JP2011100287A - Security system and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To propose a security system with high secrecy which permits execution of a program with the program execution limitation only in a specific narrow range. <P>SOLUTION: The security system 11 includes a terminal device 21 and an illuminating light source 30. The illuminating light source 30 includes a modulator 31 which outputs an optical modulation signal 201 which has a role of authentication information 80 showing that a program execution right is assigned to the terminal device 21 by optically modulating illuminating light 200. The terminal device 21 stores the program 101 with the program execution limitation, and includes an authentication means 71 which receives and demodulates the modulation signal 201 to extract the authentication information 80, and permits execution of the program 101 by the terminal device 21 on condition that it is authenticated that the terminal device 21 has the program execution right based on the authentication information 80. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a security system and an authentication method for authenticating a program execution right.

  Various studies have been conducted on system construction for preventing unauthorized use of a program stored in a built-in storage device of a terminal device such as a personal computer. In particular, when a terminal device storing a program that is allowed to be executed only within a specific area is illegally taken out of the specific area, a system is constructed to prevent unauthorized use of the program stored in the terminal device Is desired. As a document referring to this type of information security, for example, Japanese Patent No. 3634506 is known. This publication discloses an authentication system that uses position information of a terminal device as authentication information for the terminal device to access specific information. According to this authentication system, specific information can be accessed by moving the terminal device to a specific position designated in advance, which is effective in preventing leakage of secret information.

Japanese Patent No. 3634506

  However, in this publication, rough position information with coarse accuracy obtained from a GPS or mobile communication base station is used as the position information of the terminal device. For example, (1) different seats on the same floor Difficult to distinguish between rooms and rooms, (2) Difficult to distinguish between different floors in the same building, and (3) Complicated operation because it is necessary to acquire location information regularly And is not suitable for use as authentication information of a terminal device.

  Therefore, an object of the present invention is to propose a highly confidential security system and authentication method that allow a program for which program execution restrictions are set to be executed only in a specific narrow range.

  In order to solve the above problems, a security system based on the first aspect of the present invention includes a terminal device and an illumination light source. The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute the program is granted to the terminal device by optically modulating the illumination light. The terminal device authenticates that the terminal device has a program execution right based on a storage device that stores a program for which program execution restrictions are set and authentication information obtained by receiving and demodulating an optical modulation signal. Authentication means for permitting the terminal device to execute the program on the condition that it is executed.

  The security system based on the second aspect of the present invention includes a terminal device, an illumination light source, and a server device. The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute the program is granted to the terminal device by optically modulating the illumination light. The terminal device includes a storage device that stores a program in which program execution restrictions are set, and a communication unit that transmits authentication information obtained by receiving and demodulating an optical modulation signal to the server device. The server device includes authentication means for permitting the terminal device to execute the program on the condition that the terminal device is authenticated based on the authentication information received from the terminal device.

  The security system based on the third aspect of the present invention includes first and second terminal devices and an illumination light source. The first and second terminal devices are connected via a network. The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute the program is given to the first terminal device by optically modulating the illumination light. The second terminal device has a storage device for storing a program for which program execution restrictions are set. The first terminal device is conditioned on the condition that the first terminal device is authorized to have a program execution right based on authentication information obtained by receiving and demodulating the light modulation signal. Authentication means for permitting execution of the program by the apparatus is provided.

  A security system according to a fourth aspect of the present invention includes first and second terminal devices and an illumination light source. The first and second terminal devices are connected via a network. The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute the program is given to the first terminal device by optically modulating the illumination light. The first terminal device includes communication means for transmitting authentication information obtained by receiving and demodulating the light modulation signal to the second terminal device. The second terminal device has a storage device for storing a program for which program execution restrictions are set. The second terminal device is a program executed by the first terminal device on the condition that the first terminal device is authenticated based on the authentication information received from the first terminal device, on the condition that the second terminal device has the right to execute the program. The authentication means which permits execution of this is provided.

  A security system based on the fifth aspect of the present invention includes first and second terminal devices, a server device, and an illumination light source. The first and second terminal devices and the server device are connected via a network. The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute the program is given to the first terminal device by optically modulating the illumination light. The first terminal device includes communication means for transmitting authentication information obtained by receiving and demodulating the light modulation signal to the second terminal device or the server device. The second terminal device or the server device includes a storage device that stores a program for which program execution restrictions are set. The second terminal device or server device is based on the authentication information received from the first terminal device, on the condition that the first terminal device is authenticated to have the right to execute a program. Authentication means for permitting execution of the program by the apparatus is provided.

