JP2002014932A - Portable device for authenticating individual - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the trouble of individual authentication when a computer connected to a computer network is used, to reduce the maintenance/ management cost of the computer and a telephone set in an office, and to improve security by automating the management and update of the password in individual authentication. SOLUTION: The portable telephone set where individual ID information, a password and the individual number of the portable telephone set are recorded is used as the device for authenticating individual instead of the ID card of an employee card which is used for authenticating the individual in a conventional case and is used for authenticating the individual at connection to the computer network, etc.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention seeks to simplify the personal authentication procedure when using a computer and to improve the security of the computer use environment, and to manage the computer use environment in a unified manner so that the number of computers installed in an office can be improved. Reduction of computer software environment maintenance costs. In addition, by providing personal authentication functions to mobile phones, we eliminate fixed telephones in the office, reduce office maintenance and management costs such as telephone work, and eliminate the trouble of telephone transfer and telephone correspondence when the person is not present. .

[0002]

2. Description of the Related Art Conventionally, an ID is generally used as an individual authentication method.
Cards are used. ID information is recorded on the ID card in a magnetic or semiconductor memory, and personal authentication is performed by calling this information at the time of authentication. Those that transfer and settle money, such as bank cash cards and credit cards, refer to IDs and PINs at the time of use to perform personal authentication.

When a single computer is shared by a plurality of users, an ID and a password are input when the computer is started, and the respective work areas are referred to. Similarly, when a computer network is used, such as referring to a server computer, an individual is authenticated by inputting an ID and a password to the server computer before connecting to the computer network, so that the computer network can be used.

[0004] Another problem apart from personal authentication is the reduction in computer maintenance costs. As a means for solving this problem, there is a network computer system disclosed in Japanese Patent Application Laid-Open No. H11-282686. In the network computer system, all software of a computer is managed by a server computer, and software and data are downloaded from the server computer via a computer network when a computer terminal is used. However, the network computer system is not used because of a heavy load on the computer network. Also, as disclosed in Japanese Patent Application Laid-Open No. H11-232193, a method has been devised in which a home server is installed and call processing is performed, thereby enabling the use of a computer network by a portable terminal. The load on the computer network is high, and it cannot be said that the environment is sufficient for many users.

As another problem, there is a reduction in the maintenance cost of offices and telephones installed in offices. As a solution to this problem, there is a method of installing the necessary number of office desks without specifying them, using the seats in the order in which they come to work, changing all telephones to mobile phones, eliminating fixed telephones, etc. ing.

[0006]

Although personal authentication using an ID card is simple, there is a security problem against unauthorized copying and the like. The contents of a magnetic recording type ID card can be easily read by a device such as a magnetic card reader.
D information can be decrypted or duplicated. By analyzing multiple ID cards, a fictitious ID is created,
It can be misused. On the other hand, an ID card using a semiconductor memory has relatively high security against decryption and the like, but requires care in handling such as bending and electrostatic destruction. The biggest problem with ID cards is the handling of passwords. When an ID card is used, a password is used together. However, if the password length is increased to enhance security, the user cannot store the password because it is too long. When writing a memo, if the memo is viewed by another person, or the ID card and the memo are lost or stolen together, unauthorized use is forgiven. For this reason, the password length is generally about 4 to 8 characters. Another problem with ID cards is that it is not possible to identify where they are lost or stolen. In the case of an ID card that performs an electronic inquiry at the time of use, such as a cash card or a credit card, it is necessary to notify the issuer of the card that the card has been lost or stolen, and have the card invalidated. In addition, in the case of an ID card only for inquiry using a photograph, it can be easily illegally used. If the location of the ID card can be specified, it can be searched for when it is lost, and even if it is stolen, the location of the ID card or the stolen person can be located.
It is possible to prevent unauthorized use of the card.

I required for personal authentication when using a computer
D and the password have the same problem. Recording the ID or password in a memo or the like is not preferable for security. For this reason, it is necessary for each person to memorize the password, and the number of characters of the password cannot be too long like the ID card. If the user forgets the password, it is necessary for the user to update the password by taking a procedure such as directly inquiring the server computer administrator. At present, the computer environment used by each person for work and personal use is diversifying, and multiple IDs and passwords have to be used together. In recent years, unauthorized access to server computers called hacking has become a problem, so password management Is becoming very important. If the password length is known, the password can be found by repeatedly accessing the same ID while changing the password. Furthermore, if there is information such as the user's name, date of birth, hobbies, etc., it is possible to analogize the character strings and numeric strings that will be used for the password based on this information, and to find the password. Can often be shortened. Further, it is not preferable from the viewpoint of security to use the same password for a long time or to make all the passwords the same, and it is preferable that all the passwords have different character strings and are regularly updated. However, in reality, if a different password is set for the device to be used, or if the password is changed frequently, the user's password is likely to be mistaken or forgotten, and the authentication work becomes complicated and the password is not changed. Mistakes can make the computer unusable.

