JP2013080267A - Authentication device and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reinforce security and enhance user's usability in an authentication device.SOLUTION: When division information stored in an information terminal indicates that "divide a display area into 4 sub areas", a user may perform touch operations on a touch panel 107 to draw trajectories of two lines 931 and 932 shown in Fig. (A), input trajectories of lines which do not cross with each other such as lines 941, 942 and 943 shown in Fig. (B), or perform touch operations along lines 951, 952 and 953 including the curved line 953 shown in Fig. (C). In any situation, information is input to divide the display area into 4 sub areas, as a result, it is determined that the user has succeeded in user authentication.

Description

  The present invention relates to an authentication apparatus and an authentication method, and more particularly to an authentication apparatus and an authentication method for performing user authentication based on information input from the outside.

  Conventionally, user authentication has been performed electronically in order to permit access to a website.

  In the technology related to user authentication, for example, a user name and password are registered in advance in an authentication device, the user is prompted to input a user name and password, and if the registered and the inputted one match, the authentication is successful. There was something to do.

  In addition, in such a technique, the user had to remember his / her user name and password, and there was a problem that it was complicated for the user.

  In recent years, a technique for performing user authentication by displaying an image on a display unit at the time of authentication and inputting information corresponding to the image has been disclosed in order to eliminate such complications for the user.

  As such a technique, as described in Non-Patent Document 1, for example, an object is displayed on a screen, and authentication is performed based on appropriateness such as a point touching the object and its order, or non-patent As described in Document 2, there are some cases where a plurality of points are displayed on the screen, and authentication is performed based on the suitability of the tracing method (pattern) of the plurality of points.

SFR GmbH, “SFR Password Screenshots”, [online], [October 2, 2009 search], Internet <http://www.sfr-software.de/cms/EN/pocketpc/viskey/screenshots.html> CNET News.com Staff, “Photo report:“ Android ”features”, May 29, 2008 [online], [October 2, 2009 search], Internet <http: / /builder.japan.zdnet.com/news/story/0,3800079086,20374208-7,00.htm>

  As described above, according to the technology for performing user authentication based on whether or not the screen is touched in the same pattern as the registered pattern for the displayed image, the user has no meaning (can be associated with other matters). Difficult) The sequence of actions such as stroking the nose of multiple dolphins displayed on the screen in order from the left instead of a character string such as a password, etc., and the same as your initials as a trace that traces multiple points displayed on the screen User authentication can be performed using items that are relatively easy to remember by being associated with other items, such as the trajectory of the alphabet.

  However, the user's input action of touching the screen with a specific pattern has caused a new problem that the contents are easily estimated by a third party who has seen the action.

  Here, if the pattern required for the user to input for authentication is complicated so that it is difficult for a third party to estimate, there is a situation where the user is difficult to remember the pattern and is complicated for the user.

  In other words, with the conventional technology, if it is attempted to input authentication information in a short time and easily, the content may be easily estimated by a third party, and the security strength cannot be ensured. In this case, there is a problem that it is complicated for the user.

  The present invention has been conceived in view of such circumstances, and an object thereof is to achieve both security strength and user convenience in an authentication apparatus.

  An input area for inputting information according to the present invention, a storage unit for storing information related to division of the input area, an input unit for inputting information to the input area, and information input to the input unit A generation unit that generates information for dividing the input area based on the information, and a determination unit that determines whether the information generated by the generation unit matches the information stored in the storage unit.

In the authentication device according to the present invention, the input area is a display unit that displays information,
The storage unit preferably stores information related to the division of the input area in association with the information displayed in the input area.

  In the authentication device according to the present invention, the information related to the division of the input area stored in the storage unit is the number of areas into which the input area is divided, or the area that exists by dividing the input area. It is preferable that the display contents are different.

  In the authentication device according to the present invention, the input unit is a touch panel, and the generation unit displays a closed graphic passing through the plurality of points when information specifying the plurality of points is input to the input unit. It is preferable to produce.

