JP2003085498A - System and method for identifying individual, portable information terminal, portable identification medium, identification device and storage medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve security and operability by permitting a user to input data on a portable terminal in an individual identification system where original confirmation information is transmitted without contact. SOLUTION: The user inputs the original confirmation information on the portable terminal. An identification device identifies an individual based on the original confirmation information inputted to the portable terminal and individual identification information stored in a portable identification medium. A user interface to which the original confirmation information is inputted and an original identification function are physically separated. Thus, an original confirmation operation can be performed while the portable identification medium is stored in a purse or a bag, convenience improves and the danger of the robbery and loss of the portable identification medium reduces.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a personal authentication technique for identifying a person, and more particularly to a personal authentication system and a personal authentication system for wirelessly transmitting personal authentication information of a user to a personal authentication device. The present invention relates to an authentication method, a mobile information terminal, a mobile authentication medium, an authentication device, and a storage medium.

More specifically, the present invention relates to a personal authentication system and a personal authentication method, a personal digital assistant, a mobile authentication medium, an authentication device, and a storage medium, in which the user inputs personal identification information. In particular, the present invention relates to a personal authentication system and a personal authentication method, a mobile information terminal, a mobile authentication medium, an authentication device, and a storage medium that allow a user to input personal identification information with good operability and safety.

[0003]

2. Description of the Related Art Personal authentication for identifying a person has been widely used in various industries for a long time, and is an essential procedure that has deeply penetrated into daily life.

In addition, in recent years when information processing and information communication technology have advanced to a high degree, there are increasing opportunities to connect a plurality of devices to share and exchange data and to collaborate between remote places. There is. The combination of devices that connect to each other is not fixed and spans many. Therefore, in order to prevent information leakage and illegal use due to so-called “spoofing”, an authentication procedure for confirming the identity of the user has been widely adopted.

For example, when using a cash card in a bank or other financial institution, the cash
Authentication is performed by entering the password and password with a dispenser. Personal authentication is used to input a security code in a safety box installed in a hotel or other accommodation facility, to input a password when logging in to a computer, or to keep information on an information terminal confidential.

Recently, a contactless IC card or I
Mobile authentication media such as C chips are becoming widespread, and IC
By storing user information for personal authentication on the chip, it can be used for personal authentication by wireless communication. For example, an IC card reader / writer installed at a cash dispenser, an entrance / exit of a concert hall, a ticket gate at a station, or the like can access an IC card held by a user without contact. In addition, such a portable authentication medium is used as a portable telephone or a PDA (Personal Digital A
ssistant), wearable devices, and other portable terminals improve convenience in terms of user input operations and information processing for personal identification.

For example, Japanese Unexamined Patent Publication No. 11-262061 discloses a wristwatch type portable device capable of wirelessly transmitting personal identification information to an external device to perform personal authentication. That is, a wristwatch is equipped with a wireless communication means for personal identification ID code, and communication setting is performed by a combination of an ID transmitter and a communication terminal. Also, on the service network side,
By providing the database management function for the correspondence between the personal identification ID and the terminal identification ID, the user can freely change the other terminal or rental terminal of the moving destination and communicate by simply wearing the wristwatch. Communication charges can be charged according to the ID.

In such a case, the user of the terminal does not need to perform a special operation for personal authentication and can easily perform personal authentication.

For example, by inputting personal identification information (personal identification number, password, biometric information, etc.) on the mobile terminal, it is confirmed that the owner is the owner, and user information stored in the mobile terminal is personally authenticated. Personal authentication can be performed by transmitting to the device.

However, if a means for inputting the personal identification information is provided in the mobile terminal itself for performing the authentication processing, if the mobile terminal is stored in a place where it is difficult to take out, such as in a purse or the back of a bag, take it out one by one. It is troublesome to operate.

If the portable terminal is stored in a place where it can be easily taken out or is frequently taken in and out, there is a high possibility that the portable terminal will be stolen or lost, and there is a possibility that it will be illegally used by another person.

[0012]

SUMMARY OF THE INVENTION An object of the present invention is to provide an excellent personal authentication system and personal authentication method which can suitably perform personal authentication by wirelessly transmitting personal authentication information held by a user to a personal authentication device. , A portable information terminal, a portable authentication medium, an authentication device, and a storage medium.

A further object of the present invention is to provide an excellent personal authentication system and personal authentication method, which can suitably perform personal authentication by the user inputting personal identification information.
A portable information terminal, a portable authentication medium, an authentication device, and a storage medium are provided.

A further object of the present invention is to provide an excellent personal authentication system and personal authentication method, a portable information terminal, a portable authentication medium, an authentication device, which allows a user to input personal identification information with good operability and safety. Another object is to provide a storage medium.

[0015]

The present invention has been made in consideration of the above problems, and a first aspect thereof is a personal authentication system for performing an authentication process based on personal authentication information. , Providing a user with an operating environment for inputting personal identification information, and personal authentication with a portable information terminal that generates and outputs personal authentication prerequisite information including the input personal identification information, and personal authentication with the authentication device A mobile authentication medium that holds personal authentication information for processing and outputs personal authentication information after the user's identity is confirmed using the personal identification information included in the personal authentication prerequisite information received from the portable information terminal, and A personal authentication system, comprising: an authentication device that removes usage restrictions on a mobile information terminal through personal authentication processing using personal authentication information received from a mobile authentication medium. That.

However, the term "system" as used herein refers to a logical assembly of a plurality of devices (or functional modules that realize a specific function), and each device and functional module have a single housing. It does not matter whether it is in the body or not.

A second aspect of the present invention is a personal authentication method in which the personal identification is physically separated from the personal identification processing, and the personal identification information is input by the user on the portable information terminal. A step of transferring the personal authentication prerequisite information including the personal identification confirmation information from the portable information terminal to the mobile authentication medium, and the identity of the user using the personal identification information included in the personal authentication prerequisite information on the mobile authentication medium. In response to the step of confirmation processing and the success of the identity verification,
Transmitting personal authentication information from the portable authentication medium to the authentication device to perform personal authentication processing; and releasing the use restriction of the authentication device for the user in response to successful personal authentication processing. The personal authentication method is characterized by being provided.

According to the personal identification system of the first aspect of the present invention or the personal identification method of the second aspect of the present invention, the user inputs the personal identification information on the portable information terminal. The personal identification is performed on the mobile authentication medium, and personal authentication is performed on the authentication device based on the personal authentication information transmitted from the mobile authentication medium. That is, by physically separating the user interface for inputting the personal identification information and the personal authentication function, the personal identification operation can be performed while the mobile authentication medium is stored in the wallet or bag, which increases convenience and The risk of theft or loss of mobile authentication media is reduced.

Here, it is preferable that data is transmitted and received between the portable information terminal, the portable authentication medium, and the authentication device by wireless cryptographic communication.

Further, the personal authentication may be canceled in response to a lapse of a predetermined time after the connection between the portable authentication medium and the authentication device is disconnected.

As the personal identification information, a personal identification number or biometric information obtained from the user's body or a part thereof may be used. The biometric information mentioned here includes unique information for each user, such as a fingerprint, an iris, a retinal blood vessel pattern, and a vein pattern.

A third aspect of the present invention is a portable information terminal for inputting a person's confirmation physically separated from personal authentication processing by a portable authentication medium, and transmitting / receiving data to / from an external device. Transmitting / receiving means, user input means for the user to input the personal identification information, and personal authentication prerequisite information generating means for generating personal authentication prerequisite information including the personal identification information input via the user input means. And a means for transmitting the generated personal authentication prerequisite information to the portable authentication medium via the transmitting / receiving means, the portable information terminal.

Here, it is preferable that the transmitting / receiving unit transmits / receives data to / from an external device by wireless cryptographic communication.

Further, the user input means receives a user input of a personal identification number as the personal identification information, and the personal authentication prerequisite information generating means includes the input personal identification number as personal identification information in the personal identification prerequisite information. May be.

Alternatively, the user input means acquires biometric information from the user's body or a part thereof, and the personal authentication prerequisite information generation means verifies the biometric information of the user or characteristic data extracted from the biometric information. The information may be included in the personal authentication prerequisite information as information.

A fourth aspect of the present invention is a portable authentication medium for performing a personal authentication process with a predetermined authentication device according to personal authentication prerequisite information from a portable information terminal, and transmitting / receiving data to / from an external device. A transmitting and receiving means, a personal identification means for performing personal identification based on the personal identification information contained in the personal authentication prerequisite information received from the portable information terminal, a personal authentication information holding means for holding the personal authentication information of the user, Personal authentication information transmission control means for transmitting the personal authentication information held in the personal authentication information holding means to the authentication device in response to the success of the personal identification by the personal identification means.
It is a portable authentication medium characterized by comprising:

Here, it is preferable that the transmitting / receiving unit transmits / receives data to / from the portable information terminal and the authentication device by wireless cryptographic communication.

The personal identification information is a personal identification number, and the personal identification confirmation means stores the personal identification number included in the personal authentication prerequisite information received from the portable information terminal in advance, which is the personal identification number of the authentic user. May be collated with.

Alternatively, the personal identification information is biometric information acquired from the user's body or a part thereof, and the personal identification means is biometric information included in the personal authentication prerequisite information received from the portable information terminal or The characteristic data,
The biometric information of the authentic user or the characteristic data thereof stored in advance may be collated.

A fifth aspect of the present invention is an authentication device for performing personal authentication with a portable authentication medium, the transmitting / receiving means for transmitting / receiving data to / from an external device, and the receiving device from the portable authentication medium. Personal authentication processing means for performing personal authentication by using the personal authentication information, and use restriction control means for releasing the use restriction for the user in response to the success of the personal authentication processing. Authentication device.

Here, it is preferable that the transmitting / receiving means transmits / receives data to / from an external device by wireless cryptographic communication.

Further, the use restriction control means may release the personal authentication for the user in response to a lapse of a predetermined time from the disconnection with the portable authentication medium.

A sixth aspect of the present invention is a personal authentication system for performing authentication processing based on personal authentication information, providing an operating environment for inputting personal identification information to a user, After confirming the identity of the user using the entered identity verification information, a personal digital assistant for generating and outputting personal authentication prerequisite information and personal authentication information for personal authentication processing with the authentication device are held, and A mobile authentication medium that outputs personal authentication information according to the personal authentication prerequisite information received from the mobile information terminal, and an authentication that releases the use restriction for the mobile information terminal through a personal authentication process using the personal authentication information received from the mobile authentication medium. A personal authentication system comprising: a device.

Further, a seventh aspect of the present invention is a personal authentication method in which the personal identification is physically separated from the personal identification processing, and the personal identification information is input by the user on the portable information terminal. Steps, a step of performing identity verification processing of the user using the identity verification information on the mobile information terminal, and transferring the personal authentication prerequisite information from the mobile information terminal to the mobile authentication medium in response to the successful identity verification. Steps to
According to the personal authentication prerequisite information, a step of transmitting the personal authentication information from the portable authentication medium to the authentication device to perform the personal authentication process; And a canceling step, which is a personal authentication method.

According to the personal identification system of the sixth aspect of the present invention or the personal identification method of the seventh aspect of the present invention, the user inputs the personal identification information on the portable information terminal to carry the personal identification information. The identity verification is performed on the information terminal, and the authentication device performs personal authentication based on the personal authentication information transmitted from the portable authentication medium. That is, by physically separating the user interface for inputting the personal identification information and the personal authentication function, the personal identification operation can be performed while the mobile authentication medium is stored in the wallet or bag.
This increases convenience and reduces the risk of theft or loss of portable authentication media.

Here, it is preferable that data is transmitted and received between the portable information terminal, the portable authentication medium, and the authentication device by wireless cryptographic communication.

Further, the personal authentication may be canceled in response to a lapse of a predetermined time after the connection between the portable authentication medium and the authentication device is cut off.

As the personal identification information, a personal identification number or biometric information obtained from the user's body or a part thereof can be used.

The eighth aspect of the present invention is a portable information terminal for inputting a person's confirmation physically separated from personal authentication processing by a portable authentication medium, and transmitting / receiving data to / from an external device. Succeeding in the personal identification, the transmitting / receiving means, the user inputting means for the user to input the personal identification information, the personal identification means for performing the personal identification using the personal identification information input via the user inputting means. In response to the request, personal authentication prerequisite information generating means for generating personal authentication prerequisite information, and means for transmitting the generated personal authentication prerequisite information to the portable authentication medium via the transmitting / receiving means. It is a portable information terminal characterized by the above.

Here, it is preferable that the transmitting / receiving means transmits the personal authentication prerequisite information to the portable authentication medium with a digital signature by wireless cryptographic communication.

Further, the user input means receives the user input of the personal identification number as the personal identification information, and the personal identification means compares the personal identification number input by the user with the personal identification number of the authentic user stored in advance. You may do it.

Alternatively, the user input means acquires biometric information from the user's body or a part thereof, and the personal identification means stores in advance the biometric information input by the user or the characteristic data extracted from the biometric information. It may be possible to collate with the characteristic data of the authentic user or the biometric information thereof.

