JP2002149612A - Authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system for preventing illegal acquisition of authentication and to provide an authentication system having versatile applicability to various information terminals. SOLUTION: A subordinate function corresponding to an individual (each user) is stored in an IC card 6 owned by the individual and the same subordinate function is stored together with information on the individual also in an authentication server 3. When an independent variable provided from the server 3 based on the information on the individual is displayed on an information terminal 1, the user obtains the value of the subordinate function by inputting the independent variable to the IC card 6 and sends this back to the server 3 from the terminal 1. The server 3 compares the sent-back value of the subordinate function with the value of the subordinate function obtained by itself and when they are coincident with each other, the server 3 authenticates the individual to be a principal. The IC card 6 and an IC information reader 5 can electrically be independent of the terminal 1.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to a system for authenticating an individual on a network.

[0002]

2. Description of the Related Art Personal identification using a card (for example, a credit card) on the Internet is performed by inputting personal information, for example, a card number, an expiration date, etc., written on a card at an information terminal such as a personal computer or a mobile phone. Has been done. In many cases, such personal information is input by the user himself / herself pressing a keyboard or a button to perform an input operation. It is also possible to connect a dedicated card information reading device to the information terminal (electrical connection such as cable connection). In this case, the user inserts the card into the card information reading device,
The information recorded on the card is read and transmitted from the information terminal.

[0003]

However, there are cases where information unique to a card, such as a card number, is disclosed to another person by transmission via the Internet. In such a case or when the card is stolen, there is a problem that even if another person impersonates the user and operates, the user is authenticated as the principal. In order to prevent such unauthorized use, it is conceivable to input a personal identification number. However, in this case, the personal identification number entered is transmitted via the Internet, and there is a danger that another person will intercept the personal identification number. There is. On the other hand, the card information reading device has another problem that its versatility is low because the connection form and the protocol are different depending on the standard of the information terminal. For example, a card information reader for connecting to a personal computer cannot be connected to a mobile phone. Therefore, it is necessary to prepare a card information reader suitable for each of various information terminals, but this is not easy in practice.

[0004] In view of the above-described conventional problems, an object of the present invention is to provide an authentication system that prevents unauthorized authentication acquisition. It is another object of the present invention to provide a versatile authentication system for various information terminals.

[0005]

An authentication system according to the present invention is connected to a network, has a dependent function corresponding to an individual, provides an independent variable based on information about the individual, and uses the independent variable as the dependent variable. An authentication device for inputting a function to obtain a dependent function value, and an information terminal connected to the network, for transmitting information input from an individual to the authentication device, and displaying an independent variable provided from the authentication device. And an information processing device that is present on the information terminal side, has the dependent function, and obtains a dependent function value by inputting the independent variable to the dependent function, and the authentication device is configured by the information processing device The obtained dependent function value is obtained via the information terminal, and the individual is authenticated by comparing it with the dependent function value obtained by itself. Than it (claim 1). In the authentication system configured as described above, the independent variable provided from the authentication device based on the information on the individual is displayed on the information terminal. The individual (user) inputs this to the information processing device to obtain a dependent function value, and then returns the dependent function value from the information terminal to the authentication device. The authentication device compares the dependent function value obtained by itself with the dependent function value returned from the information terminal, and performs individual authentication only when they match.

In the authentication system (claim 1),
It is preferable that the information processing device is electrically independent from the information terminal (claim 2). In this case, the information processing device is electrically independent of the information terminal, and thus does not require an electrical interface with the information terminal. In addition, since they are electrically independent, there is no risk that the contents of the information processing will be known to other individuals (others) on the network.

In the above authentication system (claim 1), the information processing device has an information processing function and is provided on an information terminal side with an IC card storing the dependent function,
An IC information reader which is used in combination with an IC card and obtains a dependent function value by inputting the independent variable to a dependent function of the IC card may be provided (claim 3). In this case, individual authentication can be performed by storing the same subordinate function owned by the authentication device for each individual in the IC card and providing the same to the individual.

In the above authentication system (claim 3), the IC card may be capable of calculating a dependent function value from an independent variable by inputting a password (claim 4). In this case, the dependent function value cannot be obtained unless the passwords match.

