JP2007053454A - Authentication device and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system in which access can be limited and information can be provided depending on the existing area of a utilization device in addition to authentication of a user. <P>SOLUTION: The authentication device performing authentication through connection with an object device 30 utilized by a user and judging availability of the utilization object device 30 comprises a section 16 for acquiring positional information by a signal provided from a positional information provider 60 under a state connected with the object device 30, and an authentication processing section 12 for judging whether the user has a utilization authority based on previously registered positional information or not by using the positional information acquired from the positional information acquiring section 16 and the user's authentication information. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an authentication device and an authentication method for performing authentication processing in consideration of user authentication information and location information.

  Conventionally, when an authentication device for identifying an individual (for example, UIM: User Identity Module) is used as a connection means to a specific site, the user can access at any terminal that selects a location. When used for remote login, etc., it is possible to view company important data, mails, etc. even in urban areas.

  In other words, normally, when accessing important data such as personal information in the company, a specific terminal is used and work is performed in a specific room. However, by using this authentication device, only the access location can be determined. Access can be made using an arbitrary terminal in a limited form. Here, Patent Documents 1 to 3 disclose authentication techniques via a wireless line.

JP 2004-100346 A JP 2004-252552 A Japanese Patent No. 3498633

  However, in the conventional authentication technology, access restriction and information provision are performed for an individual who subscribes to a specific service according to the area where the user device exists, in addition to the authentication for use. I can't. In addition, when using an authentication device that identifies an individual, use of a PIN (Personal Identity Number) code or biometric authentication is permitted. Is invited. Moreover, if the authentication device is lost, the connection source cannot be checked where it was used.

  Here, as a means for specifying an individual, there is a mechanism that can be used only when a communication is performed between a transmission terminal and a reception terminal and there is a reception terminal in the vicinity of the transmission terminal. It is not possible to consider the authority according to the system, and even if the usage target apparatus is restricted in use, work log management is not performed.

  The present invention has been made to solve such problems. That is, the present invention provides an authentication device that performs authentication by connecting to a target device that a user intends to use and determines whether or not the target device can be used, and is provided from the position information providing device while being connected to the target device. Whether or not the user has the authority to use the information based on the pre-registered position information using the position information acquisition unit that acquires the position information by the signal and the position information acquired by the position information acquisition unit and the user authentication information. And an authentication processing unit for determining.

  The present invention also provides an authentication method for performing authentication by connecting an authentication device to a target device to be used by a user, and determining whether or not the target device can be used, with the authentication device being connected to the target device. The authentication device acquires the location information based on the signal provided from the information providing apparatus, the location information acquired by the authentication device and the user authentication information, and the use authority based on the location information registered in advance by the user is obtained. And a step of determining by an authentication device whether or not it has the authentication method.

  In the present invention, when the authentication device is connected to the target device to be used by the user, the location information of the target device is acquired together with the user authentication information by the authentication device, and the right of use is obtained based on the user authentication information and the location information. Judging the presence or absence of. As a result, in addition to user authentication, use authority by location can be set.

  In addition to the authentication device of the present invention, the security level can be increased by using another authentication device. For example, by allowing the authentication device itself to be used in two, the separated authentication devices are positioned as the authentication device (1) and the authentication device (2), and the authentication device (1) side connects to the usage target device. When the authentication device (2) enters the area permitted by the authentication device (1) in the state of being authenticated, the authenticity of each other authentication device is mutually authenticated on the encrypted communication path as necessary. Authentication by acquiring location information and referring to information (location information and usage authority table encrypted and held in a chip that cannot be accessed by the user) registered in the authentication device (1) in advance. Authentication is performed only when the person who has the authentication device (2) paired with the device (1) exists in the vicinity of the target device and is in a place where use and service provision are permitted. Stand City, the available state will release the lock of the use target device. This authentication device (1) may be built in the use target apparatus or may be externally attached.

  Then, when accessing the server side such as a service provider that becomes the connection target device after the unlocked state of the target device to be used, the location information acquired by the authentication device (1) is transmitted in addition to the authentication information at the time of authentication. By doing this, it is possible to manage information on who is accessing from where on the authentication server side, providing authentication according to the area, or providing authentication restrictions according to the area to the connection target device side, etc. Can be defined.

  Further, when the authentication device (1) is used as an external device to the usage target device, it manages a work log and the like while the authentication device (1) is connected to the usage target device. Alternatively, a mechanism is provided that does not leave work log information on the use target device side when the authentication device (2) is out of the use allowable area of the authentication device (1).

  The authentication device (1) and the authentication device (2) hold the session even after the authentication is established, and periodically send and receive “Keep Alive” messages to allow the authentication device (2) to be accepted by the authentication device (1). Manage whether it exists in the available area.

  In addition, communication between the authentication device (1) and the authentication device (2) is performed in an encrypted state, and an encryption session key that is mutually used regularly is updated.

  When using the authentication device without separation, instead of omitting the authentication generated between the authentication device (1) and the authentication device (2), in order to give the use authority of the authentication device itself, as necessary Other alternative authentications such as PIN (Personal Identity Number) input and biometric authentication may be used, and the authentication device itself can be applied either internally or externally.

  According to the present invention as described above, it is possible to perform access restriction and information provision for an individual who subscribes to a specific service according to the authentication for use and the area where the user device exists. It becomes. In addition, it is possible to reliably prevent the use of a third party due to forgetting to unplug the authentication device, and it is possible to prevent unauthorized use by erasing the work log when usage restrictions are imposed.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<System configuration>
FIG. 1 is a schematic diagram illustrating a configuration example of an authentication system using an authentication device according to the present embodiment. That is, this authentication system includes authentication devices (1) and (2), a usage target device 30, a connection target device 40, an authentication server 50, and a location information providing device 60, and authentication for using the usage target device 30. Is performed based on the location information acquired from the authentication devices (1) and (2) and the location providing device 60.

  If there is a connection target device 40 that requires line connection for the user to receive the service, the authentication device (1) provides authentication information and position information to the connection target device 40, and performs authentication processing. The connection target device 40 and the usage target device 30 are connected to each other, and access and information provision according to the authority of the user can be received.

  As an apparatus (position information providing apparatus) that provides position information to the authentication device (1), for example, a GPS (Global Positioning System) or a wireless AP (Access Point) is used, and the authentication device (1) is used as the usage target apparatus 30. When connected, the authentication device (1) performs user authentication (authentication of the user with pre-registered authentication information), and acquires position information by a signal sent from the position information providing device 60, and is registered in advance. By referring to the usage authority table based on the location information, the presence / absence of usage authority in the acquired location information is determined.

  Since the location information is acquired by the authentication device (1), the location information is actually information indicating the location of the authentication device (1). However, the authentication device (1) is connected to the use target device 30 (directly or via a cable). In other words, it is equivalent to information indicating the position of the usage target device 30.

  If there is a usage authorization based on user authentication and location information, the user can receive a service using the usage target device 30. In particular, in the present embodiment, since the use authority using the position information can be set, an information providing service according to the individual and the area to be used can be realized.

  In this embodiment, since the authentication device (1) has a function of acquiring location information, an area-limited service based on the user and location information even if the usage target device 30 is general-purpose. It is also a feature that can be provided.

  In addition to user authentication and usage authority setting based on location information, authentication using two authentication devices (authentication devices (1) and (2)) can be performed from the viewpoint of improving the security level. In other words, the authentication device (1) determines whether or not the authentication device (2) exists in the usable area permitted by the authentication device (1), and only when there is, instructs the lock release request to the target device. To do.

  As a result, since the user has the authentication device (2) and the use target device can be used only in the state where the authentication device (1) is in the usable area, the authentication device (1) is erroneously selected. As long as there is an authentication device (2) outside the usable area even if the device is left connected to the device to be used, the device to be used will be locked to prevent unauthorized use by a third party. Become.

<Configuration of authentication device>
FIG. 2 is a functional block diagram of the authentication device. As functions held by the authentication devices (1) and (2), the authentication device (1) authenticates the authentication information 11, the authentication processing unit 12, the location information use authority table 13, and the authentication location information holding area 14 are encrypted and managed. The communication apparatus 15 includes a use target device communication unit 15, a position information acquisition unit 16, and a wireless communication unit 17 as communication units with related devices.

  Among these, the authentication information 11 is information necessary for authenticating the user, and is identification information such as a PIN code registered in advance. The location information use authority table 13 is a table showing correspondence between areas (position information) and use authorities for authenticated users, and data indicating what use authority is given to which areas. It is.

  The authentication processing unit 12 authenticates the user using the authentication information when the authentication device (1) is connected to the usage target device 30, and the location information acquired by the location information acquisition unit 16 from the location information providing device 60. And the position information use authority table 13 are used to determine whether the user has the use authority corresponding to the current area.

  The at-authentication position information holding area 14 is an area (memory) for storing position information acquired when the authentication device (1) is connected to the usage target device 30 and the user is authenticated.

