JP2010049477A - Authentication system, authentication method, card device and authentication request device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide technology for performing authentication according to a request condition when a card is used. <P>SOLUTION: This authentication system has an authentication policy management server, a card device, and an authentication request device. The authentication policy management server holds authentication policy information showing the kind of authentication registered in advance by a user. The card device holds authentication status information showing whether the authentication of the kind registered in the authentication policy management server as the authentication policy information is performed or not. In the authentication request device, request condition information showing the kind of the authentication of the request condition is set. The authentication request device decides, based on the authentication policy information held in the authentication policy management server and the authentication status information held in the card device, whether or not the authentication of the kind shown by the request condition information is performed on the user to use the card device. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to authentication when using an IC card.

  In recent years, many services using cards have been performed. There are magnetic cards and IC cards as types of cards, and there are contact type and non-contact type IC cards. In particular, non-contact IC (Integrated Circuit) cards are highly convenient because data can be exchanged without contact, and various services using non-contact IC cards are being developed.

  For example, the user can pay with electronic money using a contactless IC card, or can use transportation such as a train or a bus with the IC card. In addition, an IC card is mounted on a mobile phone, and its convenience is further increased. In the future, the types of services using IC cards are expected to increase further.

  In an IC card system typified by a payment system that performs payment processing using electronic money or a ticket gate system that performs ticket processing using an IC card as a ticket, an IC card and a communication device incorporating an IC card reader / writer are short-range wireless. Processing is performed by performing communication (NFC (Near Field Communication)).

However, in general, in an IC card system, a user can easily use an IC card, but on the other hand, the user is not authenticated. Therefore, a third party can easily use the IC card illegally due to theft or the like. Therefore, how to authenticate the user is a security issue. On the other hand, various authentication techniques have been proposed so far (see Patent Documents 1 and 2). As information for identifying a user in authentication, a password, fingerprint information, face recognition information, and the like are known.
JP 2006-236085 A JP 2003-216878 A

  If user authentication is performed using fingerprints or face recognition when using an IC card, the security of the IC card system is improved. However, on the other hand, since the user is required to perform an authentication operation and action, the convenience of the IC card is impaired.

  As described above, there are various services using IC cards. Among them, there are services that require high security, and services that require high convenience instead of requiring high security. In addition, there are users who want to use IC cards for services that require high security, and there are users who use IC cards for services that are highly convenient. Thus, there are various requests for authentication.

  However, the authentication techniques disclosed in Patent Documents 1 and 2 do not take into consideration that there are various requirements for authentication. For this reason, at the time of using the card, it has not been possible to perform authentication under the authentication condition according to the request.

  An object of the present invention is to provide a technique that makes it possible to perform authentication that meets required conditions when using a card.

In order to achieve the above object, the authentication system of the present invention provides:
An authentication policy management server that holds authentication policy information indicating the type of authentication registered in advance by the user;
A card device that holds authentication status information indicating whether or not the type of authentication registered as the authentication policy information in the authentication policy management server;
Request condition information indicating the type of authentication that is a request condition is preset, and whether or not the type indicated by the request condition information has been authenticated for a user who intends to use the card device, An authentication requesting device that makes a determination based on the authentication policy information held in the authentication policy management server and the authentication status information held in the card device.

An authentication method of the present invention is an authentication method for authenticating a user by communication between a card device and an authentication requesting device,
The authentication policy management server holds authentication policy information indicating the type of authentication registered in advance by the user,
The card device holds authentication status information indicating whether or not the type of authentication registered as the authentication policy information in the authentication policy management server,
In the authentication requesting device, holding request condition information indicating a type of authentication to be a request condition,
The authentication policy information stored in the authentication policy management server indicates whether or not the type of authentication indicated by the request condition information has been performed for a user who intends to use the card device in the authentication requesting device. And the authentication status information held in the card device.

A card device according to an aspect of the present invention includes:
Policy management means for registering authentication policy information indicating the type of authentication registered in advance by the user in the authentication policy management server;
Authentication status management means for managing authentication status information indicating whether or not the type of authentication policy information registered in the authentication policy management server has been authenticated.

An authentication requesting apparatus according to an aspect of the present invention is provided.
Authentication policy inquiry means for acquiring authentication policy information indicating the type of authentication registered in advance by the user, held in the authentication policy management server;
Authentication information receiving means for acquiring authentication status information indicating whether or not authentication of the type registered as the authentication policy information in the authentication policy management server is held in a card device;
Whether the type of authentication indicated by the request condition information indicating the type of authentication set in advance as a request condition for the user who intends to use the card device is acquired from the authentication policy management server. Authentication check means for determining based on authentication policy information and the authentication status information acquired from the card device;
have.

  According to the present invention, since it is determined whether or not the type of authentication set as the request condition is performed for the user who intends to use the service, the authentication can be performed under a condition that meets the request.

  Embodiments for carrying out the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the authentication system according to the present embodiment. Referring to FIG. 1, the authentication system includes an authentication policy management server 11, a card device 12, and an authentication request device 13.

  The authentication policy management server 11 and the authentication requesting device 13 are connected to the network 14. The card device 12 is a device having a function of a non-contact IC card, and has a configuration in which an IC card is mounted on a mobile phone as an example. The card device 12 can be connected to the network 14 by the function of the mobile phone. The authentication requesting device 13 is a device on which an IC card reader / writer is mounted, and can perform near field communication without contact with the card device 12.

  The card device 12 is a mobile phone in which an IC card is incorporated. The user of the card device 12 registers in advance the type of authentication he / she receives in order to use the service using an IC card as authentication policy information.

  The authentication policy management server 11 holds authentication policy information indicating the type of authentication registered in advance by the user of the card device 12.

  The card device 12 holds authentication status information indicating whether or not the type of authentication registered as authentication policy information in the authentication policy management server 11 has been performed. As authentication types, for example, authentication by password, authentication by fingerprint, authentication by face recognition, and the like can be considered. The authentication may be received from an external certification body (not shown).

  Further, the card device 12 may validate the authentication for a certain period from the time when the authentication is received, and may hold the authentication status information indicating that the authentication has been performed for that period. For example, the user may set the card device 12 as a re-authentication period as a period during which authentication is valid. In this case, the card device 12 starts measuring the re-authentication period at the time when the authentication is performed, and resets the measurement of the re-authentication period if the authentication is performed again before the re-authentication period elapses. On the other hand, if the next authentication is not performed before the re-authentication period elapses, the card device 12 returns the authentication status information to a state where the authentication is not performed. In order to return the authentication status information to a state where the authentication is not performed, for example, the authentication status information may be deleted.

  The authentication requesting device 13 is a device corresponding to a payment device in a payment system that performs payment processing with electronic money, a vending machine, or a ticket gate in a ticket gate system that performs ticket gate processing using an IC card as a ticket.

  The service provider can set an authentication type as a request condition when providing a service to the IC card user. The authentication requesting device 13 is preliminarily set with requesting condition information indicating the type of authentication that is used as a requesting condition when providing a service to a user of an IC card. Whether or not the type of external authentication indicated by the information is performed is determined based on the authentication policy information held in the authentication policy management server 11 and the authentication status information held in the card device 12. At that time, the authentication requesting device 13 acquires the authentication policy information from the authentication policy management server 11 via the network 14 and acquires the authentication status information from the card device 12 by short-range communication.

  The authentication requesting device 13 includes the authentication policy information stored in the authentication policy management server 11 in which the request condition information and the authentication type match, and the authentication status read from the card device 12 that the user tried to use By examining whether or not there is authentication policy information corresponding to the information, it is possible to determine whether or not the type of external authentication indicated by the request condition information is performed for the user.

  More specifically, the authentication requesting device 13 acquires all the authentication policy information whose request condition information matches the authentication type from the authentication policy information held in the authentication policy management server 11 and is acquired. It is sufficient to check whether there is any authentication policy information corresponding to the authentication status information.

  In the authentication requesting device 13, if the type of authentication used as a request condition when the service provider provides the service is performed for the user who intends to use the service, the service provision is permitted. Good.

