Authentication server apparatus, authentication server apparatus-use program and authentication method

• US 9,348,986 B2
• Filed: 03/29/2011
• Issued: 05/24/2016
• Est. Priority Date: 03/29/2010
• Status: Active Grant

• Current Assignee: Rakuten Group, Inc.
• Original Assignee: Rakuten, Inc. (Rakuten Group, Inc.)
• Inventors: Takami, Shinya
• Primary Examiner(s): TODD, GREGORY G
• Application Number:
  US13/388,925
• Publication Number:
  US 20120144004A1
• Time in Patent Office: 1,883 Days
• Field of Search: 709/220, 709/229, 713/150
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

An authentication server apparatus is capable of simply and accurately assessing whether a user terminal is being operated by a person. In the authentication server apparatus connected to the user terminal, operating instructions for instructing operation by an operator by using objects are associated with operation information and stored. A session ID is imparted for each session with the user terminal, operating instructions are selected for each session, a page provided with the selected operating instructions and the objects is generated, and position information is received corresponding to operations executed at the user terminal that has displayed the page. At authentication time, operating instructions using the session ID of the session are associated with position information received from the terminal, and using the stored operation information associated with the operating instruction that have been associated with the received position information, and the position information, an assessment is made of whether or not the operations were made by an operator.

Claims

1. An authentication server apparatus that is connected to a terminal provided with a display through a network, the authentication server apparatus comprising:

at least one hardware processor configured to execute modules comprising;

an operation storage that associates and stores an operating instruction and operation information, the operating instruction including text information that instructs an operator of the terminal to perform an operation on the display, the operation information including a position on the display matching the operation and comprising content matching content of the corresponding operating instruction;

a session ID assigner that assigns a session ID per session with respect to the terminal that displays a page comprising the operating instruction and an object displayed on the display for the operation;

an operation instruction selector that selects the operating instruction per session;

a page transmitter that transmits the page, the page comprising the selected operating instruction, the object displayed on the display for the operation matching the operating instruction, the session ID, and a position information transmitter that transmits position information of a pointer from the terminal that displays the page to the authentication server apparatus on a regular basis during the operation in the session, the position information indicating a pointer position in the terminal that displays the page and comprising coordinates representing the pointer position on the display in the terminal, and the position information transmitter beginning transmitting the position information of the pointer when the object displayed on the display for the operation is selected;

a position information receiver that receives the position information transmitted from the terminal by the position information transmitter in the page;

a position information storage that, every time the position information is received, stores the received position information per session ID and reception time; and

a flag setter, when the position information stored in the position information storage and position information stored at a time before the position information are different in the same session ID, sets a manual operation flag indicating that movement of the pointer is operated by the operator of the terminal;

an associator that associates the operating instruction provided in the page displayed in the session and the position information received from the terminal in the session, based on the session ID included in an authentication request received from the terminal that displays the page; and

a determiner that determines whether or not the operation is performed by the operator, wherein the operator is a person, based on;

(a) whether or not a comparison of (i) the operation information stored in the operation storage and associated with the operating instruction associated with the position information and (ii) object selection information or object selection movement information indicates that the operator of the terminal has performed the operation on the display instructed by the operating instruction, and

(b) whether or not the manual operation flag is set, indicating that the operator of the terminal is a person.

2. The authentication server apparatus according to claim 1, wherein the operation is performed using a pointing device that is operated by the operator at the terminal.

3. The authentication server apparatus according to claim 2, wherein:

the page transmitter transmits the page comprising the position information transmitter that transmits to the authentication server apparatus the position information indicating a position of an instruction indicator that can be moved by the operator, on the display, and a plurality of objects that can be selected according to the instruction indicator.

4. The authentication server apparatus according to claim 2, wherein:

the page transmitter transmits the page comprising a plurality of objects that can be selected and moved on the display by the operator and the position information transmitter that transmits to the authentication server apparatus the position information indicating a position of the object on the display.

5. The authentication server apparatus according to claim 1, wherein:

the page transmitter transmits the page comprising the position information transmitter that transmits to the authentication server apparatus the position information indicating a position of an instruction indicator that can be moved by the operator, on the display, and a plurality of objects that can be selected according to the instruction indicator.

6. The authentication server apparatus according to claim 5, wherein

the position information transmitter in the page does not transmit the position information at a point of time when the page is displayed in the terminal, and starts transmitting the position information when one arbitrary object of the plurality of objects is selected.

7. The authentication server apparatus according to claim 5, further comprising

a flag returner that returns the manual operation flag to the terminal every time the position information is received, wherein, when the terminal transmits the position information, the page transmitter transmits the page further comprising a position information transmission stopper that stops transmitting the position information when the terminal receives the manual operation flag indicating that the operation is performed by the operator.

8. The authentication server apparatus according to claim 7, wherein,

when the terminal transmits the position information and receives the manual operation flag indicating that the operation is performed by the operator, the page transmitter transmits the page further comprising an authentication request method displayer that displays on the display a request transmitter that transmits the authentication request to the authentication server apparatus.

9. The authentication server apparatus according to claim 1, wherein:

the page transmitter transmits the page comprising a plurality of objects that can be selected and moved on the display by the operator and the position information transmitter that transmits to the authentication server apparatus the position information indicating a position of the object on the display.

10. The authentication server apparatus according to claim 1, wherein the pointer position indicated by the position information changes in association with the operation.

11. A non-transitory recording medium which records a program for an authentication server apparatus causing a computer that is connected to a terminal comprising a display unit, through a network and that is included in the authentication server apparatus to function as:

an operation storage unit that associates and stores an operating instruction and operation information, the operating instruction including text information that instructs the operator of the terminal to perform an operation on the display unit, the operation information including a position on the display unit matching the operation and that comprises content matching content of the corresponding operating instruction;

a session ID assigning unit that assigns a session ID per session with respect to the terminal that displays a page comprising the operating instruction and an object displayed on the display unit for the operation;

an operation instruction selecting unit that selects the operating instruction per session;

a page transmitting unit that transmits the page, the page comprising the selected operating instruction, the object displayed on the display unit for the operation matching the operating instruction, the session ID, and a position information transmitting unit that transmits position information of a pointer from the terminal that displays the page to the authentication server apparatus on a regular basis during the operation in the session, the position information indicating a pointer position in the terminal that displays the page and comprising coordinates representing the pointer position on the display unit in the terminal, and the position information transmitting unit beginning transmitting the position information of the pointer when the object displayed on the display unit for the operation is selected;

a position information receiving unit that receives the position information transmitted from the terminal by the position information transmitting unit in the page;

a position information storage unit that, every time the position information is received, stores the received position information per session ID and reception time; and

a flag setting unit that, when the position information stored in the position information storing unit and position information stored at a time before the position information are different in the same session ID, sets a manual operation flag indicating that movement of the pointer is operated by the operator of the terminal;

an associating unit that associates the operating instruction provided in the page displayed in the session and the position information received from the terminal in the session, based on the session ID included in an authentication request received from the terminal that displays the page; and

a determining unit that determines whether or not the operation is performed by the operator, wherein the operator is a person, based on;

(a) whether or not a comparison of (i) the operation information stored in the operation storage unit and associated with the operating instruction associated with the position information and (ii) object selection information or object selection movement information indicates that the operator of the terminal has performed the operation on the display unit instructed by the operating instruction, and

(b) whether or not the manual operation flag is set, indicating that the operator of the terminal is a person.

12. An authentication method executed in an authentication server apparatus that is connected to a terminal comprising a display unit, through a network, the authentication method comprising:

an operation storing step of associating and storing an operating instruction and operation information, the operating instruction including text information that instructs the operator of the terminal to perform an operation on the display unit, the operation information including a position on the display unit matching the operation and that comprises content matching content of the corresponding operating instruction;

a session ID assigning step of assigning a session ID per session with respect to the terminal that displays a page comprising the operating instruction and an object displayed on the display unit for the operation;

an operation instruction selecting step of selecting the operating instruction per session;

a page transmitting step of transmitting the page, the page comprising the selected operating instruction, the object displayed on the display unit for the operation matching the operating instruction, the session ID, and a position information transmitting unit that transmits position information of a pointer from the terminal that displays the page to the authentication server apparatus on a regular basis during the operation in the session, the position information indicating a pointer position in the terminal that displays the page and comprising coordinates representing the pointer position on the display unit in the terminal, and the position information transmitting unit beginning transmitting the position information of the pointer when the object displayed on the display unit for the operation is selected;

a position information receiving step of receiving the position information transmitted from the terminal by the position information transmitting unit in the page;

a position information storage step of storing, every time the position information is received, the received position information per session ID and reception time; and

a flag setting step of setting, when the stored position information and position information stored at a time before the stored position information are different in the same session ID, sets a manual operation flag indicating that movement of the pointer is operated by the operator of the terminal;

an associating step of associating the operating instruction provided in the page displayed in the session and the position information received from the terminal in the session, based on the session ID included in an authentication request received from the terminal that displays the page; and

a determining step of determining whether or not the operation is performed by the operator, wherein the operator is a person, based on;

(a) whether or not a comparison of (i) the operation information stored and associated with the operating instruction associated with the position information and (ii) object selection information or object selection movement information indicates that the operator of the terminal has performed the operation on the display unit instructed by the operating instruction, and

(b) whether or not the manual operation flag is set, indicating that the operator of the terminal is a person.