JP2012133717A - Password input authentication device and portable terminal device using the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a password input authentication device which prevents authentication using a steal-read password by using a history of an input password and a dummy character.SOLUTION: An input password history comparison part 13 which compares a password 120 with a dummy character input by a password input part 11 with a password stored in an input password history storage part 14 and input in the past, deletes a dummy character 150 stored in a dummy character storage part 16 from the password 120 with the dummy character when they do not match each other, and transmits the resulting password as a regular password 160 to a server side. When a password authentication result 170 as a result of authentication by the server side is received and the authentication is successful, an application is executed, and the password 120 with the dummy character is stored in the input password history storage part 14. Consequently, when a steal-read password is input as it is, authentication ends in failure, so the safety is enhanced.

Description

  The present invention relates to a password input authentication device and a portable terminal device using the same, and more particularly to a password input authentication technique that can be used for a portable electronic device having a touch sensor such as a touch panel.

  In recent years, an increasing number of mobile phone terminals are equipped with touch sensors such as a touch panel and a touch pad, and can be operated with a finger or a stylus, and characters can be input by handwriting instead of using a keyboard.

However, there is a problem that characters entered when entering a password in personal authentication are read by others, especially when handwritten characters are entered, Since the handwriting for confirming the written character and the character of the recognition result are displayed on the screen, there is an increased risk of being read by other people than the input using the keyboard. In order to solve this problem, there is known a method of inputting a password with dummy characters added to the password when inputting the password. (For example, see Patent Document 1 and Patent Document 2)
According to Patent Document 1, the server side displays a password inserted with a dummy character on the client side screen for prompting input, or the client side uses the number of password characters stored on the client side for dummy characters. You can enter a different password each time by displaying the password inserted in the client side screen, deleting the dummy characters from the password entered by the user and sending it to the server side. Even if it is stolen, the correct password is not known and the security is improved.

  According to Patent Document 2, when a user enters a password, a different password can be entered each time by inserting a dummy character arbitrarily set by the user in the middle, front or back of the password. It becomes possible and can prevent theft. In addition, the user can also specify a dummy character that is prohibited to be used as a dummy character, and if the dummy character contains a prohibited dummy character, authentication can fail even if the password is correct, thus preventing theft. Become.

JP 2006-11940 A JP 2006-293804 A

  However, in the above-mentioned conventional patent document 1, since dummy characters are displayed on the input screen, when a password is stolen, the password can be easily guessed from the stolen password and the dummy characters displayed on the screen. There is.

  Moreover, in patent document 2, when a password is stolen, if the stolen password is input as it is, there exists a subject that authentication will be successful with the input password.

  The present invention has been made in view of such a conventional problem, and newly provides a password history storage unit and a password history comparison unit, and prompts the user to input a different password each time during personal authentication. An authentication apparatus is provided.

  In order to solve the conventional problem, a password input authentication device according to the present invention includes a password input unit that inputs a password with dummy characters, a password history storage unit that stores a history of passwords with dummy characters, and authentication in the past. An input password history storage unit for storing a password with a dummy character that has succeeded, and an input password history for comparing the password with the dummy character input in the password input unit and the password with a dummy character stored in the password history storage unit A comparison unit, a dummy character storage unit in which dummy characters are registered in advance, the password with dummy characters input by the input password history comparison unit, and a password with dummy characters stored in the password history storage unit; If the characters do not match, the entered dummy character A dummy character deletion unit that deletes the dummy characters from the password and generates a formal password. When the formal password is successfully authenticated, the input password with dummy characters is stored in the input password history storage unit. It has a configuration for storing.

  With this configuration, when the entered password is stolen by another person, if the stolen password is entered as it is, authentication fails, so that safety is improved. In addition, since there are few dummy characters to remember, there is no need to remember where to put the dummy characters, and it is only necessary to generate a password that the user can enter freely, so the burden on the user can be reduced. Furthermore, safety can be ensured even when characters are easily read and read more than input with keys, such as handwritten character input.

  Furthermore, the password input authentication device of the present invention is configured to limit the number of passwords with dummy characters stored in the input password history storage unit to a certain number of passwords with dummy characters stored most recently. Thus, it is possible to improve the convenience to some extent by setting the number of cases that a regular user can store.