  Further, when the user of the card device 12 registers the authentication type as authentication policy information in advance, the card device 12 may register the authentication policy information in the authentication policy management server 11 using the communication function of the mobile phone. . In that case, the authentication policy management server 11 gives the authentication identification information to the authentication policy information registered by the card device 12, holds the authentication identification information included in the authentication policy information, and notifies the card device 12 of it.

  Further, the card device 12 may hold the authentication identification information given to the authentication policy information as the authentication status information when the type of external authentication registered as the authentication policy information is performed. In this case, the authentication requesting device 13 includes authentication identification information included in authentication policy information whose authentication condition matches the request condition information in the authentication policy information held in the authentication policy management server 11, and authentication status information. If the authentication identification information read from the card device 12 matches, it can be determined that the type of authentication indicated by the request condition information is being performed for the user.

  FIG. 2 is a sequence diagram showing the operation of the authentication system according to the present embodiment. Referring to FIG. 2, first, the card device 12 registers an authentication policy in the authentication policy management server 11 in advance by the user's operation on the card device (mobile phone) 12 (step 101).

  Thereafter, when the user brings the card device 12 close to the authentication requesting device 13, the authentication status information is sent from the card device 12 to the authentication requesting device 13 by short-range communication (step 102).

  The authentication requesting device 13 that has acquired the authentication status information searches the authentication policy management server 11 (step 103), and acquires an authentication policy group that meets its request conditions (step 104).

  Then, the authentication requesting device 13 compares the authentication status information acquired from the card device 12 with the authentication policy group acquired from the authentication policy management server 11, so that the user who wants to use the card device 12 It is determined whether or not authentication matching the above is performed (step 105).

  As described above, according to the present embodiment, the authentication requesting device 13 determines whether or not the type of authentication set as the request condition is performed for the user who intends to use the service. Authentication can be performed under conditions suitable for For example, service provision is permitted when the type of authentication used as a request condition when a service provider provides a service is performed for a user who intends to use the service.

(Example)
This example is an example of a more specific embodiment described above. FIG. 3 is a block diagram showing the configuration of the authentication system of this embodiment. FIG. 3 also shows the configuration within each apparatus. Referring to FIG. 3, the authentication system includes an authentication policy management server 11, a mobile phone (card device) 12, and an authentication requesting device 13 as in FIG.

  The mobile phone 12 includes a policy management unit 21, an authentication status management unit 22, an authentication function processing unit 23, an authentication information transmission unit 24, and a policy storage unit 25.

  The authentication policy management server 11 includes an authentication policy registration unit 26, a policy storage unit 27, and an authentication policy search unit 28.

  The authentication requesting device 13 is, as a specific example, a device that uses authentication such as personal biometric authentication or ID authentication as a service providing requirement condition, and includes an authentication policy inquiry unit 31, an authentication information reception unit 32, an authentication check unit 33, and a restriction. A functional unit 34 is provided.

  FIG. 4 is a diagram showing the contents of authentication policy information. Referring to FIG. 4, the authentication policy 4 includes an authentication ID 41, a re-authentication period 42, and an authentication method 43.

  The authentication ID 41 is unique identification information for identifying the authentication policy, and is generated by the authentication policy management server 11.

  The re-authentication period 42 is an effective period of authentication executed by the authentication function processing unit 23 of the mobile phone 12.

  The authentication method 43 is information indicating the type of authentication set by the user, and authentication of the type is executed by the authentication function processing unit 23.

  In the mobile phone 12 of FIG. 3, the policy management unit 21 has an input interface from the user and a communication function with the authentication policy management server 11. The policy management unit 21 transmits the authentication method 43 and the re-authentication period 42 input as the authentication policy by the user to the authentication policy management server 11. Further, the policy management unit 21 stores the authentication method 43 and the re-authentication period 42 in the policy storage unit 25 as an authentication policy together with the authentication ID 41 sent from the authentication policy management server 11.

  The authentication status management unit 22 starts operation when an authentication result is transmitted from the authentication function processing unit 13. An authentication policy that matches the type of the authentication result transmitted from the authentication function processing unit 13 is acquired from the policy storage unit 25, and the authentication ID 41 included in the authentication policy is held as authentication status information.

