JP2006268668A - Terminal authentication, terminal change method, operation terminal, authentication server, and authentication program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve the security to loss, theft and alteration of a recording device for authentication. <P>SOLUTION: An authentication key verification part 11a compares an authentication key B1 read from the recording device 2<SB>1</SB>with an authentication key A1 recorded in a recording part 14<SB>1</SB>of an operation terminal 1<SB>1</SB>to verify whether the authentication key B1 read from the recording device 2<SB>1</SB>is valid or not. A terminal key decoding part 11b decodes a terminal key B2 read from the recording device 2<SB>1</SB>with the authentication key A1 of the recording part 14<SB>1</SB>and terminal identification information A1, and a terminal key verification part 11c compares this value (secret information) with secret information A3 recorded in the recording part 14<SB>1</SB>, and authenticates, when the both are matched, that the terminal key B2 recorded in the recording device 2<SB>1</SB>is valid in the operation terminal 1<SB>1</SB>. When it is authenticated that both the authentication key B1 and the terminal key B2 are valid, a user can use a system through the operation terminal 1<SB>1</SB>. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a method for authenticating a user when using an operation terminal.

  In a conventional personal authentication system, an authentication key is recorded on a recording device such as an IC card or a USB memory, and when the user uses the operation terminal, the authentication key is read from the recording device by the operation terminal. There was a way to do.

  An example of a conventional authentication system is shown in FIG. The authentication system includes an operation terminal 4 and a recording device 5, and the operation terminal 4 includes a recording unit 42 that records the authentication key A1 and a verification unit 41 that verifies the authentication key B1 of the recording device 5. When the recording device 5 is connected to the operation terminal 4, the verification unit 41 reads the authentication key B 1 of the recording device 5 and the authentication key A 1 of the recording unit 42, compares them, verifies them, and if they match, the recording device 5 Authenticate as legitimate.

As a personal authentication method, the fingerprint entered on the terminal and the fingerprint information of the IC card are collated, and if they match, the inputted fingerprint and the IC card information are transmitted from the terminal to the server, and the information received by the server is A method of authenticating by collating a database has been proposed (Patent Document 1).
Japanese Patent Laid-Open No. 11-161793

  In this method, having a recording device that records the authentication key is an operable condition, and any operation terminal can be operated in the same manner as long as it has the recording device. For example, there is an advantage that the terminal can be used anywhere if there is a terminal on the other floor of the workplace or an operating terminal at home, as well as the terminal at the workplace. On the other hand, if a recording device is lost or stolen or counterfeit, it can be used on any operation terminal, so there is a high risk of unauthorized use from an operation terminal different from the original user's operation terminal.

  An object of the present invention is to provide an authentication method, an operation terminal, an authentication server, and an authentication program that have improved security against loss, theft, and forgery of a recording device for authentication.

  In the first aspect of the present invention, a terminal key that gives the right to use only one specific operation terminal of this system is recorded together with an authentication key that gives the right to use the system to the recording device, and is used for authentication. The use authority is given only on the operation terminal. Then, the operating key to be used is changed by updating the terminal key according to the operating terminal of the change destination. More specifically, the recording device has a terminal key, the operation terminal recording unit has terminal identification information and secret information, the operation terminal verification unit reads the authentication key from the recording device, and this is recorded in the operation terminal recording unit. If it matches, it authenticates that the authentication key recorded in the recording device is valid, then reads out the terminal key from the recording device, and stores the terminal key in the recording unit of the operation terminal When the recorded authentication key and terminal identification information are decrypted and the value matches the secret information, it is authenticated that the terminal key recorded in the recording device is valid at the operation terminal. In addition, the terminal identification information of the change destination is recorded on the recording device, and the terminal key generation unit and the terminal identification information encryption / decryption unit of the operation terminal update the terminal key, whereby the operation terminal to be used can be changed. Thus, according to this aspect, since the user can limit the use terminal, security is improved against loss, theft, and forgery of the recording device for authentication. In addition, since the terminal key is updated in accordance with the operation terminal to be changed, the operation terminal to be used can be changed.

  In the second aspect of the present invention, the verification unit is cut out from the operation terminal as an authentication server, and the authentication key and the secret information in the recording unit of the operation terminal are recorded in the recording unit of the authentication server. Perform authentication and change the terminal key. In this aspect, the authentication key can be collectively managed, and the secret information is collectively managed by the recording unit of the authentication server. Therefore, the secret information can be updated at any time, and the risk of leakage of the terminal key can be reduced. Furthermore, since the authentication server is used when the terminal key is updated due to the change of the operation terminal, the number of changes of the operation terminal and the operation terminals to be changed can be limited in the authentication server.

  In the third aspect of the present invention, in the first aspect, the authentication key, the terminal key, and the terminal identification information recorded in the recording device are recorded in the recording unit of the operation terminal or in a recording means different from this. The recording device has been removed. Moreover, the communication part between operation terminals is arrange | positioned in an operation terminal, and communication between operation terminals is enabled. Therefore, it is not necessary for the user to carry the recording device, and the recording device is not lost or stolen. Further, since direct communication is performed between the operation terminals, the operation terminal of the change destination is clearly indicated to the user, and the possibility of unauthorized use from an operation terminal different from the original user's operation terminal is reduced.

  In the fourth aspect of the present invention, the portable information adapting unit is added to the operation terminal in the first aspect, the terminal characteristic information is added to the recording unit, and the terminal characteristic information and the portable information are added to the recording device. Yes. In this aspect, the portable information is recorded and carried on the recording device, so that the working file can be continuously used even if the operation terminal is changed. When the terminal is changed between operation terminals having different terminal characteristics, the portable information adapting unit uses the terminal characteristic information to change the portable information into a format that matches the characteristics of the operation terminal that is the change destination.

  The present invention records an authentication key that gives the right to use the system to the recording device and a terminal key that gives the right to use only one specific operation terminal of this system and uses it for authentication, so that it can be used only for the specific operation terminal. Therefore, there is an effect that security is improved against loss, theft, and forgery of the authentication recording device. In addition, since the terminal key is updated in accordance with the operation terminal to be changed, the operation terminal to be used can be changed.

  Next, embodiments of the present invention will be described with reference to the drawings.

[First embodiment]
Referring to FIG. 1, the authentication system of the first embodiment of the present invention is constituted by the operation terminal 1 ₁ and the recording device 2 _1.

