JP2007219773A - Authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system having high reliability of individual authentication, high usability even for a person having some physical disability, and having a low psychological barrier in use. <P>SOLUTION: This authentication system comprises authentication system client software 100 and authentication system server hardware 200. The authentication system client software 200 has an authentication data storage part 101, a list creation part 104, and a passphrase creation part 108, and applies a passphrase created in the passphrase creation part 108 for user registration/authentication. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an authentication system applied to a computer system, and more particularly to an authentication system that has high reliability of personal authentication and is easily used by people with disabilities.

With the development of computer use, it has become common to share a computer connected to a computer network among a plurality of users.
In such a situation, it is necessary to distinguish authority such as data browsing, editing, and program execution in a computer connected to a network depending on the user's position.
In order to distinguish users, a mechanism for identifying the users is necessary in order to ensure use by the authority granted to the users.
Conventionally, a method using a user identifier and a password is generally used, but in order to make a password easy for a user to remember, a meaningful word related to the user is often used. For this reason, there is a problem that it becomes easy for a person other than the user to specify the password. As a result, it is difficult to prevent fraud by impersonation.
Since a method using a character string such as a password usually requires input using a keyboard or similar input device, there is a problem that it is difficult to use for a visually handicapped person or a handicapped person with a disability in the forelimbs.

Various measures have been studied for improving the prevention of fraud by impersonation.
As a first conventional example, there is biometric authentication using physical features such as fingerprint authentication, palm vein authentication, and iris authentication in recent years.
As a second conventional example, authentication based on the input order of a plurality of figures is also partially performed.
Further, as a third conventional example, a message identifier encrypted by a one-way function is generated using transmission information including a user identifier and a password as arguments, and the transmission information and the message identifier are transmitted to a higher system, and the higher system transmits the message identifier. There is also a method in which a message identifier is generated from information and user authentication is performed by comparing this with a received message identifier. (For example, Patent Document 1)
JP 2003-308298 A

The biometric authentication of the first conventional example is effective in preventing spoofing fraud by improving the certainty of personal authentication, but this method can be used for persons with disabilities who have lost the body part to be authenticated. Can not. In addition, since the information to be collected is closely linked to the individual user, there is a problem that psychological barriers in use are high.
The authentication based on the input order of a plurality of figures in the second conventional example is effective in preventing fraud by impersonation, but in order to increase this effect, the user needs to select a plurality of figures from many figures. . However, it is difficult to prepare a sufficient number of selected figures.
In the third conventional example, the authenticity of personal authentication is improved by using a password obtained by encrypting transmission information including a user identifier and information including a password with a one-way function. However, since the data used for authentication is limited to the user identifier and the password, there is a problem that the data range that can be selected is narrow, and in particular, the disabled person cannot select data suitable for himself.

  The present invention has been made in view of such problems, and provides an authentication system with high reliability of personal authentication, easy to use for people with some physical disabilities, and low psychological barriers in use. With the goal.

  In order to solve the above problem, the present invention is configured as follows.

According to the first aspect of the present invention, in an authentication system comprising authentication system client software that operates on terminal computer basic software and authentication system server software that operates on server computer basic software,
The authentication system client software selects an authentication data storage unit that stores a plurality of authentication data, a list creation unit that reads the authentication data and creates a list, and selects a plurality of authentication data from the list. And a passphrase creating unit that creates a passphrase by converting a plurality of authentication data using a one-way function, and applying the passphrase to perform user registration and authentication.
According to a second aspect of the present invention, the passphrase creating unit inputs the plurality of selected authentication data in a set order and converts them by a one-way function.
According to a third aspect of the present invention, the authentication data is further stored in an external storage device of the terminal computer and an authentication data storage unit in the authentication system server software. .
According to a fourth aspect of the present invention, the authentication data is binary data such as character string data, image data, and audio data.
According to a fifth aspect of the present invention, the one-way function includes a HASH function.
According to the sixth aspect of the present invention, a computer system to which the authentication system client software and the authentication system server software according to the first aspect are applied is provided.

According to the invention of claim 1, since the original data reproduction is difficult by using a passphrase created using a one-way function from a plurality of data as an authentication password, the certainty of personal authentication is improved, Unauthorized acts such as impersonation can be prevented.
According to the invention of claim 2, since authentication is performed using a plurality of data in addition to the input order, the authenticity of personal authentication is improved and fraud is more difficult.
According to the invention of claim 3, a plurality of authentication data at different locations can be used in combination. As a result, if the data in the external storage device and the internal storage unit are used together, even if the data in the internal storage unit is leaked or the medium for the external storage device storing the authentication data is lost, both data will not be available. (Passphrase) cannot be reconstructed, so safety can be secured.
According to the invention of claim 4, since it is possible to use various types of data, the user can use data suitable for himself. As a result, an appropriate method can be used even for a person with some kind of disability. For example, an appropriate method can be used such as voice data for a poor person and image data for a poor person. Also, since it is not related to the individual body, there are low psychological barriers in use.
According to the invention of claim 5, since the HASH function is used as the one-way function, a more secure password (passphrase) can be created.
According to the invention of claim 6, the certainty of personal authentication is improved, and a system that is easy to use for a person with some kind of disability can be provided.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  The authentication system according to the present invention is software that operates on a computer system including one or more terminals and one or more servers.

FIG. 1 is a configuration diagram of a computer system using an authentication system according to an embodiment of the present invention.
1 is a terminal computer, 2 is a server computer, 3 is a network, and 4 is an external storage device.
The terminal computer 1 includes terminal computer basic software 10, and the server computer 2 includes server computer basic software 20. The external storage device 4 includes a user individual authentication data unit 401 that stores individual authentication data. Examples of the medium used in the external storage device 4 include a flexible disk, an optical disk, and a USB standard memory.

First, the terminal computer basic software 10 will be described.
In the terminal computer basic software 10, 11 is an authentication function unit, 12 is a user registration change function unit, and 100 is authentication system client software. The authentication function unit 11 is an authentication function normally provided in the basic software, and the user registration change function unit 12 is a user identifier and password setting function normally provided in the basic software.
The authentication system client software 100 includes an authentication data terminal storage unit 101, an authentication data holding buffer 102, an authentication data acquisition unit 103, a list creation unit 104, a display unit 105, a playback unit 106, an input unit 107, a passphrase creation unit 108, An authentication function unit interface 109 and a user registration update unit interface 111 are provided.
Hereinafter, the function of each part will be described.

In the authentication system client software 100, the authentication data terminal storage unit 101 stores terminal authentication data, and the authentication data acquisition unit 103 acquires authentication data from the server and temporarily stores it in the authentication data holding buffer 102. The list creation unit 104 reads authentication data from the authentication data terminal storage unit 101, the authentication data holding buffer 102, and the user individual authentication data 401 and creates an authentication data list.
In addition to the character string, the authentication data includes binary data such as audio data and image data, but any authentication data can be used as long as it can be reproduced by a reproduction unit and confirmed by a human.
The display unit 105 displays a list of authentication data, and the reproduction unit 106 reproduces the data when the data is audio data or moving image data. When the user selects his / her authentication data, the user inputs it from the input unit 107.
Conventionally, there is one password as data for recognizing the user, but here, a plurality of authentication data is used and authentication is performed by a combination of these data. When a plurality of authentication data are used, the combination of the data to be used and, if necessary, the input order are also set as the authentication conditions.
The passphrase creation unit 108 creates data for the selected authentication data information using a one-way function such as a HASH function, and from this data output, a character string that can be used by the authentication function unit 11 and the user registration change function unit 12 To passphrase.
The authentication function interface 109 has a function of passing the created passphrase as a password to the authentication function unit 11. Further, the user registration update unit interface 111 has a function of passing the created passphrase as a password to the user registration change function unit 12.
As described above, the passphrase issued by the passphrase creation unit 108 is used for authentication at the time of login of the terminal computer.

