JP2012146038A - Network system, terminal device, and id card - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an inexpensive terminal device capable of extracting a plurality of stable chip coding data from an authentication article.SOLUTION: By providing luminous sources L1, L2 and L3 that generate different wavelengths of light and camera 14 in a dark space 52 of a terminal device 2, a stable light is obtained and analysis of an authentication article (analog chip 4) by infrared rays etc. is enabled. A physical element is effectively arranged on the authentication article (analog chip 4), in order to produce diversity in analytical data obtained by observing with the luminous sources L1, L2 and L3 generating pre-determined wavelengths of light.

Description

  The present invention authenticates the authenticity of an ID card equipped with an authentication object (analog chip) having physical characteristics in an authentication object authentication system in which a terminal and an authentication server are connected via a network (information network). The present invention relates to a network system determined by a server, a terminal device, and an ID card.

In network systems, secure processing is required as a countermeasure for privacy, crime prevention, etc., and there are devices that require a wide variety of authentication functions, such as small-scale networks with independent authentication systems, information appliances, game machines, etc. There are many.
Under such circumstances, various authentication systems such as an authentication system requiring a high level of security and a low level authentication system are mixed and rapidly expanding while maintaining independence.

  The main attacks against such an authentication system are an attack that creates a forged card by copying the authentication itself, and data that is sent and received between the terminal and the authentication server during the execution of the authentication protocol. ”(Replay attacks, interleaving attacks, etc.), and there is an urgent need to construct an authentication system equipped with countermeasures against such attacks.

  In particular, if the authentication protocol information for illuminating the authenticity of the ID transmitted and received between the terminal and the authentication server is single, even if the transmitted and received data is encrypted, it is single. It is more susceptible to replay attacks.

  In addition, if the card itself is a standard product and the authenticity of the card is determined by the embossing process and the stored data, if the data stored on the card is leaked, a large number of counterfeit cards are created. Such a situation is related to the continuation of the system.

  Therefore, as a means for preventing mass counterfeiting, a card with physical characteristics provided by providing the card with physical characteristics is proposed in Patent Nos. 4395660 and 4284551 filed by the inventor. Yes.

Japanese Patent Laid-Open No. 9-305697 Japanese Patent No. 4395660 Japanese Patent No. 4284551

The present application relates to a system for determining authenticity by detecting physical characteristics of an authentication object (analog chip).
In particular, in order to cope with replay attacks that use data sent and received between the terminal and the authentication server, the data used to prove the authenticity of the authentication object is diversified and the data sent and received between the terminal and the authentication server is simplified. The purpose is to invalidate the replay attack to be copied.
However, in order to diversify the data to be transmitted and received between the terminal and the authentication server, development of an inexpensive and mechanically stable apparatus that can obtain a plurality of analysis data by optical processing with one terminal It was an issue.
Furthermore, simultaneously with the development of the device, in order to create diversity in the analytical data obtained by observing the certified object with a light source that emits light at a predetermined wavelength, physical elements are effectively allocated to the certified object. There was a problem to do.

In the network system according to the first aspect of the present invention, an authentication card having a three-dimensional structure having unique physical characteristics, an ID card having an ID for identifying the authentication object, and generating the chip code data from the authentication object An authentication server having a storage device for storing chip data in association with the ID; and an authentication server for determining the authenticity of the authentication object based on the chip code data and the chip data. In a network system having a judgment system,
The terminal device includes: an ID input unit that acquires the ID; a dark sky unit that shields external light; a plurality of light sources that are disposed in the dark sky unit and each emit light having a different wavelength; and the light source Or observation means data for specifying one light emission pattern from a plurality of light emission patterns to be emitted by selecting a plurality of light sources having different wavelengths, a storage unit for storing a plurality of observation means data, and the observation Illumination control means for causing the light source to emit light according to means data, a camera, photographing means for photographing with the camera as light of the light source emitted by the observation means data, and image data obtained by the photographing means, respectively A plurality of generating means for generating the chip code data having different values, a storage unit for storing encoding method data for specifying the generating means, the ID and the previous And a transmission unit for transmitting the chip code data,
The authentication server includes a chip data DB for storing chip data associated with the ID and the observation means data, and a specifying means for specifying the observation means data used when the authentication object is photographed by the terminal. Specifying means for specifying the encoding method data used when encoding the image data at the terminal, and generating means for generating dummy data from the chip data by the encoding method data, When the ID and the chip code data are transmitted from the terminal device, the chip data associated with the ID and the observation means data is read from the chip data DB, and dummy data is read from the chip data by the encoding method data. Data is generated, and this dummy data is collated with the chip code data transmitted from the terminal. And the was to have authentication system determines the authenticity of the authentication object.

  In the network system according to the second aspect of the present invention, the control data of the camera corresponding to the observation means data is stored in the storage unit of the terminal device.

  In the network system according to the third aspect of the present invention, the authentication object includes a color element, an infrared reflection element, an infrared absorption element, and an infrared transmission element, and the light source emits visible light and an infrared ray. It has an LED that emits light, and the camera can detect visible light and infrared light.

In the network system according to the fourth aspect of the present invention, the terminal device and the authentication server include changing means for changing the observation means data and the encoding method data in time synchronization.
In the network system according to the fifth aspect of the invention, the terminal device inquires of the authentication server about the observation means data and the encoding method data, and generates chip code data based on the acquired observation means data and the encoding method data.

  In the network system according to the sixth aspect of the present invention, the authentication process is performed a plurality of times, and the authenticity is determined by continuously determining the trueness.

