JP2003208408A - User authentication system, method and program, and computer-readable recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a user authentication system capable of performing the authentication in high safety. <P>SOLUTION: The user authentication system 10 comprises a authentication request receiving part 101 for receiving an ID key and an access number generated on the basis of an authentication terminal ID, a user unique key and a random number, and transmitted from an authentication terminal 30, a user inquiring part 102 for inquiring the ID key and the access number stored in an authentication information storing part 109, an authentication transmitting part 103 for transmitting a generation time information stored in relation to the ID key and the access number when the combination of the agreed ID key and access number exists, a use confirmation receiving part 104 for receiving the use confirmation key generated on the basis of the ID key and the generation time information from the authentication terminal 30, and a use confirmation collating part 105 for collating the received use confirmation key and the corresponding use confirmation key stored in the authentication information storing part 109. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication system, a user authentication method, a user authentication program, and a computer-readable recording medium.

[0002]

2. Description of the Related Art Conventional methods for authenticating a user's qualification by using authentication information such as a password can be broadly classified into two types: a public key encryption method and a common key encryption method. However, when incorporated into the Internet-related communication protocol, etc., a method applying a common key type encryption method capable of significantly higher speed processing than the public key encryption method, particularly a password authentication method is often used. The basic password authentication procedure is as follows. First, a user registers a password in an authentication terminal such as a store (including a virtual store on a network) that the user intends to use. At the time of authentication, the user sends the password to the authentication terminal. The authentication terminal compares the received password with the registered password.

However, this password authentication method has the following problems. The first problem is that the password is stolen by stealing the password file on the authentication terminal side. The second problem is that the password is stolen by wiretapping during communication. Third
The problem is that the user has to disclose the password, which is his secret information, to the authentication terminal.

As a method for solving the first problem, for example, a user registers data in which an one-way function is applied to a password in an authentication terminal (including a central processing system for managing the authentication terminal), and the authentication is performed. Sometimes, there is a method in which the password received by the authentication terminal is subjected to the same one-way function and the results are compared. A one-way function is a function that does not have an efficient means to obtain an input from an output other than the brute force of the input. It is possible to prevent the user from being calculated and masquerading as the authenticated user.

The method using the one-way function can solve the first problem of the basic password authentication method. However, when this is applied to the Internet where the wiretapping is easy, the second problem cannot be solved. Also,
Regarding the third problem, although this basic password authentication method can be applied to customer authentication in cases where confidentiality is strict as in banks, it is suitable for qualification authentication at the same level between users and stores. Absent.

As a method for solving such a problem, there is a qualification authentication method in which authentication information such as a password is variable. The important feature of such a qualification authentication method is that the authentication data passed from the user to the authentication terminal via the communication path such as the Internet is different every time, so even if it is intercepted, another authentication data will be sent to the person to be authenticated at the next authentication. Since it is not authenticated unless it is sent to the certifier from the certifier, an unqualified person who eavesdrops cannot masquerade as a legitimate user.

[0007]

Although there are various qualification authentication methods that make such authentication information variable, conventional qualification authentication methods of the same kind require, for example, a very large amount of processing (calculation) on the user side. Some have the big problem and the technical problem to be solved that the user needs to update the password regularly. Although another conventional credential authentication method can eliminate the need to update such a password, the technical problem to be solved that the amount of processing (calculation) in the user and the authentication terminal is large still remains. It was

Therefore, according to the present invention, the amount of processing executed on the authentication terminal side for each authentication is minimized, and more secure authentication can be performed, that is, a user authentication system, a user authentication method, and a user authentication. An object is to provide a program and a computer-readable recording medium.

[0009]

SUMMARY OF THE INVENTION A user authentication system of the present invention includes authentication terminal specifying information for specifying the authentication terminal, which is transmitted from an authentication terminal that attempts to authenticate a user, and uniquely for each user. Authentication for receiving first authentication information generated based on predetermined user unique information and a randomly generated random number, and unique access information corresponding to each of the first authentication information. Request receiving means, and a user inquiring means for inquiring the first authentication information and the access information stored in the authentication information storage means based on the first authentication information and the access information received by the authentication request receiving means, If a combination of the matching access information and the first authentication information is present in the authentication information storage means as a result of the inquiry by the user inquiring means, the matching access information and the first authentication information are combined. Authentication transmitting means for transmitting the generation time information stored in the authentication information storage means in association with the first authentication information to the authentication terminal, and the generation time information transmitted by the authentication terminal by the first authentication information and the authentication transmitting means. Use confirmation receiving means for receiving second authentication information generated based on the second authentication information, second authentication information received by the use confirmation receiving means, access information stored in the authentication information storage means, and first authentication Usage confirmation collating means for collating the second authentication information corresponding to the information.

In the user authentication method of the present invention, the authentication request receiving means uniquely preliminarily uniquely identifies each user with the authentication terminal specifying information for specifying the authentication terminal, which is transmitted from the authentication terminal attempting to authenticate the user. Authentication for receiving first authentication information generated based on predetermined user unique information and a randomly generated random number, and unique access information corresponding to each of the first authentication information. The request receiving step and the user inquiring means inquire the first authentication information and the access information stored in the authentication information storing means based on the first authentication information and the access information received by the authentication request receiving means. If the combination of the user inquiry step and the inquiry by the user inquiry means indicates that the matching access information and the first authentication information are present in the authentication information storage means, authentication is performed. An authenticating step of transmitting the generation time information stored in the authentication information storage means in association with the matching access information and the first authentication information to the authentication terminal; The usage confirmation receiving step in which the usage confirmation receiving means receives the second authentication information generated based on the generation time information transmitted by the authentication transmitting means, and the second step in which the usage confirmation collating means receives the second authentication information. And a use confirmation collation step of collating the authentication information with the access information stored in the authentication information storage means and the second authentication information corresponding to the first authentication information.