  If the authentication result by the authentication method 43 of the same type is not transmitted from the authentication function processing 13 until the re-authentication period 42 elapses for the authentication ID 41 registered in the authentication status information, the authentication status management unit 22 The corresponding authentication ID 41 is deleted from the authentication status information.

  Further, when authentication status information is requested from the authentication information transmission unit 24, the authentication status management unit 22 delivers the authentication status information at that time to the authentication information transmission unit 24.

  The authentication function processing unit 23 includes a plurality of types of authentication functions such as biometric authentication using fingerprints and face recognition, device authentication using an external server (not shown), and basic authentication using a password. When each type of authentication is performed, the authentication result management unit 22 is notified of the authentication result.

  The authentication information transmitting unit 24 has a short-range wireless communication function, and starts operation when approaching the authentication information receiving unit 32 in the authentication requesting device 13. The authentication information transmission unit 24 acquires authentication status information from the authentication status management unit 22 and transmits it to the authentication information reception unit 32 of the authentication requesting device 13.

  The policy storage unit 25 is a storage area that stores authentication policy information that is passed from the policy management unit 21 and used by the authentication status management unit 22. The authentication status information indicates an authentication ID 41 included in the authentication policy authenticated by the authentication status management unit 22 in the mobile phone 12. The policy storage unit 25 can store a plurality of authentication IDs as authentication status information.

  In the authentication policy management server 11 of FIG. 3, the authentication policy registration unit 26 has a function of communicating with the mobile phone 12. When the authentication policy registration unit 26 receives information on the authentication policy including the authentication method 43 and the re-authentication period 42 from the policy management unit 21 of the mobile phone 12, the authentication policy registration unit 26 searches the policy storage unit 27 and has the same type as the authentication policy. It is determined whether or not the authentication policy is in the policy storage unit 27.

  If there is an authentication policy of the same type, the authentication policy registration unit 26 transmits the authentication ID 41 of the authentication policy to the mobile phone 13. On the other hand, if there is no authentication policy of the same type, the authentication policy registration unit 26 generates a unique authentication ID 41, creates a new authentication policy 41 of that authentication ID, and stores it in the policy storage unit 27. At the same time, the authentication policy registration unit 26 notifies the generated authentication ID 41 to the mobile phone 12.

  The authentication policy search unit 28 has a function of communicating with the authentication requesting device 13 of the authentication requesting device 13. When the authentication policy search unit 28 receives the authentication type information as the request condition from the authentication policy inquiry unit 31, the authentication policy search unit 28 searches the policy storage unit 27 in the authentication policy management server 11 for an authentication policy suitable for the type. . Then, the authentication policy search unit 28 notifies the authentication request apparatus 13 of the authentication ID 41 included in all authentication policies that match the request conditions.

  The policy storage unit 27 is a storage area for storing information on an authentication policy registered by the authentication policy registration unit 26 and accessed by the authentication policy search unit 28.

  In the authentication requesting apparatus 13 of FIG. 3, the authentication policy inquiry unit 31 has a function of communicating with the authentication policy management server 11. When the authentication policy inquiry unit 31 is requested by the authentication check unit 33 to acquire an authentication policy that matches the request condition, the authentication policy inquiry unit 31 sends information indicating the type of authentication that is the request condition to the authentication policy management server 11, and the type Request a search for an authentication policy that matches When the authentication ID 41 as the search result is acquired from the authentication policy management server 11, the acquired authentication ID is delivered to the authentication check unit 33.

  The authentication information receiving unit 32 has a function of performing short-range wireless communication with the mobile phone 12. When the authentication information receiving unit 32 approaches the authentication information transmitting unit 14 of the mobile phone 1, the authentication information receiving unit 32 starts its operation. The authentication information reception unit 32 acquires authentication status information from the authentication information transmission unit 24 and transmits the authentication status information to the authentication check unit 33.

  Upon receiving the authentication status information from the authentication information receiving unit 32, the authentication check unit 33 requests the authentication policy inquiry unit 31 to acquire an authentication policy that matches the request condition. When the authentication ID 41 indicating the authentication policy that matches the request condition is acquired from the authentication policy inquiry unit 31, the authentication status information acquired from the authentication information receiving unit 32 is compared with the authentication IDs 41.