The seventh aspect of the present invention includes an ID card having a three-dimensional structure authentication object having a specific physical characteristic, an ID for specifying the authentication object, and generating means for generating chip code data from the authentication object. An authentication server having storage means for storing chip data in association with the ID, and a determination means for determining the authenticity of the authentication object by the chip code data and the chip data. In the network system of certified products
An ID input unit for acquiring the ID; a dark sky part that shields outside light; a plurality of light sources that are arranged in the dark sky part and each emit light of a different wavelength; and one of the light sources, , Observation means data for specifying one light emission pattern of a plurality of light emission patterns to be emitted by selecting a plurality of light sources having different wavelengths, a storage unit for storing a plurality of the observation means data, and the observation means data. Illumination control means for causing the light source to emit light, a camera, photographing means for causing the light source to emit light by the illumination control means, and photographing with the light, and the chip code data from image data obtained by the photographing means The terminal device in the network system is characterized by comprising the generating means for generating

  In the terminal device according to the eighth aspect of the present invention, the camera control data corresponding to the observation means data is stored in the storage unit of the terminal device.

In the ID card of the ninth invention,
A three-dimensional structure with unique physical characteristics;
An ID card for a network system according to any one of claims 1 to 4, further comprising an ID providing unit that identifies the authentication object.
The certificate is
An infrared absorbing element, an infrared reflecting element, a fluorescent element, and a color element;
These elements are assumed to be fixed by a base material that transmits light of ultraviolet to infrared wavelengths.

The network system according to the first to second aspects of the present invention relates to an authentication object authenticity determination system for determining the authenticity of an authentication object,
In the terminal device, a dark sky part that shields outside light, a plurality of light sources that are arranged in the dark sky part and each emit light of a different wavelength, one of the light sources, or one of the wavelengths Since a single light emission pattern from a plurality of light emission patterns for selecting different light sources to emit light and a storage unit for storing a plurality of observation means data to be specified are provided, it is possible to obtain light with a stable wavelength. can get.
Conventionally, when an authentication object is photographed with a camera that senses infrared light by illuminating external light such as fluorescent light or sunlight that contains a lot of infrared light, the obtained image data has become unstable.
On the other hand, in this invention, since it shields in order to minimize the influence of this external light in a dark sky part, the effect which stabilizes image data is acquired.
In addition, analysis data is obtained from the certified product, and encoding method data can be obtained from the analyzed data. However, the certified product cannot be reproduced from the chip code data or the analytical data.
Such a forgery difficulty of the certified product is a secondary effect.

In the third invention, since various elements are included in the authentication object, the image obtained according to different wavelengths changes.
Therefore, when replicating a certified product, it is required to copy the physical properties of elements (such as a sharp cut filter) included in the certified product.
However, since it is impossible to copy an authentication object having such physical characteristics by a method such as printing, forgery of the authentication object is extremely difficult.

In 4th and 5th invention, the said terminal device and the said authentication server are provided with the change means to change the said observation means data and the said encoding method data in time synchronization.
In addition, the terminal device inquires about the observation means data and the encoding method data from the authentication server, and generates chip code data based on the obtained observation means data and the encoding method data.
If the encoding method data, etc. is rewritten by such changing means or inquiries, the security attacker replays the data by using the authentication protocol executed in the past as it is and attempting “spoofing”. Even if an attack such as an attack (replay attack) is attempted, the eavesdropping data becomes invalid after a certain period of time, making it very difficult to perform “spoofing”.

In the sixth invention, by performing the authentication process a plurality of times, for example, when the light source first performs the authentication process using visible light, and further when the light source performs the authentication process using infrared light, the authentication object to be analyzed is visible. Two elements are always required, one that is observed with light and the other that is observed with infrared, but it is not possible to characterize these different elements.
Therefore, there is an effect of making it difficult to forge the certified product.

A terminal device according to a seventh aspect of the present invention is a dark sky portion that shields external light containing a large amount of infrared rays and ultraviolet rays, a plurality of light sources that are disposed in the dark sky portion and each emit light of a different wavelength, and the light source Or a storage unit for storing a plurality of observation means data for specifying one light emission pattern from a plurality of light emission patterns that emit light by selecting a plurality of light sources having different wavelengths, and the light source by the observation means data. Illumination control means for emitting light, a camera, the illumination control means for causing the light source to emit light, photographing means for photographing by the camera with this light, and generating the chip code data from image data obtained by the photographing means Since the generation means is provided, there is an effect that various stable chip code data can be obtained by using light sources having various light emission patterns.
In the terminal device according to the eighth aspect of the invention, since the camera control data corresponding to the observation means is stored, the camera can be associated with various light sources.

An ID card according to a ninth aspect of the present invention includes an authentication object having a three-dimensional structure having unique physical characteristics, and an ID providing unit that identifies the authentication object, and the authentication object emits light having a wavelength from ultraviolet to infrared. Since the base material to be transmitted, the infrared absorbing element, the infrared reflecting element, the infrared transmitting element, the fluorescent element, and the color element are fixed by the base material, each element is three-dimensionally arranged in the base material. In addition, each element can be observed with a camera.
In addition, when such a certified product is copied, it is required to copy the physical properties of the elements included in the certified product.
For example, when there are three objects, an infrared reflecting element, an infrared absorbing element, and an infrared transmitting element, even if the three objects appear black in visible light, the infrared reflecting element appears whitish when analyzed by infrared, and the infrared absorbing element is The infrared transparent element has the physical properties that appear black and appear transparent.
However, it is extremely difficult to duplicate an element having such physical characteristics by a generally known method such as printing, and forgery of a certified product is extremely difficult.

