JP4190023B1 - Authentication apparatus, method, and computer program - Google Patents

Abstract

[PROBLEMS] Active network authentication
It provides authentication of Directory and information in IC chip read by various devices, and their automatic matching processing module and mechanism.
A network terminal that reads information in an IC chip via a reader / writer looks at an Active Directory server via the network and authenticates if the same information exists, and denies it if it does not exist. Also, if only the keys match, the information in the IC chip is updated to the Active Directory server to automatically maintain consistency, so that the authentication table in the network authentication is unified and the IC chip mounted device is lost, etc. Reduce the number of authentication table correction man-hours.
[Selection] Figure 1

Description

  The present invention relates to a mechanism for performing individual authentication in a network, and in particular, when performing individual authentication in a Windows (registered trademark) network, a serial number of an IC chip mounted device such as an IC card or a mobile phone, The present invention relates to a technique suitable for a mechanism for automatically registering and updating a user identification number in Active Directory.

  Recently, an increasing number of companies have introduced integrated authentication systems that integrate various system authentication and device authentication. The purpose of this is to unify the management by integrating user authentication databases that have been erected by the development of multiple systems.

  There is also a mechanism called single sign-on authentication for performing various system authentications and device authentications. This is because the user authentication table is unified because various systems and devices are authenticated with a single user account, and the purpose is to prevent the randomness.

  In this way, products that aim to simplify the complex management of user authentication tables by authenticating various systems and devices with a mechanism called integrated authentication system and single sign-on authentication have spread to the world. Yes.

As a user management mechanism, the server sends the generated random number and common key to the client, decrypts the device identifier received from the client with the common key, and decrypts the random number received with the public key corresponding to the device identifier. The device authentication is performed by comparing and comparing the decrypted random number and the generated random number, and the client uses the random number from the server and the common key as the IC.
Output to the card, send the random number from the IC card and the encrypted device identifier to the server, and the IC card encrypts the random number from the client with the secret key, encrypts the device identifier with the common key, encrypted Output the random number and device identifier to the client, decrypts the update data from the client with the secret key,
There is a data update system for rewriting a card (Patent Document 1).

JP 2006-024237 A

  However, many companies that have a Windows (registered trademark) network perform network authentication using Active Directory, and when building a system for integrated authentication or single sign-on authentication, user account management is available in addition to Active Directory. It was necessary to do.

  In addition, it is necessary to construct a system for account management for each product such as an entrance / exit management system using an IC card and output control of a multifunction printer, which increases the workload of the Windows (registered trademark) network administrator. There was a problem.

In the case of authentication using an IC card, every time the IC card is lost or damaged, the administrator must correct the information that links the user (user ID, etc.) and the IC card (IC card serial number, etc.). There was a problem that it took time and was not efficient.

  In addition, managing multiple user account databases requires the person in charge to perform operations such as user account registration, which increases the possibility of information leakage, and is also preferable from the viewpoint of preventing corporate information leakage. There was also a problem of not.

  The present invention has been made to solve the above-mentioned problems and problems, and reduces the complexity of management by aggregating device authentication databases on the network, and the user and the IC chip such as an IC card. The object is to provide a mechanism for automatically registering and correcting association information.

  An authentication apparatus according to one aspect of the present invention includes an IC chip that stores a manufacturing number that identifies an IC chip and a user ID that identifies a user, and a reading unit that reads data stored in the IC chip; An authentication request is made by transmitting the read IC chip data to the server, and a network terminal that performs a predetermined operation when the authentication is correct is configured to be connectable to the network terminal via communication In association with the user ID, at least the latest IC chip manufacturