Authentication device, authentication method, and authentication program

Abstract

To provide an authentication device capable of increasing strength of authentication using a two-dimensional code displayed in a log-in terminal.SOLUTION: An authentication server 10 includes: an access reception section 111 for transmitting log-in page data describing an inspection program for issuing an inspection token to a log-in terminal 20 when inspection is completed by a bot detector according to access from the log-in terminal 20; a display data transmission section 112 for transmitting display data of a two-dimensional bar code that can be reproduced only by an inspection token to the log-in terminal 20 so as to show a URL including new encoded session information when receiving the inspection token from the log-in terminal 20; and an authentication processing section 113 for confirming validity and completing log-in from the log-in terminal 20 when receiving access to a URL from an authentication terminal 30 reading a two-dimensional bar code displayed by using an inspection token in the log-in terminal 20.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an authentication system using a two-dimensional barcode. [Background technology]

[0002] Conventionally, in order to improve security during user authentication in Web services, an authentication procedure has been used in which authentication information such as a URL is included in a two-dimensional barcode such as a QR code (registered trademark) and the barcode is read into an authentication terminal (see, for example, Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Steam Guard, Internet,<https: / / help.steampowered.com / ja / faqs / view / 7EFD-3CAE-64D3-1C31> [Non-Patent Document 2] Cloudflare Bot Management, Internet,<https: / / www.cloudflare.com / ja-jp / application-services / products / bot-management / > Summary of the Invention [Problem to be solved by the invention]

[0004] However, when a two-dimensional barcode is used for authentication by having it read by an authentication terminal, there is a problem in that this two-dimensional barcode can be exploited and displayed on fake websites, making it possible to commit phishing scams.

[0005] An object of the present invention is to provide an authentication device, an authentication method, and an authentication program that can improve the strength of authentication using a two-dimensional barcode displayed on a login terminal. [Means for solving the problem]

[0006] The authentication device of the present invention includes an access receiving unit that includes a bot detector in response to access from a login terminal, and when the bot detector completes inspection, sends login page data to the login terminal, the login page data including an inspection program for issuing an inspected token; a display data transmitting unit that, when it receives the inspected token from the login terminal, sends to the login terminal display data of a two-dimensional barcode that can only be reproduced by the inspected token to indicate a URL including encrypted new session information; and an authentication processing unit that, when it accepts access to a URL including the encrypted session information from an authentication terminal that reads the two-dimensional barcode displayed on the login terminal using the inspected token, verifies the validity of the session information and completes the login from the login terminal.

[0007] The access receiving unit may obfuscate the inspection program and transmit it to the login terminal.

[0008] The verified token may be one-time data based on time information.

[0009] The authentication method of the present invention includes an access receiving step in which, in response to access from a login terminal, a bot detector is included, and when the bot detector completes inspection, login page data containing an inspection program for issuing an inspected token is sent to the login terminal; a display data sending step in which, when the inspected token is received from the login terminal, display data for a two-dimensional barcode that can only be reproduced by the inspected token to indicate a URL including encrypted new session information is sent to the login terminal; and an authentication processing step in which, when access to a URL including the encrypted session information is accepted from an authentication terminal that has read the two-dimensional barcode displayed using the inspected token on the login terminal, the validity of the session information is confirmed and login from the login terminal is completed.

[0010] An authentication program according to the present invention causes a computer to function as the authentication device. Effect of the Invention

[0011] According to the present invention, it is possible to improve the strength of authentication using a two-dimensional barcode displayed on a login terminal. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating a functional configuration of an authentication system according to an embodiment. [Diagram 2] FIG. 4 is a sequence diagram showing an authentication method according to an embodiment. [Diagram 3] 1 is a sequence diagram illustrating various attacks countered by an authentication method according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] An example of an embodiment of the present invention will now be described. The authentication system of this embodiment executes login processing by having an authentication terminal read a two-dimensional barcode displayed on a login page.

