JP2009193272A - Authentication system and mobile terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To input one-time password by a simple operation, and to authenticate a user with higher security in token authentication using one-time password with a portable terminal. <P>SOLUTION: This authentication system is provided with a portable telephone set 200; a password issue server 100 for issuing a password on the basis of a request from the portable telephone set 200; and an authentication server 300 for authenticating the user of a portable terminal. The password issue server 100 generates a password by using identification information unique to the portable terminal, converts a password into voice data on the basis of a conversion table, and transmits a password sound from a speaker to the microphone of the authentication server 300. The authentication server 300 inversely converts the password sound by a conversion table corresponding to the conversion table of the portable terminal to restore the password, and permits the authentication of the portable terminal when the restored password coincides with the password received from the password issue server 100. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication system, and more particularly to a one-time password using a mobile terminal.

  In general, a method called token authentication is used for secure network access. This allows a client to have a function called “token” for generating a one-time password, and realizes a one-time password with an authentication server. The token includes a hardware token that is a physical device such as a card type, and a software token that operates on a personal computer or a mobile phone. A token code valid only for the token is generated at a specific time based on the time data from the token's built-in clock and the unique identification information (PIN code: Personal Identification Number). Displayed and updated above.

  Among these, in token authentication performed on a mobile phone, a one-time password is transmitted to the authentication server by performing a one-time password transmission with an audio signal, without requiring a particularly troublesome one-time password input operation on the mobile phone. Is disclosed. (Patent Document 1 and Patent Document 2)

JP 2004-348238 A JP 2005-190447 A

  When the one-time password is generated with text information, if another person sees the scene where the one-time password is entered, it is a short time, but the attack of the other person cannot be avoided. Moreover, in a portable terminal, the input operation of the one-time password by a character is troublesome. Also, it is difficult to leak the one-time password as a sound signal to the network.

  Therefore, the present invention has been made in view of the above problems, and an object of the present invention is to provide an authentication system capable of performing simple authentication and safe authentication in a portable terminal that can perform user authentication using a password. And

  In order to solve the above problem, an authentication system according to claim 1 performs a mobile terminal, a password issuing device that issues a password based on an access request from the mobile terminal, and user authentication of the mobile terminal. An authentication system comprising an authentication device, wherein the password issuing device uses a unique identification information included in an access request from the mobile terminal to obtain a password expressed in a scale from the speaker of the mobile terminal. The mobile terminal generates and transmits the password to sound data in correspondence with the unique identification information, and the mobile terminal converts the password into sound data and converts the received password into sound data based on the conversion table. An output unit for converting and outputting a password sound from the speaker, and the authentication device is configured to output the password sound output from the speaker. A microphone to be input; a conversion table corresponding to the conversion table of the portable terminal; a restoration unit that reversely transforms sound data of a password sound input from the microphone by the conversion table; and the restoration unit; And an authentication permission unit that permits authentication of the portable terminal when the password restored from the password is the same as the password received from the password issuing device.

  According to the first aspect of the present invention, the password issuing device uses unique identification information included in the mobile terminal, such as a mobile phone individual identification number, a login ID of a person who receives usage authentication, various cookies, and the like. Generate a password. The password is generated by using a unique identification information and time-changing information such as time data to calculate the password as a random number whose regularity is not easily understood. The password generated in this way is transmitted to the mobile terminal and the authentication device.

  The password transmitted to the mobile terminal is converted into sound data based on a conversion table stored in the mobile terminal, and transmitted as a password sound from a speaker provided in the mobile terminal. Therefore, the password input operation can be performed with a simple operation. Then, the conversion process to the sound signal is added, and the conversion process is a process based on the table. Therefore, the safety can be improved as compared with the case where the password is simply converted into the sound signal. The password transmitted to the authentication terminal is stored in the unique identification information authentication device. When a password sound is input from a microphone provided in the authentication device, the input password sound is reversely converted into a password based on a table corresponding to the conversion table stored in the mobile terminal. Is restored. Thereafter, the authentication permission unit determines whether the reversely converted password matches the password transmitted from the above-described authentication device, thereby performing user authentication of the mobile terminal.

  According to a second aspect of the present invention, the portable terminal further includes an operation unit, and the output control unit outputs a password sound from the speaker when a predetermined operation is performed on the operation unit. It is characterized by. According to this configuration, this password sound is emitted when a predetermined operation is performed. Thereby, the person who is going to receive authentication can emit a password sound arbitrarily when he wants to receive authentication.

  The invention of claim 3 is characterized in that the conversion table has different contents depending on the unique identification information of the portable terminal. According to this, since the conversion table is different for each unique identification information of each mobile terminal, even if the information of the conversion table of one mobile terminal leaks, the security of the authentication system itself is safe. The security of user authentication of other mobile terminals is maintained. Thereby, by adding a process of converting a password into a sound signal, further safety can be ensured.

  The invention of claim 4 is a portable terminal in which user authentication is performed by an authentication device that performs user authentication based on a password issued by a password issuing device, and an identification information storage unit that stores unique identification information; A transmitting unit that accesses the password issuing device based on the unique identification information and transmits a password issuance request, and a receiving unit that receives the password generated by the password issuing device using the unique identification information A conversion table that converts the password into sound data; an output unit that converts the received password into sound data based on the conversion table and outputs a password sound from a speaker to the authentication device; and the authentication A password sound input from a microphone provided in the apparatus is converted into a conversion table corresponding to the conversion table of the portable terminal. When the password restored by reverse conversion by the password and the password issued by the password issuing device match, the authentication permission result data is received from the authentication device, and the authentication permission result is displayed on a predetermined display unit. And a display control unit for displaying.

  According to invention of Claim 4, it is a portable terminal by which user authentication is performed by the authentication apparatus which performs user authentication based on the password issued by the password issuing apparatus, and this portable terminal receives issue of a password In addition, it has a transmitter for transmitting unique information stored in the mobile terminal, for example, a mobile phone identification number. And the receiving part which receives the password produced | generated by the password issuing apparatus using the transmitted information is provided. In order to transmit the received password as a password sound, it is necessary to convert the password into a sound signal. This conversion is converted by the conversion unit based on the conversion table. The sound signal becomes a password sound and is emitted from the output unit to the microphone of the authentication device.

  The password sound input from the microphone provided in the authentication device is restored to the password before being converted by the authentication device by the conversion table corresponding to the conversion table of the mobile terminal and converted by the mobile terminal. However, when the authentication device matches the password received from the password issuing device, the authentication control device has a display control unit that displays the result of the authentication permission.

  The invention of claim 5 is characterized in that the conversion table has different contents depending on the unique identification information transmitted from the portable terminal. According to this, since the conversion table is different for each unique identification information of each mobile terminal, even if the information of the conversion table of one mobile terminal leaks, The security of user authentication is maintained. Thereby, in the process of converting a password into a sound signal, further safety can be ensured.

  ADVANTAGE OF THE INVENTION According to this invention, the authentication system which can perform simpler and safer authentication in the portable terminal which can perform user authentication using the password expressed with a musical scale can be provided.

  Hereinafter, the best mode for carrying out the present invention will be described in detail.

  The outline of the present invention will be described with reference to FIG. In the embodiments described below, the present invention is applied to a mobile phone as an embodiment suitable for a mobile terminal according to the present invention.

  When user authentication of the owner of the mobile phone is performed using the mobile phone 200, secure user authentication using a one-time password can be performed by placing a so-called software token application in the mobile phone. In this case, a predetermined signal for requesting the issuance of a one-time password is transmitted from the mobile phone 200 to the password issuance server 100 that is a password issuance device for issuing the one-time password via the network 11 such as the Internet. When the password issuing server 100 determines that a signal satisfying a predetermined condition is transmitted from the mobile phone 200, the password issuing server 100 issues a one-time password and transmits it to the mobile phone 200. In accordance with this, the one-time password transmitted to the mobile phone 200 and unique identification information are transmitted to the authentication server 300 as the authentication device. Upon receiving the one-time password, the owner of the mobile phone 200 receives the microphone 313 using a sound signal using a password sound created from the one-time password described below in the authentication server 300 in order to receive the target service. Send using.

  The authentication server 300 transmits information on the one-time password issued from the password issuing server 100 and issued to the mobile phone 200, and information on the one-time password restored by reversely converting the password sound sent from the mobile phone 200. And the user authentication is completed when it is determined that the person who has issued the one-time password and the person who has transmitted the one-time password are the same. Thereby, the user of the mobile phone 200 can receive the target service. This system can be used, for example, when it is desired to manage a person who performs a transaction with an automatic teller machine (ATM) such as a bank.

<Internal structure of password issuing server>
FIG. 2 is a block diagram showing the internal configuration of the password issuing server 100. In the embodiment of the present invention, the password issuing server functions as a password issuing device as described above.

  The password issuing server 100 is used for communicating with a central processing unit (CPU) 101, a read only memory (ROM) 102, a random access memory (RAM) 103, and a mobile phone 200 via the Internet. A communication interface circuit 104 and a hard disk drive 105 are provided.

  The hard disk drive 105 stores unique identification information and PIN code of the cellular phone 200 described later, a calculation formula for generating a one-time password from the unique identification information of the cellular phone 200 and information that changes regularly. Has been.

The RAM 103 stores unique identification information and PIN code data transmitted from the mobile phone 200 described below, a created one-time password, and the like.

  When the CPU 101 receives the unique identification information and PIN code from the mobile phone 200, the CPU 101 reads and compares the unique identification information and PIN code of the mobile phone 200 stored in the hard disk drive 105. If the two match, a calculation formula for generating a one-time password for generating a one-time password is read from the hard disk drive 105, and the password generation circuit 106 generates a one-time password corresponding to the mobile phone. This will be described in detail with reference to FIG.

  The communication interface circuit 104 transmits the one-time password generated by the password generation circuit 106 and stored in the RAM 103 to the mobile phone 200 via the Internet. As a result, the one-time password is displayed on the liquid crystal panel of the mobile phone 200, and the user authentication necessary for receiving the target service can be received by using the one-time password.

  In addition, the one-time password generated by the password generation circuit 106 is an authentication server on the Internet or a wired line by the communication interface circuit 104 together with unique identification information of the mobile phone 200 that has transmitted a predetermined signal for issuing a one-time password. 300.

<Configuration of mobile phone>
FIG. 3 is a block diagram showing the internal configuration of the mobile phone. In the embodiment of the present invention, the mobile phone 200 functions as a mobile terminal.

  The cellular phone 200 includes an operation unit 204, a liquid crystal panel 206, a CCD camera 208, a wireless unit 210, an audio circuit 212, a speaker 214, a microphone 216, a transmission / reception antenna 218, a nonvolatile memory 220, a CPU 222, and a secondary battery 224. .

  The operation unit 204 inputs a predetermined instruction to the CPU 222 described later. The liquid crystal panel 206 functions as a display unit in the present invention, and displays a program executed by the CPU 222 in a predetermined mode. The CCD camera 208 captures an arbitrary image, and image data obtained by capturing is stored in the nonvolatile memory 220.

  The wireless unit 210 is controlled by the CPU 222 to transmit / receive to / from the base station using radio waves as a medium through a transmission / reception antenna 218 that performs transmission / reception via the Internet. In other words, sending a predetermined signal requesting the issuance of a one-time password via the Internet line, receiving a one-time password if a one-time password is issued, receiving information to that effect if not issued, etc. do. Then, these pieces of information are sent to the CPU 222. In the present invention, the radio unit 210 and the communication antenna 218 function as a transmission unit and a reception unit.

  The audio circuit 212 outputs the reception signal output through the CPU 222 to the speaker 214 and transmits the audio signal output from the microphone 316 to the CPU 222. The speaker 214 converts the reception signal output from the audio circuit 212 into a sound signal and outputs the sound signal. The microphone 316 converts the input sound into an audio signal and outputs it to the audio circuit 312. In the embodiment of the present invention, the audio circuit 212 and the speaker 214 function as an output unit that outputs a password sound after the one-time password transmitted from the password issuing server 100 is changed to sound data.

  The non-volatile memory 220 is composed of, for example, a flash memory or the like. For example, the non-volatile memory 220 stores various data such as image data captured by the CCD camera 208, image data for a standby image, music data for ringtones, and various programs. Store in a nonvolatile manner.

