JP2004214736A - Authentication certification apparatus and authentication certification method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simply prove that an authenticator authenticates a person to be authenticated. <P>SOLUTION: A requester inserts an authentication IC card 100 to a card reader 400 and also inserts an IC card 102 for a person to be authenticated that is possessed by an agent to the card reader 400. The authentication IC card 100 acquires and encrypts facial information being identification information of the agent from the authentication IC card 100 to be authenticated via a card reader 400 to generate an authentication electronic signature. Then an authentication certification apparatus 10 stores the authentication electronic signature into the authentication IC card 102 via the card reader 400. When the authentication electronic signature is decrypted by a public key of the requester, it is proved that the authentication electronic signature is generated by the authentication IC card 100. Thus, it is proved that the agent is requested to execute the procedure on behalf of the requester. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authentication certification apparatus that generates an electronic signature indicating that a person has been authenticated, and an authentication certification method using the electronic signature.
[0002]
[Prior art]
There are procedures that can only be performed by the principal at a government office or bank. Such procedures may be requested from an agent. Since no prior art document indicating a technique related to requesting an agent for a procedure has been recognized at this time, description on the prior art document is omitted.
[0003]
[Problems to be solved by the invention]
When requesting an agent to act for a procedure, the client needs to prove that the agent has requested the procedure. In the past, a power of attorney was created and entrusted to an agent, but creating a power of attorney required labor. Also, during the procedure, it was difficult to determine whether the power of attorney was genuine or forged.
[0004]
For this reason, it is necessary to be able to easily prove that the authentication target to be authenticated is authenticated.
[0005]
Accordingly, an object of the present invention is to provide an authentication certification apparatus and an authentication certification method that can solve the above-described problems. This object is achieved by a combination of features described in the independent claims. The dependent claims define further advantageous specific examples of the present invention.
[0006]
[Means for Solving the Problems]
That is, according to the first aspect of the present invention, an authentication certification device that indicates that an authentication target to be authenticated is authenticated by an authenticator, a secret key holding unit that holds the secret key of the authenticator, An authentication target information acquisition unit that acquires information indicating an authentication target, and encrypting the information indicating the authentication target using a secret key, and generating and generating an electronic signature for authentication indicating that the authentication target is authenticated by the certifier There is provided an authentication certification apparatus comprising an electronic signature generation unit for outputting the authentication electronic signature to the outside.
[0007]
In this authentication certification apparatus, the authentication certification apparatus includes an authentication IC card owned by the authenticator and a card reader that reads the authentication IC card, and the authentication IC card holds a secret key that holds the authenticator's private key. The card reader may include an authentication target information acquisition unit.
[0008]
The authentication certification apparatus has an authentication IC card owned by an authenticator, the authentication IC card includes a secret key holding unit, and the authentication target information acquisition unit receives authentication as information indicating an authentication target. The identification information of the person to be authenticated may be acquired from the IC card for authentication owned by the person to be authenticated, and the electronic signature generation unit may output the electronic signature for authentication and store it in the IC card for authentication.
In this case, the authentication target information acquisition unit may acquire the face information of the person to be authenticated as identification information of the person to be authenticated. Further, in this case, the authentication target information acquisition unit may include an imaging unit that captures the face of the person to be authenticated and generates face information.
[0009]
The subject of authentication is the agent requested by the certifier, and the electronic signature generation unit displays the agent content information indicating the agent content requested by the agent and the identification information of the agent. An electronic signature for authentication may be generated by encrypting with a secret key.
[0010]
In this case, the authentication certification apparatus may include an authentication IC card owned by the authenticator, and the authentication IC card may be necessary for the authenticator to perform the procedure.
In addition, the proxy information storage unit that stores the proxy and the proxy content in association with each other, and when the proxy performs the procedure, receives at least one of the information indicating the proxy and the information indicating the proxy content. You may further provide the proxy information output part which outputs the information which shows at least the other of the content outside.