  Further, in the authentication device according to the present invention, the generation unit uses the input line for input so that the line input to the input unit reaches the end of the input area when the line does not reach the end of the input area. It is preferable to generate an image of a line that extends to the edge of the region.

  An authentication method according to the present invention is a method for performing authentication in an authentication device including an input area, the step of storing information related to the division of the input area, the step of accepting input of information to the input area, The method includes the steps of generating information for dividing the input area based on the received information, and determining whether the generated information matches the stored division information.

  According to the present invention, the information that the user needs to input at the time of authentication may be information for dividing the input area, and may not be information specifying a specific part in the object. . That is, for example, when the information that the user needs to input is “information for dividing the input area into three areas”, the information that the user needs to input is the input area vertically Information that is divided into three parts or information that is divided into three parts horizontally may be used.

  For this reason, the information which requires input can be made highly flexible. From this, the user can change the operation of inputting information each time, so that it is difficult for a third party who sees the act of inputting the information to guess what the user is inputting. .

  Therefore, in the authentication apparatus, the security strength can be improved without complicating the contents that require the user to input for authentication.

It is a figure for demonstrating the whole structure of the information terminal which is 1st Embodiment of the authentication apparatus of this invention. It is a figure which shows the hardware constitutions of the information terminal of FIG. It is a control block diagram of the information terminal of FIG. It is a flowchart of the main routine performed in the information terminal of FIG. 5 is a flowchart of a subroutine of authentication information registration processing of FIG. 4. 5 is a flowchart of a user authentication processing subroutine of FIG. 4. It is a figure which shows an example of the image for authentication displayed in the user authentication process of FIG. It is a figure which shows an example of the image displayed in the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is 2nd Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is 2nd Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is a modification of 1st Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is a modification of 1st Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the case where a user authentication fails in the information terminal which is 1st Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating an example of the interpolation aspect of the data in the authentication apparatus of this invention.

  Embodiments of the present invention will be described below with reference to the drawings. In each figure, elements having the same function are denoted by the same reference numerals, and description thereof will not be repeated.

[1. First Embodiment]
[1-1. Schematic configuration of information terminal]
FIG. 1 shows an appearance of an information terminal 100 that is the first embodiment of the authentication apparatus of the present invention.

  The information terminal 100 has a display unit 110 on its main surface. Display unit 110 is configured by a general display device such as an LCD (liquid crystal display).

  Below the display unit 110 on the main surface of the information terminal 100, four operation buttons 112 to 115 are provided. The function assigned to each of the operation buttons 112 to 115 can be changed according to the type of application being executed on the information terminal 100 and the state in which the application is being executed.

  On the right side surface of the information terminal 100, a power button 111 for switching ON / OFF of power-on of the information terminal 100 is provided. A card slot 120 for inserting a recording medium such as a memory card into the main body of the information terminal 100 is provided on the lower surface of the information terminal 100.

  In addition, the information terminal 100 includes a touch pen 190 that is separated from the main body of the information terminal 100.

[1-2. Hardware configuration of information terminal]
FIG. 2 is a control block diagram of the information terminal 100 of FIG.

  Referring to FIG. 2, information terminal 100 stores a CPU (Central Processing Unit) 101 that controls the entire terminal, a RAM (Random Access Memory) 102 that temporarily stores data, a program, a constant, and the like. A ROM (Read Only Memory) 103, a hard disk drive (HDD) 104 for storing image data, and a communication interface (I / F) 105 for connecting to a network for communication with other devices , The input unit 106 for the operation buttons 112 to 115 and the power button 111, the touch panel 107 provided in contact with the display unit 110, and the card reader 108.

  The card reader 108 reads and / or writes information with respect to the recording medium inserted into the card slot 120.

[1-3. Block configuration of information terminal]
FIG. 3 is a control block diagram of the information terminal 100.