  An authentication method according to the first aspect of the present invention provides a program execution right by an illumination light source that irradiates illumination light to a terminal device that stores a program for which program execution restrictions are set, thereby modulating the illumination light. Authenticating that the terminal device has the right to execute the program based on the step of outputting the optical modulation signal carrying the authentication information for authenticating that the optical signal is given and the authentication information obtained by receiving and demodulating the optical modulation signal The terminal device permits the execution of the program by the terminal device on the condition that it is executed.

  An authentication method according to a second aspect of the present invention provides a program execution right by an illumination light source that illuminates illumination light to a terminal device that stores a program for which program execution restrictions are set, thereby modulating the illumination light. A step of outputting an optical modulation signal carrying authentication information for authenticating to be given to the terminal, a step of transmitting the authentication information obtained by receiving and demodulating the optical modulation signal to the server device, and a transmission to the server device The server device permits the execution of the program by the terminal device on the condition that the terminal device is authenticated based on the authentication information.

  According to the security system and the authentication method according to the present invention, the terminal device must move within the range irradiated with the illumination light in order to obtain the authority to execute the program for which the program execution restriction is set. The range in which program execution is authenticated can be limited to a specific range. In particular, the illumination light irradiation range can be limited to a narrow range that allows the terminal device to be arranged, which is suitable for highly confidential authentication processing.

  The identification information may be updatable. If the identification information is obtained illegally, there is a concern about unauthorized access using the identification information. However, by making the identification information updatable, such unauthorized access can be prevented and a highly secure authentication process can be realized.

  The authentication unit may re-authenticate whether the terminal device has the right to execute the program each time the authentication valid time elapses. In order for the program execution by the terminal device to be continuously authenticated, the terminal device has to be located within the range irradiated with the illumination light, so that authentication processing with high security can be realized.

  The terminal device may further include an input device for inputting personal authentication information. The authentication unit permits the terminal device to execute the program on the additional condition that the validity of the personal authentication information input to the input device is authenticated. By using personal authentication information as an additional condition for permitting program execution, authentication processing with higher security can be realized.

  The illumination light is preferably visible light. By using visible light as illumination light, there is a security advantage that an operation action for executing a program can be visually recognized.

  According to the present invention, it is possible to provide a highly confidential security system and authentication method that allow a program for which program execution restrictions are set to be executed only within a specific narrow range.

1 is a schematic configuration diagram of a security system according to Embodiment 1. FIG. 1 is a hardware configuration diagram of a terminal device according to Embodiment 1. FIG. It is explanatory drawing of the authentication information concerning Example 1. FIG. 3 is a flowchart illustrating authentication processing according to the first embodiment. FIG. 6 is a schematic configuration diagram of a security system according to a second embodiment. 6 is a hardware configuration diagram of a server apparatus according to Embodiment 2. FIG.

  Embodiments according to the present invention will be described below with reference to the drawings. The same apparatus is denoted by the same reference numeral, and redundant description is omitted.

  The security system 11 according to the first embodiment will be described with reference to FIGS. FIG. 1 shows a schematic configuration of a security system 11 according to the first embodiment. The security system 11 includes a plurality of terminal devices 21 and 22 and an illumination light source 30 for irradiating the illumination light 200. The plurality of terminal devices 21 and 22 are connected via a network 50 so as to be able to communicate with each other. The network 50 may be a private communication network such as a LAN (local area network), or may be a public communication network such as a telephone line network, ISDN network (integrated service digital network), the Internet network, or a dedicated line. However, in the present embodiment, the plurality of terminal devices 21 and 22 are not necessarily connected to the same network 50, and may be connected to different networks or may be operated stand-alone. The illumination light source 30 includes a modulator 31 that outputs an optical modulation signal 201 carrying the authentication information 80 by optically modulating the illumination light 200. The modulation method of the optical modulation signal 201 is not particularly limited, and a known modulation method (for example, intensity modulation) can be applied. The authentication information 80 is authority information for authenticating that the terminal device 21 or 22 is authorized to execute a specific program 101 or 102 for which program execution restrictions are set (program execution right). It is used for authentication processing to determine whether or not it is possible. The illumination light 200 is preferably visible light from the viewpoint of security. Moreover, as the illumination light source 30, a fluorescent lamp or the like is suitable. The terminal devices 21 and 22 are, for example, personal data assistants, palmtop computers, laptop computers, desktop computers, or mobile communication terminal devices (for example, mobile phones or PHS).

