Patent Publication Number: US-2018048471-A1

Title: System and storage medium

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
     This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2016-158208, filed on Aug. 10, 2016, the entire contents of which are incorporated herein by reference. 
     FIELD 
     The embodiments discussed herein are related to a system and a storage medium. 
     BACKGROUND 
     Conventionally, devices, such as Internet of Things (IoT) devices, such as a sensor, a wristwatch, a camera, a printer, an electronic lock, or the like, which is coupled to the Internet and provides various types of services, have been known. 
     It has been known that, among the devices, some devices have a function of performing user authentication for security reasons. For example, the related art is disclosed in Japanese Laid-open Patent Publication No. 2009-049464, Japanese Laid-open Patent Publication No. 2003-143136, and Japanese Laid-open Patent Publication No. 2015-203947. 
     SUMMARY 
     According to an aspect of the invention, a system includes circuitry configured to store, as information that identifies an authentication method, identification information shared with an authentication device that performs authentication of a user of an information processing device in association with an event that occurs in accordance with an operation of the information processing device, which is performed by the user, into a memory, transmit, when the event occurs, the identification information stored in association with the event in the memory to the authentication device, receive a result of the authentication of the user by the authentication method in accordance with the identification information in the authentication device from the authentication device, and execute, when the result of the authentication of the user indicates a success, processing in accordance with the event that has occurred. 
     The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
     It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  is a view illustrating a configuration example of an information processing system according to a first embodiment; 
         FIG. 2  is a diagram illustrating a hardware configuration example of an information processing device according to the first embodiment; 
         FIG. 3  is a diagram illustrating an example of a functional configuration of each of the information processing device and an information terminal according to the first embodiment; 
         FIG. 4  is a sequence diagram illustrating an example of setting processing of the information processing system according to the first embodiment; 
         FIG. 5  is a view illustrating an example of a list display screen of an authentication method in accordance with an event; 
         FIG. 6  is a table illustrating an example of an authentication information storage unit; 
         FIG. 7  is a table illustrating an example of an authentication event storage unit; 
         FIG. 8  is a sequence diagram illustrating an example of authentication processing of the information processing system; 
         FIG. 9  is a view illustrating a configuration example of an information processing system according to a second embodiment; and 
         FIG. 10  is a sequence diagram illustrating an example of setting processing of the information processing system according to the second embodiment. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     In the devices, in performing user authentication, a dedicated hardware exclusively used for user authentication is desired to be added. The adding the dedicated hardware leads to increase in load, such as increase in cost, power consumption, or the like. 
     Therefore, according to an aspect, it is an object of the present disclosure to provide a technology that enables reduction in load of a device that is operated by a user for performing user authentication. 
     Embodiments of the present disclosure will be described below with reference to the accompanying drawings. 
     First Embodiment 
     &lt;System Configuration&gt; 
       FIG. 1  is a view illustrating a configuration example of an information processing system according to a first embodiment. In  FIG. 1 , an information processing system  1  includes an information processing device  10  and an information terminal  20 . 
     The information processing device  10  and the information terminal  20  are coupled to one another so as to be communicable with one another, for example, via a short-range wireless communication or a wireless local area network (LAN). 
     The information processing device  10  is, for example, a smartphone, a tablet type terminal, a personal computer (PC), or the like. 
     The information processing device  10  authenticates a user, based on biological information, such as a fingerprint, a face image, or the like, and notifies the information terminal  20  of an authentication result. Specifically, among smartphones or the like, ones which have a function of performing biological authentication, such as fingerprint authentication, face authentication, or the like, have been known. Also, a technology called First Identity Online (FIDO) in which a user is authenticated by biological authentication and an authentication result thereof is reported to a server side has been known. According to FIDO, compared to a method in which a conventional password is notified to the server side and authentication is performed at the server side, a leakage of authentication information, such as a password or the like, from the server side does not occur. In this embodiment, the information processing device  10  provides a service of user authentication to the information terminal  20  using the above-described function. 
