JP2010218276A - Authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system for improving the convenience of log-in and screen lock release without deteriorating security. <P>SOLUTION: This authentication system includes a password management device including a password input means for inputting a password; a password encryption means for encrypting the input password; a password temporary storage means for temporarily storing the encrypted password over a prescribed time or until a PC is logged out; and a communication means for performing Bluetooth wireless connection with the PC. The PC includes: a communication means for performing Bluetooth wireless connection with the password management device; a password decryption means for decrypting the encrypted password received from the password management device; a non-contact IC card reader for reading a user certificate from the non-contact IC card whose lock has been unlocked based on the decrypted password; and a log-in control means for logging in the PC only when it is confirmed that the user is a normal user from the contents of the user certificate. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an authentication system that prevents login by a person who is not a legitimate authorized person and impersonation after login when using a computer.

  In the method of preventing impersonation in a computer device, when it is detected that an IC card is inserted in an IC card device connected to the computer device, the user ID and password stored in the IC card are read and the user ID entered by the user is read. If the login process is performed by comparing with the password, and the login is successful, the access counter is stored in the computer device and the IC card, the computer device can be operated, and no operation is performed within the set time. For example, it is checked whether an IC card is inserted in the IC card device, and if it is not detected that an IC card is inserted, the process is locked by a screen saver (see, for example, Patent Document 1).

JP-A-11-305867

However, when considering security, even if password authentication is used or a screen saver method is used, if a password is stolen or leaked, it can be used improperly and harm a legitimate user or It can happen to give unfair profits.
In addition, when user authentication is performed using a recording medium such as a magnetic card that can be physically copied instead of a password, it is illegally used and a legitimate user is harmed or an illegal user is gained. Things can happen.
In order to maintain security, logout or screen lock is performed when there is no operation for a predetermined time after logging in once, and the PC cannot be operated unless login or screen lock release operation is performed again. There is a problem in that convenience has to be reduced because a password has to be entered each time.

  An object of the present invention is to provide an authentication system that improves the convenience of login and screen lock release without deteriorating security.

  The authentication system according to the present invention is an authentication system in which a PC can be logged in only when it is confirmed that the user is a regular user from the contents of the user certificate stored in the contactless IC card. A personal identification number input means, a personal identification number encryption means for encrypting the inputted personal identification number, and a personal identification number temporarily storing the encrypted personal identification number for a predetermined time or until the PC logs out. A storage means, and a password management device comprising a Bluetooth communication means for making a Bluetooth wireless connection with the PC, wherein the PC has a Bluetooth communication means for making a Bluetooth wireless connection with the password management device, and the password Security code decryption to decrypt the encrypted security code received from the management device A non-contact IC card reader that reads the user certificate from a non-contact IC card unlocked by the decrypted password, and confirms that the user is a legitimate user from the contents of the user certificate Log-in control means for logging in the PC only when it is done.

The effect of the authentication system according to the present invention is that the password for unlocking the contactless IC card is encrypted when the user certificate is read from the contactless IC card and the login process is performed. Although it is obtained from the personal identification number management device, since the personal identification number is temporarily stored in the personal identification number management device for a predetermined time, it is not necessary to input the personal identification number every time the login process is performed. Is to improve.
In addition, when a third party tries to illegally use an information device and a contactless IC card, the buzzer sounds for the personal identification number management device, so that the authorized user knows that there is a risk of unauthorized use. Is to improve.

