Risk-based authentication system and risk-based authentication method

Abstract

To provide a risk-based authentication system and a risk-based authentication method capable of reducing the processing time of risk evaluation and the resource consumption of a system used for performing the risk evaluation.SOLUTION: A risk-based authentication system includes an information processing device which performs the evaluation on the risk of access to a resource by a client terminal and performs processing according to an evaluation result. The information processing device performs the risk score calculation by a rist determination method at each execution stage, calculates a stage risk score at the execution stage unit based on the risk score, and performs the risk evaluation for evaluating the risk of access based on the calculated stage risk score, stepwise so as to shift to the next execution stage in an ascending order of the execution stage and only in a predetermined case.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a risk-based authentication system and a risk-based authentication method. [Background technology]

[0002] The IT environment has undergone significant change in recent years. The use of cloud services has steadily increased, with 64.7% of companies using cloud services at least partially in 2019. Furthermore, with the rapid spread of working from home (WFH) due to COVID-19, companies have rapidly adopted teleworking, with nearly 60% of companies planning to do so in the future. In addition to these changes in IT usage patterns, attacks targeting corporate information are also evolving. Cyberattacks, particularly advanced persistent threats (APTs), differ from traditional threats in that they are stealthy and persistent over long periods of time, making it impossible to detect or prevent malware from infiltrating corporate networks. Furthermore, since the most common route for the leak of corporate trade secrets is through internal perpetrators, simply preventing external attacks is not enough to prevent information leaks.

[0003] In this climate, risk-based authentication is attracting increasing attention. Risk-based authentication is a method of more reliable identity authentication and access control by calculating the risk level of user access using records such as user access logs and dynamically changing authentication methods and access permissions according to the risk level.

[0004] For example, if a user accesses a cloud service from another country immediately after accessing it from Japan, it is possible to determine that there is a high risk of spoofing and perform additional authentication, thereby preventing unauthorized access. Access control can also be considered, depending on the status of the user and the client device they use, for example, to prevent access to important resources in teleworking. Furthermore, issuing a warning when access behavior differs from the user's usual behavior pattern can serve as a countermeasure against insider theft.

[0005] As such, risk-based authentication has been attracting attention due to recent changes in the IT environment. However, although risk-based authentication recommends correlative analysis of various information such as user behavior and device status, the input information and analysis method have not been established.

[0006] Background art that solves this problem is found in Patent Document 1. Patent Document 1 states that "in a risk-based authentication system, by changing the risk level evaluation result based on risk level information obtained from the Internet from outside and changing the decision level for performing additional authentication, it is possible to realize more flexible risk-based authentication." [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Japanese Patent Application Publication No. 2019-191657 Summary of the Invention [Problem to be solved by the invention]

[0008] The technology described in Patent Document 1 performs risk-based authentication based on risk level information on the Internet obtained from external sources in addition to rule analysis and behavior analysis, which allows for more flexible and accurate risk-based authentication. However, since multiple risk assessment methods are all implemented during authentication and authorization, the processing time for risk assessment and the resource consumption of the system used to perform the risk assessment increase.

[0009] The present invention has been made to address the above-mentioned problems, and an object of the present invention is to provide a risk-based authentication system and a risk-based authentication method that can reduce the processing time for risk assessment and the amount of resource consumption of the system used to perform the risk assessment. [Means for solving the problem]

[0010] In order to solve the above problem, the risk-based authentication system of the present invention includes an information processing device that evaluates the risk of access to a resource by a client terminal and performs processing according to the evaluation result, wherein the information processing device is configured to perform risk score calculation to calculate the risk score using risk calculation data, which is information necessary to calculate a risk score indicating a risk level, using each of a plurality of risk assessment methods, and the information processing device is configured to be able to set, for each of the plurality of risk assessment methods, an execution stage for gradually setting the order in which the risk score calculations are performed using the risk assessment methods, and the information processing device is configured to calculate the risk score by performing the risk score calculation using the risk assessment method for each of the execution stages, calculate a stage risk score for each of the execution stages by integrating the calculated risk scores, and perform a risk evaluation to evaluate the risk of the access based on the calculated stage risk score in a stepwise manner, starting from the smallest execution stage and transitioning to the next execution stage only in specified cases.

[0011] The risk-based authentication method of the present invention uses an information processing device that evaluates the risk of access to a resource by a client terminal and performs processing according to the evaluation results, and uses risk calculation data, which is information necessary to calculate a risk score indicating a risk level, to perform a risk score calculation using each of a plurality of risk assessment methods, and is able to set execution stages for each of the plurality of risk assessment methods to gradually set the order in which the risk score calculations are performed using the risk assessment methods.The risk score is calculated by performing the risk score calculation using the risk assessment method on an execution stage basis, and the calculated risk scores are integrated to calculate a stage risk score for each execution stage.A risk assessment that evaluates the risk of the access based on the calculated stage risk score is performed in stages, starting from the smallest execution stage and transitioning to the next execution stage only in specified cases. [Effects of the Invention]