     The information terminal  20  is, for example, a sensor, a wristwatch, a camera, a printer, an electronic lock, or the like. 
     In accordance with an operation of a user or the like, the information terminal  20  requests the information processing device  10  for user authentication and acquires a result of user authentication from the information processing device  10 . 
     &lt;Hardware Configuration&gt; 
       FIG. 2  is a diagram illustrating a hardware configuration example of the information processing device  10  according to the first embodiment. The information processing device  10  of  FIG. 2  includes a drive device  100 , an auxiliary storage device  102 , a memory device  103 , a CPU  104 , an interface device  105 , or the like, which are mutually coupled to one another via a bus B. 
     An information processing program that realizes processing in the information processing device  10  is provided by a recording medium  101 . When the recording medium  101  in which the information processing program is recorded is set in the drive device  100 , the information processing program is installed in the auxiliary storage device  102  from the recording medium  101  via the drive device  100 . However, there may be a case where the information processing program is not installed from the recording medium  101 , and the information processing program may be downloaded from some other computer via a network. The auxiliary storage device  102  stores the installed information processing program, and also, stores a file, data, or the like which are to be used. 
     When an instruction for starting up a program is given, the memory device  103  reads out the program from the auxiliary storage device  102  and stores the program. The CPU  104  realizes a function related to the information processing device  10  in accordance with the program stored in the memory device  103 . The interface device  105  is used as an interface used for coupling with the network. 
     Note that, as an example of the recording medium  101 , a portable recording medium, such as CD-ROM, a DVD disk, USB memory, or the like, is used. Also, as an example of the auxiliary storage device  102 , a hard disk drive (HDD), flash memory, or the like is used. Each of the recording medium  101  and the auxiliary storage device  102  corresponds to a computer-readable recording medium. 
     Also, the information processing device  10  may include a hardware, such as a camera, a fingerprint acquiring device, or the like, which acquires biological information of a user. 
     A hardware configuration of the information terminal  20  may be similar to the hardware configuration example of the information processing device  10  illustrated in  FIG. 2 . 
     &lt;Functional Configuration&gt; 
     Next, with reference to  FIG. 3 , a functional configuration of each of the information processing device  10  and the information terminal  20  according to the first embodiment will be described.  FIG. 3  is a diagram illustrating an example of a functional configuration of each of the information processing device  10  and the information terminal  20  according to the first embodiment. 
     &lt;&lt;Information Processing Device&gt;&gt; 
     The information processing device  10  includes an authentication information storage unit  11 . The authentication information storage unit  11  is realized, for example, using an auxiliary storage device or the like. Details of the authentication information storage unit  11  will be described later. 
     Also, the information processing device  10  includes an authentication setting unit  12 , a generation unit  13 , a user authentication unit  14 , and a communication unit  15 . Each of the units is realized by processing that each of one or more programs installed in the information processing device  10  causes the CPU of the information processing device  10  to execute. 
     The authentication setting unit  12  sets authentication information, such as a temporary ID (TID), an authentication method, or the like in accordance with an event of the information terminal  20  to the authentication information storage unit  11 . Note that TID is information that identifies the event in the information terminal  20 . 
     The generation unit  13  generates TID, a public key of a key, and a secret key of the key in accordance with the event of the information terminal  20 . 
     The user authentication unit  14  performs user authentication using biological information, such as a fingerprint, a face image, or the like, or a password or the like. 
     When the communication unit  15  receives a beacon from the information terminal  20  in a stage of authentication processing, which will be described later, the communication unit  15  switches a communication mode from a peripheral mode in which a request from another device may be received to a host mode in which a request is transmitted to another device. Thus, a communication is performed between the information terminal  20  and the information processing device  10 . When the information terminal  20  has a capability of switching its communication mode to the host mode, in accordance with an instruction of the communication unit  15 , a communication unit  25  switches the communication mode to the host mode and the communication unit  15  switches the communication mode to the peripheral mode again. Thus, a request for user authentication from the information terminal  20  is received by the information processing device  10 . When the information terminal  20  does not have a host function, the information processing device  10  polls the communication unit  25  without performing switching of a communication and receives a request for user authentication. 
