JP2020046925A - Authentication system - Google Patents

Abstract

To provide an authentication system that reduces burden that a customer carries an ID card and eliminates a risk of leaking detailed personal information.SOLUTION: An authentication system includes a store identification code to be provided to a store, a store device, a user registration server, a portable terminal device owned by a user, an authentication server, and a communication network. The user registration server has means for creating abstracted user information using image data of an identification card of the user and transmitting the created user information to the authentication server. The authentication server authenticates the store and the user, and transmits a user authentication result and the abstracted user information to the store device.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication system that authenticates a customer's qualification at a store such as alcoholic beverages, a window for a limited area service, and the like.

  Alcoholic beverages and tobacco retailers, game ticketing counters at game arcades, windows for limited services to local residents in the use of public halls and public sports facilities, and windows that provide services that differ depending on gender of men and women In the Japanese Patent Application Laid-Open No. 2003-207, after certifying the customer's age and other qualifications with the customer's identification card and the like, the company has offered sales of goods, services such as discount services limited to regions, and other services.

JP-A-2017-151738

  For a customer, there is a problem that the customer is required to always carry an ID card in order to receive a service in which the qualification is confirmed by an ID card and the service is not received if the user forgets to carry the ID card. In addition, if the customer presents identification cards or other documents to confirm their qualifications, the customer will be presented with the excessive personal information described in those documents at the counter. There was a problem that he did not want to present it and hesitated to present his identification card.

  In addition, for the person in charge of the merchandise store and the ticket issuing counter, there is a problem that the work of confirming the identity of the customer and confirming the qualification of the customer requires an administrative burden. In addition, there is also a problem that the person in charge of checking the identity of the customer and determining the qualification of the customer is uncertain.

  In addition, at stores and counters that provide services to customers after confirming the customer's qualifications, it is necessary to keep a record of the presented customer's personal information in order to record the identification, There was a problem in that information management had to be performed, and the burden of clerical work was excessive.

  In order to improve this, in Patent Literature 1, the age confirmation device acquires the biometric information of the customer and associates the biometric information with the biometric information from a biometric information database in which a personal ID associated with the biometric information of the customer is registered. There has been proposed a technique of reading a personal ID, reading age information of a customer associated with the personal ID from a personal information database, and transmitting the information to an age confirmation device.

  However, in the technique of Patent Document 1, although excessive disclosure of personal information can be avoided, if the personal information database is hacked by a malicious third party, there is a risk that detailed personal information stored in the personal information database is leaked. There was a problem.

An object of the present invention is to alleviate the above-mentioned problems and reduce the burden on the customer by eliminating the need for the customer to carry an identification card in which detailed personal information is described. Also, the qualification of the customer is easily and accurately determined at the store or the counter. In addition, the unnecessary disclosure of personal information other than the prescribed personal information by the conventional ID card is suppressed, and the risk of leaking detailed personal information due to hacking of the database is reduced, reducing the burden of personal information management of the system operator To provide an authenticated authentication system.

In order to solve the above-mentioned problems, the present invention provides a store identification code to be provided to a store, a store device, a user registration server, a portable terminal device owned by a user, an authentication server, and an authentication system configured with a communication network. And
The portable terminal device has means for photographing image data of a user's identification card and transmitting the image data to the user registration server,
Means for the user registration server to store a user key pair of a user ID, a user private key, and a user public key for each user in the portable terminal device;
Means for creating user information abstracted using the image data of the user's identification card and transmitting the user information to the authentication server,
The authentication server has means for authenticating the shop and the user, and means for transmitting an authentication result of the user and the abstracted user information to the shop apparatus,
When the portable terminal device transmits the user ID to the authentication server or the store device and requests user authentication, the mobile terminal device authenticates the store and the user, and authenticates the user authentication result and the abstracted user information. It is an authentication system characterized by transmitting to a store device.

  According to the present invention, with this configuration, the authentication server authenticates the mobile terminal device of the user at the store or the counter, and transmits the authentication result and the abstracted user information to the store device, so that the qualification of the customer at the store can be obtained. There is an effect that can be easily determined.

  Further, the present invention is the authentication system described above, wherein the authentication server receives the image data of the store identification code and the user's authentication request command data from the mobile terminal device, and An authentication system is characterized by performing authentication.

  Further, the present invention is the above-described authentication system, wherein the authentication server authenticates the store and the user by receiving authentication request command data of a user from the store device. .

Further, the present invention is the above authentication system,
The user registration server has means for creating a user public key certificate of the user public key and storing the certificate in the portable terminal device,
An authentication system, wherein the mobile terminal device transmits the user public key certificate to the authentication server or the store device.

Further, the present invention is the above authentication system,
The user registration server and the authentication server have block creation means for block chain data,
When the user registration server creates a user ID for each user and registers the user, the data obtained by adding the block in which the data of the user ID and the user public key are recorded to the blockchain is used as a participant of the blockchain. Send to
The authentication system is characterized in that the authentication server sends data obtained by adding a block in which the store and the user authentication result are recorded to a blockchain to a participant of the blockchain.

According to the present invention, an authentication system is configured by a store device of a store to which a store identification code is provided, a user registration server, a portable terminal device owned by a user, an authentication server, and a communication network, and the portable terminal device is a camera. The image data of the identity card of the user who has taken the image is transmitted to the user registration server.

  Then, the user registration server causes the user's portable terminal device to store the user ID pair for each user and the user's key pair of the user's private key and the user's public key.

