JP2008079060A - Device authentication system and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To set authentication conditions by every authentication terminal when one device and a plurality of authentication terminals which can perform authentication exist. <P>SOLUTION: In a device authentication system which performs radio communication between a portable terminal 106 and an authentication terminal 101 which authenticates a user of the portable terminal 106 and permits use of the portable terminal 106 only when the authentication terminal 101 is authenticated with the portable terminal, the authentication conditions by every authentication terminal 101 are provided when a plurality of users use one portable terminal 106 by changing conditions for judging that the authentication is taken, or/and a function of the portable terminal 106 whose use is permitted in the authentication according to use environment of the portable terminal 106 by an authentication condition setting means 110 provided on the portable terminal 106 by every authentication terminal 101. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a device authentication system for controlling a device and an authentication terminal for controlling the operation of the device by wireless communication, and a program thereof.

  Conventionally, this type of device authentication system acquires information from other electronic devices by information communication via a wireless transmission path, and controls setting / cancellation of authentication based on the acquired information (for example, Patent Document 1).

  FIG. 6 shows a conventional device authentication system described in Patent Document 1. In FIG.

  As shown in FIG. 6, the key code transmitter 601 carried by the user encrypts the user's key code in the encryption unit 605 and intermittently transmits the encrypted key code S1 from the transmission unit 607. Send.

  The key code receiver 608 provided in the device is decrypted by the receiving unit 615 that intermittently performs the receiving operation and receives the key code S1, and the key code stored in the key code memory 613 and the decoding unit 609. A collation unit 614 that collates the key code, and a signal S2 that enables the device when the key code can be authenticated based on the collation result, and a signal S2 that disables the device when the key code cannot be authenticated.

The initial setting of the device cannot be used, and the key code transmitter 601 and the key code receiver 608 intermittently communicate with each other at regular intervals, and the use setting of the device is changed based on the output signal S2.
Japanese Patent Laid-Open No. 10-41936

  However, in the conventional configuration, when one device is shared by a plurality of users, the key code transmitter must also be shared.

  For example, when a company's device is shared by a supervisor and a subordinate, information that can be accessed when the supervisor uses it is not desired to be accessed by the subordinate, or if the supervisor does not want the subordinate to perform a task that can be performed by the supervisor It was necessary to determine whether it was a boss or a subordinate.

  After authentication, only basic operations are permitted to be used, and when performing other operations, there is no choice but to discriminate them by a method that allows only the supervisor to access again, for example, by entering a password.

  However, the number of users increases, the types of access restrictions increase, and the use of devices becomes inconvenient.

  An object of the present invention is to solve the above-described conventional problems, and to set an authentication condition for each authentication terminal when there are a plurality of authentication terminals that can be authenticated with one device.

In order to solve the conventional problem, the device authentication system of the present invention performs wireless communication between a device and an authentication terminal that authenticates a user of the device, and only when the authentication terminal is authenticated with the device. In the device authentication system permitting the use of the device, for each authentication terminal, the condition for determining that the authentication has been obtained, and / or the authentication condition provided in the device for the function of the device that is permitted for use during the authentication The setting means changes according to the usage environment of the device.

  Thereby, when a plurality of users use one device, it is possible to set authentication conditions for each authentication terminal.

  The device authentication system of the present invention can determine the ID of an authentication terminal and set device authentication conditions accordingly.

  In a device authentication system in which the first invention allows wireless communication between a device and an authentication terminal that authenticates a user of the device and permits the use of the device only when the authentication terminal is authenticated with the device. The device authentication system includes the device and a plurality of the authentication terminals, and the device includes a condition for determining that the authentication has been obtained for each authentication terminal, and / or a function of the device permitted to be used at the time of the authentication. The authentication condition setting means is changed according to the usage environment of the device. Thereby, an authentication condition can be set for each authentication terminal.

  According to a second aspect of the present invention, in particular, in the device authentication system according to the first aspect, the device includes authentication condition holding means for each ID for storing the authentication condition, and the device and the authentication terminal authenticate with an authentication terminal ID signal. When the authentication message including the signal is transmitted and received and the device and the authentication terminal are authenticated, the device reads the authentication terminal ID from the authentication message by the authentication message reading unit, and is unique to the authentication terminal ID. The condition for determining that the authentication has been obtained and / or the function of the device permitted to be used at the time of authentication are changed by the authentication condition setting unit according to the use environment of the device.

  As a result, the authenticated authentication terminal ID can be recognized, and the authentication conditions associated with the ID can be set.

  In the third invention, particularly in the first invention, when authentication is possible between the device and the plurality of authentication terminals, a priority is assigned to each authentication terminal, and authentication is performed with one or more authentication terminals. The authentication condition of the device with the higher priority is set.

  Thereby, when there are a plurality of authentication terminals that can be authenticated with the device, it is possible to accurately select a terminal that performs authentication communication.

  According to a fourth aspect of the present invention, in the third aspect of the invention, in the case where authentication can be performed between the device and the plurality of authentication terminals, the priority order of the authentication terminals is the distance between the device and the authentication terminal, and the authentication terminal. This is determined based on the right to use the device permitted by the authentication condition.

  Thereby, the priority order of the authentication terminal is determined based on a plurality of elements, and the priority order can be distributed in a balanced manner.

  In particular, the fifth invention is a device according to the present invention in which at least a part of any one of the first to fourth inventions is programmed so that hardware resources such as an electric / information device, a computer, and a server cooperate with each other. At least a part of the authentication system can be easily realized.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the embodiments.

(Embodiment 1)
FIG. 1 shows a configuration diagram of a device authentication system and peripheral devices according to Embodiment 1 of the present invention.

  FIG. 2 is a flowchart showing the operation of the device authentication system from the start of authentication according to Embodiment 1 of the present invention.

  FIG. 3 is a diagram for explaining the authentication conditions held by the authentication condition holding means in Embodiment 1 of the present invention.

  FIG. 4 is a flowchart when a plurality of authentication terminals 101 in the first embodiment of the present invention exists within the authentication range.

  FIG. 5 is a flowchart showing the operation of the device authentication system when the authentication terminal ID is registered and when the authentication condition is changed in the first embodiment of the present invention.

  In the first embodiment, the device is described as a portable terminal, but the device is not limited to this.

  In FIG. 1, authentication terminals 101a to 101c include authentication terminal display means 102a to 102c, authentication terminal ID holding means 103a to 103c, authentication terminal notification means 104a to 104c, and authentication terminal transceivers 105a to 105c.

  The portable terminal 106 includes a portable terminal notification means 107, an ID-specific authentication condition holding means 108, a portable terminal transceiver 109, an authentication condition setting means 110, a portable terminal display means 111, and an authentication message reading means 112. .

  The authentication terminal transceiver 105 transmits an authentication message to the portable terminal transceiver 109. When the authentication message is received, the authentication message reading unit 112 reads the authentication terminal ID from the authentication message, and the authentication condition setting unit 110 receives the authentication message. Authentication conditions corresponding to the authentication terminal ID read from the ID-specific authentication condition holding means 108 are selected and set.

  When authentication is not achieved or when an illegal ID is received, notification is made from the mobile terminal notification means 107 using sound, light, vibration, or a combination thereof, or the authentication status is displayed on the mobile terminal display means 111, or Do both.

  About the apparatus authentication system comprised as mentioned above, the operation | movement and an effect | action are demonstrated below using FIGS. 1-4.

  First, the operation from the start of authentication will be described with reference to the flowchart of FIG.

  In the first embodiment, as shown in FIG. 1, a case will be described in which there are three authentication terminals from the mobile terminal 106 and the authentication terminals 101a to 101c in the authentication system. However, the number of authentication terminals is not limited to this. is not.

In S1, an authentication message is transmitted from the authentication terminal 101a to the portable terminal 106. One or more authentication terminals 101 from the authentication terminals 101a to 101c can authenticate with the mobile terminal 106, but here, it is assumed that only the user a is within the range in which the mobile terminal 106 can be authenticated.

  Authentication is permitted when communication is possible between the mobile terminal 101 and the authentication telephone 106 at a constant reception level strength, and authentication is not possible when communication is below a certain reception level or communication is impossible.

  When the authentication message is received by the portable terminal 106 in S2, the authentication message ID is read from the authentication message by the authentication message reading means 112 in S3.

  Here, the authentication message can be provided with a header portion in the data signal, and the authentication terminal ID can be described in the header portion, or the authentication terminal ID can be included in the data signal.

  When it is necessary to quickly determine the authentication terminal ID, for example, a reference value for determining that authentication is possible, for example, the reception level strength is changed for each authentication terminal 101 to distinguish a plurality of terminals. It describes.

  If the mobile terminal 106 cannot receive the authentication message in S2, the authentication operation starts from the beginning.

  After reading the authentication terminal ID from the authentication message, the authentication condition setting unit 110 compares the authentication ID with the ID used in the previous authentication operation in S4.

  If the ID is the same as the previous time in S4, the authentication condition setting is not changed in S9, and the authentication operation is started at the next authentication timing.

