JP2008234560A - Authentication apparatus and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a compact authentication apparatus being easily handled and capable of reducing cost to prevent electronic equipment from being illicitly utilized due to theft or loss and to provide an authentication method. <P>SOLUTION: This authentication apparatus 1 is provided with a storage means 11 for storing the set and specified position information, a GPS receiving means 12 for receiving GPS information, and a checking means 13 for checking the information related to current position obtained from the GPS information received by the GPS receiving means 12 against the specified position information stored in the storage means 11 and outputting a check agreement signal when the information related to the current position agrees with the specified position information as a result of check. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication device and an authentication method for accepting or rejecting use of an electronic device.

  As a security measure against theft or loss of various electronic devices such as computers and personal digital assistants, the user is prompted to input the specified identification information when the electronic device is turned on, restored, or accessed. There is an authentication method for judging whether or not to permit use of the electronic device by comparing the information with identification information registered in advance in the electronic device (see, for example, Patent Document 1).

  For example, there is a method of performing authentication based on an input of a password using a character string such as a BIOS password or a hard disk password (see, for example, Patent Document 2).

  Also, for example, there is biometric authentication (biometric authentication) in which authentication is performed using information such as human biological organs and behavior patterns (see, for example, Patent Document 3). Examples of biometric information used for biometric authentication include a fingerprint, palm, retina, iris, or face shape.

  In addition, for example, an external authentication key such as a USB authentication key or an IC card in which identification information is stored in an internal memory is prepared separately from an electronic device to be authenticated, and the external authentication key is set to a predetermined value of the electronic device. There is a method of performing authentication by connecting to a connector (for example, see Patent Document 4).

  Further, for example, there is a method of accessing the authentication server via the network and receiving authentication as in the case of a wireless LAN or the Internet (see, for example, Patent Document 5).

  FIG. 6 is a flowchart illustrating an operation flow of authentication processing according to a conventional example. Here, a case where an authentication process is taken in when the computer is powered on will be described as an example. When the power source is activated in step S301, input of authentication information is requested in step S302. Specific examples of the authentication information are as described above. When authentication information is input in step S303, in step S304, the input authentication information is checked against previously registered authentication information. As a result of the collation, when it is determined that the input authentication information matches the authentication information registered in advance, the operating system (OS) of the computer is started in step S306. Even if the authentication process is taken in when returning from the sleep mode, the same process as described above is executed.

JP 2003-122444 A JP-A-11-184756 JP 2003-58509 A JP 2006-152679 A JP 2004-343448 A

  The method of performing authentication using a password may be decrypted or obtained by a third party. In addition, it is troublesome to enter a password every time authentication is performed. Also, there is a high possibility that the person forgets the password. For example, if you set a hard disk password and forget it, it is almost difficult for you to recover the hard disk yourself.

  Since the biometric authentication method requires advanced technology for the biometric information reading sensor and the authentication device, the introduction cost tends to be high, and the authentication device main body is also large. In addition, it is troublesome because a living organ as authentication information must be placed over the authentication device every time authentication is performed. In addition, biometric authentication may be impossible due to injury or illness. Further, since human biological information is used, there is a possibility that the biological information changes due to aging and authentication cannot be performed. In addition, there is biometric information that is easily copied such as a fingerprint. Since biometric information cannot be restored for a lifetime once it has been replicated, it must be carefully managed. In addition, since only the person himself / herself has the biometric information necessary for the authentication, the biometric information registration work is complicated when introducing the biometric authentication system in an environment where there are a large number of computers such as companies and schools. It becomes.

  The method of performing authentication using an external authentication key that is separate from the electronic device to be authenticated has a risk that the external authentication key may be lost or stolen. In addition, an external authentication key must be connected to the electronic device every time authentication is performed, which is troublesome.

  The method of accessing the authentication server via the network and receiving authentication does not function unless an environment for connecting to the authentication server and the network can be secured, and the construction of a new connection environment requires a great deal of labor and cost. Is.

  Accordingly, in view of the above problems, an object of the present invention is to provide an authentication device and an authentication method that are easy to handle, small, and low in cost so that an electronic device is not illegally used due to theft or loss. It is in.

