JPH11212454A - Authentication type security system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To effectively prevent an authenticated body from being forged, to facilitate the maintenance, and to evade complexity of the structure of, specially, the authenticated body side by collating feature data with physical features which are read at the time of authentication and deciding whether or not the authenticated body is genuine or false according to the respective matching results. SOLUTION: When a card 4 to be authenticated is inserted into a card reader 3, issue device sign data 4c, feature data 4C, etc., stored on a magnetic stripe 45 are read out and physical features are read as feature data 4D' out of a reference area 43 along a read track set on the card reader 3. The authentication device sign data 2C are deciphered with authentication device open key data 1B and collated with issue device open key data 2B. Issue device sign data 4C are deciphered with the issue device open key data 2B and collated with feature data 4D. The feature data 4D' and feature data 4D are collated with each other. When the respective collated results meet specific conditions, it is decided that the card 4 is a regular card.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security system for preventing forgery of an authentication target, such as a prepaid card, a credit card, and an ID card, which needs to be authenticated.

[0002]

2. Description of the Related Art As one method of a conventional security system, signature data is generated from original data by a certification device (institution) and an issuing device (institution) using a signature generation rule based on secret key data. This is magnetically recorded, for example, on an object to be authenticated such as a credit card, the object to be authenticated is issued, and the signature data is inspected from the public key data stored in the authentication device using a signature inspection rule. There is known an authentication system that verifies the authenticity of a user by authenticating the user.

According to this system, only a person who knows the signature generation rule can newly generate his / her own signature data,
Since the data can be modified, the effect of preventing forgery disguised as a new authentication target is high, but, for example, interception of communication between the authentication device and the authentication target or signature data from the authentication target can be obtained. Unauthorized reading and dead copy cannot be prevented.

On the other hand, as a means for preventing forgery or duplication of an authentication target, for example, physical characteristics unique to the authentication target are recorded as data, and this data is compared with actual physical characteristics. Methods for determining authenticity have also been proposed.

Accordingly, the applicant of the present application has disclosed, for example, Japanese Patent Application No. Hei 8-
As described in the specification of Japanese Patent No. 85946, physical characteristic data of each object to be authenticated is recorded as the signature data on the object to be authenticated. A method was proposed in which the data was converted back to feature data and the two were compared.

According to this method, forgery cannot be forged without knowing the physical characteristics of each authentication object even if the recorded contents of the authentication object are known, so that the forgery prevention effect is significantly increased.

[0007]

However, it is sufficient that the above-mentioned certifying device and the issuing device are the same, and that the certifying device and the certifying device correspond one-to-one. (Credit company)
Issuing devices (credit companies, banks, etc.) may be the same institution, but these are often separate from the authentication devices installed in stores that use credit cards, especially issuing devices The number of authentication devices is remarkably large as compared with. Therefore, when the secret key data or the public key data is changed, or when the number of issuing devices (institutions) increases or decreases, the public key data or the like stored in each authentication device must be changed each time. It was troublesome.

On the other hand, an operation processing unit using an IC is provided on the side of the object to be authenticated, and signature data in which confirmation data such as a random number is generated from the authenticator using secret key data is transmitted from the authentication device to the object to be authenticated every time authentication is performed. A dynamic authentication method has been proposed in which the data is returned to the original confirmation data and sent back, and the communication content between the authentication device and the object to be authenticated is changed at each authentication. Since complicated calculations have to be performed, there has been a problem that the size and cost of the IC for that purpose increase.

In view of the problems of the prior art, it is a main object of the present invention to effectively prevent forgery of an object to be authenticated and to facilitate maintenance, and in particular, the structure of the object to be authenticated is complicated. The purpose of the present invention is to provide a security system that does not need to be implemented.