  Here, the acquisition of the position information is performed by the position information acquisition unit 16 at a predetermined timing, and the position information at the time of authentication stored in the position information holding area 14 at the time of authentication is the same as the position information acquired at the predetermined timing. If it is different, the location information usage authority table 13 is referred to determine whether there is a usage authority in the location information, and the contents of the location information holding area 14 at the time of authentication are determined. The position information used for the determination after updating is stored.

  Therefore, the user can continue using the usage target device 30 in the area where the usage right is used, and if the user is out of the area with the usage right, the user loses the usage right and uses the usage target device 30. Can not be.

  As for the authentication device (2), the authentication information 21 and the authentication processing 22 part exist in an encrypted and managed area, and the wireless communication part 23 is held as a communication part. As the authentication information 21, the same information as the authentication information 11 stored in the authentication device (1) is stored. The authentication processing unit 22 executes an authentication process with the authentication device (1) using the authentication information 21, and only when authenticated, the presence / absence of use authority based on the position information via the authentication device (1) is determined. Will be done.

  Authentication processing is executed between the authentication devices (1) and (2) by exchanging encrypted authentication information by the wireless communication units 17 and 23. At this time, the communication area in the wireless communication unit 17 of the authentication device (1) becomes an available area permitted by the authentication device (1), and in this available area, that is, the authentication device (2) is connected to the authentication device (1). Authentication is performed only when the wireless communication is within an area where wireless communication is possible. When authentication is successful, position information is acquired, and usage authority is determined based on the acquired position information and user information.

  Accordingly, the use target device 30 is used only when the user has the authentication device (2) paired with the authentication device (1) and enters the usable area of the authentication device (1). If the user leaves the usable area of the authentication device (1) while holding the authentication device (2), the usage target device 30 is locked without being authenticated. As a result, even if the authentication device (1) is mistakenly left while being connected to the usage target device 30, the usage target device 30 is locked as long as the authentication device (2) is outside the available area. This will prevent unauthorized use by third parties.

  When the authentication devices (1) and (2) are not used in a separated form as described above (for example, when the authentication device (2) is directly connected to the authentication device (1)), the authentication information 11, 21. The authentication processing units 12 and 22 are shared, and arbitrary authentication (such as PIN input or biometric authentication) for using the authentication device is performed in a state where there is no authentication operation part between the authentication devices. This makes it possible to substitute other sequences.

<Operation, authentication method>
FIG. 3 is a sequence diagram for explaining the outline of the operation. In the following description, reference numerals not shown in FIG. 3 refer to FIGS. As an outline of the operation, first, when the authentication device (2) exists in the usable area provided by the authentication device (1), the authentication device (1) transmits its own authentication information 11 to the authentication device (2). Is transmitted via the wireless communication unit 17 and an authentication request is requested. After confirming the authentication information 11 sent from the authentication device (1), the authentication device (2) transmits its own authentication information 21 to the authentication device (1) if there is no problem.

  Next, the authentication device (1) that has received the authentication information 21 sent from the authentication device (2) verifies the authentication information 21, acquires location information from the location information providing device 60, and authenticates the authentication device (2 ) Authentication information 21 and the location information use authority table 13 held in the authentication device (1) are compared to determine the use authority. If there is no problem, the authentication is established, and the authentication device (2) is authenticated. The authentication result is transmitted, and a lock release request corresponding to the usage authority is transmitted to the usage target device 30. Thereby, the usage target device 30 becomes available.

  Thereafter, the session between the authentication devices (1) and (2) is maintained and the authentication device (1) always confirms whether or not the authentication device (2) is present by a “Keep Alive” message or the like. Enter the monitoring mode.

  If there is no response from the authentication device (2) (goes out of the usable area) or location information is always acquired, the target device 30 is taken out of the use range (out of the area where use is authorized) If the authentication device (1) has received the request, the authentication device (1) transmits a lock request to the usage target device 30. As a result, the usage target device 30 becomes unavailable.

  Next, when attempting to connect to the connection target device 40 using the usage target device 30 or requesting information provision, the usage target device 30 transmits a connection request to the connection target device 40, The connection target device 40 that has received the connection request message transmits an authentication / location information transmission request including its own authentication information.

  The use target device 30 that has received the transmission request from the connection target device 40 provides this information to the authentication device (1), and the authentication device (1) includes its own authentication information 11 together with the acquired location information. I will provide a. Then, the usage target device 30 transmits this content to the connection target device 40, and the connection target device 40 receives the result by issuing an authentication request to the higher-level authentication server 50, and the authentication is established, not established, or established. In this case, the available area information is transmitted to the usage target device 30. As a result, the access right according to the use right or the service provision (information reception) can be used by the use target device 30.

