JP2013127662A - Input information authentication device, server, input information authentication system, and program for the device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it difficult to infer authentication information even when a third party sees the input operation or input screen during the input of the authentication information.SOLUTION: Each of multiple keys is assigned to a first state or a second state to be presented to a user. The information corresponding to a key operated when a pre-registered key of multiple keys is in the first state is used for authentication, and the information corresponding to a key operated when the pre-registered key is in the second state is not used for authentication.

Description

  The present invention, for example, receives input of authentication information such as a personal identification number, collates the input contents with previously registered authentication information, and performs an input information authentication device for performing authentication that is a determination as to whether or not they match. The present invention relates to a server device, an input information authentication system, and a device program.

  As a technique to prevent the authentication information from being stolen when inputting, narrowing the viewing angle of the display screen or displaying the input number with "*" mark etc. to indicate only the number of input digits Has been done.

  In addition, as a PIN code input device that allows a user to input a PIN code using a numeric keypad from a terminal such as a financial automatic machine (ATM), an input numeric keypad screen and a fake input numeric keypad screen are displayed. In some cases, the password is prevented from being stolen even when the movement of the input hand is seen by being inserted (see, for example, Patent Document 1).

Japanese Patent No. 2985888

  However, the above-described conventional technology for preventing snooping such as Patent Document 1 assumes that a third party is located at some distance away, such as a financial automatic machine (ATM), for example. It wasn't even taken into account even when it was seen from a distance by a third party. That is, information indicating whether the user wants to input a dummy number or a password is presented on a fake input numeric keypad. For this reason, for example, when the input screen itself is viewed as well as the movement of the input user's hand, such as over the shoulder of the input user or a hidden camera, which input is dummy There is a risk that the password will be identified and the password will be known.

  The present invention has been made in view of such a situation, and even when a hand and an input screen are viewed from a third party when inputting authentication information, it is possible to make it difficult to guess the authentication information. An object is to provide an information authentication device, a server device, an input information authentication system, and a program for the device.

In order to achieve such an object, an input information authentication apparatus according to the present invention includes:
An input information authentication device for performing authentication, which is a determination that information corresponding to an operated key of an input unit having a plurality of keys is compared with authentication information stored in advance,
Each of the plurality of keys is assigned to either the first state or the second state,
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for authentication and corresponds to the key of the input means operated when the predetermined key is in the second state The information to be used is not used for authentication.

Moreover, the server device according to the present invention provides:
A server device used by being connected to an input information authentication device by wire, wireless, or a combination thereof,
Provided with a display input control means for controlling the input information authentication device,
The input information authentication device has an input means for performing key input, and a communication means for receiving control by the display input control means,
The input means has a plurality of keys,
The display input control means
Assign each of the plurality of keys to either the first state or the second state;
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for authentication and corresponds to the key of the input means operated when the predetermined key is in the second state The information to be used is not used for authentication.

Moreover, the input information authentication system according to the present invention includes:
An input information authentication system configured by connecting an input information authentication device and a server device by wire, wireless, or a combination thereof,
The server device includes display input control means for controlling the input information authentication device,
The input information authentication device has an input means for performing key input, and a communication means for receiving control by the display input control means,
The input means has a plurality of keys,
The display input control means
Assign each of the plurality of keys to either the first state or the second state;
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for authentication and corresponds to the key of the input means operated when the predetermined key is in the second state The information to be used is not used for authentication.

Moreover, the program of the input information authentication device according to the present invention is:
A program of an input information authenticating device for performing authentication, which is a judgment that information corresponding to an operated key of an input means having a plurality of keys is compared with previously stored authentication information,
On the computer,
Assigning each of the plurality of keys to either the first state or the second state;
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for authentication and corresponds to the key of the input means operated when the predetermined key is in the second state And a procedure for not using information to be used for authentication.

  As described above, according to the present invention, it is possible to make it difficult to guess the authentication information even when the hand and the input screen are viewed from a third party when the authentication information is input.

It is a block diagram which shows the structural example of the input information authentication apparatus 100 as the 1st Embodiment of this invention. It is a figure which shows an example of an input code string in the case of a touch keyboard example and passcode authentication OK. It is a figure explaining the example of a change of a display pattern, and the security to a replay attack. It is a flowchart which shows the operation example of the input information authentication apparatus 100 as 1st Embodiment. It is a block diagram which shows the structural example of the input information authentication system as 2nd Embodiment. It is a flowchart which shows the operation example of the input information authentication system as 2nd Embodiment. It is a block diagram which shows the structural example of the input information authentication apparatus 100 as 3rd Embodiment. It is a flowchart which shows the example of extraction operation | movement of the input passcode sequence in 3rd Embodiment. It is a figure explaining the example of a determination operation | movement whether it is an input passcode in 3rd Embodiment, or a dummy code. It is a flowchart which shows the operation example at the time of passcode registration in 4th Embodiment. It is a figure which shows an example which decomposes | disassembles an extraction pattern for every digit and hashes. It is a flowchart which shows the operation example of the input information authentication apparatus 100 as 4th Embodiment.

  Next, an embodiment to which an input information authentication apparatus, a server apparatus, an input information authentication system, and an apparatus program according to the present invention are applied will be described in detail with reference to the drawings.

First, an outline common to the embodiments of the present invention will be described.
In the embodiment of the present invention, each input key is divided into a plurality of states depending on the display color, and the key input in the display pattern is authenticated depending on whether or not the input key registered in advance as a key key is in a predetermined state. It is determined whether the input pass code is used or a dummy code not used for authentication.

  As described above, in the embodiment of the present invention, it is not determined whether the input is the dummy input or the authentication information depending on the display color of the input key, so which input is the dummy. It can be made indistinguishable to a third party who does not know the key and the input color. For this reason, even if it is a case where the hand and display screen at the time of input are seen from the third party, it can be difficult to guess authentication information.

