JP2006012104A - Authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system with high crime prevention property which suppresses a damage by surreptitious use of information of an authentication terminal and further enables sure early detection when the information is illegally used. <P>SOLUTION: An automatic update function of information for authentication is added to a management center of the information for authentication. A rewritable recording medium is used for the authentication terminal, an authentication use device of the authentication terminal is provided with a rewriting function of the information for authentication and further provided with an acceptance device which automatically updates the information for authentication separately from the rewriting function. When an authenticating action is performed with the authentication terminal or whenever the authentication terminal is passed to an information for authentication update device, the authenticating action is first performed, after authenticated, the whole or a part of the information for authentication recorded in the authentication terminal is updated, information for collation recorded in a recorder of the management center is updated as a new piece of authentication information simultaneously as rewriting the information for authentication recorded in the authentication terminal. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

Detailed Description of the Invention

[Industrial application fields]
The present invention relates to security protection of personal authentication such as use of a credit card and entrance / exit management.

[Conventional technology]
Conventionally, when a recording medium is used for an authentication terminal, authentication information fixed in advance on the recording medium of the authentication terminal is recorded, and the same information is recorded on the recording device by a management center that manages the authentication information.
At the time of authentication, the authentication terminal information reading device reads the authentication terminal authentication information, transmits it to the management center, and performs verification by collating it with the recorded information.

[Problems to be solved by the invention]
The authentication information recorded in the authentication terminal may be stolen by a technique such as skimming, and there is a possibility of information leakage from the management center that manages the authentication information.
The authentication terminal can be easily counterfeited based on the stolen authentication information. There is a risk of damage from fraudulent acts by counterfeit authentication terminals. Moreover, since the authentication information of the forged authentication terminal is correct, it is authenticated, so there is a risk that fraudulent acts cannot be found or discovery is delayed.

[Means for solving problems]
A rewritable recording medium such as an IC card or a memory stick was used for the authentication terminal.
Added a function to automatically update authentication information in the authentication information management center. A function for rewriting the updated authentication information into the authentication terminal is provided in the authentication using device of the authentication terminal. A reception device that automatically updates authentication information that can be communicated with a management center that manages authentication information is installed separately from the authentication using device of the authentication terminal.
When the authentication information is authenticated by the authentication using device of the authentication terminal, or whenever the authentication terminal is passed through the authentication information update accepting device, the authentication operation is first performed and authenticated. By authentication, all or part of the authentication information recorded on the authentication terminal is updated to information that does not overlap with the authentication information recorded on other authentication terminals, and the authentication recorded on the recording device of the management center At the same time that the authentication information is updated, the authentication information is rewritten to the authentication terminal. (Figure 1)
Next time when performing an authentication act, authentication is performed by comparing the updated authentication information of the authentication terminal with the updated authentication information of the recording device of the management center.

[Action]
Due to the automatic update function of authentication information, the authentication information for the next authentication terminal will be different. If the authentication information is stolen, the authentication information recorded on the counterfeit authentication terminal will be invalidated if the authentication information of the real authentication terminal is updated before using the counterfeit authentication terminal. The authentication information of the forged authentication terminal is not authenticated because it does not collate with the information recorded in the management center. Therefore, it is possible to reliably detect fraud while simultaneously preventing fraud.

[Example]
Example 1: Explanation of the case where the present invention is used for credit card usage management.

Description of equipment Added automatic update function of authentication information to the authentication information management center.
All of the cards currently in use are IC cards that can rewrite information. The IC card reader of the credit card authentication apparatus currently installed at the place where each credit card is used is replaced with an IC card reader / writer, and the updated authentication information can be rewritten to the authentication terminal.
An authentication device equipped with an IC card reader / writer was installed at a new credit card use location.
An authentication information rewrite acceptance device has been installed in places where credit cards are used, and in convenient places such as convenience stores and hotel halls. As an option, an IC card reader / writer that can be attached to an information communication device such as a mobile phone or a personal computer is distributed to users as an information rewrite accepting device for personal authentication.
If the IC card reader cannot be easily replaced with an IC card reader / writer due to the structure, an authentication information rewrite accepting device is installed near the place where the credit card is used. When it was not possible to install it, a location guide for the authentication information rewrite acceptance device installed in the vicinity was installed.
Furthermore, the credit card usage location should be “When using a credit card, be sure to update the authentication information with the credit card authentication device, or after using the credit card, be sure to pass through the authentication information update acceptance device. ”Was installed.

