Authentication device, authentication method, and authentication program

Abstract

To provide an authentication device, an authentication method, and an authentication program capable of improving intensity of two-step authentication.SOLUTION: An authentication server 10 for executing a second-step authentication using an authentication message to log-in access containing a user ID, includes: a communication regulation unit 111 which executes communication regulation for an authentication terminal 20 specified by a telephone number associated with the user ID, excluding a specific communication destination including a transmission server of an authentication message and an authentication server 10, in response to the log-in access; a message transmission unit 112 which transmits an authentication message indicating a one-time password to the authentication terminal 20 after the communication restriction is executed; an authentication processing unit 113 which, when receiving the one-time password from the authentication terminal 20, completes log-in with the user ID verifying authenticity of the one-time password; and a communication restriction releasing unit 114 which releases the communication restriction in response to the completion of the log-in.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a two-step authentication system. [Background technology]

[0002] Conventionally, in order to improve security during user authentication in Web services, two-step authentication has been widely adopted in which a one-time password notified to a mobile terminal using SMS (Short Message Service) is entered (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2007-058469 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in recent years, there have been attacks in which malware or other devices send the data contained in SMS to an external party, eavesdrop on the contents, and then impersonate the legitimate user to authenticate the user. Therefore, measures against such SMS eavesdropping are desired.

[0005] An object of the present invention is to provide an authentication device, an authentication method, and an authentication program that can improve the strength of two-step authentication. [Means for solving the problem]

[0006] The authentication device of the present invention is a device that performs two-step authentication using an authentication message for login access involving a user ID, and includes a communication restriction unit that, in response to the login access, implements communication restrictions on an authentication terminal identified by a telephone number linked to the user ID, excluding a sending server of the authentication message and specific communication destinations including the authentication device, a message sending unit that sends the authentication message indicating a one-time password to the authentication terminal after the communication restriction is implemented, an authentication processing unit that, upon receiving the one-time password from the authentication terminal, completes login using the user ID by verifying the validity of the one-time password, and a communication restriction lifting unit that lifts the communication restriction in response to completion of the login.

[0007] The authentication processing unit may invalidate the one-time password when the login is completed.

[0008] The communication restriction unit may hold a whitelist of the specific communication destinations.

[0009] The login page for the login access may include code for performing detection access to a communication detection server that is subject to the communication restriction, and the authentication processing unit may cause the login to fail when it receives a notification from the communication detection server that the detection access has occurred.

[0010] The authentication method of the present invention is a method in which an authentication device implements two-step authentication using an authentication message for login access involving a user ID, and executes the following steps: a communication restriction step of implementing communication restrictions on an authentication terminal identified by a telephone number linked to the user ID in response to the login access, excluding a sending server of the authentication message and specific communication destinations including the authentication device; a message sending step of sending the authentication message indicating a one-time password to the authentication terminal after the communication restriction is implemented; an authentication processing step of verifying the validity of the one-time password upon receiving the one-time password from the authentication terminal, thereby completing login using the user ID; and a communication restriction release step of releasing the communication restriction in response to completion of the login.

[0011] An authentication program according to the present invention causes a computer to function as the authentication device. Effect of the Invention

[0012] According to the present invention, the strength of two-step authentication can be improved. [Brief description of the drawings]

[0013] [Figure 1] FIG. 2 is a diagram illustrating a functional configuration of an authentication system according to the first embodiment. [Diagram 2] FIG. 1 is a sequence diagram showing a flow of conventional SMS authentication. [Diagram 3] FIG. 11 is a sequence diagram illustrating a case where an SMS eavesdropping attack is carried out in a conventional SMS authentication flow. [Figure 4] FIG. 4 is a sequence diagram showing a flow of SMS authentication in the first embodiment. [Diagram 5] FIG. 11 is a sequence diagram showing a flow of SMS authentication in the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] [First embodiment] A first embodiment of the present invention will now be described. In order to prevent spoofing by SMS interception at the terminal, the authentication server (authentication device) of this embodiment stops the user's general data communication from the base station before sending an SMS, and resumes it after authentication is complete.

[0015] FIG. 1 is a diagram showing the functional configuration of an authentication system 1 according to the present embodiment. The authentication system 1 is configured to perform SMS authentication using an authentication terminal 20 when a login terminal 30 makes a login access accompanied by a user ID to an authentication server 10. Information including the telephone number of the authentication terminal 20 held by the user is registered in advance in the authentication server 10 in association with the user ID. The authentication terminal 20 may also function as the login terminal 30 .

[0016] The authentication terminal 20 is an information processing device capable of receiving an authentication message (hereinafter, referred to as SMS) based on a telephone number for two-step authentication, and corresponds to a mobile terminal such as a smartphone. In the authentication terminal 20, an application for receiving an SMS runs in addition to an application (browser application) for accessing the authentication server 10.

[0017] The authentication server 10 is an information processing device including a control unit 11, a storage unit 12, and various input / output interfaces. The control unit 11 executes software (authentication program) stored in the storage unit 12 to function as a communication restriction unit 111, a message transmission unit 112, an authentication processing unit 113, and a communication restriction lifting unit 114.