[0012] According to the present invention, it is possible to reduce the processing time for risk assessment and the amount of resource consumption of the system used to perform the risk assessment. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing an entire system including a risk-based authentication system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing details of a risk determination device included in the risk-based authentication system. [Figure 3] FIG. 3 is a diagram showing an example of the risk assessment means table. [Figure 4] FIG. 4 is a diagram showing an example of the threshold value table. [Figure 5] FIG. 5 is a diagram showing an example of the risk determination result log table. [Figure 6] FIG. 6 is a UML sequence diagram showing an overview of the processing of a system having a risk-based authentication system. [Figure 7] FIG. 7 is a flowchart showing the process flow of the risk calculation data update process. [Figure 8] FIG. 8 is a flowchart showing the processing flow of the risk determination process. [Figure 9] FIG. 9 is a flowchart showing the processing flow of the parameter update process. [Figure 10] FIG. 10 is a diagram showing an example of the rejection screen. [Figure 11] FIG. 11 is a diagram showing an example of a client terminal risk display screen. DETAILED DESCRIPTION OF THE INVENTION

[0014] <<Embodiment>> Hereinafter, an embodiment of the present invention will be described with reference to Figures 1 to 11. In this embodiment, the same components are generally designated by the same reference numerals, and repeated description will be omitted. It should be noted that this embodiment is merely an example for realizing the present invention and does not limit the technical scope of the present invention. In the following embodiment, the risk assessment process will be described as an example in which the function is realized by a computer executing software, but it may also be realized by hardware logic.

[0015] In the following description, various types of information may be described using expressions such as "table," but the various types of information may also be expressed using data structures other than these. Furthermore, when describing identification information, expressions such as "ID," "code," and "identification information" are used, but these are interchangeable. Furthermore, in the following description, processing may be described using a functional block as the subject, but the subject of the processing may be the CPU instead of the functional block.

[0016] The program may be installed into a computer (information processing device) from a program source. The program source may be, for example, a program distribution server or a storage medium (portable storage medium) readable by the computer (information processing device). In an embodiment, two or more programs may be realized as one program, or one program may be realized as two or more programs.

[0017] The present invention relates to a system that uses multiple risk assessment means (risk determination methods) to assess the risk of access by a client terminal to resources such as a server. Furthermore, the present invention relates to a technology for optimizing the processing time required for risk assessment, the accuracy of risk assessment, and the resource consumption of a database, a risk management assessment system, and a client terminal related to risk assessment processing in this system. Furthermore, the present invention relates to a technology for varying the weight of each risk assessment means, whether or not and the order in which the risk assessment means are implemented, the update frequency of risk calculation data created for risk assessment, and the collection period of log data required to create risk calculation data in order to optimize these resource consumptions.

[0018] First, a system configuration including a risk-based authentication system 1 according to an embodiment of the present invention will be described with reference to Fig. 1. The system includes a client terminal 101 that a user uses in various environments such as a telework environment, an office in one's own country, or an overseas office, resources 102 that exist in various environments such as a cloud environment, an office in one's own country, or an overseas office and that the user accesses using the client terminal 101, the risk-based authentication system 1, and a log management device 105, all of which are connected via a network 106. The network 106 may be, for example, a wired local area network (LAN) or a wireless LAN, or may be a global network such as the Internet.

[0019] The risk-based authentication system 1 includes an authentication device 103 and a risk assessment device 104. The authentication device 103 is a device that authenticates the client terminal 101 and the user using the client terminal 101 each time the client terminal 101 accesses the resource 102. For example, authentication may be performed each time the client terminal 101 sends a request to the server that owns the resource 102. Another example of the frequency of authentication is that authentication may not be performed multiple times for accesses within a certain period, such as from login to logout. During authentication, the authentication device 103 inquires of the risk assessment device 104 about the risk level (magnitude of risk) of the access, and imposes appropriate authentication and access control on the user depending on the result (i.e., the authentication device 103 dynamically changes the authentication level imposed on the user depending on the risk level). The log management device 105 stores information required for the risk assessment device 104 to calculate the risk level (risk score indicating the risk level).

[0020] In FIG. 1, as an example, the client terminal 101 exists in three places: a telework environment, an office in the home country, and an overseas office. Note that the client terminal 101 may exist in other environments. Similarly, the resources 102 exist in three places: a cloud environment, an office in the home country, and an overseas office. The resources 102 may exist in other environments. Also, although the log management device 105 shows three places, A to C, there is no set number.

[0021] Next, the risk assessment device 104 will be described with reference to Fig. 2. The risk assessment device 104 is realized by a general information processing device such as a PC (Personal Computer) or a server as shown in Fig. 2, and includes a communication interface (communication IF) 111, a CPU (Central Processing Unit) 112, a main memory 113, a storage device 114, and a communication path 115 connecting these respective components. The communication path 115 is, for example, an information transmission medium such as a bus or a cable. The risk assessment device 104 may be realized by a plurality of information processing devices. The information processing device may be a virtual information processing device constructed on the cloud.

[0022] The main memory 113 is, for example, a semiconductor storage device such as a RAM (Random Access Memory), and temporarily stores programs that are loaded from the storage device 114 and executed by the CPU 112, as well as necessary work data.

[0023] The CPU 112 executes a program stored in the main memory 113 .

[0024] The storage device 114 is, for example, a large-capacity magnetic storage device or semiconductor storage device such as a hard disk drive (HDD) or a solid state drive (SSD), and stores programs executed by the CPU 112 and data used by the CPU 112.

