JP2016006656A - Terminal device, terminal device authentication system, authentication information generation method for terminal device and authentication information generation program for terminal device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a terminal device, a terminal identification method and a terminal identification program which cannot be impersonated.SOLUTION: A terminal 100 has: a dynamic information storage unit 120; a static information storage unit 130; an authentication information generation unit 140; and an authentication information storage unit 150. A terminal identification device 200 has: an authentication information database 210; an authentication information collation unit 220; and an authentication result determination unit. The authentication information generation unit 140 generates authentication information by arbitrarily combining dynamic information generated during communication and held in the dynamic information storage unit 120 and static information such as an ID number and a pass code held in the static information storage unit 130, stores it in the authentication information storage unit 150, and transmits it to the authentication information database 210 for the next-time authentication. In the next-time authentication, the terminal 100 transmits the authentication information held in the authentication information storage unit 150 to the authentication information collation unit 220, the authentication information collation unit 220 collates it with the authentication information transmitted from the authentication information database 210, and transmits the authentication result to the terminal 100.

Description

  The present invention relates to a terminal device, a terminal device authentication system, a terminal device authentication information generation method, and a terminal device authentication information generation program.

  Currently, various portable devices are used as representatives such as smartphones, tablet terminals, and notebook personal computers. As a result, short-range wireless communication between devices, local area network (hereinafter referred to as LAN), wide area network (hereinafter referred to as WAN), and wireless fidelity communication (hereinafter referred to as Wi-Fi (registered trademark) communication) can be used. There is a growing demand for various connections. During communication using these devices, individual identification of devices is required for permission of connection establishment, various authentications, and the like.

  Various methods have been devised and implemented for individual identification of mobile devices. Many of them use unique information attached to the apparatus. The unique information mentioned here is a Media Access Control address (hereinafter referred to as MAC address), International Mobile Equipment Identity (hereinafter referred to as IMEI), circuit characteristics, passphrase, etc., which is static information that does not change with time. is there. In the case of static information, if information is stolen by some means, it is a problem that it is easily disguised.

  Therefore, various techniques for preventing impersonation have been developed. Patent Document 1 discloses a technique for encrypting a user ID with an encryption key and appropriately updating the encryption key. Further, in Patent Document 1, in order to avoid that the user cannot be accessed due to the update of the encryption key, the authentication device holds the encryption key and the user ID at the previous authentication, and uses them for authentication and data A technique for promoting renewal is also disclosed.

  Patent Document 2 discloses a technique in which a terminal stores a user's action pattern, and an authentication is performed by comparing an action pattern held by an authentication device with an action pattern stored by the terminal.

JP 2008-153728 A JP 2006-144421 A

  However, the technique of Patent Document 1 has a problem that if a user ID generated using an encryption key is obtained by any method, there is no way to prevent impersonation.

  Moreover, in the technique of patent document 2, there existed a risk of impersonating by imitating a user's action.

  The present invention has been made in view of the above problems, and an object thereof is to provide a terminal device, a terminal identification method, and a terminal identification program that cannot be camouflaged.

  In order to solve the above problems, the terminal device of the present invention has a voltage, screen transition, operated history, device connection history, acceleration, external pressure, vibration, inherent to the terminal device that changes during operation of the terminal device. Dynamic information generating means for generating dynamic information based on at least one of temperature and humidity, and authentication information generating means for generating authentication information based on the dynamic information.

  An effect of the present invention is that it is possible to prevent the terminal from being camouflaged.

It is a block diagram which shows the outline | summary of the 1st Embodiment of this invention. It is a schematic diagram which shows the authentication information generation part function of the 1st Embodiment of this invention. It is a sequence diagram which shows the authentication information generation operation | movement of the 1st Embodiment of this invention. It is a sequence diagram which shows the authentication operation | movement of the 1st Embodiment of this invention. It is a sequence diagram which shows the authentication operation | movement of the 2nd Embodiment of this invention. It is a block diagram which shows the service usage form of the 3rd Embodiment of this invention. It is a sequence diagram which shows the authentication operation | movement of the 4th Embodiment of this invention.

  Hereinafter, the present invention will be described in detail with reference to the drawings.

