JP2002342282A - Personal authentication method and personal authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide method and a personal authentication system capable of preventing the forgetfulness of a password, and increasing safety against surreptitious viewing or wiretapping. SOLUTION: This system is provided with a questioning means 421 for presenting any of a plurality of associative word pairs 352, preliminarily set so that a prescribed reference word and associative words associated by a user with respect to the reference word are included, to the user in an arbitrary order and an answering means 422 for enabling the user to enter answer words associated with respect to the presented reference word, so that the operator can be authenticated as being a legitimate user 5.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a personal authentication method and a personal authentication system, and is used for confirming that the user has a proper access right to various systems or equipment.

[0002]

2. Description of the Related Art Conventionally, individuals are required to confirm their identity by logging in to a computer system or network, operating with an automatic teller machine (ATM), or passing through a security-locked gate such as a secret facility. Authentication is required. In addition, in order to collect tolls for transportation, enter amusement facilities, and charge for the use of other facilities, it is necessary to confirm authority, such as a pass ticket, according to personal authentication.

In order to perform such personal authentication, a system that uses a personal identification code (user ID) for specifying a user and a secret release code (password) known only to the user has become mainstream.

In such an ID password pair method, a pair of a user ID and a password is registered in advance in a security system for managing the network, ATM, gate, and the like described above. At the time of authentication, when the user inputs an ID and a password, the security system checks the password corresponding to the input ID from the registration information, and if the password matches the input password, confirms the identity.
Release the security lock. On the other hand, if the registered password is different from the entered password, the personal authentication is rejected and the security lock is maintained.

[0005] As a personal authentication system for ensuring security and charging, a physical certification means such as a machine key or an identification card has been used for a long time. However, with a physical key or the like, there are inconveniences such as a decrease in security due to forgery or duplication, and loss. In response, systems for identifying the physical characteristics of the user have been developed. For example, fingerprint and voiceprint checks, retinal image inspection, and the like have been put to practical use. However, these systems are expensive and far from widespread. From these backgrounds, as the personal authentication method that can reduce the equipment cost and the like instead of the physical key and the like, the encryption method that only the person can understand, specifically, the ID password pair method described above is mainly used. .

In the above-mentioned ID password pair method, there is a problem that the user forgets the password set by himself and cannot release it. On the other hand, a system using an associative auxiliary password has been proposed.

For example, in the personal identification system disclosed in Japanese Patent Application Laid-Open No. 63-40963, a user-specific keyword that is associated with a password is registered in advance, and a password request is issued. Is displayed when an instruction is issued to rescue a user who has forgotten the password. Specifically, a keyword unique to the user, which is associated with a password, is stored in a keyword storage unit of the personal identification system.

[0008] When the user forgets the password, he / she makes a keyword request from the keyword request input section after confirming the ID code. The control unit of the system fetches from the storage unit a keyword registered as a pair with the ID code whose match has been confirmed by the collating unit in response to a keyword request from the input unit. Output to the keyword output unit.

[0009] The user associates the password by looking at the keyword output to the output unit, and inputs the password from the password input unit. The control part of the system
If the input password matches the password stored corresponding to the keyword, the user is confirmed as the same as the original ID password authentication. Examples of similar associative systems include JP-A-01-94491, JP-A-06-177872, and JP-A-10-63620.

[0010]

In the associative system described above, a keyword (reference word) and a password (associative word) are used.
Are related to each other based on the association unique to the user, and have a feature that imitation cannot be performed by others and impersonation is difficult to be performed.

However, the keywords and passwords in the associative system mainly take the form of a natural language because they depend on human association. Although it is possible to perform associative reproduction reliably because it is a natural language, there is a security problem due to eavesdropping and eavesdropping on others. In other words, associative passwords are more easily stored by others than abstract numbers and character strings because they are a natural language, and can be easily stored when someone looks into them from behind when entering a password. This can increase the risk of spoofing due to eavesdropping.

[0012] Due to the possibility of such wiretapping and eavesdropping, the associative method has been used only in an auxiliary manner, regardless of its advantages. The ID password pair method described above is mainly used for ordinary personal authentication, and a problem such as forgetting a password in this method cannot be sufficiently solved.