  According to the password input authentication device of the present invention, it is possible to reduce the burden on the user for password input and to perform highly secure authentication.

Configuration diagram of password input authentication device according to Embodiment 1 of the present invention The figure which shows the display screen with a touchscreen for demonstrating operation | movement of the password input authentication apparatus in Embodiment 1 of this invention. The figure which shows the data stored in the input password log | history memory | storage part for demonstrating operation | movement of the password input authentication apparatus in Embodiment 1 of this invention The flowchart explaining operation | movement of the password input authentication apparatus in Embodiment 1 of this invention.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. Note that in all the drawings for explaining the embodiments, the same reference numerals are given to the same constituent elements, and duplicate explanations are omitted.

(Embodiment 1)
FIG. 1 is a configuration diagram of a password input authentication device according to Embodiment 1 of the present invention.

  As shown in FIG. 1, the password input authentication device 1 includes a password input unit 11, a display control unit 12, an input password history comparison unit 13, an input password history storage unit 14, a dummy character deletion unit 15, a dummy character storage unit 16, An official password transmission unit 17, a password authentication result reception unit 18, and an input password storage processing unit 19 are provided.

  The password input unit 11 recognizes the handwriting information 100 and the character by recognizing the character from the handwriting when the handwritten character is written on the input device 2 represented by the touch panel arranged on the surface of the housing. As a result, the recognition candidate 110 and the password 120 with dummy characters are output.

  The display control unit 12 outputs the handwriting information 100, the recognition candidate 110, and the password 120 with dummy characters to the display device 3. The display device 3 displays control buttons for character deletion and password determination.

  The input password history comparison unit 13 compares the password 120 with dummy characters and the saved input password 130 stored in the input password history storage unit 14 to check whether there is a matching password, and compares the comparison result with the comparison result flag 140. Output as.

  The input password history storage unit 14 stores a password 120 with dummy characters that has been successfully authenticated in the past as a saved input password 130.

  If there is no matching password according to the comparison result flag 140, the dummy character deletion unit 15 uses only the characters that match the dummy character 150 stored in the dummy character storage unit 16 from the password with dummy characters 120 to the password 120 with dummy characters. And output as the official password 160. On the other hand, when the dummy character 150 does not exist in the password 120 with dummy characters, the official password is not output and the dummy character-less flag 180 is output.

  The dummy character storage unit 16 stores dummy characters 150 registered in advance by the user, and a plurality of dummy characters 150 can be registered.

  When there is no matching password from the comparison result flag 140, the formal password transmission unit 17 outputs the formal password 160 to the transmission device 4 for transmission to the server side (application side).

  The password authentication result receiving unit 18 receives the authentication result of the official password 160 on the application side by the receiving device 5 and outputs the received authentication result as the authentication result flag 170.

  The input password storage processing unit 19 temporarily stores the password 120 with dummy characters when there is no matching password from the comparison result flag 140, and stores the password 120 with dummy characters when the authentication result flag 170 succeeds in personal authentication. The password is stored in the input password history storage unit 14.

  Next, the operation of the first embodiment of the present invention will be described with reference to FIGS.

  FIG. 2 is a diagram illustrating a display screen 31 with a touch panel for explaining the operation of the password input authentication device 1 according to the first embodiment of the present invention. The input device 2, the password input unit 11, the display control unit 12, and the input The password history comparison unit 13 and the input password history storage unit 14 are related.

  As shown in FIG. 2A, the display screen 31 with a touch panel includes a message display area 32, a handwritten character input frame 33, a character recognition candidate display frame 34, a password display frame 35, and a control button 36.

  As shown in FIG. 2B, a message prompting input is displayed in the message display area 32, and when the first character (a in the example) of the input password is written in the handwritten character input frame 33, the handwriting information 100 reads the handwriting. Is superimposed on the handwritten character input frame 33 and displayed.

  As shown in FIG. 2C, a recognition candidate 110 that is a result of recognizing characters in the password input unit 11 is displayed in the character recognition candidate display frame 34. The user selects a corresponding character from the recognition candidates 110 displayed in the character recognition candidate display frame 34.

  As shown in FIG. 2D, when the corresponding character of the recognition candidate 110 is selected, the handwriting of the handwritten character input frame 33 and the recognition candidate 110 of the character recognition candidate frame 34 are erased, and the selected character is used for blinding. Is displayed in the password display frame 35 as a character (* in the example).