[0010]

According to the present invention, the authenticity of an object to be authenticated by an issuing device and certified by an attesting device is determined by authenticating the object with an authenticating device. What is claimed is: 1. A security system for preventing forgery of an authentication target, wherein the authentication target is readable by a machine, but is artificially generated because it is randomly generated. A reference region having difficult physical characteristics, characteristic data read from the reference region at the time of issuance, issuing device signature data obtained by encrypting the characteristic data with issuing device private key data in the issuing device, and the issuing device A data storage area for storing and holding issuing device public key data for decrypting the issuing device signature data encrypted with the secret key data for authentication. The authentication device reads out the characteristic data, the issuing device signature data, and the issuing device public key data stored in the data storage area of the object to be authenticated, and reads the physical features from the reference area, and reads out the issuing device public key. Decrypting the issuing device signature data with the data, collating the characteristic data with the characteristic data, collating the characteristic data with the physical characteristic read at the time of authentication, and determining the authenticity of the authentication object based on the respective collation results. This is achieved by providing an authenticated security system characterized in that the authentication is performed. Further, the authentication target has a plurality of continuous or discontinuous reference areas, and the data storage area stores and holds the characteristic data corresponding to each of the reference areas and the issuing device signature data corresponding thereto. At the time of authentication, the authentication device reads the public key data for the issuing device stored in the data storage area of the object to be authenticated, and selectively issues one or a plurality of characteristic data and the corresponding issuance. Reading the device signature data, further reading its physical characteristics from the reference area corresponding to the read characteristic data, decrypting the issuing device signature data with the issuing device public key data and collating with the characteristic data, The feature data is compared with the physical feature read at the time of authentication, and the authenticity of the authentication target is determined based on each of the matching results. It is preferable that the authentication target further includes an arithmetic processing unit, and the data storage area is a secret key data for the authentication target set for each authentication target, and a public key for the authentication target. Key data and another object issuing device signature data obtained by encrypting the authentication object public key data with the issuing device private key data in the issuing device are further stored and held. The authentication object public key data and the another issuing device signature data are also read from the storage area, and the authentication object signature data is decrypted with the issuing device public key data, and collated with the authentication object public key data. The authentication device sends different authentication data to the object to be authenticated each time authentication is performed, and the arithmetic processing unit encrypts the authentication data with the secret key data for the object to be authenticated and sends the encrypted verification data to the authentication device. The authentication device decrypts the authentication object public key data with the authentication data and checks it against the confirmation data, checks the feature data and the physical feature read at the time of authentication, and based on the respective check results, It is preferable that the authenticity of the authentication target be determined.

[0011] In this case, it is extremely difficult to analyze the signature data without knowing the secret key data, and even if the data stored in the data storage area of the authentication target is simply dead-copied, the other data is not copied. Since the authenticity is denied because the characteristics of the reference area are different in the certified object, it is possible to effectively prevent unauthorized application to other objects to be authenticated, and all the data required for authentication is authenticated. Even if the private key data for the issuing device or the public key data for the issuing device is changed, or new private key data for the issuing device or new public key data for the issuing device is added, the update on the authentication device side is performed. do not need.

In particular, when the contents of communication between the object to be authenticated and the authentication device are changed each time authentication is performed, one or several of a plurality of data stored in the object to be authenticated are transmitted as in claim 2. By selecting and reading on the authentication device side, there is no need to provide an IC or the like for arithmetic processing on the object to be authenticated, and the processing is simplified.

As a reference area, it is difficult to duplicate magnetic fibers in paper or resin at random, or to make use of unevenness in paper, or to artificially duplicate the surface roughness of sheet material. In addition, any predetermined machine can be used as long as it can be detected with good reproducibility. Examples of such a device are disclosed in JP-A-6-168363,
There are those disclosed in JP-A-2-33444 and JP-A-57-500851.

[0014]

Preferred embodiments of the present invention will be described below in detail with reference to the accompanying drawings.

FIG. 1 is a block diagram showing a schematic configuration of an authentication security system according to a first embodiment to which the present invention is applied. This system is an authentication type security system for a credit card, in which a certification institution (card company) in which one or a plurality of certification devices 1 are installed, and one or a plurality of card reader / writers 2 as a card issuing device are installed. Issuer (banks, agencies, etc.) and certifiers with one or more card readers 3 as authentication devices (stores, facilities, etc. using cards)
And a credit card 4 as an object to be authenticated which is usually issued in large numbers.