[0011]
A certifier image holding unit that holds collation face information that is the face information of the certifier in advance, and a face information acquisition unit that acquires face information of a user who wants to generate an authentication digital signature using the authentication certification device And an authenticator authenticating unit for verifying that the user's face information is compared with the matching face information and authenticating that the user is an authenticator. An electronic signature may be generated when the user is authenticated.
In this case, the face information acquisition unit may acquire the user's face information from an external imaging device. The face information acquisition unit may include an imaging unit that images the user, and may generate face information based on an image captured by the imaging unit.
[0012]
According to a second aspect of the present invention, there is provided a method for indicating that an authentication object to be authenticated is authenticated by an authenticator by generating an electronic signature by an authentication certification apparatus, and an IC card possessed by the authenticator The authentication certification device encrypts the information indicating the authentication target using the private key held by the IC card and generates an electronic signature for authentication, and the authentication certificate is released. There is provided an authentication certification method characterized in that when an electronic signature for authentication is decrypted with a key and information indicating an authentication target is obtained, it is determined that the authentication target is authenticated by an authenticator.
[0013]
The above summary of the invention does not enumerate all the necessary features of the present invention, and sub-combinations of these feature groups can also be the invention.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described through embodiments of the invention. However, the following embodiments do not limit the invention according to the claims, and all combinations of features described in the embodiments are included. It is not necessarily essential for the solution of the invention.
[0015]
FIG. 1 is a schematic diagram illustrating an authentication certification apparatus 10 that is a first example of an embodiment of the present invention. The authentication certification device 10 is used to prove that the client has requested the agent to act as a proxy.
[0016]
Specifically, the authentication certification apparatus 10 has an authentication authentication IC card 100 and a card reader 400 possessed by the client. The card reader 400 includes a touch panel type input unit 410 and an imaging unit 420.
The requester inserts the authentication IC card 100 for authentication into the card reader 400. Further, the IC card for authentication 102 owned by the agent is also inserted into the card reader 400. Then, the requester inputs, to the input unit 410, the content to be requested for proxy and the expiration date of the proxy right as information indicating the proxy content.
[0017]
Then, the authentication authentication IC card 100 acquires face information, which is identification information of the agent, from the authentication authentication IC card 100 via the card reader 400. The face information may be, for example, a face image, or information indicating facial features. Then, the authentication IC card 100 encrypts the agent's face information and information indicating the proxy content input to the card reader 400, and generates an authentication electronic signature. Then, the authentication certification apparatus 10 stores the authentication electronic signature in the IC card for authentication 102 via the card reader 400. At this time, the imaging unit 420 of the card reader 400 images the client and authenticates that the client is the owner of the authentication IC card 100.
[0018]
After that, as shown in FIG. 2, the agent goes to a place where the procedure is to be performed, for example, a public office or the like, with the IC card for authentication 102 brought. An authentication confirmation device 300 is installed at a public office or the like. The authentication confirmation apparatus 300 acquires the requester's public key, and uses this public key to authenticate the authentication electronic signature stored in the IC card for authentication 102 and information indicating the agent's face information and proxy contents To decrypt. If the decryption is successful, it is proved that the authentication electronic signature is generated by the authentication IC card 100. Therefore, it is proved on the spot that the agent has been requested to substitute the procedure.
[0019]
Further, the authentication confirmation apparatus 300 causes the display apparatus 500 to display the decrypted face information. A person such as a government office visually collates the displayed face information with the face of the agent in front of the eyes. By this work, it is proved on the spot that the agent who is requested to represent the procedure is the person on the spot.
The face matching may be performed by face authentication processing by a computer. In this case, the authentication confirmation device 300 includes an imaging device. This imaging device captures the face of a person who came to perform the procedure and generates face information. Then, the authentication verification apparatus 300 main body collates the face information generated by the imaging with the face information included in the authentication digital signature, and calculates the degree of coincidence. If the calculated degree of coincidence is equal to or greater than a predetermined reference value, the agent is authenticated.
[0020]
FIG. 3 is a block diagram showing a configuration of the authentication IC card 100. The authentication IC card 100 includes an owner identification information holding unit 110, a procedure information holding unit 120, an authentication target information acquisition unit 130, an owner image holding unit 160, an owner authentication unit 170, a secret key holding unit 180, and an electronic signature generation Unit 190, proxy information storage unit 210, and proxy information output unit 220.