(First embodiment)
In this embodiment, dynamic information generated during communication is used for authentication at the next connection in addition to static information such as ID numbers and passcodes that are generally used. . Details will be described below.

  FIG. 1 is a block diagram showing a terminal 100 and a terminal identification device 200 used in the present embodiment.

  The terminal 100 includes a dynamic information generation unit 110, a dynamic information storage unit 120, a static information storage unit 130, an authentication information generation unit 140, and an authentication information storage unit 150.

  The dynamic information generation unit 110 is means for acquiring dynamic information generated during communication. Examples of the dynamic information include information related to the operation / state of the terminal 100 such as voltage, screen transition, operation history, device connection history, time, acceleration, and information outside the terminal 100 such as external pressure, vibration, temperature, and humidity. is there. Information outside the terminal 100 is acquired by various sensors or measuring instruments, for example.

  The dynamic information storage unit 120 stores the dynamic information A obtained by the dynamic information generation unit 110.

  The static information storage unit 130 stores static information B. The static information B is information that does not change during communication. For example, the MAC address, housing distortion, circuit structure, circuit characteristics, IMEI (International Mobile Equipment Identity), and path unique to each terminal 100 Information that does not change, such as phrases.

  FIG. 2 schematically shows the function of the authentication information generation unit 140. The authentication information generator 140 includes the dynamic information A (A1, A2,..., Al) held in the dynamic information storage unit 120 and the static information B (B1) held in the static information storage unit 130. , B2,... Bm) are arbitrarily combined to generate authentication information X (X1, X2,... Xn) and store it in the authentication information storage unit 150. Such generation of authentication information may be repeated any number of times. Further, a part of the generated authentication information X may be able to restore the dynamic authentication information A and the static authentication information B.

  Returning to FIG. 1, the terminal identification device 200 will be described. The terminal identification device 200 includes an authentication information database 210, an authentication information collation unit 220, and an authentication result determination unit 230.

  The authentication information database 210 holds authentication information Y associated with the terminal ID. This is the same as the authentication information X stored in the authentication information storage unit 150 of the terminal 100, and is used in the next authentication.

  The authentication information verification unit 220 has a function of verifying the authentication information X received from the terminal 100 during authentication and the authentication information Y held in the authentication information database 210. Note that the authentication information database 210 may be provided as a separate device from the authentication information matching unit 220.

  Next, an operation for generating and storing authentication information will be described. FIG. 3 is a sequence diagram showing this operation. First, the authentication information generation unit 140 requests the static information B from the static information storage unit 130 (s1). The authentication information generation unit 140 arbitrarily determines which information is requested. Next, the static information storage unit 130 transmits the requested static information B to the authentication information generation unit 140 (s2). Next, the authentication information generation unit 140 requests the dynamic information A from the dynamic information storage unit 120 (s3). The authentication information generation unit 140 arbitrarily determines which information is requested. In response to this, the dynamic information storage unit 120 transmits the dynamic information A (s4). The transmission of the static information B and the transmission of the dynamic information A may be reversed. Next, the authentication information generation unit 140 generates authentication information X (s5). The generation of the authentication information X is performed by arbitrarily combining the dynamic data A and the static data B received by the authentication information generation unit 140 or performing an operation. Next, the authentication information generation unit 140 transmits the authentication information X to the authentication information storage unit 150 (s6). The authentication information storage unit 150 stores authentication information X used for the next authentication (s7). Next, the authentication information generation unit 140 transmits the authentication information X to the authentication information database 210 (s8). At this time, the authentication information X may be encrypted. The authentication information database 210 stores the received authentication information X as authentication information Y used for next authentication (s9). Note that the order of s6 and s8 may be reversed.

  Next, an operation for identifying the terminal 100 will be described. FIG. 4 is a sequence diagram showing this operation. First, the terminal 100 transmits the authentication information X held by the earthquake to the authentication information verification unit 220 (s101). The authentication information matching unit 220 holds the authentication information X (s102). Next, the authentication information collation unit 220 requests authentication information Y for collation from the authentication information database 210 (s103). The authentication information database 210 transmits the authentication information Y held by itself (s104). Next, the authentication information collation unit 220 collates the authentication information X with the authentication information Y (s105). Next, the authentication result is transmitted to the terminal 100.

