JP2014197321A - Collation system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a collation system which distributes a one-time password via a memory medium.SOLUTION: A mobile terminal 2 carried by a user, reads out an unused one-time password stored in a storage domain of a memory medium 3 specified by an authentication server device 4, in receiving one-time password authentication, and then overwrites the read-out storage domain with a new one-time password in preparation for a coming authentication. The mobile terminal 2 transmits the read-out one-time password to the authentication server device 4 and requests one-time password authentication. The authentication server device 4 has stored a writing state of the one-time password in the storage domain of the memory medium 3, and collates whether the stored one-time password and the one-time password received from the mobile terminal 2 match each other.

Description

  The present invention relates to a verification system using a one-time password (OTP).

  Conventionally, when using one-time password authentication, a two-dimensional matrix created by combining alphanumeric characters and symbols is distributed in advance to users who request authentication from the verification side. There is known a technique for specifying a plurality of positions and collating and realizing that a correct combination is obtained as a response.

  There is also known a method of preparing a one-time password generator that can generate the same password at the same timing on both the verification side (server) and the authentication request side (client) (Patent Document 1).

Japanese Patent Laying-Open No. 2005-05348

  By the way, in the first method, the values of the individual elements of the distributed two-dimensional matrix are unchanged, and the combinations that can be generated are finite. In the second method, it is necessary to prepare a one-time password generator for both the server and the client, and synchronize the one-time password generator with a counter or a clock.

  Therefore, an object of the present invention is to provide a verification system that distributes a one-time password through a rewritable storage medium.

  In order to solve such a problem, the present invention is a verification system that has a password generation unit that sequentially generates passwords, and that verifies a password read from a storage medium by a user terminal on a server device. The terminal includes a medium update unit that sequentially updates and reads passwords stored in the storage medium, and a verification request unit that makes a verification request to the server device, and the server device stores passwords sequentially. And a password verification unit for verifying the password acquired from the verification request unit and the password in the password storage unit, the password verification unit being the latest verification OK from the password stored in the password storage unit Verification system characterized by verification using password generated next to lost password To provide. As a result, after the mobile terminal reads the one-time password currently written for verification, the new one-time password is overwritten on the storage medium for the subsequent verification, so that the one-time password can be changed via the storage medium. Can be distributed.

In such a collation system, the medium update unit of the user terminal updates and reads the password of the area of the storage medium corresponding to the area ID specified in the server device,
The password storage unit of the server stores a user terminal that has been verified and the specified area ID in association with the next generated password, and the password verification unit of the server device issues a verification request. A password that does not correspond to the user terminal selected is selected from the password storage unit, the area ID corresponding to the password is specified for the user terminal that has requested verification, and the selected password is used in response to the verification request. It is preferable to collate them. Thereby, since it is possible to prohibit the portable terminal itself that has written the one-time password in the storage medium from using the same one-time password, it is possible to prevent the one-time password from becoming obsolete.

  In the verification system, it is preferable that the medium update unit updates the password generated next to the password on condition that the password verification unit performs verification.

  In the verification system, it is preferable that the password generation unit generates the next password on condition that the password verification unit verifies the password.

  According to the present invention, a one-time password can be exchanged via a rewritable storage medium.

It is a figure for demonstrating the authentication system by this invention. It is a block diagram of a portable terminal. It is a block diagram of a storage medium. It is a block diagram of an authentication server apparatus. It is a figure for demonstrating the memory | storage part of a storage medium. It is a figure for demonstrating the memory | storage part of an authentication server apparatus. It is a process flowchart of a portable terminal. It is a process flowchart of an authentication server apparatus. It is a figure for demonstrating the memory | storage part of the storage medium with which writing was performed by the portable terminal.

Hereinafter, an authentication system according to the present invention will be described with reference to the drawings.
FIG. 1 is a diagram schematically showing the overall configuration of an authentication system according to the present invention. An authentication system 1 shown in FIG. 1 includes a mobile terminal 2 (2-1, 2-2) used when a user carries and receives authentication, a storage medium 3 for storing a one-time password, and a one-time password. An authentication server device 4 that performs authentication and a service providing device 5 that provides a user with a predetermined service associated with the storage medium 3 using an authentication result of the authentication server device 4.