[0021]
The owner identification information holding unit 110 holds the ID of the owner of the authentication IC card 100 in advance. The procedure information holding unit 120 holds in advance information indicating in which procedure the authentication IC card 100 is necessary. This procedure is, for example, a bank deposit withdrawal or a procedure at a government office. The owner image holding unit 160 is an example of an authenticator image holding unit, and holds in advance face information for verification for authenticating the owner. The private key holding unit 180 holds the authenticator's private key in advance.
[0022]
Further, the authentication target information acquisition unit 130 acquires the facial information of the agent. The owner authentication unit 170 authenticates that the user of the authentication IC card 100 is the owner of the authentication IC card 100. The electronic signature generation unit 190 generates an authentication electronic signature. The proxy information output unit 220 outputs the proxy content to the authentication confirmation apparatus 300 when the authentication confirmation apparatus 300 authenticates the agent based on the authentication digital signature. Details of these operations will be described later with reference to flowcharts.
[0023]
FIG. 4 is a table showing the data configuration of the proxy information storage unit 210. The proxy information storage unit 210 stores the proxy ID for identifying the proxy, the proxy content requested by the client from the proxy, and the expiration date of the proxy right in association with each other. Accordingly, by making an inquiry to the proxy information storage unit 210, it is possible to confirm the proxy content requested by the client and the expiration date.
The proxy information storage unit 210 may store the authentication electronic signature in association with the proxy ID.
[0024]
FIG. 5 is a block diagram of the authentication confirmation apparatus 300. The authentication confirmation apparatus 300 includes an IC card information holding unit 320, an electronic signature decryption unit 330, a proxy authentication unit 340, and a display control unit 350.
[0025]
The IC card information holding unit 320 holds in advance the address of the authentication IC card 100 or the card reader 400 in association with the ID of the owner of the authentication IC card 100 or the card reader 400.
The display control unit 350 controls the display device 500.
[0026]
The electronic signature decryption unit 330 obtains the requester's public key from the outside and decrypts the authentication electronic signature. The proxy authentication unit 340 confirms that the information indicating the proxy content included in the authentication electronic signature matches the proxy content stored in the authentication IC card 100. Details of these operations will be described later with reference to flowcharts.
[0027]
FIG. 6 is a flowchart showing the operation when the requester's authentication IC card 100 generates an authentication electronic signature. As a premise, the IC card 102 for the vehicle to be authenticated holds in advance the agent's face information as information for identifying the agent.
First, the authentication target information acquisition unit 130 acquires the face information of the agent from the IC card 102 for authentication of the agent (S10). At this time, the agent's ID is also acquired.
Note that the imaging unit 420 of the card reader 400 may capture the agent and generate face information. In this case, the time from the generation of the agent's face information to the execution of the procedure delegated by the agent is shortened. Therefore, the possibility that the face and hairstyle of the agent when executing the requested procedure is different from the face information included in the authentication digital signature is low.
[0028]
Then, the requester inputs information indicating contents to be requested for proxy to the proxy and the expiration date of the proxy right to the input unit 410 of the card reader 400. The owner authentication unit 170 acquires information input to the input unit 410 (S20). Then, the owner authentication unit 170 authenticates that the input proxy content is within the procedure indicated by the information held by the procedure information holding unit 120, that is, within the authority of the authentication IC card 100 (S30). ).
[0029]
In addition, the imaging unit 420 of the card reader 400 images the face of the user of the authentication IC card 100 and generates face information of the holder. The owner authentication unit 170 acquires the face information generated by the imaging unit 420 (S40). And it verifies with the authentication image of the owner which the owner image holding part 160 hold | maintains, and it authenticates that a user is the owner of the IC card 100 for authentication (S50).
[0030]
When the requester is authenticated as the owner, the electronic signature generation unit 190 encrypts the agent's face information and information indicating the proxy content using the secret key held by the secret key holding unit 180. An electronic signature for authentication is generated (S60).