An object of the present invention is to provide a personal authentication method and a personal authentication system that can avoid forgetting a password and increase security against eavesdropping.

[0014]

SUMMARY OF THE INVENTION A method of the present invention is a personal authentication method for authenticating that an operator is a legitimate user. A plurality of associative word pairs including an associative word associated with are set, and at the time of authentication, any of the associative word pairs is presented to the user in an arbitrary order, and the user sets the associative word to the presented reference word. Input the associated answer word,
The user is determined to be a person based on the coincidence between the input answer word and the associated word corresponding to the presented reference word.

The system of the present invention is a personal authentication system for authenticating that an operator is a legitimate user. The system includes a predetermined reference word and an associative word associated with the reference word by the user. Means for presenting any of a plurality of associative word pairs set to the user in an arbitrary order, and an answer that allows the user to input an answer word associated with the presented reference word Means.

In the present invention, the user answers the answer word to a specific reference word based on a preset association word pair. The answer word is based on the association based on the association peculiar to the user himself, and gives substantially the same result as the associative word set in advance to the associative word pair. Therefore, if the answer word matches the associative word, it can be determined that the person is the person. This avoids forgetting such as passwords with abstract numbers and character strings.

Further, in the present invention, a plurality of associative word pairs are set, and upon authentication, a plurality of reference words are presented by changing the order. If the user is correct, the association result for each reference word is almost the same regardless of the arrangement.
For this reason, even if the input of the answer word of the user is spoofed by another person's eavesdropping or eavesdropping, this is an answer word for a specific reference word sequence, and does not form a correct associative word. Thus, impersonation of another person due to eavesdropping or eavesdropping can be avoided.

[0018] In the present invention, it is preferable that the apparatus further comprises a judging means for judging that the person is a person based on the coincidence between the answer word input to the answer means and the associated word corresponding to the presented reference word. With this configuration, the determination unit can automatically determine the answer word. When used in a network, the question means and the answer means may be installed in the client, and the determination means may be installed in the server.

In the present invention, the associative word pair may include a plurality of associative words with respect to a reference word, and the determining means may determine that the user is the principal if the answer word from the user matches any of the associative words. Good. In this way, even if the user's association changes and deviates from the first candidate and matches with the second candidate, it is possible to improve the identity verification accuracy even in the case of the collation including the ambiguity of the association.

In the present invention, each of the reference word and the associative word is preferably a two-byte code. As the two-byte code, in addition to the Japanese kanji code defined in the JIS standard, a character code used in a computer system in each country can be used. Such a two-byte code is
It generally has a meaning compared to a one-byte code such as an alphabet or a number, and is more effective when given as an associative word.

[0021] In the present invention, it is preferable that the reference word is presented to the user as a plurality of continuous character strings. In this way, for example, the original registration is
Even if it is "bottom", it is displayed as "sea bottom", and it is difficult to determine the break even if another person who tries to gain authentication illegally pretends to reply. On the other hand, the reference word is "sea" from the memory etc. at the time of setting the association word
It is possible to identify the “bottom”, and to correctly input the answer word associated with each. This can further enhance the protection against unauthorized authentication by another person.

In the present invention, it is preferable that a plurality of the answer words are input as a continuous character string. In this way, for example, even if the answer word is “Taihei”, “Offshore”, or “Land”, the input screen displays “Pacific landing”. For this reason, even if another person who tries to gain unauthorized authentication attempts wiretapping and eavesdropping, it is difficult to store in a short time due to the long character string length. Also, since the break is unknown,
By remembering "Pacific", "landing", etc., it becomes difficult to correctly answer when the order is changed. In other words, by searching for a combination of “Taihei”, “Offshore” and “Land” and a combination of “Pacific” and “Landing”, the possibility of accidentally reaching the correct answer is significantly reduced. This can further enhance the protection against unauthorized authentication by another person.

