JP2005050150A - Authentication system using positioning information, authentication method thereof, and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent illicit authentication requests by restricting the location or position where authentication is requested and to ensure security by restricting the location where authentication is requested and the location where business is conducted. <P>SOLUTION: In an authentication system which authenticates a user when an ID and a password are sent to the system by means of an information terminal, the information terminal 2 includes a positioning means 21 for positioning its own current position and a means for sending at least one of the ID, the password or the current position to the authentication system 6 when the user requests authentication. The authentication system includes an authentication database 61 which registers IDs, passwords, and position information restricting the location where authentication is requested; and an authentication means which authenticates an authentication request if the position information retrieved based on the at least one of the ID, the password or the current position matches the current position within a permissible area. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a system for requesting authentication from an information terminal, and more particularly to an authentication system based on positioning information for limiting the place where an authentication request is transmitted and improving authentication security, an authentication method thereof, and a program thereof.

  Conventionally, in an authentication system, a method of specifying a user using an ID and a password and giving a use authority of a system for operating information has been operated. However, this conventional technique has the following problems.

  The first problem is that authentication by ID and password is easily unlocked by a third party. The ID and password must be memorized by the user himself / herself, and it is very difficult to memorize a sufficiently secure combination of ID and password. This is because the possibility of being unlocked by hitting is very high.

  A second problem is that in authentication using only an ID and a password, a third party can try to unlock the lock from an arbitrary location. This is because when unlocking can be performed, if an authenticable line can be used for a system that operates information, unlocking can be attempted from anywhere without being trapped in a physical place.

  The third problem is that in order to ensure security, it is not possible to restrict the operation to a specific place and area. When it is intended to ensure security by using the system from a specific place and area, authentication using ID and password has a problem that the system can be used from an inconvenient place or a place outside the unauthorized area.

  Therefore, from the viewpoint of strengthening the security of authentication requests and business execution, the means for detecting the location of the information terminal detects that the information terminal is within a specific permitted area in the building, thereby enhancing the security of user authentication. There is an example of strengthening (for example, Patent Document 1).

  In addition, in voter authentication in an electronic voting system, there is an example in which voting is permitted by authenticating using an ID and a password and matching the position information of the terminal with a pre-registered position (for example, patents) Reference 2).

JP-A-10-56449 (paragraphs 0029 to 0034)

JP 2002-163414 A (paragraphs 0020 to 0023)

  In a conventional authentication system, by using location information in addition to an ID and a password, in addition to specifying a user, a place where business is performed is limited and security is enhanced. . However, this conventional technique has the following problems.

  The first problem is that the success rate of authentication decreases when the position where authentication is requested is limited. The cause is that the current position measured by the positioning means includes an error. For this reason, unsuccessful authentication occurs because the registered position information and the current position by positioning cannot be completely matched.

  FIG. 4A exemplifies this situation. When the measurement error E and the authentication range R1 are the same, the relationship between the measurement error E and the authentication range R2 is twice E in FIG. Show. FIG. 5 illustrates the distance between the position information stored in the authentication database 61 and the measurement position and the authentication rate when the measurement error is 10 meters, the authentication radius is 10 meters, and 20 meters. When only the measurement error E is considered in the authentication, since the authentication range R1 = E, as shown in FIG. 4A, only when positioning is performed at the same position as the position information stored in the authentication database 61. If the authentication succeeds with a probability of 100% and the position for positioning is slightly different, the authentication success rate decreases (curved line in FIG. 5).

  Further, a constant of the comparison formula is set so that the authentication range R2 ≧ E. This case is shown in FIG. Even when the position of the positioning is shifted with respect to the position information stored in the authentication database 61, it is possible to succeed in the authentication as shown by the thick line in FIG.

  The second problem is that, when there is a discrepancy between the location information registered in the authentication database and the current location due to the location of the authentication request, the location is restricted by authentication security and authentication is permitted. When there is no current position in the authentication request, the position is unrestricted as in a normal authentication request using an ID and a password. When the authentication request includes at least one of an ID and a password and the current position, the difference between the position information in the authentication database and the current position is determined based on whether or not it is within a predetermined allowable range. FIG. 3 illustrates an evaluation formula 62 for the allowable range. When the difference between the current position obtained by positioning of the latitude, longitude, and altitude and the registered position information is squared and multiplied by the evaluation coefficient is smaller than the allowable value D, it is evaluated that the current position is within the allowable range. For example, when it is desired to limit the current position to a pinpoint location, a specific building, or a specific administrative area, the allowable value D can be appropriately set.