  If any of the authentication IDs of the authentication policy acquired from the authentication policy inquiry unit 31 matches the authentication ID of the authentication status information, the authentication check unit 33 determines that the authentication is normally performed (authentication OK). To do. If there is no authentication ID of the authentication policy acquired from the authentication policy inquiry unit 31 that matches the authentication ID of the authentication status information, the authentication check unit 33 determines that the authentication is not normally performed (authentication NG). To do. The authentication policy inquiry unit 31 notifies the restriction function unit 34 of the authentication determination result (authentication OK or authentication NG).

  Upon receiving the authentication determination result notified from the authentication check unit 33, the restriction function unit 34 restricts the service function accordingly. For example, it is assumed that the authentication requesting device 13 is a vending machine, and a user purchases a product using a non-contact type IC card incorporated in the mobile phone 12. If the determination result is authentication OK, the restriction function unit 34 executes settlement and product payout. If the determination result is authentication NG, the restriction function unit 34 notifies the user that the payment cannot be made.

  5A to 5C are diagrams illustrating images of operations or operations of the authentication system according to the present embodiment. FIG. 5A shows an operation image when the user inputs an authentication policy to the mobile phone 12. This operation is referred to as operation A. FIG. 5B shows an operation image when the user performs authentication by the authentication function provided in the mobile phone 12. The operation at this time will be referred to as operation B. Authentication types include biometric authentication such as fingerprint authentication and face recognition, password authentication using an external authentication organization, and device authentication using the mobile phone 12. FIG. 5C shows an operation image when the mobile phone 12 and the authentication requesting device 13 are performing near field communication (NFC communication). This operation is referred to as operation C.

  First, the operation A will be described.

  In the cellular phone 12, as shown in FIG. 5A, when an authentication policy is input by the user, the policy management unit 21 starts to operate, and the authentication method 43 and the re-authentication period 42 input as the authentication policy are changed to the authentication policy management. This is transmitted to the authentication policy registration unit 26 of the server 11.

  In the authentication policy management server 11, when the authentication policy registration unit 26 receives the authentication policy from the policy management unit 11, the authentication policy registration unit 26 searches the policy storage unit 27 for a matching authentication policy of the type. If there is a matching authentication policy, the authentication policy registration unit 21 transmits the authentication ID 41 of the authentication policy to the policy management unit 21 of the mobile phone 12. If there is no matching authentication policy, the authentication policy registration unit 21 generates a unique authentication ID 41, newly creates an authentication policy 4 of the authentication ID 41, and stores it in the server policy storage unit 28. At the same time, the authentication policy registration unit 21 transmits the generated authentication ID 41 to the policy management unit 21 of the mobile phone 12.

  In the cellular phone 12, the policy management unit 21 creates an authentication policy by combining the authentication method 43 and re-authentication period 42 sent to the authentication policy management server 11 and the authentication ID 41 received from the authentication policy management server 11. And stored in the policy storage unit 25.

  Thereby, registration of the authentication policy 4 to the mobile phone 12 and the authentication policy management server 11 is completed.

  Next, the operation B will be described.

  In the mobile phone 12, when the user performs authentication as shown in FIG. 5B, the authentication function processing unit 23 starts operating. When the authentication is completed, the authentication function processing unit 23 transmits the authentication method 42 of the completed authentication to the authentication status management unit 22 as an authentication result.

  When the authentication status management unit 22 receives the authentication result from the authentication function processing unit 23, the authentication status management unit 22 acquires the authentication policy 4 whose type matches the authentication obtained from the authentication result from the authentication policy storage unit 25, and sets the authentication policy 4 The included authentication ID 41 is held as authentication status information.

  The authentication status management unit 22 monitors the progress of the re-authentication period 42 for the authentication ID 41 held as the authentication status information. If the same type of authentication result is not received from the authentication function processing 23 before the re-authentication period 42 elapses, the authentication status management unit 22 performs authentication by deleting the corresponding authentication ID 41 from the authentication status information. Eliminate the state of being.