  In order to achieve the above object, in the present invention, the authentication device obtains from the storage means for storing the set designated position information, the GPS receiving means for receiving GPS information, and the GPS information received by the GPS receiving means. Collating means for collating the information on the current position and the designated position information stored in the storage means, and outputting a collation match signal when the information on the current position and the designated position information match as a result of the collation, . The collation means outputs a collation mismatch signal when the information on the current position does not match the designated position information as a result of the collation.

  In the designated position information, an installation position where use of the electronic device is permitted is defined. For the designated position information, an expiration date for which the designated position information is effective may be set. In this case, when the expiration date of the designated position information expires, the designated position information is deleted.

  Further, the authentication device according to the present invention stores the further designated position information in the storage means only when the information on the current position matches the designated position information as a result of the collation based on the designated position information stored in the storage means. Setting means for permitting the above may be further provided.

  An authentication method for accepting or rejecting the use of an electronic device according to the present invention includes a storing step for storing designated position information that defines an installation position where use of the electronic device is permitted in a storage unit, and a GPS receiving unit receiving the GPS information. In the GPS reception step, the collation step in which the control means collates the information on the current position of the electronic device obtained from the GPS information received in the GPS reception step, and the specified position information stored in the storage means, and in the collation step As a result of the collation, if the information on the current position matches the specified position information, the control unit permits the use of the electronic device, and if not, the control unit prohibits the use of the electronic device. And comprising.

  According to the present invention, since the electronic device can be used only when the current position of the electronic device matches the position set in advance by the designated position information, the electronic device is stolen or lost. In addition, it is possible to prevent unauthorized use of the electronic device in an unintended place other than the position set in advance by the designated position information. If multiple specified location information is set, while the electronic device having the authentication device is moving, the electronic device can be used as long as it is within the range of the specified location information, and if it is outside the range, the electronic device should be used. Security can be improved.

  In the present invention, since the position information is used for authentication, even if the set designated position information is leaked, the information only includes information related to the position in the first place. The user receives less damage.

  In addition, according to the present invention, information on the current position of the electronic device is acquired by the GPS receiving means and collated with the set designated position information. The authentication key is not required to be connected and is easy to handle. Since it is easy to set the designated position information, it is easy to introduce an authentication system in an environment where there are a large number of computers such as companies and schools. Further, there is no danger such as forgetting or leaking in the case of a conventional password or loss in the case of an external authentication key.

  Further, since the GPS receiver used in the present invention is small and inexpensive, a small and low-cost authentication device can be realized. Therefore, it is easy to incorporate the authentication apparatus according to the present invention into an electronic device.

  In addition, according to the present invention, network connection as in the case of a conventional authentication server is not necessary, and it is not necessary to construct a new connection environment when introducing an authentication system, thus reducing the introduction cost. Is possible.

  Further, for example, when authentication is performed using a password in combination with authentication according to the present invention, the electronic device is preset with designated position information by executing the authentication process according to the present invention before the authentication process using the password. If the device is in a location other than the specified location, use of electronic devices is prohibited, so password authentication is not required (for example, password entry is not required) and passwords can be leaked. The nature is also lowered.

  In the present invention, if an expiration date that is effective for the designated location information is set, the designated location information is deleted when the expiration date of the designated location information expires, further improving security. For example, it can be said that there is a security problem if the designated position information that is no longer used is abandoned for a long period of time, but in such a case, it is particularly important to set an expiration date for the designated position information as in the present invention. It is effective. As described above, according to the present invention, even if an electronic device is stolen or lost, it is possible to prevent unauthorized use of the electronic device in an unintended place other than the position set in advance by the designated position information. If an electronic device that is stolen or lost is accidentally present at the position set by the designated position information, it is illegally used. As a countermeasure in such a case, if an expiration date is set for the designated location information, the designated location information is deleted when the expiration date expires, which further improves security.

  Further, in the present invention, only when the information on the current position of the electronic device matches the designated position information, the use of the electronic device is permitted if the storage of the further designated position information in the storage means is permitted. The possibility that the designated position information that defines the installation position is falsified is reduced, and an unintended expansion of the use area of the electronic device can be prevented.

  FIG. 1 is a principle block diagram of an authentication apparatus according to an embodiment of the present invention. Hereinafter, components having the same reference numerals in different drawings mean components having the same functions.

  The authentication device 1 includes a storage unit 11, a GPS reception unit 12, and a verification unit 13. Further, the authentication device 1 includes a permission / refusal unit 14 and a setting unit 15. The verification unit 13, the acceptance / rejection unit 14, and the setting unit 15 are realized in the control unit 10 in the authentication device 1.

  When the authentication device 1 is constructed in a form incorporated in an electronic device in which authentication processing is desired, the control means 10 may be realized in a CPU provided in the electronic device in which the authentication device 1 is incorporated. . The storage unit 11 may be realized by a hard disk connected to or built in the electronic device or an internal memory in the electronic device. For the GPS receiving means 12, for example, a commercially available GPS unit may be incorporated in the electronic device.

  On the other hand, when the authentication device 1 itself is constructed as a single unit so that it can be externally attached to an existing electronic device (that is, “retrofitting”), the control means 10 may be realized in a CPU provided in the authentication device 1. The storage unit 11 may be realized by an internal memory in the authentication device 1. As for the GPS receiving means 12, for example, a commercially available GPS unit may be incorporated in one authentication device.

  The GPS receiving means 12 in FIG. 1 receives GPS information. A GPS (Global Positioning System) is a positioning system that receives GPS information transmitted from an artificial satellite orbiting the earth by a GPS device and obtains position information. The GPS receiving unit 12 acquires information related to the current position of the authentication device 1. Since the authentication device 1 is built in or connected to the electronic device as described above, it can be said that the current position of the authentication device 1 is also the current position of the electronic device.

  The storage unit 11 stores the set designated position information. In the designated position information, an installation position where use of the electronic device is permitted is defined by a pinpoint or an area having a predetermined size. In other words, the electronic device can be used only when the current position of the electronic device matches or falls within the range defined by the designated position information. The storage unit 11 stores one or a plurality of designated position information. A method of setting designated position information, that is, a registration method will be described later.

  The designated position information is represented by a function of latitude and longitude, for example. As a specific example of the setting of the installation position where the use of the electronic device defined by the specified position information is permitted, “pinpoint setting” for setting the installation position where the use of the electronic device is permitted at one latitude and longitude “Circular area setting” for setting the installation position where the use of the electronic device is permitted with the latitude and longitude of one point and the radius of the circle centered on the latitude and longitude, and the electronic device with the latitude and longitude of 2 to 4 points There are “rectangular area setting” for setting the installation position where the use of the electronic device is permitted, “arbitrary shape area setting” for setting the installation position where the use of the electronic device is permitted with a plurality of latitudes and longitudes.

  In addition to the information regarding the planar area as described above, the altitude may be further included in the function in the designated position information. For example, in a high-rise building, even if only one point of latitude and longitude is specified, that point also indicates the position on another floor (the number of floors of the building). If the floor is different, it can be considered that it is a completely different residence, a different department, or a different company, so it is preferable to be able to set the altitude with the specified location information in preparation for such a case. .

  The designated position information is represented by a function of latitude and longitude, but the information regarding the latitude and longitude may be set by manual input by the user himself or using the GPS receiving means 12 in the authentication device 1. For example, in the case of manual input by the user himself / herself, map information recorded on a recording medium such as a map information server, a CD-ROM, or a DVD may be retrieved and obtained via the Internet. Alternatively, an interface may be provided so that a specific address can be designated or designated by a landmark name such as a station, commercial facility, public facility, or mountain name. The altitude may be measured using a known altimeter. Further, in the case of the GPS receiving means 12 in the authentication apparatus 1, the authentication apparatus 1 is actually installed at a position to be registered as an installation position where the use of the electronic device is permitted, the GPS receiving means 12 is operated, and the received GPS Information on latitude and longitude may be obtained from the information.

  In this way, depending on how the specified location information is set, the range of installation locations where electronic devices are allowed to be used is the same table, department, floor (number of floors of the building), company, district, altitude, municipality, region, It can be set to any size, such as country, economic zone, continent, northern hemisphere, southern hemisphere. Although details will be described later, an expiration date for which the designated position information is effective may be defined in the designated position information.

  The collation means 13 collates the information on the current position obtained from the GPS information received by the GPS reception means 12 and the designated position information stored in the storage means 11, and as a result of the collation, information on the current position and the designated position. When the information matches, a verification match signal (True) is output, and when the information does not match, a verification mismatch signal (False) is output.

  The acceptance / rejection unit 14 permits the use of the electronic device only when the collation unit 13 outputs a collation coincidence signal (True), and when the collation unit 13 outputs the collation mismatch signal (False), the use of the electronic device is permitted. Is prohibited. The instruction regarding permission and prohibition is transmitted to a control unit (not shown) of the electronic device. In the illustrated example, the acceptance / rejection means 14 is realized as one component of the control means 10 in the authentication device 1. However, as an alternative example, a verification match signal (True) / verification mismatch signal output by the verification means 13. (False) may be directly transmitted to the control unit of the electronic device, and permission / prohibition of use of the electronic device may be determined in processing of the control unit of the electronic device.

  The setting means 15 permits further storage of the designated position information in the storage means 11 only when the matching means 13 outputs a matching match signal based on the designated position information stored in the storage means 11. Thereby, a plurality of designated position information can be stored in the storage unit 11. Details of the storage of further designated position information by the setting means 15 will be described later.

  FIG. 2 is a flowchart showing an operation flow of authentication processing according to the embodiment of the present invention. In step S101 in FIG. 2, the GPS receiving unit 12 in FIG. 1 acquires information regarding the current position of the authentication device 1. Since the authentication device 1 is built in or connected to the electronic device, the current position of the authentication device 1 is also the current position of the electronic device.

  Next, a matching process is executed using the acquired information on the current position. In step S102 of the verification process, the verification unit 13 in the control unit 10 obtains information on the current position of the electronic device obtained from the GPS information received in step S101 and the specified position information stored in the storage unit 11. Collation is performed to determine whether the information on the current position matches the specified position information. When a plurality of designated position information is stored in the storage unit 11, information on the current position is checked against the plurality of designated position information.

  As a result of the collation in step S102, when the information on the current position matches the designated position information, the collation means 13 in the control means 10 outputs a collation coincidence signal (True) in step S103. On the other hand, as a result of the collation in step S102, if the information on the current position does not match the designated position information, the collation means 13 in the control means 10 outputs a collation mismatch signal (False) in step S104. In the case where a plurality of designated position information is stored in the storage means 11, the collating means 13 sends a collation coincidence signal if the information on the current position matches any one of the plurality of designated position information. (True) is output, and if it does not match any of the plurality of designated position information, the verification means 13 outputs a verification mismatch signal (True). Therefore, by setting a plurality of designated position information, while the electronic device having the authentication device 1 is moving, the electronic device can be used within the range of the set designated position information. A recognition system that cannot be used can be constructed.

  FIG. 3 is a flowchart showing an operation flow of registration processing of designated position information in the authentication apparatus according to the embodiment of the present invention. When the user wants to set, that is, register, the designated position information that defines the installation position where the use of the electronic device is permitted, the authentication apparatus 1 is instructed to start the designated position information registration process. The instruction operation is generally used to start processing such as key operation or mouse operation of a keyboard connected to an electronic device, or pressing of a registration start button provided exclusively for the authentication device 1. What is necessary is just to implement | achieve by instruction | indication operation.

  When the registration process of designated position information in the authentication apparatus is started, first, in step S201, the setting means 15 in the control means 10 of the authentication apparatus 1 has already registered the specified position information in the storage means 11 in FIG. Determine whether or not. If it is determined that the designated position information is not yet registered in the storage unit 11, the process proceeds to step S202.

  In step S202, the setting unit 15 in the control unit 10 determines whether or not to register the specified position information. Note that the process of step S202 is a process of reconfirming to the user whether or not he / she really wants to register the specified position information, and even if this process is omitted in the embodiment of the present invention. Good.

  In step S203, designated position information to be registered is input. As described above, the specified position information is expressed by functions of latitude and longitude, and preferably altitude. These functions are input manually by the user himself or using the GPS receiving means 11 in the authentication device 1. To set.

  In step S <b> 204, the setting unit 15 in the control unit 10 stores the input designated position information in the storage unit 11.

  On the other hand, if it is determined in step S201 that the designated position information has already been registered in the storage unit 11, the process proceeds to step S100. In step S100, the authentication process according to the embodiment of the present invention described with reference to FIG. 2 is executed. That is, the information on the current position acquired in step S101 in FIG. 2 and the designated position information stored in the storage unit 11 are collated, and as a result of the collation, the information on the current position matches the designated position information. In this case, a collation coincidence signal (True) is output in step S103 in FIG. 2, and in a case where there is no coincidence, a collation mismatch signal (False) is output in step S104 in FIG. In the case where a plurality of designated position information is stored in the storage unit 11, if the information on the current position matches any one of the plurality of designated position information, a matching match signal (True) is generated. If it does not match any of the plurality of designated position information, a verification mismatch signal (True) is output. In step S100, if a collation match signal (True) is output, step S202 is executed, and steps S203 and S204 are executed with the above-described contents.

  That is, when it is determined in step S201 that the designated position information has already been registered in the storage unit 11, the setting unit 15 performs the processing of steps S100, S202, S203, and S204, so that the setting unit 15 Only when the collating unit 13 outputs a collation coincidence signal based on the designated position information stored in, the storage of the further designated position information in the storage unit 11 is permitted. Thereby, a plurality of designated position information can be stored in the storage unit 11. Thus, in the embodiment of the present invention, only when the information related to the current position of the electronic device and the specified position information match, the storage of the further specified position information in the storage means is permitted. The possibility that the designated position information that defines the installation position permitted to be used is falsified is reduced, and the unintended use area of the electronic device can be prevented from being expanded.

  FIG. 4 is a block diagram showing the principle of an authentication apparatus according to a modification of the embodiment of the present invention. In the present modification, in the above-described embodiment, an expiration date in which the designated position information is effective is defined in the designated position information. As shown in FIG. It further includes an erasing unit 16 that erases the designated position information from the storage unit 11 when the expiration date has expired. Since the other constituent elements are the same as those shown in FIG. 1, the same constituent elements are denoted by the same reference numerals, and detailed description thereof is omitted.

  The erasing unit 16 is realized in the control unit 10 in the authentication device 1. The erasing unit 16 operates based on, for example, a timer provided in the control unit 10 or time information from the electronic device main body. If an effective expiration date is set for the designated position information as in this modification, the designated position information is erased by the erasing means 16 when the designated position information expires, further improving security. This expiration date may be renewable. In this case, the setting unit 15 executes the process.

  As a further modification of the embodiment of the present invention, when the GPS receiving unit 12 in FIG. 1 sequentially acquires information related to the current position of the authentication device 1, the acquired information related to the current position no longer matches the specified position information. In addition, a warning may be issued or the power supply of the electronic device may be shut off. Specific examples of such warnings include alarms, buzzers, vibrations, light emission, and blinking.

  FIG. 5 is a flowchart showing an operation flow of an application example in which the authentication processing according to the embodiment of the present invention and the authentication processing according to the prior art are combined. Here, a description will be given of a case where the authentication process according to the embodiment of the present invention is executed before the authentication process according to the prior art when the authentication process is taken in when the computer is turned on.

  When the power supply is activated in step S301, the process proceeds to step S100. In step S100, the authentication process according to the embodiment of the present invention described with reference to FIG. 2 is executed. That is, the information on the current position of the computer acquired in step S101 in FIG. 2 and the designated position information stored in the storage unit 11 are collated. As a result of the collation, the information on the current position and the designated position information are If they match, a matching match signal (True) is output in step S103 of FIG. 2, and if they do not match, a matching mismatch signal (False) is output in step S104 of FIG. In the case where a plurality of designated position information is stored in the storage unit 11, if the information on the current position matches any one of the plurality of designated position information, a matching match signal (True) is generated. If it does not match any of the plurality of designated position information, a verification mismatch signal (False) is output.

  If the collation match signal (True) is output in step S100, the process proceeds to step S302. In step S302, input of authentication information such as a password and biometric information is requested. Specific examples of the authentication information are as described above. When authentication information is input in step S303, in step S304, the input authentication information is checked against previously registered authentication information. As a result of the collation, when it is determined that the input authentication information matches the authentication information registered in advance, the operating system (OS) of the computer is started in step S306.

  If a verification mismatch signal (False) is output in step S100, the computer provided with the authentication device 1 is located at a location other than the location set in advance in the specified location information for some reason such as theft or loss. Therefore, in order to prevent unauthorized use by a third party, it is impossible to start the operating system (OS) of the computer (step S305).

  By executing the authentication process according to the embodiment of the present invention before the authentication process according to the prior art, even if the computer is to be executed at the position set in advance by the designated position information, the authentication information input in the authentication process according to the prior art is input. Therefore, the possibility that the authentication information is leaked in the authentication processing according to the conventional technique is reduced.

  The present invention can be applied to an authentication device and an authentication method for preventing various electronic devices such as computers and portable information terminals from being used illegally.

  According to the present invention, since the electronic device can be used only when the current position of the electronic device matches the position set in advance by the designated position information, the electronic device is stolen or lost. In addition, it is possible to prevent unauthorized use of the electronic device in an unintended place other than the position set in advance by the designated position information.

It is a principle block diagram of the authentication apparatus by the Example of this invention. It is a flowchart which shows the operation | movement flow of the authentication process by the Example of this invention. It is a flowchart which shows the operation | movement flow of the registration process of the designated position information in the authentication apparatus by the Example of this invention. It is a principle block diagram of the authentication apparatus by the modification of the Example of this invention. It is a flowchart which shows the operation | movement flow of the application example which combined the authentication process by the Example of this invention, and the authentication process by a prior art. It is a flowchart which illustrates the operation | movement flow of the authentication process by a prior art example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Authentication apparatus 10 Control means 11 Storage means 12 GPS receiving means 13 Verification means 14 Acceptance / rejection means 15 Setting means

Claims (13)

Storage means for storing the set designated position information;
GPS receiving means for receiving GPS information;
Collation that collates information on the current position obtained from the GPS information and the designated position information, and outputs a collation match signal when the information on the current position matches the designated position information as a result of the collation Means,
An authentication device comprising:   2. The apparatus according to claim 1, further comprising a setting unit that permits storage of further specified position information in the storage unit only when the verification unit outputs a verification match signal based on the specified position information stored in the storage unit. The authentication device described.   The authentication device according to claim 1, wherein, as a result of the collation, the collation unit outputs a collation mismatch signal when the information on the current position does not match the designated position information.   The authentication apparatus according to claim 1, wherein the storage unit stores a plurality of pieces of the designated position information.   The authentication apparatus according to claim 1, wherein the designated position information defines an installation position where use of an electronic device is permitted.   The authentication apparatus according to claim 5, further comprising: a permission / refusal unit that permits use of the electronic device only when the verification unit outputs a verification match signal.   The authentication apparatus according to claim 1, wherein an expiration date for which the designated position information is effective is defined in the designated position information.   The authentication apparatus according to claim 7, further comprising an erasing unit that erases the designated position information from the storage unit when the expiration date of the designated position information expires. An authentication method for accepting or rejecting use of an electronic device,
A storage step of storing in the storage means specified position information that defines an installation position where use of the electronic device is permitted;
A GPS receiving step in which the GPS receiving means receives GPS information;
A collation step in which the control means collates the information on the current position of the electronic device obtained from the GPS information received in the GPS reception step and the designated position information stored in the storage means;
As a result of the collation in the collation step, if the information on the current position and the designated position information match, the control unit permits the use of the electronic device, and if not, the control unit uses the electronic device. Prohibited or rejected steps;
An authentication method comprising:   A setting step for permitting storage of further specified position information in the storage means only when the information on the current position matches the specified position information as a result of collation based on the specified position information stored in the storage means. The authentication method according to claim 9, further comprising:   The authentication method according to claim 9 or 10, wherein the storage means stores a plurality of the designated position information.   The authentication method according to claim 9 or 10, wherein an expiration date for which the designated position information is effective is defined in the designated position information.   The authentication method according to claim 12, further comprising: an erasing step in which the control unit erases the designated position information from the storage unit when the expiration date of the designated position information expires.

Images