The user authentication program of the present invention is such that the authentication terminal specifying information for specifying the authentication terminal, which is transmitted from the authentication terminal that attempts to authenticate the user, causes the computer to be uniquely determined in advance for each user. Authentication request receiving means for receiving first authentication information generated on the basis of existing user unique information and randomly generated random numbers, and unique access information corresponding to each of the first authentication information. And a user inquiring means for inquiring the first authentication information and the access information stored in the authentication information storing means based on the first authentication information and the access information received by the authentication request receiving means, and the user inquiry. When the combination of the matching access information and the first authentication information is present in the authentication information storage means as a result of the inquiry of the means, the matching access information. And a generation time when the generation time information stored in the authentication information storage means in association with the first authentication information is transmitted to the authentication terminal, and the generation time when the authentication terminal is transmitted by the first authentication information and the authentication transmission means. Usage confirmation receiving means for receiving second authentication information generated based on the information, second authentication information received by the usage confirmation receiving means, access information stored in the authentication information storing means, and first authentication information. It functions as a use confirmation collating unit that collates the second authentication information corresponding to the authentication information.

According to the user authentication system and the user authentication method of the present invention, the user inquiring means has the access information and the first authentication information received by the authentication request receiving means, and the access information stored in the authentication information storing means. And the first authentication information are inquired, for example, even if only the first authentication information is obtained by a third party other than the user, if the access information does not match, it will not be misused, and the security can be improved. High authentication can be performed. When the authentication terminal generates the second authentication information, the authentication transmission means transmits the generation time information stored in the authentication information storage means in association with the matching access information and the first authentication information to the authentication terminal. The generation time information can be provided as the information used for. Since the usage confirmation collating means collates the second authentication information received by the usage confirmation receiving means with the corresponding second authentication information stored in the authentication information storing means, it is based on the second authentication information. Authentication is possible. The second authentication information received by the usage confirmation receiving means is generated by the authentication terminal using the generation time information transmitted by the authentication transmitting means. For example, the second authentication information is combined with the generation time information to generate the second authentication information. Assuming that the first authentication information for generating is received from the user,
Since each of these pieces of information can be made different each time, the impersonation of a third party can be effectively eliminated. Also, the same operation is achieved by executing the user authentication program of the present invention using a computer.

In the user authentication system, the user authentication method, and the user authentication program of the present invention, the generation time information may be a numerical value determined based on the time when the first authentication information is generated. . As the numerical value determined based on the time, for example, if the position occupied by the time on a day is represented by a decimal, it becomes easy to convert the information into another type of information.

Further, in the user authentication system of the present invention, the first authentication information is obtained when the received second authentication information and the stored second authentication information match as a result of the verification by the usage confirmation verification means. Third information generating means for generating third authentication information based on the random number corresponding to the above and the authentication terminal unique information uniquely determined in advance for each trader holding the authentication terminal, and the third information generating means. It may be provided with a usage confirmation transmitting unit that transmits the third authentication information to the authentication terminal.

Further, in the user authentication method of the present invention, when the received second authentication information matches the stored second authentication information as a result of the verification by the usage confirmation verification means, the third information generation means. A third information generating step of generating third authentication information based on the random number corresponding to the first authentication information and the authentication terminal unique information that is uniquely determined in advance for each trader holding the authentication terminal; The confirmation transmitting unit may include a use confirmation transmitting step of transmitting the third authentication information generated by the third information generating unit to the authentication terminal.

Further, the user authentication program of the present invention causes the computer to determine whether the received second authentication information matches the stored second authentication information as a result of the verification by the usage confirmation verification means. Information generating means for generating the third authentication information based on the random number corresponding to the authentication information and the authentication terminal unique information which is uniquely determined in advance for each trader holding the authentication terminal, and the third information generation. The third authentication information generated by the means may be used as a use confirmation transmitting means for transmitting the authentication information to the authentication terminal, and may further function.

The usage confirmation sending means sends the authentication terminal, which has sent the first authentication information, the third authentication information generated based on the random number corresponding to the first authentication information and the authentication terminal unique information. Since the information is transmitted, it is possible to provide information for the trader holding the authentication terminal to generate management information of each user associated with the authentication terminal by using the authentication terminal unique information and the user unique information.

Further, in the user authentication system of the present invention, when the usage confirmation transmission means transmits the third authentication information to the authentication terminal, the random number used when generating the transmitted third authentication information and the random number Associated access information,
A reset unit that deletes the first authentication information and the second authentication information from the authentication information storage unit may be provided.

Further, in the user authentication method of the present invention, when the usage confirmation transmission means transmits the third authentication information to the authentication terminal, the random number used when the transmitted third authentication information is generated and the random number Associated access information, first
The reset step may be provided in which the reset means deletes the authentication information of No. 2 and the second authentication information from the authentication information storage means.

In the user authentication program of the present invention, when the usage confirmation transmitting means transmits the third authentication information to the authentication terminal, the computer uses the random number used when generating the transmitted third authentication information, The access information, the first authentication information, and the second authentication information associated with the random number may be further functioned as a reset unit that deletes from the authentication information storage unit.

