JP4799476B2 - Authentication method and authentication apparatus - Google Patents

Description

  The present invention relates to an authentication method and an authentication apparatus for authenticating a password.

In personal authentication when a user logs in to a personal site on the Internet or an ATM (Automatic Teller Machine) of a financial institution, it is important to ensure the complexity and confidentiality of the password used for authentication. In other words, by complicating the password and making it impossible for others to guess, and keeping the password strictly confidential, it does not leak to others, preventing password theft and effective personal authentication at login. Make things.
JP 2005-228121 A

  However, no matter how complex the password is, if it is leaked and known to others, it will be easy to impersonate.

  Therefore, Patent Document 1 discloses a system that performs authentication using a card ID printed on a card in addition to personal authentication using a user ID and a password. The card ID is divided into a plurality of blocks each composed of a plurality of digits, and each block is given a block number. At the time of authentication with a card ID, a block number and a digit position in the block are designated from the authentication server for each block of the card ID, and a plurality of characters corresponding to the designated block number and digit position are specified at the terminal. It is entered and multiple characters are authenticated by the authentication server. However, in this system, if the user ID and password are leaked and the card is stolen, spoofing becomes possible.

  The present invention has been made in view of the above problems, and its main purpose is to prevent unauthorized login even if a password is leaked.

In order to solve the above problems, the present invention provides a user ID unique to a user, a registration password from which an authentication password used for authentication is generated, and a division of a character string generated from the registration password as the authentication password A method of authenticating a target password used by the user by a computer having a storage unit for storing password information including the number of digits of the part, wherein the computer receives the password information and stores the password information in the storage unit; , Receiving the user ID and a plurality of target passwords to be authenticated, specifying password information stored in the storage unit from the user ID, and among the password information, each of the registered password and the character string A step of generating a plurality of the authentication passwords from the number of digits of the divided part , And executes the steps of: collating the received plurality of target password and the generated plurality of the authentication password, respectively.

  According to this method, since the rule for generating the password is the number of digits of each divided portion of the character string, the user can easily remember the rule. Further, since authentication is performed using a plurality of passwords obtained by dividing the original password, even if the original password is leaked, an outsider cannot guess the password used for authentication.

  In addition, the present invention provides a user ID unique to a user, a registration password from which an authentication password used for authentication is generated, a password generation method indicating a cyclic method, a division method, or a combined method, and the registration password as the authentication password The target password used by the user is authenticated by a computer having a storage unit that stores password information including the start position of the character string and the circulation direction and / or the number of digits of each divided portion of the character string according to the authentication time generated from A method in which the computer receives the password information and stores the password information in the storage unit, receives the user ID and one or more target passwords to be authenticated, and stores the storage unit from the user ID. Identifying the password information stored in the password and the password information When the password generation method is a cyclic method, the step of generating the authentication password from the registered password, the start position of the character string and the cyclic direction according to the authentication, and the password generation method is a split method. And generating the plurality of authentication passwords from the registration password and the number of digits of each divided part of the character string, and when the password generation method is a combined method, the registration password and the authentication A password is generated from the start position and circulation direction of the character string according to time, and a plurality of the authentication passwords are generated from the password and the number of digits of each divided portion of the character string, and the received one or more of the above-mentioned one or more And verifying the target password and the generated one or more authentication passwords. It is characterized in.

  According to this method, the password generation method includes a patrol method, a division method, and a combined method, so that the user can select a password that is easy to remember and safe for security. Also, since there are a plurality of password generation methods, even if the original password is leaked, an outsider cannot guess the password used for authentication.

  Further, the present invention is an authentication method, wherein a start position and a circulation direction of a character string corresponding to the authentication are changed, and a start position and a circulation direction of a character string changed at every authentication, or a day of the week and a date at the time of authentication. Or it is the start position and circulation direction of the character string produced | generated for every time slot | zone, It is characterized by the above-mentioned.

  The present invention includes an authentication device. In addition, the problems disclosed in the present application and the solutions thereof will be clarified by the column of the best mode for carrying out the invention and the drawings.

  According to the present invention, even if a password is leaked, unauthorized login can be suppressed.

  Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. In the authentication system according to the embodiment of the present invention, an authentication server (computer, authentication device) is preliminarily used from a terminal, based on an original password (first password) consisting of a character string of a predetermined length and an original password. The rule information for generating a password (second password) used for authentication is received and stored. Then, the authentication server sorts the original passwords according to the rule information at the time of authentication, or creates a new password by selecting from the original password, and the new password different from the original and the password received from the terminal (the first password) 3 password). According to this, even if the original password is leaked, as long as the rule information is secretly managed, unauthorized login can be suppressed.

≪System configuration and overview≫
FIG. 1 is a diagram illustrating a configuration of an authentication system. The authentication system 100 includes a terminal 1 and an authentication server 2. The terminal 1 and the authentication server 2 can communicate via the network 3. The terminal 1 is a terminal used by a user (user) to register a password or to input a password to receive a predetermined service. The terminal 1 is a mobile phone, a PDA (Personal Digital Assistance), a PC (Personal Computer). ) Etc. The terminal 1 may be a dedicated terminal such as an ATM terminal.

  The authentication server 2 stores a password to be registered received from the terminal 1, and further verifies a password to be authenticated received from the terminal 1 and a new password generated from the stored password. This is realized by a computer such as a PC (Personal Computer). The authentication server 2 may be a dedicated device. The network 3 is a communication network that enables the terminal 1 and the authentication server 2 to communicate with each other, and may be a public line such as the Internet or a dedicated line such as an intranet.

  FIG. 2 is a diagram illustrating a configuration of the terminal 1. The terminal 1 includes a communication unit 11, an input unit 12, a display unit 13, a processing unit 14, and a storage unit 15. The communication unit 11 is a part that communicates with the authentication server 2 via the network 3 and is realized by a NIC (Network Interface Card) or the like. The input unit 12 is a part where a user inputs a password or the like, and is realized by an operation button, a touch panel, a keyboard, a mouse, or the like. The display unit 13 is a part that displays a registration screen for registering a password or the like and a login screen for inputting a user ID and password in response to an instruction from the processing unit 14, and is displayed on an LCD (Liquid Crystal Display) or the like. Realized.

  The processing unit 14 is a part that controls the entire terminal 1 by passing and editing data between the units, and is realized by a CPU (Central Processing Unit) executing a program stored in a predetermined memory. Is done. The storage unit 15 is a part that stores data from the processing unit 14 and reads the stored data, and is realized by a nonvolatile storage device such as a flash memory or a hard disk device.

  FIG. 3 is a diagram illustrating the configuration of the authentication server 2. The authentication server 2 includes a communication unit 21, a clock unit 22, a processing unit 23, and a storage unit 24. The communication unit 21 is a part that communicates with the terminal 1 via the network 3 and is realized by a NIC or the like. The clock unit 22 is a part for outputting the current year / month / day / hour / minute / second (date / time) to the processing unit 23, and the clock unit 22 itself may have a clock function. You may make it acquire at any time. The processing unit 23 is a part that controls the entire authentication server 2 by transferring and editing data between the units, and is realized by the CPU executing a program stored in a predetermined memory. The storage unit 24 is a part that stores data from the processing unit 23 and reads the stored data, and is realized by a nonvolatile storage device such as a flash memory or a hard disk device.

  FIG. 4 is a diagram illustrating a module configuration of the processing unit 23 of the authentication server 2. The processing unit 23 includes an overall control unit 231, a password information registration unit 232, an authentication password generation unit 233, and a password verification unit 234. The overall control unit 231 activates each other unit in the processing unit 23 in response to an event that has occurred (for example, reception of a password or the like by the communication unit 21 or termination of the processing of the authentication password generation unit 233). The processing flow of the entire processing unit 23 is controlled. In addition, messages and data are exchanged by controlling an interface between the communication unit 21 and the storage unit 24 and other units in the processing unit 23. The overall control means 231 is a program module called a so-called kernel or scheduler.

