JP2018159971A - Authentication system, authentication method, and authentication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable authenticating only when a user generating a password (PW) and a user using the PW are facing or close to each other, in an authentication system having a terminal displaying the PW and a terminal performing authentication processing.SOLUTION: An authentication system having a first device for displaying a PW, and a second device that performs authentication processing is provided, the first device comprising a position information acquisition unit that acquires position information of the first device, a first PW generating unit for generating a PW by a message digest using the acquired position information and a predetermined initial value, and a PW display unit for displaying the generated PW. The second device comprises a position information acquisition unit for acquiring position information of the second device, a second PW generation unit for generating the PW by a message digest using the acquired position information and a predetermined initial value, and a PW comparator for determining that authentication is successful, if the generated PW matches the input PW.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication technique for computers and smartphones, and more particularly to an authentication technique that uses a temporary password issued when biometric authentication fails.

In recent years, biometric authentication technologies such as face authentication, fingerprint authentication, and iris authentication are becoming widespread in authentication technologies such as computers. By using these biometric authentication techniques, the user does not need to memorize IDs and passwords, and authentication can be realized with excellent accuracy. Therefore, there is an advantage that convenience is high.
On the other hand, if the authentication is not successful due to, for example, a face being scratched during face authentication, authentication must be performed by other methods.

Here, the authentication method using two computers includes the following methods. That is, a password is issued by the first computer, and the user acquires the generated password from the first computer. The user inputs the acquired password into the second computer. In order to confirm whether the input password is a password issued by the first computer, the second computer inquires to the first computer via a network or the like.
In this method, if the computer that generates the password and the computer that confirms the password are not connected via a network, it cannot be confirmed whether or not the entered password is correct.

JP 2014-38612 A JP 2011-2960 A JP 2010-282322 A

By the way, when a computer is used at a school or the like, for example, a tablet computer may be carried to go out of school for learning. In such a case, it may occur that the computer that generates the password and the computer that confirms the password cannot be connected via a network.
Therefore, it is desirable to enable authentication even when these computers cannot be connected via a network.

When a computer is used at a school or the like, both a computer that generates a password and a computer that confirms the password may be used in a relatively close place.
In such a case, if the generated password is made available only when the person who issued the password and the person using it are in a face-to-face or relatively close location, the person who issued the password Since the person who uses the password can be visually confirmed, it is possible to prevent an unspecified person from using the password.
In other words, if the password can be used only face-to-face, the identity of the person who uses the password can be confirmed from the face and appearance, which is useful when the password is used after confirming the identity. is there.

  Therefore, the present inventor has earnestly researched, causing the computer that generates the password and the computer that confirms the password to acquire the position information, causes these computers to generate the password by message digest based on the position information and a predetermined initial value, By making these passwords comparable and enabling authentication, we succeeded in realizing authentication using a password that can only be used face-to-face, and completed the present invention.

Here, as an authentication technique using position information, the authentication systems described in Patent Document 1 and Patent Document 2 can be cited. According to these authentication systems, it is possible to acquire the location information of the computer and make the authentication successful only when the computer is in a predetermined range. Patent Document 3 discloses an authentication system that generates an authentication code based on the coordinate value of a GPS calculated position or the distance between the same position and a predetermined position.
However, in the authentication systems described in these patent documents, the authentication is successful only when the person who uses the computer that generates the password and the person who uses the password by using the computer that confirms the password exist face-to-face. It was not possible to do that.

  The present invention has been considered in view of the above circumstances, and authentication is performed only when a person who uses a computer that generates a password and a person who uses a computer that confirms the password are in a face-to-face relationship. An object is to provide an authentication system, an authentication method, and an authentication program that can be used successfully even in an offline environment.

  In order to achieve the above object, an authentication system of the present invention is an authentication system including a first information processing apparatus that displays a password and a second information processing apparatus that performs an authentication process, wherein the first information processing apparatus The apparatus generates a password by message digest using the position information acquisition unit for acquiring the position information of the first information processing apparatus and the acquired position information of the first information processing apparatus and a predetermined initial value. One password generation unit and a password display unit for displaying the generated password, and the second information processing device includes a password input unit for inputting a password and positional information of the second information processing device. A password is generated by a message digest using the acquired position information acquisition unit, the acquired position information of the second information processing apparatus, and the predetermined initial value. A second password generation unit that, if the password the input with the generated password matches, a configuration equipped with a determining password comparison unit and an authentication success.

  In the authentication system of the present invention, the first password generation unit generates a password by message digest using only the position information of the first information processing apparatus, and the second password generation unit generates the second It is also preferable that the password is generated by message digest using only the position information of the information processing apparatus.

  The authentication method of the present invention is an authentication method using a first information processing apparatus that displays a password and a second information processing apparatus that performs an authentication process, and acquires position information of the first information processing apparatus. The first information processing apparatus acquires position information of the first information processing apparatus, and the first password generation unit of the first information processing apparatus acquires the acquired position information of the first information processing apparatus and a predetermined initial value. Using a message digest to generate a password, the password display unit of the first information processing device displays the generated password, the password input unit of the second information processing device inputs the password, The position information acquisition unit of the second information processing device acquires the position information of the second information processing device, and the second password generation unit of the second information processing device acquires the second Information processing If a password is generated by a message digest using the position information of the device and the predetermined initial value, and the password comparison unit of the second information processing device matches the generated password and the input password, the authentication is successful. It is as a method of judging.

  Further, the authentication program of the present invention causes the first information processing apparatus to acquire the position information of the first information processing apparatus, and uses the acquired position information of the first information processing apparatus and a predetermined initial value. The password is generated by the message digest, the generated password is displayed, the second information processing apparatus is made to input the password, the position information of the second information processing apparatus is acquired, and the acquired second information A password is generated by a message digest using the position information of the information processing apparatus and the predetermined initial value, and when the generated password matches the input password, the authentication is determined to be successful.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to authenticate only when the person who uses the computer which produces | generates a password, and the person who uses a password using the computer which confirms a password exist face-to-face. Also, according to the present invention, authentication can be performed even in an offline environment.

In the block diagram which shows the structure of the authentication system of 1st embodiment of this invention, it is a figure which shows the flow of information. It is a flowchart which shows the process sequence of the authentication system of 1st embodiment of this invention. In the block diagram which shows the structure of the authentication system of 2nd embodiment of this invention, it is a figure which shows the flow of information. It is a flowchart which shows the process sequence of the authentication system of 2nd embodiment of this invention. In the block diagram which shows the structure of the authentication system of 3rd embodiment of this invention, it is a figure which shows the flow of information. In the block diagram which shows the structure of the authentication system of 4th embodiment of this invention, it is a figure which shows the flow of information.

  Hereinafter, preferred embodiments of an authentication system, an authentication method, and an authentication program of the present invention will be described with reference to the drawings.

[First embodiment]
First, a first embodiment of the present invention will be described with reference to FIGS. 1 and 2. FIG. 1 is a block diagram showing the flow of information in the block diagram showing the configuration of the authentication system of this embodiment, and FIG. 2 is a flowchart showing the processing procedure of the authentication system of this embodiment.

In FIG. 1, the authentication system has a password display device 1 and an authentication device 2.
The password display device 1 includes a location information acquisition unit 11, an organization information storage unit 12, a password generation unit 13, and a password display unit 14. The authentication device 2 includes a location information acquisition unit 21, an organization information storage unit 22, A password generation unit 23, a password input unit 25, and a password comparison unit 26 are provided.

The password display device 1 is a computer (information processing device) that generates and displays a password, and is preferably used by a user such as a school teacher.
The position information acquisition unit 11 acquires position information of the password display device 1. The position information acquisition unit 11 can receive radio waves from a satellite called GPS, for example, and input the current latitude, longitude, and altitude of the password display device 1. In recent years, such a position information acquisition unit 11 is often already built in a personal computer or a smart phone, and thus the configuration can be realized with many devices.

