Authentication integration device, authentication integration program, and authentication integration method

Abstract

The present invention provides an authentication integration device that supports multiple authentication methods and can handle authentication judgment output results corresponding to each authentication method. [Solution] An authentication integration device connected to an authentication execution device that executes multiple authentication methods, comprising: an authentication method determination unit that receives a user authentication request from a user's terminal, determines the authentication method based on the authentication method ID included in the user authentication request, and requests user authentication information corresponding to the authentication method from the user's terminal; an authentication execution request unit that receives user authentication information from the user's terminal, extracts pre-stored authentication execution request information according to the authentication method based on the user ID included in the user authentication information, and transmits the authentication method and authentication execution request information to the authentication execution device to request authentication execution; an authentication execution result receiving unit that receives authentication execution result information corresponding to the authentication method from the authentication execution device; and an authentication determination unit that determines whether authentication is successful or unsuccessful based on the authentication execution result information.

Description

Technical Field

[0001] The present disclosure relates to an authentication integration device, an authentication integration program, and an authentication integration method, and particularly relates to the authentication of a user's terminal and the user connected via a network connection.

Background Art

[0002] It is known to ensure security by rejecting access to requests from terminals without access rights for terminals such as personal computers, smartphones, and tablets that access a target site via a network. For example, in the authentication system of Patent Document 1, in authentication using a combination of authentication methods, from the authentication method that guarantees the strongest security (``password authentication'' and ``terminal authentication'' and ``mobile terminal authentication'') to the most convenient authentication method (only ``password authentication''), a technique for ensuring security by providing optimal security for a wide range of environments is disclosed.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Normally, in order to enhance security, since the preferred authentication method varies depending on the use case and the user environment, it is necessary to provide an authentication device that combines multiple authentication methods. However, in the prior art, in the four authentication methods of "password authentication", "terminal authentication", "mobile terminal authentication", and "device authentication", only authentication OK (○ mark) and authentication NG judgments are accepted, and there is a problem that authentication judgment results other than the ○ mark, such as the probability value of identity verification, cannot be accepted.

[0005] This disclosure was made in view of the above-mentioned issues, and aims to provide an authentication integration device that has multiple authentication methods and can handle authentication judgment output results corresponding to each authentication method. [Means for solving the problem]

[0006] The authentication integration device relating to this disclosure is an authentication integration device connected to an authentication execution device that executes multiple authentication methods, and comprises: an authentication method determination unit that receives a user authentication request from a user's terminal, determines the authentication method based on the authentication method ID included in the user authentication request, and requests user authentication information corresponding to the authentication method from the user's terminal; an authentication execution request unit that receives user authentication information from the user's terminal, extracts pre-stored authentication execution request information according to the authentication method based on the user ID included in the user authentication information, and transmits the authentication method and the authentication execution request information to the authentication execution device to request authentication execution; an authentication execution result receiving unit that receives authentication execution result information corresponding to the authentication method from the authentication execution device; and an authentication determination unit that determines whether authentication is successful or unsuccessful based on the authentication execution result information received by the authentication execution result receiving unit. [Effects of the Invention]

[0007] This disclosure provides an authentication integration device connected to an authentication execution device that performs multiple authentication methods, which receives authentication execution result information corresponding to the requested authentication method from the authentication execution device based on a user authentication request received from the user's terminal, and determines whether the authentication was successful or failed. [Brief explanation of the drawing]

[0008] [Figure 1] A diagram illustrating the system configuration according to Embodiment 1. [Figure 2] Functional configuration diagram of the device according to Embodiment 1. [Figure 3] Hardware configuration diagram of the device according to Embodiment 1. [Figure 4] An example of user authentication management data for the device according to Embodiment 1. [Figure 5] Authentication process flow diagram of the integrated authentication device according to Embodiment 1. [Figure 6] A flowchart of the telephone call authentication process for the integrated authentication device according to Embodiment 1. [Figure 7] A flowchart of the lifestyle habit authentication process of the integrated authentication device according to Embodiment 1. [Figure 8] A diagram illustrating the system configuration according to Embodiment 2. [Figure 9] Functional configuration diagram of the device according to Embodiment 2. [Figure 10] Authentication process flow diagram of the integrated authentication device according to Embodiment 2. [Modes for carrying out the invention]

[0009] [Embodiment 1] Embodiment 1 will be described below.

[0010] ***Configuration of Embodiment 1*** Figure 1 is a diagram showing the schematic configuration of the authentication integration system 1 according to Embodiment 1. This authentication integration system 1 consists of an authentication integration device 10, an authentication execution device 20, an authentication utilization service device 30, and a user terminal 40. The authentication integration device 10 communicates with the authentication execution device 20, the authentication service utilization device 30, and the user terminal 40 via network 2. Network 2 can be a LAN or the Internet, for example. LAN stands for Local Area Network. The authentication integration device 10, authentication execution device 20, authentication utilization service device 30, and user terminal 40 are devices that identify and execute the instructed process. Specific examples include computers such as servers. The user terminal 40 is a device such as a personal computer, smartphone, or tablet.

[0011] FIG. 2 is a block diagram showing a configuration example of the authentication integration device 10. The authentication integration device 10 includes a storage unit 11, a communication unit 12, an authentication method determination unit 13, an authentication execution request unit 14, an authentication execution result reception unit 15, an authentication determination unit 16, and an authentication control unit 17. User authentication management data 111 is stored in the storage unit 11. With these configurations, the authentication integration device 10 receives, from an authentication execution device, authentication execution result information corresponding to a requested authentication method based on a user authentication request received from a user's terminal, and provides an authentication integration device that determines whether authentication is successful or failed.

[0012] Hereinafter, each configuration of the authentication integration device 10 will be described. The communication unit 12 is connected to the network 2 and performs various communications necessary for user authentication.The communication unit 12 receives a user authentication request and information related to user authentication information from the user terminal 40, and also transmits the result of the user authentication request, which has been determined by the authentication determination unit 16 as to whether authentication is successful or not, to the user terminal 40. The communication unit 12 requests the authentication execution device 20 to execute user authentication, and receives the authentication execution result information requested for authentication execution from the authentication execution device 20.

[0013] Specifically, the user authentication request can be configured, for example, in the form of a URL, and is referred to as an authentication request URL. Also, in the user authentication execution request, for example, it can be configured with an API (Application Programming Interface) endpoint, and the authentication execution can be requested from the authentication execution device 20 in the form of a URL. The API endpoint requested from the authentication execution device 20 is referred to as an authentication execution endpoint.

