JP2012142003A - Authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform authentication processing without impairing security even when performing the authentication processing in one sequence.SOLUTION: Readers 1a, 1b send out a signal storing present time information at each prescribed time. An RFID tag 4 encrypts the present time information stored in the signal sent out from the readers 1a, 1b and a user ID 33, and transmits them to the readers 1a, 1b. The readers 1a, 1b authenticate a user carrying the RFID tag 4 on the basis of the present time information transmitted from the RFID tag 4 and the user ID 33.

Description

  The present invention relates to an authentication system for authenticating a user or an object possessing an authenticated means based on unique identification information stored in the authenticated means.

  Conventionally, an authentication system including a reader that acquires a user ID stored in an RFID (Radio Frequency IDentification) tag and authenticates a user possessing the RFID tag based on the acquired user ID is known (Patent Document 1). , 2). According to such an authentication system, the user can be authenticated without performing a password input or the like.

JP 2002-259344 A JP 2003-216994 A

  By the way, when there are a plurality of readers at independent locations, if user authentication is performed by only transmitting an authentication packet including a user ID from the RFID tag to the reader once, in other words, authentication is performed. When the processing is performed in one sequence, even if the contents of the authentication packet are encrypted, the malicious packet is generated by eavesdropping on the authentication packet and generating the same authentication packet. I can be authenticated by impersonating the user. In order to prevent generation, a method of including a sequential numerical value in the authentication packet is also conceivable. However, when this method is used, the numerical values must be completely synchronized between a plurality of readers and the RFID tag. There is a risk of being impersonated because they cannot.

  The present invention has been made to solve the above-described problem, and an object of the present invention is to perform an authentication process without degrading security even when the authentication process is performed in one sequence. Is to provide.

  In order to solve the above problem, an authentication system according to a first aspect includes an authenticated unit storing unique identification information, and a user possessing the authenticated unit based on the identification information transmitted from the authenticated unit. An authentication system comprising authentication means for authenticating, wherein the authentication means comprises signal sending means for sending a signal of a predetermined frequency storing current time information every predetermined time, and the authenticated means is connected to the signal sending means. The current time information stored in the transmitted signal and the identification information are encrypted, and a signal having a frequency different from the predetermined frequency is transmitted to the authentication unit. A user possessing an authenticated means is authenticated based on time information and identification information.

  According to the present invention, since the user possessing the authenticated means is authenticated based on the current time information synchronized between the authenticating means and the authenticated means, the authentication process is performed in one sequence. However, the authentication process can be performed without losing security.

It is a schematic diagram which shows the general view of the entrance / exit management system to which the authentication system which concerns on this invention is applied. It is a block diagram which shows the internal structure of the entrance / exit management system shown in FIG. It is an authentication sequence diagram for demonstrating operation | movement of the entrance / exit management system shown in FIG.

  The authentication system according to the present invention is a user stored in an RFID tag possessed by a user who has entered the entrance area and the exit area as shown in FIG. 1, for example, readers 1a and 1b provided in the entrance area and the exit area. The present invention can be applied to an entrance / exit management system in which the ID is read and the entrance / exit determination unit 2 controls the open / closed state of the door 3 provided between the entrance area and the exit area according to the read user ID. Hereinafter, the configuration and operation of an entrance / exit management system according to an embodiment of the present invention will be described with reference to the drawings.

[Configuration of entrance / exit management system]
First, with reference to FIG. 2, the structure of the entrance / exit management system which is embodiment of this invention is demonstrated.

  As shown in FIG. 2, an entrance / exit management system according to an embodiment of the present invention includes readers 1a and 1b provided in an entrance area and an exit area, and opening / closing of a door 3 provided between the entrance area and the exit area. An entry / exit determination unit 2 that controls the state is provided as a main component. The readers 1a and 1b include an interface unit 11 that controls information communication processing with the entrance / exit determination unit 2, a second communication means transmission / reception unit 12 that performs information communication with the RFID tag 4 possessed by the user, And a first communication means transmitting unit 13 for transmitting a time signal including current time information to the area every predetermined time. Although not shown, the readers 1a and 1b store unique reader IDs.

  The entry / exit determination unit 2 stores the interface unit 21 that controls information communication processing between the readers 1a and 1b, and the opening / closing authority of the door 3 for each user ID stored in the RFID tag 4 possessed by the user. The user ID database 22 to be authenticated, the user ID stored in the user ID database 22 and the user ID transmitted from the readers 1a and 1b are compared to authenticate the user who has entered the area, and to the user ID A door opening / closing control unit 23 that controls the opening / closing state of the door 3 in accordance with the assigned opening / closing authority of the door 3.

  In the present embodiment, in the RFID tag 4 possessed by the user, information communication is performed between the first communication means receiving unit 31 that receives the time signal transmitted from the readers 1a and 1b and the readers 1a and 1b. The second communication means transmitting / receiving unit 32 for performing the above and a unique user ID 33 assigned to each user are provided. The second communication means transmitting / receiving units 12 and 32 store a common encryption key (hereinafter abbreviated as a common key) in order to enable encrypted communication between the readers 1a and 1b and the RFID tag 4. is doing.