For example, even if the access information, the random number, the first authentication information, and the second authentication information in a certain authentication phase are acquired by a third party, a valid authentication terminal ends the authentication phase. After that, such information is deleted, so that more secure authentication can be performed.

A computer-readable recording medium of the present invention has any one of the above user authentication programs recorded therein. When the user authentication program recorded on the recording medium of the present invention is executed using a computer, the user inquiry means stores the access information and the first authentication information received by the authentication request receiving means, and the authentication information storage means. Since the access information and the first authentication information are inquired, for example, even if only the first authentication information is obtained by a third party other than the user, if the access information does not match, it is not misused. More secure authentication can be performed. When the authentication terminal generates the second authentication information, the authentication transmission means transmits the generation time information stored in the authentication information storage means in association with the matching access information and the first authentication information to the authentication terminal. The generation time information can be provided as the information used for. Since the usage confirmation collating means collates the second authentication information received by the usage confirmation receiving means with the corresponding second authentication information stored in the authentication information storing means, it is based on the second authentication information. Authentication is possible. The second authentication information received by the usage confirmation receiving means is generated by the authentication terminal using the generation time information transmitted by the authentication transmitting means. For example, the second authentication information is combined with the generation time information to generate the second authentication information. If the first authentication information for generation is received from the user, the respective pieces of information can be made different each time, so that the impersonation of a third party can be effectively eliminated.

[0023]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The findings of the present invention can be easily understood by considering the following detailed description with reference to the accompanying drawings, which are shown for exemplification only. Subsequently, embodiments of the present invention will be described with reference to the accompanying drawings. When possible, the same parts are designated by the same reference numerals, and overlapping description will be omitted.

A user authentication system 10 which is an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a diagram for explaining a user authentication system 10. The user authentication system 10 is configured to be able to communicate with the authentication terminal 30. The user authentication system 10 and the authentication terminal 30 are connected via a dedicated line (not shown), and are configured to be able to mutually send and receive information. In addition, in the present embodiment, the mobile phone 20 and the authentication terminal 30 used by the user who is going to be authenticated via the authentication terminal 30 bring the mobile phone 20 near the authentication terminal 30 to obtain the information. It is configured to be able to send and receive. The mobile phone 20 and the authentication terminal 30 may be configured to transmit and receive information via a communication line. Further, a user or the like may read the information displayed on the mobile phone 20 and input the information to the authentication terminal 30. You may

The mobile phone 20 is a mobile phone that also has a data communication function used by a user, and is a TDMA.
(Time Division Multiple A
PDC (Persona), which is one of the
1 Digital Cellular (CDMA) system is adopted, but CDMA (Code Division M) is used.
It may be a digital mobile phone of another system such as the multiple access system, and GPRS (Ge
general Packet Radio Service
A method such as e) is also applicable, and various methods capable of data communication are appropriately adopted. Furthermore, IMT-2000
Such a so-called third generation mobile communication system may be used. In addition, P that has a communication function instead of a mobile phone
DA (Personal Digital Assist)
A portable information terminal such as a device (tance) may be used, and devices capable of information communication can be widely applied.

The authentication terminal 30 is physically a computer system including a CPU (central processing unit), a memory, an input device such as a mouse and a keyboard, a display device such as a display, a storage device such as a hard disk, and a communication device such as a modem. It is configured. The authentication terminal 30 is a terminal used by a store operator or the like, and is used for authenticating a user when the user uses each store.

The user authentication system 10 is physically
It is configured as a computer system including a CPU (central processing unit), a memory, an input device such as a mouse and a keyboard, a display device such as a display, a storage device such as a hard disk, and a communication device such as a modem.

The user authentication system 10 has, as a functional component, an authentication request receiving unit (authentication request receiving means) 101.
A user inquiring unit (user inquiring unit) 102, an authentication transmitting unit (authentication transmitting unit) 103, a use confirmation receiving unit (use confirmation receiving unit) 104, a use confirmation collating unit (use confirmation collating unit) 105, A third information generation unit (third information generation means) 106 and a usage confirmation transmission unit (usage confirmation transmission means) 1
07, a reset unit (reset unit) 108, and an authentication information storage unit (authentication information storage unit) 109. Subsequently, each component will be described in detail.

The authentication request receiving unit 101 is the authentication terminal 3 that is transmitted from the authentication terminal 30 that requests user authentication.
It is a part that receives an “authentication terminal ID (authentication terminal identification information)” for specifying 0, an “access number (access information)”, and an “ID key (first authentication information)”. "I
The “D key” is generated based on a “user unique key (user unique information)” that is uniquely determined in advance for each user and a “random number” that is randomly generated, and the user authentication system 10 Is information to be generated and transmitted to the mobile phone 20 in response to a request from the user. The “random number” used here is generated each time it is generated. Further, as a generation method for generating the “ID key” based on the “user unique key” and the “random number”, a method capable of back calculation such as addition, subtraction, multiplication and division is appropriately used. "Access number" and "ID key" sent from the authentication terminal 30
Is information passed from the mobile phone 20.
More specifically, a user who intends to use the store in which the authentication terminal 30 is installed brings the mobile phone 20 to the store, and the “access number” and “ID key” stored in the mobile phone 20 are stored. Is transmitted to the authentication terminal 30. The authentication terminal 30 transmits the received “access number” and “ID key” together with the “authentication terminal ID” to the user authentication system 10 in order to request authentication of the user,
The authentication request receiving unit 101 of the user authentication system 10 uses the “access number” and the “ID key” as the “authentication terminal ID”.
To receive with. The authentication request receiving unit 101 uses the received “access number” and “ID key” as the “authentication terminal ID”.
It is also output to the user inquiry unit 102.