  With reference to FIG. 3, in information terminal 100, when operation is performed on touch panel 107 and / or operation keys 112 to 115, the input determination unit 151 detects that the operation has been performed and the content thereof. In the information terminal 100, the information input unit 150 is configured by the touch panel 107, the operation keys 112 to 115, and the input determination unit 151.

  The display control unit 155 controls the display content of the display unit 110 via the drawing control unit 156, and stores the screen data displayed on the display unit 110 in the second storage unit 153.

  In the present embodiment, information used for user authentication is referred to as authentication information. The authentication information includes an authentication image displayed on the display unit 110 at the time of user authentication, and division information that is information for specifying a mode for dividing the authentication image with respect to the authentication image. . The authentication information generation unit 152 stores the authentication image in the first storage unit 158 and stores the division information in the third storage unit 157.

  In the information terminal 100, the input determination unit 151, the authentication determination unit 154, the display control unit 155, the drawing control unit 156, the authentication information generation unit 152, and the input information generation unit 159 are stored in the HDD 104 or the like. It is realized by executing the program. Each unit may be realized by a dedicated hardware component such as a dedicated LSI (Large-Scale Integration) having an equivalent function.

[1-4. Main routine]
FIG. 4 is a flowchart of a main routine executed in information terminal 100 of the present embodiment. The main routine is started by operating the power key 111 from the state where the information terminal 100 is powered off.

  Referring to FIG. 4, first, in step S <b> 1, CPU 101 has operated another key (any of operation keys 112 to 115) during operation of power key 111 that is a condition for starting the main routine. If it is determined that it has been operated, the process proceeds to step S2, and if it is determined that it has not been operated, the process proceeds to step S3.

  In step S2, the CPU 101 executes an authentication information registration process and proceeds to step S4. Details of the authentication information registration process will be described later.

  In step S3, the CPU 101 executes a user authentication process and advances the process to step S4.

  In step S4, the CPU 101 determines whether or not an operation for turning off the information terminal 100 has been performed. If it is determined that the operation has not been performed, the process proceeds to step S5.

  In step S5, the CPU 101 executes a process according to the content of the operation on the information terminal 100, and advances the process to step S4.

  In the information terminal 100, the process of step S5 is continued until an operation for turning off the power is performed. If the CPU 101 determines in step S4 that an operation to turn off the power has been performed, the CPU 101 ends the process.

[1-5. Authentication information registration process]
FIG. 5 is a flowchart of a subroutine of authentication information registration processing in step S2.

  Referring to FIG. 5, in the authentication information registration process, CPU 101 registers information for specifying the authentication image in first storage unit 158 in step S21, and advances the process to step S22.

  Here, the authentication image may be specified by information input by a user who operates the information terminal 100, or the CPU 101 stores it in a storage device such as the HDD 104 or another device on the network using a random number or the like. It may be configured to select from the images that are displayed.

  In step S22, the CPU 101 registers the above-described division information in the third storage unit 157, and returns the process to FIG.

  The division information may be generated and registered based on the operation content on the touch panel 107 and the operation keys 112 to 115, or information selected by the CPU 101 using a random number or the like may be registered.

  Further, the division information can be, for example, information on how many areas the display unit 110 is divided into.

[1-6. User authentication process]
FIG. 6 is a flowchart of a subroutine of the user authentication process in step S3.

  In the user authentication process, first, in step S31, the CPU 101 acquires the authentication image stored in the first storage unit 158, and the display control unit 155 advances the process to step S32.

  In step S32, the display control unit 155 sends the authentication image acquired in step S31 to the drawing control unit 156, causes the display unit 110 to display the image, and proceeds to step S33.

  In step S33, the CPU 101 activates the input device (touch panel 107 and operation keys 112 to 115), and the process proceeds to step S34.

  In step S34, the process waits until there is an input to the input device. In step S35, it is determined whether or not an input has been made. If it is determined that an input to the input device has been made, the process proceeds to step S36.

  In step S36, the display control unit 155 updates the display content of the display unit 110 based on the information input to the touch panel 107, and the process proceeds to step S37.