For this reason, even if a person other than the owner of the authentication IC card 100 uses the authentication IC card 100, the authentication IC card 100 cannot generate an authentication electronic signature. Therefore, the reliability of the generated electronic signature for authentication is increased. Also, the secret key is not output to the outside of the authentication IC card 100 when generating the authentication electronic signature. Therefore, the possibility that the secret key is leaked is also reduced.
[0031]
Also, the electronic signature generation unit 190 stores the proxy ID, the requested proxy content, and the expiration date of the proxy right in the proxy information storage unit 210 in association with each other (S70).
[0032]
Then, the electronic signature generation unit 190 outputs the authentication electronic signature and the ID of the requester held by the owner identification information holding unit 110 to the IC card for authentication 102 and stores them in association with each other (S80). ). Therefore, the authentication confirmation apparatus 300 can determine which authentication IC card 100 has generated the authentication electronic signature based on the secret key held by the authentication IC card 100 based on the requester's ID.
[0033]
FIG. 7 is a flowchart showing the operations of the authentication confirmation device 300 and the card reader 400 when confirming that the agent is authenticated by the client based on the electronic signature for authentication. Here, the authentication IC card 100 is inserted in advance into the card reader 400 owned by the client.
The electronic signature decryption unit 330 of the authentication confirmation apparatus 300 reads the authentication electronic signature and the requester ID from the IC card for authentication 102 (S200). Then, the electronic signature decryption unit 330 acquires the requester's public key using the requester's ID, and uses the acquired public key to decrypt the authentication electronic signature into the proxy content and the agent's face information (S210). ).
[0034]
When the authentication electronic signature is successfully decrypted (S220: Yes), the proxy authentication unit 340 of the authentication confirmation device 300, based on the owner's ID, from the IC card information holding unit 320 of the authentication confirmation device 300 to the card reader 400. And the agent's ID is transmitted to the card reader 400 (S230).
If decryption of the authentication electronic signature fails (S220: No), the authentication confirmation apparatus 300 determines that the authentication electronic signature has not been properly generated and ends the process.
[0035]
The card reader 400 inputs the received proxy ID to the proxy information output unit 220 of the authentication IC card 100. The proxy information output unit 220 of the authentication IC card 100 reads the proxy content from the proxy information storage unit 210 based on the input proxy ID and outputs it to the card reader 400 (S240). The card reader 400 transmits the proxy content to the proxy authentication unit 340 of the authentication confirmation apparatus 300 (S250).
The proxy authentication unit 340 confirms that the proxy content received from the proxy information output unit 220 matches the proxy content included in the authentication digital signature (S260). Then, the display control unit 350 causes the display device 500 to display the agent's face information and proxy content (S270).
[0036]
As described above, the authentication confirmation apparatus 300 refers to the proxy content stored in the authentication IC card 100 and confirms the proxy content included in the authentication electronic signature. Therefore, the reliability of the proxy content displayed on the display device 500 is high.
[0037]
In the first example described above, the authentication IC card 100 generates the authentication electronic signature. However, the configuration may be changed so that the card reader 400 generates the authentication electronic signature. This first modification will be described with reference to FIGS.
[0038]
FIG. 8 is a block diagram of the authentication IC card 100 according to this modification. The authentication IC card 100 includes an owner identification information holding unit 110, a procedure information holding unit 120, an owner image holding unit 160, and a secret key holding unit 180. The function of each part is the same as in the first example.
[0039]
FIG. 9 is a block diagram of a card reader 400 according to this modification. In addition to the input unit 410 and the imaging unit 420, the card reader 400 includes an authentication target information acquisition unit 130, an owner authentication unit 170, an electronic signature generation unit 190, a proxy information storage unit 210, and a proxy information output unit 220. The function of each unit is the same as the function of each unit included in the authentication IC card 100 of the first example, except for the data configuration of the proxy information storage unit 210.
[0040]
In this modification, the authentication IC card 100 does not have an arithmetic processing function. For this reason, the authentication IC card 100 does not have to include an arithmetic processing unit. Therefore, the manufacturing cost of the authentication IC card 100 can be kept low.