In inputting the answer words, a delimiter operation or an input of a separator may be performed for each answer word in the input operation. In this case, the recognition on the system side is easy, and the software and the like can be simplified. On the other hand, if the input operation of the answer word itself is continuous (a plurality of answer words are continuously input without a break),
It is also possible to enhance the protection against prying eyes and the like during the input operation. In such a configuration, it is necessary to perform a process of cutting out a plurality of answer words from a continuously input answer word character string because the system does not know the answer word breaks. For such processing, for example, segment recognition technology used in Japanese kana-kanji conversion software or the like can be used. In addition, the associative word stored in the associative word pair, that is, the correct answer word is sequentially collated, or processing such as temporarily extracting the same number of characters of the answer word from the answer word character string and checking whether they match is performed. Alternatively, the necessary functions may be realized by appropriately using the character string operation in the existing computer technology.

In the present invention, there is provided storage means for storing a plurality of associative word pairs, and selecting means for selecting any of the associative word pairs stored in the storage means in an arbitrary order. Preferably, the means is for presenting a reference word included in the associative word pair selected by the selecting means to the user. This is suitable for presenting the associated reference words in an arbitrary order.

In the present invention, it is preferable that the number of associative word pairs stored in the storage means is set to be larger than the number of reference words presented to the user by the selection means. By doing so, only some of the preset associative word pairs are used for actual authentication. That is, at the time of authentication, not only the order of the reference words is changed, but also the presented reference words themselves are changed. This can further enhance the protection against impersonation by others.

In the present invention, it is preferable that the selecting means sets the order of the associative word pairs by random number generation. This can reduce the possibility that the order of the reference words will be the same, thereby further improving the defensive property against impersonation by others.

In the present invention, the selecting means may shift the order of the previously selected associative word pair by a predetermined number to obtain a new order. In this way, a certain degree of relevance can be left, and the user can easily answer.

In the present invention, it is preferable that a registration unit is provided for associating the user with an associative word with respect to a predetermined reference word, generating a plurality of associative word pairs, and registering the associative word pair in the storage unit. With such a registering means, the user can set the above-mentioned associative word pair by himself, and the possibility of being known to others can be eliminated.

In the present invention, it is preferable that the registration means selects an arbitrary reference word from a large number of reference words stored in advance, presents the reference word to the user, and causes the user to input a corresponding associative word. In this way, the user can register a predetermined number of reference word pairs simply by answering the reference words sequentially presented at the time of registration, and the processing is simplified.

In the present invention, the registration means may allow the user to input an arbitrary reference word and an associated word. In this way, the user can set the reference word itself, which makes it more difficult for others to impersonate.

In the present invention, the storage means stores a plurality of sets of the plurality of associative word pairs for each user.
The selection means may be configured to select the associative word pair corresponding to the user based on identification information specifying the user. In this way, the processing can be performed reliably even when dealing with a large number of users such as network login. When only one user is used, such as when applying to a door lock of a private house, there is no need to store the information for each user.

[0032]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. In FIG. 1, a network system 1 has a server computer 3 and a client computer 4 interconnected via a communication line 2,
When the user 5 operates the client computer 4 to make a service request, the server computer 3 provides a predetermined network service 6. For this purpose, the server computer 3 has an existing function (not shown) for providing the network service 6.
An existing function (not shown) for connecting to the server computer 3 and receiving the network service 6 is incorporated in the client computer 4.

The personal authentication system 10 according to the present invention is applied to the network system 1 to confirm that the user 5 is a legitimate user who has the authority to receive the network service. Is to be executed. To this end, a personal authentication server 30 is configured in the server computer 3,
The client computer 4 has a registration routine 41 and an authentication routine 42 incorporated therein.

The individual components of the personal authentication server 30 and the components such as the registration routine 41 and the authentication routine 42 described below are implemented in software by a computer program executed on the server computer 3 or the client computer 4. Things. of course,
If necessary, some or all may be realized by hardware.