The ninth aspect of the present invention is a portable authentication medium for performing a personal authentication process with a predetermined authentication device according to personal authentication prerequisite information from a portable information terminal, and transmitting / receiving data to / from an external device. The personal authentication information holding means for holding the personal authentication information of the user, and the personal authentication information held in the personal authentication information holding means according to the personal authentication prerequisite information received from the portable information terminal. And a personal authentication information transmission control means for transmitting the personal authentication information to the authentication device.

Here, the transmitting / receiving means transmits / receives data to / from an external device by wireless cryptographic communication,
It is preferable to confirm the electronic signature received from the portable information terminal.

Further, it is preferable that the transmitting / receiving means transmits the personal authentication information with an electronic signature to the authentication device by wireless cryptographic communication.

The tenth aspect of the present invention is a personal authentication system for performing authentication processing based on personal authentication information, providing an operating environment for inputting personal identification information to a user, and Personal information received from the portable information terminal, which holds personal authentication information for personal authentication processing between the portable information terminal that generates and outputs personal authentication prerequisite information including the input personal identification information and the authentication device. A mobile authentication medium that outputs personal authentication information that includes personal identification information included in the prerequisite information, and a user identification and personal authentication processing that uses the personal identification information that is included in the personal authentication information received from the mobile authentication medium. A personal authentication system comprising: an authentication device that releases a use restriction on the portable information terminal.

The eleventh aspect of the present invention is a personal authentication method in which personal identification is physically separated from personal identification processing, and personal identification information is input by a user on a portable information terminal. Transferring personal authentication prerequisite information including the personal identification information from the mobile information terminal to the mobile authentication medium, and personal authentication information including the personal identification information from the mobile authentication medium according to the personal authentication prerequisite information. Transferring to the authentication device, performing a user identity confirmation process using the identity verification information included in the personal authentication information on the authentication device, and transmitting the personal authentication information in response to the successful identity verification And performing the personal authentication process, and releasing the use restriction of the authentication device for the user in response to the success of the personal authentication process. It is the personal authentication method comprising.

According to the personal identification system of the tenth aspect of the present invention or the personal identification method of the eleventh aspect of the present invention, while the user inputs the personal identification information on the portable information terminal, The authentication device performs personal authentication based on the personal authentication information transmitted from the portable authentication medium. That is, by physically separating the user interface for inputting the personal identification information and the personal authentication function, the personal identification operation can be performed while the mobile authentication medium is stored in the wallet or bag, which increases convenience and The risk of theft or loss of mobile authentication media is reduced.

Here, it is preferable that data is transmitted and received between the portable information terminal, the portable authentication medium, and the authentication device by wireless cryptographic communication.

Further, the personal authentication may be canceled in response to a lapse of a predetermined time after the connection between the portable authentication medium and the authentication device is disconnected.

As the personal identification information, a personal identification number or biometric information obtained from the user's body or a part thereof can be used.

Further, a twelfth aspect of the present invention is that a computer software written so as to execute on a computer system an individual authentication process for physically confirming the individual separately from the individual authentication process. A storage medium physically stored in a readable format, wherein the computer software carries a personal authentication prerequisite information containing the personal identification information including a step of inputting personal identification information by a user on a portable information terminal. In response to the step of transferring from the information terminal to the mobile authentication medium, the step of performing the identity verification process of the user using the identity verification information included in the personal authentication prerequisite information on the mobile authentication medium, and responding to the successful identity verification. The step of performing personal authentication processing by transmitting the personal authentication information from the portable authentication medium to the authentication device, and the success of the personal authentication processing. In response, a storage medium characterized by comprising the step of releasing the restriction of the use of the authentication device for the user, the.

Further, a thirteenth aspect of the present invention is a computer software which is written so as to execute on a computer system a personal authentication process for physically confirming the identity separately from the personal authentication process. A storage medium physically stored in a readable format, wherein the computer software includes a step of inputting personal identification information by a user on a mobile information terminal, and a user using the personal identification information on the mobile information terminal. Step of performing personal identification confirmation processing, transferring personal authentication prerequisite information from the portable information terminal to the portable authentication medium in response to successful identification confirmation, and authenticating the portable authentication medium from the portable authentication medium according to the personal authentication prerequisite information. The step of performing personal authentication processing by sending personal authentication information to A storage medium characterized by comprising the step of releasing the restriction of the use of the authentication apparatus, the.

Further, a fourteenth aspect of the present invention is that a computer software written so as to execute on a computer system a personal authentication process for physically confirming the identity separately from the personal authentication process. A storage medium physically stored in a readable format, wherein the computer software carries a personal authentication prerequisite information containing the personal identification information including a step of inputting personal identification information by a user on a portable information terminal. Transferring from the information terminal to the portable authentication medium, the personal authentication information including the personal identification information from the portable authentication medium to the authentication device according to the personal authentication prerequisite information, and the personal authentication information on the authentication device. In response to the step of performing the user identity verification process using the identity verification information included in A memory comprising: a step of performing personal authentication processing using personal authentication information; and a step of releasing a use restriction of the authentication device for the user in response to the success of the personal authentication processing. It is a medium.

The storage medium according to each of the twelfth to fourteenth aspects of the present invention provides computer software in a computer-readable format to a general-purpose computer system capable of executing various program codes, for example. It is a medium. Such a medium is, for example, a CD (Comp
act Disc), FD (Floppy Disc), MO (Magneto-Opt)
ical disc) is a removable and portable storage medium. The storage medium mentioned here may be realized not only as a package medium but also as a semiconductor memory or a magnetic disk in which a program is temporarily or permanently stored.
Alternatively, it is technically possible to provide computer software to a specific computer system via a transmission medium such as a network (whether the network is wireless or wired).

Such a program storage medium defines a structural or functional cooperative relationship between the computer software and the storage medium for realizing a predetermined computer software function on a computer system. It is a thing. In other words, the twelfth to first aspects of the present invention
By installing predetermined computer software in the computer system via the storage medium according to each of the four aspects, the cooperative action is exerted on the computer system, and each of the first and second aspects of the present invention. Personal authentication system or personal authentication method according to the sixth aspect of the present invention
It is possible to obtain the same operational effects as the individual authentication system or individual authentication method according to the seventh and seventh aspects, or the individual authentication system or individual authentication method according to the tenth and eleventh aspects of the present invention.

Further objects, features and advantages of the present invention are as follows.
It will be clarified by a more detailed description based on embodiments of the present invention described below and the accompanying drawings.

[0058]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below in detail with reference to the drawings.

First Embodiment: FIG. 1 shows a first embodiment of the present invention.
1 schematically shows the overall configuration of the personal authentication system according to the exemplary embodiment. As shown in the figure, the personal authentication system includes an authentication device 3 that authenticates a user individually, and personal authentication information (user ID, etc.) held for each user who needs personal authentication. At the same time, it is composed of a portable authentication medium 2 that can be transmitted, and a portable information terminal 1 that provides a user interface for performing a personal authentication operation (release of usage restrictions) on the authentication device 3.

A user who needs personal authentication uses the portable authentication medium 2 and the portable information terminal 1 in combination. In addition,
Although not shown in order to prevent the drawing from becoming complicated, usually, a large number of sets of mobile authentication media 2 and mobile information terminals 1 can be connected to one authentication device 3.

The authentication device 3 is, for example, an ATM (Automatic Te) that allows the start of a predetermined processing procedure through personal authentication.
ller Machine) and other terminal devices.

The portable authentication medium 2 is composed of an IC card, a memory stick, a wearable device or the like, and is not particularly limited as long as it can transmit personal authentication information by wireless communication and is convenient to carry.

The mobile information terminal 1 is a mobile phone or P
DA (Personal Digital Assistant), notebook,
It is composed of a highly portable device, such as a computer, which can be carried by a user and provides a user interface for performing a user input operation.

The operation of the portable information terminal 1 is totally controlled by the control unit 7. The control unit 7, for example,
RAM (Random) that consists of a microcomputer and is used to load programs and save work data
Access Memory), a ROM (Read Only Memory) for permanently storing a program code and predetermined data (neither is shown). The control unit 7 includes
The operation unit 11, the connection terminal management unit 8, the authentication prerequisite information generation unit 9, and the display 12 are connected by a bus (not shown) or the like to control each unit.

The encryption unit 10 is connected to the encryption key storage unit 15. The encryption key storage unit 15 stores an encryption key E1 for decryption only with the decryption key D1 stored in the decryption key storage unit 24 of the portable authentication medium.

The transmission / reception unit 4 is a functional module for transmitting / receiving data to / from an external device such as the portable authentication medium 2 or the authentication device 3 by wireless communication, and its communicable distance is, for example, about several meters.

The connection terminal management unit 8 manages terminal information regarding the authentication device 3 with which the transmission / reception unit 4 can communicate. When the transmission / reception unit 4 receives the terminal information transmitted from the authentication device 3, the connection terminal management unit 8 stores this in the terminal information storage unit 13.

The terminal information stored in the terminal information storage unit 13 includes the encryption key E2 of the corresponding authentication device 3, and other information such as the name of the authentication device 3 and the service content provided by the authentication device 3. I'm out.

The operation section 11 constitutes a user interface of the portable information terminal 1 together with the display 12. The operation unit 11 includes a unit that selects the terminal device 3 that is the target of personal authentication and a unit that inputs the personal identification information.

The means for selecting the personal authentication destination authentication device 3 is, for example, a selection button. A terminal list is displayed on the display 12 based on the terminal information stored in the terminal information storage unit 13, and the user can select the authentication device 3 that performs personal authentication from the terminal list.

In response to the user's selection of the authentication device 3 as the personal authentication destination, a message prompting the user to enter the personal identification information is displayed on the display 12. The means for inputting the personal identification information is, for example, a ten-key pad, and the user can input the personal identification number as the personal identification information. The input personal identification number is temporarily stored in the personal identification number register 14.

The operation means may be a keyboard so that a password can be input as the personal identification information. Alternatively, the means for inputting the personal identification information may be a biometrics sensor unit (described later) that detects biometric information from the user's body or a part thereof.
The biometric information mentioned here refers to a fingerprint, an iris, a retinal blood vessel pattern, a vein pattern, and the like. When the personal identification information input means is a biometrics sensor unit, the personal identification information input means is further provided with means for extracting characteristic data from the biometric information input to the portable information terminal 1, and the extracted characteristic data is encrypted as personal identification information. You may make it output to the conversion part 10.

The personal authentication prerequisite information generation unit 9 uses the encryption key E of the authentication device 3 selected as the personal authentication destination by the user.
The personal authentication prerequisite information including 2 and the personal identification information input by the user is generated and sent to the encryption unit 10. The generated personal authentication prerequisite information is encrypted by the encryption unit 10 using the encryption key E1 stored in the encryption key storage unit 15, and then transmitted from the transmission / reception unit 4 to the portable authentication medium 2.

The operation of the portable authentication medium 2 is totally controlled by the control unit 16. The control unit 16 is bus-connected to the reception management unit 17, the operator authentication unit 20, and the personal authentication information transmission control unit 18, and controls each unit.

The personal authentication information transmission control unit 18 is connected to the encryption unit 22 and generates information to be transmitted. Also,
The reception management unit 17 is connected to the transmission / reception unit 5 via the decoding unit 21 and manages the received information.

The transmitting / receiving unit 5 is adapted to transmit / receive data to / from an external device such as the portable information terminal 1 or the authentication device 3, and the communicable distance thereof is about several meters. The transmission / reception unit 5 receives the encrypted data from the encryption unit 22 and transmits it to the outside. Further, the encrypted data received by the transmission / reception unit 5 is decrypted by the decryption unit 21.

The decryption unit 21 is connected to the decryption key storage unit 24. The decryption key storage unit 24 stores a decryption key D1 for decrypting the data encrypted with the encryption key E1 stored in the encryption key storage unit 15 of the mobile information terminal 1.

The reception management unit 17 stores the encryption key E2 included in the personal authentication prerequisite information transmitted from the portable information terminal 1 in the encryption key storage unit 23, and the operator inputs the personal identification number included in the personal authentication prerequisite information. Output to the authentication unit 20.

The personal identification number storage unit 25 stores the personal identification number of the authentic owner of the portable authentication medium 2. The operator authenticating unit 20 compares the personal identification number included in the personal identification prerequisite information transmitted from the mobile information terminal 1 with the personal identification number stored in the personal identification number storage unit 25, and confirms whether the two match. . If they match, the personal authentication information transmission control unit 18 permits the transmission of the personal authentication information.

The personal authentication information storage unit 19 stores the personal authentication information including the portable authentication medium 2, that is, the user ID of the cardholder.

The personal authentication information transmission control unit 18 sends the personal authentication information stored in the personal authentication information storage unit 19 to the encryption unit 22.

The encryption key storage unit 23 stores the encryption key E2 for each authentication device for decryption only with the decryption key D2 stored in the decryption key storage unit 31 of the authentication device 3. . The encryption unit 22 is connected to the encryption key storage unit 23, encrypts the personal authentication information received from the personal authentication information transmission control unit 18 using the encryption key E2 corresponding to the destination, and transmits the encrypted data to the transmission / reception unit 5. Output.