[0014] The authentication method determination unit 13 obtains an authentication method ID from the user authentication request received from the user terminal 40, determines the authentication method requested from the user terminal 40, and requests the user terminal 40 for user authentication information corresponding to the authentication method.

[0015] When the authentication execution request unit 14 receives user authentication information from the user terminal 40, it obtains the user ID included in the user authentication information, and identifies the user based on the obtained user ID. Further, when the user is identified, based on the user ID, the authentication execution request information required for authentication is obtained from the user authentication management data 111. The authentication method and the authentication execution request information are transmitted to the authentication execution device 20, and the authentication execution request unit 14 requests authentication execution.

[0016] The authentication execution result receiving unit 15 receives authentication execution result information corresponding to the authentication method from the authentication execution device 20. The authentication execution result information is different for the first authentication method and the second authentication method. The authentication execution result information will be described later.

[0017] The authentication determination unit 16 determines whether authentication is successful or failed according to each authentication method, and transmits authentication completion information including the determined authentication result to the user terminal 40. <000010I>

[0018] Here, the authentication method determined by the authentication method determination unit 13 will be described. The authentication methods include a first authentication method and a second authentication method. The first authentication method is an authentication method in which user authentication execution is requested from the authentication execution device 20, and authentication success or failure is determined from the authentication execution result information including information with or without verification of whether the user is the actual person. The second authentication method is an authentication method in which user authentication execution is requested from the authentication execution device 20, and authentication success or failure is determined from the authentication execution result information including a probability value calculated based on the degree of matching with the behavior history pattern in the user's living habits. Further, it is not limited thereto, and an authentication method in which a numerical value such as a probability value is calculated for personal authentication is included.

[0019] Examples of the first authentication method include call authentication, user certificate authentication, and password authentication.

[0020] [[ID=I4]][Call Authentication] For telephone call authentication, the system refers to the user authentication management data 111 to identify the phone number of the user who made the user authentication request, notifies the user terminal 40 of the authentication phone number, determines whether or not an incoming call was made from the user terminal 40 to the authentication phone number, and if an incoming call is made, authentication is considered successful.

[0021] [User Certificate Authentication] User certificate authentication refers to the user authentication management data 111, decrypts the encrypted user certificate on the user terminal 40 using the decryption key, and determines whether the user certificate has been tampered with. User certificate authentication methods include, for example, PKI (Public Key Infrastructure) authentication and IC (Integrated Circuit) card authentication.

[0022] [Password Authentication] Password authentication involves referring to the user authentication management data 111 and comparing the user ID and password obtained from the information received from the user terminal 40 with the user ID and password stored in the user authentication management data 111 to determine if a match is made.

[0023] The second authentication method includes, for example, lifestyle-based authentication. [Lifestyle Certification] Lifestyle authentication analyzes the behavioral history patterns of a user's lifestyle, captured by sensors, to identify their unique characteristics and use that information to authenticate them. Authentication is considered successful if the probability of matching the behavioral history patterns of that person's unique lifestyle is greater than a threshold value that determines the success of authentication.

[0024] Furthermore, the system may be configured to execute a third authentication method that determines whether or not it is permissible to request authentication execution from the authentication execution device 20 in order to execute the first or second authentication method. The third authentication method may be, for example, user certificate authentication or password authentication. If authentication is successful using the third authentication method, the system requests the authentication execution device 20 to perform authentication; if authentication fails, the system does not request the authentication execution device 20 to perform authentication.

[0025] The authentication control unit 17 controls the authentication process according to the authentication control settings corresponding to each authentication method that have been set in advance. Specifically, the system receives a user authentication request from the user terminal 40, and once the authentication method is determined, it controls the process of sending a user authentication screen to the user terminal 40, sending an authentication execution request corresponding to the authentication method to the authentication execution device 20, and sending authentication completion information, including the authentication result, to the user terminal 40, according to the pre-configured authentication control settings.

[0026] Specifically, authentication control settings refer to the settings that the authentication control unit 17 uses to control the authentication method requested by an unauthenticated user when an unauthenticated user accesses a service site provided by the authentication service device 30.

[0027] For example, the authentication method ID "auth1" for the telephone call authentication method is configured by the administrator in advance to send a URL to the user authentication screen where the user enters authentication information to the user terminal 40 when a user authentication request is received, and to notify the user terminal 40 of the authentication completion result when the user authentication process is completed. The same applies to the authentication method ID "auth2" for the lifestyle authentication method.

[0028] Here, the authentication execution device 20 is an information processing device that executes multiple authentication methods corresponding to the authentication integration device 10. When the authentication execution device 20 receives an authentication execution request from the authentication integration device 10, it executes authentication processing according to the authentication method and transmits the result of the authentication execution to the authentication integration device 10. Although not shown in the figure, the authentication execution device 20 includes a storage unit, a communication unit, and an authentication execution unit.

[0029] The authentication service device 30 is an information processing device that provides a service site. The site provided by the authentication service device 30 requires user authentication to ensure security when a user makes a payment, etc. The authentication service device 30, although not shown in the diagram, includes a communication unit, a storage unit, a site provision unit, an authentication request unit, and a user information management unit.

[0030] Specifically, a service site refers to a website, such as an e-commerce site or an online securities trading site, that is displayed on a browser installed on a user's device 40, such as a personal computer, smartphone, or tablet.

[0031] The user terminal 40, although not shown in the diagram, includes a communication unit, an operation receiving unit, and a display unit. Furthermore, when performing authentication using the telephone call authentication method, it also includes a telephone call unit capable of making telephone calls.

[0032] The authentication integration device 10, authentication execution device 20, authentication utilization service device 30, and user terminal 40, as configured above, are each composed of a computer equipped with a processor 51, memory 52, and signal input / output unit 53, as shown in Figure 3. The functions of the storage unit 11, communication unit 12, authentication method determination unit 13, authentication execution request unit 14, authentication execution result receiving unit 15, authentication determination unit 16, and authentication control unit 17 of the authentication integration device 10 are realized by this computer. Specifically, the computer's memory 52 stores programs for realizing the functions of the communication unit 12, authentication method determination unit 13, authentication execution request unit 14, authentication execution result receiving unit 15, authentication determination unit 16, and authentication control unit 17. In addition, various information stored in the storage unit 11 is stored in the memory 52. ​​The processor 51 performs calculation processing related to the functions of the authentication integration device 10 based on the programs stored in the memory 52.