  The authentication information X generated as described above includes dynamic information A unique to the terminal 100 and cannot be imitated by other terminals. For this reason, according to the present embodiment, the terminal 100 can be identified safely and reliably.

  Note that this embodiment is not limited to a mobile phone or a personal computer, and can be applied to any electronic device having a changing internal state. Specific examples include cars, bicycles, desks, and watches.

(Second Embodiment)
When the terminal 100 is authenticated by the terminal identification device 200 for the first time, the authentication information database 210 does not have the authentication information Y generated using the dynamic information A. For this reason, the first authentication is performed by collating the initial authentication information V held by the predetermined terminal 100 with the initial authentication information W held by the authentication information database 210. The initial authentication information V and W are static information such as IMEI and passphrase, for example.

FIG. 5 is a sequence diagram showing this operation. First, the terminal 100 transmits initial authentication information V to the authentication information verification unit 220 (s201). Next, the authentication information collation unit 220 holds the initial authentication information V (s202). Next, the authentication information collation unit 220 requests initial authentication information W from the authentication information database 210 (s203). In response to this, the authentication information database 210 transmits the initial authentication information W to the authentication information matching unit 220 (s204). Next, the authentication information collation unit 220 collates V and W (s205). Subsequently, the authentication information matching unit 220 transmits the authentication result to the terminal 100 (s206). When the authentication is established, the terminal 100 starts generating authentication information X for the next authentication (s207). Subsequent operations are the same as those in the first embodiment.

(Third embodiment)
The first and second embodiments can be applied when the terminal 100 uses the service of the service providing server 300.

  FIG. 6 is a schematic block diagram showing an example of this application mode. The terminal 100, the terminal identification device 200, and the service providing server 300 are connected to each other via a network. The authentication information database 210 is not necessarily integrated with the terminal identification device 200, and is an external device that can communicate with the service providing server 300 in this example. When the terminal 100 uses a service provided by the service providing server 300, the terminal 100 transmits authentication information X (authentication information V for the first time) to the terminal identification device 200 and receives authentication. When the authentication is established, the terminal 100 starts using the service. The terminal 100 generates new authentication information X by the end of service use, transmits it to the authentication information database 210 via the service providing server 300 or the terminal identification device 200, and is stored as authentication information Y used for the next authentication. The

  Although the above example is an example, the load on the terminal identification device 200 is reduced by separating the authentication information database 210 from the terminal identification device 200. With such a configuration, a usage form in which the terminal identification function is entrusted to a trusted third party (TTP) is widely used. Note that communication between apparatuses in the above example is desirably encrypted.

  As described above, by using this embodiment, the service provided by the service providing server 300 by the terminal 100 can be used safely.

(Fourth embodiment)
As described in the first embodiment, a part of the authentication information X and Y may be restored to the original dynamic information A. The restored dynamic information A is stored as likelihood information Z representing the characteristics of the terminal 100 in the authentication information database 210. The likelihood here is used to mean “reliability”. The authentication information collation unit 220 can detect impersonation by the likelihood check in addition to the normal authentication.

  FIG. 7 is a sequence diagram showing a matching operation using the likelihood information Z. At this time, normal authentication information X is also authenticated, but since it has already been described, description thereof is omitted here.

  First, the terminal 100 transmits the authentication information X to the authentication information matching unit 220 (s301). The authentication information collation unit 220 restores the dynamic information A by restoring a part of the authentication information X (s302). Next, the authentication information collation unit 220 requests the likelihood information Z corresponding to the restored A from the authentication information database (s303). The authentication information database 210 transmits the requested likelihood information Z (s304). Next, the authentication information collation unit 220 collates the dynamic information A and the likelihood information Z (s305). The collation in s305 does not require a strict match as in normal authentication, but it is preferable to provide a criterion such as accepting a match if there is a certain width. For example, it is assumed that the likelihood information Z of the voltage at a certain node is 5 ± 3V. If it is a regular access, the restored dynamic information A falls within 5 ± 3V. However, if it is an unauthorized access, there is a possibility that a different numerical value such as 100V may appear due to the restoration. The possibility of unauthorized access is determined by such steps (s306). The information to be restored may be static information B.

