Information processing device, authentication terminal, method therefor, and program

Abstract

To provide a technique that maintains the consistency of credential information between a server and an external terminal that is the registration destination terminal, thereby improving user convenience.SOLUTION: An information processing device 101 receives a first request for registering credential information from a service (e.g., authentication server 104) that manages public keys used to verify signatures related to user authentication, sends a second request for creating credential information to the external terminal (e.g., authentication terminal 102) on the basis of the user's selection regarding the use of the external terminal, and when a specified error is detected before the external terminal completes registration of the public key created on the basis of the second request to the service, sends a third request for deleting the credential information to the external terminal.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to techniques for managing credential information in an authentication system. [Background technology]

[0002] Challenge-response authentication is sometimes used as an authentication mechanism in authentication systems that use authentication technologies including biometric authentication. Specifically, authentication methods such as FIDO (registered trademark, abbreviation for Fast Identity Online) are sometimes used.

[0003] FIDO involves a registration process between an authenticator located on the user's device or other device and an external authentication server managed by the service provider, whereby credential information such as a private key and user ID is registered in the authenticator, and a public key for signature verification is registered in the authentication server. If a user directly deletes credential information from their device, the public key information registered in the authentication server is not deleted. For this reason, Patent Document 1 (JP-A-2005-102666) describes a prior art technique in which an authentication server sends a request to a terminal to check whether credential information corresponding to the public key registered on the authentication server is registered. If the credential information is not registered, the authentication server deletes the public key. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2022-178277 Summary of the Invention [Problem to be solved by the invention]

[0005] The specifications for communication between a FIDO client and an authenticator are defined in CTAP (Client to Authenticator Protocol). In particular, the specifications for communication between a FIDO client on one device and an authenticator on another device are defined in a specification called Hybrid-transport. This specification enables credential registration (credential registration) to be performed on a device other than the device that requested the credential registration by communicating between devices using a communication method such as BLE. BLE is an abbreviation for Bluetooth Low Energy. Hereinafter, the device that requested the credential registration will be referred to as the "registration source device." However, the method of registering credential information on a device other than the device that requested the credential registration has the following issues:

[0006] After credential information is created on another device based on a request from the registration source device, there are cases where the credential registration process fails midway due to a system failure on the authentication server or a temporary interruption of communication between the authentication server and the registration source device. In this case, the credential information may remain stored on the other device even though the public key for authentication is not registered on the authentication server. This is because the processing failure cannot be detected on the other device.

[0007] Furthermore, when a user uses various services, multiple pieces of credential information are managed on different terminals, making it extremely difficult for the user to distinguish between credential information that has already been registered on the authentication server and credential information that has failed to be registered but remains. Patent Document 1 does not anticipate such a problem at all, and conventional technologies have not been able to solve this problem.

[0008] The present disclosure provides a technology that maintains the consistency of credential information between a server and a registration destination terminal, thereby improving user convenience. [Means for solving the problem]

[0009] An information processing device according to one embodiment of the present disclosure includes a receiving means for receiving a first request for registering credential information from a service that manages a public key used to verify a signature related to user authentication, and a transmitting means for transmitting a second request for creating the credential information to the external terminal based on a user's selection regarding the use of the external terminal, wherein the transmitting means transmits a third request for deleting the credential information to the external terminal if a specified error is detected before the external terminal completes registration of the public key created based on the second request to the service. [Effects of the Invention]

[0010] According to the present disclosure, it is possible to maintain the consistency of credential information between the server and the external terminal that is the registration destination terminal, thereby improving user convenience. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a system configuration diagram according to a first embodiment. [Figure 2] FIG. 2 is a hardware configuration diagram of each device in the first embodiment. [Figure 3] FIG. 2 is a diagram illustrating the module configuration of each device in the first embodiment. [Figure 4] 10 is an example of a credential registration screen in the first embodiment. [Figure 5] FIG. 4 is a sequence diagram showing a user authentication process in the first embodiment. [Figure 6] FIG. 10 is a sequence diagram showing a credential information management server authentication process in the first embodiment. [Figure 7] FIG. 4 is a sequence diagram showing a credential registration process in the first embodiment. [Figure 8] FIG. 8 is a sequence diagram showing a continuation of FIG. 7. [Figure 9] 10 is a flowchart showing a process of the information processing device in a credential registration process. [Figure 10]10 is a flowchart showing the processing of an authentication terminal communication management module in the credential registration processing. [Figure 11] 10 is a flowchart showing a process of the authentication terminal in the credential registration process. [Figure 12] 10 is a diagram illustrating an example of a screen indicating a failure in the credential registration process in the first embodiment. [Figure 13] FIG. 10 is a diagram showing the module configuration of each device in the second embodiment. [Figure 14] FIG. 10 is a sequence diagram showing a credential registration process in the second embodiment. [Figure 15] FIG. 15 is a sequence diagram showing a continuation of FIG. [Figure 16] 10 is a flowchart showing processing by the information processing device in credential registration continuation processing. [Figure 17] 10 is a flowchart showing the processing of an authentication terminal communication management module in the credential registration continuation processing. [Figure 18] 10 is a flowchart showing a process of the authentication terminal in the credential registration continuation process. [Figure 19] 10 is a flowchart showing the processing of the authentication server in the credential registration continuation processing. [Figure 20] 10 is a flowchart showing the processing of the application server in the credential registration continuation processing. [Figure 21] 10 is an example of a credential registration success screen in the second embodiment. [Figure 22] 10 is a flowchart showing a process of the information processing device in a credential deletion process according to the second embodiment. [Figure 23] 10 is a flowchart showing the processing of the authentication terminal communication management module in the credential deletion processing. [Figure 24] 10 is a flowchart showing a process of the authentication terminal in a credential deletion process. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. Not all of the features in the embodiments of the present disclosure are essential, and multiple features may be combined as desired. Furthermore, the configurations shown in the following embodiments are merely examples, and the present disclosure is not limited to the illustrated configurations. In the drawings, the same reference symbols are used to designate the same or similar configurations, and redundant explanations will be omitted.

[0013] [First embodiment] In this embodiment, the following method is disclosed for a credential registration method in which credential information is registered in a registration destination terminal by communication between the registration source terminal and the registration destination terminal, which is a terminal different from the registration source terminal: In this method, if credential registration fails due to a failure in communication between the authentication server and the registration source terminal, the credential information is deleted from the registration destination terminal.

[0014] <System configuration> FIG. 1 is a diagram showing the overall configuration of a system according to an embodiment of the present disclosure. The system includes an information processing device 101, an authentication terminal 102, an application server 103, an authentication server 104, a first credential information management server 105, a second credential information management server 106, and an authentication terminal communication management module 107. The authentication terminal 102 is an example of an external terminal or a terminal device.

[0015] An information processing device 101 such as a PC has an authentication function for authenticating a user and supports challenge-response authentication such as FIDO for logging in to an application server 103. For example, the information processing device 101 can transmit a request to create credential information to the application server 103 and obtain a challenge from the authentication server 104. Then, the information processing device 101 can transmit information indicating the registration result of the credential information (credential registration result) to the authentication server 104. The information processing device 101 is, for example, a PC.

[0016] The authentication terminal 102 is a terminal that can be used by a user as an external authenticator for the information processing device 101. The authentication terminal 102 is assumed to be a smartphone or the like. The authentication terminal 102 can not only be used as an external authenticator for the information processing device 101, but also supports challenge-response authentication such as FIDO for logging in to the application server 103, just like the information processing device 101.

[0017] In this embodiment, when registering a credential, the information processing device 101 communicates with the authentication terminal 102, so that the credential information can be registered in the authentication terminal 102, which is a terminal different from the information processing device 101 that is the credential registration source. This process is executed as follows, for example.

[0018] (1) In response to a credential registration request from the registration source terminal (information processing device 101), the authentication server that receives the request transmits a credential registration challenge to the registration source terminal. (2) When the registration source terminal receives the challenge, it establishes communication with the terminal to which the credential is to be registered (hereinafter referred to as the registration destination terminal) based on the Hybrid-transport specifications. Here, it is assumed that the authentication terminal 102 is the registration destination terminal. Note that whether or not to register the credential information in the registration destination terminal can be specified by the user at will when making a credential registration request on the information processing device 101. (3) The registration source terminal transmits a request to register the credential information to the registration destination terminal together with the challenge received from the authentication server. (4) When the registration destination terminal receives a registration request from the registration source terminal, it creates credential information and sends the signature and public key to the registration source terminal. (5) When the registration source terminal receives a response from the registration destination terminal, it sends a request to terminate communication with the registration destination terminal, terminates communication with the registration destination terminal, and then sends the public key and signature to the authentication server. (6) The authentication server verifies the signature based on the received public key and registers the public key if the verification is successful.