  Each unit of the password information registration unit 232, the authentication password generation unit 233, and the password verification unit 234 is a program module that realizes specific functions of the authentication server 2 by operating under the control of the overall control unit 231. . The password information registration unit 232 stores the password information received from the terminal 1 via the network 3 in the storage unit 24. Details of the password information will be described later. The authentication password generation unit 233 generates an authentication password for authenticating the user ID and password received from the terminal 1 via the network 3. In this case, the password information stored in the storage unit 24 is specified by the user ID, and an authentication password is generated from the password information. Details of the generation process will be described later. The password verification unit 234 verifies the received password (target password) and the generated authentication password.

<< Data structure >>
FIG. 5 is a diagram showing a data structure of the password information 30. As shown in FIG. The password information 30 is stored in the storage unit 24 when the user registers before the user receives a predetermined service. And when a user actually receives a predetermined service, when a user ID and a password are input to the terminal 1, the authentication server 2 is used to generate an authentication password for authentication.

  FIG. 5A shows an example of the data configuration of the password information 30. The password information 30 includes, for example, a record including a user ID 301, a registered password 302, a password generation method 303, a circulation rule 304, and a division rule 305. The user ID 301 is an ID unique to the user, and is data that can identify the user. The registration password 302 is data used to generate an authentication password used for authentication. The password generation method 303 is data instructing a method for generating an authentication password from the registered password 302, and there are a cyclic method, a division method, and a combined method.

  In the patrol method, a start position and a patrol direction of a character string are determined according to authentication, and a new character string sequentially arranged in the patrol direction from the character at the start position in the registered password 302 is used as an authentication password. It is. For example, when the registration password 302 is “1234567”, the start position is “seventh digit”, and the circulation direction is “clockwise”, the authentication password is “7123456”. “According to the time of authentication” means that the start position and the circulation direction of the character string are changed for each authentication (login) (for example, the start position is shifted by one character, the circulation direction is reversed, etc.) This means that the start position and the circulation direction of the character string are determined for each day of the week, date, or time zone (for example, AM / PM).

  The division method is a method in which the number of digits of each divided part when a character string is divided into two or more is determined, and two or more parts obtained by dividing the registration password 302 according to the number of digits are used as an authentication password. For example, when the registration password 302 is “1234567” and the number of digits of each divided portion is “2, 4, 1”, the authentication password is “12”, “3456”, and “7”.

  The combined method is a method in which a cyclic method and a division method are combined, and is a method in which a character string generated by the cyclic method is further divided by a division method and used as an authentication password. For example, when the registration password 302 is “1234567”, the start position is “seventh digit”, the cyclic direction is “clockwise”, and the number of digits of each divided portion is “2, 4, 1”, the authentication password is “ 71 ”,“ 2345 ”and“ 6 ”.

  The circulation rule 304 is a rule used for the circulation method, and indicates the start position and the circulation direction of the character string corresponding to the time of authentication. Specific examples thereof will be described later. The circulation rule 304 is effective when the password generation method 303 is a circulation method or a combination method. The division rule 305 is a rule used for the division method, and indicates the number of digits of each divided portion when the character string is divided into two or more. Specific examples thereof are “2, 4, 1” already shown. The division rule 305 is effective when the password generation method 303 is a division method or a combination method.

  FIG. 5B shows an example of the circulation rule 304 for the password information 30. The tour rule 304 is composed of records including a day of the week 3041, a start position 3042, and a tour direction 3043, for example. The day of the week 3041 indicates the day of the week at the time of authentication, and means that the start position 3042 and the traveling direction 3043 are determined for each day of the week. The start position 3042 indicates the position of the character that becomes the head of the character string to be generated among the characters constituting the registered password 302. A circulation direction 3043 indicates a direction in which characters constituting the registered password 302 are arranged when a character string is generated. For example, when the registered password 302 is “1234567”, the 1-> 7 direction is clockwise and the 7-> 1 direction is counterclockwise.

≪Screen structure≫
FIG. 6 is a diagram illustrating an example of a registration screen. The registration screen G1 is displayed on the display unit 13 of the terminal 1 and is a screen for the user to register password information. As shown in FIG. 6, the registration screen G1 includes a column for inputting a user ID and a password, a column for selecting a password generation method, and a column for setting rules for each method. When the cyclic method or combination method is selected as the password generation method, the “(1) cyclic rule” field is activated, and when the division method or combination method is selected, the “(2) division rule” column is displayed. Activate.