It is a block diagram which shows the structure of the authentication system which concerns on Embodiment 1 of this invention. It is a flowchart which shows the procedure in PC when performing the pairing according to Bluetooth specification between PC and PIN code management apparatus which concern on Embodiment 1 of this invention. It is a flowchart which shows the procedure in a PIN code management apparatus when performing pairing according to Bluetooth specification between PC and PIN code management apparatus which concern on Embodiment 1 of this invention. It is a flowchart which shows a part of procedure in PC when login, logout, screen lock, or screen lock release of PC. It is a flowchart which shows the remainder of the procedure in PC when login, logout, screen lock, or screen lock cancellation of PC. It is a flowchart which shows a part of procedure in the PIN code management apparatus when login, logout, screen lock, or screen lock release of PC. It is a flowchart which shows the remainder of the procedure in a PIN code management apparatus when login, logout, screen lock, or screen lock release of PC. It is a block diagram which shows the structure of the authentication system which concerns on Embodiment 2 of this invention. It is a flowchart which shows the procedure replaced with S309-S311 of FIG. It is a flowchart which shows the procedure replaced with S406-S413 of FIG.

1 is a block diagram showing a configuration of an authentication system according to Embodiment 1 of the present invention.
Embodiment 1 FIG.
The present invention identifies a user's identity and appropriateness to various resources when operating information equipment such as a personal computer (hereinafter referred to as a PC) 1, a personal digital assistant (PDA), a mobile phone, and a car navigation device. The present invention relates to an authentication system for supporting an operation for acquiring qualification information necessary for access to a user. In this description, the PC 1 will be described as an example.
In the PC 1 according to the present invention, when there is a login request, it is possible to log in when the content of the user certificate stored in the non-contact IC card 2 relates to a person who is permitted to operate the PC 1. Then, in order to read out the user certificate stored in the non-contact IC card 2 via the non-contact IC card reader 3, the user is requested to input a password for unlocking the non-contact IC card 2, and the input password Only when the number is correct, the contactless IC card 2 is unlocked and the user certificate can be read out.

  When logging in for a long period of logout, for example, a mobile phone having a Bluetooth communication function, a PDA, a mouse, a keyboard, a printer, a modem, a barcode reader, and a GPS (Global Positioning System) receiver. The personal identification number is acquired from the personal identification number management device 4 such as a speaker or a headphone, and the personal identification number is temporarily stored in the personal identification number management device 4. When logging in when the logout is short, since the personal identification number temporarily stored in the personal identification number management device 4 is not deleted, the personal identification number can be sent to the PC 1 without newly inputting it. it can.

The authentication system according to Embodiment 1 of the present invention includes a PC 1, a personal identification number management device 4, and a non-contact IC card 2.
The PC 1 includes a Bluetooth communication unit 11 that performs Bluetooth wireless communication with the personal identification number management device 4, a PIN input unit 12 that is used for pairing with the personal identification number management device 4, and an encryption sent from the personal identification number management device 4. The personal identification number decrypting means 13 for decrypting the personalized personal identification number, the non-contact IC card reader 3 for reading the user certificate from the non-contact IC card 2, and the personal identification number from the personal identification number management device 4 when a login request is input In addition, a login control means 14 is provided for obtaining a user certificate from the non-contact IC card 2 using a personal identification number and logging in the PC 1.
Further, the PC 1 has a personal identification number input means 15 for inputting a personal identification number in case the wireless connection with the personal identification number management device 4 is not possible.

  The personal identification number management device 4 includes a Bluetooth communication unit 21 that performs Bluetooth wireless communication with the PC 1, a PIN input unit 22 that is used for pairing with the PC 1, and a password that is not stored and requires a new input. The personal identification number input means 23 for inputting the personal identification number, the personal identification number encryption means 24 for encrypting the inputted personal identification number, the personal identification number temporary storage means 25 for temporarily storing the encrypted personal identification number, and the personal identification number from the PC 1 When there is a number transmission request and logout notification, it has a password management means 26 for managing the password.

  The contactless IC card 2 stores user information as qualification information necessary for identifying the identity and validity of the user and accessing various resources. In order to read the user certificate from the non-contact IC card 2, the lock applied to the non-contact IC card 2 must be unlocked via the non-contact IC card reader 3, but it is used for unlocking. It is a password.

2 and 3 are flowcharts showing a procedure for performing pairing according to the Bluetooth standard between the PC 1 and the password management device 4 according to Embodiment 1 of the present invention.
A procedure for performing pairing according to the Bluetooth standard between the PC 1 and the password management device 4 according to Embodiment 1 of the present invention will be described. At this time, the PC 1 and the personal identification number management device 4 are arranged close to a range where Bluetooth communication is possible, for example, within 1 m. In addition, the user acquires a PIN in advance.
In S101, the PC 1 sets the radio to be undiscoverable and connectable.
In S102, the PC 1 searches the personal identification number management device 4 wirelessly.
In S103, the PC 1 calls the personal identification number management device 4 wirelessly.
In S104, the PC 1 requests pairing to the personal identification number management device 4 via wireless.

In S201, the personal identification number management device 4 is set so that wireless can be found and connected.
In S202, the personal identification number management device 4 responds to a wireless search from the PC1.
In S203, the personal identification number management device 4 receives a wireless call from the PC1.
In S204, the personal identification number management device 4 responds to the connection from the PC1.
In S205, the personal identification number management device 4 responds to the pairing request from the PC1.

In S <b> 105, the PC 1 obtains a PIN code used for pairing with the personal identification number management device 4 from the PIN input unit 12.
In S106, the PC 1 generates an initialization key for the personal identification number management device 4.
In S107, the PC 1 generates a link key with the personal identification number management device 4.
In S108, the PC 1 stores the link key with the personal identification number management device 4 and completes the pairing.

In S <b> 206, the personal identification number management device 4 acquires the PIN code used for pairing with the PC 1 from the PIN input unit 22.
In S207, the personal identification number management device 4 generates an initialization key with the PC1.
In S208, the personal identification number management device 4 generates a link key with the PC1.
In S209, the personal identification number management device 4 stores the link key with the PC 1 and completes the pairing.

In S109, the PC 1 performs authentication using the personal identification number management device 4 and the link key, and wirelessly connects to the personal identification number management device 4 when the authentication is successful.
In S110, the PC 1 registers a communication profile with the password management device 4.
In S111, the PC 1 sets the radio to be undiscoverable and not connectable.

In S210, the personal identification number management device 4 performs authentication using the PC 1 and the link key, and when the authentication is successful, establishes a wireless connection with the PC.
In S211, the password management apparatus 4 registers a communication profile with the PC1.
In S212, the personal identification number management device 4 sets the wireless to be undiscoverable and connectable.

4 and 5 are flowcharts showing a procedure in the PC 1 when the PC 1 is logged in, logged out, screen locked, or screen unlocked.
Next, a procedure for logging in, logging out, screen locking, or unlocking the PC 1 will be described.
In S301, it is determined whether or not the PC 1 is in the login state. When the PC 1 is not in the login state, the process proceeds to S304, and when the PC 1 is in the login state, the process proceeds to S302.
In S302, it is determined whether or not a time during which the PC 1 is not operated has passed a predetermined screen lock time. If it has elapsed, the process proceeds to S303, and if not, the process proceeds to S304.
In S303, the PC 1 is screen-locked and the process proceeds to S304.

In S304, the PC 1 determines whether there is a logon request, a screen lock release request, or a logout request by the user. If there is, the process proceeds to S305, and if not, the PC 1 is maintained as it is and the process returns to S301.
In S305, it is determined whether or not the PC 1 is wirelessly connected to the personal identification number management device 4, and when the wireless connection is established, the process proceeds to S308, and when the wireless connection is not established, the process proceeds to S306.
In S306, the PC 1 makes a wireless connection request to the personal identification number management device 4.
In S307, the PC 1 performs authentication using the personal identification number management device 4 and the link key. When the authentication is successful, the PC 1 wirelessly connects to the personal identification number management device 4 and proceeds to S308. When the authentication is unsuccessful, the processing proceeds to S312.

