WO2017073448A1

WO2017073448A1 - Mutual authentication device and mutual authentication method

Info

Publication number: WO2017073448A1
Application number: PCT/JP2016/081085
Authority: WO
Inventors: 史彦赤羽
Original assignee: 日本電産サンキョー株式会社
Priority date: 2015-10-30
Filing date: 2016-10-20
Publication date: 2017-05-04
Also published as: CN108351934A; JP2017084281A; JP6453202B2

Abstract

The present patent application provides a mutual authentication device capable of easily detecting a replacement with an unauthorized device even when the configuration of the mutual authentication device is simplified. For example, an A/D conversion part 20 of a card reader 1 receives an analog signal, that is, a time-series continuous waveform, from a host device 2 and converts the analog signal into a digital signal. A storage unit 30 stores authentication information 300 to be used for mutual authentication with the host device 2. An authentication processing part 100 authenticates a displacement pattern of the received digital signal, which has been converted by the A/D conversion part 20, against the authentication information 300 stored in the storage unit 30. When the authentication by the authentication processing part 100 is successful, a transmission digital signal generation part 110 generates a transmission digital signal having a displacement pattern corresponding to the authentication information 300 stored in the storage unit 30. A D/A conversion part 40 converts the transmission digital signal generated by the transmission digital signal generation part 110 into an analog signal and transmits the analog signal to the host device 2.

Description

Mutual authentication device and mutual authentication method

The present invention relates to a mutual authentication device and a mutual authentication method, and more particularly to a mutual authentication device and a mutual authentication method for performing mutual authentication between a higher-level device and a lower-level device.

2. Description of the Related Art Conventionally, there are card readers (mutual authentication devices) that read or write information on a card-like medium (information medium) on which information is recorded.

Such a card reader is configured to perform mutual authentication with a computer such as an ATM (Automated Teller Machine), which is a host device, in order to improve security. For example, in Patent Document 1, as an example of such a card reader, in a mutual authentication system in which a higher-level device and a lower-level device mutually authenticate, even when the lower-level device has a plurality of subordinate devices, it is easy to construct a mutual authentication system A mutual authentication system and a mutual authentication method are described. In the technique of Patent Document 1, a control unit that controls the entire card reader, an encryption magnetic head that is a subordinate device arranged in the card reader, and a host device perform mutual authentication.

JP 2013-109554 A

However, the card reader described in Patent Document 1 has a complicated configuration related to encryption / decryption. That is, unless a circuit having a complicated configuration is mounted, it is not possible to detect replacement with an unauthorized device.

An object of the present invention has been made in view of such a situation, and is to provide a mutual authentication device that can easily detect replacement with an unauthorized device even if the configuration is simplified. In addition, the problem of the present invention has been made in view of such a situation, and by providing a mutual authentication method capable of easily detecting replacement with an unauthorized device even if the configuration is simplified. is there.

The mutual authentication apparatus according to the present invention performs mutual authentication between an A / D conversion unit that receives an analog signal having a continuous waveform in time series from another apparatus and converts it into a received digital signal, and the other apparatus. Authentication information storage means for storing authentication information for authentication, and authentication for verifying the displacement pattern of the received digital signal converted by the A / D converter with the authentication information stored in the authentication information storage means A processor, a transmission digital signal generator for generating a transmission digital signal of a displacement pattern corresponding to the authentication information stored in the authentication information storage means when authentication is successful in the authentication processor, and the transmission digital signal A D / A converter that converts the transmission digital signal created by the creation unit into an analog signal and transmits the analog signal to the other device. With this configuration, even if the configuration is simplified, it is possible to easily detect replacement with an unauthorized device.

In the mutual authentication device of the present invention, the authentication information includes a period for verifying the analog signal, a sampling period, and verification data for verifying the displacement pattern. By comprising in this way, an analog signal can be received and the displacement pattern of authentication information can be collated reliably.

The mutual authentication apparatus of the present invention further includes an authentication information resetting unit that resets the authentication information at a specific timing, and the transmission digital signal creation unit is configured to reset the authentication information reset by the authentication information resetting unit. The transmission digital signal is generated based on information, and the D / A converter converts the transmission digital signal corresponding to the reset authentication information generated by the transmission digital signal generation unit into an analog signal. And transmitting to the other apparatus. With this configuration, authentication information can be reset according to an accident, failure, user instruction, or the like.

In addition, the mutual authentication method of the present invention receives an analog signal that is a time-series continuous waveform from another device, converts it into a received digital signal, and performs authentication for mutual authentication with the other device. And the converted displacement pattern of the received digital signal is authenticated by comparing the stored authentication information, and if the authentication is successful, the transmission digital of the displacement pattern corresponding to the stored authentication information A signal is generated, the generated transmission digital signal is converted into an analog signal, and transmitted to the other device. With this configuration, even if the configuration is simplified, it is possible to easily detect replacement with an unauthorized device.

According to the present invention, there is provided a mutual authentication device that easily converts an unauthorized device even if simplified by digitally converting an analog signal transmitted from another device and verifying the displacement pattern by collating them. Can be provided. In addition, according to the present invention, the analog signal transmitted from another device is digitally converted, and this displacement pattern is collated and authenticated, so that it is possible to easily detect a change to an unauthorized device even if simplified. A method can be provided.

It is a block diagram which shows the system configuration | structure of the mutual authentication system which concerns on embodiment of this invention. It is a flowchart of the mutual authentication process which concerns on embodiment of this invention. It is a conceptual diagram which shows the specific example of the mutual authentication process shown in FIG. It is a flowchart of the authentication information reset process which concerns on embodiment of this invention.

<Embodiment>
[Configuration of mutual authentication system X]
FIG. 1 is a block diagram showing a system configuration of a mutual authentication system X according to an embodiment of the present invention.
In the present embodiment, the mutual authentication system X is an ATM having a card issuing function. In addition to this ATM, Kiosk terminals, transportation ticket issuing systems, point card issuing systems such as convenience stores, member card issuing systems for retail stores, card issuing / payment systems for gaming machines, entrance / exit management It may be a system or the like.

The mutual authentication system X includes a card 3 for reading and writing, a writing card reader 1 (mutual authentication device), and a host device 2.

The card reader 1 is a motor reader type card reader / writer device. The card reader 1 is connected to the host device 2 and executes various processes according to commands from the host device 2. Examples of the card reader include a magnetic card reader, a contact type IC card reader, and a non-contact type IC card reader. The detailed configuration of the card reader 1 will be described later.

The host device 2 is an embedded PC for ATM or the like. The host device 2 includes a control unit, a storage unit, various interfaces, and the like, and controls the card reader 1.

The card 3 is a contact type or non-contact type IC card and / or a magnetic card. The card 3 is a plastic card such as rectangular vinyl chloride having a thickness of about 0.7 to 0.8 mm. When the card 3 is a contact type IC card, an integrated circuit chip (IC chip) is embedded in the plastic substrate of the card 3 and an IC terminal is disposed on the surface. When the card 3 is a non-contact type IC card, an IC chip and an antenna coil are embedded in the plastic substrate. When the card 3 is a magnetic card, a magnetic stripe for recording magnetic data is formed on the surface. The card may be a PET (polyethylene terephthalate) card having a thickness of about 0.18 to 0.36 mm, a paper card having a predetermined thickness, or the like. The card stores information such as user information and money value information.

In addition, the mutual authentication system X is a scanner that reads photos and characters on the card surface, a crusher that crushes the collected card, a card collection and return module that collects the card, and prints on the card surface. A card printer or the like may be provided.

In FIG. 1, the system configuration related to mutual authentication of the card reader 1 and the host device 2 is described with particular attention. Here, in the present embodiment, the card reader 1 and the host device 2 can execute the same mutual authentication process. Therefore, in the following, the configuration related to mutual authentication of the card reader 1 will be described with particular attention.

The card reader 1 includes a control unit 10, an A / D conversion unit 20, a storage unit 30 (authentication information storage unit), a D / A conversion unit 40, and an interface unit 50.

The control unit 10 is a control calculation means such as a CPU (Central Processing Unit). The control unit 10 controls reading and writing of information on the card 3. The card reader 1 can also encrypt and decrypt information read or written by the card 3.

The A / D converter 20 receives an analog signal that is a time-series continuous waveform from the host device 2 and converts it into a received digital signal that is a digital signal that can be handled by the controller 10 or the like. For this reason, the A / D conversion unit 20 is connected to the D / A conversion unit 41 of the host device 2 by a dedicated wiring or the like. The analog signal input by the A / D conversion unit 20 is expressed by, for example, a continuous and temporal voltage change. In addition, a specific bias or the like is applied to this voltage. For example, if the number of quantization bits is 8 bits, the minimum value is 0 to the maximum value 255, and if it is 16 bits, the minimum value is 0 to the maximum value 65535. It is converted into a digital signal with such a value. In addition, the A / D conversion unit 20 acquires the received digital signal at a sampling frequency of 11 kHz to 48 kHz, for example. The A / D converter 20 may store the received digital signal in a buffer or the like of the storage unit 30 using DMA (Direct Memory Access) or the like.

The storage unit 30 is a non-temporary recording medium such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a flash memory. The storage unit 30 controls the entire card reader 1, communicates with the host device 2, and displays a control program for executing various processes, an OS (Operating System), temporary data of each process, and various states. Stores status information, setting information indicating various settings, and the like.

The D / A converter 40 converts a digital signal into an analog signal according to an instruction from the controller. The D / A conversion unit 40 is connected to the A / D conversion unit 21 of the host device 2 by a dedicated wiring or the like.

The interface unit 50 includes various interface circuits and physical layers for connecting to communication lines such as USB (Universal Serial Bus), RS-232C, and LAN (Local Area Network). The interface unit 50 transmits and receives various kinds of information to and from the host device 2 via a communication line. The various information includes various commands including an authentication start trigger and an authentication information reset trigger described later.

Each unit including the A / D conversion unit 20 and the D / A conversion unit 41 may be configured as a System On Chip or the like built in the control unit 10. In addition to this, the card reader 1 conveys the card 3, a sensor of a mechanical type, an optical type, a magnetic type or the like that detects insertion of the card 3 or a position in the conveyance path, a sensor circuit that acquires this state, and the like. A transport mechanism including a motor, a roller and the like, a motor circuit for driving the transport mechanism, a magnetic head for reading information on the card 3 inserted in the transport path, and writing information on the card, A Read / Write circuit and a demodulation circuit for controlling the magnetic head are included.