  Further, the user registration server authenticates the user with the user's identification card received from the user's portable terminal device, creates abstracted user information using the image data of the identification card, and transmits the user information to the authentication server.

  Then, the user's portable terminal device transmits the user ID to the authentication server or the store device to request user authentication. In response, the authentication server authenticates the store and the user. Is transmitted to the shop device.

  According to the present invention, with this configuration, the authentication server authenticates the mobile terminal device of the user at the store or the counter, and transmits the authentication result and the abstracted user information to the store device, so that the qualification of the customer at the store can be obtained. There is an effect that can be easily determined. Further, there is an effect that the risk of leaking detailed personal information can be eliminated.

FIG. 1 is a diagram illustrating a configuration of an authentication system according to a first embodiment of the present invention. It is a flowchart (the 1) which shows the operation | movement procedure of the authentication system of the 1st Embodiment of this invention. It is a flowchart (the 2) which shows the operation | movement procedure of the authentication system of the 1st Embodiment of this invention. It is a figure showing the composition of the attestation system of a 2nd embodiment of the present invention. It is the flowchart (the 1) which shows the operation | movement procedure of the authentication system of the 2nd Embodiment of this invention. It is the flowchart (the 2) which shows the operation | movement procedure of the authentication system of the 2nd Embodiment of this invention.

<First embodiment>
As shown in FIG. 1, the authentication system according to the first embodiment includes a store device 100 of a store to which a store identification code 1 has been issued, a user registration server 200, a portable terminal device 300 owned by a user, and an authentication server 400. , A communication network NW connecting these devices.

(Portable terminal device 300)
As the mobile terminal device 300 of the user, a smartphone, a tablet terminal, a personal computer, or the like can be used. The authentication application software 310 is downloaded and installed in the user's portable terminal device 300 from the user registration server 200 via a network such as the Internet.

  The user transmits captured image data of the user's identification card 320 captured by the camera 300a of the mobile terminal device 300 to the user registration server 200 using the authentication application software 310 of the mobile terminal device 300 of the user. Is registered in the user registration server 200.

The authentication application software 310 of the user's portable terminal device 300 receives, from the user registration server 200, data of a user ID, a user key pair of a user private key KEY and a user public key CKEY, and a user public key certificate SKEY. And receive and store the abstracted user information.

(Store device 100)
The store joins the authentication system and registers the store device 100 in the authentication server 400. The registered store is provided with a store identification code 1 such as a two-dimensional code for identifying the store from the authentication server 400.

  The store receives a user authentication service that causes the authentication server 400 to authenticate a user who has visited the store. Then, the store device 100 of the store receives the user authentication result from the authentication server 400.

  The store device 100 is a device including a communication unit 110 that can receive a user authentication result from the authentication server 400. For example, as the store device 100, a personal computer, a tablet terminal, a smartphone, and a store manager provided in a store Mobile phones and the like can be used.

  Alternatively, the authentication server 400 provided in the store can also serve as the store device 100.

(User registration server 200)
The user registration server 200 supplies the authentication application software 310 to the user's mobile terminal device 300 and installs it. In addition, the user registration server 200 includes an identification card image analysis unit 210 that analyzes captured image data of the user identification card 320 received from the user's portable terminal device 300. In addition, a user information abstraction unit 220 for creating abstracted user information is provided.

(Registration of user to user registration server 200)
The user registration server 200 reads the user's identification card using an OCR (Optical Character Reader) of the identification card image analysis means 210 or the like. Further, the user registration server 200 receives other user information required by the authentication server 400 from the portable terminal device 300 of the user. Other user information includes, for example, items such as name, e-mail address, telephone number, department, post, and the like.

  The user registration server 200 authenticates the user based on the information of the user's ID, and creates a user key pair of a user ID, a user private key KEY, and a user public key CKEY for each registered user. I do. In addition, the data of the user public key certificate SKEY including the signature obtained by encrypting the user ID and the user public key CKEY with the user public key CKEY and the server secret key TKY of the user registration server 200 is created.

(Creation of abstracted user information)
Using the user information abstraction means 220, the user registration server 200 abstracts the user information read from the captured image data of the user's identification card 320 and other user information received from the user's portable terminal device 300. Create user information. The abstracted user information includes, for example, information obtained by converting the name “Tanban Taro” into “Toppan”, information obtained by converting the address “Bunkyo-ku, Tokyo 1-3-3” into “Bunkyo-ku, Tokyo”, and the age “ This is information obtained by converting "34 years old" into "30s".

(Transmission of data to portable terminal device 300)
Then, the user information abstraction means 220 of the user registration server 200 stores the user ID of the registered user, the user's private key KEY and the user's public key CKEY in the authentication application software 310 of the user's portable terminal device 300. The key pair, the user public key certificate SKEY, and the data of the abstracted user information are transmitted and stored in the portable terminal device 300.

  Note that the user registration server 200 creates a user key pair, transmits the key pair to the user's portable terminal device 300 and stores it in the user's portable terminal device 300, and then stores the user private key KEY from the storage means of the user registration server 200. May be deleted. By doing so, the user private key KEY is stored only in the user's portable terminal device 300, and even if the user registration server 200 is hacked, the user private key KEY is not leaked.

(Transmission of data to authentication server 400)
The user registration server 200 transmits the user information abstracted by the user information abstraction means 220 to the authentication server 400 and stores it in the database. That is, the user registration server 200 transmits the user ID of the newly registered user and the data of the abstracted user information to the authentication server 400 for storage.

  Accordingly, the information that the user registration server 200 notifies and stores in the authentication server 400 is the abstracted user information created by the user information abstraction unit 220 by removing personal information from the user information. Even if is hacked, only the abstracted user information is leaked, which has the effect of minimizing the leakage damage of the user's personal information.

  After the user registration server 200 notifies the authentication server 400 of the abstracted user information and stores it, the detailed user information received from the user's portable terminal device 300 is stored in the storage unit of the user registration server 200. The information may be deleted. By doing so, even if the user registration server 200 is hacked, there is an effect that detailed personal information of the user is not leaked.

(Modification 1)
As a first modification, the data of the user key pair of the user private key KEY and the user public key CKEY can be generated by the authentication application software 310 of the portable terminal device 300 of the user. Then, the user's portable terminal device 300 causes the user registration server 200 to transmit the data of the user public key CKEY.

  When the user registration server 200 receives the photographed image data of the user's identification card 320 and the data of the user's public key CKEY from the user's portable terminal device 300, the user registration server 200 creates a user ID and stores the data of the user public key certificate SKEY. Create That is, the user registration server 200 encrypts and signs the user ID and the user public key CKEY with the server private key TKY of the user registration server 200, and creates data of the user public key certificate SKEY including the signature.

  In addition, the user registration server 200 uses the user information abstraction means 220 to abstract the user information read from the captured image data of the user's identification card 320 and other user information received from the user's portable terminal device 300. Create user information.

  Then, the user registration server 200 transmits the user ID, the user public key certificate SKEY, and the data of the abstracted user information to the portable terminal device 300 of the user, and stores the data in the portable terminal device 300 of the user.

  In addition, the user registration server 200 notifies the authentication server 400 of the user ID and the data of the abstracted user information and stores them. The above is the first modification.

(Authentication server 400)
It is desirable that the authentication server 400 be configured as a distributed system including a plurality of distributed servers. The authentication server 400 includes a store registration unit 410, a user authentication unit 420, and an abstracted user information transmission unit 430. The authentication server 400 stores the server public key TCKY of the user registration server 200.

(Registration of store in authentication server 400)
The store joins the authentication system and registers the store device 100 in the authentication server 400. The store registration means 410 of the authentication server 400 supplies the store subscribed to the authentication service with the store identification code 1 such as a two-dimensional code for identifying the store.

  The authentication server 400 can be provided in a store, and the authentication server 400 can also serve as the store device 100. In addition, one authentication server 400 may be configured to register and manage a store group of a specific group.

(Authentication of Store Visiting User by Authentication Server 400)
The store presents the store identification code 1 supplied from the authentication server 400 to the user, and causes the camera 300a of the portable terminal device 300 of the user to read the store identification code 1.

  The authentication application software 310 of the user's portable terminal device 300 creates the user's authentication request command data CMD encrypted with the user's private key KEY. Then, the authentication application software 310 of the user's portable terminal device 300 reads the image information obtained by reading the shop identification code 1, the data of the user public key certificate SKEY, and the user's authentication request command encrypted with the user's private key KEY. The data CMD is transmitted to the authentication server 400.

  The user's portable terminal device 300 can transmit those data to the authentication server 400 via the communication line of the portable terminal device 300.

  Using the user authentication means 420, the authentication server 400 analyzes the store identification code 1 of the store received from the user's portable terminal device 300 and authenticates the store. Next, the user authenticating means 420 decrypts the signature of the user public key certificate SKEY with the server public key TCKY of the user registration server 200, thereby converting the user public key CKEY included in the user public key certificate SKEY into an authorized one. Is determined to be a public key.

  In addition, the user authentication unit 420 of the authentication server 400 checks the validity of the user ID by checking the user ID of the user who visited the store with the information recorded in the valid user record database.

  The user authentication unit 420 decrypts the encrypted user authentication request command data CMD received from the user's portable terminal device 300 with the user public key CKEY so that the user authentication request command data CMD is registered in the user. It confirms that it was created by the legitimate portable terminal device 300 registered in the server 200.

  Next, the user authentication means 420 transmits to the mobile terminal device 300 encrypted data obtained by encrypting the secret code created by the authentication server 400 with the user public key CKEY.

  The mobile terminal device 300 decrypts the encrypted data using the user secret key KEY, reads the secret code created by the authentication server 400, and transmits reply information including the secret code to the authentication server 400.

  The user authentication means 420 of the authentication server 400 confirms that the return code contains the secret code, thereby confirming that the portable terminal device 300 is the only portable terminal device 300 having the user secret key KEY. Then, the mobile terminal device 300 of the user is authenticated.

  The authentication server 400 transmits the authentication result of the user's mobile terminal device 300 to the store device 100.

  If the authentication server 400 can authenticate that the user's mobile terminal device 300 is the legitimate mobile terminal device 300 using the user authentication means 420, the store sends the user to the shop using the abstracted user information transmission means 430. To provide the service, the user apparatus transmits to the store apparatus 100 the minimum necessary and abstracted user information that is abstracted and limited so that an individual cannot be identified.

  Then, the authentication server 400 stores the authenticated store device 100, the user public key certificate SKEY of the user's portable terminal device 300, the user public key CKEY, and the transaction date and time in the transaction history storage means of the database.

  In the store, the store device 100 provides the user with necessary services according to the user authentication result received from the authentication server 400 and the abstracted user information.