Also, the portable authentication medium 2 according to the present embodiment.
Includes mobile communication means (not shown). The portable authentication medium 2 can receive the personal authentication function off signal from the mobile communication means, and the user can use the portable information terminal 1 to identify the individual of the portable authentication medium 2 even if the portable authentication medium 2 is not near the portable authentication medium 2. The authentication function can be turned off.

The authentication device 3 is an ATM (Automatic Tell) that allows the start of a predetermined processing procedure through, for example, personal authentication.
er Machine) and other terminal devices, and the control unit 2
The operation is controlled comprehensively by 6.

The control unit 26 is composed of, for example, a microcomputer, and is a RAM (Random Access Memory) used for loading programs and storing work data.
In addition, a ROM (Read Only Memory) for permanently storing a program code and predetermined data (none of them is shown) is provided. A reception information management unit 27 and a personal authentication unit 29 are connected to the control unit 26 and control each unit.

The reception information management unit 27 is connected to the transmission / reception unit 6 via the decoding unit 28, and manages the data received by the transmission / reception unit 6.

The transmission / reception unit 6 transmits / receives data to / from an external device such as the portable information terminal 1 or the portable authentication medium 2, and its communicable distance is, for example, about several meters. The data received by the transmission / reception unit 6 is decrypted by the decryption unit 28.

The decryption unit 28 is connected to the decryption key storage unit 31. The decryption key storage unit 31 stores a decryption key D2 for decrypting the data encrypted with the encryption key E2.

The personal information storage unit 30 stores at least one user ID of a person who is permitted to use the authentication device 3. Further, setting information for customizing the authentication device 3 for each user who is permitted to use the authentication device 3 may be stored together.

The personal authentication unit 29 searches the personal information storage unit 30 for a user ID that matches the user ID included in the personal authentication information transmitted from the portable authentication medium 2. Then, if found, the user individual corresponding to the user ID is authenticated and the use restriction of the authentication device 3 is released.

When a plurality of records are stored in the personal information storage unit 30 and the authentication device 3 can be used by only one person at a time, while the user of the authentication device 3 is being personally authenticated, It is desirable to lock the function of the personal authentication unit 29.

Further, the personal authentication unit 29 limits the use of the authentication device 3 again when a predetermined time has passed since the last time the authentication information was received (when the unused state is detected).

Next, the operation of the personal identification system shown in FIG. 1 will be described with reference to FIG.

A user who wants to release the use restriction of a certain authentication device 3 brings the portable information terminal 1 and the portable authentication medium 2 he / she own close to the authentication device 3 by a sufficient distance (about several meters). As a result, the transmission / reception units 4, 5, 6 establish a connection between the three parties.

When the user brings the mobile information terminal 1 closer to the authentication device 3 and the mobile information terminal 1 and the terminal device 3 can communicate with each other, the authentication device 3 transmits the terminal information to the mobile information terminal 1. The terminal information includes the encryption key E2 of the authentication device 3,
In addition, it includes information such as the name of the authentication device 3 and the service content provided by the authentication device 3.

On the portable information terminal 1 side, the received terminal information is stored in the terminal information storage unit 13 by the connection terminal management unit 8. However, when the portable information terminal 1 and the authentication device 3 cannot communicate with each other, the terminal information management unit 8 causes the terminal information storage unit 13 to operate.
The terminal information of the authentication device 3 stored in is deleted.

In the portable information terminal 1, a list of communicable authentication devices 3 is displayed on the display 12 based on the terminal information stored in the terminal information storage unit 13. The user can select, from the list, the authentication device 3 desired to perform personal authentication via the operation unit 11. In response to this user selection operation, the display 12
A message prompting you to enter your PIN is displayed above.

When the user inputs the personal identification number, the personal authentication prerequisite information generation unit 9 generates personal authentication prerequisite information including the encryption key E2 of the authentication device 3 selected by the user and the input personal identification number. This personal authentication prerequisite information is used by the encryption unit 10
After being encrypted by using the encryption key E1, it is transmitted from the transmitting / receiving unit 4 to the portable authentication medium 2.

On the portable authentication medium 2 side, when the encrypted personal authentication prerequisite information is received by the transmission / reception unit 5, the decryption unit 21
Then, it is decrypted using the decryption key D1. Reception management unit 17
Is the encryption key E included in the decrypted personal authentication prerequisite information.
2 is temporarily stored in the encryption key storage unit 23, and the personal identification number also included in the personal authentication prerequisite information is sent to the operator authentication unit 20.

The operator authenticating section 20 compares the received personal identification number with the personal identification number stored in the personal identification number storage section 25, and confirms whether or not they match. If the two do not match, this processing ends. On the other hand, if the two match, the personal authentication information transmission control unit 18
The personal authentication information stored in the personal authentication information storage unit 19 is sent to the encryption unit 22. Then, the encryption unit 22 encrypts this using the encryption key E2 stored in the encryption key storage unit 23, and transmits it from the transmission / reception unit 5 to the corresponding authentication device 3.

On the authentication device 3 side, when the encrypted personal authentication information is received by the wireless transmission / reception unit 6, it is decrypted by the decryption unit 28 using the decryption key D2 and sent to the personal authentication unit 29.

The personal authentication unit 29 searches the personal information storage unit 30 for a record having the same user ID as the user ID included in the personal authentication information. And the same user I
When D is found, the use restriction of the authentication device 3 is released, and various settings of the authentication device 3 are performed based on the settings stored in the record. In addition, the personal information storage unit 30
If a plurality of records are stored in and the authentication device 3 can be used by only one person at a time, the function of the individual authentication unit 29 is locked while the user of the authentication device 3 is individually authenticated.

On the other hand, when the same user ID is not found, this process is terminated without releasing the use restriction.

If communication between the transmitter / receivers 5 and 6 becomes impossible due to the user leaving the authentication device 3 or the like, the connection between them is cut off. The personal authentication unit 29 responds to the elapse of a predetermined time from the last reception of the authentication information, and again limits the use of the authentication device 3.

Second Embodiment: FIG. 2 shows a second embodiment of the present invention.
1 schematically shows the overall configuration of the personal authentication system according to the exemplary embodiment. As shown in the figure, the personal authentication system includes one or more authentication devices 103 for authenticating individual users, and personal authentication information (user ID) possessed by each user who needs personal authentication. Etc.) and a portable authentication medium 102 capable of transmitting and holding, and a portable information terminal 101 that provides a user interface for performing a personal authentication operation (releasing use restrictions) for the personal authentication function of the authentication device 103. It

A user who needs personal authentication uses the portable authentication medium 102 and the portable information terminal 101 in combination. Although not shown in order to prevent the drawing from becoming complicated,
Usually, a large number of sets of portable authentication media 102 and portable information terminals 101 can be connected to one authentication device 103.

The authentication device 103 is, for example, an ATM (Automati) that is permitted to start a predetermined processing procedure through personal authentication.
c Teller Machine) and other terminal devices.

The portable authentication medium 102 is composed of an IC card, a memory stick, a wearable device, etc., and is not particularly limited as long as it can transmit personal authentication information by wireless communication and is convenient to carry.

The mobile information terminal 101 is a device such as a mobile phone, a PDA (Personal Digital Assistant), a notebook computer, etc. that can be carried by the user and provides a user interface for user input operation. Composed.

Each authentication device 103, portable authentication medium 102,
The mobile information terminals 101 are wireless communication modules 10 respectively.
6, 105, 104 are provided so that wireless communication can be performed between the wireless communication modules. In addition, these wireless communication modules 106, 105, 104 perform various communication-related processes such as connection establishment / disconnection between specific terminals and encryption of wirelessly transmitted data. The maximum communicable distance by the wireless communication modules 106, 105, 104 is, for example, about 10 m.

The operation of the portable information terminal 101 is totally controlled by the control unit 111. Control unit 111
Is, for example, a microcomputer that is used for loading programs and storing work data.
AM (Random Access Memory), ROM (Read Only) that permanently stores program code and predetermined data
Memory) etc. (none of them are shown). The control unit 111 includes an operation unit 117 and a feature data extraction unit 1
14, the personal authentication prerequisite information generation unit 112, the personal authentication confirmation information management unit 113, the terminal information management unit 115, and the display 116 are connected by a bus (not shown) or the like to control each unit.

The terminal information management unit 115 includes the contactless reception unit 1
It is connected to 07.

The contactless receiver 107 can receive the data transmitted from the contactless transmitter 108 (described later) on the authentication device 103 side, and the communicable distance is several cm.
It is a degree. When the contactless reception unit 107 receives the terminal device information including the device ID and the identity verification flag indicating whether or not the identity verification information needs to be input from the contactless transmission unit 108 of the authentication device 103, the contactless reception unit 107 causes the terminal information management unit 115 to perform the operation. It is designed to output.

The terminal information management section 115 includes the contactless receiving section 1
The device ID included in the terminal information received from 07 is stored in the terminal device ID register 122. In addition, the value of the personal identification flag included in the terminal information is confirmed.

The operation section 117 includes an operation panel 118 for using various functions of the portable information terminal 101, and a biometrics sensor 119 for inputting biometric information from the user's body or a part thereof. . The biometric information input from the biometrics sensor 119 is unique information for each user, such as a fingerprint, a vein pattern, an iris pattern, a voiceprint, and a face image. The biometric information input from the biometrics sensor 119 is temporarily stored in the biometric information register 120.

The feature data extraction unit 114 extracts feature data representing the feature from the biometric information input from the biometrics sensor 119, and temporarily stores it in the feature data register 121. .

The personal authentication prerequisite information generation unit 112 is connected to the wireless communication module 104, and is adapted to generate personal authentication prerequisite information including the device ID stored in the terminal device ID register 122. The generated setting change information is wirelessly transmitted via the wireless communication module 104. When the personal identification flag of the terminal information received from the authentication device 103 is “true”, the characteristic data stored in the characteristic data register 121 is also included in the personal authentication prerequisite information.

The personal authentication confirmation information management unit 113, after the personal authentication is performed in the authentication device 103, the authentication device 10
The personal authentication confirmation information (described later) transmitted from the server 3 is managed.

The operation of the portable authentication medium 102 is totally controlled by the control unit 123. Control unit 123
Is a reception management unit 124 and a personal authentication information transmission control unit 12
6 and the feature data collating unit 125 are connected to the bus to control each unit.

Upon receiving the personal authentication prerequisite information from the portable information terminal 101 via the wireless communication module 105, the reception management unit 124 confirms whether or not the personal authentication prerequisite information includes characteristic data. If the characteristic data is included, it is output to the characteristic data collating unit 125.

In the characteristic data storage unit 128, characteristic data extracted from the biometric information of the authentic user of the portable authentication medium 102 is registered in advance.

The characteristic data collating unit 125 collates the characteristic data included in the personal authentication prerequisite information received from the portable information terminal 101 with the characteristic data registered in the characteristic data storage unit 128, and both are obtained from the same person. It is judged whether it is the feature data. Then, in response to the positive determination result, the personal authentication information transmission control unit 126 permits the personal information transmission process.

The personal authentication information transmission control unit 126 controls the transmission of the personal authentication information stored in the personal authentication information storage unit 129 via the wireless communication module 105.

The authentication device 103 is an ATM (Automatic) that allows the start of a predetermined processing procedure through, for example, personal authentication.
(Teller Machine) and other terminal devices, and the operation is generally controlled by the control unit 131.

The control unit 131 is composed of, for example, a microcomputer, and is used for loading a program and storing work data, RAM (Random Access Memor).
y), a ROM (Read Only Memory) for permanently storing a program code and predetermined data (neither is shown). The personal authentication unit 132 and the non-contact transmission unit 108 are connected to the control unit 131 and control each unit.

The authentication device 103 also includes a personal information database 130. Personal information database 13
0 stores at least one record of a user who is permitted to use the authentication device 103, and at least a user ID is stored in each record. Instead of equipping the authentication device 103 with the personal information database 130, the personal information database 130 can be built on the database server 110 on the network as shown in FIG. In such a case, the authentication device 103 can access the personal information database 130 via the network 109 via the network connection unit 133.

When personal authentication information is received from the portable authentication medium 102 via the wireless communication module 106, the personal authentication section 132 causes the user I included in the personal authentication information.
The user ID that matches D is the personal information database 130.
To search from. Then, when the same user ID is found, the individual user corresponding to the user ID is authenticated, and then the use restriction of the authentication apparatus 103 is released. When a plurality of records are stored in the personal information database 130 and the authentication device 103 can be used by only one person at a time, the personal authentication part 132 is provided while the user of the authentication device 103 is being personally authenticated. It is desirable to lock the function of. In addition, the personal authentication unit 132
When the connection between the mobile authentication medium 102 and the wireless communication modules 105 and 106 of the authentication device 103 is disconnected, the mobile information terminal 101 restricts the use of the authentication device 103 again.