FIG. 1 is a perspective view for explaining an example of an analog chip for convenience. FIG. 2 is a schematic diagram for explaining an example of chip analysis data obtained when the illumination frequency is changed. FIG. 3 is a schematic diagram for explaining an example of chip code data obtained when the chip analysis data is encoded. FIG. 4 is a schematic diagram for explaining an example of the configuration of the ID card in the embodiment of the present invention. FIG. 5 is a diagram illustrating that the terminal device and the authentication server perform data transmission / reception via the information network. FIG. 6 is a diagram illustrating an example of the configuration of the terminal device according to the embodiment of the present invention. FIG. 7 is a diagram showing an example of the configuration of the authentication server in the embodiment of the present invention. FIG. 8 is a diagram for explaining an example of data transmitted from the terminal device to the authentication server. FIG. 9 is a first half of a flowchart for explaining an example of a series of steps for obtaining information from the ID card in the terminal device. FIG. 10 is a diagram for explaining the second half of the example of the flowchart of FIG. 9. FIG. 11 is a flowchart for explaining an example of a series of steps when authentication is performed by the authentication server. FIG. 12 is a diagram for explaining an example of a subroutine of the flowchart shown in FIG. FIG. 13 is a diagram for explaining an example of a subroutine of the flowchart shown in FIG. FIG. 14 is a cross-sectional view of an example of the terminal device 2. FIG. 15 is a diagram for explaining the relationship of data handled in the present invention.

By switching the light source stored in the terminal, a plurality of pieces of analysis data are obtained from the authentication object, and the analysis data (image data) is further encoded by a plurality of encoding methods. Get from one certified object.
A secure authentication system is constructed using the various chip code data.

Explanation of term.
“ID” is a code used to identify the authentication object.
The “chip analysis data 19” is image data captured by the camera 14 with a light source controlled based on predetermined observation means data.
The “chip code data 25” is data obtained by encoding chip analysis data based on predetermined encoding method data.
The “chip data 26” is data obtained based on the observation means data, and this chip data is stored in the chip data DB of the authentication server in association with the ID and the observation means data.
“Dummy data 27” is data generated from chip data by encoding method data.
The “encoding procedure data 20” is data that comprehensively represents the encoding method data 22, the observation means data 21, and the like.
The “light emission pattern” is a form in which light sources having different wavelengths are singly or simultaneously emitted.

In this embodiment, “visible light” refers to light emitted from a light source “LED (Light Emitting Diode)” that emits light having a wavelength of approximately 450 μm on the short wavelength side and 830 μm on the long wavelength side.
In the present embodiment, “ultraviolet rays” are light rays emitted from a light source (LED) having a peak wavelength of about 400 μm.
In the present embodiment, “infrared rays” refers to light rays emitted from a light source (LED) having a peak wavelength of approximately 950 μm.

An “element” is an “object” that constitutes an analog chip having physical characteristics.
The “authenticated object” refers to an object having a specific physical characteristic by arranging a plurality of elements at random, and is an analog chip in this embodiment.
The “total light transmitting element” is an element that transmits light in a wavelength range of approximately 100 nm to 1 mm including ultraviolet rays and infrared rays.
The “color element” is an element having a color observed mainly with visible light.
A “fluorescent element” is an element that emits visible light when excited by electrons.
An `` infrared absorbing element '' is an object that has a high ratio of absorbing infrared rays, has a color with visible light, and is an element that absorbs infrared rays and appears blackish when shot with infrared rays. Infrared reflectance refers to elements below about 5%.
In this example, carbon that looks black in infrared rays and visible rays was used for easy explanation.

An "infrared reflective element" is an object that reflects infrared rays and is an object that appears whitish by reflecting infrared rays when it is photographed by irradiating infrared rays. When an image is taken, it is an object that reflects infrared rays and appears whitish. In this embodiment, the infrared reflectance is approximately 5% or more.
In the present example, for ease of explanation, a material that looks black in visible light but appears whitish in infrared (cellulose dyed material) was used.
An “infrared transmitting element” is an object that absorbs and blocks light below visible light as much as possible and transmits infrared light having a longer wavelength than visible light as much as possible. Sharp cut filter “SC74”.
Since it has such characteristics, when it is analyzed with visible light, visible light is absorbed and blocked so it looks black, but when it is analyzed with infrared light, it is transparent because it transmits infrared light, and below it is an infrared reflective element, If there is an infrared absorbing element, it can be photographed.

The “substrate” is a material for fixing the element.
The “one-time function” is a function in which the authentication server 3 and the terminal device 2 output the same observation means data 21 and encoding method data 22 or encoding procedure data 20 including these data in time synchronization. is there.

  Further, in this embodiment, the analog card 4 and the ID providing unit 5 are provided in the ID card 1, but the shape of the ID card 1 can be adopted in various shapes without being bound by JIS standards. Needless to say.

First, the relationship between each data and the basic configuration of the authentication system in the authentication system of the present invention will be described with reference to FIG.
In the terminal device 2, data obtained in association with the ID 24 of the analog chip 4 is chip analysis data 19 and chip code data 25.
On the other hand, the authentication server 3 stores the chip data 26 in association with the ID 24 of the analog chip 4, and the dummy data 27 is obtained from the chip data 26 by the encoding method data.
Since the chip analysis data 19 and the chip data 26 are obtained from the analog chip 4 with the same observation means data 21, they are almost the same.
If the same encoding method data 22 is encoded from the chip analysis data 19 and the chip data 26, almost the same chip code data 25 and dummy data 27 are obtained.
The chip code data 25 and the dummy data 27 generated by the authentication server 3 are compared to extract a difference. If the difference is within the error due to noise or the like, it is determined that the difference is the same.
Further, the observation means data 21 and the encoding method data 22 are set as a set, and information specifying this set is set as the encoding procedure data 20.
In addition, it is preferable that this encoding procedure data is standardized and opened in the network system, so that an environment in which anyone can conduct research for improving security is prepared.

  In this system, when the chip analysis data and the chip data 26 stored in the authentication server 3 are analyzed (photographed), the relative positional relationship between the analog chip and the camera, the white balance / aperture of the camera, the LED The positional relationship of illumination, settings of illuminance, wavelength, and the like are determined in advance so as to satisfy the same conditions as necessary.

Further, as shown in FIG. 14, in the terminal device 2, a dark sky portion 52 is configured by a partition wall 53 that blocks outside light. This is because external light contains ultraviolet rays, visible rays, infrared rays, etc., so that light with wavelengths that are emitted by the LED is prevented from being mixed with light rays with unnecessary wavelengths, and stable analysis data can be obtained. It aims to be obtained.
Moreover, it is preferable that a reflector 54 whose reflectance of all light rays is defined by the standard is provided under the analog chip 4.

FIG. 1 is a perspective view for explaining an example of the analog chip 4 for convenience.
In the present embodiment, in order to facilitate understanding of the features of the physical features included in the analog chip 4, the lowermost first layer 40 is divided into the second layer 41 and the uppermost third layer 42. Elements are arranged in three dimensions.
In the first layer 40, fluorescent elements 61 and 62 and a color element 60 are arranged.
In the second layer 41, infrared absorbing elements 63 and 65 and an infrared reflecting element 67 are arranged.
In the third layer 42, the infrared absorbing element 64, the infrared reflecting element 66, and the infrared transmitting element 70 are arranged.
Each element is fixed by a base material 68 (total light transmission element).
Note that such an arrangement divided into layers is for explaining the operation of the analog chip, and the configuration of the analog chip is not limited to such a vertical relationship or layer.

FIG. 2 shows chip analysis data 19 obtained from the analog chip 4 of FIG. 1, and shows visible light 43, infrared light 44, ultraviolet light 45, visible light + infrared light 46, and ultraviolet light + infrared light 47 obtained by the following light emission pattern. Show.
Next, the chip analysis data 19 will be described.

The visible light 43 is a light emission pattern using an LED that emits visible light as a light source, and is chip analysis data obtained by photographing the analog chip 4 with a camera.
In this analysis data, the color element and the fluorescence element can be observed with color, and the infrared transmission element 70, the infrared reflection element 67, and the infrared absorption element 63 are displayed in black.

The infrared ray 44 is a light emission pattern using an LED that emits infrared rays as a light source, and is chip analysis data obtained by photographing the analog chip 4 with a camera.
In this analysis data, a star-shaped infrared absorbing element 65 located below the infrared transmitting element 70, an infrared absorbing element 64 positioned above the infrared reflecting element 67, and an infrared absorption where the infrared reflecting element 66 is whitened into a triangle. The element 63 is photographed in black.

  The ultraviolet ray 45 is a light emission pattern using an LED that emits ultraviolet rays as a light source, and is chip analysis data obtained by photographing the analog chip 4 with a camera. The fluorescent elements 61 and 62 emit light and are photographed by the camera. ing.

Visible light + infrared ray 46 is chip analysis data photographed with a light emission pattern that activates an LED that emits visible light and an LED that emits infrared light.
The ultraviolet ray + infrared ray 47 is chip analysis data photographed by operating an LED that emits ultraviolet rays and an LED that emits ultraviolet rays.
As described above, the chip analysis data 19 having a different pattern can be obtained from the analog chip 4 by changing the light emission pattern (observation method) of the LED.
The camera according to the present embodiment has a sensitivity capable of photographing about 450 μm on the short wavelength side and 950 μm on the long wavelength side.
However, it goes without saying that a camera having a wider wavelength sensitivity may be adopted depending on the elements included in the authentication object and the wavelength of the light source.

FIG. 3 is a schematic diagram for explaining the outline of the chip code data 25 obtained by encoding the chip analysis data 19 for convenience.
More specifically, cyan 49 (chip code data) and yellow 50 (chip) obtained when the original color 48 (chip analysis data) as color elements is divided into CMYK divisions (cyan, magenta, yellow, black). It is understood that chip code data 25 having different patterns can be obtained by dividing the original color 48. FIG.

  In this embodiment, the chip code data 25 is obtained by CMYK division, but various chip code data 25 is also obtained by various methods such as RGB division, edge processing, binarization, and linear processing. It goes without saying that you can get it.

FIG. 4 is a schematic diagram for explaining an example of the ID card 1 of the present invention.
The ID card 1 has an analog chip 4 and an ID providing unit 5.
The analog chip 4 is an authentication product having a specific physical characteristic. In this embodiment, the analog chip 4 is created as a part of the card, but the entire card has a specific physical characteristic. Then, a part or the whole of them may be an analog chip.
Furthermore, various modes can be adopted without being trapped by the shape of the card.

In this embodiment, the ID providing unit 5 of this embodiment provides an ID for specifying an analog chip using a two-dimensional barcode.
In addition, when the ID card issuing company and the authentication server for determining the authenticity of the analog chip 4 are independent, the card number specifying the ID card itself is provided separately from the ID providing unit specifying the analog chip. A separate section may be provided so that an ID card issuing company can independently construct an ID card management system.

  Further, as an embodiment of the ID providing unit, a barcode or the like may be used, or a small RFID (Radio Frequency Identification) may be embedded in the analog chip 4 or an ID may be provided by a magnetic stripe or IC. Needless to say, various embodiments can be adopted as necessary.

FIG. 5 is a diagram for explaining the relationship between an authentication system using a terminal device and an authentication server connected via the information network 55.
A plurality of terminal devices 2a to 2c are connected to the authentication server 3a via the information network 55 to constitute one authentication system.
Further, the authentication server 3b is connected to the terminal devices 2e to 2g, and another authentication system is configured. However, the ID card 1 can be shared in such a plurality of authentication systems.
The authentication server 3 and the terminal device 2 are preferably mutually authenticated.

In such a plurality of authentication systems, the encoding procedure data 20 can be uniquely set.
Furthermore, it is also possible to construct an authentication system having high uniqueness by adopting an LED having a specific wavelength by the authentication system and obtaining chip analysis data 19 and chip data 26 dedicated to the authentication system.

FIG. 6 is a diagram for explaining an example of the configuration of the terminal device 2 of the present invention.
The terminal device 2 includes a terminal data processing unit 6, an observation unit 7, a storage unit 8, an encoding procedure data instruction unit 9, an ID input unit 10, an input unit 11, a transmission unit 12, and a reception unit 13. And a clock 28.

The input unit 11 includes a device for inputting data such as fingerprints, irises and veins for identifying the owner of the ID card 1, and a keyboard for inputting a personal identification number (PIN) or the like. Input device.
The transmission unit 12 is a device for transmitting information to the information network 55, and the reception unit 13 is a device for receiving information from the information network 55.
The ID input unit 10 aims to read a number unique to the ID card 1 provided from the ID providing unit 5 of the ID card 1. In this embodiment, the ID input unit 10 uses the camera 14 to read a barcode or QR code ( Registered trademark).

The encoding procedure data instructing unit 9 controls the LED to obtain chip code data, observation means data 21 for obtaining chip analysis data 19, and encoding method data 22 for encoding the chip analysis data 19. The encoding procedure data 20 for associating with the camera control data 23 for controlling the camera is output.
However, depending on the configuration of the network system, the observation means data and the encoding method data may be individually output instead of the encoding procedure data.
In short, observation means data and encoding method data need only be specified.
Note that the camera control data 23 can be omitted if conditions necessary for photographing are prepared in advance.

Further, the encoding procedure data instruction unit 9 of the terminal device 2 and the encoding procedure data output unit 38 of the authentication server 3 output the same encoding method procedure data 20 based on the time data, thereby “one-time function”. It is also possible to construct
Further, the terminal device 2 makes an inquiry to the authentication server 3 and obtains the encoding procedure data 20 generated by the encoding procedure data output unit 38 of the authentication server 3. May be changed.

  As described above, when the encoding procedure data 20 is changed with the passage of time, the chip code data 25 is also changed with the passage of time, so that the previous chip code data becomes invalid. Therefore, even when the data is transmitted and received between the authentication server 3 and the terminal device 2, even if the chip code data 25 or the like is wiretapped, the data wiretapped by the attacker is neutralized after a certain period of time. Further, when the chip code data 20 whose validity has been lost is transmitted from the attacker, it is possible to grasp the unauthorized access in real time, so that the unauthorized access can be traced.

  The terminal data processing unit 6 is an MPU (Micro-Processing Unit) that includes a buffer for temporarily storing data and controls each device and calculates / processes data.

The observation unit 7 includes an illumination control unit 15 that controls a plurality of light sources “LEDs (L1 to L3)” and a camera 14, and the camera 14 records an image captured by an image sensor as digital data. In this embodiment, the signal from the CCD is AD converted and output as image data that can be processed by the MPU.
In the plurality of LEDs of this embodiment, L1 emits ultraviolet light, L2 emits visible light, and L3 emits infrared light. However, the present invention is not limited to this.

  In this embodiment, three types of LEDs are used. However, the present invention is not limited to these wavelengths and numbers. For example, light sources having various wavelengths such as emitting a part of visible light are used. It goes without saying that it is possible.

The storage unit 8 stores an encoding procedure DB 16 (database) and a terminal number 17.
The encoding procedure DB 16 includes observation means data 21 associated with the encoding procedure data 20 output from the encoding procedure data instruction unit 9 for controlling and specifying the LEDs L1 to L3 by the illumination control unit 15, and Coding method data 22 for coding the chip analysis data 21 and camera control data 23 are stored.
The camera control data 23 controls the camera so that uniform chip analysis data 19 such as “brightness”, “contrast”, “gamma”, “hue”, “brightness”, “exposure”, and “white balance” is obtained. Is stored.

The terminal number 17 stores a number unique to the terminal.
In this embodiment, the terminal number 17 is stored in the storage unit. However, since the terminal number 17 is intended to identify the terminal, the MPU processor serial number is not limited to this. -Needless to say, a number (PSN to Processor Serial Number) may be used.

FIG. 7 is a diagram illustrating an example of the configuration of the authentication server 3 according to the embodiment of the present invention. The server reception unit 30, the server data processing unit 31, the server storage unit 32, and the encoding procedure data output unit 38 are illustrated. And an output unit 39.
The server receiving unit 30 is a device for receiving information from the information network 55.
The server data processing unit 31 is an MPU (Micro-Processing Unit) that includes a buffer for temporarily storing data and controls each device and calculates and processes data.