  In the present embodiment, the frequency band used when the first communication means transmitting / receiving unit 13 transmits the time signal is different from the frequency band used by the second communication means transmitting / receiving units 12 and 32 during information communication. It is set to a belt. According to such a structure, it can prevent that a collision generate | occur | produces between the time signal and the information which the 2nd communication means transmission / reception parts 12 and 32 transmit.

[Authentication processing]
The entrance / exit management system having the above-described configuration makes it possible to authenticate a user who has entered the area in one sequence without impairing security by executing the following authentication process. Hereinafter, the operation of the authentication system when executing the authentication process will be described in detail with reference to the authentication sequence diagram shown in FIG.

  The authentication sequence shown in FIG. 3 is started in response to the power supply of the entrance / exit management system being turned on, and the process of step S1 is started.

  In the process of step S1, the readers 1a and 1b generate a packet (wake-up PA) including the reader ID and current time information (time t) every predetermined time, and send the generated packet into the area. When the user who owns the RFID tag 4 enters the area, the first communication means receiving unit 31 in the RFID tag 4 receives the packets transmitted by the readers 1a and 1b.

  In the process of step S2, the second communication means transmitting / receiving unit 32 in the RFID tag 4 extracts the current time information from the packets received by the first communication means receiving unit 31 from the readers 1a and 1b, and the extracted current The time information and the user ID 33 are encrypted with a common key. And the 2nd communication means transmission / reception part 32 transmits the packet containing the encrypted information to the reader | leaders 1a and 1b for every predetermined time as a packet for authentication.

  Next, the second communication means transmission / reception unit 12 of the readers 1a and 1b receives the authentication packet transmitted by the second communication means transmission / reception unit 32 in the RFID tag 4, and is stored in the authentication packet by the common key. The current time information and the user ID 33 are acquired by decrypting the encrypted information. Then, the second communication means transmitting / receiving unit 12 determines whether or not the time difference between the acquired current time information and the reception time of the authentication packet is within a predetermined time (for example, several seconds).

  When the time difference is within the predetermined time, the second communication means transmission / reception unit 12 determines that the received authentication packet is a normal authentication packet, and transmits the user ID 33 to the entrance / exit determination unit 2. The door opening / closing control unit 23 collates the transmitted user ID with the user ID stored in the user ID database 22, and controls the opening / closing state of the door 3 based on the collation result.

  Further, the second communication means transmission / reception unit 12 transmits an ACK signal to the second communication means transmission / reception unit 32 in the RFID tag 4, and the second communication means transmission / reception unit 32 stops transmitting the authentication packet when receiving the ACK signal. To do. On the other hand, when the time difference is within the predetermined time, the second communication means transmission / reception unit 12 determines that the received authentication packet is not a regular authentication packet, and stops the authentication process.

  As is apparent from the above description, according to the entrance / exit management system according to the embodiment of the present invention, the readers 1a and 1b send a signal storing the current time information every predetermined time, and the RFID tag 4 receives the reader 1a. , 1b encrypts the current time information stored in the signal and the user ID 33 and transmits them to the readers 1a, 1b. The readers 1a, 1b transmit the current time information transmitted from the RFID tag 4 and the user ID 33. Based on the above, the user who possesses the RFID tag 4 is authenticated. According to such an authentication method, the user who possesses the RFID tag 4 can be authenticated based on the current time information that is synchronized between the readers 1a and 1b and the RFID tag 4. Can be performed without damaging the security even when the process is performed in one sequence.

  As mentioned above, although the embodiment to which the invention made by the present inventors was applied has been described, the present invention is not limited by the description and the drawings that form part of the disclosure of the present invention according to this embodiment. That is, it should be added that other embodiments, examples, operation techniques, and the like made by those skilled in the art based on the above embodiments are all included in the scope of the present invention.

DESCRIPTION OF SYMBOLS 1a, 1b: Reader 2: Entrance / exit judgment part 3: Door 4: RFID tag 11, 21: Interface part 12, 32: 2nd communication means transmission / reception part 13: 1st communication means transmission part 22: User ID database 23: Door Opening / closing controller 31: first communication means receiver 33: user ID

Claims (1)

An authentication system comprising: an authenticated means in which unique identification information is stored; and an authenticating means for authenticating a user possessing the authenticated means based on the identification information transmitted from the authenticated means,
The authentication means includes signal sending means for sending a signal of a predetermined frequency storing current time information every predetermined time, and the authenticated means is current time information stored in a signal sent from the signal sending means. And the identification information are encrypted and a signal having a frequency different from the predetermined frequency is transmitted to the authentication means, and the authentication means possesses the authenticated means based on the current time information and the identification information transmitted from the authenticated means. An authentication system characterized by authenticating a user to perform.