  In the present embodiment, in the store, only by presenting the store identification code 1 to the user's portable terminal device 300, the user's portable terminal device 300 communicates with the authentication server 400, and as a result, the user's portable terminal device 300 The shop device 100 can receive the authentication result and the abstracted user information from the authentication server 400.

  Accordingly, since the store can cope only by printing and presenting the store identification code 1 supplied from the authentication server 400, there is no need to construct a special system, and the introduction of the present authentication system is easy. effective.

  Further, by causing the user's mobile terminal device 300 to transmit the user ID and the like supplied from the user registration server 200 to the authentication server 400, the authentication server 400 authenticates the user's mobile terminal device 300, and the store device 100 The authentication result of the user's portable terminal device 300 and the abstracted user information are transmitted. Thereby, there is an effect that the qualification of the customer can be accurately determined.

(Modification 2)
As a second modification, an image in which the user's authentication request command data CMD and the shop identification code 1 are read from the user's portable terminal apparatus 300 to the shop apparatus 100 via the communication network NW or using short-range wireless communication. Information and data of the user public key certificate SKEY can be transmitted. The store device 100 transmits the information to the authentication server 400. Then, the shop device 100 receives the authentication result of the user from the authentication server 400.

(User authentication by the store device 100)
In the second modification, the store apparatus 100 stores the server public key TCKY of the user registration server 200 in advance. Then, the portable terminal device 300 of the user transmits the data of the user public key CKEY and the data of the user public key certificate SKEY to the shop device 100.

  The shop device 100 confirms the signature by decrypting the signature of the user public key certificate SKEY received from the user's mobile terminal device 300 with the server public key TCKY of the user registration server 200, and generates the user public key CKEY, It can authenticate that it is a legitimate public key.

  Next, the shop device 100 creates encrypted data obtained by encrypting the secret code of the shop device 100 with the user public key CKEY, and transmits the encrypted data to the portable terminal device 300.

  The portable terminal device 300 decrypts the encrypted data using the user secret key KEY, reads the secret code of the store device 100, and returns reply information including the secret code of the store device 100 using the user secret key KEY. Then, encrypted data is created and transmitted to the store apparatus 100.

(Authentication of User by Authentication Server 400)
Next, the store device 100 stores the store identification code 1, the secret code of the store device 100, the user public key CKEY received from the mobile terminal device 300, the data of the user public key certificate SKEY, and the reply information. The encrypted data encrypted using the user secret key KEY is transmitted to the authentication server 400.

  The authentication server 400 authenticates the shop device 100 by analyzing the shop identification code 1. The authentication server 400 authenticates the user public key certificate SKEY of the user's portable terminal device 300.

  In addition, the authentication server 400 checks the user ID of the user who has visited the store with the information recorded in the valid user record database, thereby confirming the validity of the user and performing initial authentication of the portable terminal device 300 of the user. I do.

  The authentication server 400 obtains the return information by decrypting the encrypted data obtained by encrypting the return information of the user's portable terminal device 300 using the user's private key KEY using the user's public key CKEY. Then, by confirming that the secret code of the store apparatus 100 is included in the reply information, it is confirmed that the portable terminal apparatus 300 is the only portable terminal apparatus 300 having the user secret key KEY, and The mobile terminal device 300 is authenticated.

  The authentication server 400 authenticates the store device 100 and the portable terminal device 300 in this way, and transmits the user authentication result and the abstracted user information to the store device 100 by using the abstracted user information transmitting unit 430.

  Then, the authentication server 400 records the visit date and time of the user's store, the store device 100, and the user public key certificate SKEY of the user's mobile terminal device 300 for recording the authentication of the store device 100 and the mobile terminal device 300. The public key for user CKEY is stored in the transaction history storage means of the database of the authentication server 400.

  In the store, the store device 100 provides the user with necessary services according to the user authentication result received from the authentication server 400 and the abstracted user information. The above is the second modification.

(Modification 3)
As a third modified example, the abstracted user information includes, from the user's portable terminal device 300 to the store device 100, the user's authentication request command data CMD of other information, image information obtained by reading the store identification code 1, and The data can be transmitted to the store apparatus 100 together with the data of the user public key certificate SKEY.

  The shop device 100 transmits the abstracted user information and other information received from the user's mobile terminal device 300 to the authentication server 400, and causes the authentication server 400 to confirm the authenticity of the abstracted user information. . Then, the shop device 100 can receive the authentication result of the user from the authentication server 400.

  The authentication server 400 also checks the authenticity of the abstracted user information, so that only the authentication result of the user can be transmitted to the store apparatus 100. The above is the third modification.

(Operation procedure)
Next, an operation procedure of the authentication system of the present embodiment will be described with reference to flowcharts of FIGS.

(Registration procedure of user's mobile terminal device 300)
Hereinafter, the registration procedure of the portable terminal device 300 of the user will be described with reference to the flowchart of FIG.

(Step S1)
The user visits the user registration site of the user registration server 200 using the user's mobile terminal device 300, and downloads and installs the authentication application software 310 from the user registration site to the user's mobile terminal device 300.

(Step S2)
The user uses the authentication application software 310 of the portable terminal device 300 to photograph the user's identification card 320 with the camera 300a of the portable terminal device 300, and transmits photographed image data of the user's identification card 320 to the user registration server 200. . Further, the authentication application software 310 of the mobile terminal device 300 obtains other necessary user information from the user and transmits the user information to the user registration server 200.