  FIG. 7 is a diagram illustrating a first example of a login screen. The login screen G2 is displayed on the display unit 13 of the terminal 1 and is a screen for the user to input a user ID and password for receiving a predetermined service. As shown in FIG. 6, the registration screen G1 includes fields for entering a user ID and a password, and is used in the case of the cyclic method or when two or more passwords are separately transmitted to the authentication server 2 by the division method. .

  FIG. 8 is a diagram illustrating a second example of the login screen. The login screen G3 is displayed on the display unit 13 of the terminal 1 and is a screen for the user to input a user ID and password for receiving a predetermined service. As shown in FIG. 6, the registration screen G <b> 1 includes fields for inputting a user ID and passwords 1 to 7, and is used when two or more passwords are transmitted to the authentication server 2 in a batch manner.

≪Login authentication process≫
FIG. 9 is a flowchart showing login authentication processing of the authentication server 2. As a processing procedure of the entire authentication system 100, first, the registration screen G1 of FIG. 6 is displayed on the display unit 13 of the terminal 1, and the password information input to the registration screen G1 is transmitted from the terminal 1 to the authentication server 2, The password information registration unit 232 of the processing unit 23 stores the password information 30 in the storage unit 24. When the login screen G2 of FIG. 7 or the login screen G3 of FIG. 8 is displayed on the display unit 13 of the terminal 1, and the user ID and password input to the login screen G2 or G3 are transmitted to the authentication server 2. The login authentication process of the authentication server 2 is performed. Hereinafter, the processing will be described.

  First, the communication unit 21 of the authentication server 2 receives a user ID and a password from the terminal 1 via the network 3 (S901). Next, in the processing unit 23, the authentication password generation unit 233 receives the user ID and password via the overall control unit 231, and searches the password information 30 stored in the storage unit 24 using the user ID as a key. The corresponding password information 30 is specified (S902). Then, the authentication password generation unit 233 refers to the password information 30 to determine what the password generation method 303 is (S903).

  When the password generation method 303 is a cyclic method, the authentication password generation unit 233 generates a cyclic password as an authentication password from the registered password 302 and the cyclic rule 304 based on the current date and time acquired from the clock unit 22 (S904). Referring to the circulation rule 304 in FIG. 5B, for example, if the day of the week 3041 corresponding to the current date and time is Sunday, the start position 3042 is the seventh digit and the circulation direction 3043 is clockwise. In this case, if the registered password 302 is the example shown in FIG. 10A, the generated cyclic password is the example shown in FIG.

  When the password generation method 303 is a split method, the authentication password generation unit 233 generates a split password as an authentication password from the registered password 302 and the split rule 305 (S905). For example, when the division rule 305 is “2, 4, 1”, if the registered password 302 is an example shown in FIG. 10A, the generated divided password is an example shown in FIG.

  When the password generation method 303 is a combined method, first, the authentication password generation unit 233 generates a circulation password from the registration password 302 and the circulation rule 304 based on the current date and time acquired from the clock unit 22 (S906). Referring to the circulation rule 304 in FIG. 5B, for example, if the day of the week 3041 corresponding to the current date and time is Sunday, the start position 3042 is the seventh digit and the circulation direction 3043 is clockwise. In this case, if the registered password 302 is the example shown in FIG. 10A, the generated cyclic password is the example shown in FIG. Next, the authentication password generation unit 233 generates a divided password as an authentication password from the generated cyclic password and the division rule 305 (S907). For example, when the division rule 305 is “2, 4, 1”, if the cyclic password is an example shown in FIG. 10B, the generated divided password is an example shown in FIG.

  Subsequently, the password collation unit 234 collates the received password with the authentication password generated by the authentication password generation unit 233 (S908). Then, the verification result (OK or NG) is transmitted to the terminal 1. In the terminal 1, the verification result received by the communication unit 11 is transferred to the processing unit 14, and the verification result received by the processing unit 14 is transferred to the display unit 13. The display unit 13 displays the collation result received from the processing unit 14. The user can know whether or not the user ID and password entered on the login screen G2 or G3 are correct by referring to the collation result displayed on the display unit 13, and can receive a predetermined service. You can know if you can.