  The non-volatile memory 220 includes a “software token” application used for password generation, a mobile phone individual identification number that is unique identification information of the mobile phone, and an individual using a one-time password according to the present invention. The login ID used for services that require authentication, the one-time password transmitted from the password issuing server 100, the conversion table for converting the one-time password into sound data, the sound data converted from the one-time password into sound data, etc. are stored. ing. In the embodiment of the present invention, the nonvolatile memory 220 functions as an identification information storage unit that stores unique identification information.

  The “software token” application is stored in the nonvolatile memory 220 as an application so that token authentication can be performed by the mobile phone. The “software token” application itself may be downloaded from a home page of a service provider that performs token authentication as user authentication.

  The conversion table is prepared to increase the security of token authentication using a one-time password. That is, information for requesting generation of one-time passwords from a plurality of mobile phones 200 is transmitted to the password issuing server 100, and different one-time passwords are generated in each mobile phone 200. One-time passwords secure user authentication. Therefore, it is necessary to prevent a situation in which the contents of the one-time password generation process will be exposed in the future. Therefore, a service provider that performs user authentication using the one-time password arbitrarily prepares a different conversion table for each software token application of each mobile phone. As a result, even if there is an outflow of data that threatens the safety of the one-time password from the password issuing server 100, the same as long as a different conversion table cannot be obtained for each software token application stored in each mobile phone 200 Even if the one-time password can be obtained, the sound data obtained based on the conversion table cannot be obtained, so that the safety of those who use the one-time password is ensured.

  The CPU 222 performs, for example, incoming / outgoing call processing, e-mail generation transmission / reception processing, Internet processing, and the like. Note that the CPU 222 performs transmission / reception of electronic mail and transmission / reception of data via the Internet via the wireless unit 210 and the transmission / reception antenna 218. The secondary battery 324 supplies power to each circuit.

  Further, the CPU 222 reads the software token application from the nonvolatile memory 220 based on a predetermined instruction input from the operation unit 204 and starts it. After that, when a personal identification number (PIN code) that only a person who wants to receive user authentication can input by operating the operation unit 204, the password and the login ID (unique identification information) are entered into the password via the Internet. It is transmitted to the issuing server 100. When these pieces of information satisfy predetermined conditions, a one-time password is transmitted from the password issuing server 100, received from the transmission / reception antenna 218 and the wireless unit 210, and stored in the nonvolatile memory 220. Then, the CPU 222 reads the one-time password and the conversion table from the nonvolatile memory 220, changes the one-time password to sound data, and stores the sound data in the nonvolatile memory 220. In addition, when a predetermined operation is performed on the operation unit 204, sound data is read from the nonvolatile memory 220 and emitted from the speaker 214.

  When the personal identification number and the login ID are transmitted to the password issuing server 100 but the predetermined condition is not satisfied and the one-time password is not issued, information indicating that is received from the transmission / reception antenna 218 and the wireless unit 210. This information is displayed on the liquid crystal panel 206.

<Internal structure of authentication server>
FIG. 4 is a block diagram showing the internal configuration of the authentication server.

  The authentication server 300 includes an interface circuit 306, a microphone 313, an audio circuit 311, a nonvolatile memory 314, and a CPU 315.

  The microphone 313 detects a password sound emitted from a speaker 214 (see FIG. 3) provided in the mobile phone 200 and outputs it to the audio circuit 311. The interface circuit 306 transmits / receives various data to / from the mobile phone 200 for one-time password authentication described below.

  The non-volatile memory 314 includes a one-time password transmitted from the password issuing server 100 to the mobile phone 200, unique identification information and owner data of the mobile phone, and non-volatile memories 220 of a plurality of mobile phones. A conversion table recorded in (see FIG. 3), a program for restoring a password sound transmitted from the mobile phone 200 input from the microphone 313 to a one-time password, a restored one-time password, and the like are stored. .