[0033] Figure 4 shows an example of the data structure diagram for user authentication management data 111. User authentication management data 111 is the authentication data required to verify that the user who requested user authentication is indeed the legitimate user. User authentication management data 111 includes user ID, password, user certificate decryption key, telephone number, and lifestyle ID. The user authentication management data 111 consists of information that the user has registered in advance on the user registration screen of the service site, which is necessary for user authentication. This information is stored in the storage unit 11 as user authentication management data 111. The user certificate decryption key is used to decrypt the user certificate encrypted on the user terminal 40. The lifestyle ID is a unique ID required for lifestyle authentication.

[0034] ***Operation of Embodiment 1*** Figure 5 is a flowchart of the authentication process of the authentication integration device 10. The operation of the authentication integration device 10 will be explained using this flowchart.

[0035] The operation procedure of the authentication integration device 10 according to Embodiment 1 corresponds to the authentication integration method according to Embodiment 1. Furthermore, the program that realizes the operation of the authentication integration device 10 according to Embodiment 1 corresponds to the authentication integration program according to Embodiment 1.

[0036] First, the user accesses the service site from the user terminal 40 (step S101). Specifically, access to the service site refers to initial access to the service site, as well as access required for identity verification processes such as purchasing goods or conducting online securities transactions.

[0037] When the authentication service device 30 receives an access request to the service site from the user terminal 40, it requests user authentication from the user terminal 40 (step S102).

[0038] When the user terminal 40 receives a user authentication request from the authentication service device 30, it requests user authentication from the authentication integration device 10 (step S103). At this time, the user terminal 40 may automatically forward (redirect) the user authentication request to the authentication integration device 10.

[0039] The authentication method determination unit 13 of the authentication integration device 10 receives a user authentication request from the user terminal 40 through the communication unit 12 (step S104).

[0040] The authentication method determination unit 13 obtains an authentication method ID from the user authentication request and determines the authentication method requested by the user terminal 40 from among the multiple authentication methods of the authentication integration device 10 (step S105).

[0041] For example, when a user accesses the service site "tenantname.example / service01" from user terminal 40, the authentication service device 30 providing the service site receives the access request from user terminal 40 and sends the authentication request URL "tenantname.example / service01 / auth1 / login" to user terminal 40. User terminal 40 receives the authentication request URL from the authentication service device 30 and automatically forwards (redirects) the authentication request URL to the authentication integration device 10. The authentication method determination unit 13 of the authentication integration device 10 receives the authentication request URL "tenantname.example / service01 / auth1 / login" from user terminal 40. The authentication method determination unit 13 obtains "auth1" from the received authentication request URL "tenantname.example / service01 / auth1 / login". It determines that the authentication method for which the authentication method ID is "auth1" is "telephone call authentication". The authentication request URL may be structured in a format that includes a URL parameter containing the authentication method ID, or the authentication method ID may be obtained from the URL parameter.

[0042] The authentication method determination unit 13 requests user authentication information from the user terminal 40 via the communication unit 12 in order to execute the third authentication method (step S106). Specifically, the authentication control settings send a user authentication screen URL corresponding to the appropriate authentication method to the user terminal 40, and user authentication information is requested.

[0043] The user terminal 40 displays the user authentication screen requested by the authentication integration device 10 (step S107).

[0044] The user terminal 40 transmits the user authentication information entered by the user on the user authentication screen to the authentication integration device 10 (step S108). Specifically, the user authentication screen displays input fields for the user ID and password, as well as an authentication button requesting authentication. When the user enters their user ID and password and clicks the authentication button, user authentication information, including the user ID and password entered on the screen, is sent to the authentication integration device 10. Furthermore, if the user ID is stored in the memory of the user terminal 40, for example, when a user authentication information request is received, the user identification information including the user ID stored in the user terminal 40 may be sent as the user authentication information.

[0045] Furthermore, if the third authentication method is user certificate authentication, the authentication integration device 10 may be configured to notify the user terminal 40 to request user authentication information including the user certificate, and the user terminal 40 may be configured to transmit user authentication information including the user ID and user certificate to the authentication integration device 10.

[0046] The communication unit 12 of the authentication integration device 10 receives user authentication information, and the authentication execution request unit 14 obtains user identification information from the user authentication information. Then, it identifies the user requesting authentication from the user identification information (step S109). Specifically, the user identification information consists of a user ID and password. The authentication execution request unit 14 checks whether a user matching the user ID and password obtained from the user authentication information is registered in the user authentication management data 111. If a user matching the user is registered in the user authentication management data 111 (YES), it is determined that authentication has been performed using the third authentication method, and the process proceeds to the next step S110. If no user matching the user authentication management data 111 is registered (NO), it is determined that authentication failed using the third authentication method, and the process proceeds to step S113.

[0047] The authentication execution request unit 14 obtains the authentication execution request information necessary for the user authentication request from the user authentication management data 111 based on the user ID obtained in step S109. Then, an authentication execution request, including the authentication method and authentication execution request information, is sent via the communication unit 12 to the authentication execution endpoint of the authentication method, requesting the authentication execution device 20 to perform authentication (step S110). The authentication execution endpoint of the authentication execution device 20 is, for example, a Web API. When it determines that the authentication method is the telephone outgoing authentication method, it requests the execution of telephone outgoing authentication from the Web API "server / endpoint / authTel / ", which executes the telephone outgoing authentication method.

[0048] The authentication execution device 20 receives an authentication execution request, performs user authentication using the specified authentication method, and transmits the authentication execution result information to the authentication integration device 10 (step S111). If the specified authentication method is the first authentication method, the authentication execution result information will include either "verification successful" (OK) or "verification unsuccessful" (NG), which is another result. If the specified authentication method is the second authentication method, the authentication execution result will include an action probability value.

[0049] The authentication execution result receiving unit 15 of the authentication integration device 10 receives authentication execution result information, which is the result of the authentication execution request, from the authentication execution device 20 via the communication unit 12 (step S112). Specifically, in the case of the first authentication method, the authentication execution result receiving unit 15 receives authentication execution result information that includes information indicating authentication OK or NG from the authentication execution result information. In the case of the second authentication method, authentication execution result information is received that includes a numerical value for the action probability value from the authentication execution result information.

[0050] In the case of the first authentication method, the authentication determination unit 16 determines that authentication is successful if the authentication execution result information obtained in step S112 includes information indicating authentication OK. In the case of the second authentication method, it determines that authentication is successful if the action probability value is greater than the determination threshold which is the criterion for determining that the user is indeed the user. It also determines that anything other than authentication success is authentication failure and notifies the user terminal 40 of authentication completion information, including authentication success or authentication failure (step S113). If, in step S109, it is determined that authentication was not performed using the third authentication method and no request is made to the authentication execution device 20 to perform authentication, then in step S113, the authentication determination unit 16 determines that authentication has failed and notifies the user terminal 40 of the authentication completion information, including the authentication failure.