The contactless transmission unit 108 includes the terminal information storage unit 1.
The terminal information stored in 35 is transmitted to the non-contact receiving unit 104 of the portable information terminal 101. The maximum communicable distance between the non-contact transmitter 108 and the non-contact receiver 107 is about several cm.

Next, the operation of the personal authentication system shown in FIG. 2 will be described with reference to FIG.

A user who wants to perform personal authentication with a certain authentication device 103 brings the mobile information terminal 101 and the mobile authentication medium 102 he or she possesses closer to the authentication device 103 by a sufficient distance (about several meters). As a result, each transmitting / receiving unit 10
4, 105 and 106 establish a connection between the three parties.

When the user further brings the portable information terminal 101 closer to the contactless transmission unit 108 of the authentication device 103 (several cm)
Degree), the non-contact receiving unit 107 on the side of the portable information terminal 101
Can receive the terminal information transmitted from the contactless transmission unit 108.

On the side of the portable information terminal 101, the terminal device management section 115 temporarily stores the device ID included in the received terminal information in the terminal device register 122 and confirms the value of the principal confirmation flag.

When the identity confirmation flag is "true", a message prompting the user to input biometric information is displayed on the display 1
16 Display on top. When the user inputs biometric information from the biometrics sensor 119, the feature data extracting unit 114 extracts the feature data from the biometric information and temporarily stores the feature data in the feature data register 121.

After that, the personal authentication prerequisite information generation unit 112
Generates personal authentication prerequisite information including the device ID stored in the terminal device ID register 122 and the feature data stored in the feature data register 121, and transmits the personal authentication medium 102 via the wireless communication module 104. Send to.

On the other hand, when the principal confirmation flag is "false", the biometric information input is omitted. That is, the personal authentication prerequisite information generation unit 112 generates personal authentication prerequisite information including the device ID and transmits it to the mobile authentication medium 102 via the wireless communication module 104.

On the side of the portable authentication medium 102, when the personal authentication prerequisite information is received via the wireless communication module 105,
The reception control unit 124 confirms whether the characteristic data is included in the personal authentication prerequisite information.

When the personal authentication prerequisite information does not include the characteristic data, the personal authentication information transmission control unit 126 reads the personal authentication information stored in the personal authentication information storage unit 129 and uses it as the personal authentication prerequisite information. Device ID included
Then, the personal authentication information is transmitted to the authentication device 103 via the wireless communication module 105.

On the other hand, when the personal authentication prerequisite information includes the characteristic data, the characteristic data collating unit 125 stores the characteristic data included in the personal authentication prerequisite information in the characteristic data storage unit 128 in advance. Match the feature data with Then, when it is determined that the both are characteristic data obtained from the same person, the personal authentication information transmission control unit 126 reads the personal authentication information stored in the personal authentication information storage unit 129, and performs the personal authentication. According to the device ID included in the prerequisite information, the personal authentication information is transmitted to the terminal device 103 via the wireless communication module 105.

On the authentication device 103 side, when the personal authentication information is received via the wireless communication module 106, the personal authentication section 132 accesses the personal information database 130 and matches the user ID included in the personal authentication information. Search for records with user IDs.

The same user ID has the personal information database 1
When found from 30, the individual authentication unit 132 authenticates the user individual corresponding to the user ID, and then releases the use restriction of various functions of the authentication device 103.

Further, the personal authentication unit 132 transmits personal authentication confirmation information to the portable information terminal 101 via the wireless communication module 106 after performing personal authentication. On the side of the portable information terminal 101, when the personal authentication confirmation information is received via the wireless communication module 104, the personal authentication confirmation information management unit 1
After confirming in 13, the user is notified that the authentication device 103 is available by displaying a personal authentication confirmation message on the display 116 or the like.

On the other hand, if the same user ID is not found or personal authentication fails, this process is terminated without releasing the use restriction.

[0143] Further, for example, when the user leaves the authentication device 103, the portable authentication medium 102 and the authentication device 10 are
When the connection between the wireless communication modules 3 is disconnected, the personal authentication unit 132 restricts the use of the authentication device 103 again.

Third Embodiment: FIG. 3 shows a third embodiment of the present invention.
1 schematically shows the overall configuration of the personal authentication system according to the exemplary embodiment. As shown in the figure, the personal authentication system includes an authentication device 203 that authenticates a user individually, and personal authentication information (user ID, etc.) held for each user who needs personal authentication. At the same time, it is composed of a portable authentication medium 202 that can be transmitted and a portable information terminal 201 that provides a user interface for performing a personal authentication operation (release of usage restrictions) for the personal authentication function of the authentication device 203.

A user who needs personal authentication uses the portable authentication medium 202 and the portable information terminal 201 in combination. Although not shown in order to prevent the drawing from becoming complicated,
Normally, a large number of sets of mobile authentication media 202 and mobile information terminals 201 can be connected to one authentication device 203.

The authentication device 203 is, for example, an ATM (Automati) that allows the start of a predetermined processing procedure through personal authentication.
c Teller Machine) and other terminal devices.

The portable authentication medium 202 is composed of an IC card, a memory stick, a wearable device, etc., and is not particularly limited as long as it can transmit personal authentication information by wireless communication and is convenient to carry.

The portable information terminal 201 is a device such as a mobile phone, a PDA (Personal Digital Assistant), a notebook computer, etc. that can be carried by the user and provides a user interface for user input operation. Composed.

The operation of the portable information terminal 201 is totally controlled by the control unit 207. Control unit 207
Is, for example, a microcomputer that is used for loading programs and storing work data.
AM (Random Access Memory), ROM (Read Only) that permanently stores program code and predetermined data
Memory) etc. (none of them are shown). The control unit 207 includes an operation unit 211 and a connection terminal management unit 208.
An authentication prerequisite information generation unit 209 and a display 212
Are connected by a bus (not shown) or the like to control each unit.

The encryption section 210 is connected to the encryption key storage section 215. The encryption key storage unit 215 stores an encryption key E1 for decryption only with the decryption key D1 stored in the decryption key storage unit 224 of the portable authentication medium.

The transmission / reception unit 204 is a functional module for transmitting / receiving data to / from an external device such as the portable authentication medium 202 or the authentication device 203 by wireless communication, and its communicable distance is, for example, about several meters.

The connection terminal management unit 208 includes a transmission / reception unit 204.
Manages terminal information relating to the authentication device 203 that can communicate with. When the transmission / reception unit 4 receives the terminal information transmitted from the authentication device 203, the connection terminal management unit 208 stores this in the terminal information storage unit 213.

The terminal information stored in the terminal information storage unit 213 includes the encryption key E2 of the corresponding authentication device 203,
In addition, it includes information such as the name of the authentication device 203 and the service content provided by the authentication device 203.

The operation section 211 constitutes a user interface of the portable information terminal 201 together with the display 212. The operation unit 211 includes means for selecting the terminal device 203 to be subject to personal authentication, and means for inputting personal identification information.

The means for selecting the authentication device 203 of the personal authentication destination is, for example, a selection button. Terminal information storage unit 213
Based on the terminal information stored in the display 21
A terminal list is displayed on the screen 2, and the user can select the authentication device 203 for personal authentication from the terminal list.

Authentication device 203 of personal authentication destination by user
In response to the selection, the message prompting the user to enter personal identification information is displayed on display 212. The means for inputting the personal identification information is, for example, a ten-key pad, and the user can input the personal identification number as the personal identification information. The input personal identification number is temporarily stored in the personal identification number register 214.

The operating means may be a keyboard so that a password can be input as the personal identification information. Alternatively, the means for inputting the personal identification information may be a biometrics sensor unit that detects biometric information from the user's body or a part thereof. The biometric information mentioned here refers to a fingerprint, an iris, a retinal blood vessel pattern, a vein pattern, and the like. When the personal identification information input means is a biometrics sensor unit, the personal identification information input means is further provided with means for extracting characteristic data from the biometric information input to the portable information terminal 1, and the extracted characteristic data is encrypted as personal identification information. You may make it output to the conversion part 10.

The personal identification number storage section 242 stores the personal digital assistant 2.
The personal identification number of 01 is stored in advance.

The operator authenticating section 241 retrieves the personal identification number input by the user from the personal identification number register 214 and compares it with the personal identification number stored in the personal identification number storage section 242. Then, when they match, the personal authentication prerequisite information generation unit 209 is permitted to generate personal authentication prerequisite information.

The personal authentication prerequisite information generation unit 209 generates personal authentication prerequisite information including the encryption key E2 of the authentication device 203 selected by the user as the personal authentication destination, and sends it to the encryption unit 210. There is. The generated personal authentication prerequisite information is encrypted by the encryption unit 210 using the encryption key E1 stored in the encryption key storage unit 215, and then transmitted from the transmission / reception unit 204 to the portable authentication medium 202.

The operation of the portable authentication medium 202 is totally controlled by the control unit 216. Control unit 216
Is a reception management unit 217 and a personal authentication information transmission control unit 21.
8 is connected to the bus to control each unit.

The personal authentication information transmission control unit 218 is connected to the encryption unit 222 and generates information to be transmitted. Further, the reception management unit 217 is connected to the transmission / reception unit 205 via the decoding unit 221, and manages the received information.

The transmission / reception unit 205 transmits / receives data to / from an external device such as the portable information terminal 201 or the authentication device 203, and the communicable distance is about several meters. The transmission / reception unit 205 receives the encrypted data from the encryption unit 222 and transmits it to the outside. Also, the transmitter / receiver 2
The encrypted data received at 05 is decrypted by the decryption unit 221.

The decryption unit 221 is connected to the decryption key storage unit 224. The decryption key storage unit 224 stores the encryption key E stored in the encryption key storage unit 215 of the portable information terminal 201.
It stores a decryption key D1 for decrypting the data encrypted by 1.

The reception management section 217 is provided for the portable information terminal 201.
Encryption key E2 included in the personal authentication prerequisite information transmitted from
Is stored in the encryption key storage unit 223.

The personal authentication information storage unit 219 stores personal authentication information including the portable authentication medium 202, that is, the user ID of the cardholder.

The personal authentication information transmission control unit 218 sends the personal authentication information stored in the personal authentication information storage unit 219 to the encryption unit 222.

The encryption key storage unit 223 is an encryption key E2 for each authentication device for performing decryption only with the decryption key D2 stored in the decryption key storage unit 231 of the authentication device 203.
I remember. The encryption unit 222 uses the encryption key storage unit 22.
3, the personal authentication information received from the personal authentication information transmission control unit 218 is transmitted to the encryption key E corresponding to the destination.
2 is used for encryption and output to the transmission / reception unit 205.

Also, the portable authentication medium 20 according to the present embodiment.
2 includes mobile communication means (not shown). The mobile authentication medium 202 can receive the personal authentication function off signal from the mobile communication means, and the user can use the mobile information terminal 201 even when the mobile authentication medium 202 is not near the mobile authentication medium 202.
The personal authentication function of the portable authentication medium 202 can be turned off.

The authentication device 203 is an ATM (Automatic) that allows the start of a predetermined processing procedure through, for example, personal authentication.
(Teller Machine) and other terminal devices, and the operation is integrally controlled by the control unit 226.

The control unit 226 is composed of, for example, a microcomputer, and is used for loading a program and storing work data, RAM (Random Access Memor).
y), a ROM (Read Only Memory) for permanently storing a program code and predetermined data (neither is shown). A reception information management unit 227 and a personal authentication unit 229 are connected to the control unit 226 and control each unit.

The reception information management section 227 has a decoding section 228.
Is connected to the transmission / reception unit 206 via
The data received at 06 is managed.

The transmission / reception unit 206 transmits / receives data to / from external devices such as the portable information terminal 201 and the portable authentication medium 202, and the communicable distance thereof is, for example, about several meters. The data received by the transmission / reception unit 206 is decoded by the decoding unit 228.

The decryption unit 228 is connected to the decryption key storage unit 231. The decryption key storage unit 231 stores a decryption key D2 for decrypting the data encrypted with the encryption key E2.

The personal information storage section 230 stores the authentication device 2 concerned.
At least one user ID of a person who is permitted to use 03 is stored. Also, the authentication device 2
The setting information for customizing each authorized user may be stored together.

The personal authentication unit 229 is used for the portable authentication medium 202.
User ID included in the personal authentication information sent from
A user ID matching with is searched for from the personal information storage unit 230. If found, the user individual corresponding to the user ID is authenticated, and the use restriction of the authentication device 203 is released. In addition, the personal authentication unit 229 restricts the use of the authentication device 203 again when a predetermined time has passed since the authentication information was last received (when unused is detected). If the personal information storage unit 230 stores a plurality of records and the authentication device 203 can be used by only one person at a time, the authentication device 2
It is desirable to lock the function of the personal authentication unit 229 while the personal authentication of the user 03 is being performed.

Next, the operation of the personal authentication system shown in FIG. 3 will be described.

FIG. 8 shows a processing procedure for transmitting the personal authentication prerequisite information to the authentication device 203 via the portable authentication medium 202.