[0025] In this embodiment, the CPU 112 loads into the main memory 113 the risk calculation data creation unit 121, the data collection unit 122, the risk determination unit 123, the parameter update unit 124, and the display unit 125 as programs. The CPU 112 executes these programs loaded into the main memory 113, thereby realizing the functions of the risk calculation data creation unit 121, the data collection unit 122, the risk determination unit 123, the parameter update unit 124, and the display unit 125.

[0026] The risk calculation data creation unit 121 is a program that creates and updates risk calculation data 133 required to calculate a risk score based on log data collected from the log management device 105 using the data collection unit 122, as described below.

[0027] The data collection unit 122 is a program that provides a unified interface that eliminates differences depending on the type of log management device 105 when the risk calculation data creation unit 121 collects log data from one or more types of log management device 105.

[0028] The risk determination unit 123 is a program that calculates a risk score using a risk determination means table 131, a threshold value table 132, and risk calculation data 133, which will be described later.

[0029] The parameter update unit 124 is a program that updates the settings of a risk assessment means table 131 and a threshold value table 132, which will be described later, using a risk assessment result log table 134, which will be described later.

[0030] The display unit 125 is a program that displays a screen, which will be described later, and processes inputs to the screen.

[0031] The storage device 114 also stores a risk assessment means table 131, a threshold value table 132, risk calculation data 133, and a risk assessment result log table 134. Details of each table will be described later.

[0032] The authentication device 103 is also realized by a general information processing device such as a PC (Personal Computer) or a server. The authentication device 103 may also be realized by a plurality of information processing devices. Furthermore, the authentication device 103 and the risk assessment device 104 may be realized by a single information processing device. The information processing device may be a virtual information processing device constructed on the cloud.

[0033] Next, the data structure used in the risk-based authentication system 1 according to this embodiment will be described with reference to FIGS.

[0034] First, an example of a risk assessment means table will be described with reference to Fig. 3. The risk assessment means table 131 is a table that records information that defines one or more risk assessment means (also referred to as "risk assessment information" or "risk assessment method") that the risk assessment device 104 (risk assessment unit 123) uses to calculate a risk score. In this table, information that defines the risk assessment methods is stored in association with each other.

[0035] An entry in the risk assessment means table 131 has fields for ID 301, risk assessment means 302, type 303, weight 304, stage 305, risk calculation data update frequency 306, usage log acquisition period 307, and real-timeness 308. ID 301 stores a code for uniquely identifying a record within the table. Risk assessment means 302 stores the name of the risk assessment means. Type 303 stores one of the values ​​"behavior" and "state," which are the types of risk assessment means. "Behavior" is a means (method) of creating a baseline based on past data and assessing risk based on the deviation from the baseline. For example, the greater the deviation, the higher the risk score calculated. On the other hand, state is a means (method) of assessing risk based on the current or most recent state. For example, a risk score may be calculated based on whether the current or most recent state differs from a specified state, or the degree to which the current or most recent state differs from a specified state (e.g., the degree to which there are signs of an attack on the device).

[0036] The weight 304 stores the weight used when the risk assessment device 104 integrates the risk scores calculated by each risk assessment means (risk assessment method) and calculates the stage risk score.

[0037] The stage 305 stores the stage at which the risk assessment means (risk assessment method) is executed. As shown in the risk assessment process S604 described later, the risk assessment device 104 calculates the risk score for each stage in order from the result of the risk assessment means (risk assessment method) with the smallest value stored in the stage. In other words, the stage is information for gradually setting the order in which the risk score calculation by the risk assessment means (risk assessment method) is performed for each stage. The stage is also called an "execution stage," and each stage unit is also called an "execution stage unit."

[0038] The risk calculation data update frequency 306 stores setting information on the frequency with which the risk assessment means (risk assessment method) updates the risk calculation data 133 used for risk score calculation. For example, if the risk calculation data update frequency 306 is one day, log data is collected from the log management device 105 once a day, and the risk calculation data 133 is updated. Specific processing will be described later in the risk calculation data update processing flowchart of FIG. 7.

[0039] In addition, risk calculation data 133 is data (including machine learning models) necessary to calculate (compute) a risk score, and means, for example, something simple such as the percentage of web browsers used by a user, generated from the access log stored in the log management device 105, or a machine learning model generated from the access log to distinguish between general users and insiders.

[0040] The usage log acquisition period 307 stores a setting value that determines how much log data from before the current date and time is to be collected from the log management device 105 when updating the risk calculation data 133. If the value is large, it becomes possible to calculate a risk score based on information going back further in time, but since a large amount of logs is collected from the log management device 105, the resource consumption, network consumption, and log data collection time of the log management device 105 increase. If the type 303 is behavior, logs for the entire period are required, so the value is the same as the risk calculation data update frequency 306.