FIG. 2 is a plan view showing the credit card 4. The credit card 4 is made up of a base sheet 41 made of polyester. This card includes an issuer, a ticket type and a purpose of use of the card. Apart from necessary management data, a magnetic stripe 42 including an identification data storage area for storing characteristic data, issuing device signature data, issuing device public key data, proving device signature data, and proving device public key data, which will be described later. And a reference region 43 in which magnetic fibers are randomly dispersed in the resin of the base sheet 41.

FIG. 3 shows a card reader / writer 2 as an issuing device to which the present invention is applied. The card reader / writer 2 incorporates a card transport unit 22 including a motor-driven roller for taking a card into a slot 21 and ejecting the card after writing data. Along the slot 21, a magnetic head 23 for reading / writing magnetic data from a magnetic stripe 42 and an inductive magnetic head 24 for reading a reference area 43 are provided. The magnetic heads 23 and 24 are controlled by a control unit 2 for controlling input / output and data processing
5 is connected. Note that a card reader 3 as an authentication device for authenticating an actually issued card is the same as the card reader / writer 2 except for a writing function, and a detailed description thereof will be omitted.

A procedure for issuing the card 4 and an authentication procedure will be described below with reference to FIGS. The proving device 1 uses the proving device private key data 1A to encrypt each issuing device public key data 2B according to a specific signature generation rule to generate the proving device signature data 2C. The certification device signature data 2C can be decrypted only by a specific signature check rule using the certification device public key data 1B.
Similarly, the control unit 25 of the card reader / writer 2
The signature data 4D to be described later of each card 4 is encrypted according to the same signature generation rule as described above using the issuing device private key data 2A to generate issuing device signature data 4C. The issuing device signature data 4C can be decrypted only by the same signature inspection rule using the issuing device public key data 2B.

First, as shown in FIG. 4, in a preparatory stage, a private key data 2A for the issuing device, a public key data 2B for the issuing device,
Certification device signature data 2C and certification device public key data 1
B is stored. Of these, the issuing device private key data 2A, the issuing device public key data 2B, and the certification device signature data 2C are unique to each issuing organization.

Next, as shown in FIG. 5, in the issuing stage,
First, when the card 4 to be issued is inserted into the card reader / writer 2, a physical feature is mechanically read as a signal from the reference area 43 along a reading locus set in the card reader / writer 2, and the feature data 4D and I do. This characteristic data 4D is encrypted according to a signature generation rule using the issuing device private key data 2A to generate issuing device signature data 4C. Then, the issuing device signature data 4C, characteristic data 4D, issuing device public key data 2B, certification device signature data 2C, and certification device public key data 1B are stored in the magnetic stripe 42 of the card 4.

Next, as shown in FIG. 6, in the authentication stage by the card reader 3 as an authentication device, first, when the card 4 to be authenticated is inserted into the card reader 3, the issuing device stored in the magnetic stripe 42 The signature data 4C, the characteristic data 4D, the issuing device public key data 2B, the certifying device signature data 2C, and the certifying device public key data 1B are read, and the physical data is read from the reference area 43 along the reading locus set in the card reader 4. The characteristic feature is mechanically read as a signal to obtain feature data 4D '.

Then, the certification device signature data 2C is decrypted by a signature check rule using the certification device public key data 1B, and the decrypted device signature data is compared with the issuing device public key data 2B.

Similarly, the issuing device signature data 4C is decrypted according to a signature inspection rule using the issuing device public key data 2B, and the decrypted data is compared with the characteristic data 4D.

The characteristic data 4D 'read as described above is compared with the characteristic data 4D.

If each of the comparison results matches a predetermined condition (eg, the degree of coincidence or non-coincidence of each data is within a predetermined range), it is determined that the card 4 is a legitimate card.

FIGS. 7 and 8 are diagrams for explaining a card issuing procedure and an authentication procedure in the authentication type security system according to the second embodiment to which the present invention is applied. 5 and 6 in FIG. This system is also an authentication type security system for a credit card, as described above, and its configuration is almost the same as that of the first embodiment.

First, in the preparation stage, the secret key data 2A for the issuing device, the public key data 2B for the issuing device, the signature data 2C for the certification device, and the public key data 1B for the certification device are stored in the card reader / writer 2 as described above. Keep it.

Next, as shown in FIG. 7, in the issuing stage,
First, when the card 4 to be issued is inserted into the card reader / writer 2, the physical feature is mechanically read from the reference area 43 as a signal along the reading locus set in the card reader / writer 2, and the data 4D is read. For example, the data is divided into 10 to obtain feature data 4D1 to 4D10. The characteristic data 4D1 to 4D10 are encrypted according to a signature generation rule using the issuing device private key data 2A to generate the corresponding issuing device signature data 4C1 to 4C10. And
The issuing device signature data 4C1 to 4C10, the corresponding feature data 4D1 to 4D10, the issuing device public key data 2B, the certification device signature data 2C, and the certification device public key data 1B are stored in the magnetic stripe 42 of the card 4. .

Next, as shown in FIG.
First, when the card 4 to be authenticated is inserted into the card reader 3, the issuing device public key data 2B, the certifying device signature data 2C, and the certifying device public key data 1B stored in the magnetic stripe 42 are transmitted. At the same time, one or a plurality of sets of issuing device signature data and feature data that are different for each authentication are read from the issuing device signature data 4C1 to 4C10 and the corresponding feature data 4D1 to 4D10. Further, a physical feature is mechanically read as a signal from the reference area 43 along a reading locus set in the card reader 4 to obtain feature data 4D '.

Then, the certification device signature data 2C is decrypted according to the signature check rule using the certification device public key data 1B, and the decrypted device signature data is compared with the issuing device public key data 2B.

Similarly, assuming that the issuing device signature data 4C5 and the corresponding feature data 4D5 have been read in the current authentication, the issuing device signature data 4C5 is decrypted by a signature inspection rule using the issuing device public key data 2B. Then, this is compared with the feature data 4D5.

The feature data 4D5 and the corresponding portion of the feature data 4D 'read as described above are collated.

When each of the comparison results matches a predetermined condition (the degree of coincidence or non-coincidence of respective data is within a predetermined range), it is determined that the card 4 is a legitimate card.

According to this configuration, since the contents read by the card reader 3 are different each time authentication is performed, even if data exchange between the two is intercepted, the data is analyzed or the data stored in the card is used for a forged card. It becomes difficult.
In addition, this process achieves the same level of security as the dynamic authentication method that conventionally performed complicated processes on the card (authentication target) side, while securing a data storage area on the card side. The structure is simplified and the cost is reduced.

In the above configuration, one feature data is divided into a plurality of feature data. However, a plurality of feature data may be read by shifting the reading position of the reference area 43.

FIGS. 9 and 10 show a third embodiment to which the present invention is applied.
It is a diagram for explaining a card issuing procedure and an authentication procedure in the authentication type security system in the embodiment of the present invention,
This corresponds to FIGS. 5 and 6 in the first embodiment. This system is also an authentication type security system for a credit card as described above, and its configuration is almost the same as that of the first embodiment. However, instead of the magnetic stripe, the card 4 has an IC 45 and a contact point capable of data storage and arithmetic processing. (Not shown), and the card reader / writer 2 and the card reader 3 are provided with corresponding contacts (not shown) for contacting the contacts of the IC 45 instead of the magnetic head. The card reader 3 generates confirmation data R composed of (pseudo) random numbers. In addition, the IC 45
By using the secret key data 4A for the authentication target and encrypting the confirmation data R consisting of a random number sent from the card reader 3 according to the same signature generation rule as in the above embodiments, the signature data 4C for the authentication target is generated. Has become.

First, in the preparation stage, the private key data 2A for the issuing device, the public key data 2B for the issuing device, the signature data 2C for the certification device, the public key data 1B for the certification device, The secret key data 4A for the subject and the public key data 4B for the subject are set in advance.

Next, as shown in FIG. 9, in the issuing stage,
First, when the card 4 to be issued is inserted into the card reader / writer 2, a physical feature is mechanically read as a signal from the reference area 43 along a reading locus set in the card reader / writer 2, and the feature data 4D and I do. This characteristic data 4D is encrypted according to a signature generation rule using the issuing device private key data 2A to generate issuing device signature data 4C. The issuing device signature data 4C, the characteristic data 4D, the issuing device public key data 2B, the certifying device signature data 2C, the certifying device public key data 1B, the certifier private key data 4A, and the authenticated person public key data 4B is stored in the storage area of the IC 45 of the card 4.

