JP6948037B2 - Authentication system and authentication program - Google Patents

Description

The present invention relates to an authentication technique for a computer or a smartphone, and more particularly to an authentication technique using a temporary password issued when biometric authentication fails.

In recent years, biometric authentication technologies such as face authentication, fingerprint authentication, and iris authentication have become widespread in authentication technologies such as computers. By using these biometric authentication technologies, the user does not need to memorize the ID and password, and authentication can be realized with excellent accuracy, which has an advantage of high convenience.
On the other hand, if the authentication is not successful due to, for example, the face being injured during face authentication, it is necessary to perform the authentication by another method.

Here, there are the following methods for the authentication technology using two computers. That is, the password is issued on the first computer, and the user obtains the generated password from the first computer. The user inputs the obtained password into the second computer. The second computer inquires of the first computer via a network or the like in order to confirm whether the entered password is the password issued by the first computer.
With this method, if the computer that generates the password and the computer that confirms the password are not connected via a network, it is not possible to confirm whether the entered password is correct.

Japanese Unexamined Patent Publication No. 2014-38612 Japanese Unexamined Patent Publication No. 2011-2960 Japanese Unexamined Patent Publication No. 2010-2823222

By the way, when using a computer at school or the like, for example, a tablet computer may be carried and going out to study outside the school. In such a case, the computer that generates the password and the computer that confirms the password may not be able to be connected by the network.
Therefore, it is desirable to enable authentication even if these computers cannot be connected via a network.

Also, when using a computer in a school or the like, both the computer that generates the password and the computer that confirms the password may be used in a relatively close location.
In such a case, if the generated password is made available only when the person who issued the password and the person who uses it are in a face-to-face or relatively close position, the person who issued the password will be able to use it. Since the person who uses the password can be visually confirmed, it is possible to prevent an unspecified person from using the password.
In other words, if the password can only be used face-to-face, the identity of the person using the password can be confirmed from the face or appearance, which is useful when the password is used after the identity is confirmed. be.

Therefore, the present inventor has diligently researched and made a computer that generates a password and a computer that confirms the password acquire location information, and causes these computers to generate a password by a message digest based on the location information and a predetermined initial value. By comparing these passwords and enabling authentication, we succeeded in realizing authentication using passwords that can only be used face-to-face, and completed the present invention.

Here, examples of the authentication technique using position information include the authentication systems described in Patent Document 1 and Patent Document 2. According to these authentication systems, it is possible to acquire the position information of the computer and to make the authentication successful only when the computer exists in a predetermined range. Further, Patent Document 3 discloses an authentication system that generates an authentication code based on the coordinate value of the GPS calculated position or the distance between the same position and a predetermined position.
However, in the authentication system described in these patent documents, the authentication is successful only when the person who uses the computer that generates the password and the person who uses the password using the computer that confirms the password exist face-to-face. It didn't make that possible.

In the present invention, the above circumstances are taken into consideration, and authentication is performed only when a person who uses a computer that generates a password and a person who uses a password using a computer that confirms the password exist face-to-face. The purpose is to provide an authentication system, authentication method, and authentication program that enables success and can be used even in an offline environment.

In order to achieve the above object, the authentication system of the present invention is an authentication system having a first information processing device for displaying a password and a second information processing device for performing authentication processing, and the first information processing The device generates a password by a message digest using the position information acquisition unit that acquires the position information of the first information processing device, the acquired position information of the first information processing device, and a predetermined initial value. A password generation unit and a password display unit for displaying the generated password are provided, and the second information processing device inputs a password input unit for inputting a password and location information of the second information processing device. A second password generation unit that generates a password by a message digest using the acquired position information acquisition unit, the acquired position information of the second information processing device, and the predetermined initial value, the generated password, and the above. The first information processing device is used by the first user, and the second information processing device is the first. It is configured to be used by a second user different from the user.

Further, in the above authentication system of the present invention, the first password generation unit generates a password by message digest using only the position information of the first information processing device, and the second password generation unit generates a second password. It is also preferable to have a configuration in which a password is generated by a message digest using only the position information of the information processing device.

Further, the authentication method of the present invention is an authentication method using a first information processing device that displays a password and a second information processing device that performs authentication processing, and acquires position information of the first information processing device. The unit acquires the position information of the first information processing device, and the first password generation unit of the first information processing device acquires the acquired position information of the first information processing device and a predetermined initial value. A password is generated by a message digest using the above, the password display unit of the first information processing device displays the generated password, and the password input unit of the second information processing device inputs the password. The position information acquisition unit of the second information processing device acquires the position information of the second information processing device, and the second password generation unit of the second information processing device has acquired the second password. When a password is generated by a message digest using the position information of the information processing device and the predetermined initial value, and the password comparison unit of the second information processing device matches the generated password with the entered password. This is a method for determining that the authentication is successful.

Further, the authentication program of the present invention causes the first information processing device to acquire the position information of the first information processing device, and uses the acquired position information of the first information processing device and a predetermined initial value. The password is generated by the message digest, the generated password is displayed, the second information processing device is made to enter the password, the position information of the second information processing device is acquired, and the acquired second information processing device is acquired. A password is generated by a message digest using the position information of the information processing device and the predetermined initial value, and if the generated password and the entered password match, it is determined that the authentication is successful, and the first information processing device is described. Is used by the first user, and the second information processing apparatus is configured to be used by a second user different from the first user.

According to the present invention, it is possible to succeed in authentication only when a person who uses a computer that generates a password and a person who uses a password using a computer that confirms the password exist face-to-face. Further, according to the present invention, it is possible to perform authentication even in an offline environment.

It is a figure which shows the flow of information in the block diagram which shows the structure of the authentication system of 1st Embodiment of this invention. It is a flowchart which shows the processing procedure of the authentication system of 1st Embodiment of this invention. It is a figure which shows the flow of information in the block diagram which shows the structure of the authentication system of the 2nd Embodiment of this invention. It is a flowchart which shows the processing procedure of the authentication system of the 2nd Embodiment of this invention. It is a figure which shows the flow of information in the block diagram which shows the structure of the authentication system of the 3rd Embodiment of this invention. It is a figure which shows the flow of information in the block diagram which shows the structure of the authentication system of 4th Embodiment of this invention.

Hereinafter, preferred embodiments of the authentication system, authentication method, and authentication program of the present invention will be described with reference to the drawings.

[First Embodiment]
First, the first embodiment of the present invention will be described with reference to FIGS. 1 and 2. FIG. 1 is a block diagram showing a configuration of an authentication system of the present embodiment, showing a flow of information, and FIG. 2 is a flowchart showing a processing procedure of the authentication system of the present embodiment.

In FIG. 1, the authentication system includes a password display device 1 and an authentication device 2.
The password display device 1 includes a location information acquisition unit 11, an organization information storage unit 12, a password generation unit 13, and a password display unit 14, and the authentication device 2 includes a location information acquisition unit 21, an organization information storage unit 22, and the password display unit 2. It includes a password generation unit 23, a password input unit 25, and a password comparison unit 26.

The password display device 1 is a computer (information processing device) that generates and displays a password, and is preferably used by a user such as a school teacher.
The position information acquisition unit 11 acquires the position information of the password display device 1. The position information acquisition unit 11 may receive radio waves from a satellite called GPS, for example, and input the current latitude, longitude, and altitude of the password display device 1. In many cases, personal computers and smartphones in recent years already have such a position information acquisition unit 11 built-in, so that the configuration can be realized in many devices.

The organization information storage unit 12 stores organization information such as a character string indicating an organization such as a school name and identification information. This organization information, together with the location information of the password display device 1, serves as a predetermined initial value for use as the original data for password generation by the message digest. By including the organization information in the original data of the password generation by the message digest in this way, even if another organization or group should generate the password using the same algorithm and use this device in the same place. , It is possible to prevent the same password from being generated.

Further, in the organization information storage unit 12, in addition to the organization information, additional information such as a character string that cannot be easily imagined is stored, and this is also used as the original data (predetermined initial value) for password generation by the message digest. It is also preferable to use it. In this way, it is possible to further reduce the risk that the same password is generated by a third party.
It is also possible to convert additional information such as a character string that cannot be easily imagined into organizational information and use it as the source data for password generation by message digest.

Further, as a method of further reducing the risk of the same password being generated by a third party, it is also preferable to update the character string of the initial value at regular intervals. For example, by storing the same plurality of initial values in advance in the password display device 1 and the authentication device 2 and selecting the same initial values based on a certain standard based on the time information, the initial values are set at regular intervals. It is possible to update the character string of.

The password generation unit 13 inputs the position information from the position information acquisition unit 11, inputs the organization information from the organization information storage unit 12, calculates a message digest from these two pieces of information, and obtains about 6 digits. Generate a numerical value (character string) as a password.
The message digest, also called a hash, is an algorithm that guarantees that it is difficult to infer the original information from the generated value, and by using this, the original data used to generate the message digest can be used. It becomes impossible to guess.

Here, it is assumed that the position information acquired from GPS or the like may include an error. Further, it is assumed that the password display device 1 for generating a password and the authentication device 2 for confirming a password are located close to each other but do not exist at the same position.
Therefore, the password generation unit 13 can process the position information so that it is the same within a range of, for example, 10 m, and use this as the source data for password generation. The method for processing the position information so as to be the same within a range of 10 m is not particularly limited, but for example, the latitude information and the longitude information acquired by the position information acquisition unit 11 are the same within a range of 10 m. It can be performed by performing a truncation process so as to become.

Further, at this time, the password generation unit 23 in the authentication device 2 processes the position information so as to be the same within a range of, for example, 10 m, and generates a plurality of position information including the range within 10 m as the original data for password generation. Can generate multiple password candidates. Then, the password comparison unit 26 authenticates with the password display device 1 by making the authentication successful when the password generated by the password generation unit 13 matches any one of the plurality of passwords generated by the password generation unit 23. It is possible to make the authentication successful only when the device 2 and the device 2 are in the proximity range.
As described above, it is preferable that the password generation unit 13 and the password generation unit 23 adjust the position information so as to be the same within a predetermined proximity range, and generate a password using the adjusted position information.

Further, as a method for making the authentication successful only when the password display device 1 and the authentication device 2 are within a predetermined proximity range, a radio wave communication unit (Bluetooth (registered trademark) or the like) that emits weak radio waves is used. You can also.
Specifically, each of the password display device 1 and the authentication device 2 is provided with a radio wave communication unit, and the password display device 1 displays a password on the password display device 1 and generates radio waves on the radio wave communication unit. Then, the authentication device 2 can succeed in the authentication by the password comparison unit 26 only when the radio wave communication unit receives the radio wave from the password display device 1. As a result, the authentication can be successful only when the authentication device 2 exists in a short distance where the radio wave generated by the password display device 1 can reach.

Further, if the password display device 1 and the authentication device 2 are made to succeed in authentication only when they are in a close range in this way, when the users of these devices are in a place where they can see each other. Only can be authenticated. That is, the password generated by the password display device 1 can be used only when the users of these devices are facing each other. That is, the authentication system of the present embodiment generates a password that can be used only face-to-face.

Further, in the present embodiment, the organization information storage unit 12 and the organization information storage unit 22 are omitted, and the password generation unit 13 and the password generation unit 23 use only the location information as the original data for password generation by a message digest. It is also preferable to configure it to generate a password.
That is, according to the present embodiment, since the users of the password display device 1 and the authentication device 2 can succeed in the authentication only when they are in the proximity range, it is possible to visually confirm that there is no third party in the vicinity. By performing the authentication process after confirmation, it is possible to safely perform user authentication even if the organization information storage unit 12 and the organization information storage unit 22 are omitted and the password is generated only from the location information. be.

The password display unit 14 inputs the password generated from the password generation unit 13 and displays it on the display of the password display device 1.

The authentication device 2 is a computer that generates a password, compares the generated password with the input password, and performs an authentication process, and is preferably used by users such as school children.
The position information acquisition unit 21 acquires the position information of the authentication device 2, and can be the same as the position information acquisition unit 11 in the password display device 1.
Further, the organization information storage unit 22 stores the organization information, and can be the same as the organization information storage unit 12 in the password display device 1. That is, the same organization information is stored in the password display device 1 and the authentication device 2.

The password generation unit 23 inputs the position information from the position information acquisition unit 21, inputs the organization information from the organization information storage unit 22, calculates a message digest from these two pieces of information, and obtains about 6 digits. Generate a numerical value (character string) as a password.
Further, the password generation unit 23 processes the position information so as to be the same within a range of, for example, 10 m, based on the same criteria as the password generation unit 13, and also performs a plurality of position information including the range within 10 m. Generate multiple passwords as the source data for password generation.

The password input unit 25 inputs the password displayed by the password display unit 14 offline. That is, the password is input by the user using an input device such as a keyboard or mouse provided or connected to the authentication device 2, and the password input unit 25 inputs the password into the authentication device 2.

The password comparison unit 26 confirms whether the password generated by the password generation unit 23 and the password input by the password input unit 25 are the same, and if they are the same, determines that the authentication is successful. ..
At this time, as described above, the password generation unit 23 generates a plurality of passwords based on the plurality of location information so that the authentication succeeds only when the password display device 1 and the authentication device 2 exist in a close range. If the generated and entered password is the same as any of these multiple passwords, the authentication can be successful.

Next, the processing procedure (authentication method) of the authentication system of the present embodiment will be described with reference to the flowchart shown in FIG. Note that FIG. 2 shows only the authentication processing process using the password display device 1 and the authentication device 2. Normally, user authentication is performed in the password display device 1 prior to the start of use of the password display device 1, but this is omitted in FIG. This also applies to the flowchart described below.

First, the password display device 1 acquires the position information of its own device (step 10), generates a password based on the position information and the organization information (step 11), and displays this password (step 12). The user of the password display device 1 conveys or refers to the displayed password to the user of the authentication device 2.
The authentication device 2 inputs the password offline by the user's operation (step 13). Next, the authentication device 2 acquires the position information of its own device (step 14) and generates a password based on the position information and the organization information (step 15).
Then, the authentication device 2 compares the input password with the generated password (step 16), and if they match (if there is a match), determines that the authentication is successful and executes various processes. (Step 17).

According to the authentication system, the authentication method, and the authentication program of the present embodiment, the user of the password display device 1 and the user of the authentication device 2 can be authenticated only when they are facing each other or are close to each other. can do. In addition, authentication can be performed even in an offline environment. Furthermore, by including the organization information in the original data for password generation, it is possible to prevent other organizations or groups from generating the same password.

[Second Embodiment]
Next, the second embodiment of the present invention will be described with reference to FIGS. 3 and 4. FIG. 3 is a block diagram showing the configuration of the authentication system of the present embodiment, and is a diagram showing the flow of information, and FIG. 4 is a flowchart showing a processing procedure of the authentication system of the present embodiment.
As shown in FIG. 3, the authentication system of the present embodiment has a password display device 1a and an authentication device 2a, and the point that the authentication device 2a includes a biometric authentication unit 27a and a password comparison can be compared. It differs from the first embodiment in that it enables logon processing to an OS (Windows, etc.) by identifying a user as well as performing it. Other points are the same as those in the first embodiment.

The biometric authentication unit 27a performs authentication processing such as face authentication, fingerprint authentication, and iris authentication, and includes a biometric information storage unit 271a, a biometric information input unit 272a, and an authentication processing unit 273a. Hereinafter, the face authentication will be described as tentatively performed, but the same configuration can be applied to other biometric authentication such as fingerprint authentication and iris authentication.

The biometric information storage unit 271a stores face authentication information in association with the user identification information of the authentication device 2a. The face recognition information is acquired in advance and stored in the biometric information storage unit 271a.
The biometric information input unit 272a inputs the face authentication information of the user of the authentication device 2a. For example, a user's face image is acquired by using a Web camera or a CCD camera provided or connected to the authentication device 2a, and the biometric information input unit 272a transmits the face authentication information to the authentication device 2a based on the face image. You can enter it.

The authentication processing unit 273a collates the face authentication information input from the biometric information input unit 272a with the face authentication information stored in the biometric information storage unit 271a, and if they match, the face authentication is successful and the user is identified. The logon process to the OS can be performed.
On the other hand, for example, when the user's face of the authentication device 2a is scratched, the face authentication information input from the biometric information input unit 272a and the face authentication information stored in the biometric information storage unit 271a match. If not, face authentication is not successful and logon processing to the OS is not performed.

Therefore, in the authentication system of the present embodiment, as described above in the first embodiment, a password is generated by the password display device 1a, input to the authentication device 2a, and matches the password generated by the authentication device 2a. In addition, by enabling various processes such as logon processing as successful authentication, it is possible to properly perform authentication even if face authentication is not successful.
Although the biometric authentication unit 27a is provided only in the authentication device 2a in FIG. 3, it goes without saying that the password display device 1a can also be provided with the biometric authentication unit.

Here, although not shown in FIG. 3, the authentication device 2a includes a user information storage unit. This user information storage unit stores the user identification information in association with the ID and password for logging on to the OS.
When the face authentication is successful, the above-mentioned authentication processing unit 273a acquires the user identification information from the biometric information storage unit 271a, and also acquires the ID and password from the user information storage unit based on the user identification information. Log on to the OS.

The user of the password display device 1a confirms the user who requested the generation of the password face-to-face, and then transmits the password displayed on the password display unit 14a and the identification information of the user to the user.
Then, the password input unit 25a inputs the password and the user identification information by the user.
The password comparison unit 26a determines that the authentication is successful when the input password and the password generated by the password generation unit 23a match, and acquires the corresponding ID and password from the user information storage unit based on the input user identification information. do.
This makes it possible to log on to the OS of the user.

Next, the processing procedure (authentication method) of the authentication system of the present embodiment will be described with reference to the flowchart shown in FIG. Here, it is assumed that the password display device 1a is used by the school teacher and the authentication device 2a is used by the school children. In addition, it is assumed that all of these devices are composed of tablet PCs, and that they are used to go out to study outside the school and are in an offline environment.

First, the authentication device 2a inputs face authentication information (biometric authentication information) by the operation of the child (step 20), and executes the face authentication process (step 21). At this time, if the authentication is successful, the logon process to the OS is performed (step 29). On the other hand, if the authentication is not successful because the child has a wound on his face, the child will report to the teacher.

Next, the password display device 1a acquires the position information of its own device in order to generate a password to be temporarily used by the child by the operation of the teacher (step 22). Then, a password is generated based on the location information and the organization information (step 23), and this password is displayed (step 24). This allows the teacher to teach the child the displayed password. At this time, the teacher confirms the child face-to-face, adds the child's identification information to the password, and teaches the child.

Next, the authentication device 2a inputs the password and the identification information of the child offline by the operation of the child who has been taught the password (step 25). Subsequently, the authentication device 2a acquires the position information of its own device (step 26) and generates a password based on the position information and the organization information (step 27).
Then, the authentication device 2a compares the entered password with the generated password (step 28), and if they match (if there is a match), the authentication device 2a determines that the authentication is successful.
Further, the authentication device 2a acquires the corresponding ID and password from the user information storage unit based on the child's identification information. Then, the authentication device 2a executes various processes such as logging on to the OS (step 29).

According to the authentication system, the authentication method, and the authentication program of the present embodiment, when the biometric authentication by the user of the authentication device 2a fails, the password display device 1a generates a password for temporary use. , This can be input to the authentication device 2a and compared with the password generated by the authentication device 2a to perform the authentication process.
In the present embodiment, the authentication device 2a is provided with the biometric authentication unit 27a, but the authentication device 2a is provided with an authentication unit other than the biometric authentication, and the authentication unit authenticates for some reason. The present embodiment can be preferably applied even when the above is not successful.

[Third Embodiment]
Next, the third embodiment of the present invention will be described with reference to FIG. FIG. 5 is a block diagram showing the configuration of the authentication system of the present embodiment, showing the flow of information.
As shown in FIG. 5, the authentication system of the present embodiment includes a password display device 1b and an authentication device 2b. The password display device 1b has a time information acquisition unit 18b, and the authentication device 2b has a time information acquisition unit 28b. It differs from the first embodiment in that it is provided with. Other points are the same as those in the first embodiment.

The time information acquisition unit 18b acquires time information. This time information can be used as one of the original data (predetermined initial value) for password generation. In general, a clock provided in a computer measures a certain amount of accurate time by transmitting a crystal without turning on the power, so that time can be used as time information. The time information may consist of, for example, the Christian era, the month, day, and hour, minute, and second.
The password generation unit 13b inputs position information from the position information acquisition unit 11b, organization information from the organization information storage unit 12b, and time information from the time information acquisition unit 18b, and generates a password by message digest using these as original data. do.

Further, the time information acquisition unit 28b acquires time information in the same manner as the time information acquisition unit 18b. It is assumed that the password display device 1b and the authentication device 2b measure almost the same date and time.
Similar to the password generation unit 13b, the password generation unit 23b inputs the position information from the position information acquisition unit 21b, the organization information from the organization information storage unit 22b, and the time information from the time information acquisition unit 28b. Generate a password as data by message digest.
In the present embodiment, the password can be generated by the message digest from the location information and the time information without using the initial value such as the organization information as the original data for password generation. It is also possible to generate a password by message digest only from the location information.

In this way, if the time information is included in the original data for password generation, the password will change if the date or time changes, so it is possible to set the expiration date of the password. For example, by using the year, month, day, and hour as time information and not using minutes and seconds, the password expiration date can be set to one hour.
The expiration date of such a password also serves to absorb the error of the clock built in the computer. That is, for example, if the expiration date is one hour, the same password is generated in the password display device 1b and the authentication device 2b even if the clock deviates from the correct time within the range of one hour. ..

Further, in consideration of the case where the time information acquired by the time information acquisition unit 18b and the time information acquisition unit 28b are different from each other, it is also preferable to perform the processing as follows.
That is, when the expiration date is set to 1 hour, for example, when the expiration date is set to 1 hour, the time information acquisition unit 28b is made to generate a plurality of password candidates by using the time information of several hours before and after as the source data for password generation, and the password display device. If the password generated by 1b matches any of these plurality of passwords, the authentication is successful, so that the authentication process can be appropriately performed even if the time information is incorrect.

According to the authentication system, the authentication method, and the authentication program of the present embodiment, the password can be generated by the message digest including the time information as the source data for the password generation. Therefore, it is possible to give the password itself an expiration date without having to perform a special process for setting the expiration date on the password.

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described with reference to FIG. FIG. 6 is a block diagram showing the configuration of the authentication system of the present embodiment, showing the flow of information.
As shown in FIG. 6, the authentication system of the present embodiment has a password display device 1c and an authentication device 2c, the password display device 1c is a physical phenomenon information input unit 19c, and the authentication device 2c is a physical phenomenon information input. It is different from the first embodiment in that the unit 29c is provided and the position information is created based on the input information by these parts. Other points are the same as those in the first embodiment.

The physical phenomenon information input unit 19c includes a temperature information input unit 191c, a humidity information input unit 192c, a barometric pressure information input unit 193c, an illuminance information input unit 194c, and a radio wave intensity information input unit 195c. The physical phenomenon information input unit 19c may be provided with only a part of these, but many of them are provided in order to improve the accuracy of the position information created by the position information acquisition unit 11c. Is preferable.
The temperature information input unit 191c, the humidity information input unit 192c, the pressure information input unit 193c, the illuminance information input unit 194c, and the radio wave intensity information input unit 195c are provided with or connected to the authentication device 2c with sensors for acquiring the respective information. By doing so, each information of temperature, humidity, pressure, illuminance (brightness of the sun), and radio wave intensity can be input.
The position information acquisition unit 11c inputs temperature information, humidity information, pressure pressure information, illuminance information, and radio wave intensity information from the physical phenomenon information input unit 19c, and uses a combination of these as position information.

Similar to the physical phenomenon information input unit 19c, the physical phenomenon information input unit 29c includes a temperature information input unit 291c, a humidity information input unit 292c, a pressure information input unit 293c, an illuminance information input unit 294c, and a radio wave intensity information input unit 295c. I have.
Further, the position information acquisition unit 21c inputs temperature information, humidity information, pressure pressure information, illuminance information, and radio wave intensity information from the physical phenomenon information input unit 29c in the same manner as the position information acquisition unit 11c, and combines these. Used as location information.

As described above, according to the present embodiment, the position information as the original data for password generation is created by combining the information of the physical phenomenon that can be obtained only in the same place without acquiring the position information by GPS. Can be done. Therefore, even when it is difficult to acquire the position information by GPS, it is possible to generate the password by the message digest including the position information as the original data for password generation.
From this point of view, it is also preferable to use more information as information on physical phenomena that can be obtained only at the same place.

The password display device and the authentication device in the authentication system of each of the above embodiments can be realized by using a computer controlled by the authentication program of the present invention. The CPU of the computer sends a command to each component of the computer based on the authentication program, and predetermined processes required for the operation of the authentication system, such as location information acquisition process, password generation process, password display process, and password comparison. Have them perform processing, etc. As described above, each process and operation in the authentication system of the present invention can be realized by a concrete means in which the program and the computer cooperate.

The program is stored in a recording medium such as ROM or RAM in advance, and the program is read by the computer from the recording medium mounted on the computer and executed. However, the program can also be read by the computer via a communication line, for example.
Further, the recording medium for storing the program can be configured by, for example, a semiconductor memory, a magnetic disk, an optical disk, or any other recording means that can be read by any computer.

As described above, according to the authentication system, the authentication method, and the authentication program according to the embodiment of the present invention, when the user who generates the password and the user who uses the password are facing each other or are close to each other. Can only be authenticated. In particular, when biometric authentication is used as a legitimate authentication in the authentication device and the authentication cannot be performed properly due to various reasons, a password for temporary use is generated and authenticated. Can be suitably used when performing the above.
Further, by including the time information as the source data for password generation, it is possible to give the password itself an expiration date without the need to perform special processing for setting the expiration date.
Further, it is also possible to perform authentication using the position information by combining the information of the physical phenomenon that can be obtained only at the same place without acquiring the position information by GPS.

It goes without saying that the present invention is not limited to the above embodiments, and various modifications can be made within the scope of the present invention.
For example, it is possible to appropriately change the configuration such that each of the first to fourth embodiments is combined in various ways.

The present invention is used temporarily in an offline environment when the user who generates the password and the user who uses the password exist face-to-face or in close proximity to each other and the computer authentication is not successful for some reason. It can be suitably used when it is desired to generate a password for the user and enable authentication.

1 Password display device 11 (11a, 11b, 11c) Position information acquisition unit 12 (12a, 12b, 12c) Organization information storage unit 13 (13a, 13b, 13c) Password generation unit 14 (14a, 14b, 14c) Password display unit 18b Time information acquisition unit 19c Physical phenomenon information input unit 191c Temperature information input unit 192c Humidity information input unit 193c Pressure information input unit 194c Illumination information input unit 195c Radio strength information input unit 2 (2a, 2b, 2c) Authentication device 21 (21a) , 21b, 21c) Position information acquisition unit 22 (22a, 22b, 22c) Organization information storage unit 23 (23a, 23b, 23c) Password generation unit 25 (25a, 25b, 25c) Password input unit 26 (26a, 26b, 26c) ) Password comparison unit 27a Biometric authentication unit 271a Biometric information storage unit 272a Biometric information input unit 273a Authentication processing unit 28b Time information acquisition unit 29c Physical phenomenon information input unit 291c Temperature information input unit 292c Humidity information input unit 293c Pressure information input unit 294c Illumination Information input unit 295c Radio strength information input unit