The server storage unit 32 stores a chip data DB 35 (database) and an encoding procedure DB 36.
The chip data DB 35 is used for convenience to explain that the observation means data 21 and the chip data 26 corresponding to the observation means 21 are stored in advance in association with the ID 24. If “A1” in the data 21 is from an LED that emits infrared rays, “Ta1” in the chip data 26 corresponding to “A1” becomes image data of the infrared ray 44 shown in FIG.

Next, if “A2” of the observation means 21 emits light from the ultraviolet LED, “Tb1” of the chip data 26 corresponding to “A2” becomes image data of the ultraviolet ray 45 shown in FIG.
In this way, chip data 26 corresponding to the observation means 21 is stored.
Further, the chip data 26 associated with the ID 24 has different physical characteristics from the analog chip 4 of the ID card to which the ID 24 is assigned, so that the chip data 26 differs depending on the ID 24.
Needless to say, the number of observation means data 21 can be increased or decreased as necessary.

  Similar to the encoding procedure DB 16 stored in the storage unit 8 of the terminal device 15 that performs authentication, the encoding procedure DB 36 is associated with the encoding procedure data 20, and the observation means data 21 and the encoding method data 22 are It is remembered.

  The server transmission unit 37 is a device for transmitting data processed by the server data processing unit 31 to the information network 55.

  The encoding procedure data output unit 38 outputs the encoding procedure data 20 in time synchronization with the terminal device 2 as necessary in an authentication process described later. It is an output part which outputs the encoding procedure data 20 used in a process.

  The output unit 39 is a device for outputting the result of the authentication process to a display device or outputting data for printing.

FIG. 8 is a diagram for explaining data included in the data group 34 transmitted from the terminal device 2 to the authentication server 3. The time data 29, the terminal number 17, the encoding procedure data 20, Data, observation means data 21, ID 24, and chip code data 25 are included as necessary.
The terminal number 17 is a unique number or symbol for identifying the terminal.
The encoding procedure data 20 is data that comprehensively represents the encoding method data 22 and the observation means data 21, and the purpose thereof is to specify the observation means data 21 and the encoding method data 22. So it does not need to be sent at the same time.

The ID 24 is a number or symbol for specifying the analog chip 4.
The time data 29 is the time when the encoding method procedure data 20 is acquired by the terminal device 2.
Further, when the terminal device 2 and the authentication server 3 are provided with a one-time function for outputting the encoding procedure data 20 that is temporarily effective in time synchronization, the terminal device 2 has the terminal number 17 and the time data. 29 is transmitted to the authentication server 3, and the authentication server 3 side uses the terminal number 17 and the time data 29 to identify the encoding method data 22 and the observation means data 21 in S150 of FIG.

  Note that the data of the data group 34 is not always transmitted all the time, but when the “one-time function” that synchronizes the time between the authentication server 3 and the terminal device 2 is adopted, the encoding method data 22 and the observation means Data 21 is not transmitted. Instead, the time data 29 and the terminal number 17 may be transmitted, and it is preferable to change the contents of the data group according to other system configurations and security.

FIG. 9 is a diagram for explaining the first half of a flowchart for explaining an example of a series of steps for obtaining information from the ID card in the terminal device 2.
First, in the card detection S101, when the ID card 1 is mounted on the positioning unit 18 of the terminal device 2, the card detection is detected by a means such as a card detection switch provided in the positioning unit 18, and the information is detected by the terminal data processing. Is sent to the unit 6 and becomes the step of card detection data acquisition S102.
When the card detection data acquisition S102 detects that the ID card 1 is attached, the ID acquisition step S103 for acquiring the ID 24 from the ID input unit 10 follows.

  In the next step S104, when the encoding process data 20 is inquired to the authentication server 3 in this authentication process, the process proceeds to step S160 in FIG. 12, and when no inquiry is made, the encoding procedure data acquisition step is performed. The process proceeds to S105.

In the encoding procedure data acquisition step S <b> 105, the terminal data processing unit 6 acquires the encoding procedure data 20 from the encoding procedure data instruction unit 9 of the terminal device 2.
The encoding procedure data 20 output from the encoding procedure data instruction unit 9 may be configured to be output in time synchronization with the authentication server 3 in advance as necessary, or may be output at random. You may comprise.
In time data acquisition step S106, time data 29 is acquired from the clock 28.

Next, the processing proceeds to observation means data acquisition step S107, camera control data acquisition step S108, and encoding method data acquisition step S109 in FIG.
First, in the observation means acquisition step S107, using the encoding procedure data 20 obtained in S105, the observation means data 21 associated with the encoding procedure data 20 is stored from the encoding procedure DB 16 stored in the storage unit 8. Is stored in a buffer for temporary storage of the MPU.
Similarly, in the camera control data acquisition step S108, the camera control data 23 associated with the encoding procedure data 20 is acquired from the encoding procedure DB 16, stored in the buffer of the MPU, and further the encoding method data acquisition step. In S109, the encoding method data 22 associated with the encoding procedure data 20 is acquired from the encoding procedure DB 16, and stored in the MPU buffer.

In the next step S110, the observation means data 21 is output from the terminal data processing section 6 to the observation section 7, and the illumination control section 15 of the observation section 7 uses the L1 (LED) of the LED based on the observation means data 21. By controlling ultraviolet rays), L2 (visible rays) and L3 (infrared rays), one of “ultraviolet rays L1,” “visible rays L2,” “infrared rays L3,” “visible rays L2 + infrared L3,” “ultraviolet rays L1 + visible rays L2,” etc. Light up.
In the next step S111, the camera control data 23 is output from the terminal data processing unit 6 to the observation unit 7, and the camera 14 is controlled to a state corresponding to the observation method.
In step S <b> 112, chip analysis data is output from the camera 14, and chip analysis data 19 is acquired by the terminal data processing unit 6.