[0014] Attackers attempt to steal authentication information by displaying a 2D barcode displayed on their own device on the screen of a user's device who visits a phishing site, etc., and having the user read the barcode to authenticate. At this time, the data contained in the displayed 2D barcode is often one-time, so the attacker needs to automatically read the data for displaying the 2D barcode and transfer it to the screen of the target each time.

[0015] In this embodiment, a bot detector (see, for example, Non-Patent Document 2), which is software for detecting automatic operations, is combined with the authentication procedure to prevent an attacker from automatically reading out data for displaying a two-dimensional barcode. The type of bot detector is not limited, and various types of software may be appropriately adopted, such as software that automatically determines whether a bot is detected based on access information, or software that determines whether a bot is detected based on information such as mouse operations or key operations.

[0016] FIG. 1 is a diagram showing the functional configuration of an authentication system 1 according to the present embodiment. When the login terminal 20 accesses the login page of the authentication server 10 (authentication device), the authentication system 1 allows the authentication terminal 30 to read the displayed two-dimensional barcode and access the authentication URL to perform login.

[0017] The login terminal 20 is an information processing device such as a personal computer that allows users to use the service, and by executing code contained in the login page of the authentication server 10, performs inspection using a bot detector, issues an inspected token, and displays a two-dimensional barcode using this inspected token.

[0018] The authentication terminal 30 is an information processing device that runs an application (browser application) for accessing the authentication server 10 as well as an application capable of reading two-dimensional barcodes for two-step authentication, and corresponds to a mobile terminal such as a smartphone.

[0019] The authentication server 10 is an information processing device including a control unit 11, a storage unit 12, and various input / output interfaces. The control unit 11 executes software (authentication program) stored in the storage unit 12 to function as an access receiving unit 111, a display data transmitting unit 112, and an authentication processing unit 113.

[0020] In response to an access from the login terminal 20, the access receiving unit 111 transmits login page data to the login terminal 20. This login page includes a bot detector, and describes code (a verification program) for issuing a verified token corresponding to the login terminal 20 when the verification is completed by the bot detector.

[0021] At this time, the access receiving unit 111 may transmit the inspection program to the login terminal 20 in an obfuscated form. Further, the verified token may be a fixed value based on terminal information, but may also be one-time data based on time information, for example.

[0022] When the display data transmission unit 112 receives the verified token from the login terminal 20, it generates display data for a two-dimensional barcode that can be reproduced only by the verified token to indicate a URL including the encrypted new session information, and transmits the display data to the login terminal 20. The display data is not image data itself, but is a two-dimensional barcode image reproduced by using the verified token output by the login terminal 20.

[0023] When the authentication processing unit 113 receives access to a URL including encrypted session information from the authentication terminal 30 that has read the two-dimensional barcode displayed on the login terminal 20 using the verified token, it verifies the validity of the session information and completes the login from the login terminal 20.

[0024] FIG. 2 is a sequence diagram showing an authentication method in this embodiment. In step S1, the login terminal 20 accesses the authentication server 10. In step S2, the authentication server 10 transmits a login page including a checking program using a bot detector to the login terminal 20 that is the access source.

[0025] In step S3, the login terminal 20 checks for the presence or absence of automatic operation by the bot detector in accordance with the inspection program included in the login page, and issues an inspected token when the inspection is completed and it is determined to be manual.

[0026] In step S4, the login terminal 20 requests the authentication server 10 for display data of the two-dimensional barcode, along with the verified token. In step S5, the authentication server 10 generates a two-dimensional barcode indicating a URL including the encrypted new session information, and transmits to the login terminal 20 display data that can be restored to an image using the verified token. In step S6, the login terminal 20 restores the display data to an image using the verified token and displays it.