  An object of the present invention is to prevent an unauthorized authentication request by limiting the location or position where the authentication is requested.

  Furthermore, another object is to secure security by limiting the place where authentication is requested and the place where business is performed.

  Therefore, in the system for authenticating the user by sending the ID and password to the authentication system using the information terminal of the present invention, the information terminal includes positioning means for measuring its current position, and the user requests the authentication. And a means for sending at least one of the ID or password or the current position to the authentication system, wherein the authentication system limits the ID and password and a place where authentication is requested. An authentication database for registering information and its allowable range, and the authentication database is searched by at least one of the ID, password, or current position, and the position information and the current position are the allowable Authentication means for authenticating the authentication request by matching within a range. The features.

  Further, the permissible range is a predetermined area when the authentication security is the highest, when the authentication security limits the location within the range of the positioning error of the positioning means, when the authentication security is the lowest, and the location without the location restriction. It is characterized by being set within the range.

  Furthermore, the information terminal is a terminal device installed at a specific place in a building, a mobile terminal of a user, or a mobile terminal mounted on a vehicle.

  Further, the positioning means is a position measuring device using GPS or a movement detecting device.

  The first effect is that it is very difficult to break through authentication by a brute force method even when the authentication terminal passes to a third party. The reason is that it is necessary to specify the physical location where authentication is performed, and the act of breaking authentication cannot be repeated at that location.

  The second effect is that an area for ensuring authentication security can be set by setting an allowable range in the comparison between the current position and registered position information. The reason is that the area for authentication and work can be limited from a radius of several tens of meters to an unlimited range, centering on the registered position information.

  A third effect is that a system for operating information can be used from a specific place and area without receiving an ID and a password. The reason is that the present invention enables authentication only with position information.

  The best mode for carrying out the present invention will be described with reference to the drawings. Referring to FIG. 1, this embodiment includes a user 1 or a vehicle 11, an information terminal 2 operated at the time of authentication, positioning means 21 for positioning a current position attached to the information terminal 2, and a wireless line 53 for the authentication system. A network 5 including a wireless station 50, a wired line 51, and a wired line 52 to be connected, and an authentication system 6 for authenticating a user are included.

  The information terminal 2 includes positioning means 21 that measures the current position, and performs positioning using a GPS or a movement detection device (not shown).

  The authentication system 6 includes an authentication database 61, and an authentication request including an arbitrary combination of an ID, a password, or a current position input from the user 1 or the vehicle 11 through the information terminal 2 is sent by the authentication database 61 and an authentication unit (not shown). Then, authentication pass / fail is determined.

  The authentication database 61 registers the ID and password, position information that limits the place where authentication is requested, and the allowable range thereof.

  Next, the operation of this embodiment will be described with reference to the drawings. Referring to FIG. 2, the user 1 or the vehicle 11 connects the authentication system 6 through the network 5 by the information terminal 2 (step 601 in FIG. 2). The user 1 or the vehicle 11 sends an authentication request to the authentication system 6 through the information terminal 2 (step 602). The combination of the ID and password included in the authentication request and the current position is analyzed (step 603). If the ID and password are included in the authentication request and the current position is not included, the ID and password stored in the authentication database 61 are searched with the ID and password sent from the information terminal 2 (step 604), A pass / fail decision is made and an unlimited position tolerance is selected (step 605).

  When the authentication request includes the ID, password, and current position, the ID and password stored in the authentication database 61 are searched for the authentication database 61 with the ID, password, and current position sent from the information terminal 2, and the position The information is collated, and authentication is performed when the positional deviation between the current position and the position information is within a predetermined allowable range (step 607).

  When the current position is included in the authentication request and the ID and password are not included (step 608), the position information stored in the authentication database 61 is compared with the current position to determine whether the authentication is successful or not. A positional deviation between the position and the position information is authenticated within a predetermined allowable range (step 609). Authentication in each case is permitted within the allowed half of the location (step 610).

  The current position of the positioning means 21 includes a measurement error. Furthermore, when the information terminal 2 cannot be installed at a planned location, it is considered difficult to determine whether the authentication is successful or not by comparing the position information registered in the authentication database 61 and the current position. Therefore, as illustrated in FIG. 3, an evaluation formula 62 for arbitrarily setting the current position and the allowable range of the position information is introduced. This mechanism is the same as expressing the strictness of authentication security by location restrictions.