The user inquiry unit 102 is the authentication request receiving unit 1
"Access number" and "ID key" received by 01,
This is a part for inquiring about the “access number” and the “ID key” stored in the authentication information storage unit 109. Also,
The user inquiry unit 102, based on the “authentication terminal ID”,
“Authentication terminal I” stored in the authentication information storage unit 109
This is the part for inquiring "D". More specifically, for example, an information string to which the “ID key” matches is searched, and if there is a match, the “access number” of the information string is inquired to check whether or not there is a match, and the “ID key” If both "access number" and "access number" match, it is judged that the received combination of "access number" and "ID key" is valid and authentication is performed. In addition, the user inquiring unit 102 searches for a matching “authentication terminal ID”, identifies which authentication terminal of which store is making the request, and sets the “authentication terminal ID” to the “ID key”.
And the authentication information storage unit 10 in association with the “access number”
9 is stored. When the user inquiring unit 102 determines that the result of the inquiry about the “ID key” and the “access number” is valid, the “generation time information” corresponding to the “ID key” and the “access number” is stored in the authentication information storage unit. It is read from 109 and output to the authentication transmission unit 103.

Here, an example of information stored in the authentication information storage unit 109 will be described with reference to FIGS. 2 (a) and 2 (b). FIG. 2A shows an example of information regarding a user who uses the user authentication system 10. Specifically, "user ID" and "user unique key" registered in advance
“Access number”, “random number”, “ID key”, “generation time information”, “use confirmation key”, and “authentication terminal ID” are stored in association with. The “user ID” is information for identifying each user on the system. The “user unique key” is information used for user authentication, and is information that is appropriately determined by the side operating the user authentication system 10, and is the user who uses the mobile phone 20 and the authentication terminal 3.
It is treated as confidential information by a store operator who uses 0. The “access number” is a number unique to each reception determined in response to the reception of the authentication information generation request from the user. The “random number” is a random number used when generating the ID key, and is stored in association with each “ID key”.

The "ID key" is information generated based on the "random number" and the "user unique key". The “use confirmation key” is information generated based on the “ID key” and the “generation time information”. "Generation time information" is "ID
Although it is determined based on the time when the "key" is generated, any other time can be appropriately selected. As the "generation time information", RTC (Real Time Cl
The time is measured by a time measuring unit (not shown) such as “ock”, and the position occupied by the time is represented by a decimal number. Specifically, if the time to generate the "use confirmation key" is 14:10,
850 minutes have passed since midnight, and one day (1440 minutes)
The position to occupy in is divided by 840 minutes by 1440 minutes,
It becomes "0.583333333". As a generation method when the "use confirmation key" is generated based on the "ID key" and the "generation time information", an addition / subtraction / multiplication / division operation or a one-way function such as a hash function is appropriately used. When the user uses the authentication information in a plurality of stores, each user may send a request to generate a plurality of authentication information. Therefore, the access number, the random number, the ID key, and the generation are generated for each user. There may be a case where a plurality of sets of "time information" and "use confirmation key" are stored.

FIG. 2B shows an example of information stored regarding the authentication terminal 30. Specifically, "store name"
In association with the "store unique key (authentication terminal unique information)",
“Authentication terminal ID” and “authentication terminal IP address” are stored. The “store unique key” is unique information assigned to each store and is information that is appropriately determined by the side operating the user authentication system 10, and is the mobile phone 20.
The information is treated as confidential information by a user who uses the user, a store operator who uses the authentication terminal 30, and the like. The “authentication terminal ID” is information for identifying each authentication terminal 30 on the system. The “authentication terminal IP address” is an IP address assigned to each authentication terminal 30. Since a plurality of authentication terminals 30 may be installed in each store, a plurality of “authentication terminal IDs” and “authentication terminal IP addresses” may be stored for “store name” and “store unique key”. is there.

The authentication transmission unit 103 is a user inquiry unit 102.
If there is a matching combination of “access number” and “ID key” in the authentication information storage unit 109, the authentication information storage unit is associated with the matching “access number” and “ID key”. This is a part for transmitting the “generation time information” stored in 109 to the authentication terminal 30. The authentication terminal 30 to which the “generation time information” has been transmitted, obtains the “use confirmation key (second authentication information)” based on the “ID key” and the “generation time information” passed from the mobile phone 20. Can be generated. The authentication terminal 30 transmits the “use confirmation key” thus generated to the user authentication system 10, and the use confirmation receiving unit 104 of the user authentication system 10 receives it. The usage confirmation receiving unit 104 outputs the received “use confirmation key” to the usage confirmation collating unit 105.

The usage confirmation collating section 105 is a section for collating the “usage confirmation key” received by the usage confirmation receiving section 104 with the “usage confirmation key” stored in the authentication information storage section 109. More specifically, the “use confirmation key” stored in the authentication information storage unit 109 corresponding to the “ID key” and the “access number” received by the authentication request receiving unit 101 and the use confirmation receiving unit 104 are The received “use confirmation key” is checked, and if the two match, the “ID
As a user corresponding to "key" and "access number",
The user of the mobile phone 20 is authenticated. Usage confirmation collation unit 1
If the result of the collation is that the “use confirmation key” received by the use confirmation receiving unit 104 and the “use confirmation key” stored in the authentication information storage unit 109 match, the result is 05 from the authentication information storage unit 109. The “random number” corresponding to the user of the mobile phone 20, the “authentication terminal ID” of the authentication terminal 30, and the “store unique key” of the store in which the authentication terminal 30 is installed are read and output to the third information generation unit 106. To do.