[0019] When the application server 103 receives a request to create credential information from the information processing device 101 and the authentication terminal 102, it transmits the request to create credential information to the authentication server 104. Furthermore, when the application server 103 receives information indicating the result of the creation of the credential information from the authentication server 104, it transmits the information indicating the result of the creation of the credential information to the information processing device 101 and the authentication terminal 102.

[0020] In the following explanation, "sending (or receiving) information indicating the result of ..." will be referred to as "sending (or receiving) the result of ..." for the sake of simplicity. This applies not only to "sending (or receiving) the result" but also to "notifying the result" or "obtaining the result."

[0021] The authentication server 104 is a server system that executes services for managing user identification information and public keys used for signature verification. The authentication server 104 also issues a challenge, which is verification data, at the timing of public key registration, user authentication, etc. When the authentication server 104 receives a credential information creation request, it transmits the challenge to the information processing device 101 or the authentication terminal 102. When the authentication server 104 receives a credential information creation result from the information processing device 101 or the authentication terminal 102, it registers the public key in the authentication server 104 and transmits the credential information creation result to the application server 103. The authentication server 104 may be configured to be managed by the same server as the application server 103.

[0022] Multi-device FIDO credentials are an extension specification for credentials handled by FIDO. For the purpose of account recovery, multi-device FIDO credentials send credentials from the FIDO client module on the registration device to the management server that manages the client module when registering credentials in an authentication system. This management server then synchronizes the user's FIDO credentials with other devices when the user uses a device other than the registration device.

[0023] The first credential information management server 105 and the second credential information management server 106 are management servers that can provide the above synchronization function and manage user credential information. Hereinafter, for convenience of explanation, the first credential information management server 105 and the second credential information management server 106 may be referred to as the "credential information management servers 105, 106."

[0024] When receiving a request to register credential information from the information processing device 101 and the authentication terminal 102, the credential information management servers 105 and 106 register the credential information and transmit the credential registration result to the information processing device 101 and the authentication terminal 102. When using the registration function, authentication of the user who uses the information processing device 101 and the authentication terminal 102 is required. Therefore, the credential information management servers 105 and 106 provide the authentication function to the information processing device 101 and the authentication terminal 102.

[0025] The authentication terminal communication management module 107 is a module used when communicating between the information processing device 101 and the authentication terminal 102. The information processing device 101 and the authentication terminal 102 communicate via websocket based on the tunnel-service defined in the CTAP Hybrid transport specifications.

[0026] In this embodiment, the authentication terminal communication management module 107 is configured as a device separate from the information processing device 101 and the authentication terminal 102. However, the authentication terminal communication management module 107 may be configured as a part of the module of the authentication terminal 102, which is the registration destination terminal.

[0027] The information processing device 101 and the authentication terminal 102 are connected via local networks 108 and 109, respectively. Furthermore, the application server 103, the authentication server 104, the first credential information management server 105, the second credential information management server 106, and the authentication terminal communication management module 107 are connected via a global network 110. The local networks 108 and 109 are communication networks realized by, for example, any one or a combination of LAN, WAN, telephone line, dedicated digital line, ATM, frame relay line, cable television line, wireless line for data broadcasting, etc. Furthermore, the global network 110 has the same configuration as the local networks 108 and 109.

[0028] <Hardware configuration> Fig. 2(A) is a block diagram showing an example of the hardware configuration of each of the information processing device 101 and the authentication terminal 102. Fig. 2(B) is a block diagram showing an example of the hardware configuration of each of the application server 103, the authentication server 104, the first credential information management server 105, the second credential information management server 106, and the authentication terminal communication management module 107. In the explanation of Fig. 2(B), the application server 103, the authentication server 104, the first credential information management server 105, the second credential information management server 106, and the authentication terminal communication management module 107 will be collectively referred to as "devices 103-107."

[0029] The information processing device 101 and the authentication terminal 102 include a CPU 201, a memory 202, a hard disk drive (HDD) 203, and a near-field communication IF 205. The information processing device 101 and the authentication terminal 102 also include a UI control unit 205, a network control unit 208, a TPM (Trusted Platform Module) 209, a biometric information sensor 210, and a touch panel 207.

[0030] The CPU 201 mainly executes programs stored in a hard disk drive 203, which is a storage device, and controls all hardware connected to a system bus 204. The memory 202 functions as the main memory, work area, etc. of the CPU 201 . The hard disk drive 203 serves as a large-capacity storage device for recording data.

[0031] The UI control unit 206 controls input from an input device such as a touch panel 207 . The network control unit 208 exchanges data bidirectionally with other nodes via the network.

[0032] The near field communication IF 205 is a network I / F for near field communication such as NFC or Bluetooth, and communicates with the information processing device 101 and the authentication terminal 102 to exchange data.

[0033] The TPM 209 is a tamper-resistant storage device that prevents stored data from being read from an external source for the purpose of processing and storing confidential information. In this embodiment, the TPM 209 manages biometric information used for authentication or credential information such as a private key corresponding to the biometric information.

[0034] The biometric information sensor 210 is a sensor that reads biometric information of a user using the authentication terminal, and converts information such as the user's fingerprint, vein pattern, voiceprint, iris, and / or facial image into a read signal. The biometric information sensor 210 is realized using a dedicated reader such as a fingerprint sensor, a camera, a microphone, etc.

[0035] The devices 103 - 107 each include a CPU 220 , a memory 211 , a hard disk drive (HDD) 212 , an input control unit 214 , a keyboard 215 , a display control unit 216 , a display 217 , and a network control unit 218 .

[0036] The CPU 220 executes programs stored in a storage device, the hard disk drive 212. The CPU 220 controls all the hardware components connected to the system bus 213. The memory 211 functions as the main memory, work area, etc. of the CPU 220 . The hard disk drive 212 serves as a mass storage device for recording data.

[0037] The input control unit 214 controls input from an input device such as a keyboard 215. Depending on the role of the devices 103-107, the input control unit 214 and the keyboard 215 may be omitted. The display control unit 216 controls the display on a display device such as a liquid crystal display (display 217). Depending on the role of the devices 103-107, the display control unit 216 and the display 217 may be omitted. The network control unit 218 exchanges data bidirectionally with other nodes via the network.

[0038] The devices 103-107 are implemented by information processing devices provided as a cloud computing service. Cloud computing includes serverless computing and virtual machines. In cloud computing, multiple hardware resources shown in FIG. 2(B) are used. Note that the application server 103, authentication server 104, credential information management servers 105 and 106, and authentication terminal communication management module 107 may each be implemented by a single physical machine.

[0039] It should be noted that a PLD (Programmable Logic Device) such as an FPGA (Field Programmable Gate Array) may be used instead of the CPUs 201 and 220. Alternatively, an ASIC (Application Specific Integrated Circuit) or a DSP (Digital Signal Processor) may be used. Furthermore, instead of the hard disk drives 203 and 212, other storage devices such as flash memory, SSD (Solid State Drive), optical recording device, or magneto-optical recording device may be used.

[0040] <Functional configuration> FIG. 3 is a block diagram showing an example of the functional configuration of the information processing device 101, the authentication terminal 102, the application server 103, the authentication server 104, the credential information management servers 105 and 106, and the authentication terminal communication management module 107. As shown in FIG.

[0041] The information processing device 101 and the authentication terminal 102 include a browser 310 , an authentication client 320 , an authentication device 330 , and an image processing unit 334 .

[0042] The browser 310 has the function of interpreting HTML and displaying web pages, as well as the function of accepting input from a user and sending requests to the application server 103. In this embodiment, the browser 310 provides a web page for displaying a credential information registration screen provided by the application server 103. FIG. 4 shows an example of the credential information registration screen. The browser 310 has the function of displaying a QR code (registered trademark, the same applies hereinafter) that is issued when communication between the information processing device 101 and the authentication terminal 102 is permitted.

[0043] The authentication client 320 has the function of performing authentication required when a user registers credentials and the function of controlling synchronization of credential registration. Credential information will be described later in the functional description of the credential information storage unit 332. The authentication client 320 also manages communication between the information processing device 101 and the authentication terminal 102, issues a QR code when communication between these terminals is permitted, and requests the browser 310 to display the QR code. In addition, when communication between the information processing device 101 and the authentication terminal 102 is established, the authentication client 320 has the function of sending a credential information registration request (a request to register credential information) to the authentication terminal of the communication destination. Communication between the information processing device 101 and the authentication terminal 102 is executed via the authentication terminal communication management module 107. Furthermore, the authentication client 320 has the function of sending a credential information deletion request (a request to delete credential information) to the authentication terminal of the communication destination when credential registration fails.