(Step S3)
The user registration server 200 uses the OCR (Optical Character Reader) of the identification card image analysis means 210 or the like to extract the user information described in the character information described on the identification card 320 from the photographed image data of the user's identification card 320. Read.

(Step S4)
The identification card image analysis means 210 authenticates the user by analyzing the read information on the identification card 320 of the user and other user information.

(Step S5)
The user information abstraction means 220 of the user registration server 200 creates abstracted user information from the user information read from the user identification card 320 and other user information.

(Step S6)
Next, the user registration server 200 registers the authenticated user, creates a user ID for each registered user, and creates a user key pair of the user private key KEY and the user public key CKEY. Then, using the server private key TKY of the user registration server 200, the user public key CKEY, the user ID and the user public key CKEY are encrypted to create a signed signature, and the user public key certificate including the signature is created. Create SKEY data.

(Step S7)
Then, the user information abstraction means 220 of the user registration server 200 stores the created user ID, the user's private key KEY and the user's public key CKEY in the authentication application software 310 of the portable terminal device 300 of the registered user. The key pair, the data of the user public key certificate SKEY, and the abstracted user information are transmitted and stored in the portable terminal device 300 of the user.

(Step S8)
Next, the user information abstraction means 220 of the user registration server 200 notifies the authentication server 400 of the newly registered user's portable terminal device 300 with the user ID and the abstracted user information and stores them.

(User authentication procedure at the store)
Hereinafter, an authentication procedure of a user at a store will be described with reference to the flowchart of FIG.

(Step S11)
The user captures the store identification code 1 of the visited store with the camera 300a of the mobile terminal device 300 of the user to obtain captured image data.

(Step S12)
The authentication application software 310 of the user's portable terminal device 300 creates the user's authentication request command data CMD encrypted with the user's private key KEY.

(Step S13)
The authentication application software 310 of the user's portable terminal device 300 converts the photographed image data of the shop identification code 1, the data of the user public key certificate SKEY, and the user's authentication request command data CMD encrypted with the user's private key KEY. , To the authentication server 400.

(Step S14)
The authentication server 400 reads the store ID information from the photographed image data of the store identification code 1 of the store received from the user's portable terminal device 300 and checks the store.

(Step S15)
Next, the authentication server 400 decrypts the signature of the user public key certificate SKEY with the server public key TCKY of the user registration server 200, and thereby authenticates the user public key CKEY included in the user public key certificate SKEY to a regular public key. The key is determined.

(Step S16)
Next, the authentication server 400 decrypts the encrypted user authentication request command data CMD with the user public key CKEY so that the user's mobile terminal device 300 can be authenticated by the authorized mobile terminal registered in the user registration server 200. The terminal device 300 is authenticated.

(Step S17)
The authentication server 400 transmits the authentication result of the user's mobile terminal device 300 to the store device 100. At that time, if the authentication server 400 can authenticate that the user's mobile terminal device 300 is a legitimate mobile terminal device 300, the abstracted user information transmitting unit 430 determines that the store provides a service to the user. The necessary abstracted user information is transmitted to the shop device 100.

  Then, the authentication server 400 stores the visit date and time of the user's store, the ID of the store device 100, and the ID of the portable terminal device 300 of the user in the transaction history storage means of the database.

(Step S18)
At the store, the store device 100 authenticates the user by receiving the user authentication result and the abstracted user information from the authentication server 400, and provides an appropriate service to the user.

  As described above, the store entrusts the user authentication to the authentication server 400, and the store device 100 receives the user authentication result from the authentication server 400, thereby authenticating the user, and Service can be provided.

<Second embodiment>
As shown in FIG. 4, the authentication system according to the second embodiment includes a store device 100, a store identification code 1, a user registration server 200, a portable terminal device 300 owned by a user, It consists of authentication application software 310 installed in the server and blockchain data 500.

  The second embodiment is different from the first embodiment in that the user registration server 200 does not create a user public key certificate SKEY which is encrypted and signed with the server secret key TKY of the user registration server 200, and the user registration server 200 The point is that the block includes a block creation unit 230 that creates a block in which the user's public key CKEY of the portable terminal device 300 is recorded and adds the block to the block history data 500 of the transaction history. This guarantees the validity of the user public key CKEY.

  In the block, a user ID, a user public key CKEY, and data of abstracted user information of the portable terminal device 300 of the newly registered user are recorded.

  Further, the authentication server 400 includes a block creation unit 440 that creates a block in which the store identification code 1 supplied to the registered store is registered and adds the block to the block history data 500 of the transaction history. Thereby, the validity of the store identification code 1 is guaranteed.

  In the authentication server 400, the store identification code 1 of the store received from the user's mobile terminal device 300 and the user's public key CKEY of the user's mobile terminal device 300 are registered in the transaction history blockchain data 500. By confirming this, the user public key CKEY is authenticated.

  Next, the authentication server 400 decrypts the user's authentication request command data CMD received from the user's mobile terminal device 300 and encrypted with the user's private key KEY with the user's public key CKEY, thereby obtaining the user ID and the user's public key CKEY. The mobile terminal 300 of the user is authenticated as a legitimate mobile terminal 300 registered in the user registration server 200.

  Lastly, the authentication server 400 uses the block creation unit 440 to create a block in which a transaction in which the user visits the store with the store identification code 1 is recorded, and adds the block to the transaction history block chain data 500. It is difficult to disguise the user ID of the portable terminal device 300, and the legitimacy of the user is assured.

(Mobile terminal device 300 and store device 100)
As the portable terminal device 300 of the user and the store device 100 installed in the store, the same device as in the first embodiment is used.

(User registration server 200)
The user registration server 200 participates in the block chain and receives the transaction history block chain data 500. The user registration server 200 adds a new block to the transaction history blockchain data 500 using the block creation means 230. That is, the block creation means 230 calculates a hash value from the data block registered in the transaction history blockchain data 500 and the nonce value (adjustment value), and adds the hash value to the predetermined value of the transaction history blockchain. Is performed to satisfy the condition of

  The user registration server 200 supplies the authentication application software 310 to the user's mobile terminal device 300 and installs it.

(Registration of user to user registration server 200)
The user registration server 200 reads the captured image data of the user's identification card 320 received from the authentication application software 310 of the user's portable terminal device 300 using the identification card image analysis means 210, and the user information thus read; The user is authenticated by calculating other user information received from the user's portable terminal device 300. Then, the authenticated user is registered in the database as follows.

  The user registration server 200 creates a user ID and a user key pair of a user private key KEY and a user public key CKEY for each registered user.

  In addition, the user registration server 200 uses the user information abstraction means 220 to abstract the user information read from the captured image data of the user's identification card 320 and other user information received from the user's portable terminal device 300. Create user information.

  The user registration server 200 stores the user ID of the registered user in the authentication application software 310 of the mobile terminal device 300 of the user, a user key pair of a user private key KEY and a user public key CKEY, and an abstracted user. The information data is transmitted and stored in the mobile terminal device 300.

  Further, the user registration server 200 uses the block creation unit 230 to store the block of the newly registered user's portable terminal device 300 in which the user ID, the user public key CKEY, and the data of the abstracted user information are recorded. It is created and added to the block history data 500 of the transaction history.

  More specifically, the block creation unit 230 of the user registration server 200 calculates the hash value of the block of the transaction history blockchain data 500 immediately before the block to be registered in the transaction history blockchain data 500 and the data to be registered. And a nonce value (adjustment value) to calculate a hash value. Then, the nonce (adjustment value) is adjusted so that the hash value becomes a hash value according to the block chain rule of the transaction history (for example, a value in which the first n digits of the hash value are all 0). To calculate the hash value.

  The block creation unit 230 of the user registration server 200 registers the data in the transaction history blockchain data 500 by adding a block including the user's registration data and its hash value to the transaction history blockchain data 500. Then, the user registration server 200 distributes the block history data 500 of the transaction history to which the block has been added to the participants of the block chain. That is, the transaction history blockchain data 500 is distributed to the authentication server 400.

In this way, the user registration server 200 registers the information including the abstracted user information in the block and adds the information to the block history data 500 of the transaction history, thereby authenticating the abstracted user information in a form that cannot be falsified. Distributed to the server 400. The block history data 500 of the transaction history can be read by the store apparatus 100 having no block creation means.

(Authentication server 400)
The authentication server 400 includes a plurality of distributed servers. The authentication server 400 participates in a block chain in which at least the user registration server 200 and the plurality of authentication servers 400 participate, and receives transaction history block chain data 500. The authentication server 400 uses the block creation means 440 to add a new block to the transaction history blockchain data 500. That is, the block creation unit 440 calculates a hash value from the data block registered in the block history data 500 of the transaction history and the nonce value (adjustment value), and sets the hash value to a predetermined condition of the block chain. Perform an operation that satisfies you.

(Registration of store in authentication server 400)
The store joins the authentication system and registers the store device 100 in the authentication server 400. The store registration means 410 of the authentication server 400 supplies the store subscribed to the authentication service with the store identification code 1 such as a two-dimensional code for identifying the store. Then, the authentication server 400 uses the block creation means 440 to register the registration history of the store registered by supplying the store identification code 1 to the block history data 500 of the transaction history.

  More specifically, the block creation unit 440 of the authentication server 400 includes a hash value of the block immediately before the new block to be added to the transaction history block chain data 500, a new block describing the registration history of the store, and a nonce value. (Adjustment value) and calculate a hash value. Then, the nonce (adjustment value) is adjusted so that the hash value becomes a hash value according to the block chain rule of the transaction history (for example, a value in which the first n digits of the hash value are all 0). To calculate the hash value.

  The block creation unit 440 creates a new block including the hash value. Then, the authentication server 400 distributes the blockchain data 500 of the transaction history to which the new block has been added to the participants of the blockchain.

(Authentication of Store Visiting User by Authentication Server 400)
The store presents the store identification code 1 supplied from the authentication server 400 to the user, and causes the camera 300a of the portable terminal device 300 of the user to read the store identification code 1.

  The authentication application software 310 of the user's portable terminal device 300 creates the user's authentication request command data CMD encrypted with the user's private key KEY. Then, the authentication application software 310 of the user's portable terminal device 300 authenticates the user by encrypting the image information obtained by reading the shop identification code 1, the user ID and the data of the user's public key CKEY, and the user's secret key KEY. The request command data CMD is transmitted to the authentication server 400.

  The authentication server 400 authenticates the store by checking the store registration information such as the store identification code 1 of the store received from the user's mobile terminal device 300 with the information read from the block history data 500 of the transaction history.

  Next, the authentication server 400 determines that the user public key CKEY is a legitimate public key by checking the received user ID and the user public key CKEY with information read from the transaction history block chain data 500. I do.

  The authentication server 400 also checks the validity of the user ID of the user who has visited the store, using the information of the valid user ID obtained by analyzing the block history data 500 of the transaction history.