Claims (9)

An authentication system having a first information processing device that displays a password and a second information processing device that performs authentication processing.
The first information processing device uses a position information acquisition unit that acquires the position information of the first information processing device, the acquired position information of the first information processing device, and a predetermined initial value to perform a message digest. It is equipped with a first password generation unit that generates a password by information processing and a password display unit that displays the generated password.
The second information processing device includes a password input unit for inputting a password, a position information acquisition unit for acquiring the position information of the second information processing device, and the acquired position information of the second information processing device. It is provided with a second password generation unit that generates a password by message digest using the predetermined initial value, and a password comparison unit that determines that authentication is successful when the generated password matches the input password .
The first information processing device is used by the first user and
The second information processing device is an authentication system characterized in that it is used by a second user different from the first user. The first password generation unit generates a password by message digest using the position information of the first information processing device, the predetermined initial information, and the time information.
The authentication according to claim 1, wherein the second password generation unit generates a password by a message digest using the position information of the second information processing device, the predetermined initial information, and the time information. system. The authentication system according to claim 1 or 2, wherein the position information acquisition unit acquires information on a physical phenomenon as position information. The authentication system according to claim 3, wherein the information on the physical phenomenon is at least one selected from temperature, humidity, atmospheric pressure, sun brightness, and radio wave intensity. The position information acquisition unit of the first information processing device acquires the position information included in a predetermined proximity range from the position information of the first information processing device as the position information of the first information processing device.
Position information acquisition unit of the previous SL second information processing apparatus acquires the position information included in the predetermined proximity range of the position information of the second information processing apparatus as the position information of the second information processing apparatus The authentication system according to any one of claims 1 to 4. An authentication system having a first information processing device that displays a password and a second information processing device that performs authentication processing.
The first information processing device has a radio wave transmitting unit capable of transmitting radio waves in a predetermined proximity range, a first password generating unit that generates a password by a message digest using a predetermined initial value, and a generated password. Equipped with a password display unit to display
The second information processing device uses a radio wave receiving unit capable of receiving the radio wave, a password input unit for inputting a password, and a second password generating unit for generating a password by a message digest using the predetermined initial values. If, consistent password the input with the generated password, and, when receiving the radio wave, authentication system that is characterized in that a determining password comparison unit and an authentication success. The predetermined proximity range is a range in which a first user who uses the first information processing device can visually recognize a second user who uses the second information processing device. The authentication system according to 5 or 6. An authentication system having a first information processing device that displays a password and a second information processing device that performs authentication processing.
The first information processing device generates a password by a message digest using a position information acquisition unit that acquires the position information of the first information processing device and the acquired position information of the first information processing device. It has a first password generation unit and a password display unit that displays the generated password.
The second information processing device inputs a password input unit for inputting a password, a position information acquisition unit for acquiring the position information of the second information processing device, and the acquired position information of the second information processing device. It is provided with a second password generation unit that generates a password by using a message digest, and a password comparison unit that determines that the authentication is successful when the generated password matches the entered password.
The first information processing device is used by the first user and
The second information processing device is used by a second user different from the first user.
An authentication system characterized by that. A first information processing device is made to acquire the position information of the first information processing device, and a password is generated by a message digest using the acquired position information of the first information processing device and a predetermined initial value. Display the generated password and
A password is input to the second information processing device, the position information of the second information processing device is acquired, and a message digest is performed using the acquired position information of the second information processing device and the predetermined initial value. If the generated password matches the entered password, it is determined that the authentication is successful .
The first information processing device is used by the first user and
The second information processing device is an authentication program for executing what is used by a second user different from the first user.

Images