  As shown in FIG. 2 (E), when the input of the password proceeds and the last character (x in the example) is written in the handwritten character input frame 33, the handwriting is displayed superimposed on the handwritten input frame 33, and FIG. As shown in FIG. 5, the recognition candidate 110 that is the result of character recognition in the password input unit 11 is displayed in the character recognition candidate display frame 34. The user selects a corresponding character from the recognition candidates 110 displayed in the character recognition candidate display frame 34.

  As shown in FIG. 2G, when a corresponding character of the recognition candidate 110 is selected, the handwriting of the handwritten character input frame 33 and the recognition candidate 110 of the character recognition candidate frame 34 are erased, and the selected character is used for blinding. Is displayed in the password display frame 35 as the character *. When the confirmation button of the control button 36 is pressed, the password 120 with dummy characters is output to the input password history comparison unit 13 and the processing of the input password history comparison unit 13 is started.

  FIG. 3 is a diagram showing data stored in the input password history storage unit 14 for explaining the operation of the password input authentication device 1 according to the first embodiment of the present invention, and relates to the input password history comparison unit 13. To do.

  As shown in FIG. 3G, a password 120 with dummy characters that has been successfully authenticated in the past is stored as a saved input password 130 in the input password history storage unit 14.

  Next, as shown in FIGS. 3A to 3F, when the official password is abcd and the dummy character is xyz, the password 120 with dummy characters is added to the passwords 1 to 4 with dummy characters in the password input unit 11. A case will be described where (abxcxdx, an aborted, xabxcxdx, abxctxdx) is input and six saved input passwords 130 are stored as shown in FIG.

  When the input of the password 120 with dummy characters is completed, the input password history comparison unit 13 compares the password 120 with dummy characters and the stored input password 130 of FIG. The comparison result flag 140 is output. In the case of the input password 1 with dummy characters shown in FIG. 3C, the display control unit 12 outputs a message prompting re-input to the display device 3 in order to match the history 5 shown in FIG. On the other hand, in the case of passwords with dummy characters 2 to 4 shown in FIGS. 3D, 3E, and 3F, there is nothing that matches the history. Executed.

  The dummy character deletion unit 15 deletes all dummy characters 150 stored in the dummy character storage unit 16 from the password 120 with dummy characters. At this time, when there is no dummy character in the password 120 with dummy characters, for example, the input password 2 with dummy characters shown in FIG. 3D has the dummy characters x, y, and z in FIG. Since there is no character, the display control unit 12 outputs a message prompting the user to input again from the no dummy character flag 180 to the display device 3.

  The dummy character deletion unit 15 deletes the dummy characters from the input passwords 3 and 4 with dummy characters shown in FIGS. 3E and 3F, and is a character string to be authenticated on the application side. ) To the official password shown in The formal passwords 3 and 4 (FIGS. 3E and 3F) are output to the formal password transmission unit 17, and password authentication is performed on the server side. As a result of the authentication on the server side, the password in FIG. 3 (e) is the same as the official password in FIG. 3 (A), so that the authentication is successful on the application side, but the password in FIG. The authentication fails because it is different from the official password of A).

  FIG. 4 is a flowchart showing a password input processing procedure of password input authentication device 1 according to the first embodiment of the present invention.

  As shown in FIG. 4, when a password is requested for personal authentication when using the application, the user inputs a password 120 with dummy characters to the password input unit 11 via the input device 2 (step S101). : YES, S102).

  As shown in FIG. 2G, when the input of the password 120 with dummy characters is completed and the confirm button of the control button 36 is pressed, the input password history comparison unit 13 includes the password 120 with dummy characters and the input password. When the stored input password 130, which is the history of the password with dummy characters input stored in the history storage unit 14, is compared with the history of the stored input password 130, for example, the password shown in FIG. If there is a character string that matches the stored input password in FIG. 3G, the display control unit 12 displays a message prompting re-input on the display device 3 based on the result of the comparison result flag 140 (step S103: NO, S111).

  If the password does not match the saved input password 130 (for example, FIGS. 3D, 3E, and 3F), the dummy character deletion unit 15 is stored in the dummy character storage unit 16 from the password 120 with dummy characters. The character that matches the existing dummy character 150 is deleted. Here, when there is no character that matches the dummy character 150 stored in the dummy character storage unit 16 in the password 120 with dummy characters (= when there is no dummy character, for example, FIG. )), The display control unit 12 displays a message prompting re-input on the display device 3 based on the result of the no dummy character flag 180 (steps S103: YES, S104, S105: NO, S111). On the other hand, when a dummy character is attached (for example, FIGS. 3E and 3F), the dummy character deleting unit 15 deletes the dummy character in the formal password transmitting unit 17 (for example, FIG. (F)) is output as the formal password 160, and the formal password transmission unit 17 transmits the formal password 160 to the server-side application via the transmission device 4 (steps S105: YES, S106).

  The password authentication result receiving unit 18 receives an authentication result flag 170 as a result of authenticating the official password 160 from the server via the receiving device 5 (S107).

  The input password storage processing unit 19 confirms on the terminal side whether the received authentication result 170 flag has succeeded in personal authentication. If the personal authentication is successful, the password 120 with dummy characters input by the user is input password history. The data is stored in the storage unit 14, the application is executed, and the process ends (S108: YES, S109, S110). On the other hand, when the personal authentication fails, the password re-input is requested (S108: NO, S111).

  In the embodiment of the present invention, the operation of the input password history comparison unit is determined to match the stored input password when both the dummy character and the place where the dummy character is inserted match, but the present invention is not limited to this. The criterion for determining the coincidence with the stored input password may be only the place where the dummy character is inserted. In this way, the user's burden can be reduced because only the location where the dummy character has been inserted in the past is stored without worrying about the type of dummy character.

  In the embodiment of the present invention, the dummy character deletion unit determines the result of the input password history comparison unit and starts the process. However, the present invention is not limited to this. The process may be started when the character is input to the character deletion unit. In this way, since the official password can be output immediately after the processing of the input password history comparison unit is completed, the processing speed can be improved.

  In this way, passwords with dummy characters that have been successfully authenticated in the past can not be used from the next time onwards, so that when passwords are entered, they are stolen by others and past passwords with dummy characters can be used as they are. Even if the authentication fails, even if the characters are input by handwriting instead of using the keyboard, the security of password authentication can be improved.

  The number of passwords with dummy characters stored in the input password history storage unit 14 can be stored by a regular user by limiting the number of passwords with dummy characters from a newly stored one to a certain number. It is also possible to make it. Thereby, it is possible to improve the convenience to some extent.

  In the first embodiment, password authentication is performed on the server side. However, the present invention can be used even when authentication is performed in a terminal.

  The password input authentication device of the present invention increases the safety of password authentication because authentication on the application side fails when the password is stolen by another person while the password is being input on the mobile terminal, and the password that has been read is used as it is. It is useful for mobile terminal devices such as mobile phones, PDAs, and smartphones equipped with touch sensors such as touch panels.

DESCRIPTION OF SYMBOLS 1 Password input authentication apparatus 2 Input apparatus 3 Display apparatus 4 Transmission apparatus 5 Receiving apparatus 11 Password input part 12 Display control part 13 Input password history comparison part 14 Input password history storage part 15 Dummy character deletion part 16 Dummy character storage part 17 Formal password Transmission unit 18 Password authentication result reception unit 19 Input password storage processing unit

Claims (4)

A password input part for inputting a password with dummy characters;
A password history storage unit for storing a history of passwords with dummy characters;
An input password history storage unit for storing passwords with dummy characters that have been successfully authenticated in the past;
An input password history comparison unit that compares the password with dummy characters input in the password input unit and the password with dummy characters stored in the password history storage unit;
A dummy character storage unit in which dummy characters are registered in advance;
A dummy character deletion unit that generates the official password by deleting the dummy characters from the input password with dummy characters,
When the input password history comparison unit determines that the input password with dummy characters and the password with dummy characters stored in the password history storage unit do not match, and when the official password has been successfully authenticated In the password input authentication device, the password history storage unit stores the input password with dummy characters in the input password history storage unit. 2. The password input authentication device according to claim 1, wherein the password input unit is input by handwriting input. 3. The password input according to claim 1, wherein the number of passwords with dummy characters stored in the input password history storage unit is limited to a certain number of passwords from the most recently stored passwords with dummy characters. Authentication device. A portable terminal device comprising the password input authentication device according to claim 1.

Images