The third information generation unit 106 outputs the "random number" corresponding to the user of the mobile phone 20 and the "store unique key" of the store in which the authentication terminal 30 is installed, which is output from the use confirmation collation unit 105. Based on the “authentication terminal analysis key (3rd
Authentication information) ”. More specifically, the “authentication terminal analysis key” is generated by appropriately using a method capable of back-calculation such as addition, subtraction, multiplication and division based on the “random number” and the “store unique key”. The third information generation unit 106 outputs the generated “authentication terminal analysis key” together with the “authentication terminal ID” to the usage confirmation transmission unit 107.

The usage confirmation transmitting section 107 is a section for transmitting the "authentication terminal analysis key" generated and output by the third information generating section 106 to the authentication terminal 30 specified by the "authentication terminal ID". When the transmission of the "authentication terminal analysis key" is completed, the usage confirmation transmission unit 107 outputs the "ID key" and "access number" corresponding to the "random number" used when generating the transmitted "authentication terminal analysis key". Specify and reset unit 10
Output to 8.

The reset unit 108 includes the usage confirmation transmission unit 10
When 7 transmits the "authentication terminal analysis key" to the authentication terminal 30, the "random number" used when generating the transmitted "authentication terminal analysis key" and the "access number" and "ID" corresponding to the "random number" This is a part for deleting the “key”, the “generation time information”, and the “use confirmation key” from the authentication information storage unit 109. More specifically, the correspondence information stored in the authentication information storage unit 109 is based on the “ID key” and “access number” output when the usage confirmation transmission unit 107 transmits the “authentication terminal analysis key”. Search for and delete.

Subsequently, a method of authenticating a user using the user authentication system 10 will be described with reference to FIGS. 3 and 4. FIG. 3 is a flowchart showing a method in which the authentication terminal 30 transmits information to the user authentication system 10 and acquires authentication information. FIG. 4 is a flowchart showing a method in which the authentication terminal 30 processes the authentication information and transmits it to the user authentication system 10 to acquire another authentication information.

First, a method in which the authentication terminal 30 transmits information to the user authentication system 10 and acquires the authentication information will be described with reference to FIG. A user who intends to use the store in which the authentication terminal 30 is installed brings the mobile phone 20 to the store and delivers the "ID key" and the "access number" to the authentication terminal 30 (step S10). The authentication terminal 30 receives the “ID key” and the “access number” and stores them in the internal storage area (step S1).
1). The authentication terminal 30 combines the “ID key” and the “access number” to obtain the “authentication terminal ID” of the authentication terminal 30.
It is sent together with the user authentication system 10 (step S
12). At this time, you may send the last 4 digits of the ID key,
By transmitting a part of the ID key in this manner, security is improved because it is not necessary to transmit all the information even when using a network that does not have a high degree of confidentiality. Further, it becomes possible to reduce the amount of information transmitted and received.

The authentication request receiving unit 101 of the user authentication system 10 receives the "access number" and the "ID key" transmitted from the authentication terminal 30 requesting the user authentication together with the "authentication terminal ID" (step S13). ). The “access number” and the “ID key” transmitted from the authentication terminal 30 are the information passed from the mobile phone 20 used by the user. The authentication request receiving unit 106 outputs the received “access number”, “ID key”, and “authentication terminal ID” to the user inquiry unit 102.

User inquiry unit 1 of user authentication system 10
02 inquires about the “access number” and “ID key” received by the authentication request receiving unit 101 and the “access number” and “ID key” stored in the authentication information storage unit 109. In addition, the user inquiring unit 102 uses the “authentication terminal ID”.
Based on the, the “authentication terminal ID” stored in the authentication information storage unit 109 is inquired (step S14). The user inquiring unit 102 searches for an information string having a matching “ID key”, and if there is a matching one, inquires the “access number” of the information string to check whether there is a match, and If both "access numbers" match, it is determined that the received combination of "access number" and "ID key" is valid (step S15). If there is no matching information, the user inquiring unit 102 outputs information to that effect to the authentication transmitting unit 103, and the authentication transmitting unit 103 transmits authentication rejection information to the authentication terminal 30 (step S1).
6). The authentication terminal 30 receives the information of the authentication refusal and recognizes that the user does not have the proper usage qualification (step S17).

On the other hand, the user inquiry section 102 makes a decision at step S.
If it is determined to be valid in 15, the "generation time information" corresponding to the "ID key" and "access number"
Is read from the authentication information storage unit 109 and the "ID key" is read.
And the “access number” together with the output to the authentication transmission unit 103. The authentication transmission unit 103 of the user authentication system 10 receives the result of the inquiry from the user inquiry unit 102, and the authentication information storage unit 109.
If there is a combination of the “access number” and the “ID key” that match with, the authentication information storage unit 10 is associated with the matching “access number” and the “ID key”.
The "generation time information" stored in 9 is transmitted to the authentication terminal 30 (step S18). The authentication terminal 30 receives the "generation time information" from the user authentication system 10 (step S19).