One object of the present invention is to provide a personal authentication device for automatically inputting an ID and a password, thereby increasing the password length, making a completely random character string, and automatically updating the password. Thus, the security level of personal authentication is improved.

As another problem, in recent years, computerization of document creation has been advanced, and each person has used a computer regardless of the type of job. Computers have different work environments depending on users, and the amount of data required by each user is increasing. One computer is required for each person. So, like the sales department,
Even in offices where the number of people who usually work is small, it is necessary to secure computers and installation locations for the number of people. In addition, since different users use different softwares, collaborative work is hindered. Therefore, software installation and version upgrades must be performed simultaneously for all computers, which requires a large number of man-hours. As a means for solving this problem, a network computer system in which all software is placed on a server computer has been devised, but the load on a computer network is large and the actual use has not been achieved.

As another problem, there is a problem that telephone installation work and maintenance cost in an office are large. In a large company, it is necessary to carry out telephone wiring and the like in accordance with the rearrangement of seats due to personnel changes and the like. There are also problems such as handing over of a telephone call when the person is absent and loss of opportunity due to the absence of a person in charge. In order to solve such problems, some companies have stopped using fixed phones and have their own mobile phones. The above problems can be solved by having a mobile phone, but it is difficult to distinguish between using the phone at work and using the phone for private use. Is the current state of each company, and if telephone charges are kept individually or on a fixed-rate basis, there is a case where a fee structure that is disadvantageous for users who frequently use telephones at work may be created.

The problem to be solved by the present invention is to reduce the cost and man-hours involved in the maintenance of computers and offices by simplifying the personal authentication method when using these computers and computer networks. This is realized by a personal authentication device.

[0012]

As means for solving the above-mentioned problems, a portable telephone is equipped with a wireless communication function with a computer, and ID information such as an employee number, personal authentication information such as a password, and a telephone. A personal identification number is assigned to the destination list and the mobile phone itself, and the mobile phone is used as a personal authentication device. Then, each individual carries the personal authentication device instead of the ID card.

A computer terminal installed in an office or the like is provided with a function of communicating with the personal authentication device. In addition to this computer, a server computer for managing ID, password, and usage environment information is prepared, and these computers are connected via a computer network. When using a computer in a company, each person sits in front of an arbitrary computer terminal, connects the personal authentication device to the computer terminal using the communication function described above, and starts the computer terminal.
At this time, the information recorded in the personal authentication device is called from the computer terminal, the ID and the password are confirmed, the inquiry is made in the server computer, and the personal use environment recorded in the server computer is transferred to the computer. Build the usage environment on the terminal.

When updating the password, a new password is generated on the server computer when the computer terminal is used, transmitted to the personal authentication machine via the computer terminal, and the password recorded in the personal authentication machine is updated.

In the office, instead of installing a fixed telephone as in the past, a base station corresponding to a personal authentication machine is installed. However, when setting restrictions on the authority to make external calls by individuals, install a telephone that can connect to the minimum number of external lines in the office.

[0016]

FIG. 1 shows an embodiment of the present invention.
FIG. 1 shows a personal authentication machine according to the present invention. The personal authentication device 1 includes a memory unit 2, a mobile phone unit 3, a control unit 4, and a PC I / F unit 5 for communicating with a computer. The memory unit 2 records ID information such as employee numbers and member numbers, passwords, and authenticator individual numbers. In addition, in the case where the authority to make an external call from within the company and restrictions on the parties (dial destinations) to make calls are added, a list of dial destinations is also recorded at the same time. The mobile phone unit 3 has 10 key buttons and a telephone communication function as well as a mobile phone such as a PHS for connection to a public telephone line. Can be. The communication I / F unit 5 has a function of performing data communication by connecting to a computer terminal 6, a mobile computer, or a home computer. The control unit 4 controls an authentication procedure such as a call by the mobile phone unit 3, control of the communication I / F unit 5, and information calling of the memory unit 1 at the time of personal authentication. Note that the memory unit 2 may be included in a memory in the mobile phone unit 3.

FIG. 2 shows an example of the operation of the personal authentication device 1 of the present invention. The personal authentication device 1 is turned on (201), and a startup process (202) such as an internal operation check is performed. After the start-up process, the process enters a standby state (203). In the standby state, a carrier signal is periodically transmitted, and a reply from the base station that has received the carrier signal is received. Generally, carriers of a plurality of base stations are received simultaneously, so that the current position can be detected from the information of the received base stations. Conversely, the current position of the personal authentication device 1 can be specified by checking which base station received the signal based on the signal sent to the base station.

The manner in which the personal authentication device functions as a telephone will be described. When the user is in a company, the call is connected to a telephone line via a premises base station 12 installed in the company. There is no need to impose any restrictions on receiving calls (2
04, 205). When making a phone call, the processing differs depending on whether it is on the company premises or outside the company. When dialing while receiving the carrier signal of the local base station 12 (207), it is confirmed whether or not the user has the right to make an outside line (208), and only when the user has the right, is it possible to talk. If the authority is inside, the process returns to the standby state (203) again. When a call is made by connecting to a general public mobile phone base station (209), the dialed number and the list of dial destinations recorded in the memory unit 2 are referred to. If the number is not listed, it is regarded as a private phone (21
1), record it in billing information (212).

The function of the personal authentication device 1 as a telephone eliminates the need to set up a fixed telephone at a telephone company, and also makes it possible for external telephone calls to be made directly to the individual, which is troublesome to take over. Also, the user is not bothered by the processing when the user is absent. Further, by comparing the dial destination registered in the memory unit 2 of the personal authentication device 1 with the number of the called party, it is possible to distinguish between a private telephone and a business telephone. In the case of an occupation that frequently calls a customer at a location such as a sales office or an SE, the telephone number of the customer who frequently calls is registered in advance. By doing so, it is possible to reduce the problem of charging the telephone usage fee.

A description will be given of a procedure for connecting and using the personal terminal 1 with the computer terminal.

The personal authentication device 1 and the computer terminal 7 are connected by a wireless or wired interface (I / F) (213, 214). In the case of a wired connection, the computer needs to be manually or automatically recognized (21).
5). For this reason, it is desirable that the PC I / F unit 5 be a wireless interface or an interface that supports plug and play even in a wired manner.

After the connection is established (216), connection to the computer network 8 is made, and after confirming the ID and password,
It connects to the server computer (221) and uses the computer network (222).

When the personal authentication device 1 is lost, as in the standby state 202, a carrier signal is periodically transmitted to specify the position, so that it is possible to specify the position near which base station is located. . Further, a more accurate position of the personal identification device 1 can be specified by making a call to the personal identification device 1 and blinking a ring tone or an incoming lamp. If the personal authentication device 1 is not turned on, the position cannot be specified. However, if the power is not turned on, the personal identification device 1 does not function as an authentication device. Therefore, the individual number registered in the server computer 8 is invalidated. Discard as it is.
Thus, security in case of loss or theft can be ensured. The user applies to the server computer administrator until a new personal authentication device 1 is issued,
The computer terminal 7 can be used with a temporary ID and password.

The memory unit 2 shown in FIG.
The information written in the memory unit 2 is stored in the package 6 so that the information written in the memory unit 2 can be electrically connected to the outside of the package. Make calls unreadable. For example, the procedure is such that an ID and a password are not transmitted unless a specific number is input following the data call command of the memory unit 2.

The personal authentication procedure and the computer terminal connection method according to the present invention will be described with reference to FIGS.