The control unit 10 includes an authentication processing unit 100, a transmission digital signal creation unit 110, and an authentication information resetting unit 120 as functional configurations. These functional units can be realized by the control unit 10 expanding and executing the OS and the control program stored in the storage unit 30. Moreover, the control part 10 becomes a hardware resource for implement | achieving the mutual authentication method which concerns on embodiment of this invention.

The authentication processing unit 100 stores in the storage unit 30 a displacement pattern of a digital signal (hereinafter referred to as “received digital signal”) obtained by converting the analog signal received from the host device 2 or the like by the A / D conversion unit 20. The authentication information 300 thus verified is verified. Specifically, the authentication processing unit 100 collates the displacement pattern of the received digital signal with the displacement pattern corresponding to the authentication information 300, and determines that the authentication is successful if the displacement pattern matches. Judge as failure.

The transmission digital signal creation unit 110 creates a digital signal (hereinafter referred to as “transmission digital signal”) to be transmitted to the higher-level device 2 and the like based on the displacement pattern corresponding to the authentication information 300 stored in the storage unit 30. . The transmission digital signal creation unit 110 may process the transmission digital signal by specific conversion including inversion of the signal when creating the transmission digital signal. The transmission digital signal creation unit 110 starts authentication in response to the authentication start trigger from the higher-level device 2. This authentication start trigger is a command indicating the start of authentication. When the authentication processing unit 100 succeeds in authentication, for example, a signal obtained by inverting the received digital signal is created as a transmission digital signal. Conversely, the transmission digital signal creation unit 110 creates a transmission digital signal corresponding to the displacement pattern corresponding to the authentication information 300 when the host device 2 is requested to authenticate.

The authentication information resetting unit 120 resets the authentication information 300 in the storage unit 30 at a specific timing. This specific timing is when the time specified by the standard has elapsed for the card reader 1, when a situation such as repair or replacement occurs due to damage or failure, or when a specific instruction from the user is received. . The authentication information resetting unit 120 resets the period, the sampling period, and the verification data for verifying the analog signal of the authentication information resetting unit 120 using a random number generator or the like.

At the time of this resetting, the authentication information resetting unit 120 transmits an authentication information resetting trigger to the higher-level device 2. The authentication information reset trigger is a command indicating resetting of the authentication information 300 and / or the authentication information 301. Thereafter, the authentication information resetting unit 120 causes the transmission digital signal creation unit 110 to create a transmission digital signal based on the reset authentication information 300. Then, the authentication information resetting unit 120 converts the transmission digital signal corresponding to the reset authentication information 300 into an analog signal by the D / A conversion unit 40 and transmits the analog signal to the host device 2. As a result, as will be described later, the host device 2 can also create authentication information 301 corresponding to the reset authentication information 300 and store it in the storage unit 31.

In the storage unit 30, authentication information 300 is stored. The authentication information 300 includes, for example, a period during which an analog signal transmitted from the host device 2 is collated, a sampling cycle, and collation data.

Among these, the period for verifying the analog signal (hereinafter referred to as “verification period”) is information indicating how long the analog signal is received from the time of transmission of the host device 2 of the authentication start trigger. . This time can be set in units of several microseconds to several seconds. This verification time includes “delay” which is the time from the authentication start trigger until the analog signal is actually started to be transmitted. In addition, the verification time may include a time during which an analog signal is actually output. When the time when the analog signal is actually output and the verification time are different, the analog signal is output for a time longer or shorter than the verification period.

The sampling period is a value indicating a period for acquiring time series data from the received digital signal. That is, the value corresponds to the period of acquisition (monitoring) for comparison of analog signals. For example, a period longer than the actual sampling frequency when the analog signal is converted into a received digital signal by the A / D converter 20 can be designated as the sampling period. This sampling cycle can be changed by designation from the host device 2. In addition, about this sampling period, the structure which uses an irregular period according to a specific numerical sequence etc. may be sufficient instead of a fixed space | interval.

The collation data is data such as an array (matrix, array) for collating the time-division displacement pattern of the analog signal received from the host device 2. The verification data is configured, for example, as displacement pattern data of time-series data acquired at the above-described sampling period within the verification period from the received digital signal. It is also possible to retain the received digital signal acquired from the previous host device 2 as the verification data as it is. In this case, the transmission digital signal creation unit 111 of the host device 2 is configured to create transmission digital data in which time series data is embedded in random digital waveform data, for example, every time authentication is started. With this configuration, it is possible to compare whether or not the received digital signal of the card reader 1 is the same as the previously received digital signal, and to detect the presence or absence of hacking.

Note that the authentication information 300 may include information on the number of quantization bits of the A / D conversion unit 20, information on an allowable range of quantization errors, and the like.

The host device 2 includes a control unit 11 similar to the control unit 10 of the card reader 1, an A / D conversion unit 21 similar to the A / D conversion unit 20, and a storage unit 30 in the mutual authentication process and configuration of the present embodiment. A similar storage unit 31, a D / A conversion unit 41 similar to the D / A conversion unit 40, and an interface unit 51 similar to the interface unit 50 are included. The control unit 11 of the host device 2 includes an authentication processing unit 101 similar to the authentication processing unit 100 related to the functional configuration of the control unit 10 of the card reader 1, a transmission digital signal generation unit 111 similar to the transmission digital signal generation unit 110, and An authentication information resetting unit 121 similar to the authentication information resetting unit 120 is included. The storage unit 31 of the host device 2 includes authentication information 301 corresponding to the authentication information stored in the storage unit 30 of the card reader 1.

