JP4319513B2 - Authentication information providing apparatus and authentication system - Google Patents

Description

  The present invention relates to an authentication information providing apparatus and an authentication system.

Conventionally, there is an authentication method using a so-called one-time password method in order to increase the security of authentication using a password (see Patent Document 1). In the conventional authentication method using the one-time password method, the one-time password transmitted from the authenticated side (for example, the user side) is received by the authentication side (for example, the authentication system side), and the received one-time password is received. And the one-time password managed by the authentication side, it is determined whether or not the user is a valid user.
JP 2002-41478 A

  However, the conventional authentication method using a one-time password has a problem that the cost required for constructing a system that requires authentication increases because the authentication side needs to have an authentication mechanism.

  Accordingly, an object of the present invention is to provide an authentication information providing apparatus and an authentication system capable of realizing authentication using a one-time password at a low cost in order to solve the above-described problems.

  The authentication information providing apparatus of the present invention includes a variable ID generating unit that generates a variable ID that is changed every predetermined period based on a predetermined algorithm that is different for each authentication target, and a variable ID generated by the variable ID generating unit. Is stored in association with authentication target identification information for identifying an authentication target, authentication side identification information for identifying an authentication side to be authenticated and a reception unit for receiving a variable ID, and reception by the reception unit Based on the obtained variable ID, the extraction means for extracting the authentication object identification information corresponding to the variable ID from the authentication object identification information stored by the variable ID storage means, and authenticating the authentication object identification information extracted by the extraction means The information is characterized by comprising transmission means for transmitting to the authentication side corresponding to the authentication side identification information received by the reception means.

  According to the present invention, since the variable ID generated by the variable ID generation means can be stored in association with the authentication target identification information by the variable ID storage means, the authentication object corresponding to the variable ID received by the reception means The identification information can be extracted by the extraction means and transmitted to the authentication side by the transmission means. Therefore, the authentication side can acquire the authentication target identification information corresponding to the variable ID without managing the variable ID generated for each predetermined period based on a predetermined algorithm that is different for each authentication target. . Thereby, since the authentication side can acquire highly reliable authentication target identification information without providing a means for managing the variable ID, authentication using the variable ID can be realized at a low cost.

  The authentication information providing apparatus of the present invention includes an authentication side identification information storage unit that stores authentication side identification information and an authentication stored in the authentication side identification information storage unit based on the authentication side identification information received by the reception unit. It is preferable to further comprise confirmation means for referring to the side identification information and confirming the authenticity of the authentication side.

  In this way, since the validity of the transmission side that has transmitted the variable ID can be confirmed, the user identification information can be transmitted only to the authentication side that has been confirmed to be a valid transmission side. Thereby, the authentication side can implement | achieve the authentication system with higher security at low cost.

  The authentication information providing apparatus of the present invention includes user information storage means for storing user identification information for identifying a user corresponding to an authentication target in association with the authentication target identification information, and authentication target identification information extracted by the extraction means. And a user identification information extracting unit that extracts user identification information corresponding to the authentication target identification information from the user identification information stored by the user information storage unit, and the transmission unit is extracted by the extraction unit It is preferable to transmit the user identification information extracted by the user identification information extraction means instead of the recognition target identification information.

  In this way, since the user identification information extracted by the user identification information extraction means can be transmitted to the authentication side, for example, the recognition target identification information is not managed on the authentication side. If the user identification information is managed, the user identification information can be provided as authentication information.

  The authentication system according to the present invention is an authentication system that performs authentication using a variable ID that is changed every predetermined period based on a predetermined algorithm that is different for each authentication target, and a variable ID that generates a variable ID. Generating means, variable ID storage means for storing the variable ID generated by the variable ID generating means in association with authentication target identification information for identifying an authentication target, and authentication side identification information for identifying the authenticating side performing authentication Receiving means for receiving the variable ID, and extracting means for extracting the authentication object identification information corresponding to the variable ID from the authentication object identification information stored in the variable ID storage means based on the variable ID received by the receiving means And the authentication object identification information extracted by the extraction unit as authentication information, and transmitted to the authentication side corresponding to the authentication side identification information received by the reception unit An authentication information providing device comprising: a communication means; a variable ID sending means for sending authentication side identification information and a variable ID to the authentication information providing device; an authentication information receiving means for receiving authentication information from the authentication information providing device; Referring to the authentication information stored in the authentication information storage means based on the authentication information received by the authentication information receiving means and the authentication information storage means for storing the authentication information including the authentication target identification information; And an authenticating device for authenticating the authenticity of the authentication target.

  According to the present invention, the authentication information providing apparatus can extract the authentication target identification information corresponding to the variable ID transmitted from the authentication apparatus and provide it to the authentication apparatus. Therefore, the authentication apparatus recognizes corresponding to the variable ID transmitted from the authentication apparatus without providing means for managing the variable ID generated for each predetermined period based on a predetermined algorithm different for each authentication target. The object identification information can be acquired from the authentication information providing apparatus. Thereby, on the authentication side, authentication using a variable ID can be realized at low cost.

  According to the authentication information providing apparatus and the authentication system according to the present invention, authentication using a one-time password can be realized at low cost.

  Embodiments of an authentication information providing apparatus according to the present invention will be described below with reference to the drawings. In addition, in each figure, the same code | symbol is attached | subjected to the same element and the overlapping description is abbreviate | omitted.

  First, FIG. 1 is a diagram illustrating a configuration of an authentication system 1 in the embodiment. As shown in FIG. 1, the authentication system 1 includes an authentication information providing server 10, a reader device 20, an authentication server 30, and a mobile phone 40. The authentication information providing server 10 and the authentication server 30 are connected via the Internet 50. Note that the reader device 20, the authentication server 30, and the mobile phone 40 actually have a plurality of reader devices 20, the authentication server 30, and the mobile phone 40, but in order to prevent the drawing from becoming complicated in FIG. Only the predetermined reader device 20, the authentication server 30, and the mobile phone 40 are shown.

  Next, each device shown in FIG. 1 will be described. The authentication information providing server 10 shown in FIG. 1 receives a variable ID included in a radio signal transmitted from the mobile phone 40 from the authentication server 30, and uses the information corresponding to the received variable ID as authentication information. It is the server device which provides. Here, the variable ID is, for example, an ID generated for a one-time password that can be used only for a certain period. Specific contents such as a variable ID and authentication information will be described later.

  A functional configuration of the authentication information providing server 10 will be described with reference to FIG. As shown in FIG. 1, the authentication information providing server 10 includes a variable ID generation unit 11, a storage unit 12, a reception unit 13, a reader confirmation unit (confirmation unit) 14, an extraction unit 15, and a transmission unit 16. And a variable ID management database (variable ID storage means) 1D and a reader information table (authentication side identification information storage means) 1T.

  The variable ID generation unit 11 generates and updates a variable ID every predetermined time (for example, 1 minute) based on a predetermined algorithm. Here, the predetermined algorithm is an algorithm for generating a variable ID for a one-time password, such as SecurID (registered trademark) or S / Key (registered trademark). The content of this predetermined algorithm differs for each mobile phone 40 and is registered in the variable ID management database 1D.

  The storage unit 12 stores the variable ID generated by the variable ID generation unit 11 in the variable ID management database 1D. Here, as shown in FIG. 2, the variable ID management database 1D includes, for example, a telephone number a, an algorithm content b, and a variable IDc. The phone number a stores the phone number of the mobile phone 40, the algorithm content b stores the content of the algorithm assigned to each mobile phone 40, and the variable IDc is assigned to each mobile phone 40. The variable ID generated based on the content of the algorithm is stored. In the present embodiment, the telephone number of the mobile phone 40 is adopted as the authentication target identification information for identifying the authentication target. Therefore, the storage unit 12 stores the variable ID generated by the variable ID generation unit 11 in association with the telephone number of the mobile phone 40.

  The receiving unit 13 receives the variable ID, the IP address of the reader device 20, and the IP address of the authentication server 30. In the present embodiment, the IP address of the reader device 20 and the IP address of the authentication server 30 are employed as authentication side identification information for identifying the authentication side that performs authentication.

  The reader confirmation unit 14 confirms the validity of the reader device 20 by determining whether or not the IP address of the reader device 20 received by the reception unit 13 is registered in the reader information table 1T. Here, the reader information table 1T includes, for example, the IP address of the reader device 20. The reader device 20 corresponding to the IP address stored in the reader information table 1T is recognized as a valid reader device 20.

  The extraction unit 15 searches the variable ID management database 1D based on the variable ID received by the reception unit 13, and extracts the telephone number stored corresponding to the variable ID.