FIG. 3 shows an example of the configuration of the system of the present invention. The computer terminal 7 has a communication function capable of communicating with the PC I / F unit 5 and basic software such as an OS. The computer terminal 7 is connected to a computer network 8 such as an in-house LAN. The computer network 8 is connected to a server computer 9 that stores information on the usage environment of each computer terminal user, management information on whether software can be used, and the like. .
FIG. 4 shows an example of a startup procedure of the computer terminal 7. First, when the power of the computer terminal 7 is turned on, the configuration is recognized by the BIOS in the same manner as a normal computer. At this time, the presence or absence of the personal authentication device 1 connected by wireless or wire is recognized (401). If the presence or absence of the personal authentication device 1 cannot be recognized, it is displayed that the presence or absence of the personal authentication device 1 cannot be confirmed, and the personal authentication device non-confirmation process is performed (41).
0). As the process 410, a process of waiting for recognition of the personal authentication machine 1, entering a procedure for automatically turning off the power, inputting a specific ID and password, and starting up as a stand-alone machine not connected to the computer network 8 is performed. The processing to be performed is set by the user or the system administrator. When the personal authentication device 1 is recognized, the computer network 7
Performs startup processing assuming a connection to. After starting the basic part of the OS and connecting to the computer network 8 (402), the computer terminal 7 communicates with the personal authentication device 1 and checks the individual number of the personal authentication device 1 (403). By referring to this individual number and a list of individual numbers registered in the server computer 8, the validity of the personal authentication device 1 is confirmed (404).
If the individual number of the personal authentication device 1 is not registered, the computer terminal 7 enters a termination procedure. Personal authentication machine 1
When the validity of the individual number is confirmed, the user ID information is received from the personal authentication device 1 (405). The presence or absence of the same ID is confirmed on the computer network 7 (406).
The password is received from the personal authentication device 1 (407) and transmitted to the server computer 9. The ID information and the password registered in the server computer 9 are queried and authenticated, the usage environment information of the user's computer terminal 7 is downloaded from the server computer 9 to the computer terminal 7 (409), and a software environment is constructed. . In step 406, if the user's ID has already been recognized by another computer terminal 11 and has been activated in the work environment under this user's ID, the activation of the computer terminal 7 is interrupted or the computer already activated After the state of the terminal 11 is transferred to the computer terminal 7, a process for redundant activation such as turning off the power of the computer terminal 11 is performed (411). The procedure of the process 411 can be selected by the user. In FIG. 3, the server computer that manages the individual number of the personal authentication device 1 and the server computer that manages the ID information and the password are expressed as the same server computer 9, but these may be managed by different server computers. . The computer usage method eliminates the need for the user to use a specific computer terminal. Furthermore, if wireless is used as the PC I / F unit, it is possible to create materials in the office and move the subsequent work to the conference room without having to remove and insert the personal authentication device 1. Become.

With such a method of using computer terminals, it is not necessary for each person to be conscious of which one is his / her own computer terminal. In departments with a small number of employees who use the company's computer terminals
What is necessary is just to install the required number of computer terminals, and all costs related to the introduction, maintenance and management of the computer system can be reduced. Also,
Since only the use environment information needs to be communicated with the server computer, the load on the computer network can be reduced as compared with a form in which all information is stored in the server computer like a network computer.

As one embodiment of the present invention, the communication I / F shown in FIG.
A wireless I / F is used as the unit 5. In this case, in an office or the like, there is a possibility that a plurality of portable personal authentication devices 1 and computer terminals 7 may exist in a narrow area, and another personal authentication device 10 in which the computer terminal 7 to be activated by a user is in the immediate vicinity. Or another computer terminal 11 recognizes at the same time as the computer terminal 7, there is a case where it has already been recognized that this ID has been activated. In order to avoid such repeated recognition of the personal authentication device 1, measures such as limiting the output power of the radio so that the recognizable distance is within about 1 m or controlling the reception sensitivity of the personal authentication device 1 are taken. .

An embodiment of the present invention will be described with reference to FIG. In the above-described personal authentication procedure, the computer terminal 7 starts up with the ID information of the personal authentication device 1 and is in a use environment of the user. In this state, the server computer 9
Generates a new password (501) and transmits it to the personal authentication device 1 via the computer terminal 7 (5).
02). The personal authentication device 1 updates the old password with the new password (503). At the time of this step 503, the old password is still stored. When the update work in the personal authentication device 1 is completed normally, a normal end signal is transmitted to the server computer 9. Server computer 9
Receives the normal end signal, discards the old password (504), and instructs the personal authentication device 1 to delete the old password (506). After receiving the command of this step 506, the personal authentication device 1 deletes the old password (506),
End all password update work. Personal authentication machine 1
If the password update procedure 503 fails in
A signal notifying that the update has failed is sent to the server computer 9. When receiving this signal, the server computer 9 discards the new password and re-registers the old password as a password (507). If there is no response from the personal authentication device 1 as to whether or not the update was successful, both the old password and the new password are set to be usable (508), and the personal authentication device 1 sends the new password at the next personal authentication. It is determined whether the received password is the old password or replaced with the new password, and the password of the server computer 9 is re-registered (509).