     The communication unit  15  performs control of encryption or the like of a communication with the information terminal  20 . 
     &lt;&lt;Information Terminal&gt;&gt; 
     The information terminal  20  includes an authentication event storage unit  21 . The authentication event storage unit  21  is realized, for example, using an auxiliary storage device or the like. Details of the authentication event storage unit  21  will be described later. 
     The information terminal  20  includes an authentication policy setting unit  22 , an authentication processing unit  23 , a processing unit  24 , and the communication unit  25 . Each of the units is realized by processing that each of one or more programs installed in the information terminal  20  causes the CPU of the information terminal  20  to execute. 
     The authentication policy setting unit  22  sets an authentication method for authenticating a user or the like in the information processing device  10  in accordance with an event of a predetermined operation or the like for which user authentication is to be performed in the information terminal  20  in the authentication event storage unit  21 . 
     When the event of the predetermined operation for which user authentication is to be performed in the information terminal  20  or user authentication occurs in order for the information terminal  20  to receive an Internet service, the authentication processing unit  23  requests the information processing device  10  for user authentication and acquires a result of the user authentication. 
     If the result of user authentication, which has been acquired by the authentication processing unit  23 , is successful, the processing unit  24  executes processing in accordance with the event of the predetermined operation or the like. Also, when user authentication for receiving an Internet service is performed, a user authentication result is transmitted to a service as it is. 
     The communication unit  25  performs control of encryption or the like of a communication with the information processing device  10 . 
     &lt;Processing&gt; 
     &lt;&lt;Setting Processing&gt;&gt; 
     Next, with reference to  FIG. 4 , setting processing of the information processing system  1  according to the first embodiment will be described. Note that the setting process is preparatory processing which is performed before performing user authentication.  FIG. 4  is a sequence diagram illustrating an example of setting processing of the information processing system  1  according to the first embodiment. 
     In Step S 101 , the authentication setting unit  12  of the information processing device  10  receives an input of an initial password set for the information terminal  20  from the user. Note that the initial password is a password set in advance at the time of shipping of the information terminal  20  or the like and, for example, is described in a manual of the information terminal  20  or the like. 
     Subsequently, the authentication setting unit  12  of the information processing device  10  performs communication connection (pairing) with the information terminal  20  using the password (Step S 102 ). 
     Subsequently, the authentication policy setting unit  22  of the information terminal  20  requests the information processing device  10  for a setting of an authentication function (Step S 103 ). 
     Subsequently, the authentication setting unit  12  of the information processing device  10  requests the information terminal  20  for an authentication policy (Step S 104 ). 
     Subsequently, the authentication policy setting unit  22  of the information terminal  20  transmits the authentication policy to the information processing device  10  (Step S 105 ). 
     In this case, the authentication policy includes an event name and information of an authentication method. The event name is the name of an operation (an event) that is planned for the information terminal  20  and is, for example, when the information terminal  20  is an electronic lock, is “unlock”, “lock”, or the like. The authentication method is information that indicates a method for user authentication and is, for example, “biological authentication”, “no authentication”, “biological information protection by hardware”, or the like. 
     Step S 106  to Step S 111 , which will be described below, are executed for each event name included in the authentication policy. An event that is a processing target will be hereinafter referred to as a “target event”. 
     Subsequently, the authentication setting unit  12  of the information processing device  10  selects an authentication method that matches an authentication method included in the received authentication policy from a group of authentication methods that may be executed in the information processing device  10  and displays a list of the selected authentication methods (Step S 106 ). 