[First Embodiment]
Next, a first embodiment of the present invention will be described.
In each embodiment described below, an example in which a numeric passcode is used as authentication information will be described.

  As shown in FIG. 1, an input information authentication apparatus 100 according to the first embodiment includes a display input unit 110 such as a touch panel display, a display input control unit 120, and a verification unit 130 that verifies an input passcode. And a storage unit 140 that stores the registered passcode and the like.

  The display input unit 110 displays a plurality of keys on the screen, detects a contact position on the front screen, and determines which of the displayed keys is input based on position information of the contact position. .

The display input control unit 120 performs control such as display control of input keys displayed on the display input unit 110 and extraction of an input passcode from input information.
The display input control unit 120 includes a display pattern generation unit 121 that generates a display pattern of each key on the touch keyboard displayed on the display input unit 110, and an input passcode extraction unit that extracts an input passcode to be verified from an input code string 122.

  With this configuration, the input information authentication device 100 according to the present embodiment displays a touch keyboard including a plurality of numeric input keys on the display input unit 110 and receives a passcode input by the user.

FIG. 2 shows a screen display example by the display input unit 110 and an example of an input code string in the case of passcode authentication OK.
In each embodiment of the present invention, an example in which numbers 1 to 9 for inputting numbers are assigned as input keys displayed on the display input unit 110 will be described. In the example of FIG. 2, the case where the passcode is “123” is shown.

  As shown in FIG. 2, the input key is divided into a colored key and a white key, and the display pattern generation unit 121 determines the display pattern of which key color each key is input. To do.

  Here, whether the input by the user operation to the touch keyboard is used as a part of the input passcode or the dummy code is whether the pre-registered key is in the pre-registered input color Determined by.

In the example of FIG. 2, a case where the key key is “7” and the input color is “colored” is registered in advance by the user.
Here, in the display pattern when the first character is input in the example of FIG. 2, “1, 2, 5, 6, 7, 9” is displayed as a colored key, and the key color “7” as the key key is displayed. “Coloring”. For this reason, in order to input a pass code for authentication OK, the user inputs “1”, which is the first digit of the pass code “1, 2, 3” as the first character.

As described above, as an input rule to be presented to the user, when a key key registered in advance has an input color registered in advance, the input content from the touch keyboard is recognized as an input passcode. In addition, when the key key registered in advance is not the input color registered in advance, the input content from the touch keyboard is recognized as a dummy and is not recognized as an input passcode.
For this reason, in order to input a passcode for authentication OK, the user inputs the registered passcode in order when the pre-registered key is in the input color registered in advance. .

  Also, when inputting the pass code, the dummy code is mixed with the same number of digits as the pass code. In the example of FIG. 2, a case where the pass code is a 3-digit number and a total of 6-digit number including 3 digits of the dummy code is input is shown.

  The display pattern of the touch keyboard is randomly determined every time one character is input as described above, but the key key registered in advance has a predetermined number of digits including a dummy code (six digits in the example of FIG. 2). The half of the number of digits is displayed in the input color registered in advance, and the other half of the number of digits is displayed in another key color.

  Note that the key color of the key key is displayed in a pre-registered input color for a number of times more than half the number of digits including the dummy code (six digits in the example of FIG. 2). A configuration may be adopted in which all inputs after passcodes are all input are treated as dummy inputs. Even in this case, up to a predetermined number of digits including a dummy code (six digits in the example of FIG. 2) does not shift to passcode verification unless some input is made.

  Next, in the display pattern when inputting the second character in the example of FIG. 2, “1, 4, 5, 9” is displayed as a colored key, and the key color of “7” as the key key is “white”, That is, the key color is not a previously registered input color. Therefore, this second character input is a dummy input regardless of which key is input. In the example of FIG. 2, the dummy input is indicated by “*”.

  In the display pattern when the third character is input in the example of FIG. 2, “1, 2, 3, 6, 7, 9” is displayed as the coloring key, and the key color “7” as the key key is “coloring”. It has become. For this reason, in order to input a pass code for authentication OK, the user inputs “2” which is the second digit of the pass code “1, 2, 3” as the third character.

  In the display pattern when the fourth character is input in the example of FIG. 2, “3,4,8” is displayed as a colored key, and the key color “7” as the key key is “white”, that is, registered in advance. The key color is not the input color. For this reason, the input of the fourth character is a dummy input regardless of which key is input.

  In the display pattern when the fifth character is input in the example of FIG. 2, “2, 5, 6, 7, 8” is displayed as the coloring key, and the key color “7” as the key key is “coloring”. ing. For this reason, in order to input the pass code for authentication OK, the user inputs “3”, which is the third digit of the pass code “1, 2, 3” as the fifth character.

  In the display pattern when inputting the sixth character in the example of FIG. 2, “4, 5, 8” is displayed as a colored key, and the key color of “7” as the key key is “white”, that is, registered in advance. The key color is not the input color. Therefore, the input of the sixth character is a dummy input regardless of which key is input. This completes the passcode input.

  Next, the security to the replay attack by the input information authentication apparatus 100 of this embodiment will be described with reference to the specific example of FIG.

FIG. 3A shows an example of a display pattern example similar to the example of FIG. Therefore, in the example of FIG. 3A, as in the example of FIG. 2, the input contents from the touch keyboard at the first character, the third character, and the fifth character are recognized as the input passcode, and the second character, The input content at the fourth and sixth characters is recognized as a dummy and is not recognized as an input passcode.
The example of FIG. 3A shows a case where six digits “1, 8, 2, 4, 3, 2” including the dummy input are input.

  Here, as shown in FIG. 3 (a), when the user is inputting the passcode, the movement of the hand inputting the key and the input screen can be seen by a third party from a close distance such as over the shoulder of the user. Suppose that Furthermore, after that, it is assumed that the input information authentication device 100 of this embodiment has been obtained by the third party.

  In this way, an example in which the third party inputs the same six digits “1, 8, 2, 4, 3, 2” that have been stolen earlier to the input information authentication apparatus 100 of the present embodiment is shown in FIG. Shown in (b).

  Since the display pattern is randomly determined every time one character is input, when the input in FIG. 3B is performed, the display pattern is different from the input pattern in FIG.

  First, in the display pattern when the first character is input in the example of FIG. 3B, “2, 3, 4, 5, 7, 9” are displayed as colored keys, and the key color “7” is the key key. Is colored. Therefore, “1”, which is the first character input, is recognized as the first digit of the input passcode.

  In the display pattern when the second character is input in the example of FIG. 3B, “1, 4, 7, 9” is displayed as the coloring key, and the key color “7” as the key key is “coloring”. It has become. Therefore, “8”, which is the second character input, is recognized as the second digit of the input passcode.

  In the display pattern at the time of inputting the third character in the example of FIG. 3B, “1, 2, 3, 6, 8, 9” are displayed as colored keys, and the key color “7” as the key key is displayed. It is “white”. Therefore, “2”, which is the third character input, is recognized as a dummy and is not recognized as an input passcode.

  In the display pattern when the fourth character is input in the example of FIG. 3B, “3,4,8” is displayed as the colored key, and the key color “7” as the key key is “white”. Yes. Therefore, “4”, which is the fourth character input, is recognized as a dummy and is not recognized as an input passcode.

  In the display pattern when the fifth character is input in the example of FIG. 3B, “2, 5, 6, 7” is displayed as the coloring key, and the key color “7” as the key key is “coloring”. It has become. Therefore, “3”, which is the fifth character input, is recognized as the third digit of the input passcode.

  In the display pattern at the time of inputting the sixth character in the example of FIG. 3B, “1, 3, 5, 6, 8” is displayed as a colored key, and the key color “7” as the key key is “white”. " Therefore, “6”, which is the sixth character input, is recognized as a dummy and is not recognized as an input passcode.

  In this way, the input passcode extraction unit 122 recognizes that the input passcode is “1, 8, 3”, and therefore does not match the correct passcode “1, 2, 3”, and the authentication result is NG. It becomes.

  For this reason, even if a third party who has seen the passcode input obtains the input information authenticating apparatus 100 and inputs the same 6 digits as the previous one, it is not possible to authenticate with the input contents seen. . In this way, even when the operation and the input screen of the hand inputting keys are viewed, it is possible to realize high security without having to know the correct passcode.

  Alternatively, once passcode authentication is NG, the wait time for input may be doubled at the next passcode input. Thus, each time the passcode authentication becomes NG, the wait time is doubled, so that security against repeated replay attacks can be improved. Alternatively, the wait time may be exponentially increased every time the passcode authentication becomes NG.

  FIG. 3C shows an input example for making the passcode authentication OK when the display pattern changes as shown in FIG.

  When the display pattern changes as shown in FIG. 3B, as described above, the input contents from the touch keyboard at the first character, the second character, and the fifth character are recognized as the input passcode, and the third character, The input content at the fourth and sixth characters is recognized as a dummy and is not recognized as an input passcode.

  For this reason, in order to input a pass code for authentication OK, as shown in FIG. 3C, the user must enter the pass code “1, 2, 3 at the first character, the second character, and the fifth character. "Will be entered. As an input code string including a dummy input, “1, 2, *, *, 3, *” is input.

  Next, an operation example of the input information authentication apparatus 100 as the first embodiment will be described with reference to the flowchart of FIG. In the operation of the present embodiment described below, it is assumed that a passcode, a key, and an input color are registered in the input information authentication apparatus 100 in advance.

  First, the display pattern generation unit 121 generates a display pattern for the first character of the touch keyboard displayed on the touch panel display as the display input unit 110 (step S1). Then, every time one character is input, the operation of the display pattern generation unit 121 generating a display pattern at random is repeated until a predetermined number of input characters are input (steps S2 and S3).

Here, display pattern generation processing by the display pattern generation unit 121 will be described.
For the display color of the key key, the display pattern generation unit 121 first displays the key key display color for the number of times and how many times the number of digits of the pass code including the same number of digits including the dummy code. The input color is randomly set by a known method such as using a random number.

  For example, if the number of input characters is 6 digits, the key key is set as the input color when half of the 3 digits are input, and the key key is set as another color when the remaining 3 digits are input. Then, the number of assignments and the number of assignments of the three digits as the input color among the six inputs are randomly set by a known method such as using a random number.

Thereafter, the display color is randomly set by a known method such as using a random number for each number of times of input in all keys other than the key.
For example, if the number of input characters is 6 digits, the display color for all keys other than the key key is randomly set for each of the 6 inputs by a known method such as using a random number.

  In addition, for all the keys, the input color may be used for half the number of input characters, and the other key color may be used for the remaining half as in the case of the key key described above. In this case, how many times and how many times the number of digits of the passcode as the input color is assigned in the entire number of input characters are randomly set by a known method such as using a random number.

  Alternatively, among the predetermined number of display patterns prepared in advance, the display pattern generation unit 121 uses as many display patterns as the total number of input times so that the number of times the key key display color is the input color is half of the total number of input times. May be selected, and the display order of the selected display patterns may be set randomly by a known method such as using random numbers.

  In this way, the display color for each key constituting the touch keyboard is switched randomly every time it is input. Nevertheless, at least for the key keys, half of the total number of inputs is the input color and the other half is the other color.

In this way, when the prescribed number of input characters, that is, the number of digits of the pass code, which is twice the number of digits of the pass code plus the same number of digits, is input from the touch keyboard, the input pass code extracting unit 122 Based on whether or not a predetermined key is an input color in the display pattern, an input passcode to be verified is extracted (step S4).
As this extraction method, as described above, the input content from the touch keyboard when the key key is in the input color is recognized as the input passcode, and the input content when the key key is in another color Is recognized as a dummy and is not recognized as an input passcode.