In S308, it is determined whether or not the user request is a logon request or a screen lock release request. If the user request is a logon request or a screen lock release request, the process proceeds to S309, and if it is not a logon request or a screen lock release request, the process proceeds to S321.
In S309, the PC 1 requests the personal identification number management device 4 to transmit the personal identification number.
In S310, the PC 1 receives the encrypted password from the password management device 4.
In S311, the PC 1 decrypts the encrypted code number to obtain the code number, and proceeds to S314.

In S312, a password input screen is displayed on the monitor of PC1.
In S313, the password entered by the user is acquired.
In S314, the lock of the non-contact IC card 2 is unlocked with a personal identification number.
In S315, it is determined whether or not the lock of the non-contact IC card 2 is unlocked. If unlocked, the process proceeds to S316, and if not unlocked, the process proceeds to S319.
In S316, a user certificate is acquired from the non-contact IC card 2.
In S317, it is determined whether or not the user certificate is valid and that of a regular user. If the user certificate is valid and that of a regular user, the process proceeds to S318, where the user certificate is invalid or the regular user's. If not, the process proceeds to S319.
In S318, login and screen lock release are permitted, and the process returns to S301.

In S319, login and screen lock release are prohibited.
In S320, it is determined whether or not the PC 1 is wirelessly connected to the personal identification number management device 4. When the wireless connection is established, the process proceeds to S321, and when the wireless connection is not established, the process returns to S304.
In S <b> 321, the PC 1 transmits a logout notification to the personal identification number management device 4.
In S322, the PC 1 disconnects the wireless connection with the personal identification number management device 4 and returns to S304.

6 and 7 are flowcharts showing a procedure in the personal identification number management device 4 when logging in, logging out, screen locking, or releasing the screen lock of the PC 1.
In S401, the personal identification number management device 4 determines whether the personal identification number is temporarily stored and the personal identification number temporary storage counter is timed out, and when the personal identification number is temporarily stored and the personal identification number temporary storage counter is timed out, S416. When the password is not temporarily stored or when the password temporary storage counter is not timed out, the process proceeds to S402.
In S402, the personal identification number management apparatus 4 determines whether or not there is a wireless connection request from the PC 1, and proceeds to S403 when there is a wireless connection request from the PC 1, and proceeds to S405 when there is no request.
In S403, the personal identification number management device 4 performs authentication using the PC 1 and the link key.
In S404, the personal identification number management device 4 determines whether or not the authentication with the PC 1 is successful. When the authentication is successful, the wireless connection with the PC 1 is established and the process proceeds to S405. When the authentication is unsuccessful, the process returns to S401.
In S405, the personal identification number management device 4 determines whether or not a logout notification has been received from the PC 1. When the logout notification is received, the process proceeds to S416. When the logout notification is not received, the process proceeds to S406.

In S406, the password management device 4 receives the password transmission request.
In S407, the personal identification number management device 4 sounds the buzzer for a predetermined time.
In S408, it is determined whether or not the encryption code number is temporarily stored. If it is not temporarily stored, the process proceeds to S409, and if it is temporarily stored, the process proceeds to S412.
In S409, the personal identification number management device 4 acquires a personal identification number for unlocking the contactless IC card 2 input by the user.
In S410, the personal identification number acquired by the personal identification number management device 4 is encrypted.
In S411, the personal identification number management device 4 temporarily stores the encrypted personal identification number.
In S412, the encryption code number temporarily stored by the code number management device 4 is read.
In S413, the personal identification number management device 4 wirelessly transmits the encrypted personal identification number to the PC 1.

In S414, it is determined whether or not the PIN management device 4 has received a logout notification. When the logout notification is received, the process proceeds to S416. When the logout notification is not received, the process proceeds to S415.
In S415, the personal identification number management device 4 starts counting after returning the personal identification number temporary storage counter to the initial value, and returns to S401.
In S416, the personal identification number management device 4 deletes the encrypted personal identification number temporarily stored, stops counting the personal identification number temporary storage counter, and returns to S401.