[0041] On the other hand, when the type 303 is "state," the usage log acquisition period 307 is set to a value equal to or smaller than the risk calculation data update frequency 306. This is because collecting logs for a period longer than the risk calculation data update frequency 306 results in duplicate logs being collected. The real-timeness 308 stores a setting value that determines how recent data needs to be used when calculating a risk score using the risk assessment means (risk assessment method). That is, the real-timeness 308 stores a time (value) for specifying the real-timeness of the risk calculation data 133 required by the risk assessment method (risk assessment means) when the risk assessment unit 123 calculates the risk score. For information that does not fluctuate much over a short period of time, such as access log trends, the period (time) of the real-timeness 308 may be lengthened. Conversely, for information that requires real-time detection, such as traces of an attack that appear on a user terminal, the period (time) of the real-timeness 308 may be shortened. This value is set to a value equal to or smaller than the risk calculation data update frequency 306. This is because, if the value is set to be larger than the risk calculation data update frequency 306, no matter what value is set, the processing result will not change in the procedure (processing) of step 804 described below from when the value is set to be the same as the risk calculation data update frequency 306. Also, the set value may be set differently for each client terminal 101. In this case, some client terminals 101 may not implement some risk assessment means (risk assessment methods).

[0042] Next, an example of the threshold value table will be described with reference to Fig. 4. The threshold value table 132 is a table that stores tiered threshold values ​​(which may be referred to as "threshold scores" for convenience) that are used to determine how to perform access control as a result of executing, on a stage-by-stage basis, the risk assessment means 302 (risk assessment method) for which the stage is set, and integrating the results.

[0043] An entry in the threshold table 132 has fields for ID 401, stage 402, threshold 403, and judgment result 404. The ID 401 stores identification information (code) for uniquely identifying a record within the table. The stage 402 stores a stage number to which the threshold 403 is applied. The threshold 403 stores a threshold for determining the judgment result 404. This threshold can also be said to be a threshold used to evaluate the risk level (access risk) based on the stage risk score. The judgment result 404 stores an access control process to be executed when the risk score (stage risk score) obtained by integrating the results of all risk judgment means (risk judgment methods) for each stage 402 exceeds the threshold 403.

[0044] The weight 304, stage 305, risk calculation data update frequency 306, usage log acquisition period 307, and threshold 403 may be set in advance by the administrator, or may be updated by the administrator.

[0045] Furthermore, the weight 304, stage 305, risk calculation data update frequency 306, usage log acquisition period 307, and threshold 403 may be set or updated by machine learning. In this case, for example, access patterns that should be detected and access patterns that should not be detected are prepared. Risk determination is performed using these, and information including the results is stored in the risk determination result log table 134, which will be described in detail later. Then, based on the information in the risk determination result log table 134, at least one of the weight 304, stage 305, risk calculation data update frequency 306, usage log acquisition period 307, and threshold 403 is mechanically set (updated) by machine learning such as a genetic algorithm so as to optimize at least one of the risk determination processing time, determination accuracy, and resource consumption. Optimization here refers to determining setting values ​​for the weight 304, stage 305, risk calculation data update frequency 306, usage log acquisition period 307, and threshold 403 such that there are no setting values ​​that can simultaneously improve all three indicators of risk determination processing time, determination accuracy, and resource consumption. It is not possible to optimize all three indicators—risk assessment processing time, assessment accuracy, and resource consumption—and they are in a trade-off relationship. For example, minimizing the risk assessment processing time can be achieved by shortening the value of the risk calculation data update frequency 306, thereby suppressing the occurrence of the risk calculation data update process (step 805) in the risk assessment process S604 (described later). However, in this case, the risk calculation data update process is executed more frequently, resulting in increased resource consumption. Alternatively, it is possible to reduce the number of risk assessment processes executed by, for example, setting stage 305 to reduce the number of risk assessment methods executed in the early stages and setting threshold 403 to make it difficult to transition to the next stage. However, in this case, reducing the number of risk assessment methods executed results in a deterioration of risk assessment accuracy. The same is true for other indicators: improving one indicator will result in a deterioration of the other indicators. Therefore, there will be multiple optimal values. In other words, optimization here refers to calculating Pareto-optimal solutions using a multi-objective optimization algorithm.

[0046] Next, an example of a risk assessment result log table will be described using Fig. 5. The risk assessment result log table 134 is a table that records the results of risk assessment. An entry in the risk assessment result log table 134 has fields for ID 501, date and time 502, client terminal identifier 503, risk assessment means 504, whether risk calculation data has been updated 505, processing time 506, resource consumption amount 507, risk score 508, and stage 509.

[0047] ID 501 stores identification information (code) for uniquely identifying a record within a table. Date and time 502 stores the date and time when risk determination was performed. Client terminal identifier 503 stores an identifier that uniquely identifies the client terminal 101 on which risk determination was performed. Risk determination means 504 stores the executed risk determination means (risk determination method). Risk calculation data update status 505 stores information on whether or not an update process for risk calculation data 133 occurred in the risk determination process described later in FIG. 8. Processing time 506 stores the processing time required from the execution of the risk determination means until the risk score is calculated. Resource consumption amount 507 stores the amount of resources consumed when calculating the risk score. The amount of resource consumption may store individual items such as network communication volume, database, risk authentication system, CPU of client terminal 101, memory, etc., or may store an index that combines these items. Risk score 508 stores the risk score obtained as a result of executing the risk determination means (risk determination method). The stage 509 stores the stage at which the risk assessment means (risk assessment method) was executed.

[0048] Next, the processing of the risk-based authentication system 1 will be described with reference to Fig. 6 to Fig. 8. First, an overview of the processing of the risk-based authentication system 1 will be described with reference to Fig. 6.