  In this way, when the input passcode extraction unit 122 extracts “first digit, second digit, third digit” of the input passcode to be verified, the verification unit 130 is extracted by the input passcode extraction unit 122. The 3-digit input passcode (verification passcode) and the registered passcode registered in the storage unit 140 are collated. As a result of this collation, authentication is OK when the two match, and authentication NG when the two do not match (step S5).

  As described above, in the above-described embodiment of the present invention, a display pattern is randomly generated every time one character is input from the touch keyboard. Therefore, as described above with reference to FIG. Even if a column is entered, the authentication result is NG. In this way, it functions substantially like a one-time password, and even if the pass code is the same, the key input content for making the authentication OK changes each time the input is made. As a countermeasure against a case where the movement of the camera and the display screen are stolen from a third party, sufficiently high security can be ensured.

Further, even if the display pattern is the same, the input code string for authentication OK differs depending on the combination of the key key and the input color registered in advance, and an arbitrary key can be selected for each dummy input. ing. For this reason, there is no feature that the specific input digit corresponds to any digit of the input passcode by the user. For this reason, even if a hand and an input screen are seen at the time of input from a third party, it is extremely difficult for the third party to guess the passcode.
Furthermore, it is possible to have sufficient encryption strength against replay attacks such as repeated retries.

  Furthermore, since the pass code includes the dummy code by the same number of digits and is input as a double digit number, security can be strengthened. Of course, if the number of digits of the dummy code is further increased, the security strength can be further improved.

  Nevertheless, the user simply inputs a passcode when the pre-registered key key has a pre-registered input color, and only inputs an appropriate key when the pre-registered key key has another key color. Can be operated with simple effort. As described above, the high security as described above can be realized without impairing the convenience of the user.

  In particular, when the input information authentication device 100 of the present embodiment is a touch panel type portable information terminal, it is conceivable to input authentication information in a train or in a crowded area. The display screen may be seen by a third party from a close distance, such as over the shoulder. In this way, even when the user who is entering authentication information and the display screen are seen, it is difficult to analogize the passcode from the seen information, and the input information authentication device with excellent security It can be.

Also, especially for beginners and elderly people, it is conceivable that the speed of key input is very slow even when a passcode is input. Accordingly, when viewed by a third party, hand movements and display screens may be easily stored.
According to the above-described embodiment, even in such a case, sufficiently high security can be ensured as described above.

In the above-described embodiment, it has been described that the input passcode is extracted based on the key key and the input color registered in advance as Step S4 described above after the input of all characters is completed. The present invention is not limited to this configuration, and it may be configured to determine whether an input passcode or a dummy input every time one character is input.
In this case, every time one character is input, it is determined whether or not the key key registered in advance is the input color registered in advance from the display pattern at the time of input, and the input key is used as the input passcode. Whether to recognize it as a dummy or not to recognize it as an input passcode is determined.

  In the case of passcode authentication OK, the display pattern is reset at random when the next passcode is input, and in the case of authentication NG, the same display pattern is set when the next passcode is input. May be. By adopting such a configuration, the probability that the display pattern when a third party steals and the display pattern when a third party tries to input it by accident can be reduced to zero. Security can be realized.

[Second Embodiment]
Next, a second embodiment of the present invention will be described.
In the second embodiment, functions such as display pattern generation, passcode storage, and verification in the first embodiment described above are realized using a server device.
Description of the same components as those in the first embodiment described above will be omitted.

  As shown in FIG. 5, the input information authentication system as the second embodiment is configured by connecting an input information authentication device 100 and a server device 200 via a network.

  The input information authentication device 100 includes a display input unit 110, a terminal-side display input control unit 310, and a communication unit 150.

  The communication unit 150 is connected to the communication unit 250 of the server device 200 via a network by wire, wireless, or a combination thereof, and performs communication with the server device 200.

  The terminal-side display input control unit 310 performs display control and the like of input keys displayed on the display input unit 110 based on transmission / reception contents with the server device 200 by the communication unit 150.

  The server device 200 includes a server-side display input control unit 320, a collation unit 230, a storage unit 240, and a communication unit 250.

  The communication unit 250 is connected to the communication unit 150 of the input information authentication device 100 via a network by wire, wireless, or a combination thereof, and performs communication with the input information authentication device 100.

  The server-side display input control unit 320 performs display control of an input key displayed on the display input unit 110 of the input information authentication apparatus 100 by communicating with the input information authentication apparatus 100 through the communication unit 250. The server-side display input control unit 320 includes a display pattern generation unit 221 and an input passcode extraction unit 222 that are the same as those in the first embodiment described above.

  Next, an operation example of the input information authentication system as the second embodiment will be described with reference to the flowchart of FIG. In the operation of the present embodiment described below, it is assumed that a passcode, a key, and an input color used in the input information authentication device 100 are registered in advance in the storage unit 240 of the server device 200.

First, the display pattern generation unit 221 of the server device 200 generates a touch keyboard display pattern to be displayed on the touch panel display as the display input unit 110 in the input information authentication device 100 (step S11). In the generation of the display pattern, display patterns for the number of input characters are generated by the same method as in the first embodiment described above, and the data is associated with the input sequence number.
For example, when the pass code is 3 digits and the dummy code is added 3 digits, the number of input characters is 6, and the display pattern generation unit 221 randomly generates 6 display patterns as described above, and each character is 1 character. The data is associated with the input sequence numbers from the first to the sixth character.

  When the display pattern generation unit 221 generates display patterns for the number of input characters, the communication unit 250 transmits display pattern data associated with each input order number to the input information authentication apparatus 100 (step S12).

  The terminal-side display input control unit 310 of the input information authentication device 100 first displays the touch keyboard with the display pattern for the first character based on the display pattern data for the number of input characters received from the server device 200 by the communication unit 150. The information is displayed on the input unit 110 (step S13).