  The organization information storage unit 12 stores organization information such as a character string indicating an organization such as a school name and identification information. This organization information plays a role as a predetermined initial value to be used as the original data for generating the password by the message digest together with the position information of the password display device 1. By including the organization information in the original data for password generation by message digest in this way, even if another organization or organization generates a password using the same algorithm and uses this device in the same place, The same password can be prevented from being generated.

Further, in addition to the organization information, additional information such as a character string that cannot be easily imagined is stored in the organization information storage unit 12, and this is also used as original data (predetermined initial value) for generating a password by message digest. It is also preferable to use it. In this way, it is possible to further reduce the risk of the same password being generated by a third party.
Note that additional information such as a character string that cannot be easily imagined can be used as original data for generating a password by message digest instead of organization information.

  Further, as a method of further reducing the risk of the same password being generated by a third party, it is also preferable to update the initial character string at regular intervals. For example, by storing a plurality of identical initial values in the password display device 1 and the authentication device 2 in advance and selecting the same initial value based on time information based on a constant reference, the initial value is set at regular intervals. It is possible to update the character string.

The password generation unit 13 inputs position information from the position information acquisition unit 11, inputs organization information from the organization information storage unit 12, calculates a message digest from these two pieces of information, and obtains about 6 digits obtained. Generate a numeric value (character string) as a password.
A message digest, also called a hash, is an algorithm that guarantees that it is difficult to guess the original information from the generated value. By using this, the original data used to generate the message digest is used. It becomes impossible to guess.

Here, it is assumed that the position information acquired from the GPS or the like may include an error. Moreover, although the password display apparatus 1 which produces | generates a password, and the authentication apparatus 2 which confirms a password are in the position which adjoins, the case where it does not exist in the same position is assumed.
Therefore, the password generation unit 13 can process the position information so as to be the same within a range of, for example, 10 m, and use this as the original data for password generation. The method for processing the position information to be the same within a range of 10 m is not particularly limited. For example, the latitude information and the longitude information acquired by the position information acquisition unit 11 are the same within a range of 10 m. This can be done by performing a truncation process.

At this time, the password generation unit 23 in the authentication device 2 processes the position information so as to be the same within a range of, for example, 10 m, and uses a plurality of position information including the range of 10 m or less as original data for password generation. As a result, a plurality of password candidates can be generated. Then, the password comparison unit 26 authenticates with the password display device 1 by making the authentication successful when the password generated by the password generation unit 13 matches any of the plurality of passwords generated by the password generation unit 23. Only when the device 2 is in the proximity range, the authentication can be successful.
Thus, it is preferable that the password generation unit 13 and the password generation unit 23 adjust the position information to be the same within a predetermined proximity range, and generate a password using the adjusted position information.

Further, as a method of making the authentication successful only when the password display device 1 and the authentication device 2 exist within a predetermined proximity range, a radio wave communication unit (such as Bluetooth (registered trademark)) that emits a weak radio wave is used. You can also.
Specifically, each of the password display device 1 and the authentication device 2 includes a radio wave communication unit, and the password display device 1 causes the password display device 1 to display a password and causes the radio wave communication unit to generate radio waves. Then, the authentication device 2 can make the authentication by the password comparison unit 26 succeed only when the radio wave communication unit receives the radio wave from the password display device 1. As a result, the authentication can be successfully performed only when the authentication device 2 exists at a short distance where the radio wave generated by the password display device 1 reaches.

  Further, in this way, if the password display device 1 and the authentication device 2 are in the proximity range, if authentication is successful, the users of these devices are in a place where they can see each other. Only authentication can be performed. That is, the password generated by the password display device 1 can be used only when the users of these devices are facing each other. That is, the authentication system of the present embodiment generates a password that can be used only face-to-face.