  The authentication server 400 registers the user's portable terminal device 300 in the user registration server 200 by decrypting the user's authentication request command data CMD encrypted with the user's private key KEY with the user's public key CKEY. The authenticated mobile terminal device 300 is authenticated.

  The authentication server 400 transmits the authentication result of the user's mobile terminal device 300 to the store device 100. In addition, when the authentication server 400 can authenticate that the user's mobile terminal device 300 is a legitimate mobile terminal device 300, the authentication server 400 is required to provide the service to the user, but to prevent the individual from being identified. The limited and minimum required abstracted user information is transmitted to the store apparatus 100. At the store, the store device 100 provides the user with necessary services according to the user authentication result received from the authentication server 400 and the abstracted user information.

  In addition, the authentication server 400 uses the block creation unit 440 to create a block in which a user visits the store with the store identification code 1 and records a transaction in which the user ID of the mobile terminal device 300 has been authenticated. Then, the authentication server 400 distributes the blockchain data 500 of the transaction history to which the block has been added to the participants of the blockchain.

(Modification 4)
As a fourth modification, the abstracted user information can be read by the store device 100 from the block history data 500 of the transaction history. Since the abstracted user information is registered in the transaction history blockchain data 500 in a form that cannot be falsified, data reliability is high. Then, the authentication server 400 transmits only the authentication result of the portable terminal device 300 of the user to the shop device 100.

(Operation procedure)
Next, an operation procedure of the authentication system according to the present embodiment will be described with reference to flowcharts of FIGS.

(Registration procedure of user's mobile terminal device 300)
Hereinafter, the registration procedure of the portable terminal device 300 of the user will be described with reference to the flowchart of FIG.

(Steps S1 and S2)
In the same manner as in the first embodiment, the user visits the user registration site of the user registration server 200 using the user's mobile terminal device 300, downloads the authentication application software 310, and sends the authentication application software 310 to the user's mobile terminal device 300. install.

  Next, the user uses the authentication application software 310 of the portable terminal device 300 to photograph the user's ID 320 with the camera 300a of the portable terminal device 300, and stores the photographed image data of the user's ID 320 into the user registration server 200. Send to In addition, other necessary user information is transmitted to the user registration server 200.

(Step S23)
The identification card image analysis means 210 of the user registration server 200 converts the user information described in the character information described in the identification card 320 from the captured image data of the user identification card 320 into an OCR (
Optical Character Reader).

(Step S24)
The identification card image analysis unit 210 authenticates the user by analyzing the information of the user's identification card 320 and other user information.

(Step S25)
The user registration server 200 uses the user information abstraction means 220 to create abstracted user information from the user information read from the user identification card 320 and other user information.

(Step S26)
Next, the user registration server 200 registers the portable terminal device 300 of the user, and creates a user key pair of a user ID, a user private key KEY, and a user public key CKEY for each registered user.

(Step S27)
Then, the user registration server 200 stores, in the authentication application software 310 of the portable terminal device 300 of the registered user, the created user ID, the data of the user key pair of the user private key KEY and the user public key CKEY, The abstracted user information is transmitted and stored in the portable terminal device 300 of the user.

(Step S28)
Next, the block creation means 230 of the user registration server 200 creates a block of the portable terminal device 300 of the newly registered user that records the user ID, the user public key CKEY, and the abstracted user information. Create blockchain data 500 of the transaction history to which the block has been added.

  Then, the user registration server 200 distributes the block history data 500 of the transaction history to the participants of the block chain including the authentication server 400.

(User authentication procedure at the store)
Hereinafter, the authentication procedure of the user at the store will be described with reference to the flowchart of FIG.

(Step S31)
In the same manner as in the first embodiment, the authentication application software 310 of the user's mobile terminal device 300 captures the store identification code 1 of the visited store with the camera 300a of the user's mobile terminal device 300 to obtain captured image data.

(Step S32)
As in the first embodiment, the authentication application software 310 of the user's portable terminal device 300 creates the user's authentication request command data CMD encrypted with the user's secret key KEY.

(Step S33)
The authentication application software 310 of the user's portable terminal device 300 is configured to store the photographed image data of the store identification code 1, the user ID, the data of the user's public key CKEY, and the user's authentication request command data encrypted with the user's secret key KEY. The CMD is transmitted to the authentication server 400.

(Step S34)
The authentication server 400 reads the store ID information from the photographed image data of the store identification code 1 of the store received from the user's mobile terminal device 300, and compares the ID information with the store information read from the transaction history blockchain data 500. Authenticate the store with.

(Step S35)
Next, the authentication server 400 determines that the user public key CKEY is a legitimate public key by checking the received user ID and the user public key CKEY with information read from the transaction history block chain data 500. I do.

  The authentication server 400 also checks the validity of the user ID of the user who has visited the store, using the information of the valid user ID obtained by analyzing the block history data 500 of the transaction history.

(Step S36)
Next, the authentication server 400 decrypts the encrypted user authentication request command data CMD with the user public key CKEY so that the user's mobile terminal device 300 can be authenticated by the authorized mobile terminal registered in the user registration server 200. The terminal device 300 is authenticated.

(Step S37)
The authentication server 400 transmits the authentication result of the user's mobile terminal device 300 to the store device 100. If the user's mobile terminal device 300 can be authenticated as a legitimate mobile terminal device 300, the authentication server 400 transmits, to the store device 100, the abstracted user information required for the store to provide the service to the user. Send.