  In this authentication system, when the user of the mobile terminal 2 wants to use a service provided by the service providing apparatus 5 associated with the storage medium 3, the user first brings the mobile terminal 2 close to the storage medium 3 and stores the storage medium. 3 is read, and the read medium ID is transmitted to the authentication server device 4. Upon receiving the medium ID, the authentication server device 4 receives information necessary for reading the one-time password stored in the storage medium 3 that the portable terminal 2 is identified by the medium ID for authentication, and the portable terminal 2 stores the storage medium. 3 is transmitted to the portable terminal 2.

  Next, the mobile terminal 2 reads the one-time password stored in the storage medium 3 using the information received from the authentication server device 4 and writes the one-time password received from the authentication server device 4 in the storage medium 3. Then, the portable terminal 2 transmits the one-time password read from the storage medium 3 to the authentication server device 4.

  The authentication server device 4 collates the one-time password received from the mobile terminal 2 and the one-time password written in the previous storage medium 3 stored in the authentication server device 4. An instruction is sent to 5 to provide the service.

  In FIG. 1, when the portable terminal 2-1 and the portable terminal 2-2 read and write the one-time password via the storage medium 3, the one-time password written by the portable terminal 2-1 is stored in the portable terminal 2-. 2 is read out and used for authentication, and the one-time password is written and read out through different paths between the storage medium 3 and the authentication server device 4.

First, the mobile terminal 2 will be described with reference to FIG.
The mobile terminal 2 is, for example, a smartphone or tablet equipped with an NFC (Near Field Communication) function, and is a first unit that exchanges data with the input unit 21, the display unit 22, the processing unit 23, the storage unit 24, and the storage medium 3. The communication unit 25 and the authentication server device 4 are configured to include a second communication unit 26 that exchanges data.

  The input unit 21 is input means for a user to input commands and data for operating the mobile terminal 2, and includes, for example, a keypad, a touch panel, and the like. The input unit 21 receives a service request start or authentication request instruction from a user, and inputs a user name / password for user authentication as necessary.

  The display unit 22 is an output unit that displays information and the like handled by the mobile terminal 2 to the user, and includes an image display device such as a liquid crystal display. The display unit 22 also displays the authentication result for the user.

The storage unit 24 is a storage device such as a ROM, a RAM, and a magnetic hard disk, stores various programs and various data, and stores a terminal ID 241 and authentication information 242 that are terminal information.
The terminal ID 241 is identification information for identifying the mobile terminal 2 by the authentication server device 4. The authentication information 242 is secret information used when the authentication server device 4 performs terminal authentication of the mobile terminal 2.

  The processing unit 23 is a configuration unit that integrally controls each unit of the mobile terminal 2, and includes a CPU that processes a terminal program stored in the storage unit 24. Therefore, the authentication request unit 231, the medium update unit 232, and the verification request unit 233 are included.

  The authentication request unit 231 reads the medium ID from the storage medium 3 via the first communication unit 25. Further, the authentication request unit 231 transmits the terminal information including the medium ID read from the storage medium 3, the terminal ID 241 read from the storage unit 24, and the authentication information 242 to the authentication server device 4 via the second communication unit 26. Make an authentication request. Further, the authentication request unit 231 receives the result of the authentication request from the authentication server device 4 via the second communication unit 26. The authentication OK response includes a one-time password, a region ID, and an authentication key.

  The medium update unit 232 reads the one-time password written in the area ID of the storage medium 3 received as an authentication OK response from the authentication server device 4 and overwrites the area with the new one-time password. In the present embodiment, the one-time password generated by the authentication server device 4 is received, but may be generated by the mobile terminal 3. In that case, after writing the one-time password generated by the password generator provided in the portable terminal 3 to the storage medium 3, the written one-time password is transmitted to the authentication server device 4 as a new one-time password and stored. Just do it.

  The verification request unit 233 transmits the one-time password read from the storage medium 3 to the authentication server device 4 via the second communication unit 26 and requests verification of the one-time password. In addition, the verification request unit 233 receives the verification result from the authentication server device 4 via the second communication unit 26 and causes the display unit 22 to display the verification result.