  FIG. 2 shows a hardware configuration of the terminal device 21. The terminal device 21 includes a CPU 61 that controls execution of various programs, an internal storage device 62 that functions as a work area and a temporary data storage area of the CPU 61 during program execution, and an external storage that stores large-capacity data, application programs, and the like. A device 63; an input device 64 for inputting commands relating to a program execution operation; a light receiver 65 for receiving illumination light 200 from the illumination light source 30; and a display device for displaying processing results of various programs. 66 and a communication interface 67 for connecting to the network 50. At least one of the internal storage device 62 and the external storage device 63 stores a program 101 (see FIG. 1) in which program execution restrictions are set.

  The internal storage device 62 is, for example, a volatile memory such as a RAM or a nonvolatile memory such as a ROM. The external storage device 63 is, for example, a disk drive (for example, an optical disk drive or a magnetic disk drive) or an external connection memory (for example, a USB memory). However, the terminal device 21 does not necessarily need to include the external storage device 63, and the external storage device 63 may be mounted according to the operation mode of the terminal device 21 (such as presence / absence of portability). The input device 64 is, for example, a keyboard, a mouse, a touch sensor panel, or the like. In the authentication process for determining whether or not to execute the program, which will be described later, when the user's biometric information (for example, fingerprint, palm print, handprint, voice, retina, iris, face recognition, vein pattern, etc.) is used as personal authentication information, The input device 64 includes a biometric information input device (for example, an image sensor, a semiconductor sensor, etc.). The light receiver 65 is, for example, a sensor device for receiving and demodulating the light modulation signal 201 to extract the authentication information 80, and a photoelectric conversion element as a light receiving unit that converts the light modulation signal 201 into an electric signal; And a demodulator as a demodulating means for demodulating the authentication information 80 from the optical modulation signal 201 converted into the signal. However, the light receiver 65 does not necessarily include a demodulator, and the CPU 61 may execute a process of demodulating the authentication information 80 from the light modulation signal 201 converted into an electrical signal. In other words, the CPU 61 may function as a demodulation unit. The communication interface 67 functions as a communication unit for controlling data communication based on the TCP / IP protocol, for example. Since the hardware configuration of the terminal device 22 is the same as the hardware configuration of the terminal device 21, the illustration is omitted.

  Next, an authentication process that is started when the terminal device 21 executes the program 101 for which program execution restrictions are set will be described with reference to FIGS. 1 to 4. The CPU 61 of the terminal device 21 functions as an authentication unit 71 that executes steps 401 to 405 shown in FIG. When the authentication process is activated, the authentication unit 71 first determines whether or not the authentication information 80 transmitted from the illumination light source 30 has been received (step 401). In the example shown in FIG. 1, since the terminal device 21 receives the illumination light 200, the light modulation signal 201 is received and demodulated by the terminal device 21, and the authentication information 80 is extracted. As shown in FIG. 2, the authentication information 80 includes identification information (ID1) 81 of the terminal device to which the program execution right is given, and programs that are permitted to be executed by the terminal device specified by the identification information 81. Identification information (ID2) 82. For example, when the authentication information 80 is authority information for authenticating that the right to execute the program 101 is given to the terminal device 21, the identification information 81 matches the identification information of the terminal device 21, and the identification information 82 is the program information. 101 matches the identification information. As the terminal device identification information 81, for example, the MAC address of the terminal device can be used. Although not shown in FIG. 2, a preamble code for establishing bit synchronization and an error correction code for detecting and correcting a code error may be added to the authentication information 80. However, when receiving the illumination light 200 is a condition for granting the program execution right, that is, the program execution right is given only by the program identification information (ID2) 82 without limiting the terminal devices 21 and 22. In this case, the identification information (ID1) 81 may not be included in the authentication information 80.