  Referring to FIG. 3, when the current position by the positioning means 21, position information registered in advance, and the difference and the allowable range of authentication are expressed by a three-dimensional sphere, The square value of each difference in altitude can be represented by an allowable value D determined by weighting with an evaluation coefficient. In order to make the expanded allowable range an area having a shape such as a municipal border, for example, it can be realized by selecting an evaluation coefficient and setting the allowable value D to an appropriate value. Furthermore, it is possible to set the range of authentication security to be strict or loose, such as the allowable range of authentication from the pinpoint location to 4Km outside the municipal boundary, and select the evaluation coefficient of evaluation formula 62 Can be applied.

  It can be applied to operations performed in a limited area such as authentication of the information terminal itself or financial affairs and public procedure operations with user authentication.

It is a figure which shows the structure of the best form which implements this invention. It is a flowchart which shows operation | movement of this best form. It is a figure which illustrates the evaluation type | formula which determines the grade of authentication security. It is a figure which illustrates the relationship between a positioning error and the tolerance | permissible_range of position information. It is a figure which illustrates the authentication success rate when collating current position and position information.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 User 2 Information terminal 5 Network 6 Authentication system 11 Vehicle 21 Positioning means 50 Wireless station 51 Wired line 52 Wired line 53 Wireless line 61 Authentication database

Claims (6)

In the system that authenticates the user by sending the ID and password to the authentication system using the information terminal,
The information terminal
A positioning means for measuring its current position;
Means for sending at least one of the ID or password or the current location to the authentication system when a user requests authentication;
With
The authentication system includes:
An authentication database for registering the ID and password and location information for limiting the location where authentication is requested and its allowable range;
The authentication database is searched by at least one of the ID, password, or current position, and the authentication request is authenticated by matching the position information and the current position within the allowable range. Authenticating means to
An authentication system using positioning information, comprising: The allowable range is
When the authentication security is the highest, it is set within the range of the positioning error of the positioning means, when the authentication security is the lowest, the range without location restrictions, and when the authentication security places restrictions, it is set within the range within the predetermined area. The authentication system using positioning information according to claim 1. The information terminal
2. The positioning information authentication system according to claim 1, which is a terminal device installed at a specific place in a building, a mobile terminal of a user, or a mobile terminal mounted on a vehicle. The positioning means is
2. The positioning information authentication system according to claim 1, which is a position measuring device using GPS or a movement detection device. In an authentication method of a system for authenticating a user by sending an ID and a password to an authentication system using an information terminal,
The procedure for the user to connect the information terminal to the authentication system,
A procedure for a user to send his / her authentication request through an information terminal to the authentication system having an authentication database for registering an ID, a password, location information, and an allowable range thereof;
A procedure for the authentication system to analyze a combination of the user ID and password included in the authentication request and the current position by the positioning means;
In the combination, when there is no current location, a procedure for searching the authentication database with at least one of ID and password and selecting authentication security location unlimited;
In the combination, the authentication database is searched with at least one of ID and password and the current position, and the position of authentication security is limited by the current position, the position information, and its allowable range. The steps to choose,
In the combination, there is no ID and password, the authentication database is searched only by the current position, and the allowable range of the position with the strictest authentication security is selected as the current position;
A procedure for permitting authentication according to the authentication security;
The authentication method of the authentication system characterized by performing. A program for executing an authentication method of a system for authenticating a user by sending an ID and a password to an authentication system using an information terminal,
The procedure for the user to connect the information terminal to the authentication system,
A procedure for a user to send his / her authentication request through an information terminal to the authentication system having an authentication database for registering an ID, a password, location information, and an allowable range thereof;
A procedure for the authentication system to analyze a combination of the user ID and password included in the authentication request and the current position by the positioning means;
In the combination, when there is no current location, a procedure for searching the authentication database with at least one of ID and password and selecting authentication security location unlimited;
In the combination, the authentication database is searched with at least one of ID and password and the current position, and the position of authentication security is limited by the current position, the position information, and its allowable range. The steps to choose,
In the combination, there is no ID and password, and the authentication database is searched only by the current position, and the current position is selected as the allowable range of the position restriction with the strictest authentication security.
A procedure for permitting authentication according to the authentication security;
A program for executing an authentication method of an authentication system, comprising:

Images