  As described above, by applying this embodiment, it is possible to further reduce the probability of impersonation.

The present invention has been described above using the above-described embodiment as an exemplary example. However, the present invention is not limited to the above embodiment. That is, the present invention can apply various modes that can be understood by those skilled in the art within the scope of the present invention.
(Appendix 1)
Dynamic information generating means for generating second dynamic information based on first dynamic information unique to the terminal device that changes during operation of the terminal device;
A terminal device comprising: authentication information generating means for generating authentication information based on the second dynamic information.
(Appendix 2)
The terminal device according to supplementary note 1, wherein the first dynamic information is information related to an operation of the terminal device or a state of the terminal device.
(Appendix 3)
The terminal device according to appendix 2, wherein the information related to the operation of the terminal device or the state of the terminal device includes at least one of voltage, screen transition, operated history, device connection history, and acceleration.
(Appendix 4)
The terminal device according to appendix 1, wherein the first dynamic information includes information outside the terminal device.
(Appendix 5)
The terminal device according to appendix 4, wherein the information outside the terminal device includes at least one of external pressure, vibration, temperature, and humidity.
(Appendix 6)
The terminal device according to any one of appendices 1 to 5, wherein the authentication information generation unit further generates authentication information based on static information that does not change during operation of the terminal device.
(Appendix 7)
Dynamic information generating means for generating second dynamic information based on first dynamic information unique to the terminal device that changes during operation of the terminal device;
Authentication information generating means for generating authentication information based on the second dynamic information;
A terminal device having authentication information storage means for storing the authentication information;
An authentication information database external to the terminal device that holds the authentication information; and
A terminal device authentication system comprising: authentication information collating means for collating the authentication information stored in the authentication information storage means and the authentication information held in the authentication information database in next authentication.
(Appendix 8)
Likelihood information extracting means for extracting likelihood information representing characteristics of the terminal device from the authentication information held in the authentication information database, and likelihood information storing means for storing the likelihood information And
The authentication information collating unit restores dynamic information from the authentication information stored in the authentication information storing unit, collates the restored dynamic information with the likelihood information, and determines the possibility of unauthorized access. The terminal device authentication system according to appendix 7, characterized by: determining.
(Appendix 9)
Generating second dynamic information based on the first dynamic information unique to the terminal device that changes during operation of the terminal device;
An authentication information generating method for a terminal device, wherein the authentication information is generated based on the dynamic information.
(Appendix 10)
The authentication information generation method for a terminal device according to appendix 9, wherein information relating to the operation of the terminal device or the state of the terminal device is acquired as the first dynamic information.
(Appendix 11)
The terminal device authentication according to appendix 10, wherein the information regarding the operation of the terminal device or the state of the terminal device includes at least one of voltage, screen transition, operated history, device connection history, and acceleration. Information generation method.
(Appendix 12)
The authentication information generation method according to appendix 9, wherein information outside the terminal device is acquired as the first dynamic information.
(Appendix 13)
The authentication information generation method according to appendix 12, wherein the information outside the terminal device includes at least one of external pressure, vibration, temperature, and humidity.
(Appendix 14)
The authentication information generation method according to any one of appendix 9 to appendix 13, wherein the authentication information is further generated based on static information that does not change during operation of the terminal device.
(Appendix 15)
Generating second dynamic information based on the first dynamic information unique to the terminal device that changes during operation of the terminal device;
Generating authentication information based on the second dynamic information;
Storing the authentication information in the authentication information storage means storage of the terminal device;
Holding the authentication information in an authentication information database external to the terminal device;
A control method for a terminal device authentication system, characterized in that in the next authentication, the authentication information stored in the authentication information storage means and the authentication information held in the authentication information database are collated.
(Appendix 16)
Extracting likelihood information representing the characteristics of the terminal device from the authentication information held in the authentication information database,
Storing the likelihood information;
Restoring dynamic information from the authentication information stored in the authentication information storage means;
Collating the restored dynamic information with the likelihood information;
The control method of the terminal device authentication system according to appendix 15, wherein the possibility of unauthorized access is determined.
(Appendix 17)
Generating second dynamic information based on first dynamic information unique to the terminal device that changes during operation of the terminal device;
Generating authentication information based on the second dynamic information;
Storing the authentication information in an authentication information storage means storage of the terminal device;
Holding the authentication information in an authentication information database external to the terminal device;
A control program for a terminal device authentication system, comprising: comparing the authentication information stored in the authentication information storage unit with the authentication information held in the authentication information database in next authentication.