In step S113, chip code data 25 is generated from the chip analysis data 19 by using the coding method data 22 obtained from the chip analysis data 19 in step S109.
In step S114, the terminal number 17 for specifying the terminal is stored in the buffer of the terminal data processing unit 6.

In step 115, the data group 34 shown in FIG. 8 which is data stored in the buffer of the terminal data processing unit 6 is processed according to a predetermined protocol.
The data of the data group 34 is not always transmitted all the time, but when the time is synchronized between the authentication server 3 and the terminal device 2, the encoding method data 22 and the observation means data are excluded from the data group 34. It is desirable to change the contents of the data group according to other system configurations and security.
In step 116, the data group 34 is transmitted to the authentication server 3 via the information network 55.

FIG. 11 is a flowchart for explaining an example of a series of steps when authentication is performed by the authentication server.
In step S <b> 130, the server receiver 30 receives the data group 34 from the terminal device 2.
In step S131, analysis of the transmitted data is started by the communication protocol.
In step S <b> 132, ID 24 is acquired from the data group 34.
In step S <b> 133, chip code data 25 is acquired from the data group 34.
In step S134, if there is no observation means data 21 / encoding method data or encoding procedure data 20 for specifying these data in the data group 34, the procedure proceeds to encoding procedure data income step S150 in FIG. If these data exist, the process proceeds to the next step S135.

Step S135 is a step in which the server data processing unit 31 acquires the chip data 26 from the chip data DB 35 of the server storage unit 32, and the chip data 26 associated with the ID 24 and the observation means data 21 of the data group 34 is chipped. Read from the data DB 35.
In step S136, dummy data 27 is generated from the chip data 26 read in S135 by the encoding method data 22 obtained in a series of steps.

In step S137, the difference between the chip code data 25 and the dummy data 27 is compared and extracted. If they are within the error range, they are determined to be the same.
In step S138, whether or not the analog chip 4 can be authenticated is transmitted to the terminal device 2, and the series of authentication steps is completed.

  FIG. 12 is a subroutine when the terminal device 2 inquires the encoding procedure data 20 to the authentication server 3 in S104 of FIG.

In step S <b> 160, the terminal device 2 transmits data for inquiring the terminal number 17 and the encoding procedure data 20 to the authentication server 3 via the transmission unit 12.
In step S161, the server data processing unit 31 of the authentication server 3 processes the data received from the terminal device 2, and requests the encoding procedure data output unit 38 from the encoding procedure data output unit 38.

In step S162, the encoding procedure data 20 is randomly output from the encoding procedure data output unit 38.
In step S163, the output encoding procedure data 20 and the like are processed, and the encoding procedure data 20 is output to the terminal data processing unit 6 of the terminal device 2. Further, the encoding procedure output in S162 of this authentication process is output. The data 20 is output to the server storage unit 32.
In step S164, the encoding procedure data 20 transmitted from the authentication server 3 is received, and the process proceeds to step S107 in FIG.
Step S165 is a step of storing in the server storage unit 32 the encoding procedure data 20 output by the authentication process of the present embodiment in the server storage unit 32.

  FIG. 13 is a diagram for explaining an example of a subroutine of the flowchart shown in FIG. 11. In step S134 of FIG. 11, the observation means data 21 and the encoding method data are stored in the data group 34 from the terminal device 2. 22 or a subroutine executed when there is no encoding procedure data 20 and the “one-time function” is adopted in this authentication process.

Step S150 of this subroutine is a step in which the server data processing unit 31 inquires the encoding procedure data output unit 38 about the encoding procedure data 20.
When the one-time function is adopted in the authentication process, the time data 29 and the terminal number 17 obtained in step S106 shown in FIG. 9 are included in the data group 34 transmitted from the terminal device 2, Based on the time data 29 and the terminal number 17, the encoding procedure data 20 in which the terminal device 2 and the authentication server 3 are time-synchronized is derived from the encoding procedure data output unit 38.
In this time synchronization, the data group 34 does not include time data, the time when the server reception unit 30 of the authentication server receives the data group 34 is adopted, and this time is acquired by the terminal device 2. However, in this case, a time lag occurs between the time when the terminal device 3 acquires the time data 29 and the time when the authentication server 3 receives the data group 34. When the time lag is corrected or an authentication error occurs, it is preferable to perform re-authentication by using the encoding procedure data 20 corresponding to the previous and subsequent times.

In the next step S151, the server data processing unit 31 extracts the observation unit data 21 associated with the encoding procedure data 20 from the server storage unit 32, and acquires the observation unit data 21.
In step S152, the server data processing unit 31 extracts the encoding method data 22 associated with the encoding procedure data 20 from the server storage unit 32, and acquires the encoding method data 22.
Then, the process proceeds to step S135 shown in FIG.
Note that the steps of this embodiment are for explanation, and it goes without saying that the order of the steps may be changed or the steps may be omitted as long as they are within the scope of the present invention.

  As a method for further enhancing the anti-counterfeiting effect of the analog chip 4, there are luminescent ink, thermochromic ink, photochromic ink, etc. as a device for the ink itself. There are inks, pearl inks, inks containing synthesized special crystal pigments, and the like, and there are methods such as employing elements constituted by such inks.

