, 300A, 300B and the login control server 200 read and execute the program recorded on this recording medium. The computer system referred to here includes the OS and hardware such as peripheral devices.

[0065] Furthermore, "computer system" also includes the homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The above program may be transmitted from a computer system in which the program is stored in a storage device or the like to another computer system via a transmission medium, or by transmission waves in the transmission medium. Here, the "transmission medium" that transmits the program refers to a medium that has the function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

[0066] The program may be for implementing some of the functions described above, or may be a so-called differential file (differential program) that can implement the functions described above in combination with a program already recorded in the computer system.

[0067] Although an embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to this embodiment, and designs that do not deviate from the gist of the present invention are also included. [Explanation of symbols]

[0068] 1. Login system 1A;Login System 1B;Login system 100; Service provider server 200;Login control server 210; Communications Department 220;Memory section 230 Control section 300;Smartphone 300A; Smartphone 300B; Smartphone 310;Display section 320; Setting section 330; Communications Department 340 Control section

Claims

1. A login system using a login and password method, a service providing server managed by a service provider; A user terminal connected to the service providing server; a login control server that controls a login operation to a website provided by the service provider; A user smartphone connected to the login control server; Including, A login system characterized in that, during a period when a user is not using a service of the service providing server, the login control server locks login by the user terminal by operating the user smartphone.

2. A login system using a login and password method, a service providing server managed by a service provider; a login control server that controls a login operation to a website provided by the service provider; A user smartphone connected to the login control server; Including, A login system characterized in that, during a period when a user is not using a service of the service providing server, the login control server locks login via the user smartphone by operating the user smartphone.

3. 3. The login system according to claim 1, wherein the user smartphone is connected to the login control server via a secure communication network.

4. 3. The login system according to claim 1, wherein the user can set login lock / unlock for each website using the user smartphone.

5. The login system according to claim 1 or 2, characterized in that, when the user smartphone has a one-time authentication code, the user smartphone can log in to a desired web page using an ID and the authentication code.

6. A program for causing a computer to execute a login lock method in a login system using a login password scheme, the program including: a service providing server; a user terminal connected to the service providing server; a login control server; and a user smartphone connected to the login control server, the program comprising: A program for causing a computer to execute the following procedure: during a period when a user is not using a service of the service providing server, the login control server locks the login by the user terminal through operation of the user smartphone.

7. A program for causing a computer to execute a login lock method in a login system using a login password scheme, the program including a service providing server, a login control server, and a user smartphone connected to the login control server, the program comprising: A program for causing a computer to execute the following: during a period when a user is not using a service of the service providing server, the login control server locks login via the user smartphone through operation of the user smartphone.

Images