Operation terminal 1 ₁ has a recording unit 14 ₁ and the verification unit 11 and the terminal key generation unit 12 and the terminal identification information decryption unit 13. The recording unit 14 ₁ of the operation terminal 1 _1, the authentication key A1, the secret information A3, terminal identification information A2 is recorded. Recording device 2 ₁ a portable, is removably connected to the operation terminal 1 _1. In the recording device 2 ₁ includes an authentication key B1, terminal key B2, terminal identification information B3 is recorded.

Authentication key A1, B1 is the key to providing a use authority of the system, is a valid key in any operation terminal 1 _1. Terminal key B2 is the key to give access authority in a specific one of the operation terminal 1 ₁ of the system. Terminal identification information A2, B3 is a unique identification information to each control terminal 1 _1. The secret information A3 is information that is not known outside the system. The verification unit 11 includes an authentication key verification unit 11a that verifies the authentication key B1, a terminal key decryption unit 11b that verifies the terminal key B2, and a terminal key verification unit 11c.

Upon utilizing operating terminal 1 _1, the operation terminal 1 ₁ of the verification unit 11 reads out the authentication key B1 and terminal key B2 from the recording device 2 _1, be verified. The operation at the time of verification will be described with reference to FIG.

Authentication key verification unit 11a, the recording device 2 ₁ from the read authentication key B1 compares the operation terminal 1 ₁ of the recording unit 14 authentication key A1 recorded in the recording device 2 ₁ authentication key B1 read from the valid Verify that there is. Next, decrypts the terminal key B2 to terminal key decrypting unit 11b is read out from the recording device 2 ₁ by the recording unit 14 ₁ of the authentication key A1 and the terminal identification information A2, terminal key verification unit 11c is a value (confidential information) compared to secret information A3 recorded in the recording unit 14 _1, terminal key B2 that has been recorded in the recording device 2 ₁ to coincide with each other and both secret information is authenticated as a valid for this operation terminal 1 _1. If both authentication key B1 and terminal key B2 is authenticated as a valid user can use the system from the operation terminal 1 _1.

Next, the operation when the user changes the operating terminal 1 _1. Changing the operation terminal 1 ₁ is performed by the following three steps.

1) the change destination operating terminal information extraction user connects the recording device 2 ₁ to the operation terminal 1 ₁ of the change destination, it records the terminal identification information A2 of the operation of the change destination terminal 1 ₁ to the recording device 2 _1. The detailed procedure is shown below.

In the change destination operation terminal 1 ₁ , first, the authentication key B ₁ read from the recording device 21 by the authentication key verification unit 11 a of the verification unit 11 and the authentication key A ₁ recorded in the recording unit 14 ₁ of the operation terminal 11 are used. comparison authentication key B1 read from the recording device 2 ₁ is verified as valid. Subsequently decrypts the terminal key B2 to terminal key decrypting unit 11b is read out from the recording device 2 ₁ by the recording unit 14 ₁ of the authentication key A1 and the terminal identification information A2, terminal key verification unit 11c is the values recorded (secret) comparing the secret information A3 recorded in the section 14 _1. However, the operation terminal 1 ₁ of the terminal key B2 is encrypted is an operation terminal 1 ₁ Change source, since the terminal identification information A2 and B3 are different to the decoding fails, both the secret information does not match, terminal key B2 is Judged not valid.

Thus, when the authentication key B1 is valid terminal key B2 is not valid, the operation terminal 1 ₁ allows for only information extraction operations change destination terminal 1 _1.

When information extracted change destination of the operation terminal enabling, as in FIG. 3, the terminal identification information A2 stored in the recording unit 14 ₁ of the operation terminal 1 _1, terminal identification information decryption unit 13 the recording device 2 encrypted with the authentication key B1, which is recorded in ₁ writes the recording device 2 ₁ as the terminal identification information B3.

2) terminal key changes the user connects the recording device 2 ₁ to the operation terminal 1 ₁ Change source from terminal key of the recording device 2 ₁ recorded on the terminal key B2 is changed source operating terminal 1 for ₁ rewritten to 1 ₁ of the terminal key for the change destination operation terminal. The detailed procedure is shown below.

Authentication key verification unit 11a, the recording device 2 ₁ from the read authentication key B1 compares the operation terminal 1 ₁ of the recording unit 14 the authentication key A1 recorded in the _1, the recording device 2 ₁ from the read authentication key B1 is enabled It verifies that it is. Subsequently decrypts the terminal key B2 to terminal key decrypting unit 11b is read out from the recording device 2 by the recording unit 14 ₁ of the authentication key A1 and the terminal identification information A2, terminal key verification unit 11c that value (confidential information) and recording unit 14 ₁ compares the secret information A3 recorded, a terminal key B2 both secret information is recorded in the recording device 2 ₁ by matching each other is effective in operation terminal 1 ₁ of the change source Certify.

When it is authenticated that the authentication key B1 and the terminal key B2 are valid, the terminal key B2 is changed. This will be described with reference to FIG. Reads the change origin of the operation terminal 1 ₁ of the terminal identification information B3 changes destination terminal identification information decryption unit 13 is recorded in the recording device 2 _1, decrypts the authentication key A1 recorded in the recording unit 14 ₁ taken out terminal identification information A2 after change of the operation terminal 1 ₁ Te, and passes to the terminal a key generation unit 12. The terminal key generating unit 12, the recording device 2 _first authentication key recorded in the B1 and the terminal identification information A2 of the terminal identification information decryption unit 13 is passed from the destination change operation terminal 1 ₁ as a key for encryption, encrypting the secret information A3 recorded in the recording unit 14 _1. As terminal key B2 for operating the terminal 1 ₁ after change the secret information A3 encrypted, the terminal key generation unit 12 writes to the recording device 2 _1.

In this manner, the recording device 2 ₁ terminal key B2 recorded in is rewritten to a valid terminal key change destination of the operation terminal 1 _1.

3) The user of the recording device 2 ₁ validation terminal key B2 is rewritten to a valid terminal key change destination of the operation terminal 1 ₁ of the change destination of the operation terminal is connected to the operation terminal 1 ₁ of the change destination, authentication The key B1 and the terminal key B2 are verified.