Next, the server computer basic software 20 will be described.
In the server computer basic software 20, 21 is an authentication function unit, 22 is a user registration update function unit, and 200 is authentication system server software 200. The authentication function unit 21 and the user registration update function unit 22 are functionally the same as the authentication function unit 11 and the user registration change function unit 12 of the terminal computer basic software 10.
The authentication system server software 200 includes an authentication data server storage unit 201 and an authentication data communication unit 202. The authentication data server storage unit 201 stores terminal authentication data, and the authentication data communication unit 202 transmits authentication data of the authentication data server storage unit 201 in response to a request from the authentication data acquisition unit 103.
In the login from the terminal computer 1 to the server computer 2, the authentication function unit 21 and the user registration update function unit 22 function.
Thus, the authentication system is used when logging in to the terminal computer 1 and logging in from the terminal computer 1 to the server computer 2.
The authentication system of the present invention is configured by the authentication system client software 100 and the authentication system server software 200. However, when the authentication system is configured by only a single computer, the authentication system client software 100 and the authentication system server software are included. 200 can be executed on the same computer.
Here, the passphrase created above is applied to the user registration update function unit and authentication function unit, which are existing functions on the basic software, but the existing registration update function unit and authentication function unit In addition, the function of the authentication system of the present invention may be added.

The registration, update, and authentication procedures will be described below.
When registering a new user, the authentication data is read and displayed as a list, and then a registration process is performed.
First, a flow until data is displayed will be described.
FIG. 2 is a flowchart showing a flow of processing from reading of authentication data to display in the authentication system showing the embodiment of the present invention.
The authentication data can be stored in three locations, that is, the authentication data terminal storage unit 101, the authentication data holding buffer 102, and the user individual authentication data unit. Here, a plurality of authentication data is stored in each unit in advance.
First, authentication data in the terminal computer 1 is read from the authentication data terminal storage unit 101. (Step S101) Next, it is confirmed whether or not the server computer 2 exists outside (Step S102). If the server computer 2 exists, the authentication data acquisition unit 103 and the authentication data communication unit 202 pass through the network 3. Authentication data is acquired from the authentication data server storage unit 201 (step S103). The acquired authentication data is temporarily stored in the authentication data holding buffer 102 (step S104).
Next, the authentication data is read from the authentication data holding buffer 102 (step S105).
Subsequently, it is determined whether the user has used the user individual authentication data unit 401 by the external storage device 4 (step S106). If the user has been used, data is read from the user individual authentication data unit 401 (step S107).
The list creation unit 104 creates a list of all the read authentication data and displays it on the display unit 105. Here, the information is displayed as identifiable information (hereinafter referred to as an identifier) such as an icon and a file name (step S108).

Next, the flow from display to registration will be described.
FIG. 3 is a flowchart showing a flow from display of authentication data to registration processing in the authentication system according to the embodiment of the present invention.
When newly registering a user, the authentication data displayed by the display unit 105 is selected (step S301). When the selected authentication data needs to be confirmed by reproduction such as an audio file (step S302), the reproduction unit 106 is selected. Is used to confirm the data content (step S303), and the necessary authentication data identifier is input. Usually, authentication is performed using a combination of a plurality of authentication data. When the order of input of a plurality of authentication data is specified, they are input in the specified order (step S304).
Next, the passphrase creation unit 108 creates data for the input authentication data information using a one-way function such as a HASH function, and converts the data output into a character string that can be used by the authentication function unit. A phrase is created (step S305).
The pass phrase and user identifier created above are transferred to the user registration update function unit 12 of the terminal computer basic software 10 through the user registration update unit interface 111 (step S306).
Thereafter, user registration is performed on the terminal computer 1 using the user registration update function unit 12 of the terminal computer basic software 10.
If the server computer 2 exists, the user registration / update function unit 22 of the server computer basic software 20 of the server computer 2 is used to perform user registration in the server computer 2.

