JP2009122885A - Authentication system, authentication server, communication terminal, authentication method, and authentication program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent collection of personal identification information from a cellular phone by third party. <P>SOLUTION: An authentication server which performs authentication processing to a cellular phone is prepared. The authentication server includes: a short-range radio/authentication registration receiving section to perform personal identification registration via short-range radio such as FeliCa (R); an authentication processing section which performs authentication processing using registered information for personal identification and authentication request data from the cellular phone; and an authentication information storage section for storing information for personal identification. The cellular phone includes: a short-range radio/authentication registration transmission section for transmitting personal identification using short-distance radio; a biometrics authentication input section for inputting biometrics authentication data; an authentication request section which performs an authentication request to the authentication server; various functions of a cellular phone; and a mobile save area which saves information for authentication communication and terminal unique IDs. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication system, and more particularly to a personal authentication system for a mobile phone using a server.

  In recent mobile phones, a device capable of inputting biometric authentication such as fingerprint / face is used to restrict access to functions of the mobile phone and personal information.

  However, in this method, it is necessary to store authentication source data for authentication in a mobile phone which is a mobile device (mobile communication device). In order to misuse these authentication data in the future, a third party As a result, personal authentication data stored in the mobile phone may be stolen and misused.

As a related technique, Japanese Unexamined Patent Application Publication No. 2006-048174 (Patent Document 1) discloses a home security system.
In this technique, when a user (user) purchases an HS stick and attaches it to a mobile phone, the HS stick automatically calls the address of the security center server and makes a fingerprint registration request. Upon receiving the registration request, the security center server reads the unique ID of the HS stick, confirms personal information such as the name of the purchased user as accompanying information, and then requests the user's own fingerprint input. A user who has received a fingerprint transfer request causes his / her finger to touch the sensor part of the HS stick and scans it. The imaging operation is repeated a number of times (for example, three times), a fingerprint image is collected, and the fingerprint feature points are extracted. Create template data and transfer it. As the fingerprint authentication server, the security center server registers the template data, the unique ID of the HS stick, and the user's personal information linked to the authentication database. Thus, the user's fingerprint registration is completed, and the security center server also functions as a fingerprint authentication server. At this time, all communication via the Internet and communication via the wireless LAN are protected by encryption.

JP 2006-048174 A

  Secure that personal authentication data can be stolen and misused without preserving important personal information in the mobile device and enabling control by biometric authentication as before It is necessary to consider an authentication system.

  An object of the present invention is to provide an authentication system, an authentication server, a communication terminal, an authentication method, and an authentication program for preventing collection of personal authentication information from a mobile phone by a third party.

  The authentication system of the present invention obtains the first personal authentication data from an authentication server that performs authentication processing by comparing the registered first personal authentication data with the second personal authentication data received from the outside, The first personal authentication data is registered in the authentication server in advance by short-range wireless communication, the second personal authentication data is acquired from the user during authentication processing, and the second personal authentication data is acquired by long-range wireless communication. And a communication terminal delivered to the server.

  An authentication server according to the present invention includes a short-range wireless / authentication registration receiving unit that acquires first personal authentication data from a communication terminal by short-range wireless communication, and receives an authentication inquiry from the communication terminal by long-range wireless communication. The second personal authentication data is obtained from the first personal authentication data, and the first personal authentication data and the second personal authentication data are collated to perform an authentication process.

  The communication terminal of the present invention starts operation when short-distance wireless communication with an authentication server is started, and provides short-distance wireless / authentication registration that provides first authentication data to the authentication server by short-range wireless communication in advance. When the operations of the transmission unit and the short-range wireless / authentication registration transmission unit are started, the first personal authentication data is acquired from the user in response to a request from the short-range wireless / authentication registration transmission unit, The first personal authentication data is delivered to the distance wireless / authentication registration transmission unit, and the second personal authentication data is acquired from the user during the authentication process, and the second personal is transmitted to the authentication server by long-distance wireless communication. And an authentication request unit that delivers authentication data.

  An authentication method performed on the authentication server side of the present invention includes a step of acquiring first personal authentication data from a communication terminal by short-range wireless communication, an authentication inquiry from the communication terminal by long-distance wireless communication, and from the authentication inquiry Obtaining second personal authentication data and comparing the first personal authentication data with the second personal authentication data to perform an authentication process.

  An authentication method performed on the communication terminal side according to the present invention includes a step of providing first personal authentication data to an authentication server by short-range wireless communication in advance, and the first personal authentication data as a user when short-range wireless communication is started. And acquiring the second personal authentication data from the user at the time of authentication processing, and delivering the second personal authentication data to the authentication server by long-distance wireless communication.

  An authentication program executed on the authentication server side of the present invention includes the steps of obtaining first personal authentication data from a communication terminal by short-range wireless communication, receiving an authentication inquiry from the communication terminal by long-range wireless communication, and receiving the authentication inquiry The second personal authentication data is acquired from the first personal authentication data, and the processor (processor) executes a step of performing authentication processing by comparing the first personal authentication data with the second personal authentication data.

  The authentication program executed on the communication terminal side of the present invention includes a step of providing first personal authentication data to the authentication server by short-range wireless communication in advance, and the first personal authentication data when starting short-range wireless communication. Obtaining from the user and acquiring the second personal authentication data from the user at the time of authentication processing, and causing the processor to execute the step of delivering the second personal authentication data to the authentication server by long-distance wireless communication.