[0049] When the client terminal 101 accesses the resource 102, it makes an access request to the authentication device 103 (S601). At that time, the authentication device 103 identifies the client terminal 101 or the user who uses the client terminal 101 by some method. Examples of the identification method include a combination of a user ID and a password, or a method using a client certificate held by the client terminal 101. The authentication device 103 queries the risk assessment device 104 about the risk of access by the client terminal 101 (S602).

[0050] Next, the risk assessment device 104 performs a risk assessment process (S604) which will be described later in Fig. 8. Next, the risk assessment device 104 responds to the authentication device 103 with the risk assessment result obtained in the risk assessment process S604 (S608). Based on the risk assessment result received from the risk assessment device 104, the authentication device 103 responds to the client terminal 101 as to whether or not the client terminal 101 is allowed to access the resource 102 (S609).

[0051] The subsequent processing changes depending on the result of whether or not access is permitted received by the client terminal 101. If the result of whether or not access is permitted is access permitted (S611), the client terminal 101 accesses the resource 102 (S612). If the result of whether or not access is permitted is additional authentication (S613), the client terminal 101 sends information for identifying the client terminal 101 and its user to the authentication device 103 (S614). The authentication device 103 verifies the received identification information and responds with the result of the additional authentication to the client terminal 101 (S615). If the result of whether or not access is permitted is access denied (S616), a screen indicating that access has been denied is displayed on the screen of the client terminal 101, and the processing ends (S617).

[0052] The subsequent processing changes depending on the result of the additional authentication received by the client terminal 101. If the result of the additional authentication is access permission (S619), the client terminal 101 accesses the resource 102 (S620). If the result of the additional authentication is access denial (S621), a screen indicating that access has been denied is displayed on the screen of the client terminal 101, and the processing ends (S622).

[0053] Next, the risk calculation data advance update process will be described with reference to Fig. 7. Fig. 7 is a flowchart showing the process flow of the risk calculation data update process executed by the risk calculation data creation unit 121. By this update process, the calculation data for each client terminal 101 of each risk assessment method is updated at a predetermined update frequency.

[0054] The risk calculation data creation unit 121 starts processing from step 700, proceeds to step 701 which is the start point of loop 1 processing, selects an unselected risk determination means from the risk determination means stored in the risk determination means table 131, and starts executing loop 1 processing from step 701 to step 707. This loop 1 processing is repeatedly executed until the end condition of loop 1 processing is met (loop 1 processing is executed for all risk determination means stored in the risk determination means table 131).

[0055] The risk calculation data creation unit 121 proceeds to step 702, which is the start point of loop 2 processing, and starts executing loop 2 processing from step 702 to step 706 for client terminals 101 for which loop 2 processing of the selected risk assessment means has not yet been executed. This loop 2 processing is repeatedly executed until the end condition of loop 2 processing (loop 2 processing is executed for all client terminals 101) is met.

[0056] The risk calculation data creating unit 121 proceeds to step 703 and acquires the update frequency data (risk calculation data update frequency) for the selected risk assessment means stored in the risk assessment means table 131.

[0057] Next, the risk calculation data creation unit 121 proceeds to step 704 and determines whether the value (time) obtained by subtracting the "risk calculation data update date and time" from the "current date and time" is smaller than the "risk calculation data update frequency" acquired in step 703. The "risk calculation data update date and time" is the date and time when the risk calculation data update process of step 705 described later was last performed (the date and time when the most recent risk calculation data update process was performed, with the time of step 704 as the base point).

[0058] If the value obtained by subtracting the "risk calculation data update date and time" from the "current date and time" is smaller than the "risk calculation data update frequency", the risk calculation data creation unit 121 judges "Yes" in step 704 and proceeds to step 706, which is the end point of loop 2 processing.

[0059] On the other hand, if the value obtained by subtracting the "risk calculation data update date and time" from the "current date and time" is equal to or greater than the "risk calculation data update frequency," the risk calculation data creation unit 121 determines "No" in step 704 and proceeds to step 705, where it collects logs from the log management device 105 and updates the risk calculation data. Thereafter, the risk calculation data creation unit 121 proceeds to step 706, which is the end point of loop 2 processing.

[0060] If the termination condition of the loop 2 processing (the loop 2 processing is executed for all the client terminals 101) is not satisfied at step 706, which is the end point of the loop 2 processing, the risk calculation data creation unit 121 returns to step 702, which is the start point of the loop 2 processing. When returning to step 702, the risk calculation data creation unit 121 starts executing the loop 2 processing for the client terminals 101 that have not yet executed the loop 2 processing.

[0061] On the other hand, if the termination condition of the loop 2 processing (loop 2 processing is executed for all client terminals 101) is met at step 706, which is the end point of the loop 2 processing, the risk calculation data creation unit 121 terminates the loop 2 processing and proceeds to step 707, which is the end point of the loop 1 processing.

[0062] If the termination condition for loop 1 processing (loop 1 processing is executed for all risk assessment means stored in the risk assessment means table 131) is not satisfied at step 707, which is the end point of loop 1 processing, the risk calculation data creation unit 121 returns to step 701, which is the start point of loop 1 processing. When returning to step 701, the risk calculation data creation unit 121 selects an unselected risk assessment means that has not yet been selected, and starts executing loop 1 processing again.