A user who wants to release the use restriction for a certain authentication device 203 is a portable information terminal 20 owned by himself.
1 and the portable authentication medium 202 are brought close to the authentication device 203 by a sufficient distance (about several meters). As a result, the transmission / reception units 204, 205, 206 establish a connection between the three parties.

The user sets the portable information terminal 201 to the authentication device 2
03, the portable information terminal 201 and the terminal device 203
When the communication becomes possible, the authentication device 203 determines that the portable information terminal 2
The terminal information is transmitted to 01. The terminal information includes the encryption key E2 of the authentication device 203, and other information includes the authentication device 203.
Information such as the name of the service and the service content provided by the authentication device 203.

On the portable information terminal 201 side, the received terminal information is stored in the terminal information storage unit 213 by the connection terminal management unit 208. However, when the portable information terminal 201 and the authentication device 203 cannot communicate with each other, the terminal information management unit 20
8 deletes the terminal information of the authentication device 203 stored in the terminal information storage unit 213.

In the portable information terminal 201, a list of communicable authentication devices 203 is displayed on the display 212 based on the terminal information stored in the terminal information storage unit 213.
Is displayed in. The user can select the authentication device 203 to perform personal authentication from the list via the operation unit 211. In response to this user selection operation,
A message prompting the user to enter the personal identification number is displayed on the display 212.

When the user inputs the personal identification number, it is temporarily stored in the personal identification number register 214. Operator authentication unit 2
41 retrieves the personal identification number input by the user from the personal identification number register 214, and inquires the personal identification number of the genuine user stored in advance in the personal identification number storage unit 242. If they match, the personal authentication prerequisite information generation unit 209 permits the generation of personal authentication prerequisite information. On the other hand, when the two do not match, this processing is ended as it is.

The personal authentication prerequisite information generation unit 209 generates personal authentication prerequisite information including the encryption key E2 of the authentication device 203 selected by the user. The encryption unit 210 encrypts this personal authentication prerequisite information using the encryption key E1. The encryption unit 210 also generates a digital signature using a random number. The transmission / reception unit 204 transmits the personal authentication prerequisite information with the electronic signature to the mobile authentication medium 202.

On the portable authentication medium 202 side, when the transmitting / receiving unit 205 receives the personal authentication prerequisite information with the electronic signature, the decrypting unit 221 confirms the electronic signature and then decrypts it using the decryption key D1. The reception management unit 217 temporarily stores the encryption key E2 included in the decrypted personal authentication prerequisite information in the encryption key storage unit 223.

The personal authentication information transmission control unit 218 sends the personal authentication information stored in the personal authentication information storage unit 219 to the encryption unit 222. Then, the encryption unit 222 encrypts this using the encryption key E2 stored in the encryption key storage unit 223, and the transmission / reception unit 205 causes the corresponding authentication device 2
Send to 03.

On the authentication device 203 side, when the encrypted personal authentication information is received by the wireless transmission / reception unit 206, the decryption unit 228 decrypts it using the decryption key D2, and the personal authentication unit 2
Sent to 29.

The personal authentication unit 229 searches the personal information storage unit 230 for a record having the same user ID as the user ID included in the personal authentication information. Then, when the same user ID is found, the use restriction of the authentication device 203 is released, and various settings of the authentication device 203 are performed based on the settings stored in the record. In addition, when a plurality of records are stored in the personal information storage unit 230 and only one authentication device 203 can be used at the same time, the function of the personal authentication unit 229 while the individual authentication of the user of the authentication device 203 is being performed. Lock.

On the other hand, if the same user ID is not found, the authentication device 203 ends this processing without releasing the use restriction for the user.

Further, if communication between the transmission / reception units 205 and 206 becomes impossible, for example, when the user leaves the authentication device 203, the connection between them is disconnected. Personal authentication unit 229
In response to the elapse of a predetermined time from the last receipt of the authentication information, the authentication device 203 cancels the personal authentication of the user and restricts the use of the user again.

Further, FIG. 9 shows a processing procedure in the case where personal authentication prerequisite information is directly transmitted from the portable information terminal 201 to the authentication device 203 and personal authentication information is transmitted to the authentication device 203 via the portable authentication medium 202. Shows.

A user who wants to release the use restriction of a certain authentication device 203 is a portable information terminal 20 owned by himself.
1 and the portable authentication medium 202 are brought close to the authentication device 203 by a sufficient distance (about several meters). As a result, the transmission / reception units 204, 205, 206 establish a connection between the three parties.

When the connection between the portable authentication medium 202 and the authentication device 203 is established, the personal authentication information transmission control unit 218
The personal authentication information stored in the personal authentication information storage unit 219 is sent to the encryption unit 222. Then, the encryption unit 222
Encrypts this using the encryption key E2 stored in the encryption key storage unit 223, and transmits it from the transmission / reception unit 205 to the corresponding authentication device 203.

In addition, the portable information terminal 201 and the terminal device 20
3 becomes communicable, the authentication device 203 transmits the terminal information to the portable information terminal 201. The terminal information includes the encryption key E2 of the authentication device 203, and the authentication device 20
3 and the information such as the service content provided by the authentication device 203.

On the portable information terminal 201 side, the received terminal information is stored in the terminal information storage unit 213 by the connection terminal management unit 208. However, when the portable information terminal 201 and the authentication device 203 cannot communicate with each other, the terminal information management unit 20
8 deletes the terminal information of the authentication device 203 stored in the terminal information storage unit 213.

Further, in the portable information terminal 201, a list of communicable authentication devices 203 is displayed on the display 212 based on the terminal information stored in the terminal information storage unit 213.
Is displayed in. The user can select the authentication device 203 to perform personal authentication from the list via the operation unit 211. In response to this user selection operation,
A message prompting the user to enter the personal identification number is displayed on the display 212.

When the user inputs the personal identification number, it is temporarily stored in the personal identification number register 214. Operator authentication unit 2
41 retrieves the personal identification number input by the user from the personal identification number register 214, and inquires the personal identification number of the genuine user stored in advance in the personal identification number storage unit 242. If they match, the personal authentication prerequisite information generation unit 209 permits the generation of personal authentication prerequisite information. On the other hand, when the two do not match, this processing is ended as it is.

The personal authentication prerequisite information generation unit 209 generates personal authentication prerequisite information including the encryption key E2 of the authentication device 203 selected by the user. The encryption unit 210 encrypts this personal authentication prerequisite information and generates an electronic signature using a random number. The transmission / reception unit 204 directly transmits the personal authentication prerequisite information with the electronic signature to the authentication device 203 without passing through the portable authentication medium 202.

On the authentication device 203 side, the portable authentication medium 20
The personal authentication information received from No. 2 is decrypted by the decryption unit 228 and sent to the personal authentication unit 229. The personal authentication unit 229
User I that is the same as the user ID included in the personal authentication information
A record having D is searched from the personal information storage unit 230.

On the authentication device 203 side, the personal authentication unit 229 performs personal authentication after confirming the electronic signature based on the personal authentication prerequisite information received from the portable information terminal 201.

Then, when the same user ID is found in the personal information recording section 230 and the personal authentication is successful, the use restriction of the authentication device 203 is released, and the authentication device 203 is released based on the setting stored in the record. Make various settings. In addition, when a plurality of records are stored in the personal information storage unit 230 and only one authentication device 203 can be used at the same time, the function of the personal authentication unit 229 while the individual authentication of the user of the authentication device 203 is being performed. Lock.

On the other hand, if the same user ID is not found or personal authentication fails, the authentication device 203
Ends the process without releasing the use restriction.

After that, when the user inputs a personal authentication end command, the portable information terminal 201 generates a personal authentication end signal and sends it directly to the authentication device 203. On the other hand, the authentication device 203 cancels the personal authentication for the user and resumes the use restriction for the user.

Fourth Embodiment: FIG. 4 shows a fourth embodiment of the present invention.
1 schematically shows the overall configuration of the personal authentication system according to the exemplary embodiment. As shown in the figure, the personal authentication system includes an authentication device 303 that authenticates a user individually, and personal authentication information (user ID, etc.) that is possessed by each user who needs personal authentication. At the same time, the portable authentication medium 302 that can be transmitted and the portable information terminal 301 that provides a user interface for performing a personal authentication operation (releasing the use restriction) for the personal authentication function of the authentication device 303 are configured.

A user who needs personal authentication uses the portable authentication medium 302 and the portable information terminal 301 in combination. Although not shown in order to prevent the drawing from becoming complicated,
Normally, a large number of sets of portable authentication media 302 and portable information terminals 301 can be connected to one authentication device 303.

The authentication device 303 is, for example, an ATM (Automati) that is permitted to start a predetermined processing procedure through personal authentication.
c Teller Machine) and other terminal devices.

The portable authentication medium 302 is composed of an IC card, a memory stick, a wearable device, etc., and is not particularly limited as long as it can transmit personal authentication information by wireless communication and is convenient for carrying.

The portable information terminal 301 is a device such as a mobile phone, a PDA (Personal Digital Assistant), a notebook computer, etc. that can be carried by the user and provides a user interface for user input operation. Composed.

The operation of the portable information terminal 301 is totally controlled by the control unit 307. Control unit 307
Is, for example, a microcomputer that is used for loading programs and storing work data.
AM (Random Access Memory), ROM (Read Only) that permanently stores program code and predetermined data
Memory) etc. (none of them are shown). The control unit 307 includes an operation unit 311 and a connection terminal management unit 30.
8, the authentication prerequisite information generation unit 309, and the display 31
2 are connected by a bus (not shown) or the like to control each unit.

The encryption section 310 is connected to the encryption key storage section 315. The encryption key storage unit 315 stores an encryption key E1 for decryption only with the decryption key D1 stored in the decryption key storage unit 324 of the portable authentication medium.

The transmission / reception unit 304 is a functional module for transmitting / receiving data to / from an external device such as the portable authentication medium 2 or the authentication device 3 by wireless communication, and its communicable distance is, for example, about several meters.

The connection terminal management unit 308 has a transmitting / receiving unit 304.
Manages terminal information about the authenticating device 303 that can communicate with each other. When the transmission / reception unit 304 receives the terminal information transmitted from the authentication device 303, the connection terminal management unit 308 stores this in the terminal information storage unit 313.

The terminal information stored in the terminal information storage unit 313 includes the encryption key E2 of the corresponding authentication device 303,
In addition, information such as the name of the authentication device 303 and the service content provided by the authentication device 303 is included.

The operation unit 311 constitutes a user interface of the portable information terminal 301 together with the display 312. The operation unit 311 includes means for selecting the terminal device 303 to be the target of personal authentication, and means for inputting personal identification information.

The means for selecting the authentication device 303 as the personal authentication destination is, for example, a selection button. Terminal information storage unit 313
Display 31 based on the terminal information stored in
A terminal list is displayed on the screen 2, and the user can select the authentication device 303 for personal authentication from the terminal list.

[0216] User's personal authentication destination authentication device 303
In response to the selection, the message prompting the user to enter the personal identification information is displayed on display 312. The means for inputting the personal identification information is, for example, a ten-key pad, and the user can input the personal identification number as the personal identification information. The input personal identification number is temporarily stored in the personal identification number register 314.

The operating means may be a keyboard so that a password can be input as the personal identification information. Alternatively, the means for inputting the personal identification information may be a biometrics sensor unit that detects biometric information from the user's body or a part thereof. When the personal identification information input means is a biometrics sensor unit, the personal identification information input means is further provided with means for extracting characteristic data from the biometric information input to the portable information terminal 301, and the extracted characteristic data is encrypted as personal identification information. Conversion unit 310
You may make it output to.

The personal authentication prerequisite information generation unit 309 generates personal authentication prerequisite information including the encryption key E2 of the authentication device 303 selected by the user as the personal authentication destination and the personal identification information input by the user, and encrypts it. The data is sent to the conversion unit 310. The generated personal authentication prerequisite information is encrypted by the encryption unit 310 using the encryption key E1 stored in the encryption key storage unit 315, and then transmitted from the transmission / reception unit 304 to the portable authentication medium 302.

The operation of the portable authentication medium 302 is totally controlled by the control unit 316. Control unit 316
Is connected to the reception management unit 317, the operator authentication unit 320, and the personal authentication information transmission control unit 318 by bus, and controls each unit.

The personal authentication information transmission control unit 318 is connected to the encryption unit 322 and generates personal authentication information to be transmitted. Further, the reception management unit 317 is connected to the transmission / reception unit 305 via the decoding unit 321, and manages the received information.

The transmission / reception unit 305 is adapted to transmit / receive data to / from an external device such as the portable information terminal 301 or the authentication device 303, and the communicable distance thereof is about several meters. The transmission / reception unit 305 transmits the encrypted data from the encryption unit 322 to the outside. Also, the transmitter / receiver 3
The encrypted data received at 05 is decrypted by the decryption unit 321.

The decryption unit 321 is connected to the decryption key storage unit 324. The decryption key storage unit 324 stores the encryption key E stored in the encryption key storage unit 315 of the portable information terminal 301.
It stores a decryption key D1 for decrypting the data encrypted by 1.