The personal authentication server 30 includes a storage unit 31, a registration unit 32, a selection unit 33, and a determination unit 34. Storage means
A reference word database 36 and a user database 35 are set in 31. A large number of pieces of user information 350 are stored in the user database 35, and each piece of user information 350 has a unique user ID 351 in the user database 35, user information (not shown) such as an address and name of each user, and a plurality of associated word pairs. And an associative word pair data set 352 including

As shown in FIG. 2, the reference word database 36
Has a plurality of reference words 361 stored therein. A reference word number 362 is set for each reference word 361 so that individual identification can be performed. The reference word 361 is a Japanese character set (iso-2022-j
Etc.).

As shown in FIG. 3, the associative word pair data set
352 includes a reference word 3521, an associative word A3522, an associative word B3523,
It has an associative word pair number 3524. The reference word 3521 is selected from any of the reference words stored in the reference word database 36. The associative word A3522 and the associative word B3523 register the result associated with the reference word 3521 by the user 5. The inquiry and registration of each associated word to the user are performed by the registration unit 32 described later.

An associative word pair 3520 is composed of these reference word 3521, associative word A3522, and associative word B3523.
In 3520, an associative word pair number 3524 is set to identify each. To be precise, the reference word 3521 and the associative word A3522
And one associative word pair, the base word 3521 and the associative word B3523 form another associative word pair. Since each is used complementarily to the base word 3521, one associative word is used in data processing. Treated as word pair 3520. In addition, the user ID 3525 is added to each of the associative word pairs 3520, and even if these associative word pair data are separately stored in the storage unit without partition arrangement for each user such as a folder or a subdirectory,
An associative word pair corresponding to a specific user 5 can be extracted.

Returning to FIG. 1, the registration means 32, the selection means 33, and the determination means 34 of the personal authentication server 30 cooperate with the registration routine 41 and the authentication routine 42 of the client computer 4 to allow the user 5 to log in for the first time. It performs personal authentication at the time of registration or subsequent login.

The registration means 32 registers user information 350 of the user 5 in the user database 35 in response to a registration request issued by the user 5 from the client computer 4. Specifically, the personal information of the user 5 is input to the client computer 4, and the personal information is input to the user computer 4.
D351 is added to set user information 350. Further, the client computer 4 causes the user 5 to input an associative word associated with the plurality of reference words, and associates the associative word with the data set.
352 is registered.

The selecting means 33 selects a predetermined number of associative word pairs used for personal authentication when the user 5 logs in to the network system 1 from the client computer 4. Specifically, when the user 5 issues a login request from the client computer 4, the user 5
The user information 35 corresponding to the user 5 is searched using the input user ID as a key, and a predetermined number of associative word pairs 3520 are selected from the associative word pair data set 352 and transferred to the question means 421 of the client computer 4. At this time, the number to be selected is a predetermined number set in advance. As a method of selecting a predetermined number of associative word pairs, an associative word pair number 3524 corresponding to a number generated by random number generation is searched, and the corresponding associative word pair 35 is searched.
A random selection method of selecting 20 can be adopted. On the other hand, the predetermined number of associative word pair numbers 3524 used last time are stored,
Other methods, such as using by shifting sequentially, may be used.

The judging means 34 judges personal authentication when the user 5 logs in to the network system 1 from the client computer 4. In particular,
When the user 5 issues a login request from the client computer 4, the client computer 4 accepts the user's 5 answer words for a plurality of reference words, and each corrects the reference words by referring to the reference word pairs stored in the storage means 31. It is determined whether the person is an individual.

The registration routine 41 and the authentication routine 42 incorporated in the client computer 4 cooperate with the storage means 31, the registration means 32, and the determination means 34 of the personal authentication server 30 to register the user 5 at the time of first login or thereafter. The personal authentication at the time of login is performed.

The registration routine 41 is started when the user 5 issues a registration request 51 to the client computer 4. The registration routine 41 has a function (not shown) for receiving an input of personal information 52. The registration question means 411 and the registration answer means 412 are provided for registering the associative word pair data set 352.

As shown in FIG. 4, the asking means for registration 411 and the answering means for registration 412 use the associative setting screen 44 to register an associative word pair. The association setting screen 44 displays the user ID
A display frame 441, a reference word display field 442, an associative word A input field 443, an associative word B input field 444, an associative word input message 445, a completion button 446, and a cancel button 447 are provided.