[0063] On the other hand, if the termination condition of the loop 1 processing (loop 1 processing is executed for all risk assessment means stored in the risk assessment means table 131) is met at step 707, which is the end point of the loop 1 processing, the risk calculation data creation unit 121 terminates the loop 1 processing, proceeds to step 795, and temporarily terminates this processing flow.

[0064] Next, the risk determination process will be described in detail with reference to Fig. 8. Fig. 8 is a flowchart showing the process flow of the risk determination process executed by the risk determination unit 123. This process corresponds to S604 in Fig. 6.

[0065] The risk assessment unit 123 starts processing from step 800 and proceeds to step 801, where it acquires request information from the authentication device 103. Thereafter, the risk assessment unit 123 proceeds to step 802, which is the start point of loop 1 processing, selects a stage in ascending order, and starts executing loop 1 processing from step 802 to step 811. This loop 1 processing is repeatedly executed until the end condition of loop 1 processing is met (loop 1 processing is executed for all stages of stage 305 in the risk assessment means table 131).

[0066] Thereafter, the risk determination unit 123 proceeds to the start point of the loop 2 process in step 803, and starts executing the loop 2 process from step 803 to step 807. This loop 2 process is repeatedly executed until the end condition of the loop 2 process (the loop 2 process is executed for all risk determination means that match the stage selected in the loop 1 process) is met.

[0067] The risk determination unit 123 proceeds to step 804 and determines whether the value (time (i.e., the time elapsed since the update date and time)) obtained by subtracting the "risk calculation data update date and time" from the "current date and time" is smaller than the value of real-timeness 308. The risk calculation data update date and time is the date and time when the risk calculation data update process (step 805) described below was last performed (the date and time when the most recent risk calculation data update process was performed, with the time of step 804 as the base point).

[0068] If the value obtained by subtracting the "risk calculation data update date and time" from the "current date and time" is equal to or greater than the value of real-timeness 308, the risk determination unit 123 determines "No" in step 804 and proceeds to step 805, where it collects logs from the log management device 105 and updates the risk calculation data 133. The risk determination unit 123 calculates a risk score using the risk calculation data 133 updated in step 805.

[0069] On the other hand, if the value obtained by subtracting the "risk calculation data update date and time" from the "current date and time" is smaller than the value of real-timeness 308, the risk assessment unit 123 judges "Yes" in step 804 and proceeds to step 806, where it calculates a risk score based on the existing created risk calculation data 133 without updating the risk calculation data 133.

[0070] Thereafter, the risk determination unit 123 proceeds to step 807, which is the end point of the loop 2 processing. If the termination condition of the loop 2 processing (loop 2 processing is executed for all determination means that match the stage selected in the loop 1 processing) is not satisfied at step 807, which is the end point of the loop 2 processing, the process returns to step 803, which is the start point of the loop 2 processing. When the risk determination unit 123 returns to step 803, which is the start point of the loop 2 processing, it selects an unselected risk determination means that has not yet been selected, and starts executing the loop 2 processing again.

[0071] At step 807, which is the end point of loop 2 processing, if the termination condition of loop 2 processing (loop 2 processing is executed for all determination means that match the stage selected in loop 1 processing) is met, the risk determination unit 123 ends loop 2 processing and proceeds to step 808, where it integrates all risk scores within the same stage calculated in loop 2 processing using weight 304 (for example, sums up values ​​obtained by multiplying the risk score by weight 304) to calculate a stage risk score. At this time, the risk determination unit 123 may also calculate the stage risk score using the stage risk score of the previous stage.

[0072] Thereafter, the risk determination unit 123 proceeds to step 809 , compares the stage risk score calculated in step 808 with the threshold value 403 (that is, evaluates the risk of access), determines the determination result 404 , and proceeds to step 810 .

[0073] When the risk determination unit 123 proceeds to step 810, it determines whether or not the determination result 404 is "advance to the next stage."

[0074] If the determination result 404 is "proceed to the next stage", the risk determination unit 123 determines "Yes" in step 810 and proceeds to step 811, which is the end point of the loop 1 processing. If the termination condition of the loop 1 processing (loop 1 processing is executed for all stages of stage 305 in the risk determination means table 131) is not met in step 811, which is the end point of the loop 1 processing, the risk determination unit 123 returns to step 802, which is the start point of the loop 1 processing, and executes loop 2 processing for the risk determination means of the next stage.

[0075] If the termination condition for loop 1 processing is met at step 811, which is the end point of loop 1 processing, the risk determination unit 123 ends loop 1 processing and proceeds to step 812, where it calculates an integrated risk score by integrating the stage-level risk scores (stage risk scores) for each stage. The integrated risk score is, for example, the average value of the stage risk scores. Thereafter, the risk determination unit 123 proceeds to step 813, where it transmits the determination result to the authentication device 103.

[0076] If the judgment result 404 is not "Proceed to the next stage" in step 810, the risk judgment unit 123 judges "No" in step 810 and proceeds directly to step 812, executes the process of step 812 described above, and then proceeds to step 813, where the judgment result is transmitted to the authentication device 103. In this example, the stages and risk assessment means are executed sequentially, but they may also be executed in parallel.