The first effect is that it is difficult for a third party to acquire personal authentication information registered in the authentication server during communication. The reason for this is that direct communication with the server is performed using short-range wireless communication as registration to the authentication server, and limited range of short-range wireless communication. From these, wiretapping by a third party on the communication path This is because it is difficult.
The second effect is that even if an authentication inquiry or an inquiry result is wiretapped, a third party does not know personal authentication data. The reason is that the biometric authentication data transmitted from the mobile phone to the authentication server is encrypted, and the information necessary for decryption is common to each other in near field communication at the time of authentication registration. This is because it is very difficult for the three parties to decrypt the encryption.

Embodiments of the present invention will be described below with reference to the accompanying drawings.
Referring to FIG. 1, the authentication system of the present invention includes an authentication server 1 and a mobile phone 2.

  The authentication server 1 includes a short-range wireless / authentication registration receiving unit 11, an authentication processing unit 12, and an authentication information storage unit 13.

  The short-range wireless / authentication registration receiving unit 11 operates by performing short-range wireless communication with the short-range wireless / authentication registration transmitting unit 21. A unique ID (identifier) and an algorithm for conversion are acquired. The short-range wireless / authentication registration receiving unit 11 communicates with the short-range wireless / authentication registration transmitting unit 21 by short-range wireless communication. For example, the short-range wireless / authentication registration receiving unit 11 may be a non-contact IC card reader / writer, an infrared communication module, or the like. At this time, the short-range wireless / authentication registration receiving unit 11 is connected between the short-range wireless / authentication registration receiving unit 11 and the short-range wireless / authentication registration transmitting unit 21 by contact or approach of the authentication server 1 and the mobile phone 2. You may make it start operation | movement when the communication by near field communication is established. Further, the short-range wireless / authentication registration receiving unit 11 generates an arbitrary result determination ID, and combines the generated result determination ID and each information acquired from the short-range wireless / authentication registration transmission unit 21. The personal authentication information 3 is created, and the created personal authentication information 3 is stored in the certificate information storage unit 13. Here, the personal authentication information 3 indicates information necessary for authentication with the mobile phone 2. Details of the contents of the personal authentication information 3 will be described later. Further, the short-range wireless / authentication registration receiving unit 11 delivers the generated result determination ID to the authentication processing unit 12.

  The authentication processing unit 12 receives the authentication query 4 from the authentication request unit 23 and collates the terminal unique ID included in the authentication query 4 with the terminal unique ID included in the personal authentication information 3 in the authentication information storage unit 13. The personal authentication information 3 whose terminal unique ID matches the terminal unique ID included in the authentication inquiry 4 is acquired from the authentication information storage unit 13. Details of the contents of the authentication inquiry 4 will be described later. The authentication processing unit 12 communicates with the authentication request unit 23 by long-distance wireless communication. For example, a communication module for connecting to a mobile phone network, the Internet, or the like can be considered as the authentication processing unit 12. Next, the authentication processing unit 12 decrypts the encrypted inquiry authentication data included in the authentication inquiry 4 using the conversion algorithm included in the acquired personal authentication information 3, and the decrypted encrypted inquiry authentication data and Then, an authentication process is performed by collating with the personal authentication data included in the personal authentication information 3. The authentication processing unit 12 sends the result determination ID to the authentication request unit 23 if they match as a result of authentication, and sends any ID other than the result determination ID if they do not match.

  The authentication information storage unit 13 stores the authentication information of the mobile phone 2 delivered from the short-range wireless / authentication registration receiving unit 11. Here, the authentication information storage unit 13 stores the personal authentication information 3.

  The cellular phone 2 includes a short-range wireless / authentication registration transmission unit 21, a biometric authentication input unit 22, an authentication request unit 23, a functional module 24, and a mobile device storage unit 25.

  The short-range wireless / authentication registration transmitting unit 21 starts operation when short-range wireless communication with the short-range wireless / authentication registration receiving unit 11 is started. At this time, the short-range wireless / authentication registration transmitting unit 21 is connected between the short-range wireless / authentication registration receiving unit 11 and the short-range wireless / authentication registration transmitting unit 21 by the contact or approach between the authentication server 1 and the mobile phone 2. You may make it start operation | movement when the communication by near field communication is established. When the short-range wireless / authentication registration transmitting unit 21 starts its operation, it acquires personal authentication data from the biometric authentication input unit 22 and acquires a terminal unique ID 5 from the mobile device storage unit 25. Here, the terminal unique ID 5 indicates a number assigned to uniquely identify the mobile phone 2. That is, the terminal unique ID 5 is a number for specifying the mobile phone 2. Further, the short-range wireless / authentication registration transmitting unit 21 generates an arbitrary conversion algorithm. The short-range wireless / authentication registration transmitting unit 21 collectively transmits the personal authentication data, the terminal unique ID, and the conversion algorithm to the short-range wireless / authentication registration receiving unit 11. When the short-range wireless / authentication registration transmitting unit 21 sends a result determination ID from the short-range wireless / authentication registration receiving unit 11 after transmission, the short-range wireless / authentication registration transmitting unit 21 combines the sent result determination ID and the generated conversion algorithm. Then, the authentication communication information 6 is created and stored in the mobile device storage unit 25 as mobile device communication information. Here, the authentication communication information 6 indicates information necessary for performing communication and determination when performing authentication with the authentication server 1. Details of the contents of the authentication communication information 6 will be described later. As an example of the short-range wireless / authentication registration transmitting unit 21, a short-range wireless communication function such as FeliCa (registered trademark), Bluetooth (registered trademark), or IrDA (Infrared Data Association) added to the mobile phone 2 can be considered. .