  Each time one character is input, the terminal-side display input control unit 310 displays and inputs a touch keyboard with a display pattern associated with the next input sequence number based on the received display pattern data for the number of input characters. The operation displayed on the unit 110 is repeated until a predetermined number of input characters are input (steps S14 and S15).

  When the specified number, that is, the number of input characters corresponding to the display pattern received from the server device 200 is input, the terminal side display input control unit 310 transmits the input code string of the input character number to the server device 200 by the communication unit 150. (Step S16).

  When the input code string is received from the input information authentication device 100 by the communication unit 250, the input passcode extraction unit 222 of the server device 200 displays display pattern data associated with each input sequence number generated in step S11. Based on the received input code string, an input passcode to be verified is extracted (step S17). Similar to the first embodiment described above, this extraction method is performed based on whether or not a predetermined key is an input color in the display pattern of the touch keyboard when each input sequence number is input.

  Thus, when the input passcode extracting unit 222 extracts “first digit, second digit, third digit” of the input passcode to be verified, the verifying unit 230 is extracted by the input passcode extracting unit 222. The 3-digit input passcode (verification passcode) and the registered passcode registered in the storage unit 240 are collated. As a result of this collation, authentication is OK when the two match, and authentication NG when the two do not match (step S18).

  As described above, according to the above-described second embodiment, the same effects as those of the above-described first embodiment can be obtained, and protection is performed with stronger security than the input information authentication device 100 that is a terminal. Since the server apparatus 200 can be used as a passcode storage location, security can be further improved.

  In addition, the server device 200 generates display patterns for the number of input characters, and the server device 200 receives the input code string corresponding to the display patterns from the input information authentication device 100 and performs processing. Authentication effect and a defense effect against impersonation of the terminal itself (including program impersonation on the terminal).

[Third Embodiment]
Next, a third embodiment of the present invention will be described.
In the third embodiment, a registered passcode is encrypted after being encrypted with a one-way function such as a hash function, and the input passcode can be verified by the user in that state.
Description of the same components as those in the first embodiment described above will be omitted.

  As shown in FIG. 7, the input information authentication apparatus 100 according to the third embodiment has a registered one-way function such as a hash function in addition to the configuration of the first embodiment described above. And an encryption registration unit (first encryption unit) 160 for encrypting the input color, and a key top information and a key color combination of each key in each display pattern are encrypted for extraction by the input passcode extraction unit 122. And an extraction encryption unit (second encryption means) 170 to be converted. The storage unit 140 stores the passcode, key key, input color, and the like encrypted by the encryption registration unit 160.

Next, an operation example of the input information authentication apparatus 100 as the present embodiment will be described.
The following operation example shows a case where md5 is used as a hash function, and a hash code obtained by hashing the numerical value x is shown as md5 (x).

  In the operation of the present embodiment described below, it is assumed that a passcode, a key, and an input color are registered in the input information authentication apparatus 100 in advance. At this time, the encryption registration unit 160 encrypts the passcode and stores it in the storage unit 140, and also encrypts the combination of the key and the input color and stores it in the storage unit 140.

  Display pattern generation and touch keyboard display by the input information authentication apparatus 100 of the present embodiment are the same as those of the first embodiment described above. That is, the operations in steps S1 to S3 in the flowchart of FIG.

  The operation of discriminating the input passcode and the dummy code from the input code string after the prescribed number of input characters has been input from the touch keyboard and extracting only the input passcode will be described with reference to the flowchart of FIG. .

  The extraction encryption unit hashes all the key top information and key color combinations of each key for each display pattern generated by the display pattern generation unit 121 (step S1). The input passcode extraction unit 122 compares hash codes for all key top information and key color combinations hashed for each display pattern with hash codes for key keys and input color combinations registered in advance. (Step S2).

FIG. 9 shows a specific example showing a comparison between all hash codes of combinations of key top information and key colors in the display pattern and hash codes of combinations of key keys and input colors.
The example of FIG. 9 shows a case where hashing is performed on the display pattern of the first character in the example of FIG.

In the display pattern of the first character in FIG. 2, the key color “1, 2, 5, 6, 7, 9” is displayed as “colored” as described above, and the key color “3,4, 8” is displayed. Displayed as “white”.
For this reason, with respect to the display pattern of the first character, hash codes obtained by hashing all combinations of key top information and key colors of the keys are as shown in FIG.
md5 (1 coloring)
md5 (2 colored)
md5 (3 white)
md5 (4 white)
md5 (5 colors)
md5 (6 colors)
md5 (7 colored)
md5 (8 white)
md5 (9 colors)

  If the pre-registered key key is “7” and the input color is “coloring”, the hash code hashed by the encryption registration unit 160 for the combination of the key key and the input color is As shown in FIG. 9, md5 (7 colors) is obtained.

The input passcode extraction unit 122 collates the hash codes of all the key top information and key color combinations of each key in the first character display pattern as described above with the hash codes of the key key and input color combination. . In the example of FIG. 9, there is a hash code for the display pattern of the first character that matches the hash code of the combination of the key and the input color.
Therefore, the input passcode extraction unit 122 determines that the pre-registered key / key has the pre-registered input color in the first character display pattern. For this reason, the input passcode extraction unit 122 recognizes the input content to the display pattern of the first character as the first digit of the input passcode.

  Similarly, for the display patterns after the second character, the input passcode extraction unit 122 also has a hash code of all the key top information and key color combinations of each key in the display pattern, and a hash code of the key key and input color combination. And match.

  In this way, the input passcode extraction unit 122 performs hash code collation for the display pattern at the time of each input, extracts only the input key for the display pattern that has a match as the input passcode, "Second digit, third digit" are arranged in the order of input to form an input passcode (step S33).