  If the ID is different from the previous time in S4, the authentication condition setting unit 110 selects the authentication condition associated with the ID read in S5 from the ID-specific authentication condition holding unit 108 and sets it.

  Here, the authentication condition will be described in detail.

  As the authentication condition, three examples shown in FIGS. 3A to 3C can be considered.

  The authentication condition described in FIG. 3A is the received electric field strength for determining that the authentication terminal 101 and the portable terminal 106 are authenticated.

  Level 1 is the received electric field strength required when shifting to the authentication state at the start of the authentication operation, level 2 indicates the strength when moving out of the authentication state, and level 3 is required when shifting from the non-authentication state to the authentication state Show high strength.

  For example, although the authentication condition of ID001 has a high level at the beginning of entering the authentication state, once authentication is performed, the authentication state can be maintained even with a relatively low electric field strength.

  ID003 is suitable for use in a crowded place because the level entering the authentication state and the level deviating from the authentication state are high.

  Next, FIG. 3 (b) shows conditions for limiting the operation of the mobile phone for each authentication terminal ID when the mobile terminal 106 is a mobile phone.

  The ID001 authentication terminal 101 has a relatively low call charge and e-mail charge, a relatively short call time, and the address book that can be used is limited to A, and is intended for children and young users.

  On the other hand, the authentication terminal 101 with ID003 is for the person in charge of the portable terminal 106 and can access all the address books.

  Finally, FIG. 3C shows a notification method for each authentication terminal 101.

  It is possible to set the notification sound and the color of the notification light when the authentication is not successful, whether to notify the registered telephone number, and which notification method to use.

  The notification sound and the notification light can be notified from both or only one of the portable terminal 106 and the authentication terminal 101.

  Note that the authentication condition in FIG. 3 is an example, and the present invention is not limited to this.

  Next, in S6, when a response message notifying that the setting of the authentication condition is completed is transmitted from the portable terminal transceiver 109 to the authentication terminal transceiver 105, and when the response message is received by the authentication terminal transceiver 109 in S7 In step S8, the reception completion message is transmitted to the portable terminal 106, and the authentication condition setting is ended in S8.

  If no response is received by the authentication terminal transceiver 109 in S7, the reception failure is notified from the portable terminal notification means 107 using one or more of light, sound, character string, and vibration in S11. To do.

  Here, if the portable terminal 106 has not received a reception completion message for a certain period of time after transmitting the response message, the portable terminal 106 determines that reception has failed.

  In S10, if the number of reception failures is a preset number of times n or more, authentication communication fails and the authentication operation is repeated from the beginning. If it is less than n times, a condition setting completion message is transmitted again from the portable terminal transceiver 109 in S6.

  As described above, in this embodiment, only when the mobile terminal 106 and the authentication terminal 101 that authenticates the user of the mobile terminal 106 perform wireless communication and the authentication terminal 101 is authenticated with the mobile terminal 106, the mobile terminal In the device authentication system that permits the use of the device 106, the device authentication system includes a mobile terminal 106 and a plurality of authentication terminals 101, and the authentication condition setting unit 110 sets authentication conditions for each authentication terminal 101.

  Considering the case where authentication messages are sent from a plurality of authentication terminals 101 at the same time, a priority order is set for each authentication terminal ID, and a signal indicating the priority order is put in the authentication message.

  Here, how to set the priority order will be described.

  For example, when a mother and daughter use one mobile phone, the mother can use more functions and has higher authority to use. Here, the case where the use authority is the highest is assumed to be level 1, and the level value is increased as it becomes lower.

  However, if the priority order is determined only by the usage authority, every time a user with a higher priority level falls within the authentication range, a user with a lower priority level may not be able to use it. The priority order is determined in consideration of the distance between the user and the portable terminal 106.

The distance between the authentication terminal 101 and the portable terminal 106 is determined from the reception level of the received signal. The higher the reception signal level, the closer the distance between the authentication terminal 101 and the portable terminal 106 is.

  Here, for example, a numerical value is assigned to each reception level corresponding to a distance from the mobile terminal 106 of 50 cm and 1 m away, and the closest region is defined as region 1, and the region value is increased as the distance increases.

  The priority order is the sum of the usage authority and the distance, and the smaller the total value, the higher the priority order. That is, more functions of the mobile terminal can be used (level 1), and the user who is closest to the mobile terminal 106 (area 1) is given the highest priority.

  When two or more users having the same priority are present in the authentication range, the portable terminal 106 sets in advance the items, distance or use authority to be compared when the priority is the same by the authentication condition setting unit 110.

  That is, when the distance is set, priority is given to the nearby portable terminal 101, and when the use right is set, the portable terminal 101 with higher authority is given priority.

  Here, if the priority order is the same, priority is given to the portable terminal 101 that has been authenticated earlier in time.

  If priority is given to distance over use authority, it is also possible to add a value obtained by multiplying the use authority value and the distance value several times. Similarly, it is also possible to use a method of obtaining a total value giving priority to distance.

  Here, an operation will be described with reference to a flowchart in the case where a plurality of authentication terminals 101 in FIG. 4 exist within the authentication range.

  First, it is assumed that the authentication terminal 101a is authenticated with the portable terminal 106, and the portable terminal 106 is set with the authentication condition 101a.

  First, in step S401, a new authentication terminal 101b enters a distance at which authentication with the portable terminal 106 can be obtained.

  In step S <b> 402, it is determined whether the portable terminal 106 is a terminal that can simultaneously authenticate with a plurality of authentication terminals 101. Here, simultaneous authentication refers to a state in which one mobile terminal 106 can perform authentication communication with two or more authentication terminals 101 at the same time.

  If the terminal is capable of simultaneous authentication in S402, authentication communication with 101a is continued in S403, and authentication communication with 101b is also started.

  In step S404, the priorities of the authentication terminals 101a and 101b are compared.

  If the priority order of the authentication terminal 101a is higher than the priority order of the authentication terminal 101b, the portable terminal 106 continues setting the authentication conditions of 101a in S405.

  As long as the authentication between the authentication terminal 101a and the portable terminal 106 is continued in S406, the portable terminal 106 can be used under the condition of the authentication terminal 101a under the condition of 101a.

Here, since the authentication communication between the authentication terminal 101a and the portable terminal 106 is accidentally performed and the authentication terminal 101 holder with the low priority is not abused by the authentication setting with the high priority, one of the following operations or Two or more combinations are possible.

  (1) When the authentication with a plurality of authentication terminals 101 is permitted, the priority is calculated from the distance (for example, the reception level), and only the authentication terminal 101 closest to the mobile terminal 106 can be authenticated.

  (2) A confirmation signal is periodically transmitted to a terminal for which authentication conditions are set, here, the authentication terminal 101a, and a button operation or the like is requested from the user.

  (3) Notifying that the authentication condition is set at the time of setting or periodically using any one or more of vibration, light, sound, or two or more at the authentication terminal 101a in which the authentication condition is set To do.

  Next, when the authentication terminal 101a is out of authentication in S407, the authentication condition setting unit 110 sets the authentication condition of the authentication terminal 101b in which authentication is continued in S408 to the portable terminal 106.

  As long as the authentication terminal 101a continues authentication in S407, the operation from S405 is continued.

  Next, when the priority of the authentication terminal 101a is lower than 101b in S404, the authentication condition setting unit 110 sets the authentication condition of the authentication terminal 101b in the portable terminal 106 in S409.

  As long as the authentication between the authentication terminal 101b and the mobile terminal 106 is continued in S415, the authentication terminal 101a can use the mobile terminal 106 under the authentication conditions of the authentication terminal 101b.

  When the authentication terminal 101b is out of authentication in S416, the authentication condition setting unit 110 sets the authentication condition of the authentication terminal 101a that is continuing the authentication in the mobile terminal 106 in S417.

  As long as the authentication terminal 101b continues authentication in S416, the operation from S415 is continued.

  Next, in S402, when the mobile terminal 106 is a terminal that cannot be simultaneously authenticated with several authentication terminals 101, the priority order of the authentication terminal 101a and the authentication terminal 101b is compared in S411.

  If the priority of the authentication terminal 101a is higher than that of the authentication terminal 101b, the authentication terminal 101b is not authenticated in S410, and the authentication communication operation between the authentication terminal 101a and the portable terminal 106 is continued.

  If the priority of the authentication terminal 101b is higher in S411, 101a stops the authentication operation in S412. At this time, it is also possible to display "Authentication operation is canceled" on the authentication terminal display means 101a.

  Next, authentication between the portable terminal 106 and the authentication terminal 101b is performed in S413, and authentication is established in S414, or the authentication condition of the portable terminal 106 is changed to a condition suitable for the authentication terminal 101b after a specified time. Change at 110.

  At this time, the timing for changing the authentication condition can be stored in the authentication condition setting means 110 in advance, or the change timing of each ID can be held in the ID-specific authentication condition holding means 108.

  Until authentication is possible, it is also possible to display “Please wait for a while, being authenticated” on the authentication terminal display means 102a.

  Here, for the authentication terminal 101 for which the authentication condition is set, blinking or lighting of light, the authentication terminal display means 102 performs character display such as “authentication condition is being set”, and the mobile terminal 106 has mobile terminal display means. It is also possible to display the ID of the authentication terminal 101 at 111.

  Next, an operation for registering the authentication terminal ID and an operation for updating the authentication condition will be described with reference to FIGS.

  First, in FIG. 5A, when the portable terminal 106 that has received the authentication message reads the authentication terminal ID by the authentication message reading unit 112, if the read ID does not exist in the ID-specific authentication condition holding unit 108, An ID registration request message is transmitted from the portable terminal transceiver 109 to the authentication terminal transceiver 105.

  The authentication terminal 101 that has received the ID registration request message transmits the authentication terminal ID and authentication conditions held in the authentication terminal ID holding means 103 to the portable terminal 106 as an ID registration message, and the portable terminal 106 receives the authentication condition setting means. At 110, an authentication condition is added to the ID-specific authentication condition holding means 108.

  Next, in FIG. 5B, when the authentication condition is updated on the authentication terminal 101, an update condition signal is added to the authentication message transmitted from the authentication terminal 101 to the portable terminal 106.

  By providing the authentication terminal 101 with an input unit, the authentication condition can be updated from the authentication terminal 101.

  The portable terminal 106 transmits an update condition request message to the authentication terminal 101 from the portable terminal transceiver 109 when the authentication message reading unit 112 reads the update condition signal.

  When the update condition request message is received by the authentication terminal transceiver 105, the authentication terminal ID held in the authentication terminal ID holding means 103 and the updated authentication condition are transmitted to the portable terminal 106 as an ID registration message, The terminal 106 updates the authentication condition of the ID-specific authentication condition holding unit 108 by the authentication condition setting unit 110.

  It is also possible to connect the mobile terminal 106 directly to an electronic device such as a personal computer and update the authentication conditions. In this case, an update condition message is transmitted from the portable terminal 106 to the authentication terminal 101 when the authentication condition is updated.

  Note that the means described in this embodiment causes hardware resources such as a CPU (or microcomputer), a RAM, a ROM, a storage / recording device, an electrical / information device including an I / O, a computer, a server, and the like to cooperate. You may implement with the form of a program. In the form of a program, new functions can be easily distributed / updated and installed by recording them on a recording medium such as magnetic media or optical media or distributing them via a communication line such as the Internet.

As described above, the present invention can be changed to user-specific settings, and thus can be applied to applications such as entrance / exit management and computer user settings in addition to portable terminals.

Configuration diagram of device authentication system and peripheral device according to Embodiment 1 of the present invention The flowchart which shows operation | movement of the apparatus authentication system from the time of the authentication start in Embodiment 1 of this invention. The figure explaining the authentication conditions which the authentication condition holding means in Embodiment 1 of this invention hold | maintains The flowchart in case the some authentication terminal 101 in Embodiment 1 of this invention exists in an authentication range. The flowchart which shows operation | movement of the apparatus authentication system at the time of authentication terminal ID registration in Embodiment 1 of this invention and an authentication condition change Configuration diagram of a conventional device authentication system

Explanation of symbols

101 Authentication terminal 106 Mobile terminal (device)
108 ID-specific authentication condition holding means 110 Authentication condition setting means 112 Authentication message reading means

Claims (5)

In a device authentication system that performs wireless communication between a device and a plurality of authentication terminals that authenticate a user of the device, and permits the use of the device only when the authentication terminal is authenticated with the device,
For each authentication terminal, the condition for determining that the authentication has been obtained and / or the function of the device permitted to be used at the time of authentication is changed according to the use environment of the device by the authentication condition setting means provided in the device. Device authentication system. The device includes ID-specific authentication condition holding means for storing the authentication condition,
When the device and the authentication terminal send and receive an authentication message including an authentication terminal ID signal and an authentication signal, and the device and the authentication terminal are authenticated,
The device reads the authentication terminal ID from the authentication message by an authentication message reading means, and determines the condition specific to the authentication terminal ID and / or the function of the device that is permitted to be used at the time of authentication. The device authentication system according to claim 1, wherein the authentication condition setting unit changes the device according to a use environment of the device. In the case where authentication can be taken with the device and the plurality of authentication terminals,
2. The device authentication system according to claim 1, wherein a priority is assigned to each of the authentication terminals, authentication is performed with one or more of the authentication terminals, and authentication conditions for the device with the higher priority are set. In the case where authentication can be taken with the device and the plurality of authentication terminals,
The device authentication system according to claim 3, wherein the priority order of the authentication terminals is determined based on a distance between the device and the authentication terminal and the authentication condition. The program for making a computer perform at least one part of the apparatus authentication system of any one of Claims 1-4.

Images