  The first communication unit 25 is a communication interface that exchanges data with the storage medium 3. Therefore, if the storage medium 3 is an NFC tag, it becomes a non-contact near field communication unit, and if the storage medium 3 is an SD card, it becomes an SD card reader / writer unit. The authentication request unit 231 reads the medium ID 321 from the storage medium 3 via the first communication unit 25. Further, the medium update unit 232 reads and writes the one-time password to the storage medium 3 via the first communication unit 25.

  The second communication unit 26 is a communication interface that exchanges data with the authentication server device 4. Therefore, the second communication unit 26 supports wired communication or wireless communication, and communicates with the authentication server device 4 via various networks such as a wide area communication network such as the Internet or an IP network such as a closed communication network, or a mobile phone communication network. May be.

Next, the storage medium 3 will be described with reference to FIG.
The storage medium 3 is a storage medium such as an NFC tag or an SD card, for example, and includes a communication unit 31, a storage unit 32, and a processing unit 33 as shown in FIG.

  The communication unit 31 is an interface that performs communication with the mobile terminal 2. Reading and writing from the portable terminal 2 are performed via the communication unit 31. The communication unit 31 is a non-contact short-range wireless communication unit if the storage medium 3 is an NFC tag, and a contact point with the SD card reader / writer on the mobile terminal 2 side if the storage medium 3 is an SD card. In the following description, a case where the storage medium 3 is an NFC tag will be described.

  The storage unit 32 includes a medium ID 321 and a one-time password storage area 322. The medium ID 321 is an area for storing an identifier for specifying the storage medium 3. It is preferable that writing from the portable terminal 2 is impossible.

  The one-time password storage area 322 is an area that can be read and written from the mobile terminal 2 and can store a plurality of one-time passwords. When a plurality of one-time passwords can be stored, the storage medium 3 can be used by a plurality of portable terminals 2, and an area used for reading and writing one-time passwords can be specified separately for each user or portable terminal 2. It becomes possible. In addition, in order to improve security, the same portable terminal 2 prohibits the act of continuously writing and reading (that is, the act of the same portable terminal 2 reading the one-time password written by the portable terminal 2), and others When it is desired to read only the one-time password written by the portable terminal 2, it is easy to secure a usable one-time password. If there are many one-time passwords that can be stored in the one-time password storage area 322 among a plurality of portable terminals 2, all of the readable one-time passwords written by other portable terminals 2 are used. Thus, the situation where the service cannot be used can be made difficult to occur.

  Here, an example of the storage unit 32 is shown in FIG. In FIG. 5, “1111” is set in the medium ID 321. The one-time password storage area 322 can store a total of eight one-time passwords, and stores the area ID, the one-time password, and the authentication key in association with each other. The one-time password is specified by “area ID”. The authentication key is used as a part of the protection mechanism that is responsible for protecting the reading of the one-time password. In FIG. 5, the “one-time password” with the “area ID” “1” is “X”, and the “authentication key” is set to “mmm”. Note that the initial state is written by some method such as writing by a dedicated terminal when the storage medium 3 and the service providing apparatus 5 are associated with each other. Then, the same content is stored in the storage unit 41 of the authentication server device 4 described later.

  The processing unit 33 performs read / write processing of the storage unit 32 in accordance with a request from the mobile terminal 2. The protection mechanism restricts reading / writing to the storage unit 32 by the portable terminal 2 by permitting reading only when a correct authentication key is presented at the time of reading request.

Next, the authentication server device 4 will be described with reference to FIG.
The authentication server device 4 is a server that performs one-time password authentication with respect to the mobile terminal 2 and provides an authentication result to the service providing device 5 associated with the storage medium 3, as shown in FIG. 41, a processing unit 42, and a communication unit 43.

  The storage unit 41 is a storage device such as a ROM, a RAM, or a magnetic hard disk, stores various programs and various data, and stores a terminal information DB 411 and a one-time password DB 412. The correspondence relationship between the storage medium 3 and the service providing device 5 is also stored.

  The terminal information DB 411 stores, for each mobile terminal 2, terminal information in which the authentication information 242 used when the authentication server device 4 performs terminal authentication of the mobile terminal 2 is associated with the terminal ID 241 of the mobile terminal 2.