[0223] The reception management section 317 is connected to the portable information terminal 301.
Encryption key E2 included in the personal authentication prerequisite information transmitted from
Is stored in the encryption key storage unit 323, and the personal identification number included in the personal authentication information is sent to the personal authentication information transmission control unit 318 via the control unit 316.

The personal authentication information storage section 319 stores personal authentication information including the portable authentication medium 2, that is, the user ID of the cardholder.

The personal authentication information transmission control unit 318 stores the personal authentication information stored in the personal authentication information storage unit 319 as follows.
The password is sent to the encryption unit 322 together with the personal identification number included in the personal authentication prerequisite information.

The encryption key storage unit 323 is an encryption key E2 for each authentication device for enabling decryption only with the decryption key D2 stored in the decryption key storage unit 331 of the authentication device 303.
I remember. The encryption unit 322 uses the encryption key storage unit 32.
The personal authentication information and the personal identification number received from the personal authentication information transmission control unit 318 are encrypted using the encryption key E2 corresponding to the transmission destination and output to the transmission / reception unit 305.

Also, the portable authentication medium 30 according to the present embodiment.
2 includes mobile communication means (not shown). The mobile authentication medium 302 can receive the personal authentication function off signal from the mobile communication means, and the user can use the mobile information terminal 301 even when the mobile authentication medium 302 is not near the mobile authentication medium 302.
The personal authentication function of the portable authentication medium 302 can be turned off.

The authentication device 303 is an ATM (Automatic) that allows the start of a predetermined processing procedure through, for example, personal authentication.
(Teller Machine) and other terminal devices, and the operation is integrally controlled by the control unit 326.

The control unit 326 is composed of, for example, a microcomputer, and is used for loading a program and storing work data, RAM (Random Access Memor).
y), a ROM (Read Only Memory) for permanently storing a program code and predetermined data (neither is shown). A reception information management unit 327 and a personal authentication unit 329 are connected to the control unit 326 and control each unit.

The reception information management section 327 has a decoding section 328.
Is connected to the transmission / reception unit 6 via
It manages the data received in.

The transmission / reception unit 306 is adapted to transmit / receive data to / from an external device such as the portable information terminal 301 or the portable authentication medium 302, and its communicable distance is, for example, about several meters. The data received by the transmitting / receiving unit 306 is decoded by the decoding unit 328.

The decryption unit 328 is connected to the decryption key storage unit 331. The decryption key storage unit 331 stores a decryption key D2 for decrypting the data encrypted with the encryption key E2.

The personal information storage section 330 stores the authentication device 3 concerned.
At least one user ID of a person who is permitted to use 03 and its personal identification number are stored. Also, setting information for customizing the authentication device 303 for each user who is permitted to use the authentication device 303 may be stored together.

The personal authentication unit 329 is used as the portable authentication medium 302.
User ID included in the personal authentication information sent from
The personal information storage unit 330 is searched for a user ID that matches with. If found, the user individual corresponding to the user ID is authenticated and the personal identification number is verified. The authentication device 303 releases the use restriction for the user in response to the success of the personal authentication and the collation of the personal identification number.

When a plurality of records are stored in the personal information storage section 30 and the authentication device 3 can be used by only one person at a time, while the user of the authentication device 3 is being personally authenticated, It is desirable to lock the function of the personal authentication unit 329.

Further, when a predetermined time has passed since the last time the authentication information was received (when unused is detected), the personal authenticating section 329 causes the authenticating device 303 by the authenticating user.
Again restrict the use of.

Next, the operation of the personal authentication system shown in FIG. 4 will be described.

In FIG. 10, the personal identification number entered on the portable information terminal 301 is transmitted to the authentication device 3 via the portable authentication medium 302.
03 shows a processing procedure for sending to 03.

A user who wants to release the use restriction of a certain authentication device 303 is a portable information terminal 30 owned by himself.
1 and the portable authentication medium 302 are brought close to the authentication device 303 by a sufficient distance (about several meters). As a result, the transmission / reception units 304, 305, and 306 establish a connection between the three parties.

[0240] The user uses the portable information terminal 301 to authenticate the authentication device 3
03, the portable information terminal 301 and the terminal device 303
When communication becomes possible, the authentication device 303 determines that the mobile information terminal 3
The terminal information is transmitted to 01. The terminal information includes the encryption key E2 of the authentication device 303, and other information includes the authentication device 303.
Information such as the name of the user and the content of the service provided by the authentication device 303.

On the portable information terminal 301 side, the received terminal information is stored in the terminal information storage unit 313 by the connection terminal management unit 308. However, when the portable information terminal 301 and the authentication device 303 cannot communicate with each other, the terminal information management unit 30
8 erases the terminal information of the authentication device 303 stored in the terminal information storage unit 313.

Also, in the portable information terminal 301, a list of communicable authentication devices 303 is displayed on the display 312 based on the terminal information stored in the terminal information storage unit 313.
Is displayed in. The user can select, from the list, the authentication device 303 desired to perform personal authentication via the operation unit 311. In response to this user selection operation,
A message prompting the user to enter the personal identification number is displayed on the display 312.

When the user inputs the personal identification number, the personal authentication prerequisite information generating section 309 causes the authenticating device 3 selected by the user.
The personal authentication prerequisite information including the encryption key E2 of 03 and the input personal identification number is generated. The personal authentication prerequisite information is encrypted by the encryption unit 310 using the encryption key E1 and then transmitted from the transmission / reception unit 304 to the portable authentication medium 302.

On the portable authentication medium 302 side, when the transmitting / receiving unit 305 receives the encrypted personal authentication prerequisite information, the decrypting unit 321 decrypts it using the decryption key D1. The reception management unit 317 temporarily stores the encryption key E2 included in the decrypted personal authentication prerequisite information in the encryption key storage unit 323.

The personal authentication information transmission control unit 318 stores the personal authentication information stored in the personal authentication information storage unit 319 as follows.
It is sent to the encryption unit 322 together with the personal identification number included in the personal authentication prerequisite information. Then, the encryption unit 322 encrypts this using the encryption key E2 stored in the encryption key storage unit 323, and the transmission / reception unit 305 transmits the corresponding authentication device 30.
Send to 3.

On the authentication device 303 side, when the encrypted personal authentication information is received by the wireless transmission / reception unit 306, the decryption unit 328 decrypts it using the decryption key D2, and the personal authentication unit 3
Sent to 29.

The personal authentication unit 329 searches the personal information storage unit 330 for a record having the same user ID as the user ID included in the personal authentication information. Then, when the same user ID is found, the personal identification number of the user is performed as well as the inquiry of the personal identification number. In response to the successful inquiry of the personal identification number and the personal authentication, the authentication device 303 releases the use restriction on the user and makes various settings of the authentication device 303 based on the settings stored in the record. Further, when a plurality of records are stored in the personal information storage unit 330 and only one authentication device 303 can be used at the same time, the function of the personal authentication unit 329 is provided while the user of the authentication device 303 is being personally authenticated. Lock.

On the other hand, when the same user ID is not found, the authentication device 303 ends this processing without releasing the use restriction for the user.

If communication between the transmitting / receiving units 305 and 306 becomes impossible due to the user leaving the authentication device 303 or the like, the connection between them is disconnected. Personal authentication unit 329
In response to the elapse of a predetermined time from the last receipt of the authentication information, the authentication device 303 cancels the personal authentication of the user and restricts the use of the user again.

Further, FIG. 11 shows a processing procedure in the case where the personal identification number input on the portable information terminal 301 is directly sent to the authentication device 303 without passing through the portable authentication medium 302.

A user who wants to release the use restriction of a certain authentication device 303 is a portable information terminal 30 owned by himself.
1 and the portable authentication medium 302 are brought close to the authentication device 303 by a sufficient distance (about several meters). As a result, the transmission / reception units 304, 305, and 306 establish a connection between the three parties.

On the portable authentication medium 302 side, the personal authentication information transmission control unit 318 sends the personal authentication information stored in the personal authentication information storage unit 319 to the encryption unit 322. Then, the encryption unit 322 encrypts this using the encryption key E2 stored in the encryption key storage unit 323, and the transmission / reception unit 3
05 to the corresponding authentication device 303.

Also, the authentication device 303 is the portable information terminal 30.
The terminal information is transmitted to 1. The terminal information includes the encryption key E2 of the authentication device 303, and other information such as the name of the authentication device 303 and the service content provided by the authentication device 303.

On the portable information terminal 301 side, the received terminal information is stored in the terminal information storage unit 313 by the connection terminal management unit 308. However, when the portable information terminal 301 and the authentication device 303 cannot communicate with each other, the terminal information management unit 30
8 erases the terminal information of the authentication device 303 stored in the terminal information storage unit 313.

Further, in the portable information terminal 301, a list of communicable authentication devices 303 is displayed on the display 312 based on the terminal information stored in the terminal information storage unit 313.
Is displayed in. The user can select, from the list, the authentication device 303 desired to perform personal authentication via the operation unit 311. In response to this user selection operation,
A message prompting the user to enter the personal identification number is displayed on the display 312.

When the user inputs the personal identification number, the personal authentication prerequisite information generation unit 309 causes the authentication device 3 selected by the user.
The personal authentication prerequisite information including the encryption key E2 of 03 and the input personal identification number is generated. The encryption unit 310 encrypts the personal authentication prerequisite information and generates a digital signature using a random number. The transmission / reception unit 304 directly transmits the personal authentication prerequisite information with the electronic signature to the authentication device 303 without passing through the portable authentication medium 302.

On the authentication device 303 side, the portable authentication medium 30
The personal authentication information received from No. 2 is decrypted by the decryption unit 328 and sent to the personal authentication unit 329. The personal authentication unit 329
User I that is the same as the user ID included in the personal authentication information
A record having D is searched from the personal information storage unit 330.

On the authentication device 303 side, after confirming the electronic signature based on the personal authentication prerequisite information received from the portable information terminal 301, the personal authentication section 329 performs personal authentication.

The personal authentication unit 329 searches the personal information storage unit 330 for a record having the same user ID as the user ID included in the personal authentication information. Then, when the same user ID is found, the personal identification number of the user is performed as well as the inquiry of the personal identification number. In response to the successful inquiry of the personal identification number and the personal authentication, the authentication device 303 releases the use restriction on the user and makes various settings of the authentication device 303 based on the settings stored in the record. Further, when a plurality of records are stored in the personal information storage unit 330 and only one authentication device 303 can be used at the same time, the function of the personal authentication unit 329 is provided while the user of the authentication device 303 is being personally authenticated. Lock.

On the other hand, if the same user ID is not found or personal authentication fails, the authentication device 303
Ends the process without releasing the use restriction.

If communication between the transmission / reception units 305 and 306 becomes impossible due to the user leaving the authentication device 303, the connection between them is disconnected. Personal authentication unit 329
In response to the elapse of a predetermined time from the last receipt of the authentication information, the authentication device 303 cancels the personal authentication of the user and restricts the use of the user again.

Fifth Embodiment: FIG. 5 shows a fifth embodiment of the present invention.
1 schematically shows the overall configuration of the personal authentication system according to the exemplary embodiment. As shown in the figure, the personal authentication system includes one or more authentication devices 403 for authenticating individual users, and personal authentication information (user ID) possessed by each user who needs personal authentication. Etc.) and a portable authentication medium 402 capable of transmitting and holding, and a portable information terminal 401 providing a user interface for performing a personal authentication operation (releasing use restrictions) for the personal authentication function of the authentication device 403. It

A user who needs personal authentication uses the portable authentication medium 402 and the portable information terminal 401 in combination. Although not shown in order to prevent the drawing from becoming complicated,
Normally, a large number of sets of portable authentication media 402 and portable information terminals 401 can be connected to one authentication device 403.

The authentication device 403 is, for example, an ATM (Automati) that allows the start of a predetermined processing procedure through personal authentication.
c Teller Machine) and other terminal devices.

The portable authentication medium 402 is composed of an IC card, a memory stick, a wearable device, etc., and is not particularly limited as long as it can transmit personal authentication information by wireless communication and is convenient for carrying.

The portable information terminal 401 is a device such as a mobile phone, a PDA (Personal Digital Assistant), a notebook computer, etc. that can be carried by the user and provides a user interface for user input operation. Composed.

Each authentication device 403, portable authentication medium 402,
The mobile information terminals 401 are wireless communication modules 40, respectively.
6, 405 and 404 are provided so that wireless communication can be performed between the wireless communication modules. Further, these wireless communication modules 406, 405, 404 perform various communication-related processes such as establishing / disconnecting specific terminals and encrypting data to be wirelessly transmitted. The maximum communicable distance by the wireless communication modules 406, 405, 404 is, for example, about 10 m.

The operation of the portable information terminal 401 is totally controlled by the control unit 411. Control unit 411
Is, for example, a microcomputer that is used for loading programs and storing work data.
AM (Random Access Memory), ROM (Read Only) that permanently stores program code and predetermined data
Memory) etc. (none of them are shown). The operation unit 417, the personal authentication prerequisite information generation unit 412, the personal authentication confirmation information management unit 413, the terminal information management unit 415, and the display 416 are connected to the control unit 411 by a bus (not shown) or the like. To control.