[0077] Next, the parameter update processing of the risk assessment means table 131 and the threshold table 132 will be described with reference to Fig. 9. Fig. 9 is a flowchart showing the processing flow of the parameter update processing executed by the parameter update unit 124. The parameter update unit 124 executes this processing flow when an administrator issues a command to start the update processing at any timing desired by the administrator. The parameter update unit 124 starts processing from step 900 and executes the processing of steps 901 to 905 described below, and then proceeds to step 995 to temporarily end this processing flow.

[0078] Step 901: The parameter update unit 124 acquires the risk assessment means table 131, the threshold value table 132, and the assessment result log table 134.

[0079] Step 902: The parameter update unit 124 outputs information necessary for analysis, including the risk assessment means table 131, the threshold value table 132, and the assessment result log table 134, to a terminal (not shown) of the administrator of the risk assessment device 104, to allow the administrator to analyze the risk assessment means table 131, the threshold value table 132, and the assessment result log table 134. The administrator performs analysis based on the information output to the terminal, and inputs information for changing the parameters to desired parameters into the risk assessment device 104 via the terminal (input device).

[0080] Step 903 : The parameter update unit 124 updates the parameters (at least one parameter) of the risk assessment means table 131 and the threshold value table 132 based on the information input in step 902 .

[0081] Step 904: The parameter update unit 124 calculates the values ​​of the indices (risk assessment processing time, assessment accuracy, and resource consumption) based on the information input in step 902.

[0082] Step 905: If the value of each index calculated in step 904 "satisfies the termination condition," the process judges "Yes" and proceeds to step 995, temporarily terminating this processing flow. On the other hand, if the value does not "satisfy the termination condition," the process judges "No" and repeats the processing from step 902. The termination condition here refers to, for example, when the value of each index becomes better than a target value set by the administrator.

[0083] Although the parameter update process described above is performed based on information input by the administrator, the parameter update unit 124 may be configured to automatically (automatically) perform automatic and periodic analysis and parameter update using machine learning (e.g., AI learning, etc.). In this case, the parameters (at least one parameter) of the risk assessment means table 131 and the threshold value table 132 may be updated mechanically so that a Pareto-optimal solution is calculated for at least one of the risk assessment processing time, assessment accuracy, and resource consumption (or at least one of the risk assessment processing time and resource consumption).

[0084] Next, the refusal display screen will be described with reference to Fig. 10. The refusal screen 1001 is a screen that is displayed when access to the resource 102 is refused. The refusal screen 1001 is, for example, a GUI screen that constitutes a GUI (Graphical User Interface) and is displayed on a display device (not shown) provided in the client terminal 101. The user operates the GUI via an input device such as a mouse or keyboard connected to the client terminal 101.

[0085] As shown in FIG. 10, the refusal screen 1001 includes a refusal message display area 1002 and a risk calculation data update button 1003. The refusal message display area 1002 is an area for displaying a message indicating that the connection has been refused. The main reason for the refusal may be written (displayed) as a message in this area (the refusal message display area 1002). This makes it easier for the user to take corrective action to reduce risk (to resolve the connection refusal). On the other hand, to prevent attackers or insiders from exploiting the main reason for the refusal to gain access permission, it may be possible to only display the fact that the connection has been refused, as in the example of FIG. 10.

[0086] The risk calculation data update button 1003 is a button for requesting an update of the risk calculation data to the risk determination unit 123. By using (operating) this button, the risk calculation data 133 is updated, and the user can have the details of the risk reduction measures taken reflected in the risk assessment immediately.

[0087] Next, the client terminal risk display screen will be described with reference to Fig. 11. The client terminal risk screen 1101 is a screen that displays the access risk status of a specific client terminal 101. The client terminal risk screen 1101 is a screen that is displayed, for example, on a display device (not shown) connected to the risk determination device 104. As shown in Fig. 11, the client terminal risk screen 1101 includes a risk score transition display area 1102 and a risk assessment result display area 1103.

[0088] The risk score transition display area 1102 includes information (a graph in this example) showing the time transition of the risk score when a resource is accessed. The risk assessment result display area 1103 is an area for displaying information showing details of the risk judgment result when a resource is accessed.

[0089] <Effects> As described above, the risk-based authentication system 1 according to an embodiment of the present invention calculates a risk score using a risk assessment method for each stage, calculates a stage risk score for each stage based on the risk scores, and evaluates the risk of access for each stage based on the calculated stage risk scores. This risk assessment is performed in stages, starting from the lowest execution stage and transitioning to the next execution stage only in predetermined cases. This allows the risk-based authentication system 1 according to an embodiment of the present invention to reduce the processing time for risk assessment and the resource consumption of the system used to perform the risk assessment. Furthermore, the risk-based authentication system 1 according to an embodiment of the present invention is configured to variably set parameters defining multiple risk assessment methods. This allows the risk-based authentication system 1 according to an embodiment to set multiple risk assessment methods so as to optimize at least one of the risk assessment accuracy, processing speed, and resource consumption required for risk assessment in risk-based authentication. Furthermore, the risk-based authentication system 1 according to an embodiment performs risk assessment using multiple risk assessment methods set to optimize at least one of the risk assessment accuracy, processing speed, and resource consumption required for risk assessment in risk-based authentication, thereby optimizing at least one of the processing speed and resource consumption required for risk assessment in risk-based authentication.