[0018] In response to login access involving a user ID from the login terminal 30, the communication restriction unit 111 implements communication restrictions on the authentication terminal 20 identified by the telephone number linked to this user ID, excluding specific communication destinations including the sending server of the authentication message and the authentication server 10.

[0019] This communication restriction restricts communication from the authentication terminal 20 to only certain IP addresses including the authentication server 10 and the SMS transmission server. Specifically, this communication restriction is the same as the restriction that restricts access to only a page for purchasing additional communication data volume by additional charges when a user has used up the maximum communication data volume under the contract, and can be realized by existing technology.

[0020] The communication restriction unit 111 may hold a whitelist of specific communication destinations with which the authentication terminal 20 can communicate. For example, a whitelist of important services such as emergency earthquake alerts by the ETWS (Earthquake and Tsunami Warning System) and emergency calls may be maintained to maintain communications. However, because this communication restriction is intended to prevent information from being transferred to a third party, even if the site is from a trusted source, it will be subject to restrictions if it has a communication function with any other party or a data storage function.

[0021] After the communication restriction is implemented by the communication restriction unit 111, the message sending unit 112 sends an authentication message indicating a one-time password to the authentication terminal 20. Note that the SMS may be sent via an SMS sending server that is not subject to the communication restriction.

[0022] When the authentication processing unit 113 receives the one-time password indicated by SMS from the authentication terminal 20, it verifies the validity of this one-time password and completes the login using the user ID. Once the login is complete, the authentication processing unit 113 invalidates the one-time password used for authentication.

[0023] When the login is completed, the communication restriction lifting unit 114 lifts the communication restriction and enables normal communication in the authentication terminal 20.

[0024] Here, the flow of SMS authentication in this embodiment will be described in comparison with the conventional method. For ease of explanation, it is assumed here that the authentication terminal 20 also serves as the login terminal 30.

[0025] FIG. 2 is a sequence diagram showing the flow of conventional SMS authentication. In step S1, the authentication terminal 20 accesses the login page of the authentication server 10 and attempts to log in using a user ID and password. In step S2, the authentication server 10 transmits an SMS including the one-time password to the authentication terminal 20 associated with the user ID.

[0026] In step S3, authentication terminal 20 accepts input of the one-time password described in the SMS to the login page from the user. In step S 4 , the authentication terminal 20 transmits the input one-time password to the authentication server 10 . In step S5, when the authentication server 10 verifies the validity of the received one-time password, it notifies the authentication terminal 20 of the completion of login and transmits authentication information.

[0027] FIG. 3 is a sequence diagram illustrating a case where an SMS eavesdropping attack is carried out in the flow of conventional SMS authentication. In step S11, the attacker's terminal (malicious server) accesses the login page of the authentication server 10 and attempts to log in using a user ID and password. In step S12, the authentication server 10 transmits an SMS including the one-time password to the authentication terminal 20 associated with the user ID.

[0028] In step S13, the malware operating in the authentication terminal 20 reads the one-time password described in the received SMS. In step S14, the malware transmits the read one-time password to a malicious server. In step S 15 , the malicious server transmits the received one-time password to the authentication server 10 . In step S16, when the authentication server 10 verifies the validity of the received one-time password, it notifies the malicious server that is the sender of the password of the completion of login and transmits authentication information.

[0029] FIG. 4 is a sequence diagram showing the flow of SMS authentication in this embodiment. In step S21, the authentication terminal 20 accesses the login page of the authentication server 10 and attempts to log in using a user ID and password. In step S22, the authentication server 10 implements communication restrictions on the authentication terminal 20 linked to the user ID. In step S23, the authentication server 10 transmits to the authentication terminal 20 an SMS including the one-time password.

[0030] In step S24, the authentication terminal 20 accepts input of the one-time password described in the SMS from the user to the login page. In step S 25 , the authentication terminal 20 transmits the input one-time password to the authentication server 10 . In step S26, when the authentication server 10 verifies the validity of the received one-time password, it notifies the authentication terminal 20 of the completion of login and transmits authentication information.

[0031] In step S27, the authentication server 10 invalidates the one-time password used for authentication. In step S28, the authentication server 10 cancels the communication restriction implemented in step S22.

[0032] According to this embodiment, in two-step authentication using SMS, the authentication system 1 imposes communication restrictions on the authentication terminal 20, excluding the authentication server 10 and servers involved in SMS transmission. Therefore, by limiting the period during which authentication terminal 20 can use the one-time password to the period during which communication restrictions are in place, authentication system 1 prevents attackers from impersonating the one-time password and transmitting it to a third party, even if authentication terminal 20 contains malware, thereby improving the strength of two-step authentication.

[0033] Furthermore, when the SMS authentication is successful and the user has completed logging in, the authentication server 10 invalidates the one-time password used for the authentication. This enables the authentication system 1 to prevent the reuse of the one-time password after communication restrictions have been lifted, thereby ensuring security.

[0034] In addition, the authentication server 10 may hold a whitelist of specific communication destinations to be exempted from communication restrictions. For example, by enabling reception of emergency earthquake alerts and emergency calls, the authentication system 1 can avoid the risk of being unable to use important services in the middle of an authentication sequence in the authentication terminal 20.