  In step S37, the input determination unit 151 determines whether or not the input of information to the touch panel 107 has been completed. If it is determined that the input has not been completed, the process returns to step S34, and if it is determined that the input has been completed, the process proceeds to step S38. To proceed. In step S37, for example, a condition that an operation key (any one of the operation keys 112 to 115), which is a condition for completing the input, is operated, or an input to the touch panel 107 is not continuously performed for a predetermined time. It is determined that the input has been completed.

  In step S38, the input information generation unit 159 generates information for dividing the display unit 110 based on the information input to the touch panel 107, and the process proceeds to step S39.

  In step S39, the authentication determination unit 154 compares the input information generated by the input information generation unit 159 in step S38 with the division information stored in the third storage unit 157, thereby obtaining the result of user authentication. The authentication determination result is displayed on the display unit 110, the user authentication process is terminated, and the process returns to FIG.

  When the process returns to FIG. 4, if the result of the authentication process in step S39 is an authentication success, the process proceeds to step S4 and subsequent steps, but if the authentication fails, the process does not proceed to step S4 and subsequent steps. An error notification or the like is made.

[1-7. Display contents in user authentication processing]
Here, the content of the user authentication process described with reference to FIG. 6 will be described in more detail together with the change in the display content on the display unit 110.

  FIG. 7 is a diagram illustrating an example of an authentication image displayed on the display unit 110 in step S32 in the user authentication process. The authentication image 990 in FIG. 7 includes an image of the watermelon 900.

  FIG. 8 is a diagram showing the screen updated to add an input locus to the touch panel 107 in step S36.

  Referring to FIG. 8, on screen 991 displayed on display unit 110, two lines 901 and 902 are added and displayed in addition to image 990 shown in FIG. Lines 901 and 902 represent two linear trajectories input to the touch panel 107.

  Next, generation of input information in step S38 from two linear trajectories represented by lines 901 and 902 will be described.

  9 shows a virtual state in which only the lines 901 and 902 shown on the screen 990 in FIG. 8 are displayed on the display unit 110 with the watermelon 900 omitted.

  The input information generation unit 159 interpolates each of the two lines 901 and 902 input to the touch panel 107 using a well-known method such as a Lagrangian interpolation method, so that each of the lines up to the end of the display unit 110 is obtained. Interpolate the data so that the line reaches it.

  FIG. 10 shows a state where the line 901 is interpolated. The interpolated portion is indicated by a broken line.

  Further, FIG. 11 shows a state where the line 902 is also interpolated. In FIG. 11, a portion extended by interpolation is indicated by a broken line.

  Then, the input information generation unit 159 is an area in which the display area of the display unit 110 is divided by the locus of input to the touch panel 107 and the line obtained by interpolating the locus as shown in FIG. Calculate the number. In the example shown in FIG. 11, the display area of the display unit 110 is divided into four areas.

  In step S39, the authentication determination unit 154 determines the number of areas acquired by the input information acquisition unit 159 in the manner described with reference to FIG. 11 and the areas stored in advance in the third storage unit 157. The numbers are compared, and if they match, it is determined that the user authentication has succeeded, and if they do not match, it is determined that the user authentication has failed.

  In step S <b> 39, a determination result regarding user authentication by the authentication determination unit 154 is displayed on the display unit 110.

[1-8. Modification of processing of input information generation unit]
As described above with reference to FIGS. 10 and 11, if two lines obtained as the locus of the touch operation on the touch panel 107 intersect, as described with reference to FIG. 11. By interpolating the lines of the trajectories, information for dividing the display unit 110 can be generated.

  Note that, as shown as lines 911 and 912 in FIG. 12, the end of one line 911 is in contact with the other line 912 in the locus of two lines obtained as the locus of the touch operation. For example, two types of interpolation modes can be considered.

  First, as shown in FIG. 13, the display area of the display unit 110 is divided into three without interpolating data at the end of the line 911 that is in contact with the line 912. To do.

  Second, as shown in FIG. 14, the end of the line 911 that is in contact with the line 912 is also interpolated in the same manner as the end of the non-contacting end. The display area of the display unit 110 is divided into four.

  Which interpolation mode is used in the information terminal 100 may be set in advance in the information terminal 100, or may be set based on information input to the input device by the user.

[1-9. Division mode for inputting division information]
In the present embodiment described above, it is only necessary to input information for dividing the display area of the display unit 110 such that the division information stored in the third storage unit 157 is generated.

  That is, for example, when the division information stored in the third storage unit 157 is “dividing the display area of the display unit 110 into four”, the line 931 shown in FIG. The touch panel 107 may be touch-operated to draw the trajectory of two lines 932, or the trajectories of lines 941, 942, and 943 that do not intersect each other may be input as shown in FIG. Further, as shown in FIG. 18C, a touch operation along lines 951, 952, and 953 including a curve 953 may be performed. Since either input is an input of information for dividing the display area of the display unit 110 into four, it is determined that the input information matches the information for division, and it is determined that the user authentication is successful.

[2. Second Embodiment]
In the first embodiment described above, the number of divided areas generated by dividing the display area of the display unit 110 is set as the authentication information.

  In the present embodiment, an image including a plurality of objects is displayed on display unit 110, and the division information is divided so that a specific condition is satisfied for the image displayed on display unit 110. The image displayed on the display unit 110 can be divided so as to generate a closed region.

  Here, the specific condition is, for example, to include only a specific object in the selected area among the objects displayed on the display unit 110, or classify the objects into a plurality of groups. The selection area is generated so that objects of a certain group are accommodated but objects of another group are not included.

  For example, in the latter case, the information on the authentication image stored in the first storage unit 158 includes information for displaying the image 980 in FIG.

  Referring to FIG. 19, an image 980 is an image including six objects of watermelon 961, pineapple 962, melon 963, cherry 964, apple 965, and orange 966.

  The first storage unit 158 stores information about each object as shown in Table 1, for example.

  Table 1 stores information (display label) that defines image information and display position of each object.

  The division information stored in the third storage unit 157 includes, for example, grouping information for displayed objects as shown in Table 2.

  In the example shown in Table 2, object number 5 “apple” (apple 965 in FIG. 19) and object number 6 “orange” (orange 966 in FIG. 19) are grouped into group number “1”. It is divided. Further, “pineapple” of object number 2 (pineapple 962 in FIG. 19) is grouped into group number 2.

  As the division information in the third storage unit 157, conditions for dividing the region including the relationship between these groups are further stored. As an example of such a condition, for example, “to generate a divided region that accommodates objects of group 1 and does not accommodate objects of group 2” can be cited.

FIG. 20 shows a region that satisfies such a condition.
Referring to FIG. 20, similar to image 980 in FIG. 19, image 981 shows six objects such as watermelon 961, and touch panel 107 is operated with image 981 displayed on display unit 110. The trajectory of the region 981A input by this is shown.

  The area 981A includes all the objects classified in the group number 1 in Table 2 (that is, the apple 965 and the orange 966), but the object of the group number 2 (the pineapple 962) represents the entire object. Not included.

[3. Other modifications]
In the image 982 in FIG. 21, six objects including the watermelon 961 are displayed, as in the image 980 in FIG. Further, the image 982 shows a locus input by a touch operation on the touch panel 107 when the image 982 is displayed on the display unit 110.

  The closed region 982A constituted by the locus includes melon 963 and the whole of the apples 965 and orange 966 of group number 1 in Table 2, and at least for the pineapple 962 of group number 2 A part is located outside the locus 972. Accordingly, it is determined that the information generated by the input information generation unit 159 matches the division information stored in the third storage unit 157 in the same way as the locus 971 in FIG. Judge as successful.

  Note that in the information terminal 100, the input information generation unit 159 receives a plurality of points when information specifying a plurality of points as indicated by points P1 to P8 in FIG. A closed figure shown as the region 981 may be generated by an existing interpolation method using Lagrangian (Lagrange interpolation method or the like) to perform user authentication.