  In addition, the received message is managed on the authentication device (1), and thereafter, the location information and the presence / absence of the authentication device (2) are continuously managed on the authentication device (1). If it becomes, the usage target device 30 immediately enters a locked state and cannot be used.

  Authentication between the authentication devices (1) and (2) and between the connection target device 40 and the usage target device 30 is performed based on a general-purpose authentication sequence such as SSL (Secure Socket Layer). Further, work history (log) information from the unlocked state until the device to be used is locked again is managed by the authentication device (1), and is outside the usable area of the authentication device (2) and the authentication device (1). Or when the use target device 30 is outside the area where the use authority is granted and authentication is no longer established, or when the use is completed, history information is deleted so that it does not remain in the use target device 30. As a result, it is possible to prevent a work history from being abused after a legitimate user has finished using the usage target device 30.

  By such a sequence, a user who wants to use a specific service connects an authentication device to the usage target device 30 in a specific area, so that the location information of the usage target device 30 exists along with user authentication. Thus, it becomes possible to perform access restriction and information provision according to these users and areas. In addition, it is possible to reliably prevent the use of a third party due to forgetting to unplug the authentication device, and it is possible to prevent unauthorized use by erasing the work log when usage restrictions are imposed.

-It is possible to provide an individual who has subscribed to a specific service by performing authentication including location information on a service corresponding to the area.
-It is possible to provide a mechanism that can be used only from a specific area (home, etc.) by restricting the use at the time of remote access.
-When handling important data such as personal information, it is possible to work with any terminal simply by defining a use area without providing a dedicated terminal.
When the usage target device 30 is composed of a mobile phone or a mobile terminal (PDA: Personal Digital Assistance), it is possible to provide a service limited to the user and the usage area.

It is a schematic diagram explaining the structural example of the authentication system with which the authentication device which concerns on this embodiment is applied. It is a functional block diagram of an authentication device. It is a sequence diagram explaining an operation | movement outline | summary.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 11 ... Authentication information, 12 ... Authentication process part, 13 ... Position information utilization authority table, 14 ... Position information holding area at the time of authentication, 15 ... Usage object apparatus communication part, 16 ... Position information acquisition part, 17 ... Wireless communication part, 21 ... authentication information, 22 ... authentication processing unit, 23 ... wireless communication unit, 30 ... use target device, 40 ... connection target device, 50 ... authentication server, 60 ... location information providing device

Claims (7)

In an authentication device that performs authentication by connecting to a target device that a user intends to use, and determines whether the target device can be used,
A position information acquisition unit that acquires position information of the target device by a signal provided from the position information providing device in a state of being connected to the target device;
Using the location information acquired by the location information acquisition unit and the authentication information of the user, and an authentication processing unit that determines whether or not the user has a use authority based on location information registered in advance. Feature authentication device. The said authentication process part acquires the said location information regularly, and judges the presence or absence of the said use authority using the said location information and the said user's authentication information for every acquisition. Authentication device. A communication unit that communicates whether there is another authentication device in a given area,
When the other authentication device is detected by the communication unit, the authentication processing unit performs authentication processing by the other authentication device, and only when the authentication is successful, the use authority based on the user authentication information and the location information is The authentication device according to claim 1, wherein presence or absence is determined. In an authentication method for performing authentication by connecting an authentication device to a target device to be used by a user, and determining whether the target device can be used,
The authentication device acquires the position information of the target device by a signal provided from the position information providing device in a state where the authentication device is connected to the target device;
Using the location information acquired by the authentication device and the authentication information of the user, and determining whether or not the authentication device has a use authority based on location information registered in advance. A characteristic authentication method. Only when there is another authentication device in a predetermined area set by the authentication device and the authentication process by the other authentication device has been performed, the presence / absence of the use authority based on the location information and the user authentication information. The authentication method according to claim 4, wherein the determination is performed by the authentication device. If it is determined that the user has authority to use, the step of transmitting the user authentication information and the location information from the target device to an external service providing source device;
The authentication method according to claim 4, further comprising: authenticating whether or not the service providing apparatus can provide a service based on the user authentication information and the location information. A step of erasing a usage record by the user from the target device when the authentication device determines that the usage right is determined and the user has lost the usage right after using the target device. The authentication method according to claim 4.

Images