Next, as shown in FIG. 10, in the authentication stage by the card reader 3, first, when the card 4 to be authenticated is inserted into the card reader 3, the issuing device signature data 4C stored in the storage area of the IC 45 is read. , The characteristic data 4D, the issuing device public key data 2B, the certification device signature data 2C, the certification device public key data 1B, and the authenticated person public key data 4B, and along the reading trajectory set in the card reader 3. , A physical feature is mechanically read from the reference area 43 as a signal to obtain feature data 4D '. Further, the card reader 3 generates a random number and sends it to the IC 45 as confirmation data R.

At this time, since the feature data 4D 'is not a pseudo-random number but a natural random number, a part of the feature data 4D' is processed by an algorithm, or the feature data 4D 'is processed.
Data extracted from a part of the reference area or an area other than the reference area using the same method as that for extracting D ′ may be used as the confirmation data R. Thereby, it is possible to prevent the random number from being specified by the analysis of the pseudo random number, and the security is further improved. So-called Fault-based-at
An attack method that causes a malfunction by giving various stimuli to the CPU from the outside, such as a tack, etc., has a physical feature generated by a method with little room for artificial operation as a random number. It can be prevented by using.

Then, the certification device signature data 2C is decrypted according to a signature check rule using the certification device public key data 1B, and the decrypted device signature data is compared with the issuing device public key data 2B.

Similarly, the issuing device signature data 4C is decrypted according to the signature inspection rule using the issuing device public key data 2B, and the decrypted data is compared with the characteristic data 4D.

The IC 45 encrypts the confirmation data R in accordance with the signature generation rule using the secret key data 4A for the authentication target to generate the signature data 4E for the authentication target, and sends it back to the card reader 3 side. The card reader 3 decrypts the authentication target signature data 4E according to the signature inspection rule using the authentication target public key data 4B, and compares this with the confirmation data R.

Further, the characteristic data 4D is compared with the characteristic data 4D 'read as described above.

When each of the comparison results matches a predetermined condition (eg, the degree of coincidence or non-coincidence of each data is within a predetermined range), it is determined that the card 4 is a legitimate card.

According to this configuration, as described above, the contents read by the card reader 3 are different each time authentication is performed. Therefore, even if data exchange between both parties is intercepted, the data is analyzed or the data stored in the card is transferred to the forged card. It becomes difficult to use.

In each of the above embodiments, the certification apparatus public key data 1B is stored in the object to be authenticated, the certification apparatus signature data 2C is decrypted by the signature inspection rule, and this is compared with the issuing apparatus public key data 2B. However, this processing is optional, and can be omitted if, for example, the certification authority and the issuing authority are the same. Also, there is one certification authority, and the certification authority private key data 1A and the certification authority public key data 1A
If B does not change, the certification authority public key data 1B does not necessarily need to be stored in the authenticated object, but may be stored in the authentication device when the authentication device is manufactured. In this way, even if each private key data and public key data are forged independently, only the certification authority public key data 1B must be used, so that the certification authority private key data is known. Unless the verification is performed, the collation does not match and can be checked. Therefore, in the case of a system in which the private key data for the certification authority and the public key data are not changed, the security is improved without lowering the maintainability.

Also, the authentication device can be connected to the authentication device when necessary, and one or more public key data for the authentication device read from the authentication target at the time of past authentication can be stored. The authentication device public key data read from the authentication target at the time of authentication is compared with the stored authentication device public key data, and if they match, the above verification is performed using the authentication device public key data. If not, the certification device is inquired by communication or the like, and if it is confirmed that the data is legitimate certification device public key data, verification is performed using the certification device public key data, and the confirmed certification device public key is confirmed. Data may be added and stored, or may be changed depending on the result of the inquiry. Even in this case, even if each private key data and public key data are forged independently, only the certification authority public key data 1B must be used, so unless the certification authority private key data is known. The above collation does not match and can be checked. Therefore, security is improved without lowering the maintainability. Furthermore, in this structure, even if the private key data for the certification authority and the public key data are changed, it is not necessary to update all of the authentication devices at the same time, and when the new public key data for the certification authority is read from the subject at the time of authentication. Only the additional data may be stored or replaced with new data. Therefore, the maintainability of the public key data for the certification device is higher than that of a system in which the certification device public key data is stored only in the authentication device. The maintenance structure of this authentication device is always connected to the server,
Generally, the present invention can be applied to a system having a terminal for confirming a password, an authentication code, an authentication code, and the like, and can reduce a load on a server and a connection line.