DESCRIPTION OF SYMBOLS 100 Terminal 110 Dynamic information generation part 120 Dynamic information storage part 130 Static information storage part 140 Authentication information generation part 150 Authentication information storage part 200 Terminal identification apparatus 210 Authentication information database 220 Authentication information collation part 300 Service provision server A Dynamic Information B Static information X, Y Authentication information V, W Initial authentication information Z Likelihood information

Claims (10)

Dynamic information is generated based on at least one of voltage, screen transition, operation history, device connection history, acceleration, external pressure, vibration, temperature, and humidity unique to the terminal device that changes during operation of the terminal device. Dynamic information generating means;
An authentication information generating means for generating authentication information based on the dynamic information. The terminal device according to claim 1, wherein the authentication information generation unit further generates authentication information based on static information that does not change during operation of the terminal device. Dynamic information is generated based on at least one of voltage, screen transition, operation history, device connection history, acceleration, external pressure, vibration, temperature, and humidity unique to the terminal device that changes during operation of the terminal device. A terminal device comprising dynamic information generating means, authentication information generating means for generating authentication information based on the dynamic information, and authentication information storage means for storing the authentication information;
An authentication information database external to the terminal device that holds the authentication information; and
A terminal device authentication system comprising: authentication information collating means for collating the authentication information stored in the authentication information storage means and the authentication information held in the authentication information database in next authentication. Likelihood information extracting means for extracting likelihood information representing characteristics of the terminal device from the authentication information held in the authentication information database, and likelihood information storing means for storing the likelihood information And
The authentication information collating unit restores dynamic information from the authentication information stored in the authentication information storing unit, collates the restored dynamic information with the likelihood information, and determines the possibility of unauthorized access. The terminal device authentication system according to claim 3, wherein the determination is performed. Dynamic information is generated based on at least one of voltage, screen transition, operation history, device connection history, acceleration, external pressure, vibration, temperature, and humidity specific to the terminal device that changes during operation of the terminal device. ,
An authentication information generating method for a terminal device, wherein the authentication information is generated based on the dynamic information. 6. The authentication information generation method for a terminal device according to claim 5, wherein the authentication information is further generated based on static information that does not change during operation of the terminal device. Dynamic information is generated based on at least one of voltage, screen transition, operation history, device connection history, acceleration, external pressure, vibration, temperature, and humidity specific to the terminal device that changes during operation of the terminal device. ,
Generating authentication information based on the dynamic information;
Storing the authentication information in an authentication information storage means of the terminal device;
Holding the authentication information in an authentication information database external to the terminal device;
A control method for a terminal device authentication system, characterized in that in the next authentication, the authentication information stored in the authentication information storage means and the authentication information held in the authentication information database are collated. Extracting likelihood information representing the characteristics of the terminal device from the authentication information held in the authentication information database,
Storing the likelihood information;
Restoring dynamic information from the authentication information stored in the authentication information storage means;
Collating the restored dynamic information with the likelihood information;
The control method of the terminal device authentication system according to claim 7, wherein the possibility of unauthorized access is determined. Dynamic information is generated based on at least one of voltage, screen transition, operation history, device connection history, acceleration, external pressure, vibration, temperature, and humidity unique to the terminal device that changes during operation of the terminal device. Steps,
And generating authentication information based on the dynamic information. An authentication information generation program for a terminal device, comprising: Dynamic information is generated based on at least one of voltage, screen transition, operation history, device connection history, acceleration, external pressure, vibration, temperature, and humidity unique to the terminal device that changes during operation of the terminal device. Steps,
Generating authentication information based on the dynamic information;
Storing the authentication information in an authentication information storage means of the terminal device;
Holding the authentication information in an authentication information database external to the terminal device;
A control program for a terminal device authentication system, comprising: comparing the authentication information stored in the authentication information storage unit with the authentication information held in the authentication information database in next authentication.

Images