System and method for two-factor user authentication

A two-factor user authentication method for use in a user authentication system designed to use a one-time-password derivation rule as a password of a user subject to authentication, in such a manner that a plurality of pattern elements are arranged in a given pattern format and presented as a presentation pattern to a client being used by the user, the client comprising a processor and a memory to perform information processing, and the one-time-password derivation rule is applied to certain ones of the pattern elements included in the presentation pattern at specific positions so as to create a one-time password, and further use information identifying the client being used by the user, as a second authentication factor, wherein the user authentication system includes a plurality of the clients each serving as an authentication-requesting client when it is used as a terminal for allowing each of a plurality of the users to request authentication therethrough, and an authentication server connected to the authentication-requesting client via a network, the authentication server comprising a processor and a memory to perform information processing, and the authentication server being operable, in response to an authentication request from the authentication-requesting client, to perform authenticate each of the users, the two-factor user authentication method comprising:

• pre-storing, in the authentication server, respective user IDs of the users, respective one-time-password derivation rules of the users, and respective client IDs of the clients to be used by the respective users as the authentication-requesting client, in associated relation with each other on a user-by-user basis;
• allowing one of the users who requests authentication, to enter his/her user ID from the authentication-requesting client;
• causing the authentication-requesting client to transmit the entered user ID to the authentication server;
• causing the authentication server to receive the user ID of the requesting user transmitted from the authentication-requesting client;
• causing the authentication server to, in accordance with a given generation rule, generate a pattern seed value adapted to uniquely specify a presentation pattern in combination with one of the client IDs;
• causing the authentication server to transmit the generated pattern seed value to the authentication-requesting client of the requesting user;
• causing the authentication-requesting client to receive the pattern seed value transmitted from the authentication server;
• causing the authentication-requesting client to acquire the client ID of the authentication-requesting client when used by the requesting user;
• causing the authentication-requesting client to, based on the received pattern seed value and the acquired client ID and in accordance with a given pattern-element-sequence creation rule, create a pattern element sequence consisting of a set of pattern elements for forming a presentation pattern;
• causing the authentication-requesting client to arrange the pattern elements comprised in the created pattern element sequence, in the given pattern format to create the presentation pattern, and display the created presentation pattern on a screen;
• allowing the requesting user to enter, into the authentication-requesting client, a one-time password created as a result of applying the one-time-password derivation rule of the requesting user to certain ones of the pattern elements included in the displayed presentation pattern;
• causing the authentication-requesting client to transmit the entered one-time password to the authentication server;
• causing the authentication server to receive the one-time password transmitted from the authentication-requesting client of the requesting user;
• causing the authentication server to create a verification code as a result of applying the pre-stored one-time-password derivation rule associated with the received user ID, to certain pattern elements included in a presentation pattern formed from a pattern element sequence which is created based on the transmitted pattern seed value and the pre-stored client ID associated with the received user ID and in accordance with the given pattern-element- sequence creation rule;
• and
• causing the authentication server to compare the received one-time password with the created verification code, and, if they are identical to one another, successfully authenticate the user corresponding to said received user ID.