  The transmission unit 16 transmits the telephone number extracted by the extraction unit 15 to the authentication server 30 corresponding to the IP address of the authentication server 30 received by the reception unit 13. This telephone number is used as authentication information for authenticating the mobile phone 40 in the authentication server 30. The transmission unit 16 further transmits the IP address of the reader device 20 received by the reception unit 13 to the authentication server 30.

  A mobile phone 40 shown in FIG. 1 is a mobile communication terminal having a function of transmitting a radio signal including a variable ID to the outside in accordance with an operation instruction from a user. The mobile phone 40 includes a variable ID generation unit (not shown) having the same function as the variable ID generation unit 11 of the authentication information providing server 10. Each mobile phone 40 stores a predetermined algorithm having different contents for each mobile phone 40. The variable ID generation unit of the mobile phone 40 generates a variable ID based on a predetermined algorithm, and updates the variable ID stored in a memory (not shown). Here, when the current time is used when the variable ID is generated based on a predetermined algorithm, the authentication information providing server 10 and the internal clock of the mobile phone 40 need to be synchronized. In such a case, each internal clock may be corrected using a common time correction mechanism such as a radio clock. In the authentication system 1 according to the present embodiment, the mobile phone 40 is described as a specific example of the mobile communication terminal. However, the mobile phone 40 is not limited to this, and a simple mobile phone (PHS) or a portable information terminal having a communication function ( It may be a mobile communication terminal such as a PDA).

  The reader device 20 shown in FIG. 1 is a device that receives a radio signal transmitted from the mobile phone 40 and transmits a signal including a variable ID included in the received radio signal to the authentication server 30. The reader device 20 is attached to, for example, a door or the like through which only a user having an authenticated mobile phone can pass.

  The authentication server 30 shown in FIG. 1 includes a variable ID receiving unit that receives a signal including a variable ID from the reader device 20, a variable ID included in the signal received by the variable ID receiving unit, and an IP address of the reader device 20. And a variable ID transmission unit that transmits a signal including the information to the authentication information providing server 10. Further, the authentication server 30 searches an authentication database (authentication information storage unit) based on the authentication information receiving unit that receives the authentication information from the authentication information providing server 10 and the authentication information received by the authentication information receiving unit. In addition, an authentication unit (authentication unit) that authenticates the mobile phone 40 based on the search result is included. Here, the authentication database includes, for example, information on the user (authentication information) such as a telephone number (authentication target identification information), a user's name / address / home telephone number, and the like. In the telephone number, the telephone number of the mobile phone 40 is stored. The authentication server 30 also includes an unlocking / opening / closing unit that unlocks or opens / closes a door or the like to which the reader device 20 is attached.

  Next, the operation of the authentication process in the authentication system 1 will be described with reference to FIG. First, the cellular phone 40 transmits a radio signal including a variable ID stored in the memory to the outside based on an operation instruction from the user (step S1).

  When the reader device 20 receives a wireless signal transmitted from the mobile phone 40, the reader device 20 transmits a signal including the variable ID included in the wireless signal to the authentication server (step S2).

  When the authentication server 30 receives a signal including a variable ID from the reader device 20, the authentication server 30 transmits a signal including the variable ID included in the received signal and the IP address of the reader device 20 to the authentication information providing server 10 ( Step S3).

  Next, when the reception unit 13 receives a signal including the variable ID and the IP address of the reader device 20, the reader confirmation unit 14 of the authentication information providing server 10 includes the reader device 20 included in the received signal. The reader information table 1T is searched based on the IP address (step S4). The reader confirming unit 14 determines whether or not the IP address of the reader device 20 is registered in the reader information table 1T based on the search result (step S5).

  If it is determined that the IP address of the reader device 20 is not registered in the reader information table 1T (step S5; NO), the authentication information providing server 10 ends the authentication process.

  On the other hand, when it is determined in step S4 that the IP address of the reader device 20 is registered in the reader information table 1T (step S5; YES), the extraction unit 15 of the authentication information providing server 10 receives the reception unit. The variable ID management database 1D is searched based on the variable ID included in the signal received by 13 (step S6). Based on this search result, the extraction unit 15 determines whether or not the variable ID is registered in the variable ID management database 1D (step S7).

  If it is determined that the variable ID is not registered in the variable ID management database 1D (step S7; NO), the authentication information providing server 10 ends the authentication process.

  On the other hand, when it is determined in step S7 that the variable ID is registered in the variable ID management database 1D (step S7; YES), the extraction unit 15 of the authentication information providing server 10 corresponds to the variable ID. The stored telephone number is extracted from the variable ID management database 1D (step S8).