  The one-time password DB 412 is a database that stores a one-time password issued to the storage medium 3. The one-time password DB 412 stores the current status of the one-time password storage area 322 of the storage medium 3.

  Here, FIG. 6 shows an example of the storage unit 41. In FIG. 6, the terminal information DB 411 stores a terminal ID 241 and authentication information 242 in association with each other. In this example, three terminals are managed. “Authentication information” with “terminal ID” “2a” is “aaa”, and “authentication information” with “terminal ID” “2b” is “bbb”. In the one-time password DB 412, the medium ID and the issued OTP are stored in association with each other. The issued OTP is information indicating the OTP, the authentication key, and to which portable terminal 2 the OTP is transmitted for each number (#) corresponding to the area ID of the one-time password storage area 322 of the storage medium 3. A valid flag indicating whether or not the OTP is valid is associated. When the validity flag is valid (1 = valid, 0 = invalid in this example), the one-time password storage area 322 of the storage unit 32 of the storage medium 3 identified by the medium ID, the set of the OTP, and the authentication key are in the same state. It will be kept. In FIG. 6, in the “# 1” area where the “medium ID” is “1111” (that is, the area where the “area ID” is “1” in the one-time password storage area 322 where the “medium ID” is “1111”). , “OTP” is set to “X” and “authentication key” is set to “mmm”, the mobile terminal 2 having “terminal ID” “2a” is written, and “valid flag” is set to “1”. It is shown that OTP is currently in a valid state.

  The processing unit 42 is a component that integrally controls each unit of the authentication server device 4, and includes a CPU that processes a server program stored in the storage unit 41. Therefore, the terminal authentication unit 421, the OTP generation unit 422, the OTP transmission unit 423, and the OTP collation unit 424 are provided.

  The terminal authentication unit 421 verifies the terminal information (terminal ID and authentication information) received from the mobile terminal 2 via the communication unit 43 with the terminal information in the terminal information DB 411 of the storage unit 41 and performs terminal authentication of the mobile terminal 2. And output the authentication result.

  The OTP generation unit 422 generates a random password as a one-time password every time a trigger is received. The OTP generation unit 422 selects the area ID of the storage medium 3 in the one-time password DB 412 used for verification from the authentication request received from the portable terminal 2 via the communication unit 43. Since the storage mechanism 3 uses a protection mechanism, the OTP generation unit 422 generates an authentication key together with the one-time password.

The OTP transmission unit 423 transmits the one-time password generated by the OTP generation unit 422 to the portable terminal 2 through the communication unit 43 together with the area ID.
The generated one-time password is temporarily stored in the work area of the storage unit 41 together with the terminal ID of the transmission destination portable terminal 2 and the medium ID of the storage medium 3. When the protection mechanism is used in the storage medium 3, the authentication key is stored together with the one-time password.

  The OTP collation unit 424 collates the one-time password received from the portable terminal 2 via the communication unit 43 with reference to the one-time password DB 412 and outputs a collation result. The OTP verification unit 424 also stores the one-time password, authentication key, medium ID, and terminal ID temporarily stored in the work area by the OTP transmission unit 423 in the storage medium 3 selected by the OTP generation unit 422 of the one-time password DB 412. The area ID is stored as the issued OTP.

  The communication unit 43 is an interface that performs communication with the mobile terminal 2 and the service providing apparatus 5. The communication unit 43 corresponds to wired communication or wireless communication, and communicates with the mobile terminal 2 and the service providing apparatus 5 through various networks such as a wide area communication network such as the Internet or an IP network such as a closed area communication network or a mobile phone communication network. May be.

  The service providing apparatus 5 is associated with the storage medium 3 and provides a predetermined service to the user of the portable terminal 2 when the collation result received from the authentication server apparatus 4 is a collation success.

Here, the processing flow of the portable terminal 2 will be described in detail with reference to FIG.
As shown in FIG. 7, in order for the user to receive a service, the process is started by bringing the mobile terminal 2 closer to the storage medium 3 as an operation for starting a service request. First, the medium ID is read from the storage medium 3 (step S11). Specifically, the authentication request unit 231 transmits a medium ID request signal to the storage medium 3. As a response to the medium ID request signal, the medium ID is acquired from the storage medium 3.