Authentication key verification unit 11a, the recording device 2 ₁ from the read authentication key B1 compares the operation terminal 1 ₁ of the recording unit 14 the authentication key A1 recorded in the _1, the recording device 2 ₁ from the read authentication key B1 is enabled It verifies that it is. Subsequently decrypts the terminal key B2 to terminal key decrypting unit 11b is read out from the recording device 2 ₁ with authentication key A1 and the terminal identification information A2 of the recording section 14, terminal key verification unit 11c that value (confidential information) and recording unit comparing the secret information A3 recorded in the 14 _1. Terminal key B2 is rewritten to the terminal key for operating the terminal 1 ₁ of the change destination, and successfully decoded terminal key B2, since both the secret information match each other, the terminal key that has been recorded in the recording device 2 ₁ B2 is authenticated as a valid change destination of the operation terminal 1 _1.

If both authentication key B1 and terminal key B2 is authenticated as a valid user can use the system from the operation terminal 1 ₁ of the change destination.

By performing such a procedure, the operation terminal 1 ₁ of the user, creates the recording device 2 ₁ to be authenticated only by changing the destination of the operation terminal 1 _1, it is possible to change the operating terminal 1 _1.

According to this embodiment, by the recording device 2 ₁ for authentication only and enable the recording device 2 ₁ in a specific operation terminal 1 ₁ by having the terminal key B2, to limit the user terminal of the user, authentication lost recording device 2 _first use, theft, additional security against forgery, and to update the terminal-key B2 to the destination of the operation terminal 1 _1, to change the operating terminal 1 ₁ utilizing it can.

[Second Embodiment]
Referring to FIG. 5, the authentication system of the second embodiment of the present invention, and an operation terminal 1 ₂ and the recording device 2 ₁ and the authentication server 3. Operation terminal 1 ₂ has a terminal key generation unit 12 and the terminal identification information decryption unit 13 and the recording unit 14 _2, only the terminal identification information A2 to the recording unit 14 ₂ is recorded. The authentication server 3 includes a verification unit 31 having an operation terminal 1 ₁ of the verification unit 11 and the same function as the first embodiment, it has been recorded in the recording unit 14 ₁ of the operation terminal 1 ₁ of the first embodiment A recording unit 32 that records the authentication key A1 and the secret information A3 is provided. The authentication server 3 is set to one in the system, all the operation terminal 1 ₂ is connected to one of the authentication server 3.

  Next, the operation of this embodiment will be described in detail.

First, the operation at the time of verification will be described with reference to FIG. Authentication key verifying unit 31a, the operation terminal 1 ₂ receives the authentication key B1 read from the recording device 2 _1, compared with the authentication key A1 recorded in the recording unit 32 of the authentication server 3 reads from the recording device 2 ₁ Verify that the authentication key B1 is valid. Subsequently, the terminal key decryption unit 31b receives the terminal identification information A2 of the operation terminal 1 ₂ is recorded in the recording unit 14 ₂ and the terminal key B2 read from the recording device 2 _1, the authentication of the recording unit 32 the terminal key B2 decoded by the terminal identification information received with key A1 from the operation terminal 1 ₂ A2, compared to the secret information A3 which terminal key verification unit 31c is the values recorded in the recording unit 32, a recording device matches the secret information A3 terminal key B2 that has been recorded in the 2 ₁ is authenticated as a valid for this operation terminal 1 _2.

If both authentication key B1 and terminal key B2 is authenticated as a valid user can use the system from the operation terminal 1 _2.

In this way, by cutting out from the operation terminal 1 ₁ a verification section as the authentication server 3 can be collectively performed authentication with the authentication server 3. For example, it is not necessary to record the authentication key A1 in the recording unit 14 ₂ of the operation terminals 1 _2, it is sufficient to record collectively to the recording unit 32 of the authentication server 3, the authentication key B1 recording device 2 Even if it is generated every _one, key management becomes easy.

  When the user changes the operation terminal, the operation terminal is changed by a three-step procedure as in the first embodiment.

1) the change destination operating terminal information extraction user connects the recording device 2 ₁ with the operation of the change destination terminal 1 ₂ records the terminal identification information A2 of the operation of the change destination terminal 1 ₂ in the recording device 2 _1. The detailed procedure is shown below. Authentication key verification unit 31a of the authentication server 3, the operation terminal 1 ₂ after change receives an authentication key B1 read from the recording device 2 _1, compared with the authentication key A1 recorded in the recording unit 32 of the authentication server 3, recording device 2 ₁ authentication key B1 read from is verified as valid. Subsequently, the terminal key decryption unit 31b receives the terminal identification information A2 of the operation terminal 1 ₂ is recorded in the recording unit 14 ₂ of the terminal key B2 read from the recording device 2 ₁ Operation terminal 1 _2, the terminal key B2 The received terminal identification information A2 and the authentication key A1 recorded in the recording unit 32 of the authentication server 3 are decrypted, and the terminal key verification unit 31c compares the value with the secret information A3 recorded in the recording unit 32. . However, the terminal encrypts the terminal key B2 is changed source operating terminal 1 _2, the decoding fails different terminal identification information B3, terminal key B2 does not match the secret information is determined not to be valid.

Thus, when the authentication key B1 is valid terminal key B2 is not valid, the operation terminal 1 ₂ allows only change destination of the operation terminal 1 _second information extraction.

When the extraction of the change destination of the operation terminal 1 _second information becomes available, as in the first embodiment, as shown in FIG. 3, the terminal identification information A2 stored in the recording unit 14 ₂ of the operation terminal 1 ₂ encrypted with the authentication key B1 to the terminal identification information decryption unit 13 is recorded in the recording device 2 _1, written in the recording device 2 ₁ as the terminal identification information B3.

2) terminal key changes the user connects the recording device 2 ₁ to change the source of the operation terminal 1 _2, change the terminal key B2 recorded in the recording device 2 ₁ changes the source of the operation terminal 1 ₂ from the terminal key It rewrites before the operation terminal 1 ₂ of the terminal key. The detailed procedure is shown below.

Authentication key verification unit 31a of the authentication server 3, the operation terminal 1 ₂ receives the authentication key B1 read from the recording device 2 _1, compared with the authentication key A1 recorded in the recording unit 32 of the authentication server 3, a recording device authentication key B1 read from the 2 ₁ is verified as valid. Subsequently, the terminal key decryption unit 31b receives the terminal identification information A2 of the operation terminal 1 ₂ is recorded in the recording unit 14 ₂ and the terminal key B2 read from the recording device 2 _1, a terminal key B2, the recording unit 32 decoded by the terminal identification information A2 received the authentication key A1, as compared to the secret information A3 which terminal key verification unit 31c is the values recorded in the recording unit 32, recorded in the recording device 2 ₁ to coincide with the secret information A3 once it was terminal key B2 is authenticated as a valid for this operation terminal 1 _2.