[0041]
In this modification, the proxy information storage unit 210 associates the proxy ID for identifying the proxy, the proxy content requested by the requester with the proxy, and the expiration date of the proxy right with the ID of the requester. Store. Then, for example, in S230 of FIG. 7, the proxy authentication unit 340 of the authentication confirmation apparatus 300 transmits the requester ID to the card reader 400 together with the proxy ID. The proxy information output unit 220 selects information indicating the proxy content based on the requester's ID, and returns the selected information to the proxy authentication unit 340. By doing in this way, the proxy authentication part 340 can confirm the proxy content which the client requested to the agent.
[0042]
As a second modification, the authentication IC cards 100 and 100b may directly and wirelessly transmit and receive information. In this case, the authentication IC card 100 becomes the authentication certification device 10.
The configuration of the authentication IC card 100 according to this modification is shown in FIG. In the second modification, the authentication IC card 100 includes an owner input unit 140 and an imaging unit 150 in addition to the configuration shown in FIG. The owner input unit 140 is provided for the owner to input the proxy content and the expiration date of the proxy right. The imaging unit 150 captures an image of the user, generates user face information, and causes the owner authentication unit 170 to authenticate that the user is the owner of the IC card. The other functions of the authentication IC card 100 according to this modification are the same as those in the first example, and thus the description thereof is omitted.
[0043]
In this way, even if the card reader 400 is not provided, the requester can request a proxy for the procedure. In this modification, the authentication IC card 100 has an IP address or a mail address. This IP address or mail address is held in advance in the IC card information holding unit 320 of the authentication confirmation apparatus 300 in association with the owner's ID. For this reason, the authentication confirmation apparatus 300 can be directly connected to the proxy information output unit 220 at the time of authentication confirmation (for example, S230 in FIG. 7).
[0044]
Note that in the authentication IC card 100 according to the second modification, the imaging unit 150 may capture an agent and generate facial information of the agent.
[0045]
In this case, the authentication target information acquisition unit 130 can be omitted from the authentication IC card 100.
Further, even if the agent does not have the authentication IC card 100, the requester causes the authentication IC card 100 of the requester to generate an authentication electronic signature, and the generated authentication electronic signature is used as the IC for authentication. By storing the data in a storage medium other than the card 102, it is possible to request the agent to substitute the procedure. In this case, the agent brings the storage medium storing the authentication electronic signature and executes the procedure requested for the agent.
Furthermore, as compared with the case where the face information of the agent is acquired from the IC card for authentication 102, the time from when the face information of the agent is generated until the agent delegates the procedure is shortened. Therefore, the possibility that the face and hairstyle of the agent when executing the requested procedure is different from the face information included in the authentication digital signature is low.
[0046]
As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment. Various modifications or improvements can be added to the above embodiment. It is apparent from the scope of the claims that the embodiments added with such changes or improvements can be included in the technical scope of the present invention.
[0047]
For example, in the above-described embodiment, the authentication target is a proxy, but the authentication target is not limited to the proxy. For example, an IC tag attached to an article may be an authentication target. In this case, the authentication target information is identification information of the IC tag. Then, by attaching the IC tag, it is proved that the article is authenticated by the authenticator.
[0048]
【The invention's effect】
As is apparent from the above description, according to the present invention, it can be easily proved that the certifier has authenticated the person to be authenticated.
[Brief description of the drawings]
FIG. 1 is a schematic view of an authentication lighting device 10 as a first example of an embodiment of the present invention.
FIG. 2 is a conceptual diagram when authenticating a proxy using an IC card for authentication 102 owned by the proxy.
3 is a block diagram showing a configuration of an authentication IC card 100. FIG.
4 is a table showing a data configuration of a proxy information storage unit 210. FIG.
5 is a block diagram of an authentication confirmation apparatus 300. FIG.
FIG. 6 is a flowchart showing an operation when a requester authentication IC card 100 generates an electronic signature for authentication.
FIG. 7 is a flowchart showing operations of the authentication confirmation device 300 and the card reader 400 when confirming an agent.
8 is a block diagram of a first modification of the authentication IC card 100. FIG.