[0051] User terminal 40 receives authentication completion information and receives the authentication result (step S114).

[0052] The authentication service device 30 receives authentication completion information from the user terminal 40 and receives the authentication result (step S115). At this time, the authentication integration device 10 may automatically transfer (redirect) the authentication completion information to the service site of the authentication service device 30 via the user terminal 40.

[0053] Furthermore, when the service site provided by the authentication service device 30 receives information that authentication was successful, it requests the authorization device (not shown) to issue an authentication token, and the authorization device issues an authentication token. This allows the authentication service device 30 to achieve single sign-on for the user terminal 40.

[0054] Figure 6 shows the authentication flow for the first authentication method. As an example of the first authentication method, Figure 6 uses the authentication flow of telephone call authentication to explain the operation. The process shown in Figure 6 is a processing flow that begins from step S201, when the authentication integration device 10 receives a user authentication request. The process in which the authentication integration device 10 sends the user authentication request is the same as in steps S101-102 and is therefore omitted. Note that the authentication processing flow shown in Figure 6 is a specific processing flow that occurs when the first authentication method is determined in step S105 of the authentication processing flow shown in Figure 5, and shows the process from step S103 onwards in Figure 5.

[0055] The user terminal 40 requests user authentication from the authentication integration device 10 (step S201). Specifically, when the user terminal 40 accesses the service site, it is redirected from the service site through the user terminal 40 to the authentication integration device 10, which then sends a user authentication request containing information about the authentication method ID "auth1" to the authentication integration device 10. In this context, the authentication method ID "auth1" refers to telephone call authentication.

[0056] The authentication method determination unit 13 of the authentication integration device 10 receives a user authentication request through the communication unit 12 (step S202).

[0057] The authentication method determination unit 13 obtains an authentication method ID from the user authentication request and determines the authentication method requested by the user terminal 40 from among the multiple authentication methods of the authentication integration device 10 (step S203). Specifically, upon receiving the authentication request URL "tenantname.example / service01 / auth1 / login", the authentication method determination unit 13 obtains the authentication method ID "auth1" from the user authentication request information and determines that the authentication method corresponding to the authentication method ID "auth1" is "telephone call authentication".

[0058] Once the authentication method determination unit 13 determines the authentication method, it sends a user authentication screen URL to the user terminal 40 and requests user authentication information in accordance with the pre-configured authentication control to execute the third authentication method (step S204).

[0059] The user terminal 40 receives the user authentication screen URL and displays the user authentication screen (step S205). Specifically, the user authentication screen displays input fields for the user ID and password necessary to identify the user, as well as a button to request user authentication.

[0060] The user terminal 40 transmits user authentication information, including the user ID and password, to the authentication integration device 10 (step S206). Let's assume that the user ID sent is "A-U0001" and the password is "pass123".

[0061] The authentication execution request unit 14 of the authentication integration device 10 receives user authentication information and obtains the user ID and password. Then, based on the user ID and password obtained from the user authentication information, it checks whether or not the corresponding user is registered in the user authentication management data 111. If the user is identified, the phone number is obtained from the user authentication management data 111 based on the user ID (step S207).

[0062] Specifically, as shown in Figure 4, the user authentication management data 111 pre-stores the user ID "A-U0001", password "pass123", and telephone number "09012345678". The user is verified based on the user identification information of user ID "A-U0001" and password "pass123" obtained from the user authentication information. Since user ID "A-U0001" and password "pass123" are registered in the user ID "A-U0001" record in the user authentication management data 111, the user is identified through verification. Then, because identity verification is required, the phone number "09012345678" is retrieved from user authentication management data 111 based on user ID "A-U0001".

[0063] The authentication execution request unit 14 transmits an authentication execution request to the authentication execution device 20, which includes information that the authentication method is a telephone call authentication method and the telephone number obtained in step S207 (step S208). Specifically, authentication request information, including the phone number "09012345678," is sent to "server / endpoint / authTel / ," which is the authentication execution endpoint for telephone-based authentication, requesting authentication using the telephone-based authentication method.

[0064] The authentication execution device 20 receives user authentication information, including a telephone number, from the authentication integration device 10 (step S209). Specifically, it receives user authentication information, including the phone number "09012345678".

[0065] The authentication execution device 20 sends an authentication telephone number to the user terminal 40 (step S210). Specifically, authentication information including the authentication telephone number "0123456789" is sent to the user terminal 40.

[0066] The user terminal 40 receives authentication information and displays the authentication phone number. The user terminal 40 then dials the authentication phone number (step S211). Specifically, the authentication telephone number "0123456789" is displayed on the user terminal 40, and the telephone dialing unit of the user terminal 40 dials the authentication telephone number "0123456789".

[0067] The authentication execution device 20 receives a call from the user terminal 40 and obtains the incoming phone number. The obtained incoming phone number is compared with the phone number in the user authentication information received in step S209, and if they match, it is determined that the match was successful (OK). If no incoming call is received from the phone number in the user authentication information received in step S209 within a certain period of time, it is determined that the match was not successful (NG). The authentication execution result information for the telephone outgoing authentication, including the determined authentication match (OK) or authentication match not successful (NG), is transmitted to the authentication integration device 10 (step S212).

[0068] The authentication execution result receiving unit 15 of the authentication integration device 10 receives authentication execution result information through the communication unit 12 (step S213).

[0069] The authentication determination unit 16 determines that authentication is successful if the authentication execution result information includes "authentication matched" (OK), and determines that authentication is unsuccessful if the authentication execution result information includes "authentication matched" (NG). The authentication determination unit 16 sends authentication completion information, including the authentication success or failure determination, to the user terminal 40 (step S214).

[0070] User terminal 40 receives authentication completion information (step S215). At this time, the user terminal 40 may be redirected to the authentication integration device 10 to send authentication completion information to the authentication service device 30.

[0071] Figure 7 shows the authentication flow for the second authentication method. Figure 7 explains the operation of the authentication flow for lifestyle habit authentication as the second authentication method. The process shown in Figure 7 is a processing flow that begins from step S301, when the authentication integration device 10 receives a user authentication request. The process by which the authentication integration device 10 sends the user authentication request is the same as in steps S101-102, so the explanation is omitted. Note that the authentication processing flow shown in Figure 7 is a specific processing flow that occurs when the second authentication method is determined in step S105 of the authentication processing flow shown in Figure 5, and shows the process from step S103 onwards in Figure 6.

[0072] The user terminal 40 requests user authentication from the authentication integration device 10 (step S301). Specifically, when the user terminal 40 accesses the service site, it is redirected from the service site through the user terminal 40 to the authentication integration device 10, and a user authentication request is sent to the authentication integration device 10. In this context, the authentication method ID "auth2" indicates lifestyle-based authentication.