[0027] In step S7, the authentication terminal 30 reads the two-dimensional barcode displayed on the login terminal 20. In step S8, the authentication terminal 30 accesses the URL for authentication processing provided by the authentication server 10 and indicated by the two-dimensional barcode, and performs login processing. In step S9, the authentication server 10 notifies the login terminal 20 of the completion of login, either in response to a status confirmation inquiry from the login terminal 20 or automatically, and transmits authentication information. As a result, the login terminal 20 uses a service that uses the authentication information.

[0028] In this way, by inserting an inspection by a bot detector before displaying the two-dimensional authentication barcode on the screen, the authentication system 1 suppresses attacks that automatically steal the two-dimensional authentication barcode. At this time, the bot detector not only performs the normal operation of transitioning to the authentication page, but also issues a token indicating that the inspection has been completed. As a result, when the authentication terminal 30 accesses the display data of the two-dimensional barcode image, it transmits the issued token indicating that the inspection has been completed to the authentication server 10.

[0029] Furthermore, since it is necessary to notify the login terminal 20 of the result of the login process in step S9, it is necessary to add session information between the authentication server 10 and the login terminal 20 to the two-dimensional barcode. To prevent this session information from being guessed from the contents of past communications, the new session information is encrypted and added to the URL in the two-dimensional barcode. The authentication server 10 decrypts the encrypted session information in the URL to restore the session. In addition, as the new session information, different session information linked to the session information may be used, or a different identification value linked to the session information may be used.

[0030] Here, the attacker displays a two-dimensional barcode on the fake site and attempts to get users who visit the fake site to log in to the attacking device by scanning the two-dimensional barcode. The authentication system 1 responds to such attacks as follows.

[0031] FIG. 3 is a sequence diagram illustrating various attacks that are countered by the authentication method according to this embodiment. In step S11, the login terminal 20 accesses a fake site (server) constructed by an attacker. In step S12, the fake site starts automatic operation of the attacking terminal to access the authentication server 10.

[0032] Here, as attack pattern A, it is conceivable that URL information embedded in the two-dimensional barcode is guessed from the session information obtained at the timing of step S12, and the two-dimensional barcode is replicated. To cope with this, as described above, the authentication server 10 further encrypts the newly issued session information and includes it in the URL, so that the attacker cannot duplicate the two-dimensional barcode.

[0033] In step S13, the authentication server 10 transmits a login page including a checking program using a bot detector to the attacking terminal that has made the access. In step S14, the attacking terminal checks for automatic operation by the bot detector according to the inspection program included in the login page, and issues an inspected token when the inspection is completed and it is determined to be manual. If automatic operation is performed, an inspected token is not issued.

[0034] In step S15, if the attacking terminal is able to acquire the verified token, it requests the authentication server 10 to send display data of the two-dimensional barcode along with the verified token. In step S16, the authentication server 10 generates a two-dimensional barcode indicating a URL including the encrypted new session information, and transmits display data that can be restored to an image using the verified token to the attacking terminal.

[0035] Here, as an attack pattern B, a URL or image data may be read from the display data obtained at step S16, and a two-dimensional barcode may be replicated. As a countermeasure against this, as mentioned above, the 2D barcode can only be displayed using a verified token in memory issued by the verification program, so an attacker who cannot obtain a legitimate verified token through automatic operation cannot replicate the 2D barcode. In addition, by obfuscating the inspection program, the restoration algorithm of the genuine inspected token and the two-dimensional barcode is concealed. Furthermore, by making the two-dimensional barcode one-time using time information, it is possible to prevent reuse of the genuine inspected token even if it is obtained.

[0036] In step S17, if the attacking terminal has acquired the verified token, it restores the display data to an image using the verified token and displays it.

[0037] Here, as attack pattern C, a two-dimensional barcode image displayed on the screen may be read by a screenshot or a camera or other means, and the two-dimensional barcode may be replicated. To address this issue, the 2D barcode is provided not as image data itself, but as display data that can only be restored using an inspected token, so an attacker who cannot obtain a genuine inspected token through automated operations cannot replicate the 2D barcode.