In the following embodiments, an example is described in which the host device 2 is another device and the card reader 1 is its own device, but conversely even if the host device 2 is its own device and the card reader 1 is another device. Good.

[Mutual authentication processing]
Next, the mutual authentication processing according to the embodiment of the present invention will be described with reference to FIGS.
FIG. 2 is a flowchart of the mutual authentication process according to the embodiment of the present invention. FIG. 3 is a conceptual diagram showing a specific example of the mutual authentication process shown in FIG.
As described above, the mutual authentication system X according to the mutual authentication process of the present embodiment includes the host device 2 and the card reader 1 as the lower device, and outputs analog signals from the card reader 1 and analogs of the card reader 1. A signal input or an analog signal output from the host device 2 and an analog signal input of the card reader 1 are connected. For this reason, the card reader 1 which is the lower device accepts the authentication by the authentication start trigger from the higher device 2. At this time, the output side converts the transmission digital signal into an analog signal via the D /

A converters

40 and 41 and outputs the analog signal, and the input side converts the analog amount into the reception digital via the A /

D converters

20 and 21. replace. As described above, in the mutual authentication processing according to the present embodiment, the output side and the input side mutually input and output analog signals that are displaced with time. That is, the output side and the input side authenticate each other using an analog signal as a medium. Therefore, the

authentication information

300 and 301 are stored in common, the analog signal is converted into a digital signal, the mutual displacement patterns are collated (compared), and the authenticity between the host device 2 and the card reader 1 is confirmed. meet. The time (period) for outputting the analog signal is a specific time.
Hereinafter, the details of the mutual authentication processing of this embodiment will be described step by step with reference to the flowchart of FIG.

In the following steps, the control unit 10 of the card reader 1 executes the control program stored in the storage unit 30 using hardware resources, and the control unit 11 of the host device 2 is stored in the storage unit 31. This can be realized by executing the control program using hardware resources.

The processing of the host device 2 will be described.
(Step S201)
The authentication information resetting unit 121 of the higher-level device 2 performs an authentication start trigger process. The authentication information resetting unit 121 transmits an authentication start trigger to the card reader 1 via the interface unit 51 (timing T201).

(Step S202)
The transmission digital signal creation unit 111 and the D / A conversion unit 41 of the host device 2 perform an analog signal transmission process. The transmission digital signal creation unit 111 creates a transmission digital signal having a displacement pattern based on the authentication information 301 and transmits it from the D / A conversion unit 41 to the card reader 1 (timing T202).

As a specific example with reference to FIG. 3A, the transmission digital signal creation unit 111 creates random but continuous digital waveform data as an example of the transmission digital signal, and then refers to the authentication information 301. Thus, the time-series data of the sampling period s of the verification period L is embedded in this digital waveform data. In other words, the data at the sampling period s is data used for verification by the card reader 1. The transmission digital signal creation unit 111 creates a transmission digital signal having a length corresponding to the output time of the analog signal. That is, the transmission digital signal creation unit 111 may create a transmission digital signal that is output longer than the verification period L, as shown in FIG. Further, the transmission digital signal creation unit 111 may not create all the transmission digital signals at once, but may sequentially create them and perform D / A conversion for transmission.

Next, processing of the card reader 1 will be described.
(Step S101)
The A / D converter 20 of the card reader 1 performs an analog signal reception process. The A / D converter 20 receives an analog signal from the host device 2 and performs A / D conversion into a received digital signal.

(Step S102)
The authentication processing unit 100 of the card reader 1 performs an authentication process. The authentication processing unit 100 performs authentication by collating the displacement pattern of the received digital signal converted by the A / D conversion unit 20 with the authentication information 300 stored in the storage unit 30.

3A, the authentication processing unit 100 acquires and collates data with a sampling period s after the delay d during the collation period L in the received digital signal. In the case of the example in FIG. 3B, the authentication processing unit 100 determines that the displacement angle or the like (displacement pattern) of the data acquired at the sampling period s is within a specific error range from the verification data in the authentication information 300. Collation is performed based on whether or not they are the same. By collating with the data displacement pattern in this way, errors due to level fluctuations, noise, and the like can be suppressed. Further, the authentication processing unit 100 can compare whether the received digital signal is exactly the same as the previously received digital signal with reference to the buffer of the storage unit 30.

(Step S103)
The authentication processing unit 100 of the card reader 1 determines whether the authentication is successful. If the displacement pattern is the same within a specific error range, the authentication processing unit 100 determines that the authentication is successful and determines Yes. In Yes, the authentication process part 100 advances a process to step S104.
On the other hand, when the displacement pattern does not match within a specific error range, the authentication processing unit 100 determines No as an unauthorized device. In No, the authentication process part 100 advances a process to step S107.
As a result, authentication is not performed by a method in which an analog signal is recorded and reproduced by a digital recorder or the like, and security can be improved.
If the received digital signal is the same as the previously received digital signal, the authentication processing unit 100 may determine No as abnormal data because it is an abnormal data.