The terminal information management unit 415 is the contactless reception unit 4
It is connected to 07.

The contactless receiver 107 can receive the data transmitted from the contactless transmitter 108 (described later) on the authentication device 103 side, and the communicable distance is several cm.
It is a degree. When the contactless reception unit 107 receives the terminal device information including the device ID and the identity verification flag indicating whether or not the identity verification information needs to be input from the contactless transmission unit 108 of the authentication device 103, the contactless reception unit 107 causes the terminal information management unit 115 to perform the operation. It is designed to output.

The terminal information management unit 115 includes the contactless reception unit 1
The device ID included in the terminal information received from 07 is stored in the terminal device ID register 122. In addition, the value of the personal identification flag included in the terminal information is confirmed.

The operation unit 417 includes an operation panel 418 for using various functions of the portable information terminal 401, and a biometrics sensor 419 for inputting biometric information from the user's body or a part thereof. . The biometric information input from the biometrics sensor 419 is unique information for each user, such as a fingerprint, a vein pattern, an iris pattern, a voiceprint, and a face image. The biometric information input from the biometrics sensor 419 is temporarily stored in the biometric information register 420.

The personal authentication prerequisite information generating section 412 is connected to the wireless communication module 404 and is adapted to generate personal authentication prerequisite information including the device ID stored in the terminal device ID register 422. The generated setting change information is wirelessly transmitted via the wireless communication module 404. When the personal identification flag of the terminal information received from the authentication device 403 is “true”, the characteristic data stored in the biometric information register 420 is also included in the personal authentication prerequisite information.

[0274] The personal authentication confirmation information management unit 413, after the personal authentication is made in the authentication device 403,
The personal authentication confirmation information (described later) transmitted from the server 3 is managed.

The operation of the portable authentication medium 402 is totally controlled by the control unit 423. Control unit 423
Is a reception management unit 424 and a personal authentication information transmission control unit 42.
6 and the feature data extraction unit 441 are connected to the bus to control each unit.

When receiving the personal authentication prerequisite information from the portable information terminal 401 via the wireless communication module 405, the reception management unit 424 confirms whether the personal authentication prerequisite information includes biometric information. When the biometric information is included, it is sent to the feature data extraction unit 441 via the control unit 423.

The characteristic data extraction unit 441 extracts characteristic data from the biometric information and extracts the characteristic data from the characteristic data.
It is temporarily stored in the register 442.

The personal authentication information transmission control unit 426 controls the transmission of the personal authentication information stored in the personal authentication information storage unit 429 via the wireless communication module 405.
If the characteristic data is stored in the characteristic data register 442, it is sent together with the personal authentication information.

The authentication device 403 is an ATM (Automatic) that allows the start of a predetermined processing procedure through, for example, personal authentication.
(Teller Machine) and other terminal devices, and the operation is integrally controlled by the control unit 431.

The control section 431 is composed of, for example, a microcomputer, and is used for loading a program and storing work data, RAM (Random Access Memor).
y), a ROM (Read Only Memory) for permanently storing a program code and predetermined data (neither is shown). The personal authentication unit 432 and the non-contact transmission unit 408 are connected to the control unit 431 and control each unit.

Further, the authentication device 403 has a personal information database 430. Personal information database 43
0 stores at least one record of a user who is permitted to use the authentication device 403, and at least a user ID is stored in each record. Instead of equipping the authentication device 403 with the personal information database 430, the personal information database 430 can be built on the database server 410 on the network as shown in FIG. In such a case, the authentication device 403 can access the personal information database 430 via the network 409 via the network connection unit 433.

[0282] When personal authentication information is received from the portable authentication medium 402 via the wireless communication module 406, the personal authentication section 432 determines that the user I included in this personal authentication information.
User ID that matches D is personal information database 430
To search from. Then, when the same user ID is found, the user individual corresponding to the user ID is authenticated.

When the personal authentication information includes the characteristic data, the characteristic data collating unit 443 collates the characteristic data.

When the personal authentication and the collation of the characteristic data are completed successfully, the authentication device 403 releases the use restriction for the user. Personal information database 43
When a plurality of records are stored in 0 and the authentication device 403 can be used by only one person at a time, the function of the personal authentication unit 132 is maintained while the individual authentication of the user of the authentication device 403 is being performed. It is desirable to lock it. Further, when the connection between the mobile authentication medium 402 and the wireless communication modules 405 and 406 of the authentication device 403 is disconnected, the personal authentication unit 432 limits the use of the authentication device 403 again.

The non-contact transmission unit 408 is connected to the terminal information storage unit 4
The terminal information stored in 35 is transmitted to the contactless receiver 404 of the portable information terminal 401. The maximum communicable distance between the non-contact transmitting unit 408 and the non-contact receiving unit 407 is about several cm.

Next, the operation of the personal identification system shown in FIG. 5 will be described with reference to FIG.

[0287] A user who wants to perform personal authentication with a certain authentication device 403 brings the portable information terminal 401 and the portable authentication medium 402, which he owns, closer to the authentication device 403 by a sufficient distance (about several meters). As a result, each transmitting / receiving unit 40
4, 405 and 406 establish a connection between the three parties.

[0288] When the user further brings the portable information terminal 401 closer to the contactless transmission unit 408 of the authentication device 403 (several cm
Degree), the non-contact receiver 407 on the portable information terminal 401 side
Can receive the terminal information transmitted from the contactless transmission unit 408.

On the portable information terminal 401 side, the terminal device management section 415 temporarily stores the device ID included in the received terminal information in the terminal device register 422 and confirms the value of the principal confirmation flag.

When the identity confirmation flag is "true", a message prompting the user to input biometric information is displayed on the display 4
16 Display on top. Then, when the user inputs biometric information from the biometrics sensor 419, the biometric information is temporarily stored in the biometric information register 420.

After that, the personal authentication prerequisite information generator 412
Generates personal authentication prerequisite information including the device ID stored in the terminal device ID register 122 and the biometric information stored in the biometric information register 420, and stores it in the portable authentication medium 402 via the wireless communication module 404. Send.

On the other hand, when the principal confirmation flag is "false", the biometric information input is omitted. That is, the personal authentication prerequisite information generation unit 412 generates personal authentication prerequisite information including the device ID and transmits it to the portable authentication medium 402 via the wireless communication module 404.

On the portable authentication medium 402 side, when the personal authentication prerequisite information is received via the wireless communication module 405,
The reception control unit 424 confirms whether or not the personal authentication prerequisite information includes biometric information.

When the personal authentication prerequisite information does not include the biometric information, the personal authentication information transmission control unit 426 reads the personal authentication information stored in the personal authentication information storage unit 428 and uses it as the personal authentication prerequisite information. The personal authentication information is transmitted to the authentication device 403 via the wireless communication module 405 according to the included device ID.

If the personal authentication prerequisite information includes biometric information, the feature data extraction unit 441 extracts the feature data from the biometric information, and the personal authentication information transmission control unit 426 determines that the user ID and the feature Generate personal authentication information including data. Then, according to the device ID included in the personal authentication prerequisite information, the personal authentication information is transmitted to the terminal device 403 via the wireless communication module 405.

On the authentication device 403 side, when the personal authentication information is received via the wireless communication module 406, the personal authentication section 432 accesses the personal information database 430 and matches the user ID contained in the personal authentication information. Search for records with user IDs.

When the personal authentication information includes characteristic data, the characteristic data collating unit 443 collates the characteristic data with the characteristic data of the authentic user.

The same user ID has the personal information database 4
If found from 30, the individual authentication unit 432 authenticates the user individual corresponding to the user ID. Then, in response to the success of the collation of the characteristic data and the personal authentication, the authentication device 403 releases the use restriction of various functions for the user.

[0299] Further, the personal authentication section 432 transmits personal authentication confirmation information to the portable information terminal 401 via the wireless communication module 406, after successful personal authentication and collation of the characteristic data. On the portable information terminal 401 side, when the personal authentication confirmation information is received via the wireless communication module 404,
After the confirmation by the personal authentication confirmation information management unit 413, a personal authentication confirmation message is displayed on the display 416 to notify the user that the authentication device 403 is available.

On the other hand, if the same user ID is not found, or if the personal authentication or the collation of the characteristic data fails, the processing is terminated without releasing the use restriction.

Also, for example, when the user leaves the authentication device 403, the portable authentication medium 402 and the authentication device 40 are
When the connection between the wireless communication modules 3 is disconnected, the personal authentication unit 432 limits the use of the authentication device 403 again.

[Supplement] The present invention has been described in detail with reference to the specific embodiments. However, it is obvious that those skilled in the art can modify or substitute the embodiments without departing from the scope of the present invention. That is, the present invention has been disclosed in the form of exemplification, and the contents of this specification should not be construed in a limited manner. In order to determine the gist of the present invention, the section of the claims described at the beginning should be taken into consideration.

[0303]

As described above in detail, according to the present invention,
Excellent personal authentication system and personal authentication method, portable information terminal, portable authentication medium, authentication device, and storage medium capable of suitably performing personal authentication by wirelessly transmitting the personal authentication information held by the user to the personal authentication device Can be provided.

Further, according to the present invention, an excellent personal authentication system and personal authentication method capable of suitably performing personal authentication by the user inputting personal identification information,
A mobile information terminal, a mobile authentication medium, an authentication device, and a storage medium can be provided.

Further, according to the present invention, an excellent personal authentication system and personal authentication method, a portable information terminal, a portable authentication medium, an authentication device, by which a user can input personal identification information with good operability and safely, In addition, a storage medium can be provided.

According to the present invention, the portable authentication medium for transmitting the user ID to the external device may be kept in the purse or the back of the bag, and it is necessary to take it in and out when the personal identification information is input. Disappear. In addition, although a mobile information terminal equipped with a personal identification information input means is often taken in and out, the mobile information terminal alone does not have the function of performing personal authentication, so it may be lost or stolen. Also, there is no case where the terminal device is illegally used by being impersonated by another person.

[Brief description of drawings]

FIG. 1 is a diagram schematically showing an overall configuration of a personal authentication system according to a first exemplary embodiment of the present invention.

FIG. 2 is a diagram schematically showing an overall configuration of a personal authentication system according to a second exemplary embodiment of the present invention.

FIG. 3 is a diagram schematically showing an overall configuration of a personal authentication system according to a third exemplary embodiment of the present invention.

FIG. 4 is a diagram schematically showing an overall configuration of a personal authentication system according to a fourth exemplary embodiment of the present invention.

FIG. 5 is a diagram schematically showing an overall configuration of a personal authentication system according to a fifth exemplary embodiment of the present invention.

FIG. 6 is a chart showing an operation in the personal identification system shown in FIG.

FIG. 7 is a chart showing an operation in the personal identification system shown in FIG.

8 is a chart showing an operation in the personal authentication system shown in FIG. 3, more specifically, a chart showing a processing procedure when personal authentication prerequisite information is sent to an authentication device via a portable authentication medium. is there.

9 is a chart showing an operation in the personal authentication system shown in FIG. 3, more specifically, personal authentication prerequisite information is directly transmitted from the portable information terminal to the authentication device, and personal authentication information is portable authentication. 6 is a chart showing a processing procedure when sending to an authentication device via a medium.

10 is a chart showing an operation in the personal authentication system shown in FIG. 4, and more specifically, a case in which a personal identification number input on a mobile information terminal is sent to an authentication device via a mobile authentication medium. 6 is a chart showing a processing procedure.

11 is a chart showing an operation in the personal authentication system shown in FIG. 4, more specifically showing a processing procedure in the case of directly transmitting the personal identification number input on the portable information terminal to the authentication device. It is a chart.

12 is a chart showing an operation in the personal identification system shown in FIG.