[0009]

FIG. 1 is a diagram showing a configuration of an authentication system according to an embodiment of the present invention. In the figure, an information terminal 1, such as a personal computer, a mobile phone, or a PDA, a member store site 2, and an authentication server 3 as an authentication device are connected to the Internet 4. Note that the authentication server 3
Installed at card companies or member stores. Merchant site 2
Is, for example, a shopping site, a membership site, and the like. On the information terminal 1 side (actually near the terminal), an IC information reading device 5 and an IC card 6 attached thereto are prepared, and both constitute one information processing device. IC
The information reading device 5 and the IC card 6 are prepared electrically independently of the information terminal 1, and do not have a relationship of electrically transmitting and receiving signals between them.

The IC card 6 is obtained by embedding an IC chip in a card-shaped plate. A card company or a member store of which the user of the information terminal 1 is a member, that is, a manager of the authentication server 3 has Offered to people. IC
The chip has an information processing function including a storage function and an arithmetic function. This IC chip stores information such as an ID number, a password, and a dependent function unique to the user. A requirement of the dependent function is that the output value is not easily inferred from the input values. As the dependent function, for example, an inverse function of the encryption function DES (Data Encryption Standard) is suitable. The encryption function DES cannot easily infer the input value from the output value. Therefore, in the inverse function, the output value cannot be easily estimated from the input value, and thus the above-mentioned necessary condition is satisfied. The DES has a plurality of arithmetic expressions, and it is possible to select which arithmetic expression to use based on a “key”. The DES and the key are stored in the IC chip. Key is individual IC
Varies by tip.

The IC information reading device 5 has a display and buttons, and can input information to the inserted IC card 6 and display an output corresponding thereto. The authentication server 3 holds the same ID number and information on the dependent function as those stored in the IC chip as information for each user. The authentication server 3 selects a key corresponding to the ID number based on the ID number. Therefore, the authentication server 3 and the IC chip can perform the same calculation.

The operation of the authentication system configured as described above will be described with reference to the flowcharts of FIGS. Steps 11 to 15 and 31 to 36 in FIG. 2 show the processing in the information terminal 1 and the authentication server 3 in the authentication system, respectively.
Indicates a process in the IC card 6. First, a user A connects to the Internet 4 from the information terminal 1,
The member store site 2 is opened (step 11 in FIG. 2). Here, the member store site 2 requests input of an ID number for personal authentication. When the user A inputs the ID number (step 12), this information is transmitted to the authentication server 3. The authentication server 3 collates the ID number with the data held by itself (step 31), and rejects the authentication if they do not match (step 36). If they match, an independent variable is selected and transmitted to the information terminal 1 (step 32). The independent variable is selected according to a random number (pseudo random number) or a serial number, and the same value is not selected continuously. Thereby, the independent variable x is displayed on the information terminal 1 (step 13). On the other hand, the authentication server 3 calculates a dependent function value f (x) for the independent variable (step 33).

The user A who sees the independent variable displayed on the information terminal 1 inserts the IC card 6 into the IC information reading device 5 (step 61 in FIG. 3), and inputs a password into the device (step 61). Step 62). If the password matches the one stored in the IC card 6, the independent variable can be input (Yes in step 63). Then, the user A inputs the independent variable x (step 64). I
The C card 6 calculates a dependent function value f (x) from the independent variable x (step 65) and displays this on the IC information reading device 5 (step 66). If the passwords do not match (No at Step 63), the personal authentication is denied (Step 67), and the user A cannot obtain the dependent function value f (x).

Next, the user A inputs the dependent function value f (x) to the information terminal 1 (step 14 in FIG. 2). The input dependent function value f (x) is sent to the authentication server 3. Here, the authentication server 3 calculates the dependent function value f obtained by itself.
(X) and the dependent function value f transmitted from the information terminal 1
(X) is compared (step 34), and if they match, the user is authenticated (step 35), and a response of authentication OK is transmitted to the information terminal 1 (step 15). If they do not match, the authentication result is rejected (step 3).
6). When the authentication OK is obtained in this way, the user A can perform procedures such as shopping at the member store site 2.