[0044] The authentication device 330 includes a biometric authentication processing unit 331 , a credential information storage unit 332 , and a biometric information management unit 333 .

[0045] The biometric authentication processing unit 331 has a function to request the user to input biometric information and a function to perform biometric authentication. Biometric authentication is a process to confirm that the biometric information received from the user exists in a biometric information table held by the biometric information management unit 333. The biometric information and the biometric information table will be described later in the functional description of the biometric information management unit 333. In addition, the biometric authentication processing unit 331 provides a function to create credential information. The credential information will be described in the functional configuration of the credential information storage unit 332 below.

[0046] The credential information storage unit 332 provides a function for storing credential information. The credential information is created when a public key for using a service provided by the application server 103 is registered in the authentication server 104. Table A1 shows an example of a credential information table stored in the credential information storage unit 332 of the information processing device 101. Table A2 shows an example of a credential information table stored in the credential information storage unit 332 of the authentication terminal 102. The credential information record includes an authentication information ID that is an ID that uniquely identifies the authentication information, a private key, a user ID that is an ID that uniquely identifies the user information, and a service URL that is the URL of the service provided by the application server 103.

[0047] [Table A1] [Table A2]

[0048] The biometric information management unit 333 manages the biometric information stored in the authentication device 330. Table B1 shows an example of a biometric information table managed by the information processing device 101 in the biometric information management unit 333. Table B2 shows an example of a biometric information table managed by the authentication terminal 102 in the biometric information management unit 333. The biometric information record includes a user ID and a biometric information ID that is an ID that uniquely identifies the biometric information.

[0049] [Table B1] [Table B2]

[0050] The image processing unit 334 processes the image input from the camera. For example, the image processing unit 334 acquires image information of a QR code input by the user for communication between the information processing device 101 and the authentication terminal 102, and analyzes the QR code.

[0051] The application server 103 includes an authentication processing unit 340 and a credential registration processing unit 341 .

[0052] The authentication processing unit 340 provides the credential information management servers 105 and 106 with a function of requesting the acquisition of information about users who use services provided by the application server 103. The authentication processing unit 340 acquires the results of user authentication from the credential information management servers 105 and 106. In this embodiment, OpenID Connect is used for user authentication, but other authentication methods such as HTTP authentication (Basic authentication / Digest authentication) may also be used.

[0053] The credential registration processing unit 341 provides a function to receive a credential registration request from the information processing device 101 and the authentication terminal 102, and to transmit the credential registration request to the authentication server 104. The credential registration processing unit 341 also provides a function to receive a credential registration result from the information processing device 101 and the authentication terminal 102, and to transmit a request to the authentication server 104 to verify the credential registration result.

[0054] The authentication server 104 includes an authentication request management unit 350 and a public key management unit 351 .

[0055] The authentication request management unit 350 provides a function to receive a credential information creation request sent from the application server 103 and to send a challenge at the time of credential registration. The authentication request management unit 350 also provides a function to verify the credential information creation result sent from the information processing device 101 and the authentication terminal 102 and to send the creation result to the application server 103. The authentication request management unit 350 also provides a function to send a request to the public key management unit 351 to save public key information included in the credential information creation result.

[0056] The public key management unit 351 provides a function of receiving a public key storage request sent from the authentication request management unit 350 and storing the public key. Table C is an example of a public key table managed by the public key management unit 351. The public key record includes an authentication information ID and a public key.

[0057] [Table C]

[0058] The credential information management servers 105 and 106 include a credential information management unit 360 and a user management unit 361 .

[0059] The credential information management unit 360 has the function of receiving a credential registration request from the information processing device 101 and the authentication terminal 102 and saving the credential information. Authentication is required to save the credential information. Details of the authentication process will be explained later in the section on credential information management server authentication processing. Table D1 is an example of a credential information table held by the credential information management unit 360 of the first credential information management server 105. Table D2 is an example of a credential information table held by the credential information management unit 360 of the second credential information management server 106. The credential information record includes an authentication information ID, a private key, a user ID, and a service URL.

[0060] [Table D1] [Table D2]

[0061] The user management unit 361 provides a function for retaining user information of users who use the information processing device 101 and the authentication terminal 102. The user management unit 361 also provides a function for receiving a user authentication request from the application server 103, performing user authentication processing, and issuing token information for using the application server 103. Additionally, the user management unit 361 provides a function for authenticating users who use the credential management servers 105 and 106 when a function for synchronizing credential information provided by the credential information management servers 105 and 106 is used. In this embodiment, authentication is performed using HTTP authentication (Basic authentication and Digest authentication), but other authentication methods such as OpenID Connect may also be used. Table E1 is an example of a user information table retained by the user management unit 361 of the first credential information management server 105. Table E2 is an example of a user information table retained by the user management unit 361 of the second credential information management server 106. Each user information record includes a user ID and a password.

[0062] [Table E1] [Table E2]

[0063] The authentication terminal communication management module 107 includes a session management unit 370. The session management unit 370 manages the session between the information processing device 101 and the authentication terminal 102. The authentication terminal communication management module 107 provides a function to transmit requests sent from the information processing device 101 and the authentication terminal 102 to another terminal using the websocket method. In this embodiment, the endpoint of the authentication terminal communication management module 107 is "cable.example.me".

[0064] <User authentication process> The user authentication process will be explained using Fig. 5. In order to register credential information linked to a user using the information processing device 101 and the authentication terminal 102, it is necessary to verify whether the user is registered for the service. This process will be explained for a case in which authentication of a service provided by the application server 103 is performed from the information processing device 101 using authentication information of a user using the authentication terminal 102.

[0065] 5 is a sequence diagram showing the processes in the user authentication process performed by the information processing device 101, the application server 103, and the second credential information management server 106. The second credential information management server 106 manages authentication information of users who use the application server 103 (here, authentication information linked to the authentication terminal 102).

[0066] When the user authentication process starts, in step S501, the browser 310 of the information processing apparatus 101 transmits a login request to the service to the application server 103.

[0067] In S502, the authentication processing unit 340 of the application server 103 creates a nonce associated with the session. A nonce is a disposable random character used during encrypted communication. A specific example is "1 999 888 777 666 555 444".

[0068] In S503, the authentication processing unit 340 of the application server 103 transmits an access request to the second credential information management server 106 to the information processing device 101.

[0069] In S504, an authentication request is sent from the browser 310 of the information processing device 101 to the credential information management server 105. The authentication request includes the user ID and password of the user who uses the authentication terminal 102. In this embodiment, the user ID is "user002" and the password is "userpass2".

[0070] In S505, the user management unit 361 of the second credential information management server 106 verifies the authentication information of the authentication terminal 102 sent from the information processing device 101. If the combination of user ID and password exists in the user information table held by the user management unit 361, the second credential information management server 106 stores the nonce. Table F is an example of a nonce information table held by the user management unit 361. The nonce information record includes a session ID, which is an identifier for the session, and a nonce.

[0071] [Table F]

[0072] In S506, the user management unit 361 of the second credential information management server 106 transmits an authorization code to the information processing device 101. The authorization code is a time-limited token issued from an authorization endpoint, and a specific example thereof is "dd1231FBC3123a987=".

[0073] In step S507 , the browser 310 of the information processing device 101 transmits the authorization code to the application server 103 .

[0074] In S508, the authentication processing unit 340 of the application server 103 sends a request to acquire an ID token and nonce, along with the authorization code, to the second credential information management server 106. An ID token is defined in OpenID Connect as a token that proves that the user who made the issuance request has been authenticated. Specific examples of ID tokens include the following: (Header) { “typ”: “assertion”, “alg”: “ES256”, “kid”: “aaaaaaaa-bbbb-1111-8888-999999999999” } (payload) { “response_type”: “id_token”, “redirect_url”: “http: / / example_srv.com / customer”, “iss”: “ODBIMWUwasdasd123UUUMXw”, “sub”: “dXIIMM123KKllss”, “iat”: 1903144999, "exp": 1903149999 }

[0075] In S509, the user management unit 361 of the second credential information management server 106 transmits the token and nonce to the application server 103.

[0076] In S510, the authentication processing unit 340 of the application server 103 verifies the token and nonce.

[0077] In S511, the authentication processing unit 340 of the application server 103 transmits the authentication result to the information processing device 101, and the process ends.

[0078] <Credential information management server authentication process> Next, the credential information management server authentication process will be described with reference to Fig. 6. This process performs authentication that is required before credential registration is performed by the information processing device 101 to the first credential information management server 105, and by the authentication terminal 102 to the second credential information management server 106.

[0079] FIG. 6 is a sequence diagram showing the processes of the information processing device 101, the authentication terminal 102, and the credential information management servers 105 and 106 in the credential information management server authentication process.