In the present embodiment, the organization information storage unit 12 and the organization information storage unit 22 are omitted, and the password generation unit 13 and the password generation unit 23 use the message digest by using only the location information as original data for password generation. It is also preferred to be configured to generate a password.
That is, according to this embodiment, since the user of the password display device 1 and the authentication device 2 can succeed in authentication only when they are in the proximity range, it is visually confirmed that there is no third party in the vicinity. By performing authentication processing after confirmation, it is possible to safely perform user authentication even if the organization information storage unit 12 and the organization information storage unit 22 are omitted and a password is generated only from position information. is there.

  The password display unit 14 inputs the password generated from the password generation unit 13 and displays it on the display of the password display device 1 or the like.

The authentication device 2 is a computer that generates a password and performs an authentication process by comparing the generated password with the input password, and is preferably used by users such as school children.
The position information acquisition unit 21 acquires position information of the authentication device 2 and can be the same as the position information acquisition unit 11 in the password display device 1.
The organization information storage unit 22 stores organization information and can be the same as the organization information storage unit 12 in the password display device 1. That is, the same organization information is stored in the password display device 1 and the authentication device 2.

The password generation unit 23 inputs position information from the position information acquisition unit 21, inputs organization information from the organization information storage unit 22, calculates a message digest from these two pieces of information, and obtains about 6 digits obtained. Generate a numeric value (character string) as a password.
In addition, the password generation unit 23 processes the position information to be the same within a range of, for example, 10 m or less based on the same standard as the password generation unit 13 and outputs a plurality of position information including the range within the 10 m. Generate multiple passwords as source data for password generation.

  The password input unit 25 inputs the password displayed by the password display unit 14 offline. That is, the password is input by the user using an input device such as a keyboard or a mouse provided or connected to the authentication device 2, and the password input unit 25 inputs the password to the authentication device 2.

The password comparison unit 26 checks whether or not the password generated by the password generation unit 23 and the password input by the password input unit 25 are the same, and determines that the authentication is successful if they are the same. .
At this time, as described above, the password generation unit 23 generates a plurality of passwords based on a plurality of pieces of position information so that the authentication is successful only when the password display device 1 and the authentication device 2 exist in the proximity range. If the generated and input password is the same as one of these passwords, the authentication can be successful.

  Next, a processing procedure (authentication method) of the authentication system of this embodiment will be described with reference to the flowchart shown in FIG. In FIG. 2, only an authentication processing process using the password display device 1 and the authentication device 2 is shown. Normally, user authentication is performed in the password display device 1 prior to the start of use of the password display device 1, but this is omitted in FIG. The same applies to the flowcharts described below.

First, the password display device 1 acquires location information of the device itself (step 10), generates a password based on the location information and organization information (step 11), and displays the password (step 12). The user of the password display device 1 conveys or refers to the displayed password to the user of the authentication device 2.
The authentication device 2 inputs the password offline by user operation (step 13). Next, the authentication device 2 acquires location information of the device itself (step 14), and generates a password based on the location information and organization information (step 15).
Then, the authentication device 2 compares the input password and the generated password (step 16), and if they match (if there is a match), determines that the authentication is successful and performs various processes. (Step 17).

  According to the authentication system, the authentication method, and the authentication program of this embodiment, authentication is possible only when the user of the password display device 1 and the user of the authentication device 2 are facing each other or close to each other. can do. Even in an offline environment, authentication can be performed. Furthermore, by including the organization information in the password generation original data, it is possible to prevent the same password from being generated by another organization or organization.

[Second Embodiment]
Next, a second embodiment of the present invention will be described with reference to FIGS. FIG. 3 is a block diagram showing the flow of information in the block diagram showing the configuration of the authentication system of this embodiment, and FIG. 4 is a flowchart showing the processing procedure of the authentication system of this embodiment.
As shown in FIG. 3, the authentication system of the present embodiment includes a password display device 1a and an authentication device 2a. The authentication device 2a includes a biometric authentication unit 27a and compares passwords. This is different from the first embodiment in that the user is specified and the logon process to the OS (Windows or the like) is enabled. Other points are the same as in the first embodiment.

  The biometric authentication unit 27a performs authentication processing such as face authentication, fingerprint authentication, and iris authentication, and includes a biometric information storage unit 271a, a biometric information input unit 272a, and an authentication processing unit 273a. Hereinafter, although it demonstrates as what performs face authentication, it can be set as the same structure also about other biometrics authentication, such as fingerprint authentication and iris authentication.

The biometric information storage unit 271a stores face authentication information in association with identification information of the user of the authentication device 2a. The face authentication information is acquired in advance and stored in the biometric information storage unit 271a.
The biometric information input unit 272a inputs the face authentication information of the user of the authentication device 2a. For example, the user's face image is acquired using a Web camera or a CCD camera provided or connected to the authentication device 2a, and the biometric information input unit 272a sends the face authentication information to the authentication device 2a based on the face image. Can be entered.

The authentication processing unit 273a compares the face authentication information input from the biometric information input unit 272a with the face authentication information stored in the biometric information storage unit 271a. To log on to the OS.
On the other hand, for example, when the face of the user of the authentication device 2a is scratched, the face authentication information input from the biometric information input unit 272a matches the face authentication information stored in the biometric information storage unit 271a. If not, face authentication is not successful and logon processing to the OS is not performed.

Therefore, in the authentication system of the present embodiment, as described above in the first embodiment, a password is generated by the password display device 1a and is input to the authentication device 2a, and matches the password generated in the authentication device 2a. In addition, by making it possible to perform various processes such as a logon process as successful authentication, it is possible to appropriately perform authentication even when face authentication is not successful.
In FIG. 3, only the authentication device 2a includes the biometric authentication unit 27a, but it goes without saying that the password display device 1a can also include a biometric authentication unit.

Here, although not shown in FIG. 3, the authentication device 2 a includes a user information storage unit. The user information storage unit stores user identification information and an ID and password for logging on to the OS in association with each other.
The authentication processing unit 273a acquires user identification information from the biometric information storage unit 271a when the face authentication is successful, and acquires an ID and password from the user information storage unit based on the user identification information. Log on to the OS.

The user of the password display device 1a confirms the user who has requested the generation of the password face-to-face, and transmits the password displayed on the password display unit 14a and the identification information of the user to the user.
And the password input part 25a inputs a password and user identification information by the said user.
The password comparison unit 26a determines that the authentication is successful when the input password matches the password generated by the password generation unit 23a, and obtains the corresponding ID and password from the user information storage unit based on the input user identification information. To do.
As a result, it is possible to perform logon processing of the user to the OS.

  Next, a processing procedure (authentication method) of the authentication system of this embodiment will be described with reference to the flowchart shown in FIG. Here, it is assumed that a school teacher uses the password display device 1a and a school child uses the authentication device 2a. All of these devices are composed of tablet PCs, and it is assumed that they are out of school using these and are in an offline environment.

  First, the authentication device 2a inputs face authentication information (biometric authentication information) by a child's operation (step 20), and executes face authentication processing (step 21). At this time, if the authentication is successful, logon processing to the OS is performed (step 29). On the other hand, if the authentication is not successful because the child has a wound on the face, the child reports that fact to the teacher.

  Next, the password display device 1a acquires position information of the device itself in order to generate a password to be used temporarily by the child by the operation of the teacher (step 22). Then, a password is generated based on the position information and organization information (step 23), and this password is displayed (step 24). Thereby, the teacher can teach the displayed password to the child. At this time, the teacher confirms the child face-to-face, adds the identification information of the child to the password, and teaches the child.

Next, the authentication device 2a inputs the password and the identification information of the child offline by the operation of the child who is informed of the password (step 25). Subsequently, the authentication device 2a acquires the location information of the device itself (step 26), and generates a password based on the location information and organization information (step 27).
Then, the authentication device 2a compares the input password and the generated password (step 28), and determines that the authentication is successful if they match (if there is a match).
Further, the authentication device 2a acquires a corresponding ID and password from the user information storage unit based on the identification information of the child. Then, the authentication device 2a performs various processes such as logon to the OS (step 29).

According to the authentication system, authentication method, and authentication program of the present embodiment, when the biometric authentication by the user of the authentication device 2a fails, the password display device 1a generates a password for temporary use. The authentication process can be performed by inputting this to the authentication device 2a and comparing it with the password generated by the authentication device 2a.
In the present embodiment, the authentication device 2a is configured to include the biometric authentication unit 27a. However, the authentication device 2a includes an authentication unit other than the biometric authentication, and authentication by the authentication unit for some reason. Even if this is not successful, this embodiment can be preferably applied.

[Third embodiment]
Next, a third embodiment of the present invention will be described with reference to FIG. FIG. 5 is a diagram showing the flow of information in the block diagram showing the configuration of the authentication system of the present embodiment.
As shown in FIG. 5, the authentication system of the present embodiment includes a password display device 1b and an authentication device 2b. The password display device 1b is a time information acquisition unit 18b, and the authentication device 2b is a time information acquisition unit 28b. Is different from the first embodiment. Other points are the same as in the first embodiment.

The time information acquisition unit 18b acquires time information. This time information can be used as one of original data (predetermined initial values) for password generation. In general, a clock provided in a computer measures the time to some extent by crystal transmission without turning on the power, so that the time can be used as time information. The time information may be composed of, for example, the year, month, day, and hour, minute, and second.
The password generation unit 13b receives the location information from the location information acquisition unit 11b, the organization information from the organization information storage unit 12b, and the time information from the time information acquisition unit 18b, and generates a password by message digest using these as original data. To do.

The time information acquisition unit 28b acquires time information in the same manner as the time information acquisition unit 18b. It is assumed that the password display device 1b and the authentication device 2b measure almost the same date and time.
Similarly to the password generation unit 13b, the password generation unit 23b receives the position information from the position information acquisition unit 21b, the organization information from the organization information storage unit 22b, and the time information from the time information acquisition unit 28b. A password is generated by message digest as data.
In the present embodiment, it is also possible to generate a password by message digest from position information and time information without using an initial value such as organization information as original data for password generation. It is also possible to generate a password by message digest from only the position information.

As described above, when the time information is included in the original data for generating the password, the password changes if the date or time changes, so that the expiration date of the password can be set. For example, the password expiration date can be set to 1 hour by using the year, month, day, and time as time information and not using minutes and seconds.
Note that such a password expiration date also serves to absorb a clock error built in the computer. That is, for example, if the expiration date is 1 hour, the same password is generated in the password display device 1b and the authentication device 2b even if the clock deviates from the correct time within the range of 1 hour. .

In consideration of the case where the time information acquired by the time information acquisition unit 18b and the time information acquisition unit 28b is shifted, it is also preferable to perform the processing as follows.
That is, for example, when the expiration date is set to 1 hour, the time information acquisition unit 28b generates a plurality of password candidates using time information about several hours before and after as the original data for password generation. If the password generated by 1b matches one of the plurality of passwords, the authentication is successful, so that the authentication process can be appropriately performed even when the time information is shifted.

  According to such an authentication system, authentication method, and authentication program of this embodiment, it is possible to generate a password by message digest including time information as original data for password generation. For this reason, it is possible to give the password itself an expiration date without performing a special process for setting the expiration date for the password.

[Fourth embodiment]
Next, a fourth embodiment of the present invention will be described with reference to FIG. FIG. 6 is a block diagram showing the flow of information in the block diagram showing the configuration of the authentication system of the present embodiment.
As shown in FIG. 6, the authentication system of the present embodiment includes a password display device 1c and an authentication device 2c. The password display device 1c has a physical phenomenon information input unit 19c, and the authentication device 2c has a physical phenomenon information input. It is different from the first embodiment in that it includes a section 29c and creates position information based on the input information. Other points are the same as in the first embodiment.

