Information processing devices, authenticators, methods and programs thereof

Abstract

To solve the problem in which: a user may not grasp a result of authentication processing in real time even when the user uses a wearable terminal as an authenticator.SOLUTION: In a mechanism in which an information processing apparatus executing an application that can control authentication processing using an external authenticator worn by a user transmits signature data received when authentication is successful in the external authenticator to a system to verify the signature data, the external authenticator responds to at least one of a result of biometric authentication and a request transmitted to the external authenticator from the information processing apparatus, and the external authenticator performs notification to the user.SELECTED DRAWING: Figure 7

Description

Technical Field

[0001] The present invention relates to authentication technology using an authenticator.

Background Art

[0002] There are many authentication methods for logging into web services and approving service usage. For example, in recent years, an authentication method called FIDO (Fast Identity Online) has attracted attention. FIDO is said to be an authentication method with a low risk of information leakage, since authentication information such as biometric information does not flow over the network.

[0003] As biometric information input methods, fingerprint authentication using a fingerprint authentication reader, face authentication using a camera, and the like are widely prevalent. In Patent Document 1, a smartphone is used as an external authenticator for FIDO authentication. In recent years, wearable terminals such as smartwatches, smart rings, and earphones are equipped with sensors that read biometric information, and realize personal authentication through vein authentication, skin authentication, ear acoustic authentication, and the like. Even such a wearable terminal can be used as an authenticator in authentication methods such as FIDO.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of Invention

Problems to be Solved by the Invention

[0005] When an authentication method such as vein authentication, skin authentication, or ear acoustic authentication is adopted using a wearable terminal as an external authenticator, there is a possibility that authentication can be performed smoothly without a specific operation input such as holding a finger over a predetermined position of a smartphone.

[0006] On the other hand, because authentication can be performed simply by wearing the device without any user intervention, there are concerns that it may be difficult for the user to understand the results of the authentication process or when it was successful. Unlike smartphones, wearable devices such as earphones may not have a display, in which case this concern becomes more pronounced. In particular, when using a wearable device as an external authenticator to authorize service use (such as product purchase) with FIDO as mentioned above, the user may want to know the results of the authentication process in real time.

[0007] The present invention aims to provide a mechanism that can appropriately notify users of the authentication process, even when a wearable device is used as an authenticator. [Means for solving the problem]

[0008] An information processing device that executes an application capable of controlling authentication processing using an external authenticator connected to the information processing device, comprising: a first transmission means for sending a request to a system communicating via a network; a first receiving means for receiving verification data from the system; and an authentication request including the verification data. Attached to the user A means of sending a request to an external authenticator, before Authentication in accordance with the authentication request by the external authenticator. After the execution of the above, the external authenticator issues the first notification to the user, and then the authentication The signature data generated by the external authenticator using the private key identified by the above From the aforementioned external authenticator A second receiving means for receiving data, a second transmitting means for transmitting the signature data to the system, a third receiving means for receiving data based on the result of a verification process of the signature data using a public key registered in the system, and in response to the reception of data by the third receiving means, before The external authenticator will provide the user with 2nd The system is characterized by having a third transmission means for sending a notification request to the external authenticator in order to trigger a notification. [Effects of the Invention]

[0009] According to the present invention, even when a wearable device is used as an authenticator, a mechanism can be provided that appropriately notifies the user regarding the authentication process. [Brief explanation of the drawing]

[0010] [Figure 1] Diagram showing examples of system and network configurations. [Figure 2] A diagram showing an example of the hardware configuration of each device within the system. [Figure 3] A diagram showing an example of a software module configuration. [Figure 4] A diagram showing an example of the sequence during authenticator registration. [Figure 5] This diagram shows an example of the data structure used in the authenticator registration process. [Figure 6] This diagram shows an example of the screen transitions during authenticator registration displayed on client terminal 102. [Figure 7] A diagram illustrating an example of the sequence of events when using a service, including authentication. [Figure 8] A diagram showing examples of parameters used during authentication. [Figure 9] A diagram showing an example of screen transitions when using a service, including authentication. [Figure 10] This figure shows an example of the sequence of service usage, including authentication, in Example 3. [Figure 11] Figure 6(D) shows a modified example. [Modes for carrying out the invention]

[0011] Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. In the following description, biometric authentication is performed by a wearable terminal owned and worn by a user when using a service on the web. The present invention relates to a mechanism for providing data (signature data) that can prove that the authentication has succeeded to a service on the web, and providing the service by successfully verifying the data in the service. Note that in the following embodiments, an example using FIDO as the mechanism is described, but a technology other than FIDO can also be adopted as long as it is a similar authentication mechanism.

[0012] (Embodiment 1) <Network Configuration> Figure 1 is a diagram showing an example of the network configuration of the present embodiment. This system is composed of a wearable terminal 101, a client terminal 102, and a server system 103.

[0013] The client terminal 102 and the server system 103 are connected via a network 105. The network 105 is, for example, any of a LAN such as the Internet, a WAN, a telephone line, a dedicated digital line, an ATM or frame relay line, a cable television line, a wireless line for data broadcasting, or the like. Alternatively, it is a so-called communication network realized by a combination of these. The wearable terminal 101 is also connected to the client terminal 102 via a network 106. The network 106 is realized by, for example, short-range wireless communication such as NFC (Near Field Communication) or Bluetooth, communication via a USB cable connection, or the like. The network 106 may be realized by Wi-Fi communication. Further, the wearable terminal 101 may be connected to the network 105.