[4. Example when user authentication fails]
In the image 983 in FIG. 23, six objects such as the watermelon 961 are displayed, as in the image 980 in FIG.

The image 983 includes a region 983A. An area 983A is a locus of a touch operation performed on the touch panel 107 when the image 983 is displayed on the display unit 110, and is generated by the input information generation unit 159.
In FIG. 23, at least a part of apples 965 and orange 966 that are objects classified into group number 1 is not included in region 983A. Thus, even if the image 983 is divided by the region 983A, the conditions stored in Table 2 cannot be satisfied.

  Therefore, in such a case, the authentication determination unit 154 determines that the information stored in the second storage unit 153 and the information stored in the third storage unit 157 (dividing information) do not match, and performs user authentication. Judge that it failed.

[5. Interpolation of input data]
In the present specification described above, interpolation of data input based on a touch operation or the like has been described with reference to FIG.

  As another mode of data interpolation, as shown as a locus 985 in FIG. 24, there is an interpolation when the input locus is not continuous.

  In such a case, portions close to each other can be interpolated by Lagrange interpolation or the like to form a continuous locus.

  In FIG. 24, lines generated by the separation are indicated by broken lines 985A to 985D. The locus 985 can form a closed region together with the end portion of the display unit 110 by connecting the fragmented portions with broken lines 985A to 985D. Specifically, a closed region is configured by a line formed by a locus 985 connected by broken lines 985A to 985D and an end portion of the lower right portion of the display unit 110, and the closed region includes apples 965 and The whole orange 966 is included.

[6. Other modifications]
In each embodiment described above, information for dividing the display area of the display unit 110 is input to the information terminal 100 as information for dividing the area.

  In the recognition device according to the present invention, the information for dividing the area may not be input to the display device such as the display unit 110.

  For an input area of an input device that is not a display device, such as a touch pad, information for dividing the area may be input. In this case, information for dividing the area (for example, “divide into four areas”) is stored in advance in the information terminal 100 as the authentication information. And the input of the information which divides | segments an area | region with respect to input devices, such as a touchpad, is received from a user. Whether or not the user authentication is successful is determined based on whether or not the input information matches the information stored in advance.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

  100 information terminal, 101 CPU, 102 RAM, 103 ROM, 104 HDD, 105 communication I / F, 106 input unit, 107 touch panel, 108 card reader, 110 display unit, 150 information input unit, 151 input determination unit, 152 for authentication Information generation unit, 153 second storage unit, 154 authentication determination unit, 155 display control unit, 156 drawing control unit, 157 third storage unit, 158 first storage unit, 159 input information generation unit, 990 authentication image.

Claims (6)

An input area for entering information;
A storage unit for storing information related to the division of the input area;
An input unit for inputting information into the input area;
A generating unit that generates information for dividing the input area based on information input to the input unit;
An authentication apparatus comprising: a determination unit that determines whether information generated by the generation unit matches information stored in the storage unit. The input area is a display unit that displays information;
The authentication device according to claim 1, wherein the storage unit stores information related to the division of the input area in association with information displayed in the input area.   The information related to the division of the input area stored in the storage unit includes the number of areas into which the input area is divided, or a set of display contents that are different from each other by dividing the input area. The authentication device according to claim 2, wherein The input unit is a touch panel,
The authentication according to any one of claims 1 to 3, wherein when the information specifying a plurality of points is input to the input unit, the generation unit generates a closed graphic that passes through the plurality of points. apparatus.   The generation unit extends the input line to the end of the input region so that the line input to the input unit does not reach the end of the input region so that the line reaches the end. The authentication device according to claim 1, wherein an image of a line to be generated is generated. A method for performing authentication in an authentication device having an input area,
Storing information relating to the division of the input area;
Receiving information input to the input area;
Generating information that divides the input area based on the information that has received the input; and
Determining whether the generated information matches the stored information relating to the division.

Images