JP2007079987A - Authentication method, authentication system, authentication program, and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication method, an authentication system, an authentication program, and a recording medium which are excellent in security by preventing others from impersonating a user even if an ID or password is leaked.
An ID and a password are input to an authentication device when connecting from a portable device. If the ID and password match the user ID / password in the database, the encrypted code is transmitted from the authentication device 10 to the mobile device 20. Since the mobile device 20 has a decryption key that is paired with the encryption key of the authentication device 10, the mobile device 20 decrypts the encrypted code and further transmits the decrypted code to the authentication device. Thus, only when the decrypted code transmitted from the mobile device 20 matches the code encrypted and transmitted from the authentication device 10 side, it is regarded as a valid user and the connection is permitted.
[Selection] Figure 1

Description

  The present invention relates to an authentication method, an authentication system, an authentication program, and a recording medium that prevent impersonation by a third party.

  In recent years, there have been many crimes of impersonating a person by impersonating a card and for stealing various information. In addition, as with the Personal Information Protection Law, etc., there is a further demand for strengthening security related to personal and unique information. Under such circumstances, there is an authentication system that authenticates the person as one that strengthens the security of personal information.

  As prior art relating to the authentication system, the inventions disclosed in Patent Documents 1 to 3 are known. Patent Document 1 discloses an invention that improves the security of authentication processing.

  Patent Document 2 discloses an invention that reduces the processing load of collecting evidence information for proving the fact of data transmission / reception in a series of data transmission / reception in an electronic transaction.

Further, Patent Document 3 discloses an invention of an authentication apparatus that uses personal authentication with high security including fingerprint information in addition to a personal identification number, and can be expected to realize operability close to an authentication apparatus using a conventional personal identification number. Has been.
JP 2000-029841 A JP 2004-357204 A JP 2001-344605 A

  However, the conventional techniques have the following problems.

  In the invention disclosed in Patent Document 1, since the communication records are stored for each access on the client side and the server side, the storage capacity becomes enormous. The invention disclosed in Patent Document 2 proves the fact that data has been transmitted and received, and since the password used during the start process is also used during the intermediate process and the end process, an illegal third time is detected during the start process. It is not possible to cope with cases such as being accessed by a person. Furthermore, the invention disclosed in Patent Document 3 requires fingerprint authentication and has a complicated structure.

  Therefore, an object of the present invention is to provide an authentication method, an authentication system, an authentication program, and a recording medium that are excellent in security by preventing others from impersonating a user even if an ID or password is leaked.

  In order to achieve the above object, according to the first aspect of the present invention, when a mobile device uses resources from another device, the authenticity of the user is authenticated using the authentication device, and only the user who has been successfully authenticated. An authentication method for permitting a connection between a portable device and another device, and an input step for inputting a user-specific ID and password from the other device to the authentication device when there is a connection request from the portable device to the other device. And a determination process for determining the legitimacy of the mobile device with reference to an ID and a password input from another device, and transmission to the mobile device when it is determined that the mobile device is valid in the determination process. An encryption process for encrypting the code to be transmitted, a process for transmitting the encrypted code to the mobile device, a decryption process for receiving the code transmitted by the mobile device and decrypting the code, and To send the received code to the authentication device And receiving a code transmitted to the authentication device after being decrypted by the portable device, and comparing the code encrypted in the encryption process with the result of the comparison process, In the case where they match, the connection between the portable device and another device is permitted.

  According to a second aspect of the present invention, in the authentication method according to the first aspect, the authentication device is paired with an encryption key corresponding to each portable device, and the portable device is paired with an encryption key of the authentication device and each portable device. The device is characterized in that authentication is performed using a unique decryption key.

  According to a third aspect of the present invention, in the authentication method according to the first or second aspect, the authentication device and the portable device are connected to each other using a network.

  According to a fourth aspect of the present invention, in the authentication method according to the third aspect, the authentication device and the portable device are connected to each other using radio.