  Further, if the same type of authentication result is received from the authentication function processing 23 before the re-authentication period 42 elapses, the authentication status management unit 22 resets the elapsed time count and again passes the re-authentication period 42 elapses. Continue monitoring.

  Thereby, the authentication status information in the mobile phone 12 can be managed.

  Next, the operation C will be described.

  In the mobile phone 12, the authentication information transmission unit 24 requests the authentication status management unit 22 and acquires the authentication status information from the authentication status management unit 22. Then, the authentication information transmitting unit 24 transmits the acquired authentication status information to the authentication information receiving unit 32 of the authentication requesting device 13 using NFC communication as illustrated in FIG. 5C.

  In the authentication requesting device 13, when receiving the authentication status information from the authentication information transmitting unit 24, the authentication information receiving unit 32 transmits the authentication status information to the authentication checking unit 33. When the authentication check unit 33 receives the authentication information 16 from the authentication information receiving unit 32, the authentication check unit 33 requests the authentication policy inquiry unit 31 to acquire a request condition related to authentication. Upon receiving a request from the authentication check unit 33, the authentication policy inquiry unit 31 transmits a request condition set in advance in the authentication requesting device 13 to the authentication policy search unit 22 of the authentication policy management server 11.

  In the authentication policy management server 11, when the authentication policy search unit 28 receives the request condition from the authentication policy inquiry unit 31, the authentication policy search unit 28 extracts the authentication policy 4 that matches the request condition from the server policy storage unit 27. The authentication ID 41 included in the authentication policy 4 is delivered to the authentication requesting device 13.

  In the authentication requesting device 13, the authentication policy inquiry unit 31 delivers the authentication ID group from the authentication policy search unit 28 to the authentication check unit 33 as it is. When the authentication check unit 33 acquires the authentication ID 41 group from the authentication policy inquiry unit 31, the authentication check unit 33 compares them with the authentication ID of the authentication condition information acquired from the authentication information reception unit 32. If there is a matching authentication ID, the authentication check unit 33 notifies the restriction function unit 34 of authentication OK. If there is no matching authentication ID, the authentication check unit 33 notifies the restriction function unit 34 of authentication NG.

  When the restriction function unit 34 receives the authentication OK from the authentication check unit 33, the restriction function unit 34 performs an operation when the authentication is confirmed. In addition, when receiving the authentication NG from the authentication check unit 33, the restriction function unit 34 performs an operation when the authentication cannot be confirmed.

  Thereby, it is possible to check whether or not the authentication that is a required condition is performed on the mobile phone 12 of the user who wants to receive the service, and to reflect this in the operation of the service function.

  As described above, the user sets the authentication policy in the mobile phone 12 and the authentication policy management server 11 in advance (operation A), executes authentication on the mobile phone 12 (operation B), and the authentication status on the mobile phone 12 And the authentication policy on the authentication policy management server 11, it can be confirmed whether or not the authentication satisfying the request condition of the authentication requesting device 13 is performed for the user (operation C).

  The case where this embodiment is applied to a vending machine will be described.

  FIG. 6 is a diagram for explaining authentication by the authentication requesting apparatus 13 that is a vending machine. In FIG. 6, user A is the owner of mobile phone 13 (terminal A), and user B is a person other than user A. Terminal A has a settlement function using an IC card. The terminal A has an authentication policy “authentication method: fingerprint authentication, re-authentication plan: 30 minutes” set by the user A.

  The authentication requesting apparatus 13 that is a vending machine is set to be “fingerprint authenticated” as the authentication request condition. The authentication requesting device 13 is set to settle the fee for the product with the IC card of the terminal A if the authentication is OK, and to reject the payment of the fee using the IC card when purchasing the product if the authentication is NG.

  As a first example, it is assumed that the user A intends to purchase a product using the authentication requesting device 13 (vending machine). When user A himself performs fingerprint authentication on terminal A, the authentication is valid for 30 minutes. Since the fingerprint authentication satisfies the requirements of the authentication requesting device 13, the user A can purchase a product and pay the fee with the IC card during that time.