In each of the above embodiments, the object to be authenticated is a credit card.
Cards, precious metals, securities of proven value, securities,
It goes without saying that the present invention can be arbitrarily applied to anything that needs to be proved to be authentic, such as a room or car key. In the first and second embodiments, the data storage area of the object to be authenticated is a magnetic stripe. However, as in the third embodiment, an IC chip may be embedded in a card to form an IC card.

[0050]

As described above, according to the present invention, the characteristic data of the reference area where it is difficult to artificially produce the same one, and the characteristic data is generated by encrypting the characteristic data with the secret key data for the issuing device. The signature data and the issuance device public key data are stored in the data storage area of the object to be authenticated, and are read out at the time of authentication, and the features of the reference area are read. Because it is possible to confirm, it is extremely difficult to analyze the signature data without knowing the secret key data, and even if the data stored in the data storage area of the Since the authenticity is denied because the characteristics of the reference area are different, it is possible to effectively prevent unauthorized application to other objects to be authenticated. Because it is on the authenticated product side, the storage capacity of the authentication device side can be significantly reduced, and the secret key data for the issuing device and the public key data for the issuing device can be changed, and the secret key data for the issuing device and the new public key for the issuing device can be changed. Even if the key data is added, it is not necessary to update the authentication device side, so that the maintenance becomes extremely simple.

In particular, when the contents of communication between the authentication target and the authentication device are changed each time authentication is performed, one or several of the plurality of data stored on the authentication target side as described in claim 2 are used. By selecting and reading on the authentication device side, there is no need to provide an IC or the like for arithmetic processing on the object to be authenticated, and the processing is simplified.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a schematic configuration of a system according to the present invention.

FIG. 2 is a front view showing a prepaid card as an example of a recording medium to which the system according to the present invention is applied.

FIG. 3 is a diagram showing an example of a card reader / writer for a prepaid card.

FIG. 4 is a block diagram showing a procedure for creating a card according to the first embodiment of the present invention.

FIG. 5 is a block diagram showing a procedure for creating a card according to the first embodiment of the present invention.

FIG. 6 is a block diagram showing a card authentication procedure according to the first embodiment of the present invention.

FIG. 7 is a block diagram showing a procedure for creating a card according to the first embodiment of the present invention.

FIG. 8 is a block diagram showing a card authentication procedure according to the first embodiment of the present invention.

FIG. 9 is a block diagram showing a procedure for creating a card according to the first embodiment of the present invention.

FIG. 10 is a block diagram showing a card authentication procedure according to the first embodiment of the present invention.

[Description of Signs] 1 Proof Device 2 Card Reader / Writer (Issuing Device) 21 Slot 22 Card Transport Unit 23 Magnetic Head 24 Inductive Magnetic Head 25 Control Unit 3 Card Reader (Authentication Device) 4 Credit Card (Authentication Object) 41 Base Sheet 42 Magnetic stripe 43 Reference area 45 IC 1A Proving device private key data 1B Proving device public key data 2A Issuing device private key data 2B Issuing device public key data 2C Proving device signature data 4A 4B Public key data for authenticated object 4C Issuing device signature data 4C1 to 4C10 Issuing device signature data 4D1 to 4D10 corresponding to feature data 4D1 to 4D10 Feature data read at the time of authentication 4D1 to 4D10 Divided data of feature data 4D 4E Certified object signature data R Confirmation data (random number)

Continuation of the front page (72) Inventor Kenji Yamamotoya 3-10-10 Fukuura, Kanazawa-ku, Yokohama-shi, Kanagawa Japan Nippon Hojo Co., Ltd.