[Explanation of symbols]

1 ... Portable information terminal 2. Mobile authentication medium 3 ... Authentication device 4, 5, 6 ... Transceiver 7 ... control unit, 8 ... connection terminal management unit 9 ... Personal authentication prerequisite information generation unit 10 ... Encryption unit, 11 ... Operation unit, 12 ... Display 13 ... Terminal information storage unit, 14 ... PIN code register 15 ... Encryption key storage unit 16 ... Control unit, 17 ... Reception management unit 18 ... Personal authentication information transmission control unit 19 ... Individual authentication information storage unit 20 ... Operator authentication unit, 21 ... Decryption unit 22 ... Encryption unit, 23 ... Encryption key storage unit 24 ... Decryption key storage unit, 25 ... PIN number storage unit 26 ... Control unit, 27 ... Received information management unit 28 ... Decryption unit, 29 ... Personal authentication unit 30 ... Personal information storage unit, 31 ... Decryption key storage unit

Claims (45)

[Claims] 1. A personal authentication system for performing authentication processing based on personal authentication information, which provides an operating environment for inputting personal identification information to a user, and an individual including the input personal identification information. A portable information terminal that generates and outputs authentication prerequisite information, and personal authentication information for personal authentication processing with the authentication device is held, and personal identification information included in the personal authentication prerequisite information received from the portable information terminal is stored. A mobile authentication medium that outputs personal authentication information after confirming the identity of the user who used it, and an authentication device that releases the use restriction on the mobile information terminal through personal authentication processing using the personal authentication information received from the mobile authentication medium. A personal authentication system comprising: 2. The personal authentication system according to claim 1, wherein data is transmitted and received between the portable information terminal, the portable authentication medium, and the authentication device by wireless cryptographic communication. 3. The personal authentication according to claim 1, wherein the personal authentication is canceled in response to a lapse of a predetermined time after the connection between the portable authentication medium and the authentication device is disconnected. system. 4. A personal identification number or biometric information obtained from the body of the user or a part thereof is used as the personal identification information.
The personal authentication system according to claim 1, wherein: 5. The personal authentication processing is a personal authentication method of physically separating and performing personal identification, including a step of inputting personal identification information by a user on a portable information terminal, and including the personal identification information. The step of transferring the personal authentication prerequisite information from the mobile information terminal to the mobile authentication medium, the step of performing the user identity confirmation processing using the personal identification information included in the personal authentication prerequisite information on the mobile authentication medium, and the personal identification In response to the success of the personal authentication information by transmitting the personal authentication information from the portable authentication medium to the authentication device, and in response to the success of the personal authentication process, The step of releasing the usage restriction,
A personal authentication method comprising: 6. The personal authentication method according to claim 5, wherein data is transmitted and received among the portable information terminal, the portable authentication medium, and the authentication device by wireless cryptographic communication. 7. In response to a lapse of a predetermined time from disconnection of the portable authentication medium and the authentication device,
The personal authentication method according to claim 5, further comprising a step of canceling the personal authentication. 8. A personal identification number or biometric information obtained from the user's body or a part thereof is used as the personal identification information.
The personal authentication method according to claim 5, wherein: 9. A portable information terminal for inputting personal identification by being physically separated from personal authentication processing using a portable authentication medium, and transmitting / receiving means for transmitting / receiving data to / from an external device, and a user's personal identification information. User input means for performing an input operation of, personal authentication prerequisite information generating means for generating personal authentication prerequisite information including the personal identification information input via the user input means, and the generated personal authentication prerequisite A means for transmitting information to the portable authentication medium via the transmitting / receiving means, the portable information terminal. 10. The portable information terminal according to claim 9, wherein the transmitting / receiving unit transmits / receives data to / from an external device by wireless cryptographic communication. 11. The user input means receives a user input of a personal identification number as personal identification information, and the personal authentication prerequisite information generation means includes the input personal identification number as personal identification information in personal authentication prerequisite information. The portable information terminal according to claim 9, wherein 12. The user input means acquires biometric information from the user's body or a part thereof, and the personal authentication prerequisite information generation means verifies the user's biometric information or characteristic data extracted from the biometric information. The mobile information terminal according to claim 9, wherein the mobile information terminal is included in the personal authentication prerequisite information as information. 13. A portable authentication medium for performing a personal authentication process with a predetermined authentication device according to personal authentication prerequisite information from a portable information terminal, and a transmitting / receiving means for transmitting / receiving data to / from an external device, said portable information. Identity verification means for performing identity verification based on the identity verification information included in the personal authentication prerequisite information received from the terminal, personal authentication information retention means for retaining the personal authentication information of the user, and identity verification by the identity verification means being successful. In response to the request, the personal authentication information transmission control means for transmitting the personal authentication information held in the personal authentication information holding means to the authentication device, the portable authentication medium. 14. The portable authentication medium according to claim 13, wherein the transmitting / receiving unit transmits / receives data to / from the portable information terminal and the authentication device by wireless cryptographic communication. 15. The personal identification information is a personal identification number, and the personal identification confirmation means stores the personal identification number included in the personal authentication prerequisite information received from the portable information terminal in advance, the personal identification number of the authentic user. 14. The portable authentication medium according to claim 13, characterized in that 16. The personal identification information is biometric information acquired from a user's body or a part thereof, and the personal identification means is biometric information included in personal authentication prerequisite information received from the portable information terminal or 14. The portable authentication medium according to claim 13, wherein the characteristic data is collated with biometric information of a genuine user or characteristic data stored in advance. 17. An authentication device for performing personal authentication with a portable authentication medium, the transmitting and receiving means for transmitting and receiving data to and from an external device, and the personal authentication using personal authentication information received from the portable authentication medium. An authentication apparatus, comprising: a personal authentication processing unit that performs the above; and a use restriction control unit that releases the use restriction for the user in response to the success of the personal authentication processing. 18. The authentication apparatus according to claim 19, wherein the transmitting / receiving unit transmits / receives data to / from an external device by wireless cryptographic communication. 19. The use restriction control means cancels personal authentication for the user in response to a lapse of a predetermined time from disconnection of the portable authentication medium. Item 17. The authentication device according to Item 17. 20. A personal authentication system for performing authentication processing based on personal authentication information, providing an operating environment for inputting personal identification information to a user, and using the input personal identification information. A mobile information terminal that generates and outputs personal authentication prerequisite information after confirming the identity of the user, and personal authentication information for personal authentication processing with the authentication device is held, and personal authentication prerequisite received from the mobile information terminal. A portable authentication medium for outputting personal authentication information according to the information; and an authentication device for releasing a use restriction on the portable information terminal through a personal authentication process using the personal authentication information received from the portable authentication medium. Personal authentication system with. 21. The portable information terminal, the portable authentication medium,
21. The personal authentication system according to claim 20, wherein data is transmitted and received between the authentication devices by wireless encrypted communication. 22. The personal authentication according to claim 20, wherein the personal authentication is canceled in response to a lapse of a predetermined time after the connection between the portable authentication medium and the authentication device is disconnected. system. 23. The personal identification system according to claim 20, wherein a personal identification number or biometric information obtained from a user's body or a part thereof is used as the personal identification information. 24. The personal authentication processing is a personal authentication method for physically confirming the personal identification, comprising the steps of inputting personal identification information by the user on the mobile information terminal, and According to the personal authentication prerequisite information transfer step from the mobile information terminal to the mobile authentication medium in response to the successful identification verification, A step of transmitting personal authentication information from the portable authentication medium to the authentication device to perform a personal authentication process, and a step of releasing the use restriction of the authentication device for the user in response to the success of the personal authentication process,
A personal authentication method comprising: 25. The portable information terminal, the portable authentication medium,
The personal authentication method according to claim 24, wherein data is transmitted and received between the authentication devices by wireless encrypted communication. 26. The method according to claim 24, further comprising the step of canceling the personal authentication in response to a lapse of a predetermined time after the connection between the portable authentication medium and the authentication device is disconnected. The personal authentication method described in. 27. The personal authentication method according to claim 24, wherein a personal identification number or biometric information obtained from a user's body or a part thereof is used as the personal identification information. 28. A mobile information terminal for inputting personal identification physically separated from personal authentication processing by a mobile authentication medium, wherein the personal identification information is transmitted and received by an external device, and the personal identification information is transmitted by the user. User input means for performing an input operation of, personal identification means for performing personal identification using the personal identification information input via the user input means, and personal authentication in response to successful identification confirmation. A personal digital assistant, comprising: personal authentication prerequisite information generating means for generating prerequisite information; and means for transmitting the generated personal authentication prerequisite information to the portable authentication medium via the transmitting / receiving means. 29. The portable information terminal according to claim 28, wherein said transmitting / receiving means transmits personal authentication prerequisite information with an electronic signature to said portable authentication medium by wireless cryptographic communication. 30. The user input means receives a user input of a personal identification number as the personal identification information, and the personal identification means compares the personal identification number input by the user with a pre-stored authentic user's personal identification number. 29. The portable information terminal according to claim 28, wherein: 31. The user input means acquires biometric information from a user's body or a part thereof, and the personal identification means stores in advance biometric information input by the user or characteristic data extracted from the biometric information. 29. The portable information terminal according to claim 28, wherein the portable information terminal is collated with the characteristic data of the authentic user or biometric information thereof. 32. A portable authentication medium for performing a personal authentication process with a predetermined authentication device according to personal authentication prerequisite information from a portable information terminal, a transmitting / receiving means for transmitting / receiving data to / from an external device, and a user's individual. Personal authentication information holding means for holding authentication information, and personal authentication information transmission for transmitting the personal authentication information held in the personal authentication information holding means to the authentication device according to the personal authentication prerequisite information received from the portable information terminal. A portable authentication medium comprising: a control unit. 33. The mobile authentication according to claim 32, wherein the transmitting / receiving unit transmits / receives data to / from an external device by wireless cryptographic communication and confirms an electronic signature received from the portable information terminal. Medium. 34. The portable authentication medium according to claim 32, wherein said transmitting / receiving means transmits personal authentication information with an electronic signature to said authentication device by wireless cryptographic communication. 35. A personal authentication system for performing authentication processing based on personal authentication information, which provides an operating environment for a user to input personal identification information, and which includes the personal identification information input. A portable information terminal that generates and outputs authentication prerequisite information, and personal authentication information for personal authentication processing with the authentication device is held, and personal identification information included in the personal authentication prerequisite information received from the portable information terminal is stored. A mobile authentication medium that outputs personal authentication information that includes the personal authentication information received from the mobile authentication medium, and the personal identification information of the user that is included in the personal authentication information received from the mobile authentication medium. A personal authentication system, comprising: 36. The portable information terminal, the portable authentication medium,
The personal authentication system according to claim 35, wherein data is transmitted and received between the authentication devices by wireless cryptographic communication. 37. The personal authentication according to claim 35, wherein the personal authentication is canceled in response to a lapse of a predetermined time from the disconnection between the portable authentication medium and the authentication device. system. 38. The personal identification system according to claim 35, wherein a personal identification number or biometric information acquired from the body of the user or a part thereof is used as the personal identification information. 39. The personal authentication processing is a personal authentication method of physically separating and performing personal identification, including a step of inputting personal identification information by a user on a portable information terminal, and including the personal identification information. A step of transferring the personal authentication prerequisite information from the portable information terminal to the portable authentication medium; a step of transferring the personal authentication information including the personal identification information from the portable authentication medium to the authentication device according to the personal authentication prerequisite information; On the device, a step of performing a user identity verification process using the identity verification information included in the personal authentication information, and a step of performing a personal authentication process using the personal authentication information in response to the successful identity verification. Responding to the success of the personal authentication process, releasing the use restriction of the authentication device for the user,
A personal authentication method comprising: 40. The portable information terminal, the portable authentication medium,
40. The personal authentication method according to claim 39, wherein data is transmitted and received between the authentication devices by wireless encrypted communication. 41. The method according to claim 39, further comprising the step of canceling the personal authentication in response to a lapse of a predetermined time after the connection between the portable authentication medium and the authentication device has been disconnected. The personal authentication method described in. 42. The personal authentication method according to claim 39, wherein a personal identification number or biometric information obtained from a user's body or a part thereof is used as the personal identification information. 43. Memory for physically storing computer software in a computer-readable format, which is described as executing personal authentication processing for performing personal verification separately from personal authentication processing on a computer system. The medium is a medium in which the computer software transfers personal identification prerequisite information including the personal identification information from the mobile information terminal to the mobile authentication medium, the step of inputting the personal identification information by the user on the mobile information terminal. Steps, on the mobile authentication medium, a step of performing user identity verification processing using the identity verification information included in the personal authentication prerequisite information, and responding to the successful identity verification from the mobile authentication medium to the authentication device. In response to the step of sending the personal authentication information to perform the personal authentication process and the success of the personal authentication process, And releasing the restriction of the use of the authentication apparatus,
A storage medium comprising: 44. A memory in which computer software physically stored in a computer-readable format is described so as to execute personal authentication processing on a computer system to perform personal verification separately from personal authentication processing. A medium, wherein the computer software includes a step of inputting identity verification information by a user on a mobile information terminal, a step of performing identity verification processing of the user using the identity verification information on the mobile information terminal, In response to the successful identification, the step of transferring the personal authentication prerequisite information from the mobile information terminal to the mobile authentication medium, and transmitting the personal authentication information from the mobile authentication medium to the authentication device according to the personal authentication prerequisite information. Performing an authentication process and using the authentication device for the user in response to successful personal authentication process And a step of releasing a limited,
A storage medium comprising: 45. Memory for physically storing computer software in a computer-readable format, which is described as executing personal authentication processing for performing personal verification separately from personal authentication processing on a computer system. The medium is a medium in which the computer software transfers personal identification prerequisite information including the personal identification information from the mobile information terminal to the mobile authentication medium, the step of inputting the personal identification information by the user on the mobile information terminal. A step of transferring personal authentication information including the personal identification information from the portable authentication medium to the authentication device according to the personal authentication prerequisite information; and using the personal identification information included in the personal authentication information on the authentication device. In response to the step of performing identity verification processing of the user and the successful identity verification, And performing an authentication process, in response to a successful personal authentication, the step of releasing the restriction of the use of the authentication device for the user,
A storage medium comprising: