JP2007052513A - Target device, authentication device, and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To secure security at a terminal shared by a plurality of persons and improve usability. <P>SOLUTION: A target device 1 for authenticating a radio UIM 2 that is an authentication device when a radio UIM 2 approaches comprises a communication unit 12 for detection whether or not the radio UIM 2 has entered a prescribed authentication area in accordance with the transmission/reception of the prescribed signal; an main CPU 11 for receiving authentication information sent from the radio UIM 2 in a state that the radio UIM 2 has entered the prescribed authentication area for collating the received authentication information with the pre-registered authentication information, and for controlling to transmit the authentication result obtained by the collation from the communication unit 12 to the radio UIM 2. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a target device that restricts the use of a user by authentication, an authentication device that gives a trigger for authentication to the target device, and an authentication method using the target device and the authentication device.

  In recent years, the spread of electronic devices has been remarkable, and the number of devices handled by one person is increasing. In addition, an environment in which a large number of people can use one device has been established, and users can benefit from the convenience of using the device at any location.

  For example, in an office or public facility, a single terminal may be shared by multiple people. An authentication mechanism is necessary so that only you can see the information addressed to you on a shared terminal. Currently, a method of logging in to a terminal by inputting a user name and a password is generally used.

  On the other hand, the development of wireless technology is tremendous, and products that can be successfully authenticated by holding a card-shaped wireless terminal over an information device are also on sale.

  Here, as a technology related to a device use restriction device, in Patent Document 1, when the identification signal transmission unit is separated from the use restriction release unit by a certain distance, it is output from the use restriction release unit, the use restriction signal is stopped, and the target device is A technique for making it unavailable is disclosed.

Japanese Patent No. 293276

  However, when other users are using the shared terminal, they cannot use it. Here, whether or not another user is using the terminal has no choice but to approach and visually observe what other people are using. In addition, the technique disclosed in Patent Document 1 is a method that restricts use when leaving, and does not log in to the terminal by approaching, but also changes in the service provided according to the distance from the terminal, or authentication Since the level cannot be changed, it is insufficient to provide a service according to the usage situation.

  The present invention has been made to solve such problems. That is, according to the present invention, in a target apparatus that performs authentication by approaching an authentication device, a communication unit that detects whether or not the authentication device has entered a predetermined authentication area by transmitting and receiving a predetermined signal; The authentication information sent from the authentication device in the state of entering the authentication area is received by the communication means, the received authentication information is collated with the authentication information registered in advance, and the authentication result obtained by the collation is obtained. And a control unit that performs control to transmit from the communication unit to the authentication device.

  In addition, the present invention transmits authentication information to the target device and receives an authentication result sent from the target device in an authentication device that performs authentication on the target device by approaching the target device that the user intends to use. The authentication device includes a communication unit and a non-rewritable storage unit that stores authentication information.

  Further, according to the present invention, in an authentication method for executing an authentication process in a target device by bringing the authentication device closer to a target device to be used by a user, whether or not the authentication device has entered a predetermined authentication area by the target device. And when it is determined that the authentication device has entered the predetermined authentication area, the authentication information transmitted from the authentication device is received by the target device, and the received authentication information and pre-registered authentication information are received. The authentication method has a step of transmitting the authentication result obtained by the verification to the authentication device and a step of receiving the authentication result transmitted from the target device by the authentication device.

  In the present invention, since the target device performs authentication processing based on the authentication information sent from the authentication device when the authentication device enters the predetermined area, the target device is moved closer to the target device. Automatic authentication can be realized.

  Further, the present invention uses a mechanism that can change the authentication level and the service after authentication in the target device depending on how far the authentication device is from the target device in a predetermined area.

  For example, when a user who has an authentication device approaches within a few meters of the target device, all services can be received by logging in by authentication on the target device. In addition, when a user having an authentication device is in an area that is more than a few meters away, a part of services can be received after performing authentication with the target device.

  As described above, by providing a necessary service according to the distance between the user having the authentication device and the target device, it is possible to provide a necessary and sufficient service according to the distance.

  As a specific usage example, when the target device is an e-mail terminal, the user who has the authentication device approaches the e-mail terminal, so that the authentication is successful and the e-mail can be referred to. As a result, it is not necessary to input a user name and password, and convenience is improved. In addition, if you are in a position within a certain area by an e-mail terminal, you can check only the information on whether or not an e-mail has arrived for the user on the display of the authentication device after authentication. Information on whether the user is using the terminal can be confirmed on the display of the authentication device.

  Therefore, according to the present invention, when a single target device (terminal) is shared by a plurality of people, it is possible to obtain information on whether or not the device is currently in use without going to the terminal. Since it is possible to acquire information on whether or not a message has arrived, it is possible to effectively use a shared terminal and a user can effectively use time. In addition, it is possible to log in to the terminal simply by approaching the terminal with the authentication device, and to improve usability.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In this embodiment, when a wireless UIM (User Identity Module) that is an authentication device approaches the target device (target device), the target device automatically performs authentication. If the authentication is successful, the target device performs wireless UIM. The system is characterized in that the authentication level and the service provided by the target device are changed according to the distance to the device.

  FIG. 1 is a schematic diagram showing an outline of an authentication system to which the present embodiment is applied. That is, the target device 1 that performs the authentication process is a terminal that can be used for each user, such as an e-mail terminal, and when there is a wireless UIM2 that is an authentication device in a predetermined area centered on the target device 1, the wireless UIM2 The target device 1 executes the authentication process using the authentication information transmitted from.

  The wireless UIM 2 is preferably a wireless UIM 2 worn by a user such as a mobile phone or an employee ID card. The authentication information is stored in the wireless UIM 2 in a non-rewritable storage means, and a reliable authentication process can be realized in the target device 1 using the authentication information.

  In the example shown in FIG. 1, two stages are provided as areas for authentication, and the target device 1 and the authentication level (1) in the far part of the area and the authentication level (2) in the near part. The authentication level is changed according to the distance from the wireless UIM2. As a result, the provided service can be changed according to the distance.

  Here, the distance for the authentication level (2) is within a few meters (for example, 1-2 meters) from the target device 1, and the distance for the authentication level (1) is a few meters (for example, 1-2 meters) from the target device 1. ) And the target device 1 can be seen (for example, 10 to 20 meters). Note that these ranges are set as appropriate depending on the type of service provided by the target device 1.

  FIG. 2 is a block diagram illustrating the configuration of the target device and the wireless UIM. The wireless UIM2 is a device for identifying an individual and is a device having an authentication function and a wireless communication function. Specifically, a non-rewritable storage unit (for example, Smart card IC) 23 and a main CPU 21 that store authentication information as an authentication function are provided, and a communication unit 22 is provided as a wireless communication function. Moreover, the monitor 24 which displays the information sent from the target apparatus 1 as needed is provided.

  The target device 1 is a device having a function that requires personal authentication such as being able to send and receive mail, log in, receive a FAX (facsimile), and receive a call, and a wireless communication function. is there. Specifically, a main CPU 11 for controlling various functions and a communication unit 12 having a wireless communication function are provided.

  The target device 1 and the wireless UIM 2 can communicate wirelessly via the communication units 12 and 22. Signal transmission / reception between the target device 1 and the wireless UIM 2 may be performed using radio waves or using light such as infrared rays. The target device 1 can receive a radio signal transmitted from the wireless UIM 2, detect the level thereof, and measure an approximate distance from the target device 1 to the wireless UIM 2.

  When the wireless UIM2 enters within a certain distance from the target device 1, the target device 1 authenticates the wireless UIM2. As an authentication method, Digest authentication, SSL (Secure Socket Layer) client authentication, or the like can be considered.

  FIG. 3 is a sequence diagram of authentication when SSL client authentication is used. First, signal transmission / reception is performed between the target device and the wireless UIM, and when the target device detects that the wireless UIM is within the authentication area of the target device, processing for authentication is executed. . At the time of authentication, the wireless UIM uses a smart card IC, which is a storage means mounted inside, to perform message signature and certificate acquisition.

  Next, when the authentication of the wireless UIM by the target device is successful, the wireless UIM is changed to an authenticated state. At that time, an authentication level is set according to the distance from the target device to the wireless UIM.

  When the authentication level is divided into two, it is as shown in FIG. By dividing the authentication level into a plurality of levels, the service provided by the target device can be changed according to the distance from the target device.

  For example, when the distance from the target device to the wireless UIM is a little far, information such as whether or not the user should use the target device can be acquired by notifying the wireless UIM of the current state of the target device. Further, when the distance from the target device to the wireless UIM is short, the owner of the wireless UIM can use the target device.

  Hereinafter, a method for changing a service according to the distance of the wireless UIM from the target device will be described. FIG. 4 is a schematic diagram illustrating an example in which a mail terminal and a FAX terminal are used as target devices. In the case of the mail terminal 101, if the distance to the wireless UIM2 is within a certain distance, it is regarded as the authentication level (1), and the mail terminal 101 determines whether the mail has arrived at the wireless UIM2, Information such as whether the terminal 101 is currently used is notified.

  Further, when the wireless UIM2 further approaches the mail terminal 101, it is considered that the authentication level has become (2), the user logs in to the mail terminal 101, and the owner of the wireless UIM2 can use the mail terminal 101. That is, even if it is not possible to read the content of the mail, if it is possible to obtain only information indicating whether the mail addressed to itself has arrived, it is possible to log in without going to the front of the mail terminal 101.

  The FAX terminal 102 is as follows. That is, when the user is at a distance slightly away from the FAX terminal 102, it is regarded as the authentication level (1), and notification is made as to whether the FAX addressed to him / her has arrived. Further, when the wireless UIM2 approaches the FAX terminal 102, the authentication level (2) is set. When the authentication level (2) is reached, the FAX addressed to the user of the wireless UIM2 is printed. Accordingly, since the printing is not performed until the FAX destination user approaches the FAX terminal 102, it is possible to avoid a risk that another person steals the FAX.

  When a single target device is shared by a plurality of people by such an authentication method using a target device and an authentication device (wireless UIM), information on whether or not the target device is currently in use without going to the front of the target device, Since it is possible to acquire information on whether or not a message addressed to itself has arrived by the wireless UIM at hand, it is possible to effectively use the target device and the user can effectively use time. In addition, it is possible to simply log in to the terminal simply by approaching the target device with the wireless UIM, and it is possible to ensure security and improve usability.

  In the above-described embodiment, the example in which the authentication level corresponding to the distance between the target device and the authentication device (wireless UIM) is set in two stages has been shown, but the present invention is not limited to this, and more stages. The authentication level may be set separately, and the change of the provided service may be set accordingly. Further, if the number of steps of the authentication level is changed depending on the provided service or the size of the authentication area is changed, a more detailed service can be provided.

<Application to videophone>
When making a videophone call or a phone call, it is not known whether the other party is at the phone, and there may be a person other than the person. Therefore, authentication is performed according to the distance from the terminal (here, the other party's telephone). For example, if the other party is away from the terminal for a certain distance, authentication is not performed and presence information indicating that the other party is not present is notified to the person who wants to make a videophone call. On the other hand, if the wireless UIM authentication is successful at a distance within a certain distance, presence information indicating that the other party is present is notified to a person who wants to make a videophone call or the like.

  Here, the distance within a certain range is assumed to be a range in which a ring tone can be heard in a house with a telephone. When there is an incoming call, the incoming video-phone call can be received only when the subject of the incoming call comes near the video-phone terminal. By using this method, it is possible to prevent a person other than the user from receiving an incoming call.

It is a schematic diagram which shows the outline | summary of the authentication system to which this embodiment is applied. It is a block diagram explaining the structure of an object apparatus and wireless UIM. It is a sequence diagram of authentication when SSL client authentication is used. It is a schematic diagram explaining the example at the time of using a mail terminal and a FAX terminal as object apparatus.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Target apparatus, 2 ... Wireless UIM, 11 ... Main CPU, 12 ... Communication part, 21 ... Main CPU, 22 ... Communication part, 23 ... Memory | storage part, 24 ... Monitor, 101 ... Mail terminal, 102 ... FAX terminal

Claims (11)

In the target device that performs authentication as the authentication device approaches,
Communication means for detecting whether the authentication device has entered a predetermined authentication area by transmitting and receiving a predetermined signal;
The authentication information sent from the authentication device in a state where the authentication device is in a predetermined authentication area is received by the communication means, and the received authentication information is collated with previously registered authentication information, And a control unit that performs control to transmit an authentication result obtained by the verification from the communication unit to the authentication device. The target device according to claim 1, wherein the control unit changes an authentication level depending on how far the authentication device is within the authentication area by the communication unit. The target device according to claim 1, wherein the control unit changes a provided service according to how far the authentication device is within the authentication area by the communication unit. In an authentication device in which authentication on the target device is performed by approaching the target device that the user is trying to use,
A communication means for transmitting authentication information to the target device and receiving an authentication result sent from the target device;
An authentication device comprising: a non-rewritable storage means for storing the authentication information. The authentication device according to claim 4, further comprising display means for performing display based on the authentication result received by the communication means. In an authentication method for executing authentication processing in the target device by bringing an authentication device closer to the target device that the user is trying to use,
Determining whether the authentication device has entered a predetermined authentication area by the target device;
When it is determined that the authentication device has entered a predetermined authentication area, the authentication information transmitted from the authentication device is received by the target device, and the received authentication information is compared with previously registered authentication information. Performing and transmitting the authentication result obtained by the verification to the authentication device;
And receiving the authentication result transmitted from the target device by the authentication device. The authentication method according to claim 6, wherein the target device changes an authentication level depending on how far the authentication device is within the authentication area. The authentication method according to claim 6, wherein the target device changes a service that can be used depending on how far the authentication device is within the authentication area. The authentication method according to claim 6, wherein the authentication device performs display based on an authentication result transmitted from the target device. The authentication method according to claim 7, wherein the authentication device performs display according to an authentication level set by the target device. The authentication method according to claim 8, wherein the authentication device performs display according to an available service set by the target device.

Images