Subsequently, a method of processing the authentication information by the authentication terminal 30 and transmitting it to the user authentication system 10 to acquire another authentication information will be described with reference to FIG. The authentication terminal 30 generates a “use confirmation key” based on the “ID key” received from the mobile phone 20 used by the user and the “generation time information” received from the user authentication system 10 (step S21). The authentication terminal 30 transmits the generated “use confirmation key” to the user authentication system 10 (step S22).

The use confirmation receiving unit 104 of the user authentication system 10 receives the "use confirmation key" transmitted from the authentication terminal 30, and outputs the received "use confirmation key" to the use confirmation collating unit 105 (step S23). ).

The usage confirmation collating unit 105 of the user authentication system 10 collates the “usage confirmation key” received by the usage confirmation receiving unit 104 with the “usage confirmation key” stored in the authentication information storage unit 109 ( Step S24). The usage confirmation collation unit 105 stores the “use confirmation key” stored in the authentication information storage unit 109 in correspondence with the “ID key” and the “access number” received by the authentication request reception unit 101, and the usage confirmation reception unit 104. Collates with the received "use confirmation key" to determine whether they match (step S
25). As a result of the collation, when the two do not match, the usage confirmation transmission unit 107 transmits the information of authentication refusal to the authentication terminal 30 (step S26). The authentication terminal 30 receives the authentication refusal information and recognizes that the user does not have the proper usage qualification (step S27). If the two match as a result of the collation, the use confirmation collating unit 105, from the authentication information storage unit 109, the “random number” corresponding to the user of the mobile phone 20, the “authentication terminal ID” of the authentication terminal 30, and the authentication terminal 30. The “store unique key” of the store where is installed is output and output to the third information generation unit 106.

The third information generation unit 106 of the user authentication system 10 outputs the "random number" corresponding to the user of the mobile phone 20 and the authentication terminal 30 output from the use confirmation collation unit 105.
Based on the "store unique key" of the store where is installed,
An "authentication terminal analysis key (third authentication information)" is generated (step S28). The third information generation unit 106 outputs the generated “authentication terminal analysis key” together with the “authentication terminal ID” to the usage confirmation transmission unit 107.

The use confirmation transmission unit 107 of the user authentication system 10 transmits the "authentication terminal analysis key" generated and output by the third information generation unit 106 to the authentication terminal 30 (step S29). When the transmission of the "authentication terminal analysis key" is completed, the usage confirmation transmission unit 107 outputs the "ID key" and "access number" corresponding to the "random number" used when generating the transmitted "authentication terminal analysis key". Specify and reset unit 10
Output to 8. The reset unit 108 includes the usage confirmation transmission unit 1
When 07 transmits the “authentication terminal analysis key” to the authentication terminal 30, the “random number” used when generating the transmitted “authentication terminal analysis key” and the “access number” and “ID” corresponding to the “random number” The "key", "generation time information", and "use confirmation key" are deleted from the authentication information storage unit 109 (step S30).

The authentication terminal 30 is the user authentication system 10
The "authentication terminal analysis key" transmitted from the usage confirmation transmission unit 107 is received (step S31). Authentication terminal 30
Is a “store unique user key” based on the “ID key” received from the mobile phone 20 used by the user and the “authentication terminal analysis key” transmitted from the usage confirmation transmission unit 107 of the user authentication system 10. Is generated (step S32).

Since the "user unique key for store" is generated by removing the part corresponding to the "random number" from the "ID key" and the "authentication terminal analysis key", the "user unique key" and the "store unique key" are generated. It becomes the information including the part corresponding to.
Therefore, it can be handled as information for managing the user for each store, and the "store unique user key"
You can build a database based on. Therefore, when the user who goes to the store in which the authentication terminal 30 is installed presents different information “ID key” every time, the store can acquire the “user specific key for store” for identifying the user. Therefore, the user authentication system 10 can be applied to various services such as displaying user information, displaying service waiting order, and adding points.

Next, a user authentication program 92 for causing a computer to function as the user authentication system 10 of this embodiment and a computer-readable recording medium 9 in which the user authentication program 92 is recorded will be described. FIG. 5 is a diagram showing the configuration of the recording medium 9 in which the user authentication program 92 is recorded. The recording medium 9 is, for example, a magnetic disk, an optical disk, a CD-ROM, a memory built in a computer, or the like.

As shown in FIG. 5, the recording medium 9 has a program area 91 for recording a program and a data area 93 for recording data. An authentication information database 931 similar to the authentication information storage unit 109 described with reference to FIG. 1 is stored in the data area 93.

A user authentication program 92 is recorded in the program area 91. User authentication program 9
2 is a main module 921 that supervises the processing, an authentication request receiving module 922, and a user inquiry module 9
23, an authentication transmission module 924, a usage confirmation reception module 925, a usage confirmation collation module 926,
A third information generation module 927, a usage confirmation module 928, and a reset module 929 are provided. Here, the authentication request reception module 922, the user inquiry module 923, the authentication transmission module 924, the usage confirmation reception module 925, the usage confirmation collation module 926, the third information generation module 927, and the usage confirmation module 92.
8. The function realized by operating each of the reset module 929 is the authentication request receiving unit 101, the user inquiring unit 102, the authentication transmitting unit 103, the usage confirmation receiving unit 104, and the usage confirmation collating unit 105 of the user authentication system 10. , Third information generation unit 106, usage confirmation transmission unit 10
7. The functions of the reset unit 108 are the same.

