JP2008269511A - User authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a user authentication method, for authenticating a user when satisfying fixed conditions even when the user can not use a portion of a means for personal authentication. <P>SOLUTION: A user can be authenticated by confirming past successful authentication results by a prescribed method, for a certain fixed period after the user succeeds in personal authentication. The user has a hardware token such as an IC card, a cellular phone, or the like, and the hardware token has a function and information for personal authentication. When the user succeeds in the personal authentication, the successful authentication result is recorded in the hardware token. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technique for authenticating a user by a plurality of authentication methods (methods, (authentication) elements), and some of a plurality of authentication methods under a certain condition due to the terminal device for authentication. The present invention relates to an authentication technique when only the authentication method can be realized. In particular, the present invention relates to a user authentication technique for authenticating a user by using a storage medium including an IC card and the user's biometric information. The biological information includes (palm, finger) vein information, fingerprint information, iris information, and the like.

  At present, there are a plurality of elements (authentication means) as a technique for personal authentication. There are the following three elements as typical ones. The first element is based on the person's memory, and identity authentication using an ID and password is a typical example. The second factor is based on the person's possession, such as an IC card or driver's license. The third factor is based on the person's biometric information, such as fingerprint authentication and finger vein authentication. Identity authentication may be performed by any one of these three elements or a combination of multiple elements.

  As a technique using a plurality of authentication methods, there is Patent Document 1. In Patent Document 1, one authentication or a combination of authentications that satisfies the target performance required for authentication is selected. For this reason, Patent Document 1 discloses performing selection in consideration of the type of authentication means, the priority of the types of authentication means, the combination method, and the like.

  Further, as an authentication method of each authentication means, authentication is performed using biometric information, PIN, etc. via an IC card or the like. Examples of this include Patent Documents 2 and 3.

  Patent Document 2 aims to provide a service for notifying a user who is to be authenticated of authentication information on the assumption that user authentication using biometric information cannot be 100% reliably authenticated. In order to achieve this purpose, in Patent Document 2, authentication is performed using biometric information, and a user ID is obtained from authentication log information including authentication results obtained by performing authentication using biometric information and biometric information used for authentication. The user information is searched using and the authentication log information is notified to the corresponding user. This aims to enable the authentication log information to be reliably notified to the person to be authenticated.

  In Patent Document 3, the authentication information of each application mounted on the IC card, which is provided to the user's service, is shared with the personal authentication information in the IC card, making it easy to create each application, and The purpose is to prevent leakage. To achieve this goal, the authentication status is managed by comparing the PIN and fingerprint authentication information for each application installed on the IC card with the card's common PIN and fingerprint authentication information. A common authentication module is installed on the IC card. When using a certain application on the terminal side, the personal authentication common module compares the personal authentication information of the application on the terminal side with the personal authentication information common to the card to perform personal authentication.

JP 2003-67340 A Japanese Patent Laid-Open No. 2002-140306 Japanese Patent Laid-Open No. 2002-298097

However, there is a problem in the method of performing user authentication by combining a plurality of authentication factors that the user authentication is performed at a lower authentication level when the user has no means for performing user authentication. It was.
For example, in personal authentication using biometric authentication in a financial institution, biometric information is registered in advance in an IC card, the biometric information is input to a biometric information reading unit provided in the ATM, and stored in the IC card. A method of verifying the identity by comparing with biometric information has become the mainstream. However, in personal authentication using biometric authentication, biometric information is read into a personal computer used by general users due to circumstances such as different authentication methods (finger vein authentication, palm vein authentication, etc.) adopted for each financial institution. At present, it is difficult to provide a device. In this case, even if the user owns an IC card with a biometric authentication function, biometric authentication cannot be performed in network transactions such as Internet banking, and identity authentication is performed by means such as ID / password. ing.

  Here, in Patent Document 1, a combination of authentication means is selected, but recovery by an authentication means that has not been selected is not taken into consideration. In other words, in the case of Patent Document 1, it is possible to intentionally avoid an effective authentication means such that a malicious third party has higher accuracy. For example, in the case of a service that provides ID / password authentication and biometric authentication, a third party steals the ID / password and only requires a terminal that does not require only an ID / password (eg, does not have biometric information input means) When conducting a transaction, etc., the transaction is permitted to a malicious third party. In order to avoid this, the fact that authentication by all authentication means (ID / password use authentication and biometric authentication) is always required restricts the terminals that can be used. You will lose.