  The one-time password transmitted from the password issuing server 100 to the mobile phone 200 and the unique identification data of the mobile phone are issued to which mobile phone 200 the one-time password is issued when performing user authentication. This information is used to identify the person who intends to receive user authentication using the mobile phone 200 in combination with the identification information unique to the mobile phone and the owner data. Since the conversion tables recorded in the non-volatile memories 220 (see FIG. 3) of a plurality of mobile phones store different conversion tables in each mobile phone, when a password sound is input from each mobile phone 200, It is used in the restoration process to perform reverse conversion corresponding to the conversion table recorded in each mobile phone 200. In addition, a program for restoring the password sound transmitted from the mobile phone 200 input from the microphone 313 to a one-time password, and the restored one-time password are stored.

  When the sound data of the password sound and the sound data of the login ID are output from the microphone 313 and received via the voice circuit 311, the CPU 315 receives the password sound from the login ID of the mobile phone 200 that has generated the password sound, and then the nonvolatile memory 314. The conversion table recorded in the non-volatile memory 220 (see FIG. 3) of the plurality of mobile phones stored in is read. Then, the sound data input from the microphone 313 using the conversion table corresponding to the login ID in the conversion table is reversely converted into a one-time password and restored. That is, the CPU 315 functions as a restoration unit in the embodiment of the present invention.

  Thereafter, the restored one-time password is stored in the nonvolatile memory 314. Then, the CPU 315 reads the one-time password transmitted from the password issuing server 100 stored in the nonvolatile memory 314 and transmitted to the mobile phone 200 and compares it with the restored password. That is, the CPU 315 also functions as an authentication permission unit in the embodiment of the present invention.

[One-time password issuance process]
In FIG. 5, the one-time password issuing process will be described in detail. In addition, about this figure, the process of the mobile telephone 200 and the password issuing server 100 example process are demonstrated in parallel.

  In step S101, the CPU 222 of the mobile phone 200 performs site access processing. Since this process requires user authentication in order to receive a specific service, the service provider activates a software token application stored in the mobile phone 200 to receive a one-time password. Processing to access a site on the Internet. When this process ends, the process proceeds to step S102.

  In step S <b> 102, a person who wishes to receive usage authentication performs an input operation of a login ID and a password using the operation unit 204 of the mobile phone 200. This process is performed by using the operation unit 204 (see FIG. 3) provided with a login ID as unique identification information and a PIN number as a PIN code in the above-described software token application stored in the mobile phone 200. Operate (see) to input. These are pieces of information that can be known only to those who undergo user authentication, and user authentication methods using these are well known. When this process ends, the process proceeds to step S103.

  In step S103, the CPU 222 of the mobile phone 200 performs a login ID / password transmission process. In this processing, the CPU 222 (see FIG. 3) of the mobile phone 200 transmits the login ID and password entered in step S102 to the password issuing server 100 via the network 11 via the wireless unit 210 and the communication antenna 218. Here, the transmission is performed through the network, but any means such as the Internet or a dedicated line may be used as the transmission means. In the present invention, the wireless unit 210 and the communication antenna 218 function as a transmission unit. When this process ends, the process proceeds to step S201.

  In step S <b> 201, the CPU 101 of the password issuing server 100 performs a login ID / password storage process. In this processing, the CPU 101 of the password issuing server 100 stores the login ID and password transmitted from the mobile phone 200 in the RAM 103 (see FIG. 3). When this process ends, the process proceeds to step S202.

  In step S202, the CPU 101 of the password issuing server 100 performs a one-time password generation process. In this process, the CPU 101 of the password issuing server 100 uses the login ID and password transmitted from the mobile phone 200 stored in the RAM 103 in step S201 as the login ID (unique ID) stored in the hard disk drive 105 of the password issuing server 100. ID information) and a personal identification number (PIN code). If they match, the calculation formula for generating the one-time password stored in the hard disk drive 105 is read, and the one-time password is generated from the regularly changing information and the login ID (unique identification information). To do. Here, the regularly changing information can easily generate a different one-time password each time it is issued, for example, by using time. The calculation formula for generating the one-time password can generate various one-time passwords by performing four arithmetic operations on the information. In order to facilitate the description of the generation of the one-time password, although not shown here, the login ID and password transmitted from the mobile phone 200 are stored in the hard disk drive 105 of the password issuing server 100. If it is determined that the login ID and the password do not match, the fact is transmitted to the mobile phone 200, and the one-time password issuing process is terminated.