The operation and effect of this embodiment will be described. Since the user inquiry unit 102 makes an inquiry about the “access number” and “ID key” received by the authentication request receiving unit 101 and the “access number” and “ID key” stored in the authentication information storage unit 109, For example, "ID key"
Even if a third party other than the user obtains only the above, unless the “access number” is matched, it will not be misused and authentication with higher security can be performed. Authentication transmitter 10
3 transmits the “generation time information” stored in the authentication information storage unit 109 in association with the matching “access number” and “ID key” to the authentication terminal 30, the authentication terminal 3
The 0 can provide the "generation time information" as the information used when the "use confirmation key" is generated. Usage confirmation collating unit 105
Is the "use confirmation key" received by the use confirmation receiving unit 104
And the corresponding "use confirmation key" stored in the authentication information storage unit 109 are collated, so "use confirmation key"
Authentication based on is possible. The “use confirmation key” received by the use confirmation receiving unit 105 is generated by the authentication terminal 30 using the “generation time information” transmitted by the authentication transmission unit 103, and is combined with the “generation time information”, for example. If the "ID key" for generating the "use confirmation key" is received from the user, the respective pieces of information can be made different each time, so that impersonation of a third party can be effectively eliminated.

Since the generation time information is a numerical value determined based on the time when the "ID key" is generated, the position occupied by the time is a decimal number as a numerical value determined based on the time. By using the one represented by, it becomes easy to convert the information into other types of information.

The usage confirmation transmission unit 107 is used by the authentication terminal 30.
Since the "authentication terminal analysis key" generated based on the "random number" corresponding to the "ID key" and the "store unique key" is transmitted, the authentication terminal 30 sends the "authentication terminal analysis key" and the "ID key". Can be used to provide information for generating management information of each user associated with the authentication terminal 30. Since each authentication terminal can generate management information unique to each user, even if one authentication terminal obtains management information generated by another authentication terminal, that information is not related to which user. Since it is not possible to recognize whether or not there is such information, it is possible to avoid the misuse of information as much as possible, compared to the case where each authentication terminal uses common management information.

Even if an access number, a random number, an ID key, and a usage confirmation key in a certain authentication phase are acquired by a third party, those information will be stored after the legitimate user completes the authentication phase. Because it will be deleted
More secure authentication can be performed. Further, based on the generation time information, for example, an access number, a random number, an ID key, and
By deleting the information such as the usage confirmation key, it is possible to prevent unauthorized use of the information of a third party even when a legitimate user interrupts the transaction, and a more secure authentication can be performed. It can be carried out.

[0058]

According to the present invention, the user inquiring means receives the access information and the first authentication information received by the authentication request receiving means, and the access information and the first authentication information stored in the authentication information storing means. For example, the first
Even if a third party other than the user obtains only the authentication information of 1, if the access information does not match, it will not be misused, and more secure authentication can be performed. When the authentication terminal generates the second authentication information, the authentication transmission means transmits the generation time information stored in the authentication information storage means in association with the matching access information and the first authentication information to the authentication terminal. The generation time information can be provided as the information used for. Since the usage confirmation collating means collates the second authentication information received by the usage confirmation receiving means with the corresponding second authentication information stored in the authentication information storing means,
Authentication based on the authentication information of can be performed. The second authentication information received by the usage confirmation receiving means is generated by the authentication terminal using the generation time information transmitted by the authentication transmitting means,
For example, if the first authentication information for generating the second authentication information in combination with the generation time information is received from the user, the respective pieces of information can be made different each time, so that impersonation of a third party can be made. Can be effectively eliminated. Therefore, the object of the present invention is to provide a user authentication system, a user authentication method, and a user authentication that can reduce the amount of processing executed on the authentication terminal side for each authentication as much as possible and can perform more secure authentication. It was possible to provide a program and a computer-readable recording medium.

[Brief description of drawings]

FIG. 1 is a diagram for explaining a user authentication system that is an embodiment of the present invention.

FIG. 2 is a diagram showing an example of information stored in an authentication information storage unit of FIG.

FIG. 3 is a flowchart showing a method in which the authentication terminal 30 transmits information to the user authentication system 10 and acquires authentication information.

FIG. 4 is a flowchart showing a method in which the authentication terminal 30 processes the authentication information and transmits it to the user authentication system 10 to acquire another authentication information.

FIG. 5 is a diagram for explaining a user authentication program that is an embodiment of the present invention.

[Explanation of symbols]

10 ... User authentication system, 20 ... Mobile phone, 30 ...
Authentication terminal, 101 ... Authentication receiving unit, 102 ... User inquiring unit, 103 ... Authentication transmitting unit, 104 ... Usage confirmation receiving unit, 1
05 ... Usage confirmation collating unit, 106 ... Third information generating unit, 10
7 ... Usage confirmation transmission unit, 108 ... Reset unit, 109 ... Authentication information storage unit.