The registration interrogating means 411 receives a predetermined number (for example, 5
Word), and each reference word is referred to as a reference word display field 442.
To prompt the user 5 to input an associated word. The answering means for registration 412 receives an associative word (two words) associated with each reference word by the user 5, and inputs the two associative words input into the associative word A input field 443 and the associative word B input field 444. Registration means 32
And let it be registered in the associative word pair data set 352.

The registration interrogating means 411 may list a plurality of reference words in the reference word display field 442 in advance and accept the input to each of the associative word A input field 443 and the associative word B input field 444. The reference word is displayed in the reference word display field 442, and the corresponding associative word A is displayed.
When an associative word is input in the input field 443 and the associative word B input field 444, the reference word in the next row may be displayed.

The registration inquiry means 411 allows the user 5 to rewrite the reference word displayed in the reference word display field 442 by overwriting. The registration response means 412 returns the reference word displayed in the reference word display field 442 to the registration means 32 together with the associated word at the time of registration, so that only the reference word selected from the reference word database 36 is registered. Without
The user 5 can set it freely.

The number of associative word pairs to be registered may be set on the system side, but may be set by the user 5 as desired. For example, a format in which registration is repeatedly performed until a specific end symbol is input may be adopted. Regardless of the format, it is desirable that the number of associative word pairs to be registered be larger than the number used for personal authentication.

The authentication routine 42 is started when the user 5 issues an authentication request 52 to the client computer 4, and displays an interactive screen for system login.
A function (not shown) for receiving the input of the user ID 54 and searching the user database 35 for the user information 350 corresponding to the user 5 is provided, and a question means 421 and an answer means 422
It has.

As shown in FIG. 5, a login screen 43 for system login includes a user ID input message 431, a user ID input field 432, and an associative password input message 43.
3, reference word display field 434, answer word input field 435, completion button 43
6, equipped with a cancel button 437.

When the login screen 43 is displayed, first, a user ID input message 431, a user ID input field 432,
A completion button 436 and a cancel button 437 are displayed. When the user 5 inputs his / her user ID in the user ID input field 432 and presses the completion button 436, the process proceeds to the next stage. If the cancel button 437 is pressed, the processing is stopped at that point.

As the next stage of the user ID input, an associative password input message 433, a reference word display field 434, an answer word input field 435, a completion button 436, and a cancel button 437 are displayed. When the user 5 looks at the reference word display field 434 and inputs an answer word associated therewith in the answer word input field 435 and presses the completion button 436, the process proceeds to the next stage. Cancel button 437
If you press, the process is stopped at that point.

Here, in the reference word display field 434, a plurality of reference words are displayed as a continuous character string. For example, "Kyoto"
If it is four reference words "sea""mountain""development",
It is displayed as a continuous character string "Kyoto Seamount Development". Also, each answer word input by the user 5 is displayed (echo back) as a continuous character string in the answer word input field 435. For example, if the answer words corresponding to the above-described reference words are input as "old city", "surfing", "river", and "insufficient sleep", they are displayed as a continuous character string of "old city surfing river lacking sleep".

Returning to FIG. 1, the display of the reference word and the input processing of the answer word on the login screen 43 are executed by the question means 421 and the answer means 422 of the authentication routine 42.
The query means 421 searches the user information 35 corresponding to the user 5 by using the above-described selection means 33, selects a predetermined number of associative word pairs 3520 from the associative word pair data set 352, and The words are linked and displayed in the reference word display field 434.

The answer means 422 allows the user 5 to input an answer word using the Japanese input function of the client computer 4 (such as kana-kanji conversion software). In this input, the answer word input field 435 may be directly used as a character input buffer to actually input a series of character strings.
Specifically, the associative word pair 3520 previously selected by the selection means 33
, The associated words (two) corresponding to each reference word may be read, and it may be checked whether any of them is included in the answer word character string and corresponds to the order presented as the reference word. These can be processed using a general character string manipulation function.
On the other hand, as an internal process, the answer words input by the user 5 may be sequentially recorded in a plurality of answer word buffers, and only the display in the answer word input field 435 may be continued. In performing such processing, the answering unit 422 needs to be able to individually identify the answer words by inputting a word end code or the like for each answer word.