  When the authentication information 80 is received (step 401; YES), the authentication means 71 includes the identification information 81, the identification information 81, the identification information of the terminal device 21 and the identification information of the program 101, respectively. 82 is determined (step 402). If they match (step 402; YES), the authentication unit 71 determines that the program execution right is given to the terminal device 21, and permits the terminal device 21 to execute the program 101 (step 403). As a result, the terminal device 21 is permitted to execute the program until a predetermined authentication valid time elapses (step 404; NO). After that, when the authentication valid time has elapsed (step 404; YES), the authentication unit 71 repeats steps 401 to 405 again to perform re-authentication. If the terminal device 21 has not received the authentication information 80 (step 401; NO), or the identification information 81 included in the authentication information 80 is the identification information of the terminal device 21 and the identification information of the program 101, respectively. , 82 (step 402; NO), the authentication means 71 determines that the program execution right is not given to the terminal device 21, and does not permit the terminal device 21 to execute the program 101. (Step 405). However, when the identification information (ID1) 81 is not included in the authentication information 80, in step 402, it is not determined whether or not the identification information of the terminal device 21 matches the identification information 81.

  On the other hand, the terminal device 22 stores the program 102 in which program execution restrictions are set in an internal storage device (not shown) or an external storage device (not shown). The terminal device 22 includes a CPU (not shown) that functions as an authentication unit 72 that executes steps 401 to 405 shown in FIG. In the example shown in FIG. 1, since the terminal device 22 does not receive the illumination light 200, the terminal device 22 does not receive the authentication information 80 (step 401; NO). For this reason, the authentication means 72 does not permit execution of the program 102 by the terminal device 22 (step 405).

  As described above, the terminal device 21 located within the range irradiated with the illumination light 200 is allowed to execute the program 101 for which the program execution restriction is set, but is located within the range where the illumination light 200 is not irradiated. The terminal device 22 is not permitted to execute the program 102 for which program execution restrictions are set. In order to obtain the execution right of the program 102, the terminal device 22 must move within the range irradiated with the illumination light 200. Therefore, the terminal device 22 specifies a place where the program 102 for which the program execution restriction is set can be executed. Can be limited to a range. In particular, the irradiation range of the illumination light 200 can be limited to a narrow range in which the terminal devices 21 and 22 can be arranged, which is suitable for authentication processing with high confidentiality. Moreover, since the setting and change of the irradiation range of the illumination light 200 are relatively easy, the construction of the security system 11 is excellent in flexibility. For example, the irradiation range of the illumination light 200 can be set in units of desks, rooms, or floors. In addition, since a highly versatile infrastructure facility called the illumination light source 30 is used, the security system 11 can be designed, changed, and installed relatively easily. In addition, since the security system 11 re-authenticates the program execution every time the authentication valid time elapses, in order to continuously authenticate the execution of the program 101 by the terminal device 21, the terminal device 21 includes the illumination light 200 Therefore, the program 101 can be effectively prevented from being illegally accessed or taken out. For example, even if the program 101 is illegally taken out from the terminal device 21, since the execution of the program 101 is not permitted outside the range where the illumination light 200 is irradiated, unauthorized use of the program 101 can be effectively prevented. Also, if the security system 11 manages a special program that operates only in the office or a database equipped with an encryption / decryption function, even if data can be taken out from these programs in some way, Without the right to execute the program, data cannot be decrypted and information leakage can be prevented.

  Further, according to the security system 11, since the user can restrict the operation of the program installed in the terminal devices 21 and 22 independently, terminal management in a company can be facilitated. Further, by using visible light as the illumination light 200, there is a security advantage that an operation act of executing the program can be visually recognized. Even when the terminal devices 21 and 22 are highly portable computers such as mobile computers, the security effect can be enhanced by installing a monitoring camera or the like that captures the range irradiated with the illumination light 200. . In addition, the display device 66 displays an icon or the like associated with a program with program execution authority on the display screen, while displaying an image so that an icon or the like associated with a program without program execution authority is not displayed on the display screen. You may control.