In the authentication system according to Embodiment 1 of the present invention, a password for unlocking the non-contact IC card 2 in order to read the user certificate stored in the non-contact IC card 2 via the non-contact IC card reader 3. The number is acquired from the personal identification number management device 4, but since the personal identification number is temporarily stored in the personal identification number management device 4 for a predetermined time, it is not necessary to input the personal identification number every time the login process is performed. Convenience is improved.
Further, since the password management device 4 can be brought by a user who is permitted to access the PC 1 and is paired with the PC 1, a user who is not permitted to access can transmit the password to the PC 1. This can prevent impersonation.

Embodiment 2. FIG.
FIG. 8 is a block diagram showing a configuration of an authentication system according to Embodiment 2 of the present invention.
The authentication system according to the second embodiment of the present invention is different from the authentication system according to the first embodiment of the present invention in that the second password encryption means 16 and the second password decryption means 17 are added to the PC 1B. Yes. In relation to this, the login control means 14B of the PC 1B is different, and the second encrypted code number encrypted by the second code number encryption means 16 is temporarily stored in the code number temporary storage means 25B. Since the other portions are the same, the same portions are denoted by the same reference numerals and the description thereof is omitted.

The PC 1B according to the second embodiment of the present invention includes a second personal identification number encryption unit 16 that encrypts the encrypted personal identification number transmitted from the personal identification number management device 4B, and a second personal identification number encryption unit 16. And a second password decrypting means 17 for decrypting the second encrypted password that has been encrypted and transmitted to the password management device 4B.
The login control means 14B according to the second embodiment of the present invention unlocks the contactless IC card 2 in order to read the user certificate stored in the contactless IC card 2 via the contactless IC card reader 3. In order to obtain the code number to be locked, the second code code number is obtained from the code number management device 4B and is decrypted by the second code number decrypting means 17 and the code number decrypting means 13. Further, when the personal identification number is input to the personal identification number management device 4B and encrypted and transmitted by the personal identification number management device 4B, the encrypted personal identification number is overlapped and encrypted by the second personal identification number encryption means 16 to manage the personal identification number. Send back to device 4B.
When the encrypted code number is sent from the code number management device 4B, the second code number encrypting means 16 superimposes the encrypted code number using the second encryption key and encrypts the second encrypted code number. obtain.
The second personal identification number decrypting means 17 decrypts the second encrypted personal identification number using the second decryption key to obtain an encrypted personal identification number.

The personal identification number management unit 26B of the personal identification number management device 4B according to the second embodiment of the present invention has a personal identification number transmission request from the PC 1B, and the second encrypted personal identification number is not stored in the personal identification number temporary storage unit 25B. At this time, the personal identification number is obtained from the user, the obtained personal identification number is encrypted by the personal identification number encrypting means 24, the encrypted personal identification number is sent to the PC 1, and the second encrypted personal identification number encrypted by being overlapped by the personal computer 1 is encrypted. Is stored in the code number temporary storage means 25B.
Also, the personal identification number management unit 26B transmits the second encrypted personal identification number to the PC 1 when there is a personal identification number transmission request from the PC 1B and the second encrypted personal identification number is stored in the temporary personal identification number storage unit 25B. .
The personal identification number temporary storage means 25B of the personal identification number management device 4B according to the second embodiment of the present invention stores the second encrypted personal identification number that has been encrypted by being overlapped by the PC1.

FIG. 9 is a flowchart showing a procedure in place of S309 to S311 in FIG.
In S501, the PC 1B requests the personal identification number management device 4B to transmit the second encrypted personal identification number.
In S502, the PC 1B receives the encrypted password or the second encrypted password.
In S503, it is determined whether or not the PC 1B has received the encrypted password. When the encrypted password is received, the process proceeds to S504. When the second encrypted password is received, the process proceeds to S506.
In S <b> 504, the PC 1 </ b> B encrypts the encrypted password with the second password encryption means 16.
In S505, the PC 1B transmits the second encrypted password encrypted by the second password encryption means 16 to the password management device 4B.
In S506, the PC 1B decrypts the second encrypted code number by the second code number decrypting means 17 to obtain an encrypted code number.
In S507, the PC 1B decrypts the encrypted code number to obtain the code number, and proceeds to S314.