  Although the embodiment of the present invention has been described above, in order for the terminal 1 and the authentication server 2 of the authentication system 100 shown in FIG. 1 to function, the program executed by the processing unit 14 and the processing unit 23 can be read by a computer. It is assumed that the authentication system 100 according to the embodiment of the present invention is realized by recording on a recording medium, causing the computer to read and execute the recorded program. Note that the program may be provided to the computer via a network such as the Internet, or a semiconductor chip or the like in which the program is written may be incorporated in the computer.

  According to the embodiment of the present invention described above, when the password generation method is the cyclic method, the start position and the cyclic direction of the character string become the password generation rules, so that the user can easily learn the rules. . In addition, the character string start position and circulation direction are changed for each login or for each day of the week, date, or time, so even if the original password is leaked, an outsider guesses the password used for authentication. I can't do it.

  Further, when the password generation method is a division method, the number of digits of each divided part of the character string becomes a rule, so that the user can easily learn the rule. In addition, since authentication is performed using a plurality of passwords obtained by dividing the original password, even if the original password is leaked, an outsider cannot guess the password used for authentication.

  Further, since there are a patrol method, a division method, and a combination method as password generation methods, the user can select a password that is easy to remember and safe for security. Also, since there are a plurality of password generation methods, even if the original password is leaked, an outsider cannot guess the password used for authentication.

  Recently, there is a risk that login authentication may be broken by brute force attack, etc., so there is a tendency to lengthen the password. Therefore, the user can write the password on the card or write it down and remember only the rules. In that case, even if the password is leaked, as long as the rules are kept secret, unauthorized login can be suppressed. It may be difficult for users to remember long passwords, but it seems easy to remember password generation rules.

<< Other embodiments >>
Although the best mode for carrying out the present invention has been described above, the above embodiment is intended to facilitate understanding of the present invention and is not intended to limit the present invention. The present invention can be changed and improved without departing from the gist thereof, and equivalents thereof are also included in the present invention. For example, the following embodiments can be considered.

(1) In the above embodiment, the configuration in which the terminal 1 and the authentication server 2 can communicate via the network 3 has been described. However, the configuration in which the terminal 1 and the authentication server 2 are integrated (for example, one unit) The server may be configured to perform password input and authentication.

(2) In the above embodiment, in the patrol method, the start position and the patrol direction of the character string are set for each day of the week. However, only the start position is set for each day of the week, date, or time zone, and the patrol direction A part of the rules may be changed according to the day of the week or the like, for example.

(3) In the above embodiment, when the password information 30 is registered, the password information 30 is input to the registration screen of the terminal 1 and transmitted to the authentication server 2. However, the method is not necessarily limited to an online method. For example, the authentication server 2 may be provided with a display and a keyboard, and registration may be performed by inputting password information on the keyboard in accordance with a registration screen displayed on the display.

1 is a diagram illustrating a configuration of an authentication system 100. FIG. 2 is a diagram illustrating a configuration of a terminal 1. FIG. 2 is a diagram illustrating a configuration of an authentication server 2. FIG. It is a figure which shows the module structure of the process part 23 of the authentication server 2. FIG. It is a figure which shows the data structure of the password information 30, (a) shows the example of the data structure of the password information 30, (b) shows the example of the circulation rule 304 of the password information 30. It is a figure which shows the example of a registration screen. It is a figure which shows the example 1 of a login screen. It is a figure which shows the example 2 of a login screen. 4 is a flowchart showing login authentication processing of the authentication server 2. It is a figure which shows the example of a password, (a) shows the example of a registration password, (b) shows the example of a cyclic password, (c) And (d) shows the example of a division | segmentation password.