[0080] When the credential information management server authentication process starts, in S601, an authentication request is sent from the browser 310 of the authentication terminal 102 to the credential information management servers 105 and 106. The information processing device 101 sends the request to the first credential information management server 105, and the authentication terminal 102 sends the request to the second credential information management server 106.

[0081] In S602, the user management unit 361 of the credential information management servers 105 and 106 transmits a user information acquisition request to the authentication terminal 102. The first credential information management server 105 transmits the request to the information processing device 101, and the second credential information management server 106 transmits the request to the authentication terminal 102.

[0082] In S603, the browser 310 of the authentication terminal accepts the user ID and password of the user using the authentication terminal 102. Upon receiving input from the user, the browser 310 transmits the user ID and password to the user credential information management server. The information processing device 101 transmits the user ID and password to the first credential information management server 105. The authentication terminal 102 transmits the user ID and password to the second credential information management server 106. In this embodiment, the user ID transmitted from the information processing device 101 is "user001" and the password is "userpass1". Furthermore, the user ID transmitted from the authentication terminal 102 is "user002" and the password is "userpass2".

[0083] In S604, the user management unit 361 of the credential information management servers 105 and 106 verifies the user information. If the corresponding user ID and password combination exists in the user information table (Tables E1 and E2), the authentication result is determined to be successful; if not, the authentication result is determined to be unsuccessful.

[0084] In S605, the user management units 361 of the credential information management servers 105 and 106 transmit the verification results to the information processing device 101 and the authentication terminal 102, and then this process ends. The first credential information management server 105 transmits the verification results to the information processing device 101. The second credential information management server 106 transmits the verification results to the authentication terminal 102.

[0085] <Credential registration process> The credential registration process will be described with reference to Figures 7 and 8. In this process, communication is performed between the information processing device 101 and the authentication terminal 102, and the information processing device 101 requests the authentication terminal 102 to register a credential. This describes the sequence that occurs when a communication error occurs between the authentication server 104 and the information processing device 101 during registration. This sequence shows that the credential information is deleted in the authentication terminal 102 by the credential information rollback process, and the credential information is synchronized, causing the credential to be deleted in the second credential information management server 106.

[0086] 7 and 8 are sequence diagrams showing the processes of the information processing device 101, authentication terminal 102, application server 103, authentication server 104, second credential information management server 106, and authentication terminal communication management module 107 in the credential registration process.

[0087] When the credential registration process starts, in step S701 the browser 310 of the information processing device 101 transmits a credential information creation request from the user who uses the information processing device 101 to the application server 103.

[0088] In S702, the credential registration processing unit 341 of the application server 103 transmits a credential information creation request to the authentication server 104.

[0089] In S703, the authentication request management unit 350 of the authentication server 104 transmits a credential registration request together with the challenge to the information processing device 101, which receives it. Specific examples of the credential registration request transmitted from the authentication request management unit 350 include the following: { challenge: “ASD123tre12312FE”, rp: { name: “AdminPage”, id: “https: / / example_srv.com / admin”, nonce: “1234 5678 9012 3456” user: { id: “user002”, name: “user002”, displayName: “user002”, }, pubKeyCredParams: [ {alg: -7, type: “public-key”}, {alg: -257, type: “public-key”}], authenticatorSelection: { authenticatorAttachment: “platform”, requireResidentKey: true, } } } The above is a specific example that conforms to the Webauthn specifications. In S703, the CPU 201 and network control unit 208 of the information processing apparatus 101 are an example of a receiving unit that receives a request to register credential information.

[0090] In S704, the authentication client 320 of the information processing device 101 transmits a request to the browser 310 to display a QR code for communication between the information processing device 101 and the authentication terminal 102. The browser 310 displays the QR code for communication between the information processing device 101 and the authentication terminal 102. The QR code is encoded in CBOR format. An example of a decoded QR code is as follows:

[0091] 0: h'12323300FFFFECEEEEDDDD11114FE1B16AE22F16BB05B88C25DB089612129696', 1: 12323300FFFFECEE twenty one

[0092] The key of 0 indicates a public key for handshake between the information processing device 101 and the authentication terminal 102. The key of 1 is authentication information for BLE advertising by the authentication terminal 102, and the key of 2 indicates the number of domains of the authentication terminal communication management module 107. In this case, it indicates that the information processing device 101 holds only the endpoint of "cable.example.me", which is the domain of the authentication terminal communication management module 107.

[0093] In S705, the image processing unit 334 of the authentication terminal 102 acquires image information of the QR code input by the user for communication between the information processing device 101 and the authentication terminal 102, and analyzes the QR code.

[0094] In S706, the authentication client 320 of the authentication terminal 102 executes BLE advertising to the information processing device 101. BLE is a well-known technology, and therefore a description thereof will be omitted here.

[0095] In S707, the authentication client 320 of the information processing device 101 that has received the BLE advertisement transmits a connection request with the authentication terminal 102 to the authentication terminal communication management module 107. As described above, the session management unit 370 of the authentication terminal communication management module 107 manages the session between the information processing device 101 and the authentication terminal 102. The session management unit 370 creates a tunnel and establishes communication between the information processing device 101 and the authentication terminal 102 using websocket frames with the authentication terminal 102.

[0096] In S708, the authentication client 320 of the information processing device 101 requests the authentication terminal communications management module 107 to transmit a credential information registration request together with the challenge. In S709, the session management unit 370 of the authentication terminal communications management module 107 transmits the credential information registration request together with the challenge to the authentication terminal 102. Here, the CPU 201 and network control unit 208 of the information processing device 101 are an example of a transmitting means that transmits at least a request for creating credential information to an external terminal. Also, the CPU 201 and network control unit 208 of the authentication terminal 102 are an example of a receiving means that receives at least the transmitted request for creating credential information.

[0097] In S710, upon receiving the challenge, the authentication terminal 102 acquires biometric information of the user using the authentication terminal 102. The authentication client 320 of the authentication terminal 102 transmits a biometric information acquisition request to the biometric authentication processing unit 331. The biometric authentication processing unit 331 receives the biometric information acquisition request and waits until it accepts the user's biometric information from the user. The biometric authentication processing unit 331 acquires the feature quantities of the biometric information input by the user. The feature quantities of the biometric information are obtained by converting unique information for each individual, such as fingerprint patterns, iris patterns, and vein shapes, into values ​​that do not impair the uniqueness. Biometric authentication identifies an individual using these unique feature quantities. It is desirable that the biometric information transmitted in this process be encrypted using a known encryption technology so that it can only be decrypted by the information processing device 101 and / or the authentication terminal 102.

[0098] In S711, the biometric authentication processing unit 331 of the authentication terminal 102 performs authentication processing. The biometric authentication processing unit 331 transmits a request to confirm that the biometric information acquired in S710 has been registered to the biometric information management unit 333. If the biometric authentication processing unit 331 receives from the biometric information management unit 333 that the biometric information has already been registered, it determines that the authentication has been successful, and if not, it terminates this processing.

[0099] In S712, the biometric authentication processing unit 331 of the authentication terminal 102 creates a pair of a private key and a public key based on the successful authentication. The public key is used for signature verification in the authentication server 104. The biometric authentication processing unit 331 then creates credential information including the private key and transmits a request to store the credential information in the credential information storage unit 332. The authenticator 330 also creates a signature using the private key and the challenge received in S709. In S712, the CPU 201 of the authentication terminal 102 and at least a part of the authenticator 330 are examples of the first generating means and the second generating means.

[0100] When the credential information storage unit 332 receives a request to save the credential information, it stores the credential information. Table G is an example of a credential information table in the biometric authentication processing unit 331 of the authentication terminal 102 after the credential information has been created.

[0101] [Table G]

[0102] In S713, the authentication client 320 of the authentication terminal 102 transmits a synchronization request for the credential information to the second credential information management server 106. Here, the CPU 201 and the authentication client 320 of the authentication terminal 102 are an example of a synchronization means that transmits the credential information to the credential information management server.

[0103] In S714, the credential information management unit 360 of the second credential information management server 106 performs credential registration corresponding to the created credential information. After this registration, the credential information management unit 360 transmits a credential synchronization completion notification to the authentication terminal 102 as a synchronization result. Table H is an example of a credential information table registered in the credential information management unit 360 of the second credential information management server 106. This is substantially the same as, for example, Table G.