  The biometric authentication input unit 22 has an I / F (interface) for acquiring user authentication data such as a fingerprint and an iris, and is input by the user in response to a request from the short-range wireless / authentication registration transmission unit 21 The personal authentication data is acquired, and the acquired personal authentication data is delivered to the short-range wireless / authentication registration transmitting unit 21. The biometric authentication input unit 22 delivers the personal authentication data to the authentication request unit 23 when the user inputs personal authentication data for authentication.

  Upon receiving the personal authentication data from the biometric authentication input unit 22, the authentication request unit 23 acquires the terminal unique ID 5 and the authentication communication information 6 from the mobile device storage unit 25. Also, the personal authentication data is converted using a conversion algorithm included in the authentication communication information 6 to create encrypted inquiry authentication data. Also, the authentication request unit 23 creates an authentication query 4 based on the acquired terminal unique ID 5 and the created encrypted query authentication data, and passes the authentication query 4 to the authentication processing unit 12. Furthermore, when an ID is sent from the authentication processing unit 12 after the authentication is completed, the authentication request unit 23 checks (confirms) whether the sent ID matches the result determination ID included in the authentication communication information 6. If they match, the function module 24 is notified of authentication OK (authentication success). As an example of the authentication request unit 23, a long-distance communication function such as a wireless communication function mounted on a mobile phone can be considered. That is, the authentication request unit 23 communicates with the authentication processing unit 12 using a mobile phone network, the Internet, or the like.

  The function module 24 indicates functions (various mobile device functions) in various cellular phones such as a telephone and a mailer mounted on the cellular phone 2. In addition, when the function module 24 receives an authentication OK (authentication success) notification from the authentication request unit 23, the function module 24 temporarily performs operations for restricting various mobile device functions such as inaccessibility of some data and inability to use functions. To release.

  The mobile device storage unit 25 stores the terminal unique ID 5 and the authentication communication information 6.

  Referring to FIG. 2, the personal authentication information 3 includes a terminal unique ID 31, personal authentication data 32, a conversion algorithm 33, and a result determination ID 34.

  The terminal unique ID 31 is an ID for uniquely identifying the mobile phone 2 that is acquired from the short-range wireless / authentication registration transmission unit 21 and is sent in advance by the mobile phone 2. That is, the terminal unique ID 31 is a number for specifying the mobile phone 2. Here, the terminal unique ID 31 is the terminal unique ID 5 acquired from the mobile device storage unit 25 by the short-range wireless / authentication registration transmission unit 21. The near field wireless / authentication registration transmitting unit 21 delivers the terminal unique ID 31 to the near field wireless / authentication registration receiving unit 11.

  The personal authentication data 32 is biometric authentication data sent in advance by the mobile phone 2. The personal authentication data 32 is used for authentication with the encrypted inquiry authentication data 42 included in the authentication inquiry 4. Here, the short-range wireless / authentication registration transmitting unit 21 acquires personal authentication data from the biometric authentication input unit 22, and delivers the acquired personal authentication data 32 to the short-range wireless / authentication registration receiving unit 11.

  The conversion algorithm 33 is an encryption / decryption algorithm generated by the short-range wireless / authentication registration transmitting unit 21 and sent in advance from the mobile phone 2. The conversion algorithm 33 is used to decrypt the encrypted inquiry authentication data 42 included in the authentication inquiry 4. Here, the short-range wireless / authentication registration transmitting unit 21 generates a conversion algorithm 33 and delivers the generated conversion algorithm 33 to the short-range wireless / authentication registration receiving unit 11.

  The result determination ID 34 is an ID for determining the authentication result generated by the short-range wireless / authentication registration receiving unit 11. Here, the short-range wireless / authentication registration receiving unit 11 generates the result determination ID 34, and combines the terminal unique ID 31, the personal authentication data 32, the conversion algorithm 33, and the result determination ID 34 together with the personal authentication information 3. The created personal authentication information 3 is stored in the certificate information storage unit 13.

  Next, the authentication inquiry 4 includes a terminal unique ID 41 and encrypted inquiry authentication data 42.

  The terminal unique ID 41 indicates a unique number added to the mobile phone 2 used when authenticating to the authentication server 2. That is, the terminal unique ID 41 is a number for specifying the mobile phone 2. Here, the terminal unique ID 41 is the terminal unique ID 5 acquired by the authentication request unit 23 from the mobile device storage unit 25. The authentication request unit 23 delivers the terminal unique ID 41 to the authentication processing unit 12.

  The encrypted inquiry authentication data 42 indicates encrypted biometric authentication data used when authenticating the authentication server 2. Here, the authentication request unit 23 creates the encrypted inquiry authentication data 42 and delivers the created encrypted inquiry authentication data 42 to the authentication processing unit 12. The authentication processing unit 12 decrypts the encrypted inquiry authentication data 42 using the conversion algorithm 33 and performs an authentication process between the decrypted encrypted inquiry authentication data 42 and the personal authentication data included in the personal authentication information 3. .