  Thus, when the input passcode extraction unit 122 extracts the input passcode to be collated from the input code string, the collation unit 130, as in step S5 in FIG. 4 in the first embodiment described above, The input passcode (verification passcode) extracted by the code extraction unit 122 and the registered passcode registered in the storage unit 140 are collated. As a result of this collation, authentication is OK when the two match, and authentication NG when the two do not match.

  As described above, according to the above-described third embodiment, the same effect as that of the above-described first embodiment can be obtained, and the passcode can be stored after being encrypted with a one-way function such as a hash function. Therefore, even when the input information authentication device 100 is obtained by a third party, it is possible to protect against analysis of information stored in the memory. Nevertheless, even with a passcode input including a dummy code similar to that of the first embodiment described above, the input passcode can be reliably verified. For this reason, higher security can be realized.

  Further, in the collation method of the third embodiment described above, collation can be performed with a much smaller amount of computation than when using an advanced calculation technique in which computation for collation is performed in an encrypted state. Therefore, even a computer having a relatively low processing capability such as a mobile terminal can be easily realized.

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described.
In the fourth embodiment, the registered passcode is stored after being encrypted with a one-way function such as a hash function, and the verification of the input passcode by the user is performed by a method different from the third embodiment described above. It is.
Description of the same components as those in the first and third embodiments described above will be omitted.

The operation of encrypting and storing the passcode when the input information authentication apparatus 100 of this embodiment is registered in the apparatus will be described with reference to the flowchart of FIG.
The following operation example shows a case where md5 is used as a hash function, and a hash code obtained by hashing the numerical value x is shown as md5 (x).

When the passcode to be registered is input, the input passcode extraction unit 122 generates extraction patterns in advance for all combinations of display patterns corresponding to the number of input characters of the touch keyboard (step S41).
The extraction pattern defines the number of characters and the number of characters to be extracted as the input passcode in the total number of input characters for each combination of display patterns for the number of input characters. For example, in the display pattern change example of FIG. 2 described above, the input passcode “first digit, dummy, second digit, dummy, third digit, dummy” by the user is extracted with respect to a six-digit key input. Will be.

In addition, combinations of display patterns for the number of input characters may be prepared for all patterns that can be considered from the combination of the number of input keys (if there are 9 input keys and 6 input characters (2 ⁹ ) ⁶ types). Alternatively, combinations of initial patterns to be used and input colors may be determined in advance (for example, 30 patterns), and the determined number may be prepared.

  The encryption registration unit 160 assigns each digit of the passcode to the generated extraction pattern, decomposes the extraction pattern for each digit, and performs hashing (step S32). The hash codes for the respective digits thus hashed are grouped together and associated with display pattern combinations for the number of input characters and stored in the storage unit 140 (step S33).

  FIG. 11 shows an example in which the extracted pattern is decomposed and hashed for each digit. In the example of FIG. 11, the extraction pattern is “1st digit, dummy, 2nd digit, dummy, 3 digits” of the input passcode by the user with respect to the 6-digit key input as in the example of FIG. 2 described above. “Eye, dummy” and the pass code is “1, 2, 3”.

  If each passcode digit is assigned to this extraction pattern and the dummy code is indicated by “*”, it becomes “1, *, 2, *, 3, *” as illustrated in FIG. Here, when the 3-digit passcode is decomposed for each digit, it becomes “100,000”, “2000”, and “30”. In order to show the digits in the extracted passcode extraction pattern, the other digits are shown as “0”.

  Numbers representing other digits are numbers that are not used in the passcode. In the present embodiment, since the authentication information is described as a passcode consisting of any one of the numbers 1 to 9, other digits are indicated as “0”. For example, when the authentication information is a passcode consisting of any number from 0 to 9, it can be realized in the same manner by setting “10” in the numeric string expressed in hexadecimal to other digits.

  Each of “100000”, “2000”, and “30” obtained by digitizing the passcode numbers separated for each digit by using “0” that is not used for the passcode is hashed with md5. A group of such hashed hash codes, md5 (100,000), md5 (2000), and md5 (30), are combined into display pattern combinations corresponding to the number of input characters (the combination shown in FIG. 2 in the example of FIG. 9). The data are stored in the storage unit 140 in association with each other.

  In this way, even if a third party who obtains the input information authentication apparatus 100 tries to analyze the stored information in the storage unit 140, not only the registered passcode is known, but also the extraction pattern It can also be unclear which input digit corresponds to any digit of the input passcode by the user.

  As for the combination of the key and the input color, the encryption registration unit 160, when previously registered in the input information authentication apparatus 100, performs the key key and input color combination, as in the operation of the third embodiment described above. The combination is encrypted and stored in the storage unit 140.

  Next, an operation example when the input information authentication apparatus 100 according to the fourth embodiment receives a passcode input from the user will be described with reference to the flowchart of FIG.

  As operations when receiving a passcode input, display pattern generation and touch keyboard display are the same as those in the first embodiment. That is, the operations of steps S51 to S53 are the same as the operations of steps S1 to S3 in the flowchart of FIG. 4 described above in the first embodiment.

  When the specified number of input characters is input from the touch keyboard in this way, the extraction encryption unit 170 decomposes the input code string by the user for each digit and hashes it with md5 in the same way as when registering the passcode (step 5). S54).

  The collation unit 130 collates the hash code stored in the storage unit 140 in association with the initial pattern and input color of the touch keyboard and the hash code hashed in step S54 (step S55).

  Here, since the input code string includes a dummy code, the number of hash codes from the input code string hashed in step S54 is greater than the number of hash codes associated with the initial pattern of the touch keyboard and the input color. Will increase. For example, if the pass code is 3 digits and the number of input characters is 6, the number of hash codes associated with the display patterns for the number of input characters is 3, and the hash code from the input code string hashed in step S54 is 6 Become one.