[0104] [Table H]

[0105] In S715, the authentication client 320 of the authentication terminal 102 transmits the credential information creation result to the information processing device 101 via the authentication terminal communications management module 107. Here, the public key and signature created in S712 are also transmitted to the information processing device 101. Specific examples of the results of creating credential information to be sent to the information processing device 101 include the following. { “id”: “asda13123fdcccc9786546”, “rawId”: “10003”, "response": { “clientDataJson”: { “type”: “webauthn.create”, “challenge”: “NKX1239887823ASd”, “origin”: “https: / / device102.me”, “crossOrigin”: false }, “attestationObject”: { “aaguid”: 00000000-0000-0000-0000-000000000000, “credentialId”: “10003”, “credentialPublicKey”: {“kty”: “RSA”, “alg”: “ECDSA_alg_sha256”, “crv”: p-256, “x”: “1aasdaVERSSDfs / werwcsdfsdf”, “y”: “oisdfsdbfsbdhs / easdas,casdasd” } }, “authenticatorAttachment”: “platform”, “type”: “public-key” } }

[0106] In S716, the session management unit 370 of the authentication terminal communication management module 107 transmits the credential information creation result to the information processing device 101. In S716, the CPU 201 and the network control unit 208 of the authentication terminal 102 are an example of a transmission means for transmitting the public key to the information processing device 101.

[0107] In S717, the authentication client 320 of the information processing device 101 transmits the public key and the signature to the authentication server 104.

[0108] In S718, the authentication client 320 of the information processing device 101 acquires an error response. The error response may be an error response sent from the application server 103, or an error determined by the authentication client 320 when access to the authentication server 104 fails. Examples of errors determined by the authentication client 320 include a connection timeout and a read timeout.

[0109] In S719, the authentication terminal communication management module 107, the information processing device 101, the authentication terminal 102, and the authentication server 104 execute a credential information rollback process. This process will be described later. This process deletes the credential information of authentication information ID 10003 stored in the credential information storage unit 332 of the authentication terminal 102. In S719, the CPU 201 of the authentication terminal 102 and at least a part of the authenticator 330 are an example of a deletion means for deleting the credential information.

[0110] In S720, the authentication client 320 of the authentication terminal 102 transmits a credential information synchronization request to the second credential information management server 106.

[0111] In S721, the credential information management unit 360 of the second credential information management server 106 deletes the synchronized credentials and transmits a synchronization completion result to the authentication terminal 102. Table I is an example of a credential information table managed by the credential information management unit 360 of the second credential information management server 106 after synchronization is completed. [Table I]

[0112] <Credential information rollback processing> The credential information rollback process (S719) will be described with reference to Figures 9 to 11. This process deletes the credentials registered in the authentication terminal 102 when a communication error occurs between the authentication server 104 and the information processing device 101. This process also cancels communication between the information processing device 101 and the authentication terminal 102 depending on the processing status of the authentication terminal 102. In this process, the credential information registered in the authentication terminal 102, which is the credential registration destination, is deleted, thereby maintaining the consistency of the credential information with the external authentication server 104 and improving user convenience.

[0113] FIG. 9 is a flowchart showing the process of the information processing device 101 in the credential registration process.

[0114] When the credential information rollback process starts, the authentication client 320 of the information processing apparatus 101 acquires a response from the authentication server 104 in S801.

[0115] In S802, the authentication client 320 of the information processing device 101 checks whether the error can be retried. The authentication client 320 manages response correspondence information, which is information used to determine whether to resend a request to the authentication server 104 for each response from the authentication server 104. The authentication client 320 determines whether to retry based on the response correspondence information.

[0116] Table J is an example of an error response correspondence table managed by the authentication client 320 of the information processing device 101 and the authentication terminal 102. The error response correspondence table includes a response code and a retry possibility indicating whether to retry. In this embodiment, if the retry possibility is True, the request is resent. If a retry is possible, the process proceeds to S803, and if not, the process proceeds to S804.

[0117] [Table J]

[0118] In S803, the authentication client 320 of the information processing device 101 determines whether the number of retries for the request to the authentication server 104 has exceeded the upper limit. In this embodiment, the upper limit for retries is set to five. If the number of retries has exceeded the upper limit, the process proceeds to S805; if not, the process proceeds to S804.

[0119] In S804, the authentication client 320 of the information processing device 101 re-executes a request to the authentication server 104. This process is similar to S717 and S718 of the credential registration process, and therefore a description thereof will be omitted. When this process is completed, the process proceeds to S801.

[0120] In S805, the authentication client 320 of the information processing device 101 requests the authentication terminal communication management module 107 to send a credential information deletion request to the authentication terminal 102. The credential information deletion request includes at least the authentication information ID of the credential information to be deleted. In this embodiment, the authentication information ID of the credential information to be deleted is "10003".

[0121] In S806, the authentication client 320 of the information processing device 101 checks whether the result of the deletion of the credential information in the authentication terminal 102 has been received from the authentication terminal communication management module 107. If it has been received, the process proceeds to S808, and if not, the process proceeds to S807. In S807, the authentication client 320 of the information processing device 101 waits for processing and proceeds to S806.

[0122] In S808, the authentication client 320 of the information processing device 101 determines whether the deletion of the credential information was successful based on the deletion result acquired in S806. If the deletion was successful, the process proceeds to S809; if not, the process proceeds to S810.

[0123] In step S809, the authentication client 320 of the information processing device 101 transmits a transmission request to the authentication terminal communication management module 107 to terminate communication with the authentication terminal 102.

[0124] In S810, the authentication client 320 of the information processing device 101 requests the browser 310 of the information processing device 101 to display a registration failure screen. The browser 310 displays the registration failure screen, and the processing on the information processing device side ends.

[0125] 12 is an example of a registration failure screen displayed on the browser 310 of the information processing device 101. Furthermore, if the deletion of the credential information of the authentication terminal 102 fails in S810, a message indicating that the deletion of the credential information has failed may be displayed on the authentication terminal 102, similar to the screen shown in FIG.

[0126] FIG. 10 is a flowchart showing the processing of the authentication terminal communication management module 107 in the credential registration processing.

[0127] In S821, the session management unit 370 of the authentication terminal communication management module 107 checks whether a credential deletion request for the authentication terminal 102 has been received from the information processing device 101. If it has been received, the process proceeds to S823. If not, the process proceeds to S822. In S822, the session management unit 370 waits for processing, and the process proceeds to S821.

[0128] In S823, the session management unit 370 transmits a request to delete the credential information received from the information processing device 101 to the authentication terminal 102.

[0129] In S824, the session management unit 370 checks whether a request to send the deletion result of the credential information has been received from the authentication terminal 102. If it has been received, the process proceeds to S826, and if not, the process proceeds to S825. In S825, the session management unit 370 waits for processing and then proceeds to S824.

[0130] In S826, the session management unit 370 transmits the deletion result of the credential information received from the authentication terminal 102 to the information processing device 101.

[0131] In S827, the session management unit 370 checks whether a request to terminate communication with the authentication terminal 102 has been received from the authentication terminal 102. If it has been received, the process proceeds to S829, and if not, the process proceeds to S828. In S828, the session management unit 370 waits for processing, and then proceeds to S827.

[0132] In S829, the session management unit 370 transmits a communication release request, requested by the information processing device 101, to the authentication terminal 102, and ends this process.

[0133] FIG. 11 is a flowchart showing the processing of the authentication terminal 102 in the credential registration processing.

[0134] In S831, the authentication client 320 of the authentication terminal 102 checks whether a request to delete the credential information requested by the authentication terminal 102 has been received from the authentication terminal communication management module 107. If it has been received, the process proceeds to S833, and if not, the process proceeds to S832. In S832, the authentication client 320 of the authentication terminal 102 waits for processing and then proceeds to S831.

[0135] In S833, the authentication client 320 of the authentication terminal 102 receives the request to delete the credential information corresponding to the authentication information ID "10003", and requests the credential information storage unit 332 of the authentication terminal 102 to delete the credential information. The credential information storage unit 332 deletes the corresponding credential information. Table K is an example of a credential information table managed by the credential information storage unit 332 of the authentication terminal 102 when the credential information corresponding to the authentication information ID "10003" is deleted.

[0136] [Table K]

[0137] In step S834, the authentication client 320 of the authentication terminal 102 requests the authentication terminal communications management module 107 to transmit the deletion result of the credential information to the information processing device 101.

[0138] In S835, the authentication client 320 of the authentication terminal 102 checks whether the communication termination request requested from the information processing device 101 has been received from the authentication terminal communication management module 107. If it has been received, the process proceeds to S837, and if not, the process proceeds to S836. In S836, the authentication client 320 of the authentication terminal 102 waits for processing and proceeds to S835.

[0139] In S837, the authentication client 320 of the authentication terminal 102 terminates communication with the information processing device 101, and ends this process.

[0140] As shown in Table K, this process deletes the credential information that failed to be registered in the authentication server 104, and indicates that the credential registration process has been successfully rolled back.