  Next, the transmission unit 16 of the authentication information providing server 10 sends a signal including the telephone number extracted by the extraction unit 15 and the IP address of the reader device 20 to the IP address of the authentication server 30 received by the reception unit 13. It transmits to the corresponding authentication server 30 (step S9). Thereby, the authentication information providing server 10 can provide the authentication server 30 with the telephone number of the mobile phone 40 used when authenticating the mobile phone 40 to be authenticated as authentication information.

  Next, the authentication unit of the authentication server 30 converts the received signal into a received signal when a signal including the telephone number transmitted from the authentication information providing server 10 and the IP address of the reader device 20 is received by the authentication information receiving unit. The authentication database is searched based on the included telephone number (step S10). The authentication unit of the authentication server 30 determines whether the telephone number is registered in the authentication database based on the search result (step S11).

  If it is determined in this determination that the telephone number is not registered in the authentication database (step S11; NO), the authentication server 30 ends the authentication process.

  On the other hand, when it is determined in step S11 that the telephone number is registered in the authentication database (step S11; YES), the unlocking / opening / closing unit of the authentication server 30 has received from the authentication information providing server 10. The unlocking or opening / closing process of the door to which the reader device 20 corresponding to the IP address of the reader device 20 included in the signal is attached is executed (step S12).

  As described above, in the authentication system 1 according to the present embodiment, the authentication information providing server 10 sets the variable ID generated by the predetermined algorithm that differs for each mobile phone 40 to be authenticated as the phone number of the mobile phone 40. Since management is performed in correspondence, when a variable ID is received from the authentication server 30, a telephone number corresponding to the variable ID can be provided to the authentication server 30. That is, the authentication server 30 can acquire the telephone number of the mobile phone 40 corresponding to the variable ID without managing the variable ID generated by a predetermined algorithm that differs for each mobile phone 40. Thereby, on the authentication side, authentication using a variable ID generated for a one-time password can be realized at low cost.

  In addition, for example, when the authentication server performs authentication based on the telephone number received from the mobile phone, there may be a situation where the authentication is performed based on the phone number altered in the mobile phone. By adopting the authentication system 1 in the embodiment, the telephone number of the mobile phone 40 managed in correspondence with the highly reliable variable ID can be provided to the authentication server 30 which is the authentication side. Then, authentication can be performed based on a highly reliable telephone number. Thereby, the authentication side can implement | achieve the authentication system with higher security at low cost.

  In addition, by adopting the authentication system 1 according to the present embodiment, the mobile phone 40 can be authenticated by a plurality of authentication sides only by including one one-time password generation mechanism (application). Therefore, the cost of the mobile phone can be reduced. Further, in the conventional authentication method using the one-time password method, it is necessary to possess an ID card or the like that issues a one-time password for each authentication side, but by adopting the authentication system 1 in this embodiment, 1 Since it is possible to receive authentication from a plurality of authentication sides simply by possessing one mobile phone 40, management becomes easy.

  In the above-described embodiment, the reader confirmation unit 14 confirms the validity of the reader device 20. However, the present invention is not limited to this. For example, the validity of the authentication server 30 may be confirmed. In this case, the IP address of the authentication server 30 may be registered in the reader information table 1T.

  In the above-described embodiment, the case where there are a plurality of reader devices 20 connected to one authentication server 30 has been described. However, when only one reader device 20 is connected to one authentication server 30. In addition, the present invention is applicable. When adopting this modification, the authentication server 30 may transmit a signal including a variable ID to the authentication information providing server 10 in step S3 described above. Since the authentication server 30 and the reader device 20 have a one-to-one correspondence, if the authentication information providing server 10 can determine the validity of the authentication server 30, the validity of the reader device 20 corresponding to the authentication server 30 is determined. This is because it is not necessary to judge gender. Therefore, in step S4, the reader confirmation unit 14 may search the reader information table 1T based on the IP address of the authentication server 30. That is, the authentication information providing server 10 confirms the validity of the authentication server 30. In step S <b> 9, the transmission unit 16 of the authentication information providing server 10 sends the signal including the telephone number extracted by the extraction unit 15 to the authentication server 30 corresponding to the IP address of the authentication server 30 received by the reception unit 13. To send to. Note that the IP address of the authentication server 30 is registered in advance in the reader information table 1T.