       FIG. 5  is an example of a list display screen of authentication methods in accordance with an event. In  FIG. 5 , an example of a display screen of the information processing device  10  when “unlock”, and “biological authentication” and “biological information protection by hardware” are designated as the name of a target event, and the authentication method, respectively, from the information terminal  20 . 
     Subsequently, the authentication setting unit  12  of the information processing device  10  receives a selection operation of selecting an authentication method from the user (Step S 107 ). 
     Subsequently, the generation unit  13  of the information processing device  10  generates a temporary ID (TID), a public key of a key, a secret key of the key, a guarantee certificate that correspond to the target event (Step S 108 ). 
     In this case, TID includes, for example, information that identifies the information terminal  20 , information that identifies the authentication method, a random number used for alteration check for a communication address of the information terminal  20 , of the like. 
     The guarantee certificate includes information that guarantees that a condition of the authentication method requested by the information terminal  20  is satisfied. 
     Note that, when biological information that corresponds to the authentication method selected in the Step S 106  has not been registered, a registration of biological information is received from the user. 
     Subsequently, the authentication setting unit  12  of the information processing device  10  stores the TID, the authentication method selected in the Step S 106 , and the secret key of the key in association with one another in the authentication information storage unit  11  (Step S 109 ). 
       FIG. 6  is a table illustrating an example of the authentication information storage unit  11 . In the authentication information storage unit  11 , the TID, the authentication method, and the secret key are stored in association with one another. 
     Subsequently, the authentication setting unit  12  of the information processing device  10  transmits the event name of the target event, the TID, the public key of the key, the secret key of the key, the guarantee certificate to the information terminal  20  (Step S 110 ). 
     Subsequently, the authentication policy setting unit  22  of the information terminal  20  verifies the received guarantee certificate (Step S 111 ). Note that, when the guarantee certificate has been encrypted by the secret key of the key, verification of the guarantee certificate may be performed by decrypting the guarantee certificate using the received public key of the key. 
     Subsequently, the authentication policy setting unit  22  of the information terminal  20  stores the TID and the public key of the key, which have been received, in the authentication event storage unit  21  (Step S 112 ). 
       FIG. 7  is a table illustrating an example of the authentication event storage unit  21 . In the authentication event storage unit  21 , the event name, the TID, and the public key of the key are stored in association with one another for each event. 
     Modified Example 
     The authentication information storage unit  11  and the authentication event storage unit  21  may be updated with a plurality of timings, such as, for example, a regular timing or the like. In this case, for example, the generation unit  13  of the information processing device  10  generates the public key of the key and the secret key of the key at a timing of a predetermined cycle or the like. 
     Then, the authentication setting unit  12  of the information processing device  10  updates data of the key associated with a predetermined TID in the authentication information storage unit  11  using the generated key, and notifies the information terminal  20  of the TID and the public key of the key. 
     Then, the authentication policy setting unit  22  of the information terminal  20  updates the public key of the key associated with the received TID in the authentication event storage unit  21 . 
     Thus, the resistance to an attack to the key is increased. 
     &lt;&lt;Authentication Processing&gt;&gt; 
     Next, with reference to  FIG. 8 , authentication processing of the information processing system  1  in accordance with the first embodiment will be described.  FIG. 8  is a sequence diagram illustrating an example of authentication processing of the information processing system  1 . 
     In Step S 201 , the processing unit  24  of the information terminal  20  receives a predetermined operation from the user. 
     Subsequently, the authentication processing unit  23  of the information terminal  20  transmits a TID associated with an event of the predetermined operation in the authentication event storage unit  21  to the information processing device  10  via the communication unit  25  (Step S 202 ). In this case, the communication unit  25  encrypts identification information used for a communication of the information terminal  20  using the TID. For example, the communication unit  25  encrypts at least a part of an MAC address of the information terminal  20  or the like using at least a part of the TID as a random number. 
     Subsequently, the communication unit  15  of the information processing device  10  checks, using the received TID, whether or not the identification information used for the communication of the information terminal  20  has been altered (Step S 203 ). 