[0038] If a two-dimensional barcode is replicated and displayed on a fake site using any of the attack patterns A to C described above, the following steps are executed: In step S18, the authentication terminal 30 reads the two-dimensional barcode displayed on the fake site. In step S19, the authentication terminal 30 accesses the URL for authentication processing provided by the authentication server 10 and indicated by the two-dimensional barcode, and performs login processing. In step S20, the authentication server 10 notifies the attacking terminal of the completion of login and transmits authentication information in response to a status confirmation inquiry from the attacking terminal or automatically. This allows the attacking terminal to use services that use the authentication information.

[0039] In this embodiment, by preventing attack patterns A to C, steps S18 and subsequent steps are not executed, and the authentication system 1 can prevent unauthorized logins.

[0040] As described above, according to this embodiment, a bot detector, which is normally used to prevent the mass collection of information on a website by suppressing automatic operations on a page, is applied to the display procedure of a two-dimensional barcode image on an authentication page. That is, the authentication system 1 uses a bot detector to check that no automated operation has occurred, and then issues a verified token in the login terminal 20, which is required to restore an image from the display data of the two-dimensional barcode. Furthermore, the authentication server 10 encrypts and assigns new, previously unused session information to the URL to be embedded in the two-dimensional barcode.

[0041] Therefore, since the two-dimensional barcode containing session information that cannot be guessed from the contents of past communications can only be restored using the verified token in memory issued by the verification program, the authentication system 1 can prevent attacks that duplicate the two-dimensional barcode and improve the strength of authentication using the two-dimensional barcode displayed on the login terminal 20.

[0042] Furthermore, the authentication server 10 may transmit the inspection program to the login terminal 20 in an obfuscated form. This allows the authentication system 1 to keep the inspected token and the restoration algorithm for the two-dimensional barcode image secret, thereby further improving the strength of authentication.

[0043] The verified token may also be one-time data based on time information. This enables the authentication system 1 to prevent reuse of verified tokens, thereby further improving the strength of authentication.

[0044] Furthermore, this embodiment can improve the strength of authentication using, for example, two-dimensional barcodes, making it possible to contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0045] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0046] The authentication method by the authentication system 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). Moreover, these programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. [Explanation of symbols]

[0047] 1 Authentication System 10 Authentication Server 11 Control section 12 Storage section 20 Login terminal 30 Authentication terminal 111 Access Reception 112 Display data transmission unit 113 Authentication processing unit

Claims

1. an access acceptance unit that includes a bot detector and transmits login page data, in which an inspection program for issuing an inspected token is written, to the login terminal when the inspection is completed by the bot detector in response to an access from the login terminal; a display data transmission unit that, upon receiving the verified token from the login terminal, transmits to the login terminal display data of a two-dimensional barcode that can be reproduced only by the verified token and indicates a URL including encrypted new session information; an authentication processing unit that, when it accepts access to a URL including the encrypted session information from an authentication terminal that reads the two-dimensional barcode displayed on the login terminal using the verified token, verifies the validity of the session information and completes the login from the login terminal.

2. The authentication device according to claim 1 , wherein the access receiving unit obfuscates the inspection program before transmitting it to the login terminal.

3. 2. The authentication device according to claim 1, wherein the verified token is one-time data based on time information.

4. an access acceptance step of transmitting login page data, which includes a bot detector and in which an inspection program for issuing an inspected token is written, to the login terminal when the inspection is completed by the bot detector in response to an access from the login terminal; a display data transmission step of, when receiving the verified token from the login terminal, transmitting to the login terminal display data of a two-dimensional barcode that can be reproduced only by the verified token and indicates a URL including encrypted new session information; an authentication processing step in which, when access to a URL including the encrypted session information is accepted from an authentication terminal that has read the two-dimensional barcode displayed on the login terminal using the verified token, the authentication processing step confirms the validity of the session information and completes the login from the login terminal.

5. An authentication program for causing a computer to function as the authentication device according to any one of claims 1 to 3.

Images