Next, a process flow for authenticating a user will be described.
The authentication data is read and displayed as a list, and then the authentication process is performed. The flow up to the display is the same as in FIG.
Next, a flow from displaying authentication data to authenticating will be described.
FIG. 4 is a flowchart showing a flow from display of authentication data to authentication processing in the authentication system showing the embodiment of the present invention.
The user uses the input unit 107 to select authentication data displayed by the display unit 105 (step S201). When the authentication data needs to be confirmed by reproduction such as an audio file (step S202), the reproduction unit 106 reproduces the data and confirms the content of the data (step S203).
The required authentication data identifier is input at the input unit 107. When the order of a plurality of authentication data is specified, they are entered in the specified order. (Step S204) The passphrase creation unit 108 creates data using a one-way function such as a HASH function for the input authentication data information, and converts the data output into a character string that can be used by the authentication function unit. A passphrase is created (step S205).
The created passphrase and user identifier are transferred to the authentication function unit 11 of the terminal computer basic software through the authentication function unit interface. (Step S206).
Thereafter, authentication is performed using the function of the authentication function unit 11 of the terminal computer basic software 10. When the server computer 2 exists, authentication is performed using the authentication function unit 21 of the server computer basic software 20 of the server computer 2.

Next, a case where the information on existing users is updated will be described.
When updating the information of an existing user, the flow from reading and displaying the authentication data is the same as in FIG. The flow after the display is the same as that in FIG.
That is, the user selects from the displayed authentication data, and when the authentication data needs to be confirmed, the user reproduces and confirms the contents. Next, the authentication data is input in the order of use, a passphrase is created from the input data, and is passed to the user registration update function unit 12 of the basic software.

In this way, the authentication system obtains authentication data stored at a plurality of locations and displays a list of authentication data. In the case of audio data or video data, it reproduces and confirms it, and selects from the displayed data list . A passphrase is created from the authentication data, and the created passphrase is used as a password for the authentication function of the basic software.
The authentication system of the present invention has the following features.
Since authentication using a plurality of data formats such as images and sounds is possible, it is possible to construct an authentication method that can be easily used by persons with disabilities. In addition, since the authentication data can be distributed, the authentication data can be used in combination with the server and the user separately prepared with a USB memory or the like. For example, if the authentication data of the computer leaks or the external storage medium that stores the authentication data is lost, the actual password (phrase) cannot be reconstructed because both of the data are not available. So it is safe.
Furthermore, by using a passphrase created by the HASH function, it is possible to easily construct a mechanism that makes it difficult to identify an individual.

  The authentication system of the present invention can be applied to computer systems and control devices having an authentication function.

1 is a configuration diagram of a computer system using an authentication system according to an embodiment of the present invention. It is a flowchart which shows the flow of a process from the reading of authentication data to a display in the authentication system which shows the Example of this invention. 5 is a flowchart showing a flow from display of authentication data to registration processing in the authentication system showing the embodiment of the present invention. It is a flowchart which shows the flow of an authentication process from the display of authentication data in the authentication system which shows the Example of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Terminal computer 2 Server computer 3 Network network 4 External storage device 10 Terminal computer basic software 11 Authentication function part 12 of terminal computer User registration update function part 20 of terminal computer Server computer basic software 21 Authentication function part 22 of server computer Server Computer user registration update function unit 100 Authentication system client software 101 Authentication data terminal storage unit 102 Authentication data holding buffer 103 Authentication data acquisition unit 104 List generation unit 105 Display unit 106 Playback unit 107 Input unit 108 Passphrase generation unit 109 Authentication function Unit interface 111 user registration update unit interface 200 authentication system server software 201 authentication data server storage unit 202 authentication data communication unit 401 Individual user authentication data section

Claims (6)

Authentication system client software running on terminal computer basic software;
Authentication system server software that runs on the server computer basic software;
In the authentication system consisting of
The authentication system client software is
An authentication data terminal storage unit for storing a plurality of authentication data;
A list creation unit that reads the authentication data and creates a list;
Selecting a plurality of authentication data from the list, and converting the selected plurality of authentication data with a one-way function to create a passphrase; and
With
An authentication system that performs user registration and authentication by applying the passphrase. The passphrase creation unit
2. The authentication system according to claim 1, wherein the plurality of selected authentication data are input in a set order and converted by a one-way function.   The authentication data is further stored in an individual user authentication data section in an external storage device of the terminal computer and an authentication data server storage section in the authentication system server software. The described authentication system.   The authentication system according to claim 1, wherein the authentication data is binary data such as character string data, image data, and audio data.   The authentication system according to claim 1, wherein the one-way function includes a HASH function.   A computer system to which the authentication system according to claim 1 is applied.

Images