[0073] The authentication method determination unit 13 of the authentication integration device 10 receives a user authentication request through the communication unit 12 (step S302).

[0074] The authentication method determination unit 13 obtains an authentication method ID from the user authentication request and determines the authentication method requested by the user terminal 40 from among the multiple authentication methods of the authentication integration device 10 (step S303).

[0075] Specifically, when the authentication method determination unit 13 receives the authentication request URL "tenantname.example / service01 / auth2 / login" for user authentication, it obtains the authentication method ID "auth2" from the user authentication request information and determines that the authentication method corresponding to the authentication method ID "auth2" is "lifestyle authentication". The authentication request URL may be structured in a format that includes a URL parameter containing the authentication method ID, or the authentication method ID may be obtained from the URL parameter.

[0076] If the authentication method determination unit 13 determines that the authentication method is a lifestyle habit authentication method, it sends a user authentication screen URL to the user terminal 40 and requests user authentication information in accordance with the pre-configured authentication control to execute the third authentication method (step S304).

[0077] The user terminal 40 receives the user authentication screen URL and displays the user authentication screen (step S305). Specifically, input fields for the user ID and password necessary to identify the user, as well as a button requesting user authentication, will be displayed. Furthermore, if the third authentication method is user certificate authentication, the authentication integration device 10 may be configured to notify the user terminal 40 to request user authentication information including the user certificate, and the user terminal 40 may be configured to transmit user authentication information including the user ID and user certificate to the authentication integration device 10.

[0078] The user terminal 40 transmits user authentication information, including the user ID and password, to the authentication integration device 10 (step S306). Let's assume that the user ID sent is "A-U0002" and the password is "pass456".

[0079] The authentication execution request unit 14 of the authentication integration device 10 receives user authentication information and obtains the user ID and password. Then, based on the user ID and password obtained from the user authentication information, it checks whether or not the corresponding user is registered in the user authentication management data 111. If the user is identified, the lifestyle ID is obtained from the user authentication management data 111 based on the user ID (step S307).

[0080] Specifically, as shown in Figure 4, the user authentication management data 111 has the user ID "A-U0002", password "pass456", and lifestyle ID "life0002" pre-stored. The user is verified based on the user identification information of user ID "A-U0002" and password "pass456" obtained from the user authentication information. Since user ID "A-U0002" and password "pass456" are registered in the user ID "A-U0002" record in the user authentication management data 111, the user requesting user authentication is identified as user ID "A-U0002" through verification. Then, because identity verification is required, the lifestyle ID "life0002" is retrieved from user authentication management data 111 based on user ID "A-U0002".

[0081] The authentication execution request unit 14 transmits authentication execution request information, which includes information that the authentication method is a lifestyle authentication method and the lifestyle ID obtained in step S307, to the authentication execution device 20 (step S308). Specifically, authentication request information including the lifestyle ID "life0002" is sent to "server / endpoint / authlife," which is the authentication execution endpoint for the lifestyle authentication method, to request authentication execution for the lifestyle authentication method.

[0082] The authentication execution device 20 receives user authentication information, including a lifestyle ID, from the authentication integration device 10 and performs lifestyle authentication (step S309). Specifically, the authentication execution device 20 receives user authentication information including the lifestyle ID "life0002" and outputs an action probability value that matches the lifestyle habits and actions of the user with lifestyle ID "life0002". The authentication execution device 20 transmits the authentication execution result information, including the action probability value, to the authentication integration device 10.

[0083] The authentication execution result receiving unit 15 of the authentication integration device 10 receives authentication execution result information through the communication unit 12 (step S310). For example, the authentication execution result information includes an action probability value represented by the number "0.821", and the authentication execution result receiving unit receives the authentication execution result information which includes the action probability value represented by the number.

[0084] The authentication determination unit 16 obtains an action probability value from the authentication execution result information. If the obtained action probability value is greater than the determination threshold for determining that the user is indeed the user, the authentication is determined to be successful. If the action probability value is less than the determination threshold, the authentication is determined to be unsuccessful. The authentication determination unit 16 transmits authentication completion information, including whether the authentication was successful or unsuccessful, to the user terminal 40 (step S311). Specifically, the authentication determination unit 16 compares the acquired action probability value "0.821" with the determination threshold value "0.800", determines that the action probability value is greater than the determination threshold, and sends authentication completion information, including information about successful authentication, to the user terminal 40.

[0085] In this example, the action probability value "0.821" indicates an 82.1% probability that the user is indeed the user, and since this action probability is greater than the judgment threshold "0.800", authentication is determined to be successful. Furthermore, the value "0.800," shown as an example of a judgment threshold, is assumed to be a value that the authentication judgment unit 16 has stored in advance.

[0086] The user terminal 40 receives authentication completion information (step S312).

[0087] ***Effects of Embodiment 1*** An authentication integration device can be provided that, based on a user authentication request received from the user's terminal, receives authentication execution result information corresponding to the requested authentication method from an authentication execution device and determines whether the authentication was successful or failed.

[0088] By integrating multiple authentication methods, including the first and second authentication methods, user authentication information such as user IDs can be centralized, enabling single sign-on after user authentication.

[0089] By combining multiple authentication methods that the service site wishes to use, security during authentication can be enhanced.

[0090] Furthermore, by having the authentication integration device control multiple authentication methods, the cost of implementing multiple authentication methods can be reduced.

[0091] ***Other configurations*** <Example 1> As a variation 1, the authentication integration device 10 and the authentication execution device 20 described in the embodiment may be combined into a single device.

[0092] <Modification 2> As a second variation, the system may be implemented in which a portion of the user authentication management data 111 described in the embodiment is stored in the authentication execution device 20.

[0093] <Variation 3> As a third modification, the authentication execution function of the authentication execution device 20 described in the embodiment may be implemented in a configuration in which a part of the authentication execution function or each of the authentication execution functions is executed by a separate authentication execution device.

[0094] <Modification 4> As a fourth modification, some or all of the functions of the authentication integration device 10 described in each embodiment may be built and implemented on the cloud.

[0095] [Embodiment 2] In Embodiment 1, the authentication integration system 1 was realized in a configuration in which an authentication integration device 10 and one authentication utilization service device 30 were connected. In Embodiment 2, an authentication integration system 1 is configured in which an authentication service device 30A operated by corporate customer A, an authentication service device 30B operated by corporate customer B, and an authentication integration device 10 are connected. The differences between Embodiment 2 and Embodiment 1 will be explained below. ***Configuration of Embodiment 2*** Figure 8 shows a schematic configuration of the authentication integration system 1 according to Embodiment 2. This authentication integration system 1 consists of an authentication integration device 10, an authentication execution device 20, an authentication utilization service device 30A, an authentication utilization service device 30B, and a user terminal 40.