  As a second example, it is assumed that a user B who is a friend or family member of the user A intends to purchase a product using the authentication requesting device 13. When user A who is the owner of terminal A performs fingerprint authentication on terminal A, the authentication is valid for 30 minutes. Since the fingerprint authentication satisfies the requirements of the authentication requesting device 13, if the user B uses the terminal A on behalf of the user A, the product can be purchased and the fee can be paid with the IC card.

  As a third example, it is assumed that a user B who is a malicious third party intends to purchase a product using the authentication requesting device 13. When the user B obtains the terminal A illegally and tries to purchase a product from the authentication requesting device 13 using the terminal A, since the fingerprint authentication by the user A is not performed, the user B charges the product fee to the terminal I can't pay with A.

  If user B obtains terminal A and tries to purchase a product from authentication requesting device 13 within 30 minutes after user A performs fingerprint authentication, the terminal A can pay the fee. However, the risk of unauthorized use can be reduced by the user A setting a short re-authentication period.

  As described above, in this embodiment, since the authentication is effective during the re-authentication period after the authentication is performed, the user does not need to perform the authentication every time the mobile phone 12 and the authentication requesting device 13 perform wireless communication. High convenience.

  As mentioned above, although embodiment and the Example of this invention were described, this invention is not limited to these, In the range of the technical idea of this invention, it uses these embodiment and an example combining. Or a part of the configuration may be changed.

It is a block diagram which shows the structure of the authentication system by this embodiment. It is a sequence diagram which shows operation | movement of the authentication system by this embodiment. It is a block diagram which shows the structure of the authentication system of a present Example. It is a figure which shows the content of the information of an authentication policy. It is a figure which shows the image of operation or operation | movement of the authentication system of a present Example. It is a figure which shows the image of operation or operation | movement of the authentication system of a present Example. It is a figure which shows the image of operation or operation | movement of the authentication system of a present Example. It is a figure for demonstrating the authentication by the authentication request | requirement apparatus 13 which is a vending machine.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 Authentication policy management server 12 Card apparatus 13 Authentication request apparatus 14 Network 21 Policy management part 22 Authentication status management part 23 Authentication function processing part 24 Authentication information transmission part 25 Policy preservation | save part 26 Authentication policy registration part 27 Policy preservation part 28 Authentication policy search Unit 31 Authentication policy inquiry unit 32 Authentication information reception unit 33 Authentication check unit 34 Restriction function unit

Claims (15)