  According to a fifth aspect of the present invention, in the authentication method according to any one of the first to fourth aspects, the portable device further includes a display step of displaying the code encrypted and transmitted by the authentication device after decryption. And a user performs authentication by inputting a code displayed after decryption into an authentication device.

  The invention according to claim 6 is the authentication method according to any one of claims 1 to 5, wherein the authentication device further includes a code generation step of generating a code by changing the code, and the code generation step The generated code is transmitted to the mobile device.

  According to a seventh aspect of the present invention, in the authentication method according to any one of the first to sixth aspects, when the ID is determined to be valid in the determination step, the authentication device adds a code to the portable device. It is characterized by transmitting.

  According to the eighth aspect of the present invention, when the portable device uses resources from another device, the authenticity of the user is authenticated by using the authentication device, and only the user who has succeeded in the authentication between the portable device and the other device. An authentication system that permits connection, and when there is a connection request from a portable device to another device, an input means for inputting a user-specific ID and password from the other device to the authentication device, and input from the other device A means for judging the legitimacy of the portable device with reference to the ID and password, and an encryption for encrypting a code transmitted to the portable device when the judgment means judges the legitimate portable device. Means, means for transmitting the encrypted code to the mobile device, decryption means for receiving the code transmitted by the mobile device and decrypting the cipher, and transmitting the decrypted code to the authentication device Means and decryption by mobile device After receiving the code transmitted to the authentication device and comparing the code encrypted by the encryption unit with the portable device when the code matches as a result of the comparison unit. It is characterized by permitting connection with other devices.

  The invention according to claim 9 is the authentication system according to claim 8, wherein the authentication device is paired with an encryption key corresponding to each portable device, and the portable device is paired with an encryption key of the authentication device. It is characterized in that each device authenticates using a unique decryption key.

  According to a tenth aspect of the present invention, in the authentication system according to the eighth or ninth aspect, the authentication device and the portable device are connected to each other via a network.

  According to an eleventh aspect of the present invention, in the authentication system according to the tenth aspect, the authentication device and the portable device are connected to each other by radio.

  According to a twelfth aspect of the present invention, in the authentication system according to any one of the eighth to eleventh aspects, the portable device further includes display means for displaying the code encrypted and transmitted by the authentication device after decryption. And the user inputs the code displayed after the decryption to the authentication device for authentication.

  According to a thirteenth aspect of the present invention, in the authentication system according to any one of the eighth to twelfth aspects, the authentication device further includes a code generation unit that generates a code by changing the code, and the code generation unit The generated code is transmitted to the mobile device.

  The invention according to claim 14 is the authentication system according to any one of claims 8 to 13, wherein when the determination means determines that the ID is valid, the authentication device adds a code to the portable device. It is characterized by transmitting.

  A fifteenth aspect of the present invention is an authentication program that causes a computer to execute the authentication method according to any one of the first to seventh aspects.

  The invention described in claim 16 is a computer-readable recording medium in which the authentication program according to claim 15 is recorded.

  Thus, according to the authentication method, authentication system, authentication program, and recording medium of the present invention, even if the ID and password are leaked, the code (data) is input to the authentication device as long as the mobile device is not owned. Can't impersonate the user. Therefore, it is possible to improve security.

Next, the authentication system of this embodiment is demonstrated using drawing. In addition, this embodiment is not limited to what will be described later, and various modifications can be made without departing from the spirit of the present embodiment.
FIG. 1 is a block diagram showing the configuration of the authentication system of this embodiment.

  The authentication system according to the present embodiment includes an authentication device 10 and a portable device 20. The authentication device in the present embodiment is a device composed of one or more components that perform user authentication processing.

  A mechanism for decrypting a cipher and a key for decryption are set in the portable device 20 of the present embodiment possessed by the user in advance. A different key is set for each portable device. Further, the authentication device 10 of the present embodiment holds a combination of an ID and a password for each user and an encryption key that is a pair of the portable device 20 possessed by each user in a database.

  The authentication device 10 includes an ID input unit 11, a password input unit 12, a code input unit 13, a code creation unit 14, a code transmission unit 15, a user database 16, an information verification unit 17, and an authentication result output unit. 18.

  The ID input unit 11 receives an input of an ID from the user, and the password input unit 12 receives an input password. The code input unit 13 receives an input of a code (data), and the code generation unit 14 generates a code based on this input. The code transmitting unit 15 transmits the generated code to the user's portable device 20.

  The user database 16 stores various information related to users. The information collation unit 17 collates information input from the outside. And the authentication result output part 18 outputs the result collated here as an authentication result.

  The portable device 20 can be connected to an authentication device, receives data sent from the code transmission unit 15 in the authentication system of the present embodiment, and performs various processes according to the received data. It has a function. In addition, the user is wearing (carrying around) the portable device 2.

  Examples of a connection method between the code transmission unit 15 and the portable device 20 include a direct connection method, a network connection method, and a wireless connection method. In the present embodiment, it is assumed that the portable device 20 is possessed by an authorized user who has been issued an ID and password. Examples of the mobile device 20 include a USB memory, a mobile phone, and a PDA.

  In the present embodiment, the code is data that is registered in advance or generated in the authentication system, and is used as the second password. Examples of codes include character strings including alphanumeric characters and symbols (“ABCD”, “123 = ABC”).

  The machine 30 is an apparatus that requires user authentication when a user accesses a resource held by the machine itself. The machine 30 implements access control using an authentication result that can be obtained from the authentication result output unit 18 of the authentication system.

Next, the operation of the authentication system of this embodiment will be described with reference to the drawings. Here, a case where a user having the mobile device 20 accesses the server A (the machine 30 in FIG. 1) will be described.
FIG. 2 is a flowchart showing an authentication operation in the authentication system of this embodiment.

  Since the user wants to use resources managed by the server A, the user connects to the server A. Since the server A performs access control of resources managed by the server A, it requests the user to input an ID and password.

  Then, the user first inputs his / her ID and password on the mobile device 20 (step S101). At this time, the server A passes the ID and password to the authentication device 10 and requests confirmation of whether the ID and password input from the portable device 20 are valid (step S102). Here, the authentication device 10 confirms the ID and password in the user database 16, and if they match (Yes in step S <b> 102), the authentication device 10 requests that the portable device 20 possessed by the user be connected to the authentication device 10.

  When connected from the mobile device 20 of the user, the authentication device 10 reads the code using the encryption key unique to the connected mobile device 20 (step S103). Then, the read user-specific code (specific to the mobile device 20) is encrypted (step S104). The authentication device 10 transmits the code thus encrypted to the mobile device 20 (step S105).

  Here, it is confirmed whether the portable device 20 has normally received the code encrypted by the authentication device 10 (step S106). When the encrypted code is normally received (step S106 / Yes), the mobile device 20 decrypts the received code to obtain the code (step S107). And the code | symbol obtained in this way is input into the code | symbol input part 13 of the authentication apparatus 10 (step S108).

  Next, the code input unit 13 compares whether or not the code transmitted (input) from the mobile device 20 matches the code encrypted by the authentication device 10 and transmitted to the mobile device 20 (step S109). As a result of the comparison, if the codes match (step S110 / yes), the user (mobile device 20) is treated as a valid user, and a result of successful authentication is transmitted to the server A (step S111). .

  On the other hand, if the ID and the password are confirmed in step S102 and they do not match (step S102 / No), the code encrypted in step S106 cannot be received (step S106 / No), As a result of comparing the codes in step S110, if the codes do not match (step S110 / No), the user is treated as an unauthorized one and a result of authentication failure is transmitted to server A (step S112). ).

  As described above, according to the authentication system of this embodiment, even if a malicious person obtains an ID and a password by some method (for example, eavesdropping or snooping), the code is used when the mobile device is not held. Cannot be returned to the authentication device. Therefore, it cannot authenticate normally and cannot impersonate the user. In addition, since different decryption keys are set for individual mobile devices, the code cannot be decrypted by a mobile device other than the mobile device possessed by a legitimate user, so authentication is not successful.

  In the authentication system of the present embodiment, a wired network such as a LAN or a wireless network such as a wireless LAN / mobile phone network is interposed between the authentication device 10 and the portable device 20, so that a user or server A Authentication is possible even at a position away from the authentication device 10.

  Next, FIG. 3 is a flowchart showing an authentication operation when a code is displayed on the display unit of the portable device and the displayed code is input to the code input unit in the authentication system of the present embodiment. Here, a description will be given using a mobile phone as the mobile device 20.

  First, the user's own ID and password are entered on the mobile phone (step S201). At this time, the server A passes the ID and password to the authentication device 10 and requests confirmation of whether the ID and password input from the mobile phone are valid (step S202). Here, the authentication device 10 confirms the ID and password in the user database 16 and, if they match (step S202 / Yes), requests that the mobile phone possessed by the user be connected to the authentication device 10.

  When connected from the user's mobile phone, the authentication device 10 reads the code using the encryption key unique to the connected mobile phone (step S203). Then, the read user-specific (mobile phone-specific) code is encrypted (step S204). The authentication device 10 transmits the code thus encrypted to the mobile phone possessed by the user (step S205). At this time, the encrypted code is described in an e-mail or the like and is transmitted after being encrypted using SSL (Secure Socket Layer) or the like.

  Here, the mobile phone confirms whether or not the encrypted signed mail is normally received by the authentication device 10 (step S206). If the encrypted code is normally received (step S206 / Yes), the mobile phone decrypts the received code to obtain the code (step S207).

  The cellular phone opens the code thus obtained, that is, the encrypted signed mail that has been decrypted, and displays it on the screen of the cellular phone (step S208). The displayed code is input to the code input unit 13 (step S209).

  Here, the code input unit 13 compares whether the code input from the mobile phone matches the code transmitted from the authentication device 10 to the mobile phone (step S210). If the codes match as a result of the comparison (step S211 / yes), the user (mobile phone) is treated as a valid user, and the result of successful authentication is transmitted to the server A (step S212).

  On the other hand, when the ID and the password are confirmed in step S202 and they do not match (step S202 / No), the code encrypted in step S206 cannot be received (step S206 / No), As a result of comparing the codes in step S211, if the codes do not match (step S211 / No), the user is treated as an unauthorized one and a result of authentication failure is transmitted to the server A (step S213). ).

  As described above, according to the authentication system of the present embodiment, even if a malicious person obtains the ID and password by some method (for example, eavesdropping or snooping), the user does not have the mobile phone. The sign cannot be entered. Therefore, since the authentication is not successful, the user cannot be impersonated.

  Next, FIG. 4 is a flowchart showing an authentication operation when the code transmitted by the authentication device is changed periodically or irregularly in the authentication system of this embodiment. Here, a description will be given using a mobile phone as the mobile device 20.

  First, the user's own ID and password are input using the mobile phone (step S301). At this time, the server A passes the ID and password to the authentication device 10 and requests confirmation of whether the ID and password input from the mobile phone are valid (step S302). Here, the authentication device 10 confirms the ID and password in the user database 16, and if they match (step S302 / Yes), the authentication device 10 requests that the mobile phone held by the user be connected to the authentication device 10.

  When connected from the user's mobile phone, the authentication device 10 generates a code using an encryption key unique to the connected mobile phone (step S303). The code generated at this time is changed regularly or irregularly. Regarding the code generation, such as the interval when it is periodically changed and the selection of regular / irregular, it can be set either by the user or automatically by the authentication system of this embodiment. Good.

  Next, the read user-specific (mobile phone specific) code is encrypted (step S304). The authentication device 10 transmits the code thus encrypted to the mobile phone possessed by the user (step S305).

  Here, the mobile phone confirms whether or not the encrypted code is normally received by the authentication device 10 (step S306). If the encrypted code is normally received (step S306 / Yes), the mobile phone decrypts the received code to obtain the code (step S307).

  The mobile phone displays the code thus obtained, that is, the code that has been decoded, on the screen of the mobile phone (step S308). The displayed code is input to the code input unit 13 (step S309).

  Here, the code input unit 13 compares whether or not the code input from the mobile phone matches the code transmitted from the authentication device 10 to the mobile phone (step S310). If the codes match as a result of the comparison (step S311 / yes), the user (mobile phone) is treated as a valid user, and the result of successful authentication is transmitted to the server A (step S312).

  On the other hand, if the ID and password are confirmed in step S302 and they do not match (step S302 / No), or if the code encrypted in step S306 cannot be received (step S306 / No), As a result of comparing the codes in step S311, if the codes do not match (step S311 / No), the user is treated as an unauthorized one and a result of authentication failure is transmitted to server A (step S313). ).

  In the authentication system of the present embodiment, since the code can be input even if the user does not own the portable device registered in advance when the leakage of the code occurs due to peeping during the code input, As described above, the code is changed periodically and irregularly. Thereby, even if a user's ID, password, and code | symbol leak all at the same time, since a code | symbol changes, damage can be suppressed.

  Next, FIG. 5 is a flowchart showing an authentication operation when the authentication device transmits a code when the ID is used in the authentication system of the present embodiment. Here, a description will be given using a mobile phone as the mobile device 20.

  First, the user's own ID and password are entered on the mobile phone (step S401). At this time, the server A passes the ID and password to the authentication device 10. At this stage, the server A requests to confirm whether only the ID input from the mobile phone is valid (step S402). At this stage, we do not yet confirm the validity of the password. Next, the authentication apparatus 10 confirms the ID in the user database 16 and if they match (step S402 / Yes), the authentication apparatus 10 requests that the mobile phone possessed by the user be connected to the authentication apparatus 10.

  When connected from the user's mobile phone, the authentication device 10 generates a code using an encryption key unique to the connected mobile phone (step S403). The code generated at this time may be changed regularly or irregularly as in step S303 described above.

  Next, the read user-specific (mobile phone-specific) code is encrypted (step S404). The authentication device 10 transmits the code encrypted in this way to the mobile phone possessed by the user (step S405).

  At this stage, it is confirmed whether or not the password input from the mobile phone is valid (step S406). If the password is valid (step S406 / Yes), the mobile phone confirms whether the code encrypted by the authentication device 10 has been received normally (step S407). If the encrypted code is normally received (step S407 / Yes), the mobile phone decrypts the received code to obtain the code (step S408).

  The mobile phone displays the code thus obtained, that is, the code that has been decoded, on the screen of the mobile phone (step S409). The displayed code is input to the code input unit 13 (step S410).

  Here, the code input unit 13 compares whether or not the code input from the mobile phone matches the code transmitted from the authentication device 10 to the mobile phone (step S411). As a result of the comparison, if the codes match (step S412 / yes), the user (mobile phone) is treated as a valid user, and the result of successful authentication is transmitted to the server A (step S413).

  On the other hand, if the IDs are confirmed and not matched in step S402 (step S402 / No), if the password is invalid in step S406 (step S406 / No), or encrypted in step S407. If the converted code cannot be received (step S407 / No), or if the codes do not match as a result of comparing the codes in step S412 (step S412 / No), the user is regarded as illegal. The result of authentication failure is transmitted to the server A (step S414).

  Even if the authentication is failed with the user's ID, the user with the corresponding ID cannot know and cannot perceive the danger. However, in such an authentication system of this embodiment, the ID is used. At that time, the code is transmitted to the user's portable device even if the password is incorrect. Therefore, the user can know that an authentication process has been attempted by a third party using his / her ID. In addition, since a third party cannot decipher the legitimate user's code, it is not impersonated by the user.

It is a block diagram which shows the structure of the authentication system of this embodiment. It is a flowchart which shows the authentication operation | movement in the authentication system of this embodiment. In the authentication system of this embodiment, it is a flowchart which shows the authentication operation | movement in the case of displaying a code | symbol on the display part of a portable apparatus, and inputting the displayed code | symbol into a code | symbol input part. In the authentication system of this embodiment, it is a flowchart which shows the authentication operation | movement when changing the code | symbol which an authentication apparatus transmits regularly and irregularly. It is a flowchart which shows the authentication operation | movement in case the authentication apparatus transmits a code | symbol when ID is used in the authentication system of this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Authentication apparatus 11 ID input part 12 Password input part 13 Code input part 14 Code creation part 15 Code transmission part 16 User database 17 Information collation part 18 Authentication result output part 20 Portable apparatus 30 Machine

Claims (16)

An authentication method in which when a mobile device uses resources from another device, the authenticity of the user is authenticated using an authentication device, and only a user who has succeeded in authentication permits the connection between the mobile device and the other device. There,
When there is a connection request from the portable device to the other device, an input step of inputting a user-specific ID and password from the other device to the authentication device;
A determination step of determining validity of the portable device with reference to the ID and the password input from the other device;
An encryption step of encrypting a code to be transmitted to the mobile device when it is determined to be a valid mobile device in the determination step;
Transmitting the encrypted code to the mobile device;
Receiving the code transmitted by the portable device and decrypting the cipher,
Transmitting the decrypted code to the authentication device;
Receiving a code transmitted to the authentication device after being decrypted by the portable device, and comparing the code encrypted in the encryption step;
As a result of the comparison step, when the codes coincide with each other, a connection between the portable device and the other device is permitted.   The authentication device performs authentication by using an encryption key corresponding to each mobile device and a decryption key that is paired with the encryption key of the authentication device and each mobile device is unique. The authentication method according to claim 1, wherein:   The authentication method according to claim 1, wherein the authentication device and the portable device are connected to each other using a network.   The authentication method according to claim 3, wherein the authentication device and the portable device are connected to each other using wireless communication. The portable device further includes a display step of displaying the code encrypted and transmitted by the authentication device after decryption,
5. The authentication method according to claim 1, wherein the user performs authentication by inputting the code displayed after decryption to the authentication device. 6. The authentication apparatus further includes a code generation step of generating the code by changing the code,
The authentication method according to claim 1, wherein the code generated in the code generation step is transmitted to the portable device. When it is determined that the ID is valid in the determination step,
The authentication method according to claim 1, wherein the authentication device transmits the code to the mobile device. An authentication system in which when a mobile device uses resources from another device, the authenticity of the user is authenticated using an authentication device, and only a user who has succeeded in authentication permits the connection between the mobile device and the other device. There,
When there is a connection request from the portable device to the other device, input means for inputting a user-specific ID and password from the other device to the authentication device;
A judging means for judging the legitimacy of the portable device with reference to the ID and the password inputted from the other device;
An encryption means for encrypting a code to be transmitted to the mobile device when the determination means determines that the mobile device is valid;
Means for transmitting the encrypted code to the portable device;
Decryption means for receiving the code transmitted by the portable device and decrypting the cipher;
Means for transmitting the decrypted code to the authentication device;
Receiving a code transmitted to the authentication device after being decrypted by the portable device, and having a comparison means for comparing the code encrypted by the encryption means;
As a result of the comparison means, an authentication system that permits connection between the portable device and the other device when the codes match.   The authentication device authenticates by using an encryption key corresponding to each mobile device and a decryption key that is paired with the encryption key of the authentication device and each mobile device is unique. The authentication system according to claim 8, wherein   The authentication system according to claim 8 or 9, wherein the authentication device and the portable device are connected to each other via a network.   The authentication system according to claim 10, wherein the authentication device and the portable device are connected to each other using wireless communication. The portable device further includes display means for displaying the code encrypted and transmitted by the authentication device after decryption,
The authentication system according to any one of claims 8 to 11, wherein the user inputs the code displayed after decryption to the authentication device for authentication. The authentication apparatus further includes code generation means for generating the code by changing the code,
The authentication system according to claim 8, wherein the code generated by the code generation unit is transmitted to the portable device. When the determination means determines that the ID is valid,
The authentication system according to claim 8, wherein the authentication device transmits the code to the mobile device.   An authentication program causing a computer to execute the authentication method according to claim 1.   A computer-readable recording medium on which the authentication program according to claim 15 is recorded.

Images