[0096] Authentication service device 30A is running service site A, operated by corporate customer A, and authentication service device 30B is running service site B, operated by corporate customer B. Furthermore, in order to determine authentication requests from service sites operated by corporate customer A and corporate customer B, corporate customer A is assigned the tenant ID "tenantA" and corporate customer B is assigned the tenant ID "tenantB". In addition, a corporate customer may be configured to provide multiple different service sites.

[0097] Figure 9 is a block diagram showing an example configuration of the authentication integration device 10. The differences between each component of the authentication integration device 10 and Embodiment 1 will be described below. Unlike in Embodiment 1, the storage unit 11 of the authentication integration device 10 is separated for each corporate customer, and is equipped with a storage unit 11A dedicated to corporate customer A and a storage unit 11B dedicated to corporate customer B. The storage units 11A and 11B may be virtually separated or physically separated.

[0098] The storage unit 11A stores user authentication management data 111A, which is the authentication information of users accessing service site A. The storage unit 11B stores user authentication management data 111B, which is the authentication information of users accessing service site B. The data structure of user authentication management data 111A and user authentication management data 111B is the same as in Embodiment 1.

[0099] When the authentication method determination unit 13 receives a user authentication request from the user terminal 40, it determines a predetermined authentication method and requests user authentication information corresponding to the determined authentication method from the user terminal 40. Specifically in Embodiment 2, the authentication method of the service site provided by the relevant tenant is determined by obtaining the tenant ID, client ID, and authentication method ID from the user authentication request.

[0100] The authentication control unit 17 manages authentication control setting information for each tenant ID. Specifically, the authentication control settings are configuration information pre-configured by the administrator that, in the case of unauthenticated users, receive the authentication request URL of the service site's user authentication request sent from the user terminal 40, obtain the tenant ID, client ID, and authentication method ID from that authentication request URL, determine the authentication method requested by the service site based on the tenant ID, client ID, and authentication method ID, and send the authentication result according to the corresponding authentication method to the user terminal 40. For each tenant ID, a client ID that is uniquely identified within that tenant ID and an authentication method ID for the authentication method executed by the authentication integration device 10 are configured. Furthermore, the client ID refers to the ID assigned to the service site that the authentication service device 30 requests user authentication from.

[0101] ***Operation of Embodiment 2*** Figure 10 is an authentication process flow diagram of the authentication integration device 10 in Embodiment 2. The differences from Embodiment 1 will be explained in detail. Note that this authentication process flow is explained for corporate customer A, but the same applies to corporate customer B. Steps S411 to S415 are the same as steps S111 to S115 in Embodiment 1, so their explanation will be omitted.

[0102] First, the user accesses service site A from user terminal 40 (step S401).

[0103] When the authentication service device 30A receives an access request to the service site from the user terminal 40, it requests user authentication from the user terminal 40 (step S402).

[0104] When the user terminal 40 receives a user authentication request from the authentication service device 30A, it requests user authentication from the authentication integration device 10 (step S403). The service site of the authentication service device 30 may redirect the user terminal 40 to the authentication integration device 10.

[0105] The authentication method determination unit 13 of the authentication integration device 10 receives a user authentication request from the user terminal 40 via the communication unit 12 and receives the user authentication request (step S404).

[0106] The authentication method determination unit 13 obtains the requesting tenant ID, client ID, and authentication method ID used by the client from the user authentication request, and determines the authentication method requested by the user terminal 40 from among the multiple authentication methods of the authentication integration device 10 (step S405). For example, when user terminal 40 accesses "tenantA.example / service01 / auth1 / login", the authentication method determination unit 13 receives the authentication request URL for "tenantA.example / service01 / auth1 / login". Based on the received authentication request URL, it obtains the tenant ID "tenantA", client ID "service01", and authentication method ID "auth1", and determines the authentication method and authentication control for tenant ID "tenantA", client ID "service01", and authentication method ID "auth1". The authentication request URL may also be configured with URL parameters including the client ID and authentication method ID. Alternatively, the relevant tenant may be identified from the authentication request URL, and the client ID and authentication method ID may be obtained from the URL parameters.

[0107] The authentication method determination unit 13 requests user authentication information from the user terminal 40 via the communication unit 12 in order to execute the third authentication method (step S406). Specifically, the authentication method determination unit 13, in accordance with the authentication control settings for tenant ID "tenantA", client ID "service01", and authentication method ID "auth1" set in advance by the administrator in the authentication control unit 17, sends a user authentication screen URL to the user terminal 40 to display the user authentication screen.

[0108] The user terminal 40 displays the user authentication screen requested by the authentication integration device 10 (step S407).

[0109] The user terminal 40 transmits the authentication information entered by the user on the user authentication screen to the authentication integration device 10 (step S408). For example, the user authentication screen displays input fields for the user ID and password, as well as an authentication button requesting authentication. When the user enters their user ID and password and clicks the authentication button, the user authentication information is sent to the authentication integration device 10.

[0110] The communication unit 12 of the authentication integration device 10 receives user authentication information, and the authentication execution request unit 14 obtains user identification information from the user authentication management data 111A of tenant A based on the user authentication information. Then, it identifies the user requesting authentication from the user identification information (step S409). For example, user identification information consists of a user ID and password. The authentication execution request unit 14 checks whether a user matching the user ID and password obtained from the user authentication information is registered in the user authentication management data 111A. If a user matching the user authentication management data 111A is registered (YES), the process proceeds to the next step S410. If no user matching the user authentication management data 111A is registered (NO), it is determined that authentication failed using the third authentication method, and the process proceeds to step S413.

[0111] The authentication execution request unit 14 obtains the authentication execution request information necessary for the user authentication request from the user authentication management data 111A based on the user ID obtained in step S109. Then, the authentication method and authentication execution request information are transmitted through the communication unit 12 to the authentication execution endpoint of the authentication execution device 20 of the authentication method, and an authentication execution request is made to the authentication execution device 20 (step S410).

[0112] ***Effects of Embodiment 2***

[0113] By implementing multi-tenancy, which manages authentication control settings and user authentication management data for each corporate customer, the authentication integration device 10 can provide authentication functionality to each service site provided by multiple corporate customers.

[0114] Furthermore, security can be enhanced by separating the storage unit that stores authentication control settings and user authentication management data for each corporate customer.