FIG. 6 shows an embodiment of the present invention. The computer terminal 14 is a mobile type or a computer installed at home. The procedure for connecting the computer terminal 14 to the computer network 8 and the server computer 9 will be described below. First, the computer terminal 14 is started.
In this case, since the user of the computer terminal 14 is unique, it is not necessary to construct an environment as in the case where the computer terminal 14 is directly connected to the computer network 8, and the computer is started up as a stand-alone computer. First, the computer terminal 14 and the personal authentication device 1 are connected, and the mobile phone unit 3 of the personal authentication device 1 dials the access point 13. As the dial destination, the current position is input from the software, or the position information detected by the personal authentication device 1 in the standby process 202 is compared with the dial destination list recorded in the memory unit 2 to select the nearest access point. After connecting to the access point 13, the ID and password are sent from the personal authentication device 1 to the server computer 9 to perform personal authentication. In the case of this connection method, since the purpose of use is limited to work, the user is charged as having performed the work.

[0031]

According to the present invention, the personal authentication procedure can be simplified and the password length can be reduced as compared with the conventional case where the personal authentication using an ID card, the personal authentication processing of a computer, and the telephone are separated. The security level can be improved, such as expansion of the size and automatic updating. Further, the present invention has an effect that the data to be transferred when the computer terminal is started up has a smaller size than only the personal use environment information as compared with the network computer system, and the load on the computer network can be reduced. Further, by having the function of a mobile phone, the cost of telephone installation can be reduced.

In addition, since the authentication function is built in the portable telephone, there is no need to pay attention to handling such as electrostatic destruction as in the case of an ID card using a semiconductor memory, and an existing device such as a charging circuit can be used. It can be produced at low cost.

Further, the present invention can be used for connection to a computer network from a mobile or home, and by automatically selecting an optimum access point, costs related to communication can be reduced.

[Brief description of the drawings]

FIG. 1 is a diagram showing a portable personal authentication device.

FIG. 2 is an explanatory diagram of the operation of the personal authentication device.

FIG. 3 is a diagram showing a computer system using a portable personal authentication device.

FIG. 4 is a diagram showing a computer terminal activation procedure.

FIG. 5 is a diagram showing a password update procedure.

FIG. 6 is a diagram illustrating a connection method at the time of mobile.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Portable personal authentication machine, 2 ... Memory part, 3 ... Mobile telephone part, 4 ... Control part, 5 ... PC I / F part, 6 ... IC package, 7 ... Computer terminal, 8 ... Computer network, 9 ...
Server computer, 10 ... portable personal authentication device, 11 ...
Computer terminal, 12 premises base station, 13 access point, 14 mobile or home computer terminal.

Claims (7)

[Claims] 1. A portable telephone having a communication function with a computer, which records information such as ID information such as an employee number, personal authentication information such as a password, a connection destination telephone number, and an individual identification number of the portable telephone itself. Personal authentication device characterized by having a memory part. 2. The portable personal authentication device according to claim 1, wherein
A portable personal authentication device having means for referring to the contents of a memory unit through an LSI that controls the mobile phone unit and the communication function unit. 3. A portable personal authentication device using a wireless communication interface as a communication function with the computer according to claim 1. 4. A portable telephone having a communication function with a computer, which records information such as ID information such as an employee number, personal authentication information such as a password, a connection destination telephone number, and an individual identification number of the portable telephone itself. Personal authentication device characterized by having a memory unit, a personal computer that calls personal authentication information such as ID information from the personal authentication device, and a computer terminal that starts up based on the authentication information, and a computer that connects a plurality of similar computer terminals A computer network comprising a network and a server computer recording usage environment information of computer terminal users such as employees. 5. Using the communication function of the portable personal authentication device,
After the computer terminal and the server computer recognize the presence or absence of the portable personal authentication machine and confirm the validity of the individual identification number of the portable personal authentication machine, the ID information recorded on the portable personal authentication machine and Using personal authentication information,
A computer terminal usage environment construction method for querying the usage environment of the computer terminal user recorded in the server computer and constructing the user environment on the computer terminal that has recognized the portable personal authentication device. 6. A connection method using a mobile computer or a home computer as the computer terminal according to claim 5, wherein position information of a base station closest to the portable personal authentication device is detected and said personal authentication is performed. A computer network connection method that refers to the connection destination telephone number recorded on the machine and connects to the most appropriate access point. 7. An authentication information updating method for automatically updating a password recorded in a personal authentication device in the computer terminal usage environment according to claim 5.