[0014] <Internal Configuration of Server System 103> FIG. 2(A) is a diagram showing a configuration example of hardware having an information processing function of a server system 103. The server system 103 is constructed by at least one or more information processing apparatuses, and provides websites, web services, and authentication services using the hardware included in those apparatuses described below.

[0015] Reference numeral 201 denotes a CPU that executes programs read from the RAM 202, the ROM 203, the storage device 210, and the like. The keyboard controller 204 controls operation inputs from the keyboard 208 and a pointing device (not shown) such as a mouse, a touch pad, a touch panel, and a trackball. The display controller 205 controls display on the display 209. The disk controller 206 controls data access to the storage device 210 such as a hard disk drive (HD) or a solid state drive (SSD) that stores various types of data. The network interface 207 is connected to a network such as a LAN, and communicates with other devices connected to the network. The respective units configuring the hardware such as 201 to 207 are connected via an internal bus 211.

[0016] <Internal Configuration of Wearable Terminal 101> FIG. 2(B) is a diagram showing the internal configuration of the wearable terminal 101.

[0017] The CPU 221 contains programs stored in the ROM 223 (including programs that implement each process described later) and comprehensively controls each device via the internal bus 233. The RAM 222 functions as the memory and work area of ​​the CPU 221. The storage device 224 is a hard disk drive (HD), solid state drive (SSD), etc., that stores various types of data. The network I / F 225 exchanges data with external network devices in one direction or bidirectionally. The biometric information sensor 226 is a sensor that reads biometric information such as vein authentication, skin authentication, and ear acoustic authentication. The Trusted Platform Module (TPM) 227 is a storage means with tamper resistance to prevent the stored data from being read from the outside, for the purpose of processing and storing confidential information. The TPM 227 stores biometric information input by the biometric information sensor 226 and secret keys generated in the wearable terminal 101, and also has a function to verify the stored biometric information with the input biometric information. As a tamper-resistant storage method, a securely constructed trusted environment defined by the platform, such as the OS of the wearable device 101, can be used as a substitute.

[0018] The proximity communication interface 228 is a network interface for proximity communication such as NFC and Bluetooth. By using the proximity communication interface 228, it is possible to exchange data with client terminals 102, etc., and for client terminals 102, etc., to issue authentication instructions to the wearable terminal 101. The touch panel 229 is a device equipped with both display and pointing functions, allowing users to manipulate objects displayed on the display with their fingers or a stylus. The vibrator 230 is a device that vibrates the wearable terminal 101, vibrating in response to user operations or external events. The speaker 231 is a device that outputs sounds such as voice messages and melodies.

[0019] The wearable terminal 101 in this invention is envisioned as a smartwatch, earphones, or smart ring that has functions such as vein authentication, skin authentication, or ear acoustic authentication that can be performed while the user is wearing it, but it is not limited to a specific device. Also, although Figure 2(B) shows a display output device such as a touch panel 229, it is not necessarily required in this invention. Furthermore, the vibrator 230 and speaker 231 of the wearable terminal 101 are used in this embodiment to notify the user of the completion of processing, but the notification device is not limited to these. For example, a smartwatch could have a device for tightening the belt, or a smart ring could have a flashing light.

[0020] <Internal configuration of the client terminal> Figure 2(C) shows an example of the hardware configuration of an information processing device, which is a client terminal 102.

[0021] The internal bus 241, CPU 242, RAM 243, and ROM 244 have the same functions as the internal bus 211, CPU 201, RAM 202, and ROM 203. The storage device 245 is a storage device such as a solid-state drive (SSD) or SD memory card, and stores various types of data, similar to the storage device 210. The network interface 247 is a communication module equipped with wireless communication capabilities for communicating with other devices connected to the network. The touch panel 249, like the touch panel 229, is a device equipped with both display and pointing functions, allowing the user to manipulate objects displayed on the display with their finger or a stylus. The proximity communication interface 250, vibrator 251, and speaker 252 have the same functions as the proximity communication interface 228, vibrator 230, and speaker 231, respectively.

[0022] The client terminal 102 in this invention is envisioned as an information processing terminal such as a smartphone, PC, or tablet computer, but is not limited to a specific device. For example, it may be a smart speaker or smart glasses that do not have a display or touch panel.

[0023] <Software configuration of client terminal 102> Figure 3(A) shows an example of the software configuration of client terminal 102.

[0024] Application 311 is an application for using the services provided by the Web service 341 of the server system 103. Application 311 consists of a display unit (UI) 312, a communication unit 313, an authenticator registration control unit 314, an authenticator authentication control unit 315, and a notification control unit 316.

[0025] Application 311 is a native application specialized for use with a web browser or web service 341. 312 is a display unit, a software module that executes and displays web content obtained from web service 341. Communication unit 313 is a software module for communicating with server system 103 and wearable terminal 101. Authenticator registration control unit 314 is a software module that requests the authenticator 331 to create credentials (described later) and generates requests to be sent to web service 341 when the authenticator is registered. Authenticator authentication control unit 315 requests authentication processing from the authenticator 331 and generates requests to be sent to web service 341 when authentication is performed. Notification control unit 316 is a software module that notifies and controls the user of the authentication result during authentication, which is a feature of the present invention. The conditions, timing, and patterns of notifications from the notification control unit 316 will be described later. The user can operate the display unit 312, and the communication unit 313 will communicate with the server system 103, allowing the user to access the services provided by the Web service 341.