  In step S203, the CPU 101 of the password issuing server 100 performs a one-time password transmission process. In this process, the CPU 101 of the password issuing server 100 transmits to the mobile phone 200 and the authentication server 300 the one-time password generated in step S202 and the identification information unique to the mobile phone that issued the one-time password. When this process ends, the process proceeds to step S105.

  In step S105, the CPU 222 of the mobile phone 200 performs processing for converting the one-time password into a musical scale. In this processing, the CPU 222 stores the one-time password transmitted from the password issuing server 100 in step S203 in the nonvolatile memory 220, and converts it into a conversion table that converts the one-time password recorded in the nonvolatile memory 220 into sound data. Based on this, the sound data is generated by changing to a musical scale. The conversion table is different for each mobile phone. When this process ends, the process proceeds to step S106.

In step S <b> 106, the CPU 222 of the mobile phone 200 records the sound data of this one-time password in the nonvolatile memory 220. When this process ends, the one-time password issuance process ends.

[One-time password authentication process]
In FIG. 6, the one-time password issuing process will be described in detail. In this figure, the processing of the mobile phone 200 and the processing of the authentication server 300 will be described in parallel.

  In step 301, when a predetermined operation is performed on the operation unit 204, the CPU 222 of the mobile phone 200 associates the sound data of the one-time password stored in the nonvolatile memory 220 with the unique identification information. To the speaker 214. That is, a password sound and a sound signal of identification information (login ID or the like) unique to a person who wants to receive user authentication are transmitted from the speaker 214 to the authentication server 300 as a sound signal. When this process ends, the process proceeds to step 401.

  In step S401, the CPU 315 of the authentication server 300 converts the password sound transmitted from the microphone 313 provided in the authentication server 300 into a one-time password. Specifically, when the CPU 315 receives the password sound, the CPU 315 stores the password sound from the conversion table recorded in the nonvolatile memory 220 (see FIG. 3) of the plurality of mobile phones, which is stored as sound data in the nonvolatile memory 314. The conversion table corresponding to the unique identification information (login ID in this case) received together is read out. Then, based on the conversion table prepared in the identification information unique to the mobile phone, the sound data is reversely converted into a one-time password and restored. When this process ends, the process proceeds to step S402.

  In step S402, the CPU 315 of the authentication server 300 performs password authentication processing. Specifically, the CPU 315 of the authentication server 300 responds to the mobile phone 200 transmitted from the password issuing server 100 stored in the nonvolatile memory 314 of the authentication server 300 and the one-time password restored in step S401. Compare the sent one-time passwords. When this process ends, the process proceeds to step S403.

  In step S403, the CPU 315 of the authentication server 300 determines whether or not the two compared in step S402 match. Then, a result of “matching” when the two match and “not matching” when the both do not match is shown. When this process ends, the process proceeds to step S404.

  In step S <b> 404, the CPU 315 of the authentication server 300 performs processing for transmitting whether or not a password is permitted. CPU 315 transmits the determination result shown in step S <b> 404 of authentication server 300 to mobile phone 200 via interface circuit 306. When this process ends, the process proceeds to step S302.

  In step S <b> 302, the CPU 222 of the mobile phone 200 performs a process of displaying the password permission information transmitted from the authentication server 300 in step S <b> 404. That is, when the one-time password transmitted from the mobile phone 200 is different from the one-time password issued by the password issuing server 100 and transmitted to the authentication server 300, the fact that the user authentication cannot be obtained is displayed on the liquid crystal panel 206. To do. On the other hand, if the two match, the fact that user authentication has been obtained is displayed on the liquid crystal panel 206. When this process ends, the one-time password authentication process ends. In the present invention, the CPU 222 functions as a display control unit that displays the result of the authentication permission on the liquid crystal panel 206 (display unit).