Description of automatic credit card authentication information update mechanism When updating credit card authentication information, an authentication information code randomly recorded on another authentication terminal by the management computer of the management center to improve safety Select an authentication information code that does not overlap with that and create a new information code. Using the information code as new authentication information, the information recorded in the management center recording device is updated, and at the same time, the credit card authentication information is rewritten through the credit card authentication device or the authentication information update accepting device. .
For example, the authentication information is set as a 15-digit information code that combines numbers and letters, the first 7-digit code is set as the user's fixed management code, and the rear 8-digit code is set as the movable authentication information. Every time the authentication information is updated, it is updated. For example, if the information code before being updated is “54S6YFH-69K22JW7”, the first 7-digit code “54S6YFH” is the user's fixed management code, and the last 8-digit code “69K22JW7” is movable for authentication. This is a code, and only this 8-digit code is updated. In addition to the user fixed management information, the updated information code is updated to an information code “54S6YFH-K487LH9A” in which the movable information portion has no related regularity with the previous code.

Description of usage.
When shopping, the credit card is passed through the authentication device at the cash register of the store, and it is authenticated and the transaction is completed. At the same time, when the card authentication information is automatically updated, the credit card authentication number is input to the authentication device having the authentication information automatic update function, and the credit card authentication information is automatically updated after being authenticated. .
When the authentication information update accepting device automatically updates the card authentication information, the credit card PIN is entered on the operation panel of the automatic updating device and authenticated, and then the credit card authentication information is automatically updated. To do. When the card authentication information is automatically updated on the personal authentication information update acceptance device, access the management center from a mobile phone, personal computer, etc., log in, and then display the authentication information update procedure screen that appears. The credit card authentication information is entered and authenticated, and then the credit card authentication information is automatically updated.

Example 2: Explanation of the case where the present invention is used for entrance / exit management.

Description of equipment Added automatic update function of authentication information to the authentication information management center.
The authentication terminal is an IC card that can rewrite information. The authentication device is an IC card reader / writer capable of rewriting the updated authentication information to the authentication terminal.

Explanation of mechanism for automatic update of IC card authentication information The authentication information is automatically updated every time the IC card of the authentication terminal is used for authentication. The management computer at the management center selects an authentication information code that does not overlap with the authentication information code recorded on another authentication terminal, and creates a new information code. Using the information code as new authentication information, the information is updated in the IC card, and the information recorded in the recording device of the management center is simultaneously updated.
For example, the authentication information is set as a 15-digit information code that combines numbers and letters, and 6 codes of the 1st, 3rd, 4th, 8th, 11th and 14th digits are set as the fixed management code of the user, and the rest Nine codes of the second, fifth, sixth, seventh, ninth, tenth, twelfth, thirteenth and fifteen digits are set in the movable authentication information and updated every time an authentication action is performed. For example, if the information code before being updated is “1969SS6FGH083A6”, among these, six codes “169F0A” of the first, third, fourth, eighth, eleventh and fourteenth digits are fixed management codes of the user, The remaining nine codes “9SS6GH836” are authentication movable codes, and only these nine codes are updated. The updated information code is updated to an information code “1R69A81F350ETAW” in which the movable information part has no regularity related to the previous code, in addition to the user fixed management information. (Figure 2)

Description of usage.
When the user enters the facility under the control of the management center, the IC card of the authentication terminal distributed to him / her is passed through the IC card reader / writer of the authentication device, is authenticated and allowed to enter the room. The authentication information is automatically updated. The next time you enter the room, you will be authenticated using the newly updated authentication information.

[The invention's effect]
According to the present invention, it is effective to suppress damage caused by misuse of authentication information without requiring a user's troublesome work, and furthermore, early detection of misuse of authentication information has become more reliable.

Basic structure diagram of authentication information management of the present invention Example of automatic update of authentication information code when the present invention is used for entrance / exit management

Claims (1)

An authentication system characterized by using a rewritable recording medium for an authentication terminal and automatically updating authentication information recorded on the authentication terminal.

Images