[0115] In addition, the term "part" in the above explanation may be replaced with "circuit," "process (step)," "procedure," "processing," or "processing circuit."

[0116] The various aspects of this disclosure are summarized below as an appendix. (Note 1) An authentication integration device connected to an authentication execution device that performs multiple authentication methods, An authentication method determination unit receives a user authentication request from the user's terminal, determines the authentication method based on the authentication method ID included in the user authentication request, and requests user authentication information corresponding to the authentication method from the user's terminal. An authentication execution request unit receives user authentication information from the user's terminal, extracts pre-stored authentication execution request information according to the authentication method based on the user ID contained in the user authentication information, and transmits the authentication method and the authentication execution request information to the authentication execution device to request authentication execution. A certification execution result receiving unit that receives certification execution result information corresponding to the authentication method from the aforementioned authentication execution device, An authentication determination unit determines whether authentication is successful or unsuccessful based on the authentication execution result information received by the authentication execution result receiving unit, An authentication integration device equipped with the following features. (Note 2) The authentication execution result receiving unit, In the case where the authentication method is the first authentication method, the authentication execution device receives authentication execution result information indicating whether the user is the person in question or not, based on the authentication execution request information. In the case where the authentication method is the second authentication method, the authentication execution result information, which includes an action probability value that is a probability value calculated by the authentication execution device to show the degree to which it matches the user's behavior history, is received from the authentication execution device. The authentication determination unit, In the case of the first authentication method, if the authentication execution result information with verification is received, it is determined that the authentication is successful. In the case of the second authentication method, if the behavioral probability value is greater than the determination threshold that serves as the criterion for determining that the user is indeed the user, the authentication is determined to be successful. The authentication integration device described in Appendix 1. (Note 3) The user authentication request received by the authentication method determination unit is an authentication request URL that includes the authentication method ID that identifies the authentication method, The authentication method determination unit obtains the authentication method ID from the authentication request URL of the user authentication request, determines the authentication method from among several different authentication methods, and requests the user authentication information from the user's terminal according to the authentication method. The authentication integration device described in either Appendix 1 or 2. (Note 4) As the aforementioned authentication execution request information, The system includes a storage unit that stores user authentication management data consisting of user authentication management information, including the user's user ID, password, and telephone number, a decryption key for decrypting an encrypted user certificate, and a unique lifestyle ID required for authentication requests of the second authentication method. The authentication integration device described in either item 2 or 3 of the appendix. (Note 5) The first authentication method includes telephone call authentication, which authenticates the user based on whether or not there is an incoming call from the user's telephone number. The authentication execution request unit obtains the telephone number from the user authentication management data based on the user ID included in the user authentication information received from the user's terminal, and notifies the user's terminal of the authentication telephone number. The authentication execution result receiving unit receives the authentication execution result information from the authentication execution device, which includes information on whether or not an incoming call was made from the user's telephone number. The authentication determination unit determines that authentication is successful if the authentication execution result information includes information indicating that an incoming call was received. The authentication integration device described in Appendix 4. (Note 6) The second authentication method includes lifestyle habit authentication, which calculates the degree to which it matches the patterns of the user's behavioral history in their daily life. The authentication execution request unit obtains the lifestyle ID from the user authentication management data based on the user ID included in the user authentication information received from the user's terminal, The authentication method indicating the lifestyle habit authentication and the authentication execution request information including the lifestyle ID are transmitted to the authentication execution device to request authentication execution. The authentication integration device described in Appendix 4. (Note 7) Furthermore, before requesting authentication execution from the authentication execution device, the authentication execution request unit, A third authentication method is executed to verify that the user is the person in question by comparing the user authentication information with the user identification information obtained from the user authentication management data. If the third authentication method fails to identify the user as the person in question, the authentication execution device will not be requested to perform authentication. The authentication integration device described in either item 5 or 6 of the appendix. (Note 8) Furthermore, the storage unit stores the user authentication management data for each corporate customer that provides the service site. The authentication integration device described in Appendix 4. (Note 9) Furthermore, the user authentication request received by the authentication method determination unit is an authentication request URL that includes a tenant ID that identifies the corporate customer, a client ID that uniquely identifies the service site, and the authentication method ID, The authentication method determination unit obtains the tenant ID, client ID, and authentication method ID from the authentication request URL of the user authentication request, determines the authentication method that corresponds to the corporate customer's service site from among a plurality of different authentication methods, and requests the user authentication information from the user's terminal according to the authentication method. The authentication determination unit determines whether authentication was successful or unsuccessful based on the authentication execution result information received by the authentication execution result receiving unit. The authentication integration device described in Appendix 8. (Note 10) The authentication determination unit notifies the user's terminal of authentication completion information, including whether authentication was successful or failed, as determined from the authentication execution result information received by the authentication execution result receiving unit. The authentication integration device described in Appendix 9. (Note 11) An authentication integration device connected to an authentication execution device that performs multiple authentication methods, The computer of the aforementioned authentication integration device: Authentication method determination process: receives a user authentication request from the user's terminal, determines the authentication method based on the authentication method ID included in the user authentication request, and requests user authentication information corresponding to the authentication method from the user's terminal. Authentication execution request processing involves receiving user authentication information from the user's terminal, extracting pre-stored authentication execution request information according to the authentication method based on the user ID contained in the user authentication information, and transmitting the authentication method and the authentication execution request information to the authentication execution device to request authentication execution. Authentication execution result receiving process, which receives authentication execution result information corresponding to the authentication method from the aforementioned authentication execution device, The system executes an authentication determination process that determines whether authentication was successful or failed based on the authentication execution result information received in the aforementioned authentication execution result receiving process. Authentication integration program. (Note 12) An authentication integration method performed by a computer in an authentication integration device connected to an authentication execution device that performs multiple authentication methods, A step of determining an authentication method, which involves receiving a user authentication request from the user's terminal, determining the authentication method based on the authentication method ID included in the user authentication request, and requesting user authentication information corresponding to the authentication method from the user's terminal, An authentication execution request step involves receiving user authentication information from the user's terminal, extracting pre-stored authentication execution request information according to the authentication method based on the user ID contained in the user authentication information, and transmitting the authentication method and the authentication execution request information to the authentication execution device to request authentication execution. A step of receiving authentication execution results, which receives authentication execution result information corresponding to the authentication method from the authentication execution device, An authentication determination step which determines whether authentication was successful or failed based on the authentication execution result information received in the authentication execution result receiving step, An authentication integration method that includes the following features.

[0117] The embodiments of this disclosure have been described above. Some of these embodiments may be implemented in combination. Alternatively, one or more of them may be implemented in part. This disclosure is not limited to the embodiments described above, and various modifications are possible as needed. [Explanation of Symbols]

[0118] 1 Authentication integration system, 2 Network, 10 Authentication integration device, 11 Storage unit, 12 Communication unit, 13 Authentication method determination unit, 14 Authentication execution request unit, 15 Authentication execution result receiving unit, 16 Authentication determination unit, 20 Authentication execution device, 30 Authentication utilization service device, 40 User terminal, 51 Processor, 52 Memory, 53 Signal input / output unit, 111 User authentication management data.

Claims

1. An authentication integration device connected to an authentication execution device that performs multiple authentication methods, An authentication method determination unit receives a user authentication request from the user's terminal, determines the authentication method based on the authentication method ID included in the user authentication request, and requests user authentication information corresponding to the authentication method from the user's terminal. An authentication execution request unit receives user authentication information from the user's terminal, extracts pre-stored authentication execution request information according to the authentication method based on the user ID contained in the user authentication information, and transmits the authentication method and the authentication execution request information to the authentication execution device to request authentication execution. A certification execution result receiving unit that receives certification execution result information corresponding to the authentication method from the aforementioned authentication execution device, An authentication determination unit determines whether authentication is successful or unsuccessful based on the authentication execution result information received by the authentication execution result receiving unit, An authentication integration device equipped with the following features.

2. The authentication execution result receiving unit, In the case where the authentication method is the first authentication method, the authentication execution device receives authentication execution result information indicating whether the user is the person in question or not, based on the authentication execution request information. In the case where the authentication method is the second authentication method, the authentication execution result information, which includes an action probability value that is a probability value calculated by the authentication execution device to show the degree to which it matches the user's behavior history, is received from the authentication execution device. The authentication determination unit, In the case of the first authentication method, if the authentication execution result information with verification is received, it is determined that the authentication is successful. In the case of the second authentication method described above, if the behavioral probability value is greater than the determination threshold that serves as the criterion for determining that the user is indeed the user, the authentication is determined to be successful. The authentication integration device according to claim 1.

3. The user authentication request received by the authentication method determination unit is an authentication request URL that includes the authentication method ID that identifies the authentication method, The authentication method determination unit obtains the authentication method ID from the authentication request URL of the user authentication request, determines the authentication method from among several different authentication methods, and requests the user authentication information from the user's terminal according to the authentication method. The authentication integration device according to claim 1.

4. As the aforementioned authentication execution request information, The system includes a storage unit that stores user authentication management data consisting of user authentication management information, including the user's user ID, password, and telephone number, a decryption key for decrypting an encrypted user certificate, and a unique lifestyle ID required for authentication requests of the second authentication method. The authentication integration device according to claim 2.

5. The first authentication method includes telephone call authentication, which authenticates the user based on whether or not there is an incoming call from the user's telephone number. The authentication execution request unit obtains the telephone number from the user authentication management data based on the user ID included in the user authentication information received from the user's terminal, and notifies the user's terminal of the authentication telephone number. The authentication execution result receiving unit receives the authentication execution result information from the authentication execution device, which includes information on whether or not an incoming call was made from the user's telephone number. The authentication determination unit determines that authentication is successful if the authentication execution result information includes information indicating that an incoming call was received. The authentication integration device according to claim 4.

6. The second authentication method includes lifestyle habit authentication, which calculates the degree to which it matches the patterns of the user's behavioral history in their daily life. The authentication execution request unit obtains the lifestyle ID from the user authentication management data based on the user ID included in the user authentication information received from the user's terminal, The authentication method indicating the aforementioned lifestyle habit authentication and the authentication execution request information including the lifestyle ID are transmitted to the authentication execution device to request authentication execution. The authentication integration device according to claim 4.

7. Furthermore, before requesting authentication execution from the authentication execution device, the authentication execution request unit, A third authentication method is executed to identify the user as the person in question by comparing the user authentication information with the user identification information obtained from the user authentication management data. If the third authentication method fails to identify the user as the person in question, the authentication execution device will not be requested to perform authentication. The authentication integration device according to any one of claims 5 or 6.

8. Furthermore, the storage unit stores the user authentication management data for each corporate customer that provides the service site. The authentication integration device according to claim 4.

9. Furthermore, the user authentication request received by the authentication method determination unit includes a tenant ID that identifies the corporate customer, a client ID that uniquely identifies the service site, and the authentication method An authentication request URL that includes an ID, The authentication method determination unit obtains the tenant ID, client ID, and authentication method ID from the authentication request URL of the user authentication request, and determines a plurality of different authentication methods The system determines the authentication method corresponding to the service site of the corporate customer from the formula, and requests the user authentication information from the user's terminal according to the authentication method. The authentication determination unit determines whether authentication was successful or unsuccessful based on the authentication execution result information received by the authentication execution result receiving unit. The authentication integration device according to claim 8.

10. The authentication determination unit notifies the user's terminal of authentication completion information, including whether authentication was successful or failed, as determined from the authentication execution result information received by the authentication execution result receiving unit. The authentication integration device according to claim 9.

11. On the computer of the authentication integration device connected to the authentication execution device that performs multiple authentication methods, Authentication method determination process: receives a user authentication request from the user's terminal, determines the authentication method based on the authentication method ID included in the user authentication request, and requests user authentication information corresponding to the authentication method from the user's terminal; Authentication execution request processing involves receiving user authentication information from the user's terminal, extracting pre-stored authentication execution request information according to the authentication method based on the user ID contained in the user authentication information, and transmitting the authentication method and the authentication execution request information to the authentication execution device to request authentication execution. Authentication execution result receiving process, which receives authentication execution result information corresponding to the authentication method from the aforementioned authentication execution device, The system executes an authentication determination process that determines whether authentication was successful or failed based on the authentication execution result information received in the aforementioned authentication execution result receiving process. Authentication integration program.

12. An authentication integration method performed by a computer in an authentication integration device connected to an authentication execution device that performs multiple authentication methods, A user authentication request is received from the user's terminal, the authentication method is determined based on the authentication method ID included in the user authentication request, and user authentication information corresponding to the authentication method is requested from the user's terminal. An authentication execution request step involves receiving user authentication information from the user's terminal, extracting pre-stored authentication execution request information according to the authentication method based on the user ID contained in the user authentication information, and transmitting the authentication method and the authentication execution request information to the authentication execution device to request authentication execution. A step of receiving authentication execution results, which receives authentication execution result information corresponding to the authentication method from the authentication execution device, An authentication determination step which determines whether authentication was successful or failed based on the authentication execution result information received in the authentication execution result receiving step, An authentication integration method that includes the following features.

Images