  In order to simplify the description, the example in which the authentication information 80 is transmitted from one illumination light source 30 has been shown. However, a plurality of illumination light sources 30 are installed so that the authentication information 80 is transmitted from each illumination light source 30. It is also possible to design a system. When authentication information 80 is transmitted from a plurality of illumination light sources 30, whether or not the terminal devices 21 and 22 have received the authentication information 80 transmitted from a specific illumination light source 30 determines whether or not the program can be executed. It may be an additional condition. By including the identification information of the illumination light source 30 in the authentication information 80, it can be determined whether or not the terminal devices 21 and 22 have received the authentication information 80 from the specific illumination light source 30.

  The programs 101 and 102 for which program execution restrictions are set may be encrypted by a known encryption algorithm. By including the decryption key for decrypting the encrypted programs 101 and 102 in the authentication information 80, the terminal devices 21 and 22 that have received the authentication information 80 decrypt the respective programs 101 and 102. You can do it with

  The illumination light source 30 may continuously transmit the authentication information 80 at regular intervals, may transmit the authentication information 80 only during a predetermined time period, or may be a server device (not shown). The authentication information 80 may be transmitted by an on-demand method in response to a request from In order to transmit the authentication information 80 from the illumination light source 30 in an on-demand manner, a network for transmitting a request signal from the server device to the illumination light source 30 may be laid.

  Further, the illumination light source 30 may prevent unauthorized use of the programs 101 and 102 due to unauthorized acquisition of the authentication information 80 by updating the authentication information 80 as needed. In order to design the system so that the authentication information 80 is updated, for example, a time table indicating the correspondence between the update contents of the authentication information 80 and the transmission time zone of the authentication information 80 is displayed as the illumination light source 30 and the terminal devices 21 and 22. Should hold.

  In the above description, the authenticity of the authentication information 80 is authenticated as a condition for authenticating the program execution. However, personal authentication information (for example, an authentication character string such as an ID or a password, or a biological body such as a fingerprint) It may be an additional condition that the authenticity of the authentication information is authenticated. By using personal authentication information as an additional condition for authenticating program execution, authentication processing with high security can be realized.

  Note that the authentication means 71 and 72 may have a function (log recording function) for storing a record (log) authenticated based on the authentication information 80. Thereby, the history of program execution can be confirmed. In addition, each component of the security system 11 (the illumination light source 30 and the terminal devices 21 and 22) encrypts information to be transmitted / received to / from each other (for example, authentication information 80, personal authentication information, or authentication result information) by publicly known encryption. A function of encrypting / decrypting using a decryption algorithm (encryption / decryption function) may be provided. Thereby, a highly secure authentication process can be realized.

  In the above description, the cases where the programs 101 and 102 are stored in the terminal devices 21 and 22 are illustrated, but the programs 101 and 102 are connected to the terminal devices 21 and 22 by other terminal devices 23 connected to the network. (See FIG. 1). In other words, the present embodiment is not limited to authentication when the terminal devices 21 and 22 execute the programs 101 and 102 stored in their storage devices (internal storage devices or external storage devices). The present invention can also be applied to authentication when executing the programs 101 and 102 stored in the storage device (internal storage device or external storage device) of another terminal device 23 accessible from the terminal devices 21 and 22 via the network. .

  Authentication means for authenticating that the terminal devices 21 and 22 execute the program stored in the terminal device 23 may be included in the terminal device 23 or the terminal devices 21 and 22. When the terminal device 23 includes an authentication unit, the terminal devices 21 and 22 may transmit authentication information 80 obtained by receiving and demodulating the light modulation signal 201 to the terminal device 23. As described above, by appropriately setting the authentication means for authenticating the authentication information 80 of the illumination light source 30 according to the storage location of the program, it is possible to give the design of the security system 11 a degree of freedom.

  The security system 11 can be used, for example, to manage a startup program for an industrial device such as a machine tool in order to prevent unauthorized removal of the machine tool, illegal transfer, and alteration of a usage monitor.

  Next, the security system 12 according to the second embodiment will be described with reference to FIGS. 5 and 6. The security system 12 is different from the security system 11 according to the first embodiment in that the authentication subject that authenticates the presence / absence of the program execution right is the server device (authentication server) 40, and both are common in the other points. Hereinafter, the differences between the first and second embodiments will be mainly described, and a duplicate description will be omitted.