In step S 12, the authentication request unit 231 transmits an authentication request including the medium ID read from the storage medium 3, the terminal ID 241 read from the storage unit 24, and authentication information 242 to the authentication server device 4.
In step S13, the authentication request unit 231 waits until a response to the authentication request is received from the authentication server device 4. When a response to the authentication request is received (step S13—Yes), in step S14, the authentication request unit 231 determines whether the received response is an OK response due to successful authentication or an NG response due to authentication failure. In the case of an OK response, the region ID, the current authentication key used for reading, a new one-time password used for writing, and a new authentication key are received from the authentication server device 4. On the other hand, in the case of an NG response, the result of terminal authentication failure is received from the authentication server device 4.

  If the response is an OK response due to successful authentication in step S14 (step S14-Yes), the process proceeds to step S15, and the medium update unit 232 designates the area ID received from the authentication server device 4 and the current authentication key, and the storage medium. 3 transmits a password read request signal to read the current one-time password from the storage medium 3. Further, the medium update means 232 designates the area ID received from the authentication server device 4, the new one-time password, and the new authentication key, transmits a password write request signal to the storage medium 3, and overwrites the one-time password. Update. At this time, a write result indicating whether or not the one-time password has been successfully written is received from the storage medium 3.

  For example, referring to FIG. 5 and FIG. 6, the portable terminal 2 having “terminal ID” “2a” and the “area ID” from the authentication server device 4 to the storage medium 3 having “media ID” “1111”. Is read when an OK response is received with "4", "Current authentication key" is "ppp", "New one-time password" is "E", and "New authentication key" is "ggg" Becomes “U”. When the portable terminal 2 succeeds in writing to the storage medium 3, as shown in FIG. 9, the "area ID" in the one-time password storage area 322 is updated, and the "area ID" is "4" “Password” is set to “E”, and “Ggg” is set to “Authentication Key”.

In step S16, the verification request unit 233 transmits the one-time password read from the storage medium 3 to the authentication server device 4 and requests verification of the one-time password authentication. Specifically, the terminal ID 241, the medium ID, the area ID,
A verification request including the current one-time password read from the storage medium 3 and the result of writing the new one-time password is transmitted to the authentication server device 4 to request verification of the one-time password.

  In step S <b> 17, the verification request unit 233 stands by until a response to the verification request is received from the authentication server device 4. When a response to the verification request is received (step S17—Yes), the process proceeds to step S18, where the verification request means 233 displays the received verification result on the display unit 22 and ends the process. If the received collation result is collation OK, it is possible to receive a desired service from the service providing apparatus 5 thereafter.

  On the other hand, if it is an NG response due to authentication failure in step S14 (step S14-No), the process proceeds to step S18, where the verification request means 233 displays the received authentication failure response on the display unit 22 and ends the process.

  Although not shown, if a response from the authentication server device 4 cannot be received even after waiting for a certain time in step S13 and step S17, a time-out occurs and the process is stopped.

Next, the processing flow of the authentication server device 4 will be described in detail with reference to FIG.
As shown in FIG. 8, when an authentication request is received from the mobile terminal 2, the authentication server device 4 starts processing. First, in step S <b> 21, the terminal authentication unit 421 performs terminal authentication processing to check whether the terminal ID 241 and the authentication information 242 received from the mobile terminal 2 are registered in the terminal information DB 411. Here, if the combination of the terminal ID registered in the terminal information DB 411 and the authentication information matches, the authentication is successful, and if the combination does not match, the authentication result is output as an authentication failure. In step S22, the output authentication result is determined.