  In this embodiment, “visible light”, “infrared”, “visible light + infrared”, and “ultraviolet light + infrared” are adopted as the light emission pattern. However, the LED that emits a specific wavelength in the visible light is not limited to this light emission pattern. Of course, it is possible to adopt a light emission pattern different from these by employing laser light.

In this embodiment, the authentication object is provided in the ID card. However, the authentication object can be formed into various shapes without being restricted by the shape of the ID card.
In particular, the functions of the ID providing unit 5 and the analog chip 4 may be concentrated on the long side or short part of the card, and the other parts may be omitted to reduce the shape.

  In this embodiment, the authentication of the card user, such as biometric authentication and input of a personal identification number, was not described in the authentication process, but this does not deny adding such personal authentication to the authentication of the authenticity. Absent.

  In addition, since multiple analysis methods and encoding methods can be adopted for the authentication object, the analysis method and the encoding method are encoded by the “one-time function” for setting and updating the valid time for each terminal and the terminal. An authentication protocol that synchronizes between the authentication server and the terminal can be constructed as required by a method such as a “counter synchronization method” that synchronizes the number of times the method is updated.

  The present invention relates to a system for determining the authenticity of a certified product in a network, and provides security by providing a terminal device that can stably obtain various analysis data from the certified product and a network system that employs this terminal device. Further, it is possible to build a multi-authentication system that can use one authentication object in a plurality of authentication systems.

1 ID card 2 Terminal device 3 Authentication server 4 Analog chip (certified product)
52 Dark Sky

Claims (9)

A three-dimensional structure with unique physical characteristics;
An ID card having an ID for identifying the authentication object;
A terminal device comprising a generating means for generating chip code data from the authentication object;
An authentication server having storage means for storing chip data in association with the ID;
In the network system having an authentication determination system, wherein the authentication server determines the authenticity of the authentication object based on the chip code data and the chip data.
The terminal device
An ID input unit for acquiring the ID;
A dark space that blocks outside light,
A plurality of light sources arranged in the dark sky part, each emitting light of a different wavelength;
Observation means data for specifying one light emission pattern from a plurality of light emission patterns that emit light by selecting one of the light sources or a plurality of light sources having different wavelengths, and
A storage unit for storing a plurality of the observation means data;
Illumination control means for causing the light source to emit light according to the observation means data;
A camera,
Photographing means for photographing the light of the light source emitted by the observation means data with the camera as illumination;
A plurality of generating means for generating different chip code data from the image data obtained by the photographing means;
A storage unit for storing encoding method data for specifying the generation unit;
A transmitter that transmits the ID and the chip code data;
The authentication server is
A chip data DB for storing chip data associated with the ID and the observation means data;
A specifying means for specifying the observation means data used when the authentication object is photographed by the terminal;
Specifying means for specifying the encoding method data used when encoding the image data in the terminal;
Generating means for generating dummy data from the chip data by the encoding method data;
When the ID and the chip code data are transmitted from the terminal device, the chip data associated with the ID and the observation means data is read from the chip data DB, and the coding method data is read from the chip data. The network system according to claim 1, further comprising: an authenticity determination system that determines the authenticity of the authentication object by generating dummy data and comparing the dummy data with the chip code data transmitted from the terminal.   The network system according to claim 1, wherein control data of the camera corresponding to the observation means data is stored in a storage unit of the terminal device. In the certified product,
Color elements,
An infrared reflective element;
An infrared absorbing element;
An infrared transmission element,
In the light source,
An LED that emits visible light;
An LED that emits infrared light,
The network system according to claim 1, wherein the camera is capable of sensing visible light and infrared light. In the terminal device and the authentication server,
4. The network system according to claim 1, further comprising changing means for changing the observation means data and the encoding method data in time synchronization.   4. The terminal device according to claim 1, wherein the terminal device inquires of the authentication server about the observation unit data and the encoding method data, and generates chip code data based on the obtained observation unit data and the encoding method data. The network system according to any one of the above.   6. The network system according to claim 1, wherein authenticity is determined by performing an authentication process a plurality of times and continuously determining whether the authentication process is true. A three-dimensional structure with unique physical characteristics;
An ID card having an ID for identifying the authentication object;
A terminal device comprising a generating means for generating chip code data from the authentication object;
An authentication server having storage means for storing chip data in association with the ID;
In the authentication object network system, the authentication server includes a determination unit that determines the authenticity of the authentication object based on the chip code data and the chip data.
An ID input unit for acquiring the ID;
A dark space that blocks outside light,
A plurality of light sources arranged in the dark sky part, each emitting light of a different wavelength;
Observation means data for specifying one of the light sources, or one of the plurality of light emission patterns that emit light by selecting a plurality of light sources having different wavelengths;
A storage unit for storing a plurality of the observation means data;
Illumination control means for causing the light source to emit light according to the observation means data;
A camera,
Photographing means for causing the light source to emit light by the illumination control means, and for the camera to photograph with this light;
A terminal device in the network system, comprising: the generating unit that generates the chip code data from image data obtained by the photographing unit.   8. The terminal device according to claim 7, wherein control data of the camera corresponding to the observation means data is stored in a storage unit of the terminal device. A three-dimensional structure with unique physical characteristics;
An ID card for a network system according to any one of claims 1 to 4, further comprising an ID providing unit that identifies the authentication object.
The certificate is
An infrared absorbing element, an infrared reflecting element, a fluorescent element, and a color element;
An ID card characterized in that these elements are fixed by a base material that transmits light of ultraviolet to infrared wavelengths.

Images