[0026] The specific processing sequences, such as authenticator registration and user authentication, will be described later.

[0027] <Software configuration of wearable device 101> Figure 3(B) shows an example of the software configuration of the wearable device 101.

[0028] The display unit 325 is a software module for providing a GUI to the user via the touch panel 229. The communication unit 326 is a software module for communicating with external devices such as the client terminal 102 via the network interface 225.

[0029] The authenticator 331 is a group of authentication modules that execute processes related to biometric authentication using the biometric information sensor 226. In this embodiment, the wearable terminal 101 can function as an external authenticator (external authentication device) for the client terminal 102 when the authenticator 331 is executed.

[0030] The authenticator registration processing unit 332 is a software module that receives a request to create credentials from the authenticator registration control unit 314 and other units, and creates a pair of keys (private key and public key) and credentials. The biometric authentication processing unit 333 is a software module that receives a biometric authentication request from the authenticator authentication control unit 315 and performs biometric authentication using the biometric information sensor 226. The authentication information storage unit 334 is a software module that stores authentication information, such as that shown in the authentication information management table (Table 1), in the TPM 227. The biometric information request unit 335 is a software module that displays a UI on the touch panel 229 for accepting biometric information input from the user. Note that some types of wearable terminals 101 do not have a display output device for displaying UI such as the touch panel 229, so the display unit 325 is not a necessary component of the present invention, similar to the touch panel 229. The notification control unit 336 is a software module that notifies and controls the user of the authentication result during authentication, which is a feature of the present invention. The timing and patterns of notifications issued by the notification control unit 336 will be described later.

[0031] <Example of a table managed by the authenticator 331 of the wearable device 101> In the authentication information management table in Table 1, each record represents an entry for one piece of authentication information.

[0032] [Table 1]

[0033] The Authentication Information ID column stores a unique identifier (ID) for each piece of authentication information. The Service ID column stores the identifier (Service ID) used to identify the target service, such as Web service 341. In the Authentication Information Management Table, the domain name of each Web service is stored as the Service ID. The User ID column stores the user identifier (User ID) used by Web services, such as legacy authentication, to uniquely identify the user. Legacy authentication is an authentication method that verifies the match between the User ID and password, and is referred to as legacy authentication to distinguish it from biometric authentication. The Private Key column stores the identifier of the private key created by the Authenticator Registration Processing Unit 332. The public key corresponding to each private key managed by each identifier in the Private Key column will be registered and managed by the service on the network corresponding to the Service ID indicated in the Service ID column. The Biometric Information ID column stores the identifier (ID) corresponding to the biometric information features.

[0034] The procedure for storing the data managed in each column of the authentication information management table, and the procedure for sending and storing the public key in Web service 341, will be described later.

[0035] <Server software configuration> Figure 3(C) shows an example of the software configuration of the server system 103.

[0036] Web service 341 is a web service that provides services using communication protocols such as HTTP and requires user authentication. Web services are prepared for each service they provide. Specific examples include social networking services, e-commerce services, financial services, and websites for those services.

[0037] The server system 103 implements the Web service by having the CPU 201 read a program for providing the Web service, which is stored in the ROM 203 of the server system 103, into the RAM 202 and execute it. The legacy authentication processing unit 342 is a software module that verifies whether the user ID and password included in the legacy authentication request received by the communication unit 348 match the user ID and password stored in the user information storage unit 344. The authenticator information processing unit 343 is a software module that stores information about the authenticator in the authenticator information storage unit 345 using the credentials received by the communication unit 348. The authenticator information processing unit 343 also verifies the assertion information (described later) received by the communication unit 348. The user information storage unit 344 is a software module that stores user information (described later) using the user information management table. The authenticator information storage unit 345 is a software module that stores authenticator information (described later) using the authenticator information management table. The presentation unit 346 is a software module that creates HTML, CSS, JavaScript, etc., in response to requests from the communication unit 348 to acquire various screens of the Web service 341 from client terminals 102, etc. The token management unit 347 is a software module that issues and verifies tokens, as described later, using a token management table. The communication unit 348 is a software module that communicates with the client terminal 102 and accepts requests.

[0038] <Example of a table managed by server system 103> Table 2 is the user information management table, which is managed by the user information storage unit 344 of the Web service 341. In the user information management table, each record represents the account information of one registered user.

[0039] [Table 2]

[0040] The User ID column contains the user identifier (User ID) used to uniquely identify users of Web service 341. The Password column stores the password used to authenticate the user. This password is used for legacy authentication and is usually stored in a hashed state. The Email Address column stores the user's email address. In addition to the email address, other attribute information about the user, such as the user's address and profile, may also be stored in the User Information Management Table.

[0041] Table 3 is the attestation challenge management table, which is managed by the user information storage unit 344 of the Web service 341.

[0042] [Table 3]

[0043] The attestation challenge management table shown in Table 3 displays information for one attestation challenge per record. An attestation challenge is data issued when a user registers their credentials and is a parameter used as verification data for challenge-response authentication. The process of issuing attestation challenges will be described later. The attestation challenge column stores the attestation challenge. The user ID column represents the user ID to which the issued attestation challenge is associated. The expiration date column represents the expiration date of the attestation challenge.

[0044] Table 4 is the authenticator information management table, which is managed by the authenticator information storage unit 345 of the Web service 341.