  If the authentication is successful (step S22—Yes), the process proceeds to step S23, where the OTP generation unit 422 refers to the one-time password DB 412 stored in the storage unit 41, and the medium ID in the authentication request received from the mobile terminal 2 The area ID of the one-time password of the area that is not currently written by the portable terminal 2 is selected for the storage medium 3 specified in (1). When the OTP generation unit 422 selects a medium area in which a one-time password to be read by the portable terminal 2 is selected, the OTP generation unit 422 reads the current authentication key and generates a one-time password and an authentication key to be written after the portable terminal 2 reads the authentication key. To do. In step S <b> 24, the OTP transmission unit 423 transmits the generated one-time password to the mobile terminal 2. Specifically, an OK response including the selected region ID, the read current authentication key, the generated one-time password and the authentication key is transmitted to the mobile terminal 2. Further, the OTP transmission unit 423 temporarily stores the generated one-time password, authentication key, medium ID, and terminal ID in the work area. Thereafter, in step S25, the process waits until a collation request is received from the mobile terminal 3.

  When a verification request is received from the portable terminal 3 (step S25—Yes), the process proceeds to step S26, where the OTP verification unit 424 verifies the received one-time password and the one-time password stored in the one-time password DB 412. In step S27, the OTP collation unit 424 outputs the collation result and notifies the portable terminal 2 of the collation result. Further, the OTP collation unit 424 officially stores the one-time password and the authentication key temporarily stored in the work area by the OTP transmission unit 423 in the one-time password DB 412.

  More specifically, if the verification result is OK and the writing result of the new one-tie password received in the verification request from the portable terminal 2 is successful, the authentication server device 4 corresponds to the one in the one-time password DB 412. The new one-time password is stored in the one-time password corresponding to the medium ID and the area ID. Similarly, the new authentication key is stored in the authentication key, the terminal ID is stored in the transmission destination, and the valid flag is set to be valid.

  On the other hand, if the collation result is a collation NG or a new one-tie password write result received in the collation request from the mobile terminal 2, the authentication server device 4 associates the storage unit 41 with the medium ID and area ID. The fact that the process has failed is recorded as a log, and the valid flag corresponding to the corresponding medium ID and area ID in the one-time password DB 412 is set to invalid.

  In addition, when the collation result is collation OK, when the write result received in the collation request from the portable terminal 2 is other than the write success (for example, the write is unsuccessful or the process is interrupted), a new one for the corresponding area ID Even if the one-time password is generated again and written to the storage medium 3 via the portable terminal 2, the writing result is returned to the authentication server device 4 via the portable terminal 2, and written to the one-time password DB 412 in the authentication server device 4. Good.

  In step S28, the collation result is determined, and if the collation result is OK (step S28-Yes), the process proceeds to step S29, and the service provision apparatus 5 is provided with a service so as to provide a predetermined service to the user. Notify instructions. On the other hand, if the collation result is collation NG (step S28—No), the process is terminated.

  On the other hand, if the authentication fails in step S22 (step S22-No), the process proceeds to step S30, an NG response due to the authentication failure is transmitted, and the process ends.

  Although not shown in the figure, if the collation request cannot be received from the portable terminal 3 even after waiting for a certain time in step S25, the process times out and the process is stopped.

  As described above, according to the present invention, it is only necessary to provide a password generator that generates a one-time password in either the authentication server device or the portable terminal through the storage medium. Further, according to the present invention, a safe one-time password can be realized by distributing it using a different route even if it is configured to use a single storage medium with a single one-time password generator. If the storage medium is an NFC tag, the reliability of the storage medium itself that stores the one-time password is verified by correctly verifying and matching the one-time password of the storage medium that is exchanged every time the user performs a proximity operation. Can be maintained, and a secure one-time password can be realized even with a single one-time password generator.

  The present invention is not limited to the above-described embodiment, and many changes and modifications can be made. For example, in the present embodiment, the case where a new one-time password is transmitted as an OK response at the time of an authentication request has been described. However, a new one-time password may be transmitted when a verification result is transmitted. In this case, a process for receiving a one-time password write request and a write result to the storage medium 3 after receiving the verification result is performed, and a process for transmitting the write result to the authentication server device 4 is further added. Then, when an authentication request is made, the OTP generation unit 422 does not generate a new one-time password or authentication key by simply selecting an area ID, but before the verification result is transmitted after the one-time password verification process, the OTP generation unit 422 generates a new one-time password. Or an authentication key may be generated.

  Although the case where terminal authentication is performed has been described in the present embodiment, terminal authentication may be omitted, or user authentication may be performed in addition to terminal authentication.