FIG. 6 shows a flow of processing at the time of user registration. The user 5 who desires user registration issues a user registration request from the client computer 4 (process S0
1). In the client computer 4, the registration routine 41
Is started (process S02) and the registration screen is displayed (process S
03). The user 5 inputs necessary items according to the registration screen (process S04). The client computer 4 issues a user registration request to the server computer 3, and transfers the input information of the user 5 (process S05). Upon receiving the user registration request, the server computer 3 activates the registration means 32 (process S06). The registration means 32 sets new user information 350 identified by the new user ID (processing S07), reads a predetermined number of reference word candidates from the reference word database 36 (processing S08), and registers the client computer 4. Is sent to the inquiry means 411 (process S09).

In the client computer 4, the registration inquiry means 411 displays a predetermined number of reference word candidates on the screen (processing S
09) On the other hand, the user 5 inputs two associated words associated with each reference word from each reference word (process S10). The inputted associative word is processed by the registration answering means 412, and an associative word registration request is issued to the server computer 3 (process S11). In the server computer 3, a reference word pair is generated by the registration means 32 by pairing each reference word and two associated words inputted by the user 5 for each reference word, and stored in the storage means 31 as a reference word pair data set 352. (Step S12). When the above processing is completed, the user ID set to the registration completion is displayed on the client computer 4, and further, a notice of the login operation from the next time is displayed (processing S13).

FIG. 7 shows a flow of personal authentication processing at the time of system login. The user 5 who wants to log in issues a log-in request from the client computer 4 (process S21). In the client computer 4, an authentication routine 42 is started (process S22), and a login screen 43 is displayed.
Is displayed (process S23). The user 5 inputs a user ID according to the screen display (process S24). The client computer 4 issues an authentication request to the server computer 3 and transfers the input user ID (process S25). In the server computer 3 receiving the authentication request, the selection means 33
Thereby, the user database 35 of the storage means 31 is checked, and the user information 350 corresponding to the transferred user ID is searched (process S26). Here, the corresponding user ID
Is determined (step S27), and if not, a request for re-input or a recommendation message for registration as a new user is displayed (step S28). If there is a corresponding user ID, the corresponding user information 350 is selected, and a predetermined number of associated word pairs 3520 are selected from the associated word pair data set 352 (step S29). Then, a reference word is taken out from each associative word pair 3520, a continuous character string is synthesized (process S30), and sent to the client computer 4.

In the client computer 4, the sent reference word character string is displayed on the screen (process S31), and in response to this, the user 5 continuously inputs answer words associated with himself from each reference word (process S32). The input answer word character string is transferred to the server computer 3 (process S33). In the server computer 3, the associative word corresponding to each reference word is extracted from the associative word pair by the selecting means 33, and the correctness of the answer word included in the answer word character string transferred by the determining means 34 is evaluated (processing). S34). Here, if the answer word included in the answer word character string corresponds to the presented reference word and is in the order of the reference word (process S35), login processing is performed as authentication OK (process S35). (S36), the display is performed on the client computer 4 (processing S37). On the other hand, if the answer word is not correct, an authentication rejection display is made (process S38).

According to this embodiment, the following effects can be obtained. The user 5 answers the answer word to the specific reference word 3521 based on the preset associative word pair 3520.
The answer word is based on the association based on the association peculiar to the user himself, and gives substantially the same result as the associative words 3522 and 3523 previously set in the associative word pair. Therefore, if the answer word matches the associative word, it can be determined that the person is the person. This avoids forgetting such as passwords with abstract numbers and character strings.

Further, a plurality of associative word pairs 3520 are set in advance, and a plurality of reference words are presented in the authentication by changing the order. If the user is correct, the association result for each reference word is almost the same regardless of the arrangement. For this reason, even if the input of the answer word of the user 5 is spoofed by another person's eavesdropping or eavesdropping, this is an answer word for a specific reference word sequence, and does not form a correct associative word. Thus, impersonation of another person due to eavesdropping or eavesdropping can be avoided.