The physical phenomenon information input unit 19c includes an air temperature information input unit 191c, a humidity information input unit 192c, an atmospheric pressure information input unit 193c, an illuminance information input unit 194c, and a radio wave intensity information input unit 195c. The physical phenomenon information input unit 19c may include only a part of these, but many of these are provided to improve the accuracy of the position information created by the position information acquisition unit 11c. It is preferable.
The temperature information input unit 191c, the humidity information input unit 192c, the atmospheric pressure information input unit 193c, the illuminance information input unit 194c, and the radio wave intensity information input unit 195c are provided with or connected to the authentication device 2c with sensors for acquiring the respective information. By doing this, it is possible to input each information of temperature, humidity, atmospheric pressure, illuminance (sun brightness), and radio wave intensity.
The position information acquisition unit 11c inputs temperature information, humidity information, atmospheric pressure information, illuminance information, and radio wave intensity information from the physical phenomenon information input unit 19c, and uses a combination of these as position information.

As with the physical phenomenon information input unit 19c, the physical phenomenon information input unit 29c includes an air temperature information input unit 291c, a humidity information input unit 292c, an atmospheric pressure information input unit 293c, an illuminance information input unit 294c, and a radio wave intensity information input unit 295c. I have.
Similarly to the position information acquisition unit 11c, the position information acquisition unit 21c inputs temperature information, humidity information, atmospheric pressure information, illuminance information, and radio wave intensity information from the physical phenomenon information input unit 29c, and combines these combinations. Used as location information.

As described above, according to the present embodiment, position information is generated as original data for password generation by combining physical phenomenon information that can be obtained only at the same place without acquiring position information by GPS. Can do. For this reason, even if it is difficult to acquire position information by GPS, it is possible to generate a password by message digest including position information as original data for password generation.
From this point of view, it is also preferable to use much more information as information on physical phenomena that can be obtained only at the same place.

  The password display device and the authentication device in the authentication system of each of the above embodiments can be realized using a computer controlled by the authentication program of the present invention. The CPU of the computer sends commands to each component of the computer based on the authentication program, and predetermined processing necessary for the operation of the authentication system, for example, position information acquisition processing, password generation processing, password display processing, and password comparison Causes processing to be performed. Thus, each process and operation in the authentication system of the present invention can be realized by specific means in which the program and the computer cooperate.

The program is stored in advance in a recording medium such as a ROM and a RAM, and is executed by causing the computer to read the program from a recording medium mounted on the computer. For example, the program may be read by the computer via a communication line.
Further, the recording medium for storing the program can be constituted by, for example, a semiconductor memory, a magnetic disk, an optical disk, or any other recording means that can be read by any computer.

As described above, according to the authentication system, the authentication method, and the authentication program according to the embodiment of the present invention, when the user who generates the password and the user who uses the password are facing each other or nearby. Can only be authenticable. In particular, when biometrics or the like is used as regular authentication in an authentication device, and the authentication cannot be appropriately performed due to various circumstances, a password for temporary use is generated and authentication is performed. It can be used suitably when performing.
Also, by including time information as the original data for password generation, it is possible to give the password itself an expiration date without having to perform a special process for setting the expiration date for the password.
Furthermore, it is also possible to perform authentication using position information by combining physical phenomenon information that can be obtained only at the same place without acquiring position information by GPS.

It goes without saying that the present invention is not limited to the above embodiment, and that various modifications can be made within the scope of the present invention.
For example, the first to fourth embodiments can be appropriately changed, such as a configuration in which the embodiments are variously combined.

  The present invention is temporarily used in the offline environment when a user who generates a password and a user who uses the password exist face-to-face or in close proximity and the computer authentication is not successful for some reason. For example, it can be suitably used when generating a password for enabling authentication.