[0141] As described above, according to this embodiment, the following effects can be obtained in a case where credential information is registered in the authentication terminal 102, which is a terminal separate from the information processing device 101. For example, even if communication between the information processing device 101 and the authentication server 104 is temporarily interrupted and credential registration fails, this embodiment deletes the credential information from the authentication terminal 102. Therefore, the integrity of the credential information between the authentication server 104 and the authentication terminal 102 can be ensured. That is, it is possible to avoid a situation in which credential information remains held in the authentication terminal 102 even though an authentication public key is not registered in the authentication server 104. This eliminates the inconvenience that a user might experience when being unable to distinguish between other successfully registered credential information and unsuccessfully registered credential information. As a result, it is possible to prevent a user from accidentally deleting successfully registered credential information by mistake, for example, deleting unsuccessfully registered credential information. In this way, this embodiment improves user convenience.

[0142] [Second embodiment] Next, a second embodiment of the present disclosure will be described. In the following, the configurations and functions of the elements constituting the system that are the same as those in the first embodiment will be omitted or simplified, and differences from the first embodiment will be mainly described.

[0143] In the first embodiment, a rollback method for deleting credential information from a registration destination terminal when credential registration fails through communication between an authentication server and a registration source terminal in a method for registering credential information to a registration destination terminal through communication between terminals was disclosed. However, the registration source terminal and the registration destination terminal often use different networks to connect to the authentication server. For this reason, sending a response from the registration destination terminal to the authentication server as a retry method is effective for continuing the credential registration process with the authentication server. In the present embodiment, a method for continuing credential registration by sending (retransmitting) a response from the registration destination terminal to the authentication server when transmission of a response to the authentication server through communication between the registration source terminal and the authentication server fails is disclosed. For ease of explanation, the response sent from the registration destination terminal to the authentication server to continue credential registration as described above will be referred to as a "registration response" below.

[0144] <Functional configuration> 13 is a block diagram showing an example of the functional configuration of the information processing device 101, the authentication terminal 102, the application server 103, the authentication server 104, the credential information management servers 105 and 106, and the authentication terminal communication management module 107. The functional configurations of the application server 103, the authentication server 104, the credential information management servers 105 and 106, and the authentication terminal communication management module 107 are the same as those in the first embodiment.

[0145] The information processing device 101 and the authentication terminal 102 include a browser 310, an authentication client 1101, an authenticator 330, and an image processing unit 334. In addition to the functions described in the first embodiment, the authentication client 1101 has a function of sending a credential resend request to the authentication terminal 102, which is the communication destination, when credential registration fails.

[0146] <Credential registration process> The credential registration process will be described with reference to Fig. 14 and Fig. 15. In this embodiment, if a communication error occurs between the authentication server 104 and the information processing device 101 during registration, a sequence will be described in which the authentication terminal 102 transmits (resends) a registration response and continues the registration process. In this sequence, in the credential registration continuation process, the authentication terminal 102 resends the registration response for the credential information, and the credential information is synchronized, whereby the credential information is registered in the second credential information management server 106.

[0147] 14 and 15 are sequence diagrams showing the processes of the information processing device 101, the authentication terminal 102, the application server 103, the authentication server 104, and the like in the credential registration process.

[0148] S1201 to S1218 are the same as S701 to S718 in the credential registration process of the first embodiment.

[0149] In S1219, the authentication terminal communications management module 107, the information processing device 101, the authentication terminal 102, and the authentication server 104 execute a credential registration continuation process. This process will be described later. By this process, the public key and signature associated with the credential information with the authentication information ID "10003" held in the credential information storage unit 332 of the authentication terminal 102 are resent to the authentication server 104, and the registration is successful in the authentication server 104.

[0150] In S1220, the authentication terminal communication management module 107, the information processing device 101, and the authentication terminal 102 execute a credential deletion process. This process is a process for deleting the corresponding credential information of the authentication terminal 102 in order to roll back if the credential registration by the authentication terminal 102 in S1219 fails. Details of this process will be described later.

[0151] S1221 and S1222 are the same as S720 and S721. Table L is an example of a credential information table managed by the credential information management unit 360 of the second credential information management server 106. This process indicates that the credential registration has been continued, and therefore the credential information registered in the authentication server 104 has been synchronized.

[0152] [Table L]

[0153] <Credential registration continuation process> The credential registration continuation process (S1219) will be described with reference to Figs. 16 to 20. In this process, if a communication error occurs between the authentication server 104 and the information processing device 101, the authentication terminal 102 transmits a registration response, and the authentication server 104 continues the credential registration. This process also cancels communication between the information processing device 101 and the authentication terminal 102 depending on the processing status of the authentication terminal 102. This process makes it possible to continue the credential registration process with the authentication server 104 by using the network of the registration destination terminal when communication between the registration source terminal and the authentication server 104 fails. This maintains the consistency of the credential information with the external authentication server 104, improving user convenience.

[0154] FIG. 16 is a flowchart showing the processing of the information processing device 101 in the credential registration continuation processing.

[0155] S1301 to S1304 are the same as S801 to S804 in the credential information rollback process of the first embodiment.

[0156] In S1305, the authentication client 1101 of the information processing device 101 transmits a confirmation request to the authentication terminal communication management module 107 to inquire whether the authentication terminal 102 satisfies the requirements for communication with the authentication server 104. An example of the confirmation request in this embodiment is as follows: 0:SSL3.0 1: AES-128 2:DH-2048 3:DES 4: HMAC-SHA1 5:SHA256

[0157] The information in each field indicates the algorithm to be used when communicating with the authentication server 104. Field 0 indicates the SSL version, field 1 indicates the server authentication algorithm, and field 2 indicates the key exchange algorithm. Field 3 indicates the symmetric key encryption algorithm to be used in data transfer, field 4 indicates the MAC algorithm to be used in data transfer, and field 5 indicates the compression algorithm. In this embodiment, this request is encoded in CBOR format, but it may also be in JSON format.

[0158] In S1306, the authentication client 1101 of the information processing device 101 confirms that it has received the confirmation result of the communication requirements sent from the authentication terminal 102, which has been sent from the authentication terminal communication management module 107. If it has been received, the process proceeds to S1308, and if not, the process proceeds to S1307. In S1307, the authentication client 1101 of the information processing device 101 waits for processing and then proceeds to S1306.

[0159] In S1308, when the authentication client 1101 of the information processing device 101 receives the confirmation result of the communication requirements, the authentication client 1101 confirms whether the authentication client 1101 of the authentication terminal 102 satisfies the communication requirements with the authentication server 104. In this embodiment, an example of a response of the confirmation result sent from the authentication terminal 102 is as follows: 0: True

[0160] The information in each field indicates the result of confirmation as to whether the requirements of the algorithm used when communicating with the authentication server 104 are met. Field 0 indicates the result of confirmation, with True indicating that the requirements are met and False indicating that the requirements are not met. If field 0 of the response indicating the confirmation result is True, the authentication client 1101 of the information processing device 101 proceeds to S1309, and if it is False, the authentication client 1101 proceeds to S1315.

[0161] In S1309, the authentication client 1101 of the information processing device 101 transmits a request to resend the credential registration to the authentication server 104, that is, a request to resend the registration response, to the authentication terminal communication management module 107. This request includes at least the endpoint (URL) of the authentication server 104, a request header to the authentication server 104, a request body, and a common key and MAC key required for communication with the authentication server 104. The request body includes at least a public key linked to the credential information created by the authentication terminal 102, and a signature for the challenge from the authentication server 104.

[0162] In S1310, the authentication client 1101 of the information processing device 101 checks whether the credential registration result has been received from the authentication server 104 via the authentication terminal 102 (authentication terminal communication management module 107). If it has been received, the process proceeds to S1312; if not, the process proceeds to S1311. In S1311, the authentication client 1101 of the information processing device 101 waits for processing and then proceeds to S1310.

[0163] In S1312, the authentication client 1101 of the information processing apparatus 101 checks whether the credential registration has been successful. If the registration has been successful, the process proceeds to S1313, and if it has not been successful, the process proceeds to S1315.

[0164] In step S1313, the authentication client 1101 of the information processing device 101 transmits a request to the authentication terminal communication management module 107 to terminate communication with the authentication terminal 102.

[0165] In S1314, the authentication client 1101 of the information processing device 101 requests the browser 310 of the information processing device 101 to display a registration success screen. Fig. 21 shows an example of the registration success screen displayed on the browser 310 of the information processing device 101. At this time, the authentication client 1101 of the information processing device 101 sets a credential deletion flag, which is a flag used to determine whether to delete the credential, to False, and ends the process.

[0166] In step S1315, the authentication client 1101 of the information processing apparatus 101 sets the credential deletion flag to True, and ends this process. If the flag is True, the credential deletion process is executed. The credential deletion process will be described later.

[0167] FIG. 17 is a flowchart showing the processing of the authentication terminal communication management module 107 in the credential registration continuation processing.

[0168] When this process starts, in S1321, the session management unit 370 of the authentication terminal communication management module 107 checks whether a confirmation request for the authentication terminal 102 to confirm whether it satisfies the communication requirements with the authentication server 104 has been received from the information processing device 101. If it has been received, the process proceeds to S1323; if not, the process proceeds to S1322. In S1322, the session management unit 370 waits for processing, and then the process proceeds to S1321.

[0169] In S1323, session management unit 370 transmits a request to authentication terminal 102 to confirm requirements for communication with authentication server 104.

[0170] In S1324, the session management unit 370 checks whether a request to transmit the confirmation results of the communication requirements with the authentication server 104 to the information processing device 101 has been received from the authentication terminal 102. If received, the process proceeds to S1326, and if not, the process proceeds to S1325. In S1325, the session management unit 370 waits for processing and then proceeds to S1324.

[0171] In S1326 , the session management unit 370 transmits the result of checking the requirements for communication with the authentication server 104 to the information processing device 101 .

[0172] In S1327, the session management unit 370 checks whether a request to resend the credential registration to the authentication server 104, that is, a request to resend the registration response, has been received from the information processing device 101. If it has been received, the process proceeds to S1329; if not, the process proceeds to S1328. In S1328, the session management unit 370 waits for processing, and then the process proceeds to S1327.

[0173] In S1329, session management section 370 transmits a retransmission request of the registration response to authentication server 104 to authentication terminal 102.

[0174] In S1330, the session management unit 370 checks whether a request to transmit the credential registration result by resending the registration response to the information processing device 101 has been received from the authentication terminal 102. If it has been received, the process proceeds to S1332; if not, the process proceeds to S1331. In S1331, the session management unit 370 waits for processing, and then the process proceeds to S1330.

[0175] In S1332, the session management unit 370 transmits a credential registration result (for example, a notification that registration was successful) to the information processing device 101.

[0176] In S1333, the session management unit 370 checks whether a request to send a communication release request to the authentication terminal 102 has been received from the information processing device 101. If received, the process proceeds to S1335, and if not, the process proceeds to S1334. In S1334, the session management unit 370 waits for processing, and then proceeds to S1333.

[0177] In S1335, session management section 370 transmits a request to authentication terminal 102 to terminate communication with information processing device 101, and ends the process.

[0178] FIG. 18 is a flowchart showing the processing of the authentication terminal 102 in the credential registration continuation processing.

[0179] When this process starts, in S1341, the authentication client 1101 of the authentication terminal 102 checks whether a request to confirm communication requirements with the authentication terminal 102 has been received from the authentication terminal communication management module 107. If it has been received, the process proceeds to S1343, and if not, the process proceeds to S1342. In S1342, the authentication client 1101 of the authentication terminal 102 waits for processing and then proceeds to S1341.

[0180] In S1343, the authentication client 1101 of the authentication terminal 102 confirms the communication requirements requested by the information processing device 101, and transmits a request to the authentication terminal communication management module 107 to transmit the confirmation results to the information processing device 101. The response of the communication requirement confirmation results is described in the processing of S1308 in the information processing device 101.

[0181] In S1344, the authentication client 1101 of the authentication terminal 102 checks whether a request to resend the registration response to the authentication terminal 102 has been received from the authentication terminal communications management module 107. If it has been received, the process proceeds to S1346, and if not, the process proceeds to S1345. In S1345, the authentication client 1101 of the authentication terminal 102 waits for processing and proceeds to S1344.

[0182] In S1346, the authentication client 1101 of the authentication terminal 102 transmits a registration response to the authentication server 104. The registration response has been described in the process of S1309 in the information processing device 101.

[0183] In S1347, the authentication client 1101 of the authentication terminal 102 checks whether the credential registration result has been received from the application server 103. If it has been received, the process proceeds to S1349, and if not, the process proceeds to S1348. In S1348, the authentication client 1101 of the authentication terminal 102 waits for processing and proceeds to S1347.

[0184] In S1349, the authentication client 1101 of the authentication terminal 102 checks whether the credential registration was successful based on the response from the application server 103. If the registration was successful, the process proceeds to S1353, and if not, that is, if an error occurred, the process proceeds to S1350.

[0185] In S1350, the authentication client 1101 of the authentication terminal 102 checks whether the response received from the authentication server 104 is a retryable error. The process of determining whether the error is a retryable error is the same as the process of S802 in the credential information rollback process of the first embodiment. If a retry is possible, proceed to S1351; if not, proceed to S1353.

[0186] In S1351, the authentication client 1101 of the authentication terminal 102 checks whether the number of request attempts has exceeded the upper limit of retries. In this embodiment, the upper limit of the number of retry attempts is set to 5. If the upper limit has been exceeded, the process proceeds to S1353; if not, the process proceeds to S1352. In S1352, the authentication client 1101 of the authentication terminal 102 retransmits the registration response to the authentication server 104.

[0187] In S1353, the authentication client 1101 of the authentication terminal 102 transmits a request to the authentication terminal communication management module 107 to transmit the credential registration result received from the authentication server 104 to the information processing device 101.

[0188] In S1354, the authentication client 1101 of the authentication terminal 102 checks whether a request to terminate communication with the information processing device 101 has been received from the authentication terminal communication management module 107. If it has been received, the process proceeds to S1356, and if not, the process proceeds to S1355. In S1355, the authentication client 1101 of the authentication terminal 102 waits for processing and proceeds to S1354.

[0189] In S1356, the authentication client 1101 of the authentication terminal 102 terminates communication with the information processing device 101, and the process ends.

[0190] FIG. 19 is a flowchart showing the processing of the authentication server 104 in the credential registration continuation processing.

[0191] When this process starts, in S1361, the authentication request management unit 350 of the authentication server 104 receives a registration response for the credential information from the authentication terminal 102.

[0192] In S1362, the authentication request management unit 350 of the authentication server 104 performs credential signature verification based on the signature and public key included in the acquired registration response.

[0193] In S1363, the authentication request management unit 350 of the authentication server 104 checks whether the credential signature verification was successful. If successful, the process proceeds to S1364, and if not, the process proceeds to S1365.

[0194] In S1364, authentication server 104 requests public key management unit 351 to register the public key. Public key management unit 351 registers the public key. Table M is an example of a public key table managed by public key management unit 351.

[0195] [Table M]

[0196] In S1365, the authentication request management unit 350 of the authentication server 104 transmits the credential registration result to the application server 103, and the process ends.

[0197] FIG. 20 is a flowchart showing the processing of the application server 103 in the credential registration continuation processing.

[0198] When this process starts, in S1371, the credential registration processing unit 341 of the application server 103 receives a request to send the credential registration result from the authentication server 104.

[0199] In S1372, the credential registration processing unit 341 transmits the credential registration result to the authentication terminal 102, and the process ends.

[0200] This process allows the credential information to be successfully registered in the authentication server 104, as shown in Table M.

[0201] <Credential deletion process> The credential deletion process for deleting credential information will be described with reference to Figures 22 to 24. This process is a process (credential deletion process) for deleting credential information from the authentication terminal 102 when the credential registration continuation process has failed.

[0202] FIG. 22 is a flowchart showing the processing of the information processing device 101 in the credential deletion processing.

[0203] When this process starts, in S1501, the authentication client 1101 of the information processing apparatus 101 determines whether the credential deletion flag is True. If it is True, the process proceeds to S1502, and if it is False, the process ends.

[0204] Steps S1502 to S1507 are the same as the credential registration rollback process steps S805 to S810 in the first embodiment.

[0205] 23 is a flowchart showing the credential deletion process performed by the authentication terminal communication management module 107. The process steps S1511 to S1519 are the same as the credential registration rollback process steps S821 to S829 of the first embodiment shown in FIG.

[0206] 24 is a flowchart showing the credential deletion process performed by the authentication terminal 102. The process steps S1521 to S1527 are the same as the credential registration rollback process steps S831 to S837 of the first embodiment shown in FIG.

[0207] As described above, according to this embodiment, taking into consideration that the information processing device 101 and the authentication terminal 102 often use different networks to connect to the authentication server 104, it is possible to continue the credential registration process from the authentication terminal 102 to the authentication server 104. This maintains the consistency of the credential information with the authentication server 104, and improves user convenience. Furthermore, even if this credential registration continuation process fails, the credential information is deleted from the authentication terminal 102, so as in the first embodiment above, consistency of the credential information with the authentication server 104 is maintained, thereby improving user convenience.