Claims (8)

[Claims] 1. A security system for authenticating an object to be authenticated issued by an issuing device certified by a certification device by an authentication device to determine authenticity thereof and preventing forgery of the object to be authenticated, A reference area having physical characteristics that the object to be authenticated is readable by a machine but is difficult to artificially produce the same because it is randomly generated; and The issuing device stores the characteristic data read from the issuing device, the issuing device signature data obtained by encrypting the characteristic data with the issuing device private key data, and the issuing device public key data for decrypting the issuing device signature data. A data storage area for performing the authentication, the authentication device stores the characteristic data, the issuer signature data, and the signature stored in the data storage area of the object to be authenticated at the time of authentication. At the same time as reading the device public key data and reading its physical characteristics from the reference area, decrypting the issuing device signature data with the issuing device public key data and collating it with the characteristic data, An authentication-type security system, wherein the authentication-based security system is configured to compare the read physical characteristics with each other, and determine the authenticity of the authentication target based on each of the comparison results. 2. The authentication object has a plurality of continuous or discontinuous reference areas, and the data storage area stores feature data corresponding to each of the reference areas and issuing device signature data corresponding thereto. At the time of authentication, the authentication device reads out the public key data for the issuing device stored in the data storage area of the object to be authenticated, and selectively stores one or more feature data and The corresponding issuing device signature data is read, and further, its physical characteristics are read from a reference area corresponding to the read characteristic data, and the issuing device signature data is decrypted with the issuing device public key data and collated with the characteristic data. The feature data is compared with the physical feature read at the time of authentication, and the authenticity of the authentication target is determined based on each of the matching results. Authentication type security system according to claim 1, characterized in that has manner is. 3. The authentication object further includes an arithmetic processing unit, and the data storage area includes secret key data for the authentication object, public key data for the authentication object set for each authentication object, and Another issuing device signature data obtained by encrypting the authentication object public key data with the issuing device private key data in the issuing device is further stored and held. The authentication object public key data and the another issuing device signature data are further read out, and the authentication object signature data is decrypted with the issuing device public key data and collated with the authentication object public key data, Sending different confirmation data to the object to be authenticated for each authentication from the authentication device, encrypting the confirmation data with the secret key data for the object to be authenticated in the arithmetic processing unit and sending it back to the authentication device, The authentication device decrypts the public key data for the object to be authenticated and collates it with the confirmation data, collates the feature data with the physical feature read at the time of authentication, and authenticates the object based on the collation results. 3. The authentication type security system according to claim 1, wherein the authenticity of the object is determined. 4. The authentication type security system according to claim 3, wherein said confirmation data is generated based on physical characteristics read at the time of authentication. 5. The proving device signature data and the proving device secret data obtained by encrypting the issuing device public key data with the proving device private key data in the proving device. It further stores proving device public key data for decrypting the proving device signature data encrypted by the key data, and also stores the proving device signature data and the proving device public key data at the time of authentication. Reading, further decrypting the certification device signature data with the certification device public key data and the issuing device public key data, and determining the authenticity of the authenticated object based on the comparison results. The authentication type security system according to any one of claims 1 to 4, wherein the authentication type security system is adapted to be used. 6. The authentication device can be connected to the certification device, and can store one or two or more certification device public key data read from a subject at the time of past certification. Comparing the public key data for the certification device read from the object to be authenticated with the stored public key data for the certification device at the time of authentication, and if they match, the collation is performed using the public key data for the certification device. If they do not match, it is inquired to the certification device that if it is confirmed that the data is legitimate certification device public key data, the verification is performed using the certification device public key data and this is stored. The authentication type security system according to claim 5, wherein: 7. The data storage area of the subject further stores certification device signature data obtained by encrypting the issuing device public key data with the certification device private key data in the certification device. The authentication device stores certification device public key data for decrypting certification device signature data encrypted with the certification device private key data, and the certification device signature data at the time of authentication. And further verifies the decryption of the certifying device signature data with the certifying device public key data and the issuing device public key data, and determines the authenticity of the authenticated object based on each verification result. The authentication type security system according to any one of claims 1 to 4, wherein the authentication is performed. 8. The authentication type security system according to claim 1, wherein said reference area is made of paper or resin in which magnetic fibers are randomly arranged.