[0090] <<Modifications>> The present invention is not limited to the above-described embodiment, and various modifications can be adopted within the scope of the present invention. For example, in the above-described embodiment, the number of stages is not limited to two, and may be three or more. [Explanation of symbols]

[0091] 1...risk-based authentication system, 101...client terminal, 102...resource, 103...authentication device, 104...risk assessment device, 105...log management device, 106...network, 121...risk calculation data creation unit, 122...data collection unit, 123...risk assessment unit, 124...parameter update unit, 125...display unit, 131...risk assessment means table, 132...threshold value table, 133...risk calculation data, 134...risk assessment result log table

Claims

1. A risk-based authentication system including an information processing device that evaluates a risk of access to a resource by a client terminal and performs processing according to a result of the evaluation, The information processing device includes: a risk score calculation is performed to calculate a risk score indicating a risk level using risk calculation data, which is information necessary for calculating the risk score by each of a plurality of risk determination methods; The information processing device includes: An execution stage for setting a stepwise order of performing the risk score calculation by the risk assessment method can be set for each of the plurality of risk assessment methods, The information processing device includes: a risk assessment that calculates the risk score by performing the risk score calculation using the risk assessment method for each execution stage, calculates a stage risk score for each execution stage by integrating the calculated risk scores, and evaluates the risk of the access based on the calculated stage risk scores; The execution stage is performed in stages, starting from the smallest execution stage and transitioning to the next execution stage only in predetermined cases. It was configured as follows: Risk-based authentication system.

2. 10. The risk-based authentication system of claim 1, The information processing device includes: Only when it is required to proceed to the risk assessment for the execution step unit of the next execution stage based on the evaluation result of the risk assessment for the execution step unit, proceed to the risk assessment for the execution step unit of the next execution stage; It was configured as follows: Risk-based authentication system.

3. 10. The risk-based authentication system of claim 1, a storage device capable of storing data; The information processing device includes: acquiring log information of the client terminal accessing the resource, generating the risk calculation data based on the acquired log information, and storing the data in the storage device; It is configured as follows: The information processing device includes: a frequency at which the risk calculation data is updated can be set for each of the plurality of risk assessment methods; generating the risk calculation data at the set frequency, and updating the risk calculation data stored in the storage device with the generated risk calculation data; It was configured as follows: Risk-based authentication system.

4. 4. The risk-based authentication system of claim 3, The storage device stores parameters for defining each of the plurality of risk assessment methods, The information processing device includes: Calculating the risk score by the risk assessment method according to the parameters; It was configured as follows: Risk-based authentication system.

5. 5. The risk-based authentication system of claim 4, The storage device stores a plurality of threshold scores for each execution step unit, The information processing device includes: performing the risk assessment by comparing the calculated stage risk score with a plurality of the threshold scores; It was configured as follows: Risk-based authentication system.

6. 6. The risk-based authentication system of claim 5, The storage device stores log information of risk assessment results relating to the risk assessment method executed in the past, The information processing device includes: Using the risk assessment result log information, calculate at least one of the parameters and the threshold score so as to calculate a Pareto-optimal solution in terms of at least one of the accuracy of the risk assessment, the processing speed of the risk score calculation by the risk assessment method, and the resource consumption of the system used to calculate the risk score, and update at least one of the parameters and the threshold score. It was configured as follows: Risk-based authentication system.

7. 6. The risk-based authentication system of claim 5, an input device for inputting information to the information processing device; The information processing device includes: configured to modify at least one of the parameters and the threshold score based on information input via the input device; Risk-based authentication system.

8. 5. The risk-based authentication system of claim 4, The storage device stores, as the parameters, a stage indicating the execution stage, a weight for calculating the stage risk score, a risk calculation data update frequency, a period for acquiring the log information, and a time for specifying the real-time nature of the risk calculation data. Risk-based authentication system.

9. 9. The risk-based authentication system of claim 8, The information processing device includes: Before calculating the risk score, the time elapsed since the most recent update date and time of the risk calculation data is calculated; If the elapsed time is equal to or greater than the time for specifying the real-time nature of the risk calculation data, the risk calculation data is updated, and the risk score is calculated using the updated risk calculation data. It was configured as follows: Risk-based authentication system.

10. 10. The risk-based authentication system of claim 1, a display device capable of displaying a GUI screen; The information processing device includes: If access to the resource is denied based on the risk assessment for each execution stage, displaying information indicating that access to the resource has been denied and an operation button on the GUI screen; When the operation button is operated, the risk calculation data is updated. It was configured as follows: Risk-based authentication system.

11. A risk-based authentication method using an information processing device that evaluates a risk of access to a resource by a client terminal and performs processing according to a result of the evaluation, By the information processing device, performing a risk score calculation for calculating the risk score by each of a plurality of risk assessment methods using risk calculation data, which is information necessary to calculate the risk score indicating the risk level; An execution stage for setting a stepwise order of performing the risk score calculation by the risk assessment method can be set for each of the plurality of risk assessment methods; a risk assessment that calculates the risk score by performing the risk score calculation using the risk assessment method for each execution stage, calculates a stage risk score for each execution stage by integrating the calculated risk scores, and evaluates the risk of the access based on the calculated stage risk scores; The execution stage is performed in stages, starting from the smallest execution stage and transitioning to the next execution stage only in predetermined cases. Risk-based authentication methods.

Images