  In the present invention, in view of these circumstances, even when a part of a plurality of authentication means cannot be used (or not used), it is possible to provide more secure authentication without impairing user convenience. With the goal.

  The present invention is characterized in that user authentication can be performed by confirming past authentication success results by a predetermined method for a certain period after the user succeeds in user authentication.

  As an aspect for realizing the present invention, the user has a hardware token such as an IC card or a mobile phone, and the hardware token has a function and information for realizing personal authentication. When the user succeeds in the personal authentication, the authentication success record is recorded in the hardware token. For successful authentication results, personal information, user attribute information, user ID, authentication ID, authentication location, authentication input information, authentication input means, time information, and calculation that adds a certain amount of time to the time information It consists of at least one data expiration date calculated by performing. The authentication success record may be stored in a storage device other than the hardware token, such as an authentication server.

  When the user requests a service that requires personal authentication in an environment where the means for performing authentication cannot be used, the user terminal confirms the authentication success record by a predetermined method, and checks the validity of the information. Is confirmed, the user is determined as the principal.

  Here, the predetermined method is a method of confirming the validity of the authentication success record stored in the hardware token owned by the user, the authentication success record stored in a storage device other than the hardware token. A method for confirming the validity and a method for confirming the validity of the authentication success record by the combination thereof are included. Further, as a method for confirming the validity, whether the user terminal obtains the current time and the current time is within the range of the data expiration date stored in the hardware token or a storage device other than the hardware token. Or the authentication success record is stored in each of the hardware token and the storage device other than the hardware token, and the authentication success record of both is collated. It includes determining whether the data is within the validity period of data stored in a storage device other than the token or the hardware token.

  The data expiration date can be calculated by adding a predetermined time to the time information acquired by the authentication terminal, changing the time added by the user's attribute information, or adding by the user himself / herself. A method that can arbitrarily determine the time is also included. In addition, changing the level of service that can be requested by the user according to the length of the set expiration date (including limiting the transaction amount and limiting the information that can be browsed) is also included.

  In addition, when a user requests a service that requires personal authentication, the storage information such as a password set in advance by the user is input, and it is determined whether the storage information is correct, In the present invention, when the user inputs illegal storage information a certain number of times, the user authentication is disabled even if the current time acquired by the user terminal is before the data expiration date. included.

  Moreover, the following aspects are also included in the present invention. The authentication process is performed using the result of biometric information authentication in an arbitrary terminal device or the like. That is, when authenticated by biometric information authentication, authentication is performed under certain conditions (including temporal conditions) without performing biometric information authentication. The certain condition includes whether or not biometric information can be input. In the terminal device to be used for authentication, the biometric information can be input even if it is not input. Even if it is authenticated by biometric authentication.

  More specifically, the following aspects are also included in the present invention.

  In the user authentication method using an IC card, the user's biometric information is stored in the IC card in advance, the first terminal device used by the user and having biometric information input means is the user. Receiving the biometric information and the user identification information for identifying the user, the first terminal device detects the time when the input biometric information is received, and the first terminal device is The biometric information input and the detected time are transmitted to the IC card, and the IC card verifies the transmitted biometric information and the stored biometric information, thereby authenticating the user. The IC card transmits the authentication result to the first terminal device, and the first terminal device is detected when the verification result is authenticated as a valid user. And the user identification information, The authentication server device stores the user identification information and time in association with each other, receives a predetermined service request from the user, and transmits the authentication server device and the network. A second terminal device connected via the user accepts user identification information and a service request from the user, and the second terminal device accepts an authentication request including the accepted user identification information, Transmitted to the authentication server device, the authentication server device identifies the time corresponding to the transmitted user identification information, performs authentication based on the time, and results of the authentication to the second terminal device It is a user authentication method characterized by notifying.

  In this user authentication method, the user authentication method is characterized in that, as the authentication, the authentication server device performs authentication based on whether or not the authentication time is within a certain time range from the specified time. Included in the invention.

  In this user authentication method, the first terminal device calculates a data valid period by performing a calculation that adds the fixed time to the detected time, and transmits the data valid period to the authentication server device, and the authentication server device. The user authentication method is also included in the present invention, wherein the server device performs authentication based on whether or not the authentication time is within the data validity period.

  In this user authentication method, the first terminal device executes the calculation of the data validity period so that at least a part thereof is executed in parallel with the time for performing the user authentication process of the IC card. A user authentication method characterized by this is also included in the present invention.

  In these user authentication methods, the first terminal device performs encryption by adding signature data to the user identification information and time, and the first terminal device performs the encryption. The encrypted user identification information and time are transmitted to the authentication server device and the IC card, and the encrypted user identification is transmitted from the IC card to the authentication server device via the second terminal device. The information and time are transmitted, and the authentication server device transmits the encrypted user identification information transmitted via the second terminal device and the time and the encryption transmitted from the first terminal device. A user authentication method is also included in the present invention, wherein the authentication is performed by comparing the user identification information and the time, and a specific one-time ID is used instead of encryption. With That these combinations are also included in the present invention.

  The present invention includes each device (a combination thereof) for realizing the above-described methods, a computer program for realizing these methods, and a medium storing this program.

  According to the present invention, even when the realization means for performing personal authentication cannot be used, it is possible to provide more secure authentication without impairing the convenience of the user.

  Embodiments of the present invention will be described with reference to the drawings. First, FIG. 1 shows a system configuration diagram in the present embodiment.

  The biometric authentication terminal 100 is assumed to be a terminal corresponding to an ATM of a financial institution, but may be a personal computer including a CPU and a memory. The biometric authentication terminal 100 includes a biometric authentication program 101 that executes biometric authentication processing and a communication program 102 for communicating data with an authentication server.

  The biometric authentication device 200 includes a biometric information reading unit 201 and an IC card R / W unit 202, and is connected to the biometric authentication terminal 100. The biometric authentication device 200 collates the biometric information acquired from the biometric information reading unit 201 with the biometric information 402 stored in the IC card 400 inserted in the IC card R / W unit 202, and the result is the biometric authentication terminal. Send to 100.

  The IC card 400 includes a memory for storing data and programs, an arithmetic processing unit for performing operations such as biometric authentication and encryption, a communication unit for communicating with the IC card R / W, and the like. The memory stores at least user identification information 401 and biometric information 402 as data.

  The authentication server 500 has an information management program 501 for managing the user identification information 511, and is connected to the biometric authentication terminal 100100 via the network 300. Here, the connection line of the network 300 is assumed to be a dedicated line, but it may be a local network such as a LAN.

  The terminal device 700 is a computer including a CPU and a memory. The terminal device 700 includes an operating system, and an application program operates under the control of the operating system. The terminal device 700 has an authentication program 701 for performing user authentication based on a service request from the user, and is connected to the authentication server 500 via the network 600. The IC card R / W 800 has a communication unit for communicating with the IC card, and is connected to the terminal device 700.

  FIG. 2 is a data configuration example of the user identification information 401 stored in the memory of the IC card 400 in the present embodiment. The user identification information 401 includes a user ID uniquely assigned to each user, a transaction ID uniquely given to each transaction, a biometric authentication device ID for identifying the biometric authentication terminal 100, a biometric Contains time information indicating the time of successful authentication.

  FIG. 3 is a data configuration example of the user identification information 511 managed by the information management program 501 included in the authentication server 500 in the present embodiment. The user identification information 511 includes a transaction ID uniquely given for each transaction, a biometric authentication device ID for identifying the biometric authentication terminal 100, time information indicating the time when biometric authentication was successful, and successful authentication. It includes a data expiration date calculated by adding a certain time from the time.

  4 and 5 are diagrams for explaining the processing contents of the embodiment of the present invention. FIG. 4 illustrates an example of pre-processing of the user authentication method according to the present invention. First, the user starts a service on the biometric authentication terminal 100 (S1000). The service here refers to withdrawal of cash from a deposit account by ATM at a financial institution. After the service starts, the biometric authentication terminal 100 requests the user ID from the IC card 400, and the IC card 400 reads the user ID from the user identification information 401 stored in the memory, and the biometric authentication terminal Send to 100. In this embodiment, user ID = 00000001 is transmitted (S1001).

  The biometric authentication terminal 100 transmits the user ID received from the IC card 400 to the authentication server 500, and the authentication server 500 collates the received user ID with the user identification information 511 included in the information management program 501. In this embodiment, the user ID read from the IC card = 00000001 is collated with the user ID in the user identification information 511 included in the information management program 501 (S1002). If there is a matching user ID as a result of the collation, the biometric authentication terminal 100 acquires the current time (S1003), the data that is the source of the user identification information, the transaction ID, the biometric authentication device ID, and S1003 Get the current time obtained in. In this embodiment, 20070313123000 is acquired as the current time (S1004). Thereafter, the biometric authentication terminal 100 requests the user to perform biometric authentication (S1005). For example, in the case of finger vein authentication, an operation of placing a finger on the biometric information reading unit is applicable.

The biometric authentication terminal 100 transmits the data created in S1004 and the biometric information read in S1005 to the IC card 400. The IC card 400 first collates the received biometric information with the biometric information stored in the memory in advance (S1006). Thereafter, the IC card 400 writes the transaction ID received from the biometric authentication device, the biometric authentication device ID, and time information to the IC card 400 as user identification information (S1007), and the result of successful authentication is the biometric authentication terminal 100. Send to. In this embodiment, transaction ID = 00001001, biometric authentication device ID = 10000001, and time information = 20070313123000 are written in the IC card 400. The biometric authentication terminal 100 receives the result of the authentication success from the IC card 400, and then the data that becomes the source of the user identification information, user ID = 00000001, transaction ID = 00001001,
The biometric device ID = 10000001 and time information = 20070313123000 are transmitted to the authentication server 500.

  The authentication server 500 calculates the data expiration date by adding a certain time to the time information received from the biometric authentication terminal 100. In this embodiment, the fixed time period is 30 days, and the data expiration date is calculated as 200070412123000 (S1008). The authentication server 500 writes the transaction ID received from the biometric authentication device, the biometric authentication device ID and time information, and the data expiration date calculated in S1007 to the information management program 501 as user identification information (S1009). Is sent to the biometric authentication terminal 100.

  FIG. 5 illustrates an example of the identity verification process of the user authentication method according to the present invention. First, the user starts a service on the terminal device 700 (S2000). Here, the service is a transfer process from the user's deposit account by Internet banking, or a credit settlement in Internet shopping. After determining the content of the service requested by the user, user authentication is started when final settlement processing is performed (S2001).

  The authentication server 500 first checks whether or not the terminal device 700 has a corresponding biometric information reading function (S2002). If the terminal device 700 has a function of reading the corresponding biometric information as a result of the confirmation, the user is requested to perform biometric authentication (S2003). If the terminal device 700 does not have a corresponding biometric information reading function, the user is requested to input a user ID and a password registered in advance by the user. In this embodiment, the user inputs the correct user ID = 00000001 and the password number = 1234 (S2004).

  The terminal device 700 transmits the user ID and password entered by the user to the IC card 400. The IC card 400 collates the received user ID and password with a user ID and password stored in the memory in advance (S2005). If they match as a result of the collation, the terminal device 700 requests the IC card 400 to read the user identification information, and the IC card 400 reads the user identification information stored in the memory in the IC card. In this embodiment, the IC card 400 reads user ID = 00000001, transaction ID = 00001001, biometric authentication device ID = 10000001, and time information = 20070313123000 as user identification information (S2006).

  The IC card 400 continues to create signature data by encrypting the user identification information by a predetermined method (S2007), and transmits the user identification information and the signature data to the terminal device 700. The terminal device 700 transmits the received user identification information and signature data to the authentication server 500. The authentication server 500 first decrypts the received signature data by a predetermined method and collates it with the user identification information received from the terminal device 700 (S2008). If they match as a result of the collation, the authentication server 500 refers to the corresponding user from the user ID included in the user identification information, and first collates the time information. In this embodiment, user ID = 00000001 is inquired and time information = 20070313123000 is collated.

  When the time information matches, the authentication server 500 compares the data expiration date = 20070412123000 of the user ID = 00000001 stored in the information management program 501 with the time information = 20070313123000 transmitted from the IC card 400 via the terminal device 700. And whether the time information is within the data expiration date range. If the time information is within the data validity period, a positive authentication result is obtained. For example, it is determined that the user is the principal.

  FIG. 6 is a data transition example of the user identification information 401 stored in the memory of the IC card 400 in the present embodiment. In the initial stage where there is no user authentication success history, the user ID and password are stored, and if biometric authentication is successful, the transaction ID linked to the user ID of the user and the biometric authentication device The ID and time information are updated.

  FIG. 7 is a data transition example of the user identification information 511 managed by the information management program 501 of the authentication server 500 in the present embodiment. At the initial stage where there is no user authentication success history, a user ID is stored, and when biometric authentication is successful, a transaction ID linked to the user ID of the user, a biometric authentication device ID, Time information is updated.

System configuration diagram in the present embodiment User identification information configuration example: IC card User identification information configuration example: Authentication server Example flowchart: Pre-authentication method Example flow chart: User authentication method Data transition example: IC card Data transition example: Authentication server

Explanation of symbols

100 ... biometric authentication terminal, 200 ... biometric authentication device, 300 ... network 1,
400 ... IC card, 500 ... authentication server, 600 ... network 2,
700 ... Terminal device, 800 ... IC card R / W, 101 ... Biometric authentication program,
102 ... Communication program, 201 ... Biometric information reading unit,
202: IC card R / W unit, 401: User identification information (IC card),
402 ... Biometric information, 501 ... Information management program, 701 ... Authentication program
511 ・ ・ ・ User identification information (authentication server)

Claims (10)

In a user authentication method for authenticating a user using a plurality of authentication means,
The authentication result for the first authentication means included in the plurality of authentication means is held in the storage device,
Receiving input necessary for the second authentication means included in the plurality of authentication means from the user,
In response to the input, an authentication process is executed by the second authentication means,
When it is determined that the first authentication unit cannot be executed, authentication is performed on the user according to an authentication result held in the storage device and an authentication processing result by the second authentication unit. User authentication method. In the user authentication method according to claim 1,
If the authentication result of the first authentication means is affirmative, the storage device holds time information indicating the time related to the authentication,
A user authentication method characterized in that if the time related to authentication for the user is within a certain period of time from the time, the authentication is executed. In the user authentication method according to claim 2,
By calculating by adding the fixed time to the time by the first authentication means, the data valid period is calculated,
A user authentication method, wherein authentication is performed based on whether or not the time of authentication by the second authentication means is within the data validity period. In the user authentication method according to claim 3,
A user authentication method, wherein the calculation of the data validity period is executed at least in part in parallel with the time for performing the first authentication process. In user authentication method using IC card,
The biometric information of the user is stored in advance in the IC card,
The first terminal device used by the user and having biometric information input means accepts input of biometric information and user identification information for identifying the user from the user,
The first terminal device detects the time when the input biometric information is received;
The first terminal device transmits the input biometric information and the detected time to the IC card,
The IC card performs authentication of the user by collating the transmitted biometric information and the stored biometric information,
The IC card transmits the authentication result to the first terminal device,
When the first terminal device authenticates the user whose verification result is valid, the detected time and the user identification information are transmitted to the authentication server device via the network,
The authentication server device stores the user identification information and time in association with each other,
Receiving a predetermined service request from the user, and a second terminal device connected to the authentication server device via a network receives user identification information and a service request from the user;
The second terminal device transmits an authentication request including the received user identification information to the authentication server device,
The authentication server device specifies a time corresponding to the transmitted user identification information, performs authentication based on the time, and notifies the second terminal device of the result of the authentication, User authentication method. In the user authentication method according to claim 5,
The authentication server apparatus performs authentication based on whether or not the authentication time is within a certain time range from the time specified for the authentication, as the authentication. In the user authentication method according to claim 6,
The first terminal device calculates a data valid period by performing a calculation that adds the fixed time to the detected time, and transmits the data valid period to the authentication server device,
The user authentication method, wherein the authentication server device performs authentication based on whether or not the authentication time is within the data validity period. In the user authentication method according to claim 7,
The first terminal device executes the calculation of the data validity period so that at least a part thereof is executed in parallel with a time for performing user authentication processing of the IC card. Authentication method. In the user authentication method according to any one of claims 5 to 8,
The first terminal device performs encryption by giving signature data to the user identification information and time,
The first terminal device transmits the encrypted user identification information and time to the authentication server device and the IC card,
Sending the encrypted user identification information and time from the IC card to the authentication server device via the second terminal device,
The authentication server device transmits the encrypted user identification information transmitted via the second terminal device and the time and the encrypted user identification information transmitted from the first terminal device; A user authentication method, wherein the authentication is executed by checking the time. In the user authentication method according to any one of claims 5 to 9,
The first terminal device creates one-time ID information that gives a one-time ID that can identify the data with respect to the user identification information and time,
The first terminal device transmits the one-time ID information to the authentication server device and the IC card,
The one-time ID information is transmitted from the IC card to the authentication server device via the second terminal device,
The authentication server device executes the authentication by collating the one-time ID information transmitted from the second terminal device with the one-time ID information transmitted from the first terminal device. A characteristic user authentication method.

Images