[0208] [Other embodiments] The predetermined error detected before the registration of the public key to the server is completed is not limited to a communication error between the information processing device 101 and the authentication server 104, as in the above embodiment. For example, a processing error in the information processing device 101 or a processing error (or system failure) in the authentication server 104 may also be considered.

[0209] The processes of, for example, S704 to S707 in the first embodiment (FIG. 7) are one example of a method for a user to select the use of an external terminal (for example, the authentication terminal 102). However, the selection method is not limited to the method using a QR code. Any method may be used as long as the operation for establishing communication with the information processing device 101 is performed by the user on the information processing device 101 and / or the authentication terminal 102.

[0210] The authentication terminal 102 is not limited to a smartphone, but may be a tablet device, a smartwatch, or other PC or electronic device. The information processing device 101 is also not limited to a PC, but may be other electronic devices such as a smartphone or a tablet device.

[0211] The disclosure of this embodiment includes the following configuration, method, and program. (Configuration 1) a receiving means for receiving a first request for registering credential information from a service that manages a public key used for verifying a signature related to user authentication; a sending means for sending a second request for creating the credential information to the external terminal based on a user's selection regarding the use of the external terminal; When a predetermined error is detected before the external terminal completes registration of the public key created based on the second request to the service, the sending means sends a third request to the external terminal to delete the credential information. 1. An information processing device comprising: (Configuration 2) the information processing device transmits to the service a signature and the public key generated by the external terminal using the verification data received from the service and a private key that forms a pair with the public key; The signature is verified by the service, and the registration of the public key is completed. 2. The information processing device according to configuration 1, (Configuration 3) The credential information is transmitted from the external terminal to a credential information management server different from the service. 3. The information processing device according to configuration 1 or 2. (Configuration 4) The information processing device further includes a display means for displaying a QR code to be read by the external terminal when establishing communication between the information processing device and the external terminal for use of the external terminal. 4. The information processing device according to any one of configurations 1 to 3. (Configuration 5) If the external terminal that receives the second request successfully authenticates the user, the external terminal generates a pair of the public key and a private key, and creates the credential information using the private key. 5. The information processing device according to any one of configurations 1 to 4. (Configuration 6) The transmitting means transmits a fourth request to the external terminal to continue the registration process of the public key for the service before transmitting the third request. 6. The information processing device according to any one of configurations 1 to 5. (Configuration 7) The transmitting means transmits the fourth request for the service when the external terminal satisfies a communication requirement for communicating with the service. 7. The information processing device according to configuration 6. (Configuration 8) A terminal device capable of communicating with an information processing device, a receiving means for receiving a request for creating credential information from the information processing device; a first generating means for generating a private key and a public key based on receiving a request for generating the credential information; a second generating means for generating the credential information using the private key; a transmitting means for transmitting the generated public key to the information processing device; a deletion means for deleting the credential information based on reception of a request for deleting the credential information from the information processing device. A terminal device characterized by: (Configuration 9) The credential information management server further includes a synchronization unit for transmitting the credential information to a credential information management server that is different from the service that manages the public key. 9. The information processing device according to configuration 8. (Configuration 10) When the credential information is deleted, the synchronization means transmits information indicating that the credential information has been deleted to the credential information management server. 10. The information processing device according to configuration 9. (Configuration 11) The deletion means deletes the credential information based on a request for deletion of the credential information transmitted from the information processing device based on a predetermined error being detected in the information processing device before registration of the created public key with a service that manages public keys is completed. 11. The terminal device according to any one of configurations 8 to 10. (Configuration 12) further comprising a biometric authentication means for performing biometric authentication of a user; The first generating means generates a private key and a public key if the biometric authentication is successful. 12. The terminal device according to any one of configurations 8 to 11. (Configuration 13) When the transmitting means receives a request from the information processing device regarding continuation of registration processing of the created public key to a service that manages public keys before receiving a request to delete the credential information, the transmitting means transmits a request to register the created public key to the service. 13. The terminal device according to any one of configurations 8 to 12. (Method 1) a receiving step of receiving a first request for registering credential information from a service that manages a public key used for verifying a signature related to user authentication; a first sending step of sending a second request for creating the credential information to the external terminal based on a user's selection regarding the use of the external terminal; a second sending step of sending a third request for deleting the credential information to the external terminal when a predetermined error is detected before the external terminal completes registration of the public key created based on the second request to the service. A method for an information processing device. (Method 2) A method in a terminal device capable of communicating with an information processing device, comprising: a receiving step of receiving a request for creating credential information from the information processing device; a first generation step of generating a private key and a public key based on receiving a request for generating the credential information; a second creation step of creating the credential information using the private key; a transmitting step of transmitting the generated public key to the information processing device; a deletion step of deleting the credential information based on reception of a request to delete the credential information from the information processing device. 10. A method in a terminal device, comprising: (program) A program that causes a computer to execute the above method 1 or 2.

[0212] The present disclosure has been described in detail above based on preferred embodiments thereof, but the present disclosure is not limited to the above embodiments, and various modifications are possible based on the gist of the present disclosure, and these modifications are not excluded from the scope of the present disclosure.

Claims

1. a receiving means for receiving a first request for registering credential information from a service that manages a public key used for verifying a signature related to user authentication; a transmitting means for transmitting a second request for creating the credential information to the external terminal based on a user's selection regarding the use of the external terminal; If a predetermined error is detected before the external terminal completes registration of the public key created based on the second request to the service, the sending means sends a third request to the external terminal to delete the credential information.

1. An information processing device comprising:

2. the information processing device transmits to the service a signature and the public key generated by the external terminal using the verification data received from the service and a private key that forms a pair with the public key; The signature is verified by the service, and the registration of the public key is completed.

2. The information processing apparatus according to claim 1, wherein:

3. The credential information is transmitted from the external terminal to a credential information management server different from the service.

2. The information processing apparatus according to claim 1, wherein:

4. The information processing device further includes a display means for displaying a QR code to be read by the external terminal when establishing communication between the information processing device and the external terminal for use of the external terminal.

2. The information processing apparatus according to claim 1, wherein:

5. If the biometric authentication of the user is successful in the external terminal that receives the second request, a pair of the public key and a private key is generated, and the credential information is created using the private key.

2. The information processing apparatus according to claim 1, wherein:

6. The transmitting means transmits a fourth request to the external terminal to continue the registration process of the public key for the service before transmitting the third request.

2. The information processing apparatus according to claim 1, wherein:

7. The transmitting means transmits the fourth request for the service when the external terminal satisfies a communication requirement for communicating with the service.

7. The information processing apparatus according to claim 6,

8. A terminal device capable of communicating with an information processing device, a receiving means for receiving a request for creating credential information from the information processing device; a first generating means for generating a private key and a public key based on receiving a request for generating the credential information; a second generating means for generating the credential information using the private key; a transmitting means for transmitting the generated public key to the information processing device; a deletion means for deleting the credential information based on reception of a request for deleting the credential information from the information processing device. A terminal device characterized by:

9. The credential information management server further includes a synchronization unit for transmitting the credential information to a credential information management server that is different from the service that manages the public key.

9. The terminal device according to claim 8.

10. When the credential information is deleted, the synchronization means transmits information indicating that the credential information has been deleted to the credential information management server.

10. The terminal device according to claim 9.

11. The deletion means deletes the credential information based on a request for deletion of the credential information transmitted from the information processing device based on a predetermined error being detected in the information processing device before registration of the created public key with a service that manages public keys is completed.

9. The terminal device according to claim 8.

12. further comprising a biometric authentication means for performing biometric authentication of a user; The first generating means generates a private key and a public key if the biometric authentication is successful.

9. The terminal device according to claim 8.

13. When the transmitting means receives a request from the information processing device regarding continuation of registration processing of the created public key to a service that manages public keys before receiving a request to delete the credential information, the transmitting means transmits a request to register the created public key to the service.

9. The terminal device according to claim 8.

14. a receiving step of receiving a first request for registering credential information from a service that manages a public key used for verifying a signature related to user authentication; a first sending step of sending a second request for creating the credential information to the external terminal based on a user's selection regarding the use of the external terminal; a second sending step of sending a third request for deleting the credential information to the external terminal if a predetermined error is detected before the external terminal completes registration of the public key created based on the second request to the service. A method for an information processing device.

15. A method in a terminal device capable of communicating with an information processing device, comprising: a receiving step of receiving a request for creating credential information from the information processing device; a first generation step of generating a private key and a public key based on receiving a request for generating the credential information; a second creation step of creating the credential information using the private key; a transmitting step of transmitting the generated public key to the information processing device; a deletion step of deleting the credential information based on reception of a request to delete the credential information from the information processing device.

10. A method in a terminal device, comprising:

16. A program causing a computer to execute the method according to claim 14 or 15.

Images