  According to the present embodiment, in a portable terminal that can perform token authentication using an audio signal, further encryption is possible in the process of converting to an audio signal. Even if the contents of calculation processing such as information, PIN code, time data, etc. are analyzed and a situation that threatens the safety of the one-time password occurs, not only the above-mentioned unique identification information but also the conversion table of the audio signal Since the analysis must also be performed, the security of token authentication is improved as a result. In particular, when different conversion tables are prepared corresponding to the unique identification information of each portable terminal, the analysis of each conversion table must be performed, so that further improvement in safety is ensured. Therefore, in conventional token authentication using a one-time password, the conversion means for converting the one-time password into an audio signal is simply a process based on the conversion table, and the conventional simplicity is maintained and the cost is low. An authentication system that can perform user authentication with improved safety can be provided.

  According to the present embodiment, the login ID is used as the unique identification information and the PIN code is the personal identification number. However, the present invention is not limited to this, and any unique information that can be known only by the person who receives the use authentication is used. It doesn't matter. The one-time password is generated by four arithmetic operations using unique identification information and regularly changing information, but is not limited to this. Furthermore, although the above-described mobile phone 200 uses a software token, the present invention can be used as long as it is a portable hardware token that can be authenticated by voice.

  The preferred embodiments of the present invention have been described in detail above. However, the present invention is not limited to the above-described embodiments, and various modifications may be made within the scope of the gist of the present invention described in the claims. It can be changed.

1 is a schematic diagram illustrating the system of the present invention in a simplified manner. It is a block diagram which shows the internal structure of the password issuing server which concerns on this invention. It is a block diagram which shows the internal structure of the mobile telephone which concerns on this invention. It is a block diagram which shows the internal structure of the authentication server which concerns on this invention. It is a flowchart which shows the one time password issuing process which concerns on this invention. It is a flowchart which shows the one-time password authentication process based on this invention.

Explanation of symbols

100 password issuing server 101 CPU
102 ROM
103 RAM
DESCRIPTION OF SYMBOLS 104 Interface circuit 105 Hard disk drive 106 Password generation circuit 200 Mobile phone 204 Operation part 206 Liquid crystal panel 214 Speaker 206 Microphone 210 Radio | wireless part 212 Audio | voice circuit 218 Communication antenna 220 Non-volatile memory 224 Secondary battery 300 Authentication server 306 Interface circuit 311 Audio | voice circuit 313 Microphone 314 Memory 315 CPU

Claims (5)

An authentication system comprising a mobile terminal, a password issuing device that issues a password based on an access request from the mobile terminal, and an authentication device that performs user authentication of the mobile terminal,
The password issuing device uses a unique identification information included in an access request from the portable terminal, generates a password expressed in a scale from a speaker of the portable terminal, and corresponds to the unique identification information Sent to the authentication device,
The portable terminal has a conversion table that converts the password into sound data, and an output unit that converts the received password into sound data based on the conversion table and outputs a password sound from a speaker.
The authentication device includes a microphone for inputting a password sound output from the speaker, a conversion table corresponding to the conversion table of the portable terminal, and reverse conversion of sound data of the password sound input from the microphone by the conversion table. And a restoration unit that restores the password, and an authentication permission unit that permits authentication of the mobile terminal when the password restored by the restoration unit matches the password received from the password issuing device. Authentication system. The portable terminal further includes an operation unit,
The authentication system according to claim 1, wherein the output control unit outputs the password sound from the speaker when a predetermined operation is performed on the operation unit.   The authentication system according to claim 1, wherein the conversion table has different contents depending on the unique identification information of the mobile terminal. A mobile terminal in which user authentication is performed by an authentication device that performs user authentication based on a password issued by a password issuing device,
An identification information storage unit for storing unique identification information;
A transmission unit for accessing the password issuing device based on the unique identification information and transmitting a password issuing request;
A receiving unit that receives the password generated by the password issuing device using the unique identification information;
A conversion table for converting the password into sound data;
An output unit for converting the received password into sound data based on the conversion table and outputting a password sound from a speaker to the authentication device;
The password recovered from the password sound input from the microphone provided in the authentication device by reverse conversion using the conversion table corresponding to the conversion table of the portable terminal matches the password issued by the password issuing device. A display control unit that receives authentication permission result data from the authentication device and displays the authentication permission result on a predetermined display unit. The mobile terminal according to claim 4, wherein the conversion table has different contents depending on the unique identification information transmitted from the mobile terminal.

Images