[0045] [Table 4]

[0046] The authenticator information management table shown in Table 4 has one record representing one piece of authenticator information. The Authentication Information ID column stores the value of the Authentication Information ID column in the Authentication Information Management Table (Table 1). The Public Key column manages the information of the public key requested to be registered as credentials by the authenticator. This public key is the public key that forms a pair with the private key associated with the Authentication Information ID. In other words, for a key pair managed with the same Authentication Information ID, data encrypted with the private key on the authenticator side can be decrypted with the public key managed in the authenticator information management table on the Web service 341 side.

[0047] The User ID column stores a User ID for uniquely identifying a user using the Web service 341. The Notification Capability column is capability information indicating whether the wearable terminal 101 is equipped with a notification control unit 336 (i.e., whether it supports the notification function according to this embodiment). This information is used when making a notification decision, which is also a feature of the present invention.

[0048] Table 5 is the token management table, which is managed by the token management unit 347 of Web service 341.

[0049] [Table 5]

[0050] The tokens managed in Table 5 are issued by the token management unit 347 of Web service 341 after various authentication processes have been completed. When using Web service 341, application 311 can use the services provided by Web service 341 by sending a request with the issued token attached.

[0051] The token management table has a single record representing information for one token. The token column stores information about the token. The user ID column stores the user ID to uniquely identify users of Web service 341. The expiration date column indicates the token's expiration date.

[0052] Web service 341 accepts a request if the token attached to the request exists in the token column of the token management table and has not expired as indicated in the expiration date column.

[0053] <Authenticate registration process> The authenticator registration process shown in Figure 4 will be explained using Figures 5 and 6 as well. The process shown in Figure 4 represents the processing steps that are achieved by executing the corresponding program on each device. Here, we will explain an example of registering information created by the authenticator 331 of the wearable terminal 101. Hereafter, registering the information created by the authenticator 331 with the Web service 341 will simply be referred to as authenticator registration.

[0054] Figure 5 shows an example of parameters included in communication between the wearable terminal 101, the client terminal 102, and the server system 103. Figure 6 shows an example of a UI that is displayed and controlled by the display unit 312 of the application 311 during the authenticator registration process.

[0055] First, Figure 6(A) shows the authentication settings screen provided by application 311. Users press button 611 when they want to use an authentication method other than legacy authentication (password authentication) when using web service 341. The authentication settings screen is provided when user 401 has already been authenticated to web service 341 using legacy authentication or other methods.

[0056] In S411, application 311 receives registration instructions in response to the user's selection of button 611.

[0057] In S412, the authenticator registration control unit 314 of application 311 requests the authenticator registration screen from the Web service 341 via the communication unit 313.

[0058] In S413, the authenticator information processing unit 343 of the Web service 341 creates the registration parameters 510.

[0059] Here, the registration parameter 510 will be explained using Figure 5(A). The registration parameter 510 consists of account information 511, encryption parameter 512, attestation challenge 513, registration policy 514, and extension area 515. Account information 511 represents the user ID identified during authentication in Web service 341 and attribute information such as the email address associated with that user ID. Encryption parameter 512 indicates attribute information related to the authentication information to be registered, such as the encryption algorithm supported by Web service 341. Attestation challenge 513 is a parameter used as verification data for challenge-response authentication. The attestation challenge is created when creating the registration parameter in S413 and is stored in the attestation challenge management table (Table 3) associated with the user ID, expiration date, etc. Registration policy 514 is an optional parameter for specifying the type of authenticator that can be registered in Web service 341. A policy, for example, might be whether the wearable device 101 acting as an authenticator supports the authentication method specified by the Web service 341, or whether it possesses specific capabilities. The extended area 515 stores extended parameters that the Web service 341 can specify in order to control the operation of the authenticator 331 and the application 311.

[0060] In S414, the authenticator information processing unit 343 of the web service 341 sends the information from the authenticator registration screen to the application 311 as a response to the request in S412. The response sent also includes the registration parameters 510.

[0061] Figure 6(B) shows an example of a registration screen that is displayed on the touch panel 249 of the client terminal 102 by application 311 in response to the response in S414. When button 621 is operated by the user, the search process is executed in S415, and when button 622 is operated, the screen returns to the screen shown in Figure 6(A).

[0062] Figure 6(C) shows the screen displayed on the touch panel 249 while processes S415 to S416 are being executed.

[0063] In S415, the authenticator registration control unit 314 searches whether a device that can be used as an authenticator (external authenticator) is connected to the client terminal 102. Specifically, it sends a request to the wearable terminal, which is the connected device, to obtain authenticator information. If the authenticator program is running on the wearable terminal, it can respond to this request. In this embodiment, the authenticator registration control unit 314 sends this request to the communication unit 326 of the wearable terminal 101 via the communication unit 313 of the application 311.

[0064] The requested authenticator information also includes the authenticator's notification capabilities, as described in the authenticator information management table.

[0065] In S416, the authenticator registration processing unit 332 receives the request via the communication unit 326 of the wearable terminal 101 and then responds to the application 311 with authenticator information.

[0066] In S417, the authenticator registration control unit 314 checks whether the authenticator information obtained in S416 satisfies the conditions of the registration policy 514 included in the response in S414 and can be used as an authenticator for the Web service 341.

[0067] Figure 6(D) is the screen displayed on the touch panel 249 when the processing in S417 confirms that it can be used as an authenticator for the Web service 341. When the user selects button 641, S418 is executed and the screen shown in Figure 6(E) is displayed. When button 642 is selected, the screen returns to the screen shown in Figure 6(A).

[0068] Although not shown in the sequence in Figure 4, if the system is configured not to require user registration confirmation, such as by always using a fixed external authenticator, the screen in Figure 6(D) may be skipped and S418 may be executed. Furthermore, if no usable authenticator is found, or if the system is configured not to use an external authenticator, the process from S417 onwards may not be executed.

[0069] In S418, the authenticator registration control unit 314 of application 311 sends a credential creation request to the wearable terminal 101 via the communication unit 313. This credential creation request is received by the communication unit 326 of the wearable terminal 101 and transmitted to the authenticator registration processing unit 332. This credential creation request in S418 includes registration request data 520.

[0070] Here, we will explain the registration request data 520 using Figure 5(B). The registration request data 520 includes the registration parameters 510 received from Web service 341, the service ID 521 of Web service 341 as described in the authentication information management table (Table 1), and WebOrigin 522. WebOrigin 522 is information indicating the origin of Web service 341.

[0071] In S419, the authenticator registration processing unit 332 executes the process of acquiring the user's biometric information. Specifically, it internally instructs the biometric information sensor 226 to read the biometric information. In S420, the biometric information of user 401 wearing the wearable terminal 101 is detected via the biometric information sensor 226. In this invention, it is assumed that the detection of biometric information is performed simply by user 401 wearing the wearable terminal 101, without any operation on the wearable terminal 101.

[0072] In S421, the authenticator registration processing unit 332 of the authenticator 331 creates a biometric information ID that uniquely identifies the biometric information and the feature quantities of the read biometric information. In S422, the authenticator registration processing unit 332 of the authenticator 331 creates a private key and a public key pair and issues an authentication information ID. Then, the authenticator registration processing unit 332 stores the authentication information ID, private key, biometric information ID created in S421 and S422, as well as the service ID 521 included in the registration request data 520 and the user ID included in the registration parameter 510 in the authentication information storage unit 334.

[0073] In S423, the authenticator registration processing unit 332 of the authenticator 331 creates the credentials 530 shown in Figure 5(C). The credentials 530 consist of authentication information ID 531, algorithm 532, public key 533, attestation 534, and authenticator name 535.

[0074] Authentication information ID 531 and public key 533 are the public key created in the process of S422. Algorithm 532 corresponds to the algorithm used to create the private key and public key pair in S422. Attestation 534 is the attestation challenge 513 encrypted using the private key created in S422.

[0075] In S424, the notification control unit 336 uses at least one of the vibrator 230 or speaker 231 of the wearable terminal 101 to notify the user 401 that the input of biometric information is complete. The user 401 can recognize the notification by vibrations transmitted from the wearable terminal 101 or by a specific sound.

[0076] The notification method used in processing S424 varies depending on the type of wearable device 101. For example, a smartwatch may use vibration or tightening of the strap, earphones may use sound, and a smart ring may use flashing lights.

[0077] Furthermore, if the wearable terminal 101 does not have a notification control unit 329, a vibrator 230, a speaker 231, or other devices, the process in S424 can be skipped, and in S429 (described later), the application 311 can take its place and notify the user 401 that the input of biometric information has been completed.

[0078] In S425, the authenticator registration processing unit 332 of the authenticator 331 responds to the application 311 of the client terminal 102 with the credentials 530 created in S423.

[0079] In S426, the authenticator registration control unit 314 sends a registration processing request, including registration data 540, to the Web service 341 via the communication unit 313.

[0080] Here, we will explain the registration data 540 using Figure 5(D). 540 is registration data and consists of credentials 530 and capability information 541. Credentials 530 are the credentials created in S423. Capability information 541 is the authenticator information of the wearable terminal 101 acquired in S415-S416.

[0081] In S427, the authenticator information processing unit 343 of the Web service 341 performs authenticator registration processing using the registration data 540 received in the registration processing request of S426. The registration processing includes verification processing by decrypting the attestation 534 contained in the credentials 530 of the registration data 540 with the public key 533 contained in the same credentials 530. Furthermore, the authenticator information processing unit 343 of the Web service 341 identifies records where the value decrypted from attestation 534 with the public key 533 is identical to the value in the attestation challenge column in the attestation challenge management table (Table 3). Then, it identifies the user ID of the record with the same value in the identified attestation challenge column as the ID to be linked to credentials 530. The authenticator information processing unit 343 of Web service 341 registers the authentication information ID 531, public key 533, and identified user ID and capability information 541 contained in the credentials 530 in the authenticator information management table. In S428, the authenticator information processing unit 343 of Web service 341 responds to application 311 via the communication unit 348 that the authenticator registration process has been successfully completed.

[0082] In S429, the authenticator registration control unit 314 of the Web service 341 makes a notification decision based on the notification capability included in the authenticator information of the wearable terminal 101 acquired in S415-S416. If the authenticator registration control unit 314 determines that the wearable terminal 101 has "no" notification capability, it calls the notification control unit 316 and, instead of the step in S424, notifies the user 401 that the input and registration process of biometric information has been completed.

[0083] For example, Figure 6(F) is the screen displayed when the authenticator registration control unit 314 executes the process shown in S429. If the client terminal 102 has an output device such as a touch panel 249 or a vibrator 251, it will notify the client terminal 102 that the registration process has been completed by displaying a screen like Figure 6(F) or by vibrating the client terminal 102.

[0084] Furthermore, if the client terminal 102 is a device that performs input and output only via voice, such as a smart speaker, the display content shown in Figure 6 will be implemented via voice.

[0085] <Modified example of the process related to Figure 6(D)> Figure 11(A) shows a modified version of the screen shown in Figure 6(D). Specifically, it is an example where multiple wearable devices are found to be usable as authenticators for the Web service 341. Figure 11(B) is an example where, in addition to multiple wearable devices, the internal authenticator of the client terminal 102 itself can also be used as an authenticator for the Web service 341.

[0086] Figures 11(A) and 11(B) illustrate multiple wearable devices, including a "○○ smartwatch" and "△△ wireless earphones." When either button 1101 or 1102 is selected by the user, a request to create credentials is sent to the wearable device corresponding to the button, and processing from S418 onwards is executed.

[0087] If the cancel button 1104 is selected in Figure 11(A)(B), the screen returns to Figure 6(A).

[0088] In Figure 11(B), when button 1103 is selected, a request to create credentials is sent to the internal authenticator implemented in the client terminal 102. In this case, the processes from S419 to S425 are executed by the internal authenticator using the biometric information acquired using the biometric information sensor in the client terminal 102.

[0089] <Authentication process> Figure 7 shows the sequence of events when user 401 uses a web service 341 that requires authentication from application 311. The processes shown in Figure 7 represent processing steps that are achieved by executing the corresponding programs on each device.

[0090] Figure 8 shows an example of parameters used for authentication. Figure 9 shows an example of a screen that the display unit 312 of application 311 controls to display in accordance with the process shown in Figure 7.

[0091] In this embodiment, similar to the authenticator registration process, the authentication process also provides a mechanism to notify the user 401 that the process is complete after biometric information has been entered. Here, using Figures 7, 8, and 9, we will explain an example of the authentication process when purchasing goods on a Web service 341 (e-commerce site).

[0092] First, Figure 9(A) shows the screen when the content provided by the presentation unit 346 of the Web service 341 is displayed by the display unit 312 of the application 311.

[0093] In S711, application 311 receives instructions in response to user 401's selection operation on button 911. In S712, the authenticator authentication control unit 315 of application 311 sends a request related to product purchase to web service 341.

[0094] In S713, the authenticator information processing unit 343 of the web service 341 creates authentication parameters 810 for user authentication. In S714, the authenticator information processing unit 343 of the web service 341 sends the authentication parameters 810 created in S713 to the application 311.

[0095] Figure 8(A) shows the authentication parameter 810. The authentication parameter 810 consists of an Assertion Challenge 811 and an Assertion Extension Area 812. The Assertion Challenge 811 is a parameter used as verification data for challenge-response authentication. The Assertion Extension Area 812 stores extension parameters that the Web service 341 can specify in order to control the operation of the authenticator 331 and the application 311. In this case, the authenticator capability information 541 assigned in S426 is included in this Assertion Extension Area 812.

[0096] In step S715, the authenticator authentication control unit 315 of application 311 sends an authentication request to the biometric authentication processing unit 333 of authenticator 331 using the authentication request parameters. At this time, the display unit 312 displays the screen shown in Figure 9(B).

[0097] Figure 8(B) shows the authentication request parameter 820. The authentication request parameter 820 consists of the authentication parameter 810, the service ID 821, and the WebOrigin 822. The service ID 821 and WebOrigin 822 are the same as those described in Figure 5(B).

[0098] In S716, the biometric information request unit 335 of the authenticator 331 executes the process of acquiring the user's biometric information. Here, the same process as in S419 is executed. In S717, the biometric information of user 401 wearing the wearable terminal 101 is detected via the biometric information sensor 226. In this invention, it is assumed that the detection of biometric information is performed simply by the user 401 wearing the wearable terminal 101, without any operation on the wearable terminal 101.

[0099] In S718, the biometric authentication processing unit 333 of the authenticator 331 performs user authentication by comparing the biometric information detected via the biometric information sensor 226 with the biometric information stored in the TPM 227. While feature point extraction and pattern matching methods are generally known as matching algorithms, the present invention does not particularly limit the matching algorithm. Subsequently, the authentication information storage unit 334 identifies the corresponding secret key from the authentication information management table based on the biometric information stored in the TPM 227. Then, signature (832) data is created from the attestation challenge 811 included in the authentication parameter 810 and the identified secret key. Furthermore, the biometric authentication processing unit 333 creates assertion information 830 containing the authentication information ID 831 and signature 832 identified from the authentication information management table (Table 1).

[0100] S719 is the process in which the notification control unit 336 of the authenticator 331 issues a notification. In S718, the notification control unit 336 notifies the user 401 of the result of biometric authentication using a vibrator 230, speaker 231, etc. In S719, the notification control unit 336 can change the notification pattern according to the authentication result in S718. For example, if the wearable terminal 101 used as an external authenticator is an earphone, if the authentication performed automatically while wearing it is successful, it will play a voice message such as "Authentication successful," and if it fails, it will play a voice message such as "Authentication failed." Also, in S719, as with authenticator registration, the wearable terminal 101 may not have devices such as the notification control unit 329, vibrator 230, or speaker 231. In that case, the notification process in S719 is skipped, and in S728, described later, the application 311 takes its place and notifies the user 401 that the input of biometric information and authentication have been completed.

[0101] In S720, the biometric authentication processing unit 333 of the authenticator 331 returns the assertion information 830 created in S718 to the application 311.

[0102] In step S721, the authenticator authentication control unit 315 of application 311 transmits the assertion information 830 received from the biometric authentication processing unit 333 to the web service 341.

[0103] In S722, the authenticator information processing unit 343 of the web service 341 verifies the assertion information 830 received from application 311. The authenticator information processing unit 343 decrypts the signature 832 of the assertion information 830 using the public key identified by the authentication information ID 831, and verifies the signature by determining whether it matches the attestation challenge 811 included in the authentication parameter 810 created in S713. The authenticator information management table is used to identify the public key. If the verification is successful, in S723, the token management unit 347 of the web service 341 issues a token and manages information about that token in the token management table. In S724, the token management unit 347 of the web service 341 returns the token issued in S723 to application 311.

[0104] In S725, the authenticator authentication control unit 315 uses the token received in S724 to send a request for product purchase to the web service 341.

[0105] In S726, the token management unit 347 verifies the token attached to the request in S725, and if successful, executes the purchase process corresponding to the request. In S727, the web service 341 returns a response to the application 311 indicating that the purchase process is complete.

[0106] In S728, the authenticator authentication control unit 315 of the Web service 341 determines whether to notify the authentication result based on the capability information 541 contained in the Assertion extension area 812 of the authentication parameter 810 returned in S714.

[0107] Similar to the authenticator registration process, the authenticator authentication control unit 315 calls the notification control unit 316 if it determines that the wearable terminal 101 has no notification capability. Then, instead of processing S719, it notifies the user 401 that the authentication process and the purchase process S726 have been completed.

[0108] For example, Figure 9(C) is the screen displayed when S728 is executed by the authenticator authentication control unit 315. The notification pattern in S728 is not limited in any particular way, as it differs depending on the device equipped on the client terminal 102, such as UI display, sound, or vibration, just like when authenticator registration. If the authenticator authentication control unit 315 determines in S728 that the wearable terminal 101 has notification capability, it is not necessary to notify that authentication is complete as in Figure 9(C), and the screen transitions to Figure 9(D).

[0109] In Example 1, the authenticator 331 of the wearable terminal 101 is equipped with a notification control unit 336, which notifies the user 401 that biometric information has been entered and the authenticator registration and authentication process has been executed. The method for notifying the user 401 by the notification control unit 316 on the client terminal 102 side, even if the wearable terminal 101 is not equipped with a notification control unit 336, has also been described. With this system, even when a wearable terminal that does not require user operation for authentication is used as the authenticator, the user can understand at an appropriate time that biometric information has been entered and the authenticator registration and authentication process has been successfully executed.

[0110] (Example 2) In Example 1, the authenticator registration processing unit 332 and the biometric authentication processing unit 333 of the authenticator 331 simply called the notification control unit 336 after completing the processing in S423 and S718 to notify the user 401. However, depending on the services provided by the Web service 341 used by user 401, it may be desirable to control whether or not a notification is sent and the notification pattern.

[0111] For example, in a system that frequently requires authentication while using a service, some users may find it annoying to be notified each time that authentication is complete. Furthermore, even with the same authentication process, there may be cases where the notification pattern needs to change depending on the operation on the Web service 341.

[0112] In light of the above case, it is possible to implement the system to additionally store control information related to notifications in the extended area 515 of the registration parameter 510 when registering an authenticator, and in the assertion extended area 812 of the authentication parameter 810 when authenticating. This control information is information that can be interpreted by the notification control unit 336 of the wearable terminal 101, and in S424 and S719, the notification control unit 336 determines whether or not to send a notification according to the value of this control information. More specifically, it is possible to control the system to send a notification only when the value of the control information indicates that a notification is necessary. It is also possible to implement the system to change the notification pattern (message content, LED lighting pattern, etc.) depending on the value of the control information.

[0113] Furthermore, if the extended area 515 and the assertion extended area 812 do not contain control information, the processing shown in Example 1 may be performed.

[0114] This embodiment of the extension makes it possible to control notifications from the wearable device 101 from the Web service 341.

[0115] (Example 3) In Example 1, the notification control unit 336 issued notifications such as S424 and S719 when biometric authentication as an external authenticator on the wearable terminal 101 was successful.

[0116] Example 3 describes a method for notifying the user when processing by Web service 341 is complete. In this example, we will avoid repeating explanations with Examples 1 and 2 described above and will explain the differences in detail.

[0117] Figure 10 is a sequence diagram of the authentication sequence in Example 1, but with the notification timing changed. The difference is that the notification process at S719 is omitted, and processes at S1029 and S1030 are added.

[0118] In S728, the presence or absence of notification capability of the wearable terminal 101 and whether notification is necessary are checked simultaneously. If it is determined that notification is necessary on the wearable terminal 101, in S1029, the authenticator authentication control unit 315 sends a notification request to the authenticator 311.

[0119] In S1030, the notification control unit 336 of the authenticator 311, upon receiving the notification request, executes notification control intended to indicate that a series of processes, including the authentication process, has been completed. This notification control may be the same process as the notification process in S719, or it may be a notification that allows the completion of the process to be directly confirmed.

[0120] In Examples 1 and 2, if communication between the client terminal 102 and the server system 103 fails during processing from S426 and S721 onward, the sequence shown in Figures 4 and 7 will terminate abnormally. In this case, even though the entire sequence did not complete successfully, the notification control unit 336 of the wearable terminal 101 notifies the user 401 of successful authentication in S424 and S719, raising concerns that this may give the user the false impression that the purchase process was successful.

[0121] On the other hand, according to this embodiment, the timing of the notification is after the processing in Web service 341 is completed, which may resolve such misunderstandings.

[0122] Furthermore, by combining Example 1 and Example 3, the present invention also makes it possible to send different notifications at both S719 in Example 1 and S1030 in Example 3, thereby notifying the user separately of authentication success and processing completion.

[0123] (Other examples) The present invention also includes apparatuses, systems, and methods configured by appropriately combining the embodiments described above.

[0124] Here, the present invention is a device or system that is the main body for executing one or more software programs that realize the functions of the embodiments described above. Furthermore, a method for realizing the embodiments described above that are executed on that device or system is also part of the present invention. In addition, the program is supplied to the system or device via a network or various storage media, and the program is read into one or more memories by one or more computers (CPU, MPU, etc.) of the system or device and executed. In other words, as part of the present invention, the program itself or various storage media that can be read by the computer storing the program are also included. Furthermore, the present invention can also be realized by a circuit (e.g., ASIC) that realizes the functions of the embodiments described above. [Explanation of Symbols]

[0125] 101 Wearable devices 102 Client terminals 103 Server 105 Network

Claims

1. An information processing device that executes an application capable of controlling authentication processing using an external authenticator connected to the information processing device, A first transmission means that sends a request to a system that communicates over a network, A first receiving means for receiving verification data from the system, A request means for sending an authentication request containing the aforementioned verification data to an external authenticator worn by the user, After the external authenticator performs authentication in accordance with the authentication request and the external authenticator issues a first notification to the user, a second receiving means receives signature data generated by the external authenticator using the secret key identified by the authentication from the external authenticator. A second transmission means for transmitting the aforementioned signature data to the system, A third receiving means that receives data based on the result of the verification process of the signature data using a public key registered in the system, An information processing device comprising: a third transmitting means that, in response to the reception of data by the third receiving means, transmits a notification request to the external authenticator in order to cause the external authenticator to issue a second notification to the user.

2. Furthermore, the information processing apparatus according to claim 1 is characterized by having control means for controlling a display for the user wearing the external authenticator in response to at least one of the results of biometric authentication in response to the authentication request and the reception of data by the third receiving means.

3. The information processing apparatus according to claim 2, wherein the control means controls the display when the external authenticator does not support the notification function.

4. The information processing device according to any one of claims 1 to 3, characterized in that the first notification to the user by the external authenticator is made in accordance with control information relating to the notification included in the authentication request.

5. The information processing device according to claim 1 to 4, characterized in that the external authenticator is a smartwatch, earphones, or smart ring that can perform biometric authentication while being worn by the user.

6. A method in an information processing device for controlling authentication processing using an external authenticator connected to the information processing device, A first transmission step involves sending a request to a system that communicates over a network, A first receiving step of receiving data for verification from the system, A request step of sending an authentication request containing the aforementioned verification data to an external authenticator worn by the user, After the external authenticator performs authentication in accordance with the authentication request and the external authenticator issues a first notification to the user, a second receiving step is performed in which the external authenticator receives signature data generated by the external authenticator using the secret key identified by the authentication. A second transmission step of transmitting the signature data to the system, A third receiving step, which receives data based on the result of the verification process of the signature data using a public key registered in the system, A third transmission step in which, in response to the reception of data in the third reception step, a notification request is sent to the external authenticator in order to cause the external authenticator to give a second notification to the user, A method characterized by having the following:

7. A program for causing a computer to function as the means described in any one of claims 1 to 5.

8. An authenticator that can be connected as an external authenticator to an information processing device that runs an application capable of controlling authentication processing using an external authenticator, is worn by the user of the information processing device, and is equipped with a notification means, A detection means for detecting the user's biometric information in response to receiving an authentication request from the information processing device, Authentication means for performing biometric authentication using the aforementioned biometric information, A control means that, when the biometric authentication is performed in accordance with the authentication request, issues a first notification by the notification means corresponding to the fact that the biometric authentication has been performed, If the biometric authentication is successful, a generation means generates signature data using the verification data included in the authentication request and the private key corresponding to the biometric information. A transmission means for transmitting the signature data to the information processing device, The system includes a receiving means for receiving a notification request based on the result of the signature data verification process from the information processing device, The authenticator is further characterized in that the control means makes a second notification to the user by the notification means in response to the notification request received from the information processing device.

9. The authenticator according to claim 8, characterized in that the first notification to the user by the authenticator is made in accordance with control information relating to the notification included in the authentication request.

10. The authenticator according to claim 8 or 9, characterized in that the authenticator is one of a smartwatch, earphones, or smart ring that can perform biometric authentication while being worn by the user.

11. The authenticator according to any one of claims 8 to 10, characterized in that the notification is a notification by sound or vibration.

12. A method for an authenticator that can be connected as an external authenticator to an information processing device that runs an application capable of controlling authentication processing using an external authenticator, is worn by a user of the information processing device, and is equipped with a notification means, Upon receiving an authentication request from the aforementioned information processing device, the user's biometric information is verified. The detection process for outputting, An authentication step that performs biometric authentication using the aforementioned biometric information, A step of providing a first notification by the notification means when the biometric authentication is performed in accordance with the authentication request, in which case the biometric authentication has been performed. If the biometric authentication is successful, a generation step is performed to generate signature data using the verification data included in the authentication request and the secret key corresponding to the biometric information. A transmission step of transmitting the signature data to the information processing device, A receiving step of receiving a notification request based on the result of the signature data verification process from the information processing device, The process of making a second notification to the user using the notification means in response to the notification request received from the information processing device, A method characterized by having the following:

13. A program for causing a computer to function as the means described in any one of claims 8 to 11.

Images