(Step S104)
When authentication is successful (in the case of Yes), the transmission digital signal creation unit 110 of the card reader 1 performs transmission digital signal creation processing. The transmission digital signal creation unit 110 creates, for example, a signal obtained by inverting the reception digital signal as a transmission digital signal as a displacement pattern corresponding to the authentication information 300. In this case, the transmission digital signal creation unit 110 can generate a signal obtained by inverting the reception digital signal as it is. The transmission digital signal generation unit 110 may generate random but continuous digital waveform data and embed data obtained by inverting the time-series data of the sampling period s of the verification period L of the authentication information 301. .

(Step S105)
The D / A converter 40 of the card reader 1 performs an analog signal return process. The D / A conversion unit 40 converts the transmission digital signal created by the transmission digital signal creation unit 110 into an analog signal and transmits it to the host device 2 (timing T101).

(Step S106)
The authentication processing unit 100 of the card reader 1 performs normal operation start processing. Since the authentication is successful, the authentication processing unit 100 starts normal operation of the card reader 1. Thereby, reading / writing of the card | curd 3 etc. are attained corresponding to the other command etc. of the high-order apparatus 2. FIG. Thereby, the process for the card reader 1 of the mutual authentication process is completed.

(Step S107)
If the authentication fails (No), the authentication processing unit 100 of the card reader 1 performs an operation stop process. The authentication processing unit 100 puts the card reader 1 in a stopped state or the like, assuming that it is an abnormal signal. Thereby, the process for the card reader 1 of the mutual authentication process is completed. At this time, the card 3 may be stored in the card reader 1. Further, the authentication processing unit 100 may store information indicating that it has been stopped in the storage unit 30 as a log (not shown).

Again, the process of the high-order apparatus 2 is demonstrated. As shown in FIG. 2, the host device 2 receives the transmitted return analog signal in step S105 of the card reader 1 (timing T101).
(Step S203)
The A / D converter 21 performs a return analog signal reception process. The A / D converter 21 receives an analog signal output from the D / A converter 40 of the card reader 1 for a specific time, regardless of whether the authentication is successful or unsuccessful, and converts it into a received digital signal.

(Step S204)
The authentication processing unit 101 of the higher-level device 2 performs an authentication result verification process. The authentication processing unit 101 converts the amplitude of the received digital signal converted by the A / D conversion unit 21 by inverting it. Then, the authentication processing unit 101 performs authentication by comparing with the authentication information 301 in the storage unit 31 in the same manner as the authentication processing in step S102 of the card reader 1 described above.

(Step S205)
The authentication processing unit 101 of the host device 2 determines whether the authentication result is normal. If the displacement patterns collated using the authentication information 301 are the same within a specific error range, the authentication processing unit 101 determines that the authentication is successful and determines Yes. In Yes, the authentication process part 101 complete | finishes the process of the high-order apparatus 2 of a mutual authentication process. At this time, the fact that the authentication result is normal may be recorded in a log (not shown) of the storage unit 31.
On the other hand, if the displacement patterns do not match, the authentication processing unit 101 determines that the authentication has failed and determines No. In No, the authentication process part 101 advances a process to step S206. Note that the authentication processing unit 101 may determine No even when an analog signal cannot be acquired in the first place.

(Step S206)
If the authentication fails (No), the authentication processing unit 101 performs an operation stop process. The authentication processing unit 101 notifies an error with a display unit, an LED, or the like (not shown) of the host device 2 and stops the operation. Thereby, the process of the upper level apparatus 2 of the mutual authentication process is completed. At this time, the fact that the authentication result is abnormal may be recorded in a log (not shown) of the storage unit 31.
Thus, the mutual authentication process according to the embodiment of the present invention is completed.

In the above-described mutual authentication process, an example in which the card reader 1 which is a lower-level device accepts authentication by an authentication start trigger from the higher-level device 2 has been described. However, conversely, it is also possible for the host device 2 to accept authentication by an authentication start trigger from the card reader 1 which is a lower device, and to execute processing similar to the above-described mutual authentication processing.

[Authentication information reset process]
Next, the authentication information resetting process according to the embodiment of the present invention will be described with reference to FIG. FIG. 4 is a flowchart of authentication information resetting processing according to the embodiment of the present invention. Here, the authentication information 300 of the card reader 1 and / or the authentication information 301 of the host device 2 according to the embodiment of the present invention is set at the time of factory shipment or the like. For this reason, normally, the

initial verification information

300 and 301 verification period, sampling cycle, and verification data displacement pattern are adjusted to match at the time of shipment. However, it may be necessary to update these at a specific timing.

For this reason, in the authentication information resetting process of the present embodiment,

such authentication information

300 and 301 are updated. In the present embodiment, the authentication information resetting unit 121 of the host device 2 resets the authentication information 301, and at that time, the authentication information reset trigger and a part of the reset authentication information 301 are transferred to the card reader 1. The transmission digital signal of the authentication information 301 that has been transmitted and reset is D / A converted by the creation D / A conversion unit 41 and transmitted to the card reader 1. This is received by the card reader 1, the time and analog amount displacement are recorded, and the authentication information 300 is updated.
Hereinafter, details of the authentication information resetting process according to the present embodiment will be described step by step with reference to the flowchart of FIG. 4.

The processing of the host device 2 will be described.
(Step S211)
The authentication information resetting unit 121 of the host device 2 performs an authentication information resetting trigger process. 121 updates the authentication information 301 in the storage unit 30 and transmits an authentication information reset trigger (timing T211).
In this process, when the above-mentioned specific timing is reached, a user such as an administrator such as ATM performs a switch or button operation on an input unit (not shown) of the host device 2 or a timer (not shown). Etc.) is transmitted. The authentication information resetting unit 121 receives these and updates the authentication information 301 in the storage unit 30.

More specifically, the authentication information resetting unit 121 creates verification data for the authentication information 301 using a random number generator or the like. Further, the authentication information resetting unit 121 can update the verification period and the sampling cycle of the authentication information 301 with a random number generator or the like. For example, according to the example of FIG. 3A, the authentication information resetting unit 121 can also reset the delay d, the verification period L, the sampling period s, and the like related to the authentication information 301.

The authentication information resetting unit 121 transmits an authentication information resetting trigger to the card reader 1 via the interface unit 51 after resetting the authentication information 301. At this time, the authentication information resetting unit 121 may transmit a verification period including the reset delay, a sampling period, and the like from the interface unit 51. Encryption or the like may be used for these transmissions.

(Step S212)
The transmission digital signal creation unit 111 and the D / A conversion unit 41 of the host device 2 perform an analog signal transmission process. The transmission digital signal creation unit 111 creates a transmission digital signal based on the authentication information 301, converts it into an analog signal by the D / A conversion unit 41, and transmits it to the card reader 1 (timing T212). This process is performed in the same manner as step S202 in FIG.

Next, processing of the card reader 1 will be described.
(Step S111)
The A / D converter 20 of the card reader 1 performs an analog signal reception process. This process is performed in the same manner as step S101 in FIG.

(Step S112)
The authentication information resetting unit 120 of the card reader 1 performs authentication information storage processing. The authentication information resetting unit 120 creates updated authentication information 300 based on the received authentication information reset trigger and the received digital signal converted by the A / D conversion unit 20 and stores the updated authentication information 300 in the storage unit 30. At this time, the authentication information resetting unit 120 may store the verification period including the reset delay, the sampling period, and the like as a part of the updated authentication information 300.

(Step S113)
The transmission digital signal creation unit 110 of the card reader 1 performs transmission digital signal creation processing. The transmission digital signal creation unit 110 creates a transmission digital signal for returning the updated authentication information 300. This process is also performed in the same manner as step S104 in FIG.

(Step S114)
The D / A converter 40 of the card reader 1 performs an analog signal return process. The D / A conversion unit 40 converts the transmission digital signal into an analog signal and transmits the analog signal to the host device 2 (timing T111). This process is also the same as step S105 in FIG.

Again, the process of the high-order apparatus 2 is demonstrated.
As shown in FIG. 4, the host device 2 receives the transmitted return analog signal in step S114 of the card reader 1 (timing T111).
(Step S213)
The A / D converter 21 performs a return analog signal reception process.
The A / D conversion unit 21 acquires an analog signal output from the D / A conversion unit 40 of the card reader 1 for a specific time, and converts it into a received digital signal.

(Step S214)
The authentication information resetting unit 120 performs reply authentication information storage processing.
The authentication information resetting unit 120 acquires the received digital signal and stores it in a buffer (not shown) of the storage unit 31. Note that the authentication information resetting unit 120 may verify whether the received digital signal is abnormal data as in the authentication result verification process in step S204 of FIG.
Thus, the authentication information resetting process according to the embodiment of the present invention is completed.

In the authentication information reset process according to the above-described embodiment, an example in which the host device 2 resets the authentication information 301 and transmits an authentication information reset trigger to the card reader 1 has been described. However, the card reader 1 may reset the authentication information 300 and transmit it to the host device 2 to perform the same processing.

[Main effects of this embodiment]
With the configuration described above, the following effects can be obtained.
The card reader 1 according to the embodiment of the present invention receives an analog signal that is a time-series continuous waveform from the host device 2 and converts it into a received digital signal, and the host device 2. Between the storage unit 30 for storing the authentication information 300 for performing mutual authentication and the displacement pattern of the received digital signal converted by the A / D conversion unit 20 with the authentication information 300 stored in the storage unit 30 The authentication processing unit 100 that authenticates and the transmission processing unit 100 that generates a transmission digital signal of a displacement pattern corresponding to the authentication information 300 stored in the storage unit 30 when the authentication processing unit 100 succeeds in authentication, A D / A conversion unit 40 that converts the transmission digital signal created by the transmission digital signal creation unit 110 into an analog signal and transmits the analog signal to the host device 2 is provided.

In addition, the host device 2 according to the embodiment of the present invention receives an analog signal having a continuous waveform in time series from the card reader 1 and converts it into a received digital signal, and a card reader. A storage unit 31 that stores authentication information 301 for mutual authentication with the authentication unit 1, and an authentication information 301 that stores a displacement pattern of the received digital signal converted by the A / D conversion unit 21 in the storage unit 31. An authentication processing unit 101 that verifies and authenticates and a transmission digital signal generation unit 111 that generates a transmission digital signal of a displacement pattern corresponding to the authentication information 301 stored in the storage unit 31 when the authentication processing unit 101 succeeds in authentication. And a D / A conversion unit 41 that converts the transmission digital signal created by the transmission digital signal creation unit 111 into an analog signal and transmits the analog signal to the card reader 1. The features.