  Therefore, for each hash code from the input code string hashed in step S54, whether or not there is a match among the hash codes associated with the display patterns for the number of input characters from the input upper digits. Will be searched. Then, the hash codes associated with the display patterns for the number of input characters, that is, whether all the hash codes from the registered passcode match are collated, and if a matching hash code is detected, the collation is performed. OK and passcode authentication OK.

As a specific example, for example, the input code string “1, 8, 2, 4, 3, 2” illustrated in FIG. 3A with respect to the display pattern for the number of input characters illustrated in FIG. The hash code from the input code string hashed in step S54 is
“Md5 (100,000)”
"Md5 (80000)"
"Md5 (2000)"
"Md5 (400)"
"Md5 (30)"
“Md5 (2)”
It becomes six.

On the other hand, for example, the hash codes stored in the storage unit 140 in association with the display patterns for the number of input characters illustrated in FIG.
“Md5 (100,000)”
"Md5 (2000)"
"Md5 (30)"
It is three.

  When these two are collated as described above, matching hash codes are detected from the six hash codes hashed in step S54 for all three hash codes associated with the display patterns for the number of input characters. Is done. For this reason, the collation in step S55 is OK and the passcode authentication is OK.

  As described above, the same effect as that of the above-described third embodiment can also be obtained by the above-described fourth embodiment.

[About each embodiment]
Each of the above-described embodiments is a preferred embodiment of the present invention, and the present invention is not limited to this, and various modifications can be made based on the technical idea of the present invention.

  For example, in each of the above-described embodiments, an example in which the pass code has three digits of “1, 2, 3” has been described. However, the number of digits of the pass code is not limited to this number, and depends on the performance of the apparatus. It may be determined arbitrarily. Naturally, the security can be further increased by increasing the number of digits of the passcode.

Further, in the above-described embodiment, it has been described that a numeric passcode is used as the authentication information. However, the authentication information is not limited to this as long as the authentication information can be expressed as a numeric string. Or a combination thereof.
In this case, for example, in the case of an alphabet, the display input unit 110 displays a touch keyboard using the alphabet as key top information, and handles the alphabets A to Z input as numbers 1 to 26, or a character string by ASCII code. Can be realized in the same manner as in the above-described embodiment by a method such as forming a numerical string.
If it is a stroke, the display range of the key registered in advance is used as the key key in the above-described embodiment, and the display range of the key is the same as in the above-described embodiment depending on whether or not the input range is a pre-registered input color. By determining the input passcode and the dummy input and treating the coordinates of the input start point and the end point as numbers, it can be realized in the same manner as in the above-described embodiment.

  In this way, by adopting a touch keyboard configured by numbers, letters such as alphabets, display ranges indicating keys, or combinations thereof, by increasing the number of keys constituting the touch keyboard, The number of possible combinations of key keys and input colors that can be registered in advance can be increased, so it is possible to realize stronger security against powerful attacks such as repeating various inputs. .

Further, an image may be used instead of letters and numbers as key top information of the touch keyboard. In this case, by adding a ruled line to the image or masking a part of the display range with a predetermined color, the range to be treated as each input key is indicated in the image, and the display range of each input key is displayed in white, gray By masking with black or the like, or not masking, the key color of each input key can be indicated.
Further, the above-described authentication of input information can be performed in the same manner as in the above-described embodiment by assigning numbers such as key numbers and key display coordinates to display ranges assigned as input keys in an image. In this case, the display range registered in advance in the image is used as the key key in the above-described embodiment, and the input passcode and the dummy are determined in the same manner as in the above-described embodiment depending on whether the display range is the input color registered in advance. Input discrimination can be performed.

  Further, when the authentication information, the key key, and the input color are registered in the server device 200 as in the second embodiment described above, the server device 200 displays a display range corresponding to each of these input keys, and the display thereof. Image information including information on state classification by a range mask or the like is generated as many as the number of input characters as corresponding to the display pattern in the above-described embodiment, transmitted to the input information authentication apparatus 100 in association with the input sequence number, and input The information authentication apparatus 100 displays the image information in order as corresponding to the display pattern in the above-described embodiment and receives an input, so that processing can be performed in the same manner as in the above-described second embodiment.

  As described above, the authentication information that can be used in the above-described embodiment is a numeric string, a character string, an image string, coordinate information, or the like, as long as it can be expressed as a numeric string by performing a predetermined conversion. A combination of these may be used.

  Moreover, although embodiment mentioned above demonstrated as dividing a key into two states with a display color, if it can divide a key into a some state, it will not be limited to dividing with a display color, For example, the feeling which touched the key Any state dividing method may be used as long as the state can be recognized so that a person can recognize that the state is different.

  Further, in each of the above-described embodiments, it has been described that the user inputs a key to the touch keyboard displayed on the touch panel display of the display input unit 110. However, the input unit and the display unit indicate key states such as key color and touch. As long as it has a mechanism to change, it is not limited to a touch keyboard, and may be a physical keyboard.

Further, each of the above-described embodiments is not limited to the configuration in which the input unit and the display unit are integrated, and the present invention can be similarly realized even if the input unit and the display unit are separate bodies or separate devices. Can do.
When the input unit and the display unit are separate, the same key as the input unit is displayed on the display unit, and the key color registered in advance is the input color registered in advance by the key color of each key in the display unit Whether or not the user can be identified by the user, and processing can be performed in the same manner as in the above-described embodiment. Also with such a configuration, the above-described embodiments can be similarly realized, and the same effect can be obtained.

  Moreover, the input information authentication device 100 of each embodiment described above is not limited to a portable information terminal, and can be similarly applied to a stationary device such as a desktop PC.