  Further, the authentication communication information 6 includes a conversion algorithm 61 and a result determination ID 62.

  The conversion algorithm 61 is an encryption / decryption algorithm generated by the short-range wireless / authentication registration transmission unit 21 and sent in advance by the mobile phone 2. The conversion algorithm 61 is used to encrypt authentication data delivered from the biometric authentication input unit 22 to the authentication request unit 23 and to decrypt the encrypted inquiry authentication data 42. Here, the short-range wireless / authentication registration transmitting unit 21 generates the conversion algorithm 61 and stores the generated conversion algorithm 61 in the mobile device storage unit 25.

  The result determination ID 62 is an ID for determining a result for the authentication query 4 to the authentication server 1. Here, the short-range wireless / authentication registration receiving unit 11 generates the result determination ID 62, and delivers the generated result determination ID 62 to the short-range wireless / authentication registration transmitting unit 21. The short-range wireless / authentication registration transmitting unit 21 acquires the result determination ID 62 from the short-range wireless / authentication registration receiving unit 11, and stores the acquired conversion algorithm 61 in the mobile device storage unit 25.

Next, the operation of this embodiment will be described in detail.
FIG. 3 shows a user operation that triggers the operation of the present embodiment. The operation A indicates a case where the user brings the mobile phone 2 close to the communication range of the short-range wireless / authentication registration receiving unit 11 of the authentication server 1. Operation B indicates a case where the functional module 24 mounted on the mobile phone 2 is operated by the user and authentication operation is started.

First, the operation A will be described with reference to FIG.
(1) Step S101
When the operation A is performed, the short-range wireless / authentication registration transmitting unit 21 of the posted telephone 2 starts to operate and requests the biometric input unit 22 to acquire personal authentication data.
(2) Step S102
The biometric authentication input unit 22 receives a request from the short-range wireless / authentication registration transmission unit 21, acquires the user's personal authentication data 32 such as a fingerprint or an iris, and sends the personal authentication data 32 to the short-range wireless / authentication registration transmission unit 21. Hand over.
(3) Step S103
When the short-range wireless / authentication registration transmitting unit 21 acquires the handed over personal authentication data 32, the short-range wireless / authentication registration transmitting unit 21 acquires the terminal unique ID 5 from the mobile device storage unit 25. At this time, the terminal unique ID 5 becomes the terminal unique ID 31.
(4) Step S104
Further, the short-range wireless / authentication registration transmitting unit 21 generates an arbitrary conversion algorithm 33 and conversion algorithm 61 for performing encryption / decryption.
(5) Step S105
The short-range wireless / authentication registration transmitting unit 21 collectively transmits the terminal unique ID 31, the personal authentication data 32, and the conversion algorithm 33 to the short-range wireless / authentication registration receiving unit 11 of the authentication server 1.
(6) Step S106
When the near field wireless / authentication registration receiving unit 11 of the authentication server 1 receives the terminal unique ID 31, the personal authentication data 32, and the conversion algorithm 33 from the near field wireless / authentication registration transmitting unit 21, an arbitrary result determination ID 34 and result A determination ID 62 is generated. At this time, the result determination ID 34 and the result determination ID 62 are the same result determination ID.
(7) Step S107
The short-range wireless / authentication registration receiving unit 11 of the authentication server 1 creates the personal authentication information 3 by combining the terminal unique ID 31, the personal authentication data 32, the conversion algorithm 33, and the result determination ID 34. The short-range wireless / authentication registration receiving unit 11 stores the created personal authentication information 3 in the authentication information storage unit 13.
(8) Step S108
Further, the short-range wireless / authentication registration receiving unit 11 transmits the generated result determination ID 62 to the short-range wireless / authentication registration transmitting unit 21.
(9) Step S109
Upon receiving the result determination ID 62, the short-range wireless / authentication registration transmission unit 21 creates the authentication communication information 6 by combining the received result determination ID 62 and the generated conversion algorithm 61, and the mobile device storage unit 25.

  As described above, the authentication server 1 and the mobile phone 2 each hold the same terminal unique ID, conversion algorithm, and result determination ID. For example, the terminal unique ID 31 included in the personal authentication information 3 on the authentication server 1 side matches the terminal unique ID 5 held in the mobile device storage unit 25 on the mobile phone 2 side. The conversion algorithm 33 included in the personal authentication information 3 on the authentication server 1 side matches the conversion algorithm 61 included in the authentication communication information 6 on the mobile phone 2 side. The result determination ID 34 included in the personal authentication information 3 on the authentication server 1 side matches the result determination ID 62 included in the authentication communication information 6. In the authentication server 1, personal authentication data 32 for authentication is registered.

Next, the case of operation B will be described with reference to FIG.
(1) Step S201
When the operation B is performed by the user, the biometric authentication input unit 22 acquires personal authentication data from the user and delivers the personal authentication data to the authentication request unit 23. This personal authentication data is preferably the same as the personal authentication data 32. However, in reality, there are cases where they are not identical. This personal authentication data is used for authentication processing with the personal authentication data 32.
(2) Step S202
The authentication request unit 23 encrypts the delivered personal authentication data using the conversion algorithm 61 stored in the authentication communication information 6 to create encrypted inquiry authentication data 42.
(3) Step S203
The authentication request unit 23 creates the authentication query 4 by combining the created encrypted query authentication data 42 and the terminal unique ID 5 in the mobile device storage unit 25. At this time, the terminal unique ID 5 becomes the terminal unique ID 41.
(4) Step S204
The authentication request unit 23 transmits the created authentication inquiry 4 to the authentication processing unit 12.
(5) Step S205
The authentication processing unit 12 receives the authentication inquiry 4 from the authentication request unit 23 and collates the terminal unique ID 41 included in the authentication inquiry 4 with the terminal unique ID 31 included in the personal authentication information 3 in the authentication information storage unit 13. The personal authentication information 3 in which the terminal unique ID 31 matches the terminal unique ID 41 is acquired from the authentication information storage unit 13.
(6) Step S206
Next, the authentication processing unit 12 decrypts the encrypted inquiry authentication data 42 from the acquired personal authentication information 3 using the conversion algorithm 33, and the decrypted encrypted inquiry authentication data 42 and the personal authentication data 32 are decrypted. Perform authentication processing by verification.
(7) Step S207
The authentication processing unit 12 sends the result determination ID 34 to the authentication request unit 23 if they match as a result of authentication, and sends an arbitrary ID that does not match the result determination ID 34 if they do not match.
(8) Step S208
When the ID delivered from the authentication processing unit 12 is sent, the authentication request unit 23 checks (confirms) whether the sent ID matches the result determination ID 62.
(9) Step S209
The authentication request unit 23 notifies the functional module 24 of authentication OK (authentication success) when the sent ID matches the result determination ID 62.
(10) Step S210
When the function module 24 receives a notification of authentication OK (authentication success) from the authentication request unit 23, the function module 24 temporarily cancels the restriction operation of various mobile device functions.

  As described above, it is possible to perform authentication at the corresponding terminal by a combination of the mobile phone 2 registered in the authentication server 1 in advance and the user having the personal authentication data.

  Each operation described above according to the user operation is called an authentication method of the present invention. A program for causing a processor (processor) to execute this authentication method is called an authentication program of the present invention. This authentication program can be stored in a storage device or a storage medium (media).

  In the present invention, personal authentication data is registered in an authentication server by short-range wireless communication, and authentication processing can be performed on the server side using a wireless communication function (far-distance wireless communication) mounted on a mobile phone during the authentication processing. . Further, by storing data for secure communication in both the authentication server and the mobile phone in advance by short-range wireless communication, it is possible to securely perform communication during authentication processing.

  As described above, according to the present invention, in personal authentication processing of a mobile device by biometric authentication that has been added in recent years in a mobile phone, what has conventionally held personal authentication data for authentication in the mobile phone, Using a short-range wireless communication function such as FeliCa (registered trademark) that has recently been added to mobile phones, it is registered in advance in an authentication server and authentication is performed on the server side. By not storing biometric authentication information, it is characterized by preventing collection of personal authentication information from a mobile phone by a third party.

  Specifically, an authentication server for performing authentication processing on the mobile phone is prepared. The authentication server uses a short-range wireless / authentication registration receiving unit for performing personal authentication registration by using short-range wireless such as FeliCa (registered trademark), registered personal authentication information, and authentication request data from a mobile phone. An authentication processing unit for performing authentication processing and an authentication information storage unit for storing personal authentication information. In addition, the mobile phone transmits an authentication request to the authentication server, a short-range wireless / authentication registration transmission unit for transmitting personal authentication using short-range wireless, a biometric authentication input unit for inputting biometric authentication data, and the authentication server. An authentication request unit to be performed, various functions of the mobile phone, a mobile device storage area storing authentication communication information and a terminal unique ID are provided.

  With this authentication server and mobile phone, the personal authentication information of the user is registered in advance in the authentication server using short-range wireless communication, and information for performing secure communication / authentication is mutually created / registered. As a result, communication between the authentication processing unit and the authentication request unit can be performed safely and authentication on the server side can be performed. As a result, authentication processing can be performed without storing personal authentication information in the mobile phone.

  According to the present invention, in personal authentication processing of a mobile device by biometric authentication, personal authentication data for authentication in a mobile phone is registered in advance in an authentication server and authenticated on the server side. Does not store the biometric authentication information that is used for authentication in the mobile device, thereby preventing the collection of personal authentication information by a third party due to unauthorized access to the mobile phone and providing more secure protection. Available for use.

  At this time, the mobile device is not limited to a mobile communication terminal carried by a user, but may be a wireless communication terminal mounted on a mobile body such as an automobile. For example, it is conceivable to use a gadget such as a notebook PC (personal computer), a car navigation system (car navigation system), or a portable game machine capable of wireless communication instead of the mobile phone.

  Although the present invention assumes that a mobile device such as a mobile phone is used, it goes without saying that the present invention is implemented using a fixed communication device that performs wired communication instead of the mobile phone. Is also possible. In this case, it is preferable to perform long-distance communication by wired communication. For example, the case where the authentication process part 12 of FIG. 1 and the authentication request | requirement part 23 communicate by wired communication can be considered.

FIG. 1 is a diagram illustrating a configuration example of an authentication system according to the present invention. FIG. 2 is a diagram illustrating a data configuration example of personal authentication information, authentication query, and authentication communication information. FIG. 3 is a diagram illustrating an example of a user operation that is a trigger for the operation of the present embodiment. FIG. 4 is a sequence diagram illustrating an operation according to the operation A. FIG. 5 is a sequence diagram illustrating an operation according to the operation B.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Authentication server 11 ... Short distance radio | wireless / authentication registration receiving part 12 ... Authentication processing part 13 ... Authentication information storage part 2 ... Mobile telephone 21 ... Short distance radio | wireless / authentication registration transmission part 22 ... Biometric authentication input part 23 ... Authentication request part 24 ... Function module 25 ... Mobile device storage unit 3 ... Information for personal authentication 31 ... Terminal unique ID
32 ... Personal authentication data 33 ... Conversion algorithm 34 ... Result determination ID
4 ... Authentication inquiry 41 ... Terminal unique ID
42 ... Encryption inquiry authentication data 5 ... Terminal unique ID
6 ... Authentication communication information 61 ... Conversion algorithm 62 ... Result determination ID

Claims (31)

An authentication server that performs authentication processing by comparing the registered first personal authentication data with the second personal authentication data received from the outside;
The first personal authentication data is acquired from a user, the first personal authentication data is registered in the authentication server in advance by short-range wireless communication, and the second personal authentication data is acquired from the user at the time of authentication processing. A communication terminal that delivers the second personal authentication data to the authentication server by wireless communication. The authentication system according to claim 1,
The communication terminal generates a first conversion algorithm and a second conversion algorithm, passes the first conversion algorithm to the authentication server in advance by short-range wireless communication, and uses the second conversion algorithm to An authentication system that encrypts second personal authentication data to create encrypted inquiry authentication data, and delivers the encrypted inquiry authentication data to the authentication server by long-distance wireless communication. The authentication system according to claim 2,
The authentication server receives the encrypted inquiry authentication data, decrypts the encrypted inquiry authentication data using the first conversion algorithm, obtains the second personal authentication data, and the first personal authentication data An authentication system for performing authentication processing by collating with the second personal authentication data. The authentication system according to claim 3,
When the authentication server receives the first conversion algorithm from the communication terminal by short-range wireless communication, the authentication server generates a first result determination ID and a second result determination ID, and stores the first result determination ID. Then, the second result determination ID is delivered to the communication terminal by short-range wireless communication, the first personal authentication data and the second personal authentication data are collated to perform an authentication process, and the first personal authentication data An authentication system that delivers the first result determination ID to the communication terminal by long-distance wireless communication when the second personal authentication data matches the second personal authentication data. The authentication system according to claim 4,
The communication terminal checks whether the first result determination ID matches the second result determination ID, and the far first result determination ID matches the second result determination ID. In such a case, an authentication system that temporarily cancels the restriction operation of various functions installed in the communication terminal. The authentication system according to claim 5,
The communication terminal passes in advance a terminal unique ID for specifying the communication terminal by short-range wireless communication to the authentication server as a first terminal unique ID, and passes the terminal unique ID to a second terminal unique ID by long-range wireless communication. An authentication system that delivers to the authentication server together with the encrypted inquiry authentication data. The authentication system according to claim 6,
The authentication server creates and stores personal authentication information including the first terminal unique ID, the first personal authentication data, the first conversion algorithm, and the first result determination ID from the communication terminal. When the second terminal unique ID is received, the first terminal unique ID included in the personal authentication information is compared with the second terminal unique ID, and the first terminal unique ID matches the second terminal unique ID. An authentication system for performing authentication processing by comparing the first personal authentication data and the second personal authentication data included in the personal authentication information. A short-range wireless / authentication registration receiving unit that acquires first personal authentication data from a communication terminal by short-range wireless communication;
Authentication for receiving an authentication inquiry from the communication terminal by long-distance wireless communication, obtaining second personal authentication data from the authentication inquiry, and performing authentication processing by comparing the first personal authentication data and the second personal authentication data An authentication server comprising a processing unit. The authentication server according to claim 8,
The short-range wireless / authentication registration receiving unit starts operating in response to the start of short-range wireless communication with the communication terminal, generates a first result determination ID and a second result determination ID, Passing the second result determination ID to the communication terminal by communication;
The authentication processing unit performs authentication processing by comparing the first personal authentication data and the second personal authentication data, and when the first personal authentication data and the second personal authentication data match, a long distance An authentication server that delivers the first result determination ID to the communication terminal by wireless communication. The authentication server according to claim 9,
The short-range wireless / authentication registration receiving unit acquires a first conversion algorithm from the communication terminal by short-range wireless communication in advance,
The authentication processing unit obtains encrypted inquiry authentication data obtained by encrypting the second personal authentication data using the second conversion algorithm from the authentication inquiry, and uses the first conversion algorithm. An authentication server that decrypts the encrypted inquiry authentication data to obtain the second personal authentication data, and compares the first personal authentication data with the second personal authentication data to perform an authentication process. The authentication server according to claim 10,
The short-range wireless / authentication registration receiving unit obtains a first terminal unique ID from the communication terminal by short-range wireless communication in advance, the first result determination ID, the first personal authentication data, and the first terminal Create and store personal authentication information by combining the unique ID and the first conversion algorithm,
The authentication processing unit collates the first terminal unique ID included in the personal authentication information with a second terminal unique ID included in the authentication inquiry, and the first terminal unique ID matches the second terminal unique ID. If they match, the encrypted inquiry authentication data is decrypted using the first conversion algorithm included in the personal authentication information to obtain second personal authentication data, and the first personal authentication data and the second personal authentication data are obtained. An authentication server that performs authentication processing by collating with personal authentication data. A short-range wireless / authentication registration transmitting unit that starts operation when short-range wireless communication with the authentication server is started and provides first personal authentication data to the authentication server by short-range wireless communication in advance,
When the operation of the short-range wireless / authentication registration transmission unit starts, the first personal authentication data is acquired from the user in response to a request from the short-range wireless / authentication registration transmission unit, and the short-range wireless / authentication A biometric authentication input unit that delivers the first personal authentication data to a registration transmission unit and obtains second personal authentication data from the user during an authentication process;
A communication terminal comprising: an authentication requesting unit that delivers the second personal authentication data to the authentication server by long-distance wireless communication. The communication terminal according to claim 12, wherein
The short-range wireless / authentication registration transmitting unit generates the first conversion algorithm and the second conversion algorithm, and passes the first conversion algorithm to the authentication server in advance by short-range wireless communication.
The authentication request unit encrypts the second personal authentication data using the second conversion algorithm to create encrypted inquiry authentication data, and transmits the encrypted inquiry authentication data to the authentication server by long-distance wireless communication. Hand over Communication terminal. The communication terminal according to claim 13,
When the short-range wireless / authentication registration transmitting unit starts operation, the short-range wireless / authentication registration transmitting unit acquires a terminal unique ID for specifying the communication terminal, and uses the terminal unique ID as a first terminal unique ID by short-range wireless communication in advance. Hand it over to the server,
When receiving the second personal authentication data from the biometric authentication input unit, the authentication request unit acquires the unique ID, sets the terminal unique ID as a second terminal unique ID, and the second terminal unique ID and the encryption A communication terminal that generates an authentication query including authentication query authentication data and delivers the authentication query to the authentication server by long-distance wireless communication. The communication terminal according to claim 14, wherein
The short-range wireless / authentication registration transmitting unit delivers the first personal authentication data, the first terminal unique ID, and the first conversion algorithm to the authentication server by short-range wireless communication, and then short-range wireless communication The first result determination ID is received from the authentication server by
The authentication request unit receives the first result determination ID and the second result determination ID when a second result determination ID is sent from the authentication server by long-distance wireless communication after the authentication by the authentication server is completed. A communication terminal that checks whether the ID matches, and performs processing for temporarily releasing the restriction operation of various functions when the first result determination ID and the second result determination ID match. An authentication method performed on the authentication server side,
Obtaining first personal authentication data from a communication terminal by short-range wireless communication;
Receiving an authentication inquiry from the communication terminal by long-distance wireless communication, obtaining second personal authentication data from the authentication inquiry, and performing authentication processing by comparing the first personal authentication data and the second personal authentication data And an authentication method. The authentication method according to claim 16, comprising:
The operation is started in response to the start of short-range wireless communication with the communication terminal, a first result determination ID and a second result determination ID are generated, and the second result determination ID is set by the short-range wireless communication. Handing it over to the communication terminal;
The first personal authentication data and the second personal authentication data are collated and an authentication process is performed. When the first personal authentication data and the second personal authentication data match, the first personal authentication data and the second personal authentication data are matched by the long-distance wireless communication. Delivering the result determination ID to the communication terminal. The authentication method according to claim 17, comprising:
Obtaining a first conversion algorithm from the communication terminal by short-range wireless communication in advance;
From the authentication inquiry, the communication terminal obtains encrypted inquiry authentication data obtained by encrypting the second personal authentication data using a second conversion algorithm, and uses the first conversion algorithm to obtain the encrypted inquiry authentication. An authentication method further comprising: decrypting data to obtain the second personal authentication data, and performing authentication processing by comparing the first personal authentication data and the second personal authentication data. The authentication method according to claim 18, comprising:
A first terminal unique ID is acquired from the communication terminal by short-range wireless communication in advance, the first result determination ID, the first personal authentication data, the first terminal unique ID, and the first conversion algorithm, To create and save personal authentication information together,
When the first terminal unique ID included in the personal authentication information and the second terminal unique ID included in the authentication inquiry are collated, and the first terminal unique ID matches the second terminal unique ID, the individual The encrypted inquiry authentication data is decrypted using the first conversion algorithm included in the authentication information to obtain second personal authentication data, and the first personal authentication data and the second personal authentication data are collated. And performing an authentication process. An authentication method performed on the communication terminal side,
Providing the first personal authentication data to the authentication server by short-range wireless communication in advance;
Acquiring the first personal authentication data from the user when short-range wireless communication is started, and acquiring the second personal authentication data from the user during an authentication process;
Delivering the second personal authentication data to the authentication server by telecommunication. The authentication method according to claim 20, wherein
Generating a first conversion algorithm and a second conversion algorithm, and delivering the first conversion algorithm to the authentication server by short-range wireless communication in advance;
Encrypting the second personal authentication data using the second conversion algorithm to create encrypted inquiry authentication data, and further delivering the encrypted inquiry authentication data to the authentication server by long-range wireless communication. Authentication method. The authentication method according to claim 21, wherein
When short-range wireless communication with the authentication server is started, a terminal unique ID for specifying the authentication method is acquired, and the terminal unique ID is preliminarily stored in the authentication server as a first terminal unique ID by short-range wireless communication. A handing over step,
Upon receiving the second personal authentication data during the authentication process, the unique ID is acquired, and the terminal unique ID is set as the second terminal unique ID, and the second terminal unique ID and the encrypted inquiry authentication data are included in the authentication. Creating an inquiry and handing over the authentication inquiry to the authentication server by telecommunications. The authentication method according to claim 22, wherein
After handing over the first personal authentication data, the first terminal unique ID, and the first conversion algorithm to the authentication server by short-range wireless communication, the first result determination ID from the authentication server by short-range wireless communication Receiving the step,
If the second result determination ID is sent from the authentication server by the long-distance wireless communication after the authentication server completes the authentication, does the first result determination ID match the second result determination ID? And when the first result determination ID and the second result determination ID match, the authentication method further includes a step of performing processing for temporarily releasing the restriction operation of various functions. An authentication program executed on the authentication server side,
Obtaining first personal authentication data from a communication terminal by short-range wireless communication;
Receiving an authentication inquiry from the communication terminal by long-distance wireless communication, obtaining second personal authentication data from the authentication inquiry, and performing authentication processing by comparing the first personal authentication data and the second personal authentication data And an authentication program for causing the processor to execute. An authentication program according to claim 24, wherein
The operation is started in response to the start of short-range wireless communication with the communication terminal, a first result determination ID and a second result determination ID are generated, and the second result determination ID is set by the short-range wireless communication. Handing it over to the communication terminal;
The first personal authentication data and the second personal authentication data are collated and an authentication process is performed. When the first personal authentication data and the second personal authentication data match, the first personal authentication data and the second personal authentication data are matched by the long-distance wireless communication. An authentication program for causing a processor to further execute a step of delivering a result determination ID to the communication terminal. An authentication program according to claim 25, wherein
Obtaining a first conversion algorithm from the communication terminal by short-range wireless communication in advance;
From the authentication inquiry, the communication terminal obtains encrypted inquiry authentication data obtained by encrypting the second personal authentication data using a second conversion algorithm, and uses the first conversion algorithm to obtain the encrypted inquiry authentication. An authentication program for causing a processor to further execute a step of decrypting data to obtain the second personal authentication data, collating the first personal authentication data with the second personal authentication data and performing authentication processing . An authentication program according to claim 26, wherein
A first terminal unique ID is acquired from the communication terminal by short-range wireless communication in advance, the first result determination ID, the first personal authentication data, the first terminal unique ID, and the first conversion algorithm, To create and save personal authentication information together,
When the first terminal unique ID included in the personal authentication information and the second terminal unique ID included in the authentication inquiry are collated, and the first terminal unique ID matches the second terminal unique ID, the individual The encrypted inquiry authentication data is decrypted using the first conversion algorithm included in the authentication information to obtain second personal authentication data, and the first personal authentication data and the second personal authentication data are collated. An authentication program for causing the processor to further execute the authentication processing step. An authentication program executed on the communication terminal side,
Providing the first personal authentication data to the authentication server by short-range wireless communication in advance;
Acquiring the first personal authentication data from the user when short-range wireless communication is started, and acquiring the second personal authentication data from the user during an authentication process;
An authentication program for causing a processor to execute the step of delivering the second personal authentication data to the authentication server by long-distance wireless communication. An authentication program according to claim 28, wherein
Generating a first conversion algorithm and a second conversion algorithm, and delivering the first conversion algorithm to the authentication server by short-range wireless communication in advance;
Encrypting the second personal authentication data using the second conversion algorithm to create encrypted inquiry authentication data, and delivering the encrypted inquiry authentication data to the authentication server by long-distance wireless communication; and An authentication program to be executed by the processor. An authentication program according to claim 29, wherein
When short-distance wireless communication with the authentication server is started, a terminal unique ID for specifying the authentication program is acquired, and the terminal unique ID is preliminarily transmitted to the authentication server as a first terminal unique ID by short-range wireless communication. A handing over step,
Upon receiving the second personal authentication data during the authentication process, the unique ID is acquired, and the terminal unique ID is set as the second terminal unique ID, and the second terminal unique ID and the encrypted inquiry authentication data are included in the authentication. An authentication program for causing a processor to further execute a step of creating an inquiry and delivering the authentication inquiry to the authentication server by long-distance wireless communication. An authentication program according to claim 30, wherein
After handing over the first personal authentication data, the first terminal unique ID, and the first conversion algorithm to the authentication server by short-range wireless communication, the first result determination ID from the authentication server by short-range wireless communication Receiving the step,
If the second result determination ID is sent from the authentication server by the long-distance wireless communication after the authentication server completes the authentication, does the first result determination ID match the second result determination ID? And when the first result determination ID and the second result determination ID match, the processor is further caused to perform a process for temporarily releasing the restriction operation of various functions. Certification program for.

Images