DESCRIPTION OF SYMBOLS 1 Password display apparatus 11 (11a, 11b, 11c) Position information acquisition part 12 (12a, 12b, 12c) Organization information storage part 13 (13a, 13b, 13c) Password generation part 14 (14a, 14b, 14c) Password display part 18b Time information acquisition unit 19c Physical phenomenon information input unit 191c Temperature information input unit 192c Humidity information input unit 193c Atmospheric pressure information input unit 194c Illuminance information input unit 195c Radio wave intensity information input unit 2 (2a, 2b, 2c) Authentication device 21 (21a , 21b, 21c) Location information acquisition unit 22 (22a, 22b, 22c) Organization information storage unit 23 (23a, 23b, 23c) Password generation unit 25 (25a, 25b, 25c) Password input unit 26 (26a, 26b, 26c) ) Password comparison unit 27a Biometric authentication unit 271a Information storage unit 272a biometric information input unit 273a authentication processing unit 28b time information acquiring unit 29c physics information input unit 291c temperature information input unit 292c humidity information input unit 293c atmospheric pressure information input unit 294c illuminance information input unit 295c radio wave intensity information input unit

Claims (9)

An authentication system having a first information processing apparatus for displaying a password and a second information processing apparatus for performing an authentication process,
The first information processing apparatus uses a position information acquisition unit that acquires position information of the first information processing apparatus, a message digest using the acquired position information of the first information processing apparatus and a predetermined initial value. A first password generation unit for generating a password by a password display unit for displaying the generated password,
The second information processing apparatus includes a password input unit that inputs a password, a position information acquisition unit that acquires position information of the second information processing apparatus, the acquired position information of the second information processing apparatus, and A second password generation unit that generates a password by message digest using the predetermined initial value, and a password comparison unit that determines that the authentication is successful when the generated password matches the input password. An authentication system characterized by The first password generation unit generates a password by message digest using the position information of the first information processing apparatus, the predetermined initial value, and time information,
The authentication according to claim 1, wherein the second password generation unit generates a password by a message digest using the position information of the second information processing apparatus, the predetermined initial value, and time information. system.   3. The position information is acquired based on information transmitted from GPS and / or based on information on a physical phenomenon that can be obtained only at the same location. Authentication system.   The authentication system according to claim 4, wherein the physical phenomenon information is at least one selected from air temperature, humidity, atmospheric pressure, sun brightness, and radio wave intensity.   The authentication system according to claim 1, wherein the predetermined initial value is identification information of an organization provided with the authentication system.   The authentication system according to claim 1, wherein the first information processing apparatus and the second information processing apparatus are not connected to each other via a network. An authentication system having a first information processing apparatus for displaying a password and a second information processing apparatus for performing an authentication process,
The first information processing apparatus generates a password by message digest using the position information acquisition unit that acquires position information of the first information processing apparatus and the acquired position information of the first information processing apparatus. A first password generation unit and a password display unit for displaying the generated password;
The second information processing apparatus includes a password input unit for inputting a password, a position information acquisition unit for acquiring position information of the second information processing apparatus, and the acquired position information of the second information processing apparatus. An authentication system comprising: a second password generation unit that generates a password by using a message digest; and a password comparison unit that determines that the authentication is successful when the generated password matches the input password. . An authentication method using a first information processing apparatus that displays a password and a second information processing apparatus that performs authentication processing,
The position information acquisition unit of the first information processing apparatus acquires the position information of the first information processing apparatus;
The first password generation unit of the first information processing device generates a password by a message digest using the acquired position information of the first information processing device and a predetermined initial value,
The password display unit of the first information processing apparatus displays the generated password;
The password input unit of the second information processing apparatus inputs a password,
The position information acquisition unit of the second information processing apparatus acquires the position information of the second information processing apparatus;
The second password generation unit of the second information processing device generates a password by a message digest using the acquired position information of the second information processing device and the predetermined initial value,
An authentication method, wherein the password comparison unit of the second information processing apparatus determines that the authentication is successful when the generated password matches the input password. Let the first information processing apparatus acquire the position information of the first information processing apparatus, generate a password by message digest using the acquired position information of the first information processing apparatus and a predetermined initial value, Display the generated password,
Causing the second information processing apparatus to input a password, acquiring the position information of the second information processing apparatus, and using the acquired position information of the second information processing apparatus and the predetermined initial value to obtain a message digest An authentication program for generating a password according to, and executing a determination that authentication is successful when the generated password matches the input password.

Images