     Subsequently, the user authentication unit  14  of the information processing device  10  selects the authentication method associated with the received TID from the authentication information storage unit  11  and displays a screen in accordance with the selected authentication method (Step S 204 ). In the screen, for example, a message that urges the user to input biological information, a password, or the like in accordance with the authentication method. 
     Subsequently, the user authentication unit  14  of the information processing device  10  acquires, from the user, biological information in accordance with the selected authentication method (Step S 205 ). 
     Subsequently, the user authentication unit  14  of the information processing device  10  performs user authentication, such as biological authentication or the like (Step S 206 ). 
     Subsequently, the communication unit  15  of the information processing device  10  encrypts the TID and a result of the user authentication using the secret key stored in the authentication information storage unit  11  in association with the TID and notifies the information terminal  20  of the TID and the result that have been encrypted (Step S 207 ). The result of the user authentication is information that indicates a success or a failure of the user authentication. 
     Subsequently, the authentication processing unit  23  of the information terminal  20  decrypts the TID and a result of biological authentication using the public key of the key (Step S 208 ). 
     Subsequently, if decryption was successful and the decrypted result of the biological authentication was successful, the processing unit  24  of the information terminal  20  performs processing in accordance with the predetermined operation received in Step S 201  (Step S 209 ). For example, when the information terminal  20  is an electronic lock and the predetermined operation is an unlocking operation, the processing unit  24  performs unlocking. 
     On the other hand, if decryption failed, or if decryption was successful but the decrypted result of biological authentication was a failure, the processing unit  24  does not perform the processing in accordance with the predetermined operation. This is because a failure of decryption failed indicates that the authentication result was not a notification from the information processing device  10 , which that has been registered in advance for the purpose of authenticating the user of the information terminal  20 . 
     Note that management of an API used for authentication in this embodiment is performed separately from management of another API and, while authentication processing is being performed, the information terminal  20  limits calls to other APIs than the API used for authentication. Thus, if an unauthorized application has been installed in the information processing device  10 , a call of the predetermined API from the application is limited. 
     Second Embodiment 
     In the first embodiment, an example in which, in setting processing, a TID or the like is directly set from the information processing device  10  to the information terminal  20  has been described. In a second embodiment, an example in which, in setting processing, a TID or the like is set to the information terminal  20  from the information processing device  10  via a server device  30  will be described. Note that, except for a part, the second embodiment is similar to the first embodiment, and therefore, the description of the second embodiment will be omitted as appropriate. 
     &lt;System Configuration&gt; 
       FIG. 9  is a view illustrating a configuration example of an information processing system according to the second embodiment. In  FIG. 9 , an information processing system  1  according to the second embodiment further includes the server device  30 . 
     Each of the information processing device  10  and the information terminal  20  is coupled to the server device  30 , for example, via the Internet or a mobile phone network so as to be communicable with one another. 
     &lt;Processing&gt; 
     &lt;&lt;Setting Processing&gt;&gt; 
     Next, with reference to  FIG. 10 , setting processing of the information processing system  1  according to the second embodiment will be described.  FIG. 10  is a sequence diagram illustrating an example of setting processing of the information processing system  1  according to the second embodiment. 
     First, for example, an IT administrator or the like sets an initial password of the information terminal  20  or the like to the server device  30  and attaches a two-dimensional barcode including information of an URL issued from the server device  30  to the information terminal  20  in advance. Then, for example, the IT administrator or the like installs a device certificate issued from the server device  30  in the information processing device  10  in accordance with a request from a user in advance. Then, for example, the IT administrator or the like registers the device certificate and the ID of the information terminal  20  in association with one another in the server device  30  in advance, and thereby, performs setting that allows an access to the information terminal  20  from the information processing device  10 . 
     The above-described setting is performed in advance and then the following processing is performed. 
     In Step S 501 , the information processing device  10  reads information of the two-dimensional barcode attached to the information terminal  20  and accesses the URL included in the information of the two-dimensional barcode. 