That is, in the present embodiment, the input side compares the stored displacement pattern of the analog signal with the displacement pattern of the received analog signal. It is determined that the device is normal. If they do not match, it is determined that the device is abnormal.
With this configuration, even if the configuration is simplified, it is possible to easily detect replacement with an unauthorized device. That is, it is possible to reliably determine whether the relationship between the host device 2 and the card reader 1 is a correct combination while having a simple configuration as compared with the technique described in the conventional patent document 1, and the replacement with an unauthorized device is possible. Can be detected.

In addition, since the card reader 1 and the host device 2 of the present embodiment have a simplified configuration, it is possible to reduce the manufacturing cost by reducing the scale of the circuit related to mutual authentication. In particular, in recent years, there are CPUs or the like that have built-in A / D converters and D / A converters, in which case an external A / D converter or D / A converter is not used. Furthermore, cost can be reduced. That is, the mutual authentication function can be realized with the minimum necessary hardware.
Further, the card reader 1 and the host device 2 of the present embodiment do not use digital encryption or the like that is restricted for reasons such as defense or confidentiality. This eliminates the need for export procedures and reduces costs.

Also, in the case of a configuration in which data is exchanged using a digital encryption key as in the past and mutual authentication is performed by the exchange, a complete digital is obtained by attaching a measuring instrument or the like to the communication unit of the upper device and the lower device and monitoring. It is possible to acquire a signal. In the case of such a digital signal, there is a possibility that the encryption key may be deciphered by detailed analysis of the monitor, and there is no security risk.
On the other hand, since the analog signals of the card reader 1 and the host device 2 of this embodiment do not include a digital encryption key or the like even if the analog signals themselves are acquired, security risks can be reduced.

Further, as an authentication method using a conventional analog signal, there has been an authentication method in which an image such as a sound waveform or a fingerprint is acquired and converted into data. These are characterized by the image itself such as the waveform of the user's voice and the fingerprint that needs to be authenticated. In addition, in such a conventional authentication method, it is necessary to select a location that is a feature of the authentication method.
On the other hand, in the card reader 1 and the host device 2 of the present embodiment, a general waveform can be used, and even if it is stolen, there is no problem. Further, it is not necessary to select a location that is a specific feature.

In addition, when a simple analog waveform signal is used, signals can be reliably verified between the upper device and the lower device due to the effects of A / D conversion, D / A conversion accuracy, noise, and the like. was difficult.
On the other hand, the authentication information 300 of the card reader 1 and the authentication information 301 of the host device 2 according to the present embodiment include a period for collating analog signals, a sampling cycle, and collation data for collating displacement patterns. It is characterized by.

With this configuration, in the card reader 1 and the host device 2 of the present embodiment, noise and the like are of a certain degree even if the A / D conversion and D / A conversion accuracy of the host device and the lower device are not high. Even if it is mixed only, it is possible to reliably collate the received digital signal after A / D conversion and the displacement pattern of the authentication information.
For this reason, it is possible to deal with combinations of products that require a certain level of security, and it is also possible to apply to combinations of products that do not require a high level of security. Further, the present invention can be applied to products that are low in cost and do not have high accuracy in A / D conversion and D / A conversion.

Further, the card reader 1 of the present embodiment includes an authentication information resetting unit 120 that resets the authentication information 300 at a specific timing, and the transmission digital signal creation unit is an authentication reset by the authentication information resetting unit 120. The transmission digital signal is created from the information 300, and the D / A conversion unit 40 converts the transmission digital signal created by the transmission digital signal creation unit and corresponding to the reset authentication information 300 into an analog signal and converts it to an upper level. It transmits to the apparatus 2, It is characterized by the above-mentioned. Similarly, the host device 2 of this embodiment includes an authentication information resetting unit 121 that resets the authentication information 301 at a specific timing, and the transmission digital signal creation unit is reset by the authentication information resetting unit 121. The D / A converter 41 converts the transmission digital signal corresponding to the reset authentication information 301 generated by the transmission digital signal generator into an analog signal. To the card reader 1.

In other words, it is possible to reset the analog signal to be displaced at a specific timing, output a new analog signal at the reset timing, monitor the state on the input side, and use the new displacement pattern at the next authentication. is there.
With this configuration, it is possible to easily reset the

authentication information

300 and 301 in the event of an accident, failure, or user instruction. Therefore, maintainability can be improved.

[Other Embodiments]
In the above-described embodiment, an example in which mutual authentication is performed between the card reader 1 incorporated in an ATM or the like and the host device 2 has been described.
On the other hand, mutual authentication according to the present embodiment can be performed between devices in the card reader, such as a control unit in the card reader and an encryption magnetic head.
With this configuration, it is possible to flexibly cope with a device configuration and the like. In the mutual authentication method of the present embodiment, since additional circuits and the like can be reduced, mutual authentication can be performed even between devices having a configuration that cannot be authenticated conventionally.

Further, in the above-described embodiment, an example in which a contact IC card reader, a non-contact IC card reader, and a magnetic card reader are used as the card reader 1 has been described.
However, as another embodiment of the present invention, for example, the present invention can be similarly used for an apparatus that reads or writes information on another information medium that handles monetary value information. For example, the present invention can be applied to a device that reads or writes magnetic information with respect to a passbook in which a magnetic stripe is formed.
With this configuration, it is possible to easily perform mutual authentication for an apparatus that performs processing on an information medium.