If both authentication key B1 and terminal key B2 is authenticated as a valid user can use the system from the operation terminal 1 ₂ in the change from.

When it is authenticated that the authentication key B1 and the terminal key B2 are valid, a procedure for changing the terminal key B2 is performed. This procedure will be described with reference to FIG. Reads the operation terminal 1 ₂ of terminal identification information decryption unit 13 the recording device 2 ₁ terminal identification information A2 of the operation of the change destination recorded terminal 1 _2, the authentication from the authentication server 3 is recorded in the recording unit 32 decoded receive keys A1, it takes out the terminal identification information A2 of the operation of the change destination terminal 1 _2, and passes to the terminal a key generation unit 12. The terminal key generating unit 12, the terminal identification information A2 of the recording device 2 ₁ that is recorded in the authentication key to the B1 and the terminal identification information decryption unit after change passed from 13 operation terminal 1 ₂ as a key for encryption, The secret information A3 recorded in the recording unit 32 of the authentication server 3 is encrypted. The secret information encrypted as a terminal key A2 after change of the operation terminal 1 _2, the terminal key generation unit 12 writes the recording device 2 _1.

In this manner, the recording device 2 ₁ terminal key B2 recorded in is rewritten to the terminal key of the newly selected operation terminal 1 for _2.

The authentication server 3, and to update the secret information A3 before passing the secret information A3 to the operation terminal 1 _2, the terminal key B2 can be a valid terminal key only once the terminal change, leakage of the terminal key B2 , Can increase security against counterfeiting. In addition, the authentication server 3, before passing the secret information A3 to the operation terminal 1 _2, and the number of times that the terminal change, by checking the operation of the change destination terminal 1 _2, the operation terminal 1 ₂ of the number of changes and change it is possible to restrict the operation terminal 1 _2.

3) Verification authentication key verification unit 31a of the change destination of the operation terminal, the operation terminal 1 ₂ receives the authentication key B1 read from the recording device 2 _1, were recorded authentication key B1 in the recording unit 32 of the authentication server 3 compared with the authentication key A1, verifies that the authentication key B1 read from the recording device 2 ₁ is valid. Subsequently, the terminal key decryption unit 31b receives the terminal identification information A2 of the operation terminal 1 ₂ is recorded in the terminal key B2 and the recording unit 14 read out from the recording device 2 _1, authentication key of the recording unit 32 the terminal key B2 The terminal key verification unit 31c compares the value with the secret information A3 recorded in the recording unit 32, and verifies that the terminal key B2 is valid.

  If it is authenticated that both the authentication key B1 and the terminal key B2 are valid, the user can use this system.

This embodiment differs from the first embodiment, disconnect the verification unit and the recording unit from the operation terminal 1 _2, since the arrangement to the outside as the authentication server 3, so that it is collectively managed in the authentication key A1. Further, since the secret information A3 is collectively managed by the recording unit 32 of the authentication server 3, the secret information A3 can be updated at any time, and the risk of leakage of the terminal key B2 can be reduced. Furthermore, since the use of the authentication server 3 when updating the terminal key A2 due to a change of the operation terminal 1 _2, the authentication server 3, it is also possible to limit the operating terminal 1 ₂ operating terminal 1 ₂ number of changes and modifications .

[Third embodiment]
Referring to FIG. 8, a third embodiment of the present invention, the recording device area 16 in the recording portion 14 ₃ of the operation terminal 1 ₃ provided, is recorded in the recording device 2 ₁ in the first embodiment authentication key B1, terminal key B2, so as to record the terminal identification information B3 in the recording unit 14 the _third recording device area 16, and removing the recording device 2 _1. Also, place the operating terminal communication unit 15 to the operation terminal 1 in _3, thereby enabling communication between the operation terminal 1 _3. Note that this embodiment can also be incorporated into the second embodiment.

  Next, the operation of this embodiment will be described.

During verification, the first embodiment the authentication key in the form B1, the terminal key B2, whereas read out from the recording device 2 _1, it is read out from the recording unit 14 the _third recording device area 16 in the present embodiment. Other operations are the same as those in the first embodiment. If the user changes the operation terminal 1 _3, performed by the procedure similar three steps of the first embodiment. However, to change the destination of the operation terminal 1 ₃ from changing source operation terminal 1 _3, Further, instead of changing the recording device 2 _first connection destination change source operation terminal 1 ₃ from the operation terminal 1 ₃ after change, between changes source operation terminal 1 ₃ and after change operation terminal 1 _3, each of the operation terminals 1 ₃ of terminal-to-terminal communication unit 15 performs communication, the operation terminal 1 ₃ after change from the modified source operation terminal 1 ₃ in addition, the authentication key B1 to change the source of the operation terminal 1 ₃ from the operation terminal 1 ₃ after change, terminal key B2, transfers the terminal identification information B3, the recording portion 14 ₃ of the change destination operations terminal 1 ₃ recording device Recorded in the use area 16. In this case, the transfer source authentication key B1, terminal key B2, terminal identification information B3 is deleted from the recording device 2 _1. Further, in each operation terminal 1 ₃ , instead of reading / writing the authentication key B ₁ , terminal key B 2, and terminal identification information B ₃ from the recording device 2 ₁ , the operation terminal 1 ₃ starts from the recording device area 16 in the recording unit 14 ₃ of each operation terminal 13. Read and write.

In this embodiment, virtually it provided that the recording device 2 ₁ in the operation terminal 1 ₃ of the storage unit 14 _3, eliminates the need for users carry the recording device 2 _1, loss of the recording device 2 _1, stolen The risk of being lost. Further, since the direct communication between the operation terminal 1 _3, the operation terminal 1 ₃ after change expressly to the user, is illegal use by another operation terminal 1 ₃ and the operation terminal 1 ₃ of the original user The risk is reduced.

The recording device area may be prepared in a recording means (for example, a built-in recording device) different from the recording unit 14 ₃ .

[Fourth Embodiment]
Referring to FIG. 9, the authentication system of the fourth embodiment of the present invention, a portable information adaptation unit 17 to the authentication system of the first embodiment is added, the recording unit 14 ₄ terminal characteristic information A4 is, in the recording device 2 ₂ the terminal characteristic information B4 portable information B5 is added respectively. Referring to FIG. 10 (2), the portable information adaptation unit 17 includes a decryption unit 17a, an adaptation unit 17b, and an encryption unit 17c.

Here, the terminal characteristic information A4, B4, the performance of the CPU, memory amount, the size of the screen, type of input device (keyboard, presence or absence of a mouse), the characteristic information of the operation terminal 1 every ₄ such as a network communication speed is there. In addition, the mobile information B5 is a work file that the user carry and recorded on the recording device 2 _2, is a document file, video, and voice files.

  This embodiment can also be combined with the second and third embodiments.

  Next, the operation of this embodiment will be described.

In this embodiment, by carrying records portable information B5 in the recording device 2 ₂ can be continuously used your work Changing the operation terminal 1 _4. Further, when the terminal changes between different operating terminal 1 ₄ of the terminal characteristics, by using a terminal characteristic information B4, a portable information B5, be changed to suit the format characteristics of the newly selected operation terminal 1 ₄ it can. For example, in the case of portable video file, characteristic after change of the operation terminal 1 ₄ CPU, and change the compression ratio in accordance with the size, etc. of the screen.

  This operation will be described along a three-step procedure when changing the operation terminal of the first embodiment.

1) when writing the operation information of the terminal 1 ₄ extraction change destination after change of the operation terminal information in the recording device 2 _2, also to the characteristic information of the operation of the change destination terminal 1 _4, encrypted with the authentication key B1, It is written in the recording device 2 _2.

When 2) terminal key change authentication key B1 and terminal key B2 is authenticated as a valid, in accordance with the procedure of changing terminal key B2, it adapts the portable information B5 to the change destination operations terminal 1 _4. This will be described with reference to FIG.

Reads portable information B5 for decoding portion 17a is recorded in the recording device 2 _2, which was decoded by the recording unit 14 ₄ authentication key recorded in the A1 and the terminal identification information A2, and passes to the adaptation unit 17b. Adaptation unit 17b reads out the recording device 2 ₂ from the terminal characteristic information B4, and change the mobile information B5 in format corresponding to the terminal characteristics, and passes to the encryption unit 17c. Encryption unit 17c, a portable information B5, decoded by the authentication key A1 recorded terminal identification information B3 recorded on the recording device 2 ₂ terminal identification information decryption unit 13 to the recording unit 14 ₄ terminal and identification information, encrypted with the authentication key B1, which is recorded in the recording device 2 _2, recorded in the recording device 2 ₂ as new portable information B5.

3) combined to verify the verification terminal key B2 for changing the destination of the operation terminal, decode the same portable information B5 and terminal key B2, using the operation terminal 1 ₄ of the change destination.

In this embodiment, by carrying records portable information B5 in the recording device 2 ₂ can be continuously used your work Changing the operation terminal 1 _4. Further, by managing the terminal characteristic information B4, carrying portable information B4 it can be adapted to the characteristics of the operation terminal 1 ₄ utilizing, is possible to continue working in accordance with the characteristics of the newly selected operation terminal 1 ₄ it can. Moreover, since the portable information B4 is encrypted using the terminal identification information B3, not only available recording devices 2 ₂ even when the portable information B4 has had leaked in particular of the operation terminal 1 _4, portable information B5 Can not be used, security is improved.

  The functions of the operation terminal and the authentication server described above are executed by recording a program for realizing the functions on a computer-readable recording medium, causing the computer to read the program recorded on the recording medium, and executing the program. You may do. The computer-readable recording medium refers to a recording medium such as a flexible disk, a magneto-optical disk, and a CD-ROM, and a storage device such as a hard disk device built in a computer system. Furthermore, the computer-readable recording medium is a medium that dynamically holds the program for a short time (transmission medium or transmission wave) as in the case of transmitting the program via the Internet, and the computer serving as the server in that case Such as a volatile memory that holds a program for a certain period of time.

It is a block diagram of the authentication system of the 1st Embodiment of this invention. It is a figure which shows the operation | movement at the time of verification of 1st Embodiment. It is a figure which shows operation | movement at the time of information extraction of the operation terminal of a change destination of 1st Embodiment. It is a figure which shows the operation | movement at the time of change of a terminal key of 1st Embodiment. It is a block diagram of the authentication system of the 2nd Embodiment of this invention. It is a figure which shows the operation | movement at the time of verification of 2nd Embodiment. It is a figure which shows operation | movement at the time of change of a terminal key of 2nd Embodiment. It is a block diagram of the authentication system of the 3rd Embodiment of this invention. It is a block diagram of the authentication system of the 4th Embodiment of this invention. It is a figure which shows the operation | movement at the time of change of a terminal key of 4th Embodiment. It is a schematic block diagram of the conventional authentication system.

Explanation of symbols

1 ₁ to 1 ₄ Operation terminal 2 ₁ , 2 ₂ Recording device 3 Authentication server 11 Verification unit 11a Authentication key verification unit 11b Terminal key decryption unit 11c Terminal key verification unit 12 Terminal key generation unit 13 Terminal identification information encryption / decryption unit 14 ₁ to 14 ₄ Recording unit 15 Inter-terminal communication unit 16 Recording device area 17 Mobile information adaptation unit 17a Decryption unit 17b Adaptation unit 17c Encryption unit A1 Authentication key A2 Terminal identification information A3 Secret information A4 Terminal characteristic information B1 Authentication key B2 Terminal key B3 Terminal identification information B4 Terminal characteristic information B5 Mobile information

Claims (21)

A method for authenticating a user when the user uses each operation terminal in a system having a plurality of operation terminals,
An authentication key that is a key that is valid for any operating terminal that gives the right to use the system, a terminal key that is a key that gives the right to use each operating terminal, and information that is not known outside the system Confidential information is recorded in advance in the recording unit of each operation terminal,
When the user connects a recording device in which an authentication key, a terminal key, and terminal identification information are recorded to the operation terminal to be used, a verification unit of the operation terminal reads the authentication key from the recording device Then, this is compared with the authentication key recorded in the recording unit of the operation terminal, and if it matches, the authentication key recorded in the recording device is authenticated, and then the terminal from the recording device The key is read, and the terminal key is decrypted with the authentication key and terminal identification information recorded in the recording unit of the operation terminal. When the value matches the secret information of the operation terminal, the terminal key is recorded on the recording device. Authenticating that the terminal key being used is valid on the operation terminal;
Authentication method. When the recording device is connected to the change destination operation terminal in order to change the operation terminal used by the user,
When the verification unit of the change destination operation terminal determines that the authentication key of the recording device is valid but the terminal key is not valid, the terminal identification information encryption / decryption unit of the change destination operation terminal The terminal identification information recorded in the recording unit of the operation terminal is encrypted using the authentication key recorded in the recording device, and the terminal identification information of the change destination operation terminal is added to the terminal identification information of the recording device. writing,
When the user connects the recording device in which the terminal identification information of the operation terminal of the change destination is written to the operation terminal of the change source,
When the authentication key and the terminal key of the recording device are both validated by the verification unit of the operation terminal of the change source, the terminal identification information encryption / decryption unit of the operation terminal of the change source is recorded in the recording device The terminal identification information of the change-destination operation terminal is read out, and this is decrypted with the authentication key recorded in the recording unit of the change-source operation terminal to extract the terminal identification information of the change-destination operation terminal ,
The terminal key generation unit of the change source operation terminal includes the authentication key recorded in the recording unit of the change source operation terminal and the terminal identification of the change destination operation terminal extracted by the terminal identification information encryption / decryption unit The secret information recorded in the recording unit is encrypted using information as an encryption key, and the encrypted secret information is written in the recording device as a terminal key of the operation terminal to be changed. Authentication method. A method of authenticating a user when the user uses each operation terminal in a system having a plurality of operation terminals and one authentication server connected to the operation terminals,
An authentication key, which is a key that is valid for any operation terminal and gives secret authority, which is information not known outside the system, is recorded in advance in the recording unit of the authentication server. And
In the recording unit of each operation terminal, the terminal identification information of the own terminal is recorded in advance,
When the verification unit of the authentication server connects to the operation terminal that the user intends to use the recording device in which the authentication key, the terminal key, and the terminal identification information are recorded, the operation terminal is disconnected from the recording device. The read authentication key is received, compared with the authentication key recorded in the recording unit of the authentication server, and if they match, the authentication key recorded in the recording device is authenticated, and The terminal key is read from the recording device, and the terminal key is decrypted with the authentication key recorded in the recording unit of the authentication server and the terminal identification information recorded in the record of the operation terminal, and the value is If it matches the confidential information, it authenticates that the operation terminal is valid.
Authentication method. When changing the operation terminal used by the user, when the recording device is connected to the operation terminal of the change destination,
When the verification unit of the authentication server determines that the authentication key of the recording device is valid but the terminal key is not valid, the terminal identification information encryption / decryption unit of the change-destination operation terminal performs the recording of the operation terminal. The terminal identification information recorded in the recording unit is encrypted using the authentication key recorded in the recording device, and written in the recording device as terminal identification information of the operation terminal to be changed,
When the user connects the recording device in which the terminal identification information of the operation terminal of the change destination is written to the operation terminal of the change source,
When the verification unit of the authentication server authenticates that both the authentication key and the terminal key of the recording device are valid, the terminal identification information encryption / decryption unit of the change source operation terminal is recorded in the recording device Read the terminal identification information of the change destination operation terminal, decrypt the authentication key recorded in the recording unit of the authentication server and extract the terminal identification information of the change destination operation terminal,
The terminal key generation unit of the change source operation terminal encrypts the authentication key recorded in the recording unit of the authentication server and the terminal identification information of the change destination operation terminal extracted by the terminal identification information encryption / decryption unit. The secret information recorded in the recording unit of the authentication server is encrypted as an encryption key, and the encrypted secret information is written in the recording device as a terminal key of the operation terminal of the change destination. Authentication method. A method for authenticating a user when the user uses each operation terminal in a system having a plurality of operation terminals,
An authentication key that is valid for any operating terminal that grants the right to use the system, a terminal key that is a key that grants the right to use the terminal itself, and information that is not known outside the system Secret information is recorded in advance in the first recording unit of each operation terminal,
Each operation terminal is provided with a second recording unit that records an authentication key, a terminal key, and terminal identification information, which is information for authenticating a user who intends to use each operation terminal.
The verification unit of the operation terminal that the user intends to use reads the authentication key from the second recording unit, compares it with the authentication key recorded in the first recording unit, and if they match, Authenticates that the authentication key recorded in the second recording unit is valid, then reads out the terminal key from the second recording unit, and the terminal key is recorded in the first recording unit. And authenticating that the terminal key recorded in the second recording unit is valid at the operation terminal when the value matches the secret information.
Authentication method. In order to change the operation terminal used by the user, the information of the second recording unit of the change source operation terminal is transmitted to the change destination operation terminal by inter-terminal communication, and the information is changed to the change destination operation terminal. When recorded in the second recording unit of the terminal,
When the verification unit of the change destination operation terminal determines that the authentication key of the second recording unit is valid but the terminal key is not valid, the terminal identification information encryption / decryption unit of the change destination operation terminal is: The terminal identification information recorded in the first recording unit of the change destination operation terminal is encrypted using the authentication key recorded in the second recording unit of the change destination operation terminal, and the change destination Is written in the second recording unit of the operation terminal as terminal identification information of the operation terminal to be changed,
The change destination operation terminal transmits information of the second recording unit of the change destination operation terminal to the change source operation terminal through inter-terminal communication, and the change source operation terminal transmits the information to the change source. When recording in the second recording unit of the operation terminal
If the authentication key and the terminal key of the second recording unit are both valid, the terminal identification information encryption / decryption unit of the operation terminal of the change source authenticates the operation of the change source. The terminal identification information of the operation terminal of the change destination recorded in the second recording unit of the terminal is read, and this is decrypted with the authentication key recorded in the recording unit of the operation terminal of the change source, and the change destination Retrieve the terminal identification information of
The terminal key generating unit of the change source operation terminal includes the authentication key recorded in the recording unit of the change source operation terminal and the terminal of the change destination operation terminal extracted by the terminal identification information encryption / decryption unit Using the identification information as an encryption key, the secret information recorded in the recording unit of the change source operation terminal is encrypted, and the encrypted secret information is used as the terminal key of the change destination operation terminal. The authentication method according to claim 5, wherein the authentication method writes in the second recording unit of the operation terminal. Terminal characteristic information that is characteristic information of the operation terminal is further recorded in the recording unit of the operation terminal,
When the verification unit writes the terminal identification information of the operation terminal to be changed to the recording device, the terminal characteristic information recorded in the recording unit is also encrypted with the authentication key of the recording device and written to the recording device. ,
The portable information adaptation unit of the operation terminal reads the portable information recorded in the recording device, decrypts the portable information with the authentication key and the terminal identification information recorded in the recording unit, and from the recording device The terminal characteristic information is read, the decrypted portable information is converted into a format corresponding to the terminal characteristic information, and the terminal identification information recorded in the recording device is converted into an authentication key recorded in the recording unit. Encrypted with the decrypted terminal identification information and the authentication key recorded in the recording device, and recorded as new portable information in the recording device,
The authentication method according to claim 2. Terminal characteristic information that is characteristic information of the operation terminal is further recorded in the recording unit of the operation terminal,
When the verification unit of the authentication server writes the terminal identification information of the operation terminal to be changed to the recording device, the terminal characteristic information recorded in the recording unit of the operation terminal is also encrypted with the authentication key of the recording device. Write to the recording device,
The portable information adaptation unit of the operation terminal reads the portable information recorded in the recording device, and the authentication key recorded in the recording unit of the authentication server and the terminal recorded in the recording unit of the operation terminal The mobile information is decoded with the identification information, the terminal characteristic information is read from the recording device, the decoded mobile information is converted into a format according to the terminal characteristic information, and this is recorded in the terminal recorded in the recording device The terminal identification information decrypted with the authentication key recorded in the recording unit of the authentication / authentication server and the authentication key recorded in the recording device are encrypted and recorded as new portable information in the recording device. ,
The authentication method according to claim 4. Terminal characteristic information that is characteristic information of the operation terminal is further recorded in the first recording unit of the operation terminal,
Terminal characteristic information and portable information are further recorded in the second recording unit of the operation terminal,
When the verification unit writes the terminal identification information of the operation terminal to be changed to the second recording unit, the terminal characteristic information recorded in the first recording unit is also the authentication key of the second recording unit. And write it in the second recording unit,
The portable information adaptation unit of the operation terminal reads the portable information recorded in the second recording unit, and decrypts the portable information with the authentication key and terminal identification information recorded in the first recording unit. Terminal characteristic information is read from the second recording unit, and the decrypted portable information is converted into a format corresponding to the terminal characteristic information, and this is converted into terminal identification information recorded in the first recording unit. Is encrypted with the terminal identification information decrypted with the authentication key recorded in the first recording unit and the authentication key recorded in the second recording unit, and new portable information is stored in the second recording unit. The authentication method according to claim 6, recorded as: In an operation terminal constituting a predetermined system,
An authentication key that is a key that is valid for any operating terminal that gives the right to use the system, a terminal key that is a key that gives the right to use the operating terminal, and information that is not known outside the system A recording unit in which confidential information is recorded;
When the user connects a recording device in which an authentication key, a terminal key, and terminal identification information are recorded to the operation terminal in order to use the operation terminal, the authentication key is read from the recording device, Compared with the authentication key recorded in the recording unit, if they match, it is authenticated that the authentication key recorded in the recording device is valid, and then the terminal key is read from the recording device, Is decrypted with the authentication key and terminal identification information recorded in the recording unit, and if the value matches the secret information, the terminal key recorded in the recording device is valid at the operation terminal. A verifier to authenticate;
An operation terminal comprising: When the recording device is connected to the operation terminal in order to change the operation terminal used by the user, the verification unit determines that the authentication key of the recording device is valid but the terminal key is not valid. Then, the terminal identification information recorded in the recording unit is encrypted using an authentication key recorded in the recording device, and written to the recording device as terminal identification information of the operation terminal to be changed, When the verification unit authenticates that both the authentication key and the terminal key of the recording device are valid, the terminal identification information of the operation terminal of the change destination recorded in the recording device is read and recorded in the recording unit A terminal identification information encryption / decryption unit that decrypts with the authentication key and retrieves the terminal identification information of the operation terminal to be changed
Using the authentication key recorded in the recording unit and the terminal identification information of the operation terminal to be changed taken out by the terminal identification information encryption / decryption unit as encryption keys, the secret information recorded in the recording unit is used. The operation terminal according to claim 10, further comprising: a terminal key generation unit that encrypts and writes the encrypted secret information to the recording device as a terminal key of a change destination operation terminal. In an authentication server in which a plurality of operation terminals are connected and constitute one system together with these operation terminals,
A recording unit in which an authentication key that is an effective key in any operation terminal that gives the right to use the system, and secret information that is information not known outside the system is recorded;
When a user connects a recording device in which an authentication key, a terminal key, and terminal identification information are recorded to the operation terminal to be used, the operation terminal receives the authentication key read from the recording device; Compared with the authentication key recorded in the recording unit, if they match, the authentication key recorded in the recording device is authenticated and then the terminal key read from the recording device by the operation terminal Is decrypted with the authentication key recorded in the recording unit and the terminal identification information received from the operation terminal, and when the value matches the secret information, the terminal key recorded in the recording device is A verification unit that authenticates that is valid on the connected operation terminal,
An authentication server characterized by comprising: An operation terminal connected to the authentication server according to claim 12 and constituting one system together with the authentication server,
A recording unit in which terminal identification information of the terminal is recorded;
When the recording device is connected to the operation terminal to change the operation terminal used by the user, the authentication key of the recording device is valid but the terminal key is valid in the verification unit of the authentication server. If it is determined, the terminal identification information recorded in the recording unit is encrypted using the authentication key recorded in the recording device, and the terminal identification information of the operation terminal to be changed is stored in the recording device. When the verification unit authenticates that both the authentication key and the terminal key of the recording device are valid, the terminal identification information of the operation terminal of the change destination recorded in the recording device is read, and the authentication server A terminal identification information encryption / decryption unit that decrypts with the authentication key recorded in the recording unit and extracts the terminal identification information of the operation terminal to be changed;
The authentication key recorded in the recording unit of the authentication server and the terminal identification information of the operation terminal to be changed taken out by the terminal identification information encryption / decryption unit are recorded in the recording unit of the authentication server as an encryption key. An operation terminal comprising: a terminal key generation unit that encrypts the secret information that has been encrypted and writes the encrypted secret information to the recording device as a terminal key of the operation terminal to be changed. In the operation terminals that make up a specific system,
An authentication key that is a key that is valid for any operating terminal that gives the right to use the system, a terminal key that is a key that gives the right to use the operating terminal, and information that is not known outside the system A first recording unit in which secret information is recorded;
A second recording unit in which an authentication key, a terminal key, and terminal identification information, which are information for authenticating a user who intends to use the operation terminal, are recorded;
The authentication key is read from the second recording unit, compared with the authentication key recorded in the first recording unit, and if they match, the authentication key recorded in the second recording unit is valid Next, the terminal key is read from the second recording unit, the terminal key is decrypted with the authentication key and terminal identification information recorded in the first recording unit, and the value is A verification unit that authenticates that the terminal key recorded in the second recording unit is valid at the operation terminal if the secret information matches the secret information;
An operation terminal comprising: An inter-terminal communication unit for communicating with other operation terminals;
In order to change the operation terminal used by the user, the change-source operation terminal transmits information of the second recording unit in the inter-terminal communication unit, and the information is transmitted to the second recording unit of the operation terminal. When recording to
If the verification unit determines that the authentication key of the second recording unit is valid but the terminal key is not valid, the verification unit records the terminal identification information recorded in the first recording unit as the second recording unit. A terminal identification information encryption / decryption unit that encrypts using the authentication key recorded in the unit and writes it as the terminal identification information of the operation terminal to be changed to the second recording unit;
When the operation terminal of the change destination transmits the information of the second recording unit by inter-terminal communication and records it in the second recording unit,
When the authentication unit authenticates that both the authentication key and the terminal key of the second recording unit are valid, the terminal identification information of the operation terminal of the change destination recorded in the second recording unit is read, This is decrypted with the authentication key recorded in the first recording unit, and the terminal identification information encryption / decryption unit for retrieving the terminal identification information of the operation terminal of the change destination,
In the second recording unit, the authentication key recorded in the first recording unit and the terminal identification information of the change-destination operation terminal extracted by the terminal identification information encryption / decryption unit are used as encryption keys. The terminal key generation unit according to claim 14, further comprising: a terminal key generation unit that encrypts the recorded secret information and writes the encrypted secret information in the second recording unit as a terminal key of the operation terminal that is the change destination. Operation terminal. Terminal characteristic information that is characteristic information of the operation terminal is further recorded in the recording unit of the operation terminal,
When the verification unit writes the terminal identification information of the operation terminal to be changed to the recording device, the terminal characteristic information recorded in the recording unit is also encrypted with the authentication key of the recording device and written to the recording device ,
The mobile information recorded in the recording device is read, the mobile information is decrypted with the authentication key and the terminal identification information recorded in the recording unit, the terminal characteristic information is read out from the recording device, and the decrypted mobile information Is converted into a format according to the terminal characteristic information, and the terminal identification information recorded in the recording device is decrypted with the authentication key recorded in the recording unit, and the recording device It further includes a portable information adaptation unit that encrypts with a recorded authentication key and records as new portable information in the recording device,
The operation terminal according to claim 11. Terminal characteristic information that is characteristic information of the operation terminal is further recorded in the recording unit of the operation terminal,
When the verification unit writes the terminal identification information of the operation terminal to be changed to the recording device, the terminal characteristic information recorded in the recording unit of the operation terminal is also encrypted with the authentication key of the recording device. Write to device,
The authentication server according to claim 12.   Read the mobile information recorded in the recording device, decrypt the mobile information with the authentication key recorded in the recording unit of the authentication server and the terminal identification information recorded in the recording unit of the operation terminal, Read terminal characteristic information from the recording device, convert the decrypted portable information into a format corresponding to the terminal characteristic information, and record the terminal identification information recorded in the recording device in the recording unit of the authentication server 14. A mobile information adaptation unit that encrypts the terminal identification information decrypted with the authentication key that has been recorded and the authentication key recorded in the recording device, and records the information as new mobile information in the recording device. The operation terminal described in. Terminal characteristic information that is characteristic information of the operation terminal is further recorded in the first recording unit of the operation terminal,
Terminal characteristic information and portable information are further recorded in the second recording unit of the operation terminal,
When the verification unit writes the terminal identification information of the operation terminal to be changed to the second recording unit, the terminal characteristic information recorded in the first recording unit is also the authentication key of the second recording unit. And write it in the second recording unit,
The mobile information recorded in the second recording unit is read, the mobile information is decrypted with the authentication key and the terminal identification information recorded in the first recording unit, and the terminal characteristics are obtained from the second recording unit. Read the information, convert the decrypted portable information into a format according to the terminal characteristic information, and record the terminal identification information recorded in the first recording unit in the first recording unit A mobile information adaptation unit that encrypts the terminal identification information decrypted with the authentication key and the authentication key recorded in the second recording unit and records the information as new mobile information in the second recording unit ,
The operation terminal according to claim 15. A system having a plurality of operation terminals and an authentication server connected to these operation terminals,
The authentication server is
A recording unit in which an authentication key that is an effective key in any operation terminal that gives the right to use the system, and secret information that is information not known outside the system is recorded;
When the user connects a recording device in which an authentication key, a terminal key, and terminal identification information are recorded to the operating terminal in order to use any of the operating terminals, the operating terminal is disconnected from the recording device. The read authentication key is received, compared with the authentication key recorded in the recording unit, and if it matches, the authentication key recorded in the recording device is authenticated, and then the operation terminal The terminal key read from the recording device is decrypted with the authentication key recorded in the recording unit and the terminal identification information received from the operation terminal, and when the value matches the secret information, the terminal key is recorded on the recording device. A verification unit that authenticates that the terminal key is valid on the operation terminal to which the recording device is connected;
Have
The operation terminal is
A recording unit in which terminal identification information of the terminal is recorded;
When the recording device is connected to the operation terminal to change the operation terminal used by the user, the authentication key of the recording device is valid but the terminal key is valid in the verification unit of the authentication server. If it is determined, the terminal identification information recorded in the recording unit is encrypted using the authentication key recorded in the recording device, and the terminal identification information of the operation terminal to be changed is stored in the recording device. When the verification unit authenticates that both the authentication key and the terminal key of the recording device are valid, the terminal identification information of the operation terminal of the change destination recorded in the recording device is read, and the authentication server A terminal identification information encryption / decryption unit that decrypts with the authentication key recorded in the recording unit and extracts the terminal identification information of the operation terminal to be changed;
The authentication key recorded in the recording unit of the authentication server and the terminal identification information of the operation terminal to be changed taken out by the terminal identification information encryption / decryption unit are recorded in the recording unit as encryption keys. A terminal key generation unit that encrypts secret information and writes the encrypted secret information to the recording device as a terminal key of a change destination operation terminal. An authentication program for causing a computer to execute the authentication method according to claim 1.

Images