     In this case, if “the event name, the TID, and the public key” of the information processing device  10  have been already registered in the server device  30 , the processing of S 502  to S 509  may be omitted and the information processing device  10  may be set using information that has been already registered in S 511 . 
     Subsequently, the server device  30  requests the information processing device  10  for a setting of an authentication function (Step S 502 ). 
     Subsequently, the authentication setting unit  12  of the information processing device  10  requests the server device  30  for an authentication policy (Step S 503 ). 
     Subsequently, the server device  30  transmits the authentication policy to the information processing device  10  (Step S 504 ). 
     Step S 505  to Step S 511  below are executed for each event name included in the authentication policy. An event that is a processing target will be hereinafter referred to as a “target event”. 
     Subsequently, the authentication setting unit  12  of the information processing device  10  selects an authentication method that matches an authentication method included in the received authentic policy from a group of authentication methods that may be executed in the information processing device  10  and displays a list of the selected authentication methods (Step S 505 ). 
     Subsequently, the authentication setting unit  12  of the information processing device  10  receives a selection operation of selecting an authentication method from the user (Step S 506 ). 
     Subsequently, the generation unit  13  of the information processing device  10  generates a temporary ID (TID), a public key of a key, a secret key of the key, and a guarantee certificate that correspond to the target event (Step S 507 ). 
     Note that, if biological information that corresponds to the authentication method selected in Step S 106  has not been registered, a registration of biological information is received from the user. 
     Subsequently, the authentication setting unit  12  of the information processing device  10  stores the TID, the authentication method selected in the Step S 106 , and the secret key of the key in association with one another in the authentication information storage unit  11  (Step S 508 ). 
     Subsequently, the authentication setting unit  12  of the information processing device  10  transmits the event name of the target event, the TID, the public key of the key, and the guarantee certificate to the information terminal  20  (Step S 509 ). 
     Subsequently, the server device  30  verifies the received guarantee certificate (Step S 510 ). Note that, if the guarantee certificate has been encrypted using the secret key of the key, verification of the guarantee certificate may be performed by performing decryption using the public key of the key which has been received. 
     Subsequently, the server device  30  notifies the information terminal  20  of the event name, the TID, and the public key of the key (Step S 511 ). 
     Subsequently, the authentication policy setting unit  22  of the information terminal  20  stores the authentication policy, the TID, and the public key of the key in the authentication event storage unit  21  (Step S 512 ). 
     Note that each of the information terminal  20 , the information processing device  10 , the authentication event storage unit  21 , and the authentication processing unit  23  in each of the above-described embodiments is an example of the corresponding one of an “information processing device”, an “authentication device”, a “storage unit”, and a “receiving unit”. 
     Each of the authentication information storage unit  11 , the user authentication unit  14 , and the communication unit  15  in each of the above-described embodiments is an example of the corresponding one of a “storage unit”, an “authentication unit”, and a “transmission unit”. 
     Although embodiments of the present disclosure have been described in detail above, the present disclosure is not limited to specific embodiments and various modifications and changes may be made to those embodiments without departing from the scope of the gist of the present disclosure as set forth in the claims. 
     Each function unit of the information processing device  10 , the information terminal  20 , and the server device  30  may be realized by cloud computing configured by, for example, one or more computers. 
     Modified Example 
     The authentication information storage unit  11  may be updated regardless of the authentication event storage unit  21 . In this case, for example, the generation unit  13  of the information processing device  10  generates a public key of a key and a secret key of the key at a timing intended by the user or the like. 
     Then, the authentication setting unit  12  of the information processing device  10  updates data of a key associated with a predetermined TID in the authentication information storage unit  11  using the generated key and notifies the server device  30  of the TID and the public key of the key. 
     Thus, when the information terminal  20  temporarily stores a user authentication result from the information processing device  10  in order to receive an Internet service, the authentication result is immediately invalidated. 
     All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.