In the above-described embodiment, an example is shown in which authentication with the card reader 1 that is a lower-level device is performed by the authentication start trigger of the higher-level device 2. However, it is also possible to authenticate the host device 2 by the authentication start trigger of the card reader 1, which is a lower device, and confirm the authenticity. For this reason, the authentication start trigger may be switched and transmitted depending on the situation between the host device 2 and the card reader 1.
Thereby, authenticity can be mutually confirmed, security can be improved, and reliability can be enhanced.

Further, in the above-described embodiment, the example in which the waveform of the analog signal is collated by the displacement angle or the like (displacement pattern) has been described. However, a configuration is also possible in which the waveform of the received digital signal itself is compared with the waveform of the received digital signal received previously. In this case, the auto-correlation and the like are calculated using the received digital signal obtained by previously acquiring the waveform of the received digital signal obtained by A / D converting the analog signal from the host device 2 and stored in the buffer as the authentication information 300. Compare. With this configuration, the configuration can be simplified and mounting becomes easy.
In addition, it is possible to employ a configuration in which the waveforms are not compared in the first place but are collated based on the amplitude or period of a sine wave or square wave. In addition, a configuration in which processing such as FFT (Fast Fourier Transform) is performed on the received digital signal to compare and collate with a ratio of a specific frequency component or the like is possible.
By configuring in this way, security can be improved rather than simply comparing waveforms.

Further, in the above-described embodiment, the example is described in which the host device 2 and the card reader 1 include the A /

D conversion units

20 and 21 and the D /

A conversion units

40 and 41, respectively. However, a combination in which the output side / input side is fixed as in the upper apparatus / lower apparatus may be used. That is, the host device 2 includes the D / A conversion unit 41 and does not include the A / D conversion unit 21, and the card reader 1 includes the A / D conversion unit 20 and does not include the D / A conversion unit 40, or The host device 2 includes the A / D converter 21 and does not include the D / A converter 41, and the card reader 1 includes the D / A converter 40 and does not include the A / D converter 20. May be. By doing in this way, two of the A /

D converters

20 and 21 and the D /

A converters

40 and 41 can be reduced, and the cost can be reduced.

Moreover, in the above-described embodiment, an example in which the authentication information resetting process is performed at a specific timing has been described. However, the authentication information resetting process can be configured to be performed only at the time of factory shipment. Thereby, security can be improved. That is, in order to further improve security, it is possible to make it impossible to reset the

authentication information

300 and 301 at the installation location.

Further, in the above-described embodiment, it is described that the processing in the other apparatus is started by the authentication start trigger and the authentication information reset trigger from the

interface units

50 and 51.
However, an authentication start trigger and an authentication information reset trigger may be transmitted by outputting a specific burst signal or the like from the D /

A converters

40 and 41.
With this configuration, it is not necessary to create or change a process related to transmission of a control program command or the like, and costs can be reduced.

It should be noted that the configuration and operation of the above-described embodiment are examples, and it is needless to say that the configuration and operation can be appropriately changed and executed without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 Card reader 2 Host apparatus 3 Card 10, 11 Control part 20, 21 A /

D conversion part

30, 31 Storage part 40, 41 D /

A conversion part

50, 51

Interface part

100, 101

Authentication processing part

110, 111 Transmission

digital Signal generators

120 and 121 Authentication

information resetting units

300 and 301 Authentication information X Mutual authentication system

Claims

An A / D converter that receives an analog signal that is a continuous waveform in time series from another device and converts the analog signal into a received digital signal;
Authentication information storage means for storing authentication information for mutual authentication with the other device;
An authentication processing unit that authenticates by comparing the displacement pattern of the received digital signal converted by the A / D conversion unit with the authentication information stored in the authentication information storage unit;
When authentication is successful in the authentication processing unit, a transmission digital signal creation unit that creates a transmission digital signal of a displacement pattern corresponding to the authentication information stored in the authentication information storage unit;
A mutual authentication apparatus comprising: a D / A conversion unit that converts the transmission digital signal created by the transmission digital signal creation unit into an analog signal and transmits the analog signal to the other device.
2. The mutual authentication apparatus according to claim 1, wherein the authentication information includes a period for verifying the analog signal, a sampling period, and verification data for verifying the displacement pattern.
An authentication information resetting unit for resetting the authentication information;
The transmission digital signal creation unit creates the transmission digital signal from the authentication information reset by the authentication information resetting unit,
The D / A conversion unit converts the transmission digital signal corresponding to the reset authentication information created by the transmission digital signal creation unit into an analog signal and transmits the analog signal to the other device. The mutual authentication device according to claim 1 or 2.
Receives an analog signal that is a continuous waveform in time series from another device, converts it into a received digital signal,
Storing authentication information for mutual authentication with the other device;
Authenticate by comparing the converted displacement pattern of the received digital signal with the stored authentication information,
When the authentication is successful, a transmission digital signal of a displacement pattern corresponding to the stored authentication information is created,
A mutual authentication method, wherein the created transmission digital signal is converted into an analog signal and transmitted to the other device.