The associative word pair 3520 includes a plurality of associative words 3522 and 3523 with respect to the reference word 3521. If the answer word from the user 5 matches any of the associative words, the user is determined to be the user. Even if the user's association changes and deviates from the first candidate and matches the second candidate, the identification accuracy can be improved even in the case of collation that includes the ambiguity of association.

Since the reference word 3521 and the associative words 3522 and 3523 are each a two-byte code, they generally have a meaning compared to a one-byte code such as an alphabet or a number, and are more effective as meanings as associative words. It is.

Since the reference words are presented to the user 5 as a plurality of continuous character strings, for example, even if the original registration is the reference words "sea" and "bottom", the display becomes "sea bottom".
It is difficult to determine a break even if another person who tries to gain unauthorized authentication attempts to answer by impersonating the person.
On the other hand, the person himself / herself can identify that the reference words are "sea" and "bottom" from the memory or the like at the time of the setting operation of the associative word, and can correctly input the answer word associated with each. This can further enhance the protection against unauthorized authentication by another person.

Since a plurality of answer words are input as a continuous character string, for example, even if the answer words are classified into "Taihei", "Offshore", and "Land", the input screen displays "Pacific landing". Is done. For this reason, even if another person who tries to gain unauthorized authentication attempts wiretapping and eavesdropping, it is difficult to store in a short time due to the long character string length. Also, since the break is unknown, it is difficult to correctly answer when the order is changed by storing "Pacific", "landing", and the like. In other words, by searching for a combination of “Taihei”, “Offshore” and “Land” and a combination of “Pacific” and “Landing”, the possibility of accidentally reaching the correct answer is significantly reduced. This can further enhance the protection against unauthorized authentication by another person.

A plurality of associative word pairs 3520 are stored in the storage means 31 and one of the associative word pairs is selected by the selecting means 33 in an arbitrary order, so that the associative reference words are presented in an arbitrary order. It is suitable to do. In addition, when the reference word is presented and when the comparison is made with the answer word, the common associative word pair can be understood by referring to the selecting means 33, so that the processing can be simplified.

It is desirable that the number of associative word pairs stored in the storage means 31 is set to be larger than the number of reference words presented to the user by the selection means 33. By doing so, only some of the preset associative word pairs are used for actual authentication. That is, at the time of authentication, not only the order of the reference words is changed, but also the presented reference words themselves are changed. This can further enhance the protection against impersonation by others.

Since the selecting means 33 sets the order of the associative word pairs by random number generation, the possibility that the order of the reference words becomes the same can be reduced, thereby further improving the protection against impersonation by others. However, the selecting means 33 may shift the order of the associative word pair selected last time by a predetermined number to a new order, so that a certain degree of relevance can be left and the user can easily answer.

The registration means 32 for associating the user 5 with an associative word with respect to a predetermined reference word to generate a plurality of associative word pairs and register them in the storage means 31 is provided. You can set it yourself and eliminate the possibility of being known to others.

The registration means 31 selects an arbitrary reference word from a large number of reference words stored in the reference word database 36 in advance, presents the reference word to the user 5, and allows the user 5 to input a corresponding associative word. The user can register a predetermined number of reference word pairs simply by answering the reference words sequentially presented at the time of registration, which simplifies the processing.

However, at the time of registration, the presented reference word is overwritten by the user 5 with an arbitrary reference word so that the reference word and the corresponding associative word can be registered. Can be set, making it more difficult for others to impersonate.

The storage means 31 stores a plurality of sets of a plurality of associative word pairs 3520 as user information 350 for each user, and the selection means 33 stores a user ID which is identification information for specifying each user.
Since an associative word pair corresponding to the user is selected based on D, the processing can be reliably performed even when the system supports a large number of users such as network login.