  In the above-described embodiment, the reader device 20 receives a variable ID from the mobile phone 40 by receiving a radio signal transmitted based on an operation instruction from the user. The method for receiving the ID is not limited to this. For example, the mobile phone 40 includes an RFID (Radio Frequency Identification) tag, and the variable ID is stored in the RFID tag, so that the variable ID of the mobile phone 40 can be read by the reader device 20 without an operation instruction from the user. It is good as well. As a result, the user can automatically unlock and open / close the door that requires authentication only by holding the mobile phone 40.

  In the above-described embodiment, the authentication information providing server 10 provides the telephone number (authentication target identification information) of the mobile phone 40 as the authentication information, but the information provided as the authentication information is the mobile phone 40. Not limited to phone numbers. For example, user identification information that can identify the user, such as a telephone number of a fixed telephone at the user's home, may be provided as authentication information. Such user identification information may be stored in the variable ID management database 1D or may be stored in another database (user information storage means). When storing in another database, the telephone number of the mobile phone 40 is provided in the data item of the other database, and the user identification information (for example, the telephone number of the fixed telephone) is associated with the telephone number of the mobile phone 40. It is preferable to memorize. As a result, the authentication information providing server 10 can provide the user identification information to the authentication server 30 instead of the telephone number of the mobile phone 40. When the identification information is not managed but the telephone number (user identification information) of the fixed telephone is managed, the telephone number of the fixed telephone can be provided as authentication information.

It is a figure which shows the structural example of the authentication system in embodiment. It is a figure which shows the database structural example of a variable ID management database. It is a sequence chart explaining the authentication process in an embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Authentication system, 10 ... Authentication information provision server, 11 ... Variable ID production | generation part, 12 ... Memory | storage part, 13 ... Reception part, 14 ... Reader confirmation part, 15 ... Extraction unit, 16 ... transmission unit, 1D ... variable ID management database, 1T ... reader information table, 20 ... reader device, 30 ... authentication server, 40 ... mobile phone, 50 ···the Internet.

Claims (4)

Variable ID generation means for generating a variable ID that is changed for each predetermined period based on a predetermined algorithm that is different for each authentication target;
Variable ID storage means for storing the variable ID generated by the variable ID generation means in association with authentication target identification information for identifying the authentication target;
Receiving means for receiving authentication side identification information for identifying an authentication side to perform authentication and the variable ID;
Extraction means for extracting authentication target identification information corresponding to the variable ID from authentication target identification information stored by the variable ID storage means based on the variable ID received by the reception means;
Transmitting means for transmitting the authentication object identification information extracted by the extraction means as authentication information to the authentication side corresponding to the authentication side identification information received by the receiving means;
An authentication information providing apparatus comprising: Authentication-side identification information storage means for storing the authentication-side identification information;
Confirmation means for confirming the authenticity of the authentication side by referring to the authentication side identification information stored in the authentication side identification information storage means based on the authentication side identification information received by the reception means; The authentication information providing apparatus according to claim 1, further comprising: User information storage means for storing user identification information for identifying a user corresponding to the authentication target in association with the authentication target identification information;
User identification information extraction means for extracting user identification information corresponding to the authentication target identification information from the user identification information stored by the user information storage means based on the authentication target identification information extracted by the extraction means; Prepared,
The authentication information according to claim 1, wherein the transmission unit transmits the user identification information extracted by the user identification information extraction unit instead of the recognition target identification information extracted by the extraction unit. Providing device. In an authentication system that performs authentication using a variable ID that is changed every predetermined period based on a predetermined algorithm that is different for each authentication target,
Variable ID generation means for generating the variable ID;
Variable ID storage means for storing the variable ID generated by the variable ID generation means in association with authentication target identification information for identifying the authentication target;
Receiving means for receiving authentication side identification information for identifying an authentication side to perform authentication and the variable ID;
Extraction means for extracting authentication target identification information corresponding to the variable ID from authentication target identification information stored by the variable ID storage means based on the variable ID received by the reception means;
Transmitting means for transmitting the authentication object identification information extracted by the extraction means as authentication information to the authentication side corresponding to the authentication side identification information received by the receiving means;
An authentication information providing device comprising:
Variable ID transmission means for transmitting the authentication side identification information and the variable ID to the authentication information providing device;
Authentication information receiving means for receiving the authentication information from the authentication information providing device;
Authentication information storage means for storing authentication information including the authentication target identification information;
Based on the authentication information received by the authentication information receiving means, referring to the authentication information stored in the authentication information storage means, authentication means for authenticating the authenticity of the authentication target;
An authentication device comprising:
An authentication system comprising:

Images