  In the present embodiment, the case where a new one-time password is generated in the OTP generation unit 422 of the authentication server device 4 has been described. However, the portable terminal 2 may have a password generation unit. In this case, the OK response received from the authentication server device 4 may include the area ID, and the medium update unit may overwrite the one-time password on the storage medium 3 using the one-time password generated by the password generation unit. Further, the verification request unit may transmit the one-time password generated by the password generation unit to the authentication server device 4 together with the authentication request.

  In the present embodiment, the case has been described where, when selecting an area ID used for one-time password authentication, the mobile terminal 2 selects the area ID of the one-time password of the area that is not currently written. In addition to determining and selecting both the transmission destination and the valid flag in the DB 412, it is also possible to select a candidate for which the valid flag is valid as a selection candidate. Also, the status of the transmission destination and valid flag of the one-time password DB 412 is periodically checked, the transmission destination of the same terminal ID reaches a certain ratio, or the area where the validity flag is invalid reaches a certain ratio. If there are restrictions on the area ID selection candidates, a warning is output to the administrator of the authentication server device 4, and writing is performed to reset all the one-time passwords of the storage medium 3 by a dedicated terminal carried by the administrator. You may make it make it.

  In this embodiment, a plurality of one-time passwords can be used for one storage medium by using a plurality of area IDs. However, if a single one-time password is sufficient, a single area ID or a fixed area is used. May be.

  In the present embodiment, when the authentication server device 4 receives a verification request from the portable terminal 2, the one-time password DB 412 has a one-time password used for verification, and the new one-time password generated by the OTP generation unit 422 is Although the case where it is temporarily stored in the work area has been described, it is also possible to store both for verification and for update for each area ID in the one-time password DB. In that case, the new one-time password generated by the OTP generation unit 422 is stored for update, and after the verification process, the one-time password is slid from update to verification, and the one-time password storage area 322 of the storage medium 3 is stored. The current status is stored for verification. In addition, a plurality of one-time passwords generated by the OTP generation unit 422 for each area ID are stored in the one-time password DB so that the generation order can be understood, and the latest one-time password storage area 322 at the time after the verification process. May be used for the next verification.

DESCRIPTION OF SYMBOLS 1 ... Authentication system 2 ... Portable terminal 21 ... Input part 22 ... Display part 23 ... Processing part 231 ... Authentication request means 232 ... Medium update means 233 ... Verification request Means 24 ... storage unit 241 ... terminal ID
242 ... Authentication information 25 ... First communication unit 26 ... Second communication unit 3 ... Storage medium 31 ... Communication unit 32 ... Storage unit 321 ... Medium ID
322 ... One-time password storage area 33 ... Processing unit 4 ... Authentication server device 41 ... Storage unit 411 ... Terminal information DB
412 ... One-time password DB
42 ... Processing unit 421 ... Terminal authentication unit 422 ... OTP generation unit 423 ... OTP transmission unit 424 ... OTP collation unit 43 ... Communication unit 5 ... Service providing device

Claims (4)

A verification system that has a password generation unit that sequentially generates passwords, and that verifies the password read by the user terminal from the storage medium on the server device,
The user terminal includes a medium update unit that sequentially updates and reads passwords stored in the storage medium, and a verification request unit that makes a verification request to the server device,
The server device includes a password storage unit that sequentially stores the passwords, a password verification unit that verifies a password acquired from the verification request unit and a password of the password storage unit,
The password verification unit performs verification by using a password generated next to a password that has been successfully verified from the password stored in the password storage unit. The medium update unit of the user terminal updates and reads the password of the area of the storage medium corresponding to the area ID specified in the server device,
The password storage unit of the server stores a user terminal that has been verified and an area ID that is designated in association with the next generated password,
The password verification unit of the server device selects a password that does not correspond to the user terminal that requested the verification from the password storage unit, and designates the area ID corresponding to the password to the user terminal that requested the verification. The collation system according to claim 1, wherein the collation request is collated using the selected password.   3. The verification system according to claim 1, wherein the medium update unit updates with a password generated next to the password on condition that the password verification unit performs verification. . The verification system according to claim 1, wherein the password generation unit generates a next password on condition that password verification is OK in the password verification unit.

Images