  FIG. 5 shows a schematic configuration of the security system 12. The security system 12 includes a plurality of terminal devices 21 and 22, a server device 40, and an illumination light source 30 for irradiating illumination light 200. The plurality of terminal devices 21 and 22 and the server device 40 are connected to each other via a network 50 so that data communication is possible. FIG. 6 shows the hardware configuration of the server device 40. The server device 40 includes a CPU 91 that controls execution of various programs, an internal storage device 92 that functions as a work area and a temporary data storage area of the CPU 91 during program execution, and an external storage that stores large-capacity data, application programs, and the like. Data communication with the terminal devices 21 and 22 via the device 93, an input device 94 for inputting commands relating to program operations, a display device 95 for displaying processing results of various programs, and the like. A communication interface 67 is provided.

  The CPU 91 functions as an authentication unit 73 that executes steps 401 to 405 shown in FIG. However, in the second embodiment, the authentication information 80 received and demodulated by the terminal device 21, the identification information of the program 101, and the identification information of the terminal device 21 are transmitted to the server device 40 for authentication processing. Different from 1. Therefore, it is noted that the authentication unit 73 determines in step 401 whether the server device 40 has received the authentication information 80, the identification information of the program 101, and the identification information of the terminal device 21 from the terminal device 21. I want to be. Similarly, the authentication information 80 received and demodulated by the terminal device 22, the identification information of the program 102, and the identification information of the terminal device 22 are transmitted to the server device 40 for authentication processing. The terminal device 21 has a function of encrypting the authentication information 80, the identification information of the program 101, and the identification information of the terminal device 21, and then transmitting the information to the server device 40. The server device 40 includes the terminal device 21. It may have a function of decrypting the information encrypted by. Thereby, a highly secure authentication process can be realized. Similarly, the terminal device 22 has a function of encrypting the authentication information 80, the identification information of the program 102, and the identification information of the terminal device 22, and then transmitting the information to the server device 40. The terminal device 22 may have a function of decrypting information encrypted. The encryption algorithm implemented in the terminal devices 21 and 22 may be the same or different. The processing of steps 402 to 405 in the second embodiment is the same as the processing of steps 402 to 405 in the first embodiment.

  If the authenticity of the personal authentication information is an additional condition for determining whether or not the program can be executed, the personal authentication information input to the terminal devices 21 and 22 is used for authentication processing. To the server device 40. The terminal devices 21 and 22 have a function of encrypting the personal authentication information and then transmitting it to the server device 40. The server device 40 decrypts the personal authentication information encrypted by the terminal devices 21 and 22. It may have a function.

  In the above description, the cases where the programs 101 and 102 are stored in the terminal devices 21 and 22 are illustrated, but the programs 101 and 102 are connected to the terminal devices 21 and 22 by other terminal devices 23 connected to the network. (See FIG. 5) or may be stored in the server device 40. In other words, the present embodiment is not limited to authentication when the terminal devices 21 and 22 execute the programs 101 and 102 stored in their storage devices (internal storage devices or external storage devices). Program 101 stored in a storage device (internal storage device or external storage device) of another terminal device 23 that can be accessed from the terminal devices 21 and 22 or a storage device (internal storage device or external storage device) of the server device 40 , 102 can be applied to authentication.

  The terminal device 23 or the server device 40 may include authentication means for authenticating that the terminal devices 21 and 22 execute the program stored in the terminal device 23 or the server device 40. When the terminal device 23 or the server device 40 includes an authentication unit, the terminal devices 21 and 22 may transmit authentication information 80 obtained by receiving and demodulating the optical modulation signal 201 to the terminal device 23 or the server device 40. As described above, by appropriately setting an authentication unit that authenticates the authentication information 80 of the illumination light source 30 according to the storage location of the file, it is possible to give the design of the security system 11 a degree of freedom.

  In addition, the illumination light source 30 may update the authentication information 80 irregularly by an on-demand system in response to a request from the server device 40. In order to update the authentication information 80 irregularly by the on-demand method, a network for transmitting a request signal from the server device 40 to the illumination light source 30 may be laid. By updating the authentication information 80 irregularly, authentication processing with high security can be realized.

  The security system and authentication method according to the present invention can be used for authentication processing for determining whether or not a program can be executed.