[0074]

According to the present invention, if the answer word and the associative word match, it is possible to determine that the user is the person himself / herself. Because a plurality of reference words are presented by changing the order, etc., even if another person eavesdrops or eavesdrops on the input of the user's answer word,
This is an answer word for a specific reference word sequence, does not form a correct associative word, and can prevent impersonation of another person by eavesdropping or eavesdropping.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an entire system according to an embodiment of the present invention.

FIG. 2 is a schematic diagram showing a data structure of a reference word database of the embodiment.

FIG. 3 is a schematic diagram showing a data structure of an associative word pair data set of the embodiment.

FIG. 4 is a schematic view showing an association setting screen according to the embodiment.

FIG. 5 is a schematic view showing a login screen according to the embodiment.

FIG. 6 is a flowchart showing user registration of the embodiment.

FIG. 7 is a flowchart showing login of the embodiment.

[Description of Signs] 30 Personal authentication server 31 Storage means 32 Registration means 33 Selection means 34 Judgment means 350 User information for each user 351 User ID which is user identification information 352 Associative word pair data set 3520 Associative word pair 3521 Reference word 3522, 3523 Associative Words

Claims (15)

[Claims] 1. A personal authentication method for authenticating that an operator is a legitimate user, comprising an associative word including a predetermined reference word and an associative word associated with the reference word by the user. A plurality of pairs are set, and at the time of authentication, any one of the associative word pairs is presented to the user in an arbitrary order, and the user is allowed to input an answer word associated with the presented reference word, A personal authentication method characterized in that a person is determined to be a person based on a match between the input answer word and an associative word corresponding to the presented reference word. 2. An individual authentication system for authenticating that an operator is a valid user, wherein the personal authentication system includes a predetermined reference word and an associative word associated with the user with respect to the reference word. Question means for presenting any of the plurality of associative word pairs to the user in an arbitrary order, and answer means capable of inputting an answer word associated with the presented reference word by the user. Personal authentication system characterized by that. 3. The personal authentication system according to claim 2, further comprising: a determination unit that determines that the user is a principal based on a match between the answer word input to the answer unit and the associated word corresponding to the presented reference word. A personal authentication system characterized by comprising: 4. The personal authentication system according to claim 3, wherein the associative word pair includes a plurality of associative words with respect to a reference word, and the determination unit determines that an answer word from the user is any of associative words. A personal authentication system characterized by determining that the user is who he or she is when he or she matches. 5. The personal authentication system according to claim 2, wherein each of the reference word and the associative word is a 2-byte code. 6. A personal authentication system according to claim 2, wherein a plurality of said reference words are presented to said user as a continuous character string. . 7. The personal authentication system according to claim 2, wherein a plurality of the answer words are input as a continuous character string. 8. The personal authentication system according to claim 2, wherein the storage unit stores a plurality of the associative word pairs, and the associative word pair stored in the storage unit. Selecting means for selecting any one in an arbitrary order, wherein the interrogating means presents to the user a reference word included in the associative word pair selected by the selecting means. system. 9. The personal authentication system according to claim 8, wherein the number of associative word pairs stored in said storage means is set to be greater than the number of reference words presented by said selection means to said user. Personal authentication system characterized in that there is. 10. The personal authentication system according to claim 8, wherein said selection means sets the order of associative word pairs by generating random numbers. 11. The personal authentication system according to claim 8, wherein said selecting means shifts the order of the previously selected associative word pair by a predetermined number to a new order. Characteristic personal authentication system. 12. The personal authentication system according to claim 2, wherein the user associates an associated word with a predetermined reference word to generate a plurality of associated word pairs. A personal authentication system comprising a registration unit for registering in a storage unit. 13. The personal authentication system according to claim 12, wherein said registration means selects an arbitrary reference word from a large number of reference words stored in advance and presents the reference word to said user. A personal authentication system characterized by inputting words. 14. The personal authentication system according to claim 12, wherein said registration means causes said user to input an arbitrary reference word and an associated word corresponding thereto. 15. The personal authentication system according to claim 8, wherein said storage means stores a plurality of sets of said plurality of associative word pairs for each of said users, and said selection means. Selects the associative word pair corresponding to the user based on the identification information specifying the user.