Explanation of symbols

100 Authentication system 1 Terminal 2 Authentication server (computer, authentication device)
21 Communication Unit 22 Clock Unit 23 Processing Unit 24 Storage Unit 30 Password Information 301 User ID
302 Registration Password 303 Password Generation Method 304 Traveling Rule 3041 Day of the Week 3042 Start Position 3043 Traveling Direction 305 Division Rule 3 Network

Claims (6)

A memory for storing a user ID unique to a user, a registration password that is a source for generating an authentication password used for authentication, and password information including the number of digits of each divided portion of a character string generated from the registration password as the authentication password A method of authenticating a target password used by the user by a computer comprising a unit,
The computer
Receiving the password information and storing it in the storage unit;
The user ID and a plurality of target passwords to be authenticated are received, the password information stored in the storage unit is specified from the user ID, and the registration password and the character string are divided among the password information. Generating a plurality of the authentication passwords from the number of digits of the part;
Checking each of the plurality of received target passwords and the plurality of generated authentication passwords;
The authentication method characterized by performing this. User ID unique to the user, registration password that is used to generate an authentication password used for authentication, a password generation method that indicates a patrol method, a division method, or a combination method, and authentication that is generated from the registration password as the authentication password A method of authenticating a target password used by the user by a computer including a storage unit that stores password information including a start position and a circulation direction of the character string and / or the number of digits of each divided portion of the character string,
The computer
Receiving the password information and storing it in the storage unit;
Receiving the user ID and one or more target passwords to be authenticated, and specifying password information stored in the storage unit from the user ID;
When the password generation method of the password information is a cyclic method, generating the authentication password from the registration password, the start position of the character string and the cyclic direction according to the authentication, and
When the password generation method is a split method, generating a plurality of the authentication passwords from the number of digits of each of the divided portions of the registration password and the character string;
When the password generation method is a combined method, the password is generated from the registration password, the start position of the character string and the circulation direction according to the authentication, and from the number of digits of each divided part of the password and the character string Generating a plurality of said authentication passwords;
Checking the received one or more target passwords and the generated one or more authentication passwords;
The authentication method characterized by performing this. The authentication method according to claim 2 ,
The start position and the circulation direction of the character string according to the authentication are as follows:
An authentication method, comprising: a start position and a circulation direction of a character string that is changed every time of authentication, or a start position and a circulation direction of a character string that is generated for each day of the week, date, or time period at the time of authentication. An authentication device for storing and authenticating a password used by a user,
A user ID unique to the user, a registration password from which an authentication password used for authentication is generated, and password information including the number of digits of each divided part of a character string generated from the registration password are stored as the authentication password A storage unit;
Password information registration means for receiving the password information and storing it in the storage unit;
The user ID and a plurality of target passwords to be authenticated are received, the password information stored in the storage unit is specified from the user ID, and the registration password and each divided part of the character string of the password information Authentication password generation means for generating a plurality of the authentication passwords from the number of digits of;
Password verification means for verifying each of the plurality of received target passwords and the plurality of generated authentication passwords;
A processing unit including:
An authentication device comprising: An authentication device for storing and authenticating a password used by a user,
A user ID unique to the user, a registration password from which an authentication password used for authentication is generated, a password generation method indicating a cyclic method, a division method or a combination method, and an authentication password generated from the registration password as the authentication password A storage unit for storing password information including the start position and the circulation direction of the corresponding character string and / or the number of digits of each divided portion of the character string;
Password information registration means for receiving the password information and storing it in the storage unit;
Accepting the user ID and one or more target passwords to be authenticated, specifying password information stored in the storage unit from the user ID,
When the password generation method of the password information is a cyclic method, generate the authentication password from the registration password, the start position of the character string and the cyclic direction according to the authentication,
When the password generation method is a split method, a plurality of the authentication passwords are generated from the number of digits of each part of the registration password and the character string,
When the password generation method is a combined method, the password is generated from the registration password, the start position of the character string and the circulation direction according to the authentication, and from the number of digits of each divided part of the password and the character string Authentication password generation means for generating a plurality of authentication passwords;
Password verification means for verifying the received one or more target passwords and the generated one or more authentication passwords;
A processing unit including:
An authentication device comprising: The authentication device according to claim 5 ,
The start position and the circulation direction of the character string according to the authentication are as follows:
An authentication apparatus, wherein the start position and the circulation direction of a character string to be changed for each authentication time, or the start position and the circulation direction of a character string to be generated for each day of the week, date, or time period at the time of authentication.

Images