FIG. 10 is a flowchart showing a procedure in place of S406 to S413 in FIG.
In S601, the personal identification number management device 4B receives the personal identification number transmission request.
In S602, the personal identification number management device 4B sounds the buzzer for a predetermined time.
In S603, the personal identification number management device 4B determines whether or not the second encrypted personal identification number is temporarily stored. If it is not temporarily stored, the process proceeds to S604, and if it is temporarily stored, the process proceeds to S609.
In S604, the personal identification number management device 4B obtains a personal identification number for unlocking the contactless IC card 2 input by the user.
In S605, the personal identification number acquired by the personal identification number management device 4B is encrypted.
In S606, the personal identification number management device 4B transmits the encrypted personal identification number to the PC 1B.
In S607, the personal identification number management device 4B receives the second encrypted personal identification number from the PC 1B.
In S608, the personal identification number management device 4B temporarily stores the second encrypted personal identification number.
In S609, the temporarily stored second encryption code number is read out.
In S610, the personal identification number management device 4B wirelessly transmits the second encrypted personal identification number to the PC 1B.

  In the authentication system according to the second embodiment of the present invention, the personal identification number previously encrypted by the personal identification number management device 4B and once sent to the PC 1B is overlapped and encrypted by using the second secret key in the personal computer 1B. Since it is returned to the management device 4B and temporarily stored, even if the password management device 4B is illegally operated to decrypt the second encrypted password, the password management device 4B does not have a decryption key, so the password is safe. Can be saved.

  1 PC, 2 non-contact IC card, 3 non-contact IC card reader, 4, 4B personal identification number management device, 11, 21 Bluetooth communication means, 12, 22 PIN input means, 13 personal identification number decryption means, 14, 14B login control means , 15, 23 PIN number input means, 16 second PIN number encryption means, 17 second PIN number decryption means, 24 PIN number encryption means, 25, 25B PIN number temporary storage means, 26, 26B PIN number management means.

Claims (2)

In an authentication system that logs in a PC only when it is confirmed that the user is a regular user from the contents of the user certificate stored in the contactless IC card,
A password input means for inputting a password, a password encryption means for encrypting the input password, and temporarily storing the encrypted password for a predetermined time or until the PC is logged out. A security code management device comprising a security code temporary storage means and a Bluetooth communication means for establishing a Bluetooth wireless connection with the PC;
The PC includes a Bluetooth communication means for establishing a Bluetooth wireless connection with the personal identification number management apparatus, a personal identification number decrypting means for decrypting the encrypted personal identification number received from the personal identification number management apparatus, and a lock by the decrypted personal identification number. A non-contact IC card reader that reads the user certificate from the unlocked non-contact IC card, and login control that logs in the PC only when the user is confirmed to be a legitimate user from the contents of the user certificate An authentication system comprising means. The PC includes a second password encryption unit that encrypts and encrypts the encrypted password received from the password management apparatus, and stores the encrypted password that has been encrypted and overlapped via the Bluetooth communication unit. Send it to the PIN management device
The personal identification number management apparatus stores the received encrypted personal identification number in the personal identification number temporary storage means and responds to the request for transmitting the encrypted personal identification number that has been encrypted in duplicate from the PC. Read out the encrypted PIN code that has been encrypted from the PIN code temporary storage means and send it to the PC,
The PC includes a second code number decrypting unit that decrypts the encrypted code number received and encrypted from the code number management device, and the code number decrypting unit is obtained by decryption by the second code number decrypting unit. The authentication system according to claim 1, wherein the encrypted password is decrypted.

Images