FIG. 9 is a block diagram of a card reader 400 according to a first modification.
10 is a block diagram of a second modification of the authentication IC card 100. FIG.
[Explanation of symbols]
100, 100a, 100b IC card 130 Authentication object information acquisition unit 150 Imaging unit 160 Owner image holding unit (authenticator image holding unit)
170 Owner Authentication Unit 180 Private Key Holding Unit 190 Electronic Signature Generation Unit 210 Proxy Information Storage Unit 220 Proxy Information Output Unit 400 Card Reader 420 Imaging Unit

Claims (12)

An authentication certification device indicating that an authentication target to be authenticated is authenticated by a certifier,
A private key holding unit for holding the authenticator's private key;
An authentication target information acquisition unit for acquiring information indicating the authentication target;
The information indicating the authentication target is encrypted using the secret key, an authentication electronic signature indicating that the authentication target is authenticated by the certifier is generated, and the generated authentication electronic signature is output to the outside. An authentication certification apparatus comprising: an electronic signature generation unit. The authentication certification device includes an authentication IC card owned by the authenticator and a card reader that reads the authentication IC card,
The authentication IC card includes a secret key holding unit that holds the authenticator's secret key and the electronic signature generation unit,
The authentication certification apparatus according to claim 1, wherein the card reader includes the authentication target information acquisition unit. The authentication certification apparatus has an authentication IC card owned by the authenticator, and the authentication IC card includes the secret key holding unit,
The authentication target information acquisition unit acquires, as information indicating the authentication target, identification information of an authenticated person to be authenticated from an IC card for authentication owned by the authenticated person, and the electronic signature generation unit includes: 2. The authentication certification apparatus according to claim 1, wherein the authentication electronic signature is output and stored in the IC card for authentication. The authentication certification apparatus according to claim 3, wherein the authentication target information acquisition unit acquires the face information of the person to be authenticated as identification information of the person to be authenticated. The authentication certification apparatus according to claim 4, wherein the authentication target information acquisition unit includes an imaging unit that images the face of the person to be authenticated and generates the face information. The authentication object is an agent who has been requested to proceed by the certifier,
The electronic signature generation unit generates the electronic signature for authentication by encrypting proxy content information indicating proxy content requested by the agent and identification information of the agent with a secret key of the certifier. The authentication certification apparatus according to claim 1. The authentication certification device includes an authentication IC card owned by the authenticator,
The authentication certification apparatus according to claim 6, wherein the authentication IC card is necessary for the certifier to perform the procedure. Furthermore,
A proxy information storage unit that stores the proxy and the proxy content in association with each other;
When the agent performs the procedure, the agent receives at least one of the information indicating the agent and the information indicating the proxy content, and outputs the information indicating at least the other of the agent and the proxy content to the outside The authentication certification apparatus according to claim 6, further comprising an output unit. An authenticator image holding unit that holds in advance face information for verification that is the face information of the authenticator;
A face information acquisition unit that acquires face information of a user who is to generate the authentication electronic signature using the authentication certification device and the face information of the user are checked against the matching face information, and the user A certifier authenticating unit that authenticates that is the certifier;
Further comprising
The authentication certification apparatus according to claim 1, wherein the electronic signature generation unit generates the electronic signature when the certifier authentication unit authenticates the user as the certifier. The authentication certification apparatus according to claim 9, wherein the face information acquisition unit acquires the face information of the user from an external imaging device. The authentication certification apparatus according to claim 9, wherein the face information acquisition unit includes an imaging unit that images the user, and generates the face information based on an image captured by the imaging unit. A method for indicating that an authentication object to be authenticated is authenticated by a certifier by an authentication certification device generating an electronic signature,
The secret key of the certifier is held in the IC card possessed by the certifier,
The authentication certification device generates an electronic signature for authentication by encrypting information indicating an authentication target using the secret key held by the IC card,
An authentication certificate, wherein when the authentication digital signature is decrypted with the public key of the authenticator and information indicating the authentication target is obtained, the authentication target is determined to be authenticated by the authenticator Method.

Images