An authentication policy management server that holds authentication policy information indicating the type of authentication registered in advance by the user;
A card device that holds authentication status information indicating whether or not the type of authentication registered as the authentication policy information in the authentication policy management server;
Request condition information indicating the type of authentication that is a request condition is preset, and whether or not the type indicated by the request condition information has been authenticated for a user who intends to use the card device, An authentication requesting device for determining based on the authentication policy information held in the authentication policy management server and the authentication status information held in the card device;
Having an authentication system.   The authentication requesting device reads from the card device that the request condition information matches the authentication type in the authentication policy information held in the authentication policy management server and the user intends to use. 2. The method according to claim 1, wherein it is determined whether or not the type of authentication indicated by the request condition information is performed for the user by checking whether there is authentication policy information corresponding to the authentication status information. Authentication system. The authentication requesting device includes:
From the authentication policy information held in the authentication policy management server, obtain all authentication policy information that matches the request condition information and the authentication type,
The authentication system according to claim 2, wherein whether or not the acquired authentication policy information corresponds to the authentication status information is checked. The card device has a communication function for accessing the authentication policy management server, and registers the authentication policy information in the authentication policy management server using the communication function,
The authentication policy management server gives authentication identification information to the authentication policy information registered by the card device, holds the authentication identification information in the authentication policy information and notifies the card device,
The card device holds the authentication identification information given to the authentication policy information as the authentication status information when the type of authentication registered as the authentication policy information is performed,
The authentication requesting device includes: authentication identification information included in authentication policy information whose authentication condition matches the request condition information in the authentication policy information held in the authentication policy management server; and the authentication status information If the authentication identification information read from the card device matches, it is determined that the type of authentication indicated by the request condition information is performed for the user.
The authentication system according to claim 2.   The card device has a re-authentication period that is a period for validating the executed authentication, and when the type of authentication registered as the authentication policy information is executed, after the authentication is executed, 5. The re-authentication period maintains a state where the authentication is performed in the authentication status information, and when the re-authentication period elapses, the state where the authentication is performed is canceled. The authentication system described in. An authentication method for authenticating a user by communication between a card device and an authentication requesting device,
The authentication policy management server holds authentication policy information indicating the type of authentication registered in advance by the user,
The card device holds authentication status information indicating whether or not the type of authentication registered as the authentication policy information in the authentication policy management server,
In the authentication requesting device, holding request condition information indicating a type of authentication to be a request condition,
The authentication policy information stored in the authentication policy management server indicates whether or not the type of authentication indicated by the request condition information has been performed for a user who intends to use the card device in the authentication requesting device. And an authentication method for determining based on the authentication status information held in the card device.   The authentication requesting device reads from the card device that the request condition information matches the authentication type in the authentication policy information held in the authentication policy management server and the user intends to use. 7. It is determined whether or not the type of authentication indicated by the request condition information is performed for the user by checking whether there is authentication policy information corresponding to the authentication status information. Authentication method. The authentication requesting device includes:
From the authentication policy information held in the authentication policy management server, obtain all authentication policy information that matches the request condition information and the authentication type,
The authentication method according to claim 7, wherein whether or not the acquired authentication policy information corresponds to the authentication status information is checked. The card device has a communication function for accessing the authentication policy management server, and registers the authentication policy information in the authentication policy management server using the communication function,
The authentication policy management server gives authentication identification information to the authentication policy information registered by the card device, holds the authentication identification information in the authentication policy information and notifies the card device,
The card device holds the authentication identification information given to the authentication policy information as the authentication status information when the type of authentication registered as the authentication policy information is performed,
The authentication requesting device includes: authentication identification information included in authentication policy information whose authentication condition matches the request condition information in the authentication policy information held in the authentication policy management server; and the authentication status information If the authentication identification information read from the card device matches, it is determined that the type of authentication indicated by the request condition information is performed for the user.
The authentication method according to claim 7.   The card device has a re-authentication period that is a period for validating the executed authentication, and when the type of authentication registered as the authentication policy information is executed, after the authentication is executed, The re-authentication period maintains the state in which the authentication is performed in the authentication status information, and when the re-authentication period elapses, the state in which the authentication is performed is canceled. Authentication method described in. Policy management means for registering authentication policy information indicating the type of authentication registered in advance by the user in the authentication policy management server;
A card device comprising: authentication status management means for managing authentication status information indicating whether or not the type of authentication registered as the authentication policy information has been registered in the authentication policy management server.   The authentication status management means has a re-authentication period that is a period for validating the executed authentication, and when the type of authentication registered as the authentication policy information is executed, the authentication is executed. The card device according to claim 11, wherein the re-authentication period maintains the state in which the authentication is performed in the authentication status information, and the state in which the authentication is performed is canceled when the re-authentication period elapses. . Authentication policy inquiry means for acquiring authentication policy information indicating the type of authentication registered in advance by the user, held in the authentication policy management server;
Authentication information receiving means for acquiring authentication status information indicating whether or not authentication of the type registered as the authentication policy information in the authentication policy management server is held in a card device;
Whether the type of authentication indicated by the request condition information indicating the type of authentication set in advance as a request condition for the user who intends to use the card device is acquired from the authentication policy management server. Authentication check means for determining based on authentication policy information and the authentication status information acquired from the card device;
An authentication requesting device.   In the authentication policy information held in the authentication policy management server, the request condition information and the type of authentication match, and the authentication status read from the card device that the user tried to use The authentication requesting apparatus according to claim 13, wherein it is determined whether or not the type of authentication indicated by the request condition information is performed for the user by checking whether there is authentication policy information corresponding to the information. An authentication policy inquiry means acquires all the authentication policy information whose authentication condition matches the request condition information from the authentication policy information held in the authentication policy management server,
The authentication requesting apparatus according to claim 14, wherein the authentication check unit checks whether there is information corresponding to the authentication status information in the authentication policy information acquired by the authentication policy inquiry unit.

Images