As described above, according to the authentication system of the above embodiment, the user A himself / herself correctly inputs the ID number,
If the correct answer (dependent function value) for the question (independent variable) provided based on the input of the ID number cannot be returned, the authentication server 3 cannot obtain the personal authentication. That is, in order to obtain personal authentication, it is necessary to know the ID number of the user and to own the IC card 6. Here, the ID number is the information terminal 1
Is transmitted to the authentication server 3 via the Internet 4 and may be intercepted by another person, but even if intercepted, as long as the person owns the IC card 6, the other person obtains the authentication. It is not possible. Further, even if the IC card 6 is stolen, it is not easy to extract the information of the ID number from the IC chip, and it is extremely difficult to obtain authentication unless the ID number is known. Therefore,
It is practically impossible for another person to impersonate and gain unauthorized authentication, and only the individual can gain authentication.

In order to obtain the dependent function value with the IC card 6, first, the passwords must be matched.
Even if the IC card 6 is handed over to another person and the other person knows the ID number, the IC card 6 cannot be used illegally. On the other hand, the independent variable and the dependent function value themselves are transmitted and received on the Internet 4 and may be intercepted by others. However, even if intercepted, these are not individual information about the individual, and the independent variables change each time. I can't.

Further, the IC information reading device 5 includes the information terminal 1
Since it is electrically independent from the Internet 4, the contents of information processing and the personal identification number in the IC card 6 are
There is no fear of being known to others above. Therefore, the confidentiality of the dependent function and the password is high. Further, since the IC information reading device 5 is electrically independent, an electrical interface with the information terminal 1 is not required, and the IC information reading device 5 can be commonly used for various information terminals 1.

Although the authentication system in the above embodiment is via the Internet, it can be applied to an intranet or other small-scale networks.

[0019]

The present invention configured as described above has the following effects. According to the authentication system of the first aspect, authentication is performed based on whether or not a correct answer (dependent function value) can be returned to a question (independent variable) issued by the authentication device based on information on an individual. Only the true individual who owns the information processing device storing the dependent function) can be authenticated. Therefore, it is possible to prevent unauthorized authentication acquisition.

According to the authentication system of the second aspect, since the information processing apparatus is electrically independent of the information terminal, an electrical interface with the information terminal is not required, and the information processing apparatus can be used for various information terminals. Can be used in common. In addition, since they are electrically independent, there is no risk that the contents of the information processing will be known to other individuals (others) on the network. Therefore, it is safe.

According to the authentication system of the third aspect, by storing the same subordinate function owned by the authentication device for each individual in the IC card and providing it to the individual,
Reliable individual authentication becomes possible.

According to the authentication system of the fourth aspect, since the dependent function value cannot be obtained unless the passwords match, it is possible to prevent unauthorized use even if the IC card is handed to another person. it can.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of an authentication system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing a process in an information terminal and an authentication server in the authentication system.

FIG. 3 is a flowchart showing processing of an IC card in the authentication system.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Information terminal 3 Authentication server 4 Internet 5 IC information reading device 6 IC card

 ────────────────────────────────────────────────── ─── Continuing from the front page (72) Inventor Hiroyuki Hayashino 1-3-1 Doshomachi, Chuo-ku, Osaka-shi My Cal Card Co., Ltd. F term (reference) 5B085 AE12 AE23 BG07 5J104 AA07 AA16 EA15 EA22 EA26 JA13 KA02 KA04 KA06 MA01 MA05 NA02 NA35 NA36 NA37 NA40 PA07

Claims (4)

[Claims] 1. An authentication system connected to a network, having a dependent function corresponding to an individual, providing an independent variable based on information about the individual, and inputting the independent variable to the dependent function to obtain a dependent function value. A device, connected to the network, transmits information input from the individual side to the authentication device, and displays an independent variable provided from the authentication device; and an information terminal that is present on the information terminal side, An information processing device having a dependent function and obtaining the dependent function value by inputting the independent variable to the dependent function, wherein the authentication device transmits the dependent function value obtained by the information processing device to the information terminal. An authentication system for acquiring an individual by acquiring the information via a sub-function and comparing the acquired value with a dependent function value obtained by the user. 2. The authentication system according to claim 1, wherein said information processing device is electrically independent from said information terminal. 3. The information processing apparatus has an information processing function, an IC card storing the dependent function, and an information card which is provided in the information terminal and used in combination with the IC card. The authentication system according to claim 1, further comprising: an IC information reading device that inputs the independent variable to a dependent function to obtain a dependent function value. 4. The IC card can calculate a dependent function value from an independent variable by inputting a personal identification number.
Authentication system described.