[0035] [Second embodiment] A second embodiment of the present invention will now be described. In this embodiment, the authentication terminal 20 has another communication means such as Wi-Fi (registered trademark) in addition to mobile communication. In this case, the aforementioned communication restrictions alone would make it possible to communicate with third parties.

[0036] Therefore, first, the authentication server 10 notifies the user on the login page that Wi-Fi must be turned off in order to log in, and prompts the user to perform the operation. Alternatively, the login page may include a code for automatically turning off Wi-Fi. Furthermore, the authentication system 1 includes a communication detection server 40, and the login page provided by the authentication server 10 includes a code for accessing the communication detection server 40 for detection purposes. Here, the communication detection server 40 is subject to communication restriction, and cannot be accessed via mobile communication during the communication restriction.

[0037] When an authentication processing unit 113 of the authentication server 10 receives a notice from the communication detection server 40 that there has been an access for detection, it judges that the authentication terminal 20 has another communication means and does not permit login and causes it to fail even if a valid one-time password is received.

[0038] FIG. 5 is a sequence diagram showing the flow of SMS authentication in this embodiment. In step S31, the authentication terminal 20 accesses the login page of the authentication server 10 and attempts to log in using a user ID and password. In step S32, the authentication server 10 implements communication restrictions on the authentication terminal 20 linked to the user ID.

[0039] In step S33, if a communication means such as Wi-Fi is available in addition to the restricted mobile communication, the authentication terminal 20 attempts to access the detection page of the communication detection server 40 in accordance with a code that is pre-included in the login page. In step S34, in response to the access from the authentication terminal 20, the communication detection server 40 notifies the authentication server 10 that the access has occurred. In step S35, when a notification is received from the communication detection server 40, the authentication server 10 disallows login.

[0040] In step S36, the authentication server 10 transmits an SMS including the one-time password to the authentication terminal 20 only if there is no notification from the communication detection server 40. In step S37, the authentication terminal 20 accepts input of the one-time password described in the SMS to the login page from the user. In step S 38 , the authentication terminal 20 transmits the input one-time password to the authentication server 10 . In step S39, when the authentication server 10 verifies the validity of the received one-time password, it notifies the authentication terminal 20 of the completion of login and transmits authentication information.

[0041] In step S40, the authentication server 10 invalidates the one-time password used for authentication. In step S41, the authentication server 10 cancels the communication restriction implemented in step S22.

[0042] According to this embodiment, the authentication terminal 20 attempts to access the communication detection server 40 that is subject to communication restriction, in accordance with a code that is included in advance in the login page. If such access occurs, the authentication server prohibits the login. In this way, the authentication system 1 can detect an access to a page that is supposed to be communication restricted and determine that there is a possibility that data intercepted via SMS may be sent to the outside. Therefore, by disallowing login in this case, the strength of the two-step authentication can be improved.

[0043] In addition, the above-mentioned embodiment can improve the strength of SMS authentication, for example, and therefore contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0044] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0045] The authentication method by the authentication system 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). Moreover, these programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. [Explanation of symbols]

[0046] 1 Authentication System 10 Authentication Server 11 Control section 12 Storage section 20 Authentication terminal 30 Login terminal 40 Communication detection server 111 Communications Regulation Department 112 Message sending unit 113 Authentication processing unit 114 Communication Restriction Lifting Department

Claims

1. An authentication device that performs two-step authentication using an authentication message for login access involving a user ID, a communication restriction unit that restricts communication with an authentication terminal identified by a telephone number associated with the user ID in response to the login access, except for a specific communication destination including a transmission server of the authentication message and the authentication device; a message sending unit that sends the authentication message indicating a one-time password to the authentication terminal after the communication restriction is implemented; an authentication processing unit that, upon receiving the one-time password from the authentication terminal, verifies the validity of the one-time password to complete login using the user ID; and a communication restriction lifting unit that lifts the communication restriction in response to the login being completed.

2. The authentication device according to claim 1 , wherein the authentication processing unit invalidates the one-time password when the login is completed.

3. The authentication device according to claim 1 , wherein the communication restriction unit holds a whitelist of the specific communication destinations.

4. the login page for the login access includes a code for performing detection access to a communication detection server that is subject to the communication restriction, 2. The authentication device according to claim 1, wherein the authentication processing unit fails the login when it receives a notification from the communication detection server that the detection access has occurred.

5. 1. An authentication method in which an authentication device performs two-step authentication using an authentication message for a login access involving a user ID, comprising: a communication restriction step of restricting communication with an authentication terminal identified by a telephone number associated with the user ID in response to the login access, except for a specific communication destination including a transmission server of the authentication message and the authentication device; a message sending step of sending the authentication message indicating a one-time password to the authentication terminal after the communication restriction is implemented; an authentication processing step of, when receiving the one-time password from the authentication terminal, verifying the validity of the one-time password to complete login using the user ID; and a communication restriction lifting step of lifting the communication restriction in response to the completion of the login.

6. An authentication program for causing a computer to function as the authentication device according to any one of claims 1 to 4.

Images