   ─────────────────────────────────────────────────── ─── Continued front page    F-term (reference) 5B085 AA08 AE01 AE09 AE23 BA07                       BG07                 5J104 AA07 KA02 PA07

Claims (13)

[Claims] 1. An authentication terminal specifying information for specifying the authentication terminal, which is transmitted from an authentication terminal attempting to authenticate a user, and user-specific information uniquely predetermined for each user and randomly generated. Authentication request receiving means for receiving first authentication information generated based on the generated random number and unique access information corresponding to each of the first authentication information, and the authentication request receiving means for receiving the authentication request receiving means. User inquiring means for inquiring the first authentication information and the access information stored in the authentication information storing means based on the first authentication information and the access information, and the matching access as a result of the inquiry by the user inquiring means. When a combination of the information and the first authentication information exists in the authentication information storage means, the authentication information is associated with the matching access information and the first authentication information. Authentication transmitting means for transmitting the generation time information stored in the storing means to the authentication terminal, and the authentication terminal generating based on the first authentication information and the generation time information transmitted by the authentication transmitting means. Corresponding to the usage confirmation receiving means for receiving the second authentication information, the second authentication information received by the usage confirmation receiving means, the access information and the first authentication information stored in the authentication information storage means. A user authentication system comprising: a use confirmation collating unit that collates the second authentication information. 2. The generation time information is a numerical value determined based on the time when the first authentication information is generated,
The user authentication system according to claim 1. 3. As a result of the collation by the use confirmation collating means, when the received second authentication information and the stored second authentication information match, the first authentication information is dealt with. Based on the random number and the authentication terminal unique information which is uniquely determined in advance for each trader holding the authentication terminal,
3. The third information generating means for generating the authentication information, and the usage confirmation transmitting means for transmitting the third authentication information generated by the third information generating means to the authentication terminal. User authentication system. 4. When the usage confirmation transmission means transmits the third authentication information to the authentication terminal, the random number used when the transmitted third authentication information is generated is associated with the random number. Access information, first authentication information, and
The user authentication system according to claim 3, further comprising reset means for deleting the second authentication information and the authentication information storage means. 5. The authentication request receiving means transmits authentication terminal specifying information for specifying the authentication terminal, which is transmitted from an authentication terminal that is going to authenticate a user, and user-specific information that is uniquely determined in advance for each user. An authentication request receiving step of receiving first authentication information generated based on the information and a randomly generated random number, and unique access information corresponding to each of the first authentication information; A user inquiring step for inquiring the first authentication information and the access information stored in the authentication information storage means based on the first authentication information and the access information received by the authentication request receiving means, As a result of the inquiry by the user inquiring means, if the matching combination of the access information and the first authentication information exists in the authentication information storing means, the authentication transmitting means determines that An authentication transmitting step of transmitting to the authentication terminal the generation time information stored in the authentication information storage means in association with the matching access information and the first authentication information; and the authentication terminal, the first authentication information and the The usage confirmation receiving step in which the usage confirmation receiving means receives the second authentication information generated based on the generation time information transmitted by the authentication transmitting means, and the usage confirmation collating means receives the second authentication information by the usage confirmation receiving means. 2. A user authentication method, comprising: a second authentication information, and a usage confirmation matching step of matching the access information and the second authentication information corresponding to the first authentication information stored in the authentication information storage means. 6. The generation time information is a numerical value determined based on the time when the first authentication information is generated,
The user authentication method according to claim 5. 7. The third information generating means, when the received second authentication information matches the stored second authentication information as a result of the verification by the usage confirmation matching means, the third information generating means A third information generating step of generating third authentication information based on a random number corresponding to the authentication information of No. 1 and authentication terminal unique information that is uniquely determined in advance for each business operator holding the authentication terminal; 7. The user authentication method according to claim 5, further comprising a usage confirmation transmitting step of transmitting the third authentication information generated by the third information generating means to the authentication terminal. 8. When the usage confirmation transmitting means transmits the third authentication information to the authentication terminal, the random number used when generating the transmitted third authentication information and the random number are associated with the random number. Access information, first authentication information, and
8. The reset step, wherein the reset means deletes the second authentication information from the authentication information storage means.
User authentication method described in. 9. The computer does not include authentication terminal identification information for identifying the authentication terminal, which is transmitted from an authentication terminal that attempts to authenticate the user, and user unique information that is uniquely determined in advance for each user. Authentication request receiving means for receiving first authentication information generated based on a randomly generated random number, and unique access information corresponding to each of the first authentication information, and reception of the authentication request. A user inquiring means for inquiring the first authentication information and the access information stored in the authentication information storing means based on the first authentication information and the access information received by the means, and a result of the inquiry by the user inquiring means, When a combination of the matching access information and the first authentication information exists in the authentication information storage means, it is associated with the matching access information and the first authentication information. Authentication transmission means for transmitting the generation time information stored in the authentication information storage means to the authentication terminal, and the generation time information transmitted by the authentication terminal and the authentication transmission means by the authentication terminal. Usage confirmation receiving means for receiving second authentication information generated based on the second authentication information, second authentication information received by the usage confirmation receiving means, the access information and the first information stored in the authentication information storage means. A user authentication program for functioning as a use confirmation collating unit that collates the second authentication information corresponding to the authentication information of 1. 10. The user authentication program according to claim 9, wherein the generation time information is a numerical value determined based on a time when the first authentication information is generated. 11. The computer receives the received second data as a result of the collation by the utilization confirmation collating means.
Authentication information and the stored second authentication information match, a random number corresponding to the first authentication information and an authentication terminal that is uniquely determined in advance for each trader holding the authentication terminal Third information generating means for generating third authentication information based on the unique information, and usage confirmation transmitting means for transmitting the third authentication information generated by the third information generating means to the authentication terminal. The user authentication program according to claim 9 for causing the program to function. 12. When the usage confirmation transmission means transmits the third authentication information to the authentication terminal, the computer associates the random number used in generating the transmitted third authentication information with the random number. The user authentication program according to claim 11, further comprising: resetting means for deleting the access information, the first authentication information, and the second authentication information, which have been set, from the authentication information storing means to further function. . 13. A computer-readable recording medium in which the user authentication program according to claim 9 is recorded.