DESCRIPTION OF SYMBOLS 11, 12 ... Security system 21, 22 ... Terminal device 30 ... Illumination light source 31 ... Modulator 40 ... Server device 50 ... Network 71, 72, 73 ... Authentication means 80 ... Authentication information 101, 102 ... Program 200 ... Illumination light 201 ... Light modulation signal

Claims (12)

A security system comprising a terminal device and an illumination light source,
The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the terminal device is granted a program execution right by optically modulating illumination light,
The terminal device has a program execution right based on a storage device that stores a program in which program execution restrictions are set and the authentication information obtained by receiving and demodulating the optical modulation signal. A security system comprising: an authenticating unit that permits execution of the program by the terminal device on the condition that authentication is performed. A security system comprising a terminal device, an illumination light source, and a server device,
The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the terminal device is granted a program execution right by optically modulating illumination light,
The terminal device includes a storage device that stores a program in which program execution restrictions are set, and a communication unit that transmits the authentication information obtained by receiving and demodulating the optical modulation signal to the server device,
The server device permits the terminal device to execute the program on the condition that the terminal device is authenticated based on the authentication information received from the terminal device, and is authenticated as having the program execution right. A security system comprising an authentication means. A security system comprising first and second terminal devices and an illumination light source,
The first and second terminal devices are connected via a network,
The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute a program is granted to the first terminal device by optically modulating illumination light,
The second terminal device has a storage device for storing a program for which program execution restrictions are set,
The first terminal device is authenticated on the condition that the first terminal device has the right to execute the program based on the authentication information obtained by receiving and demodulating the optical modulation signal. A security system comprising authentication means for permitting execution of the program by the first terminal device. A security system comprising first and second terminal devices and an illumination light source,
The first and second terminal devices are connected via a network,
The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute a program is granted to the first terminal device by optically modulating illumination light,
The first terminal device includes communication means for transmitting the authentication information obtained by receiving and demodulating the light modulation signal to the second terminal device,
The second terminal device has a storage device for storing a program for which program execution restrictions are set,
On the condition that the second terminal device is authenticated on the basis of the authentication information received from the first terminal device that the first terminal device has the right to execute the program. A security system comprising authentication means for permitting execution of the program by one terminal device. A security system comprising first and second terminal devices, a server device, and an illumination light source,
The first and second terminal devices and the server device are connected via a network,
The illumination light source includes a modulator that outputs an optical modulation signal that bears authentication information for authenticating that the right to execute a program is granted to the first terminal device by optically modulating illumination light,
The first terminal device includes communication means for transmitting the authentication information obtained by receiving and demodulating the optical modulation signal to the second terminal device or the server device,
The second terminal device or the server device has a storage device for storing a program for which program execution restrictions are set,
The second terminal device or the server device is authenticated that the first terminal device has the right to execute the program based on the authentication information received from the first terminal device. A security system comprising authentication means for permitting execution of the program by the first terminal device as a condition. The security system according to any one of claims 1 to 5,
The security system, wherein the authentication information can be updated. The security system according to any one of claims 1 to 6,
The authentication unit is a security system that re-authenticates whether or not the terminal device has the right to execute the program each time an authentication valid time elapses. The security system according to any one of claims 1 to 7,
The terminal device further includes an input device for inputting personal authentication information,
The authentication system permits the execution of the program by the terminal device with an additional condition that the validity of the personal authentication information input to the input device is authenticated. The security system according to any one of claims 1 to 8,
The security system, wherein the illumination light is visible light. It bears authentication information for authenticating that an illumination light source that irradiates illumination light to a terminal device that stores a program for which program execution restrictions are set grants a program execution right to the terminal device by optically modulating the illumination light. Outputting a light modulation signal;
The execution of the program by the terminal device is performed on the condition that the terminal device is authenticated based on the authentication information obtained by receiving and demodulating the light modulation signal. A step permitted by the terminal device;
An authentication method comprising: It bears authentication information for authenticating that an illumination light source that irradiates illumination light to a terminal device that stores a program for which program execution restrictions are set grants program execution rights to the terminal device by optically modulating the illumination light Outputting a light modulation signal;
The terminal device transmitting the authentication information obtained by receiving and demodulating the light modulation signal to a server device;
Based on the authentication information transmitted to the server device, the server device permits the execution of the program by the terminal device on the condition that the terminal device is authenticated to have the right to execute the program. Steps,
An authentication method comprising: The authentication method according to claim 10 or claim 11,
The authentication method, wherein the authentication information can be updated.

Images