(Step S38)
In addition, the authentication server 400 uses the block creation unit 440 to create a new block in which a transaction including the visit date and time of the user's store, the store identification code 1, and the user ID is recorded. Then, the block creating means 440 adds the new block to the block history data 500 of the transaction history. The authentication server 400 distributes the block history data 50 of the transaction history to the block chain participants.

(Step S39)
At the store, the store device 100 authenticates the user by receiving the user authentication result and the abstracted user information from the authentication server 400, and provides an appropriate service to the user.

  With the above configuration, the user registration server 200 uses the block creation unit 230 to add a new block in which the user public key CKEY and the abstracted user information data are registered to the transaction history block chain data 500. Thus, the validity of the data can be guaranteed.

  In the second embodiment, in particular, the user registration server 200 uses the block creation unit 230 to add a block in which the user public key CKEY is registered to the transaction history block chain data 500, thereby validating the data. Can be guaranteed. Thus, the creation of the user public key certificate SKEY by the user registration server 200, which has been performed in the first embodiment, is eliminated.

  This has the effect of eliminating the risk of the user registration server 200 hacking the private key used to create the user public key certificate SKEY and falsifying the user public key certificate SKEY.

  As described above, when the user's portable terminal device 300 transmits the user's authentication request command data CMD encrypted with the user's private key KEY to the authentication server 400, the authentication server 400 transmits the transaction history blockchain data 500. The user who transmitted the user authentication request command data CMD by confirming the validity of the user public key CKEY and decrypting the user authentication request command data CMD using the user public key with reference to Of the portable terminal device 300 is authenticated.

  Then, the authentication server 400 transmits the authentication result of the user's mobile terminal device 300 to the shop device 100. In this way, the authentication server 400 performs the authentication of the user at the store on behalf of the store, so that the store can provide the user with an appropriate service.

(Guaranteed validity of user authentication)
It is conceivable that information related to a certain user ID is illegally copied to a portable terminal device other than the portable terminal device 300 of the user, and the illegal portable terminal device impersonates the user ID.

  In response, the authentication server 400 uses the block creation means 440 to add a new block in which the authentication record of the store identification code 1 and the user ID of the user who visited the store is registered to the transaction history block chain data 500. By doing so, a transaction in which the user ID is impersonated can be found as follows.

  More specifically, the authentication server 400 or another server can read and analyze the information of the transaction history blockchain data 500 to find an abnormality in the record of the transaction history of the predetermined user ID. It is possible to discover impersonation of the user ID. As described above, since the impersonation of the user ID can be found, the reliability of user authentication can be improved.

  For example, by detecting a case where an unusually large number of stores are visited by a predetermined user ID, it is possible to detect unauthorized use of the user ID. Further, by detecting a contradiction in which the abstracted user information of the predetermined user ID is different, it is possible to discover unauthorized use of the user ID.

  In this way, the user registration server 200 and the authentication server 400 join the blockchain and add the block in which the transaction history information is registered to the transaction history blockchain data 500. This has the effect of ensuring correctness.

DESCRIPTION OF SYMBOLS 1 ... store identification code 100 ... store apparatus 110 ... communication means 200 ... user registration server 210 ... identification card image analysis means 220 ... user information abstraction means 230 ... block creation Means 300 ··· Portable terminal device 300a · Camera 310 · Authentication application software 320 · Identification card 400 · Authentication server 410 · Store registration means 420 · User authentication means 430 · · · Abstract user information transmitting means 440 Block creating means 500 Block chain data CKEY User public key CMD User authentication request command data KEY User private key NW Communication network SKEY: user public key certificate TCKY: server public key TKY: server private key

Claims (5)

An authentication system comprising a store identification code to be provided to the store, a store device, a user registration server, a portable terminal device owned by the user, an authentication server, and a communication network,
The portable terminal device has means for photographing image data of a user's identification card and transmitting the image data to the user registration server,
Means for the user registration server to store a user key pair of a user ID, a user private key, and a user public key for each user in the portable terminal device;
Means for creating user information abstracted using the image data of the user's identification card and transmitting the user information to the authentication server,
The authentication server has means for authenticating the shop and the user, and means for transmitting an authentication result of the user and the abstracted user information to the shop apparatus,
When the portable terminal device transmits the user ID to the authentication server or the store device and requests user authentication, the mobile terminal device authenticates the store and the user, and authenticates the user authentication result and the abstracted user information. An authentication system for transmitting to a store device.   2. The authentication system according to claim 1, wherein the authentication server authenticates the store and the user by receiving image data of the store identification code and authentication request command data of a user from the mobile terminal device. An authentication system characterized by the following.   2. The authentication system according to claim 1, wherein the authentication server authenticates the store and the user by receiving user authentication request command data from the store device. The authentication system according to any one of claims 1 to 3,
The user registration server has means for creating a user public key certificate of the user public key and storing the certificate in the portable terminal device,
The authentication system, wherein the portable terminal device transmits the user public key certificate to the authentication server or the store device. The authentication system according to any one of claims 1 to 3,
The user registration server and the authentication server have block creation means for block chain data,
When the user registration server creates a user ID for each user and registers the user, the data obtained by adding the block in which the data of the user ID and the user public key are recorded to the blockchain is used as a participant of the blockchain. Send to
The authentication system, wherein the authentication server transmits data obtained by adding a block in which the store and the user authentication result are recorded to a blockchain to a participant of the blockchain.

Images