In addition, by recording the processing procedure for realizing the input information authentication device 100 or the server device 200 as each embodiment described above on a recording medium as a program, the above-described functions according to each embodiment of the present invention can be obtained. A program supplied from a recording medium can be realized by causing a CPU of a computer constituting the system to perform processing.
In this case, the present invention can be applied even when an information group including a program is supplied to the output device from the above recording medium or from an external recording medium via a network.
That is, the program code itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program code and the signal read from the recording medium constitute the present invention. It will be.
As this recording medium, for example, a hard disk, an optical disk, a magneto-optical disk, a floppy (registered trademark) disk, a magnetic tape, a nonvolatile memory card, a ROM, or the like may be used.

  According to the program according to the present invention, each function in each of the above-described embodiments can be realized by a computer controlled by the program.

DESCRIPTION OF SYMBOLS 100 Input information authentication apparatus 110 Display input part 120 Display input control part 121 Display pattern generation part 122 Input passcode extraction part 130 Verification part 140 Storage part 150 Communication part 160 Encryption registration part (an example of 1st encryption means)
170 Extraction encryption unit (an example of second encryption means)
200 server device 310 terminal side display input control unit 320 server side display input control unit

Claims (14)

An input information authentication device for performing authentication, which is a determination that information corresponding to an operated key of an input unit having a plurality of keys is compared with authentication information stored in advance,
Each of the plurality of keys is assigned to either the first state or the second state,
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for the authentication, and the information is operated when the predetermined key is in the second state. An input information authentication apparatus characterized in that information corresponding to a key of an input means is not used for the authentication.   2. The selection as to whether each of the plurality of keys is assigned to the first state or the second state is made at random each time a character is input from the input means. The input information authentication device described. Provided with display input control means,
The display input control means includes
Assigning each of the plurality of keys to either the first state or the second state;
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for the authentication, and is operated when the predetermined key is in the second state. 3. The input information authentication apparatus according to claim 1, wherein information corresponding to a key of the input means is not used for the authentication. First encryption means for encrypting a combination of the predetermined key and the first state with a one-way function;
For each of the plurality of keys, a second encryption unit that encrypts a key and a combination of whether the key is in the first state or the second state with a one-way function;
An encryption collation unit that collates the encrypted character string by the first encryption unit and the encrypted character string by the second encryption unit, and
The display input control means uses the input information to the key of the input means when matched by the verification by the encryption verification means for the authentication, and when the verification does not match by the verification by the encryption verification means 4. The input information authentication apparatus according to claim 3, wherein the input information to the key of the input means is not used for the authentication. Authentication information stored in advance is information that can be expressed as a numeric string.
First encryption means for deciphering the authentication information expressed as a numeric string for each digit and encrypting the authentication information with a one-way function;
A second encryption means for expressing the input information input from the input means as a number string, decomposing each digit, and encrypting with the one-way function;
4. The input information authentication apparatus according to claim 3, further comprising: a collating unit that collates an encrypted character string by the first encryption unit and an encrypted character string by the second encryption unit. The first encryption means decomposes the authentication information expressed as a number string into numbers for each digit, and a digit in which the decomposed number exists for the number of input characters including dummy inputs. Is digitized with a number that is not used in the authentication information, and the digitized number is encrypted with a one-way function,
The second encryption unit expresses the input information input from the input unit as a numeric string and decomposes it into a number for each digit, and the decomposed number exists in the numeric string of the input information. 6. The input information authentication apparatus according to claim 5, wherein the digit is digitized by a number that is not used in the authentication information, and the digit is digitized by a one-way function. Comprising communication means for receiving control from a display input control means outside the apparatus;
By control from the display input control means via the communication means,
Assigning each of the plurality of keys to either the first state or the second state;
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for the authentication, and is operated when the predetermined key is in the second state. 3. The input information authentication apparatus according to claim 1, wherein information corresponding to a key of the input means is not used for the authentication. The communication means transmits the content input from the input means to a server device,
The server device
Storage means for storing the authentication information in advance;
The input information authentication apparatus according to claim 7, further comprising: a verification unit that performs verification with the authentication information based on content input from the input unit.   9. The display device according to claim 1, further comprising: a display unit that displays a key image indicating whether each of the plurality of keys is assigned to the first state or the second state. The input information authentication device according to item 1.   The said input means detects the contact position to the surface screen of the said display means, and discriminate | determines to which of these keys input based on the positional information on this contact position. Input information authentication device. A server device used by being connected to an input information authentication device by wire, wireless, or a combination thereof,
Comprising a display input control means for controlling the input information authentication device;
The input information authentication device has an input means for performing key input, and a communication means for receiving control by the display input control means,
The input means has a plurality of keys,
The display input control means includes
Assign each of the plurality of keys to either the first state or the second state;
The information corresponding to the key of the input means operated when the predetermined key is in the first state is used for authentication, and the input operated when the predetermined key is in the second state A server apparatus characterized in that information corresponding to a key of means is not used for authentication.   The display input control means generates allocation information for each of the plurality of keys to either the first state or the second state so that the allocation is random for the number of input characters for authentication. The server device according to claim 11, wherein the server device transmits the information to the input information authentication device via the communication unit. An input information authentication system configured by connecting an input information authentication device and a server device by wire, wireless, or a combination thereof,
The server device includes display input control means for controlling the input information authentication device,
The input information authentication device has an input means for performing key input, and a communication means for receiving control by the display input control means,
The input means has a plurality of keys,
The display input control means includes
Assign each of the plurality of keys to either the first state or the second state;
The information corresponding to the key of the input means operated when the predetermined key is in the first state is used for authentication, and the input operated when the predetermined key is in the second state An input information authentication system characterized in that information corresponding to a key of means is not used for authentication. A program of an input information authenticating device for performing authentication, which is a judgment that information corresponding to an operated key of an input means having a plurality of keys is compared with previously stored authentication information,
On the computer,
Assigning each of the plurality of keys to either the first state or the second state;
Information corresponding to the key of the input means operated when the predetermined key is in the first state is used for the authentication, and the information is operated when the predetermined key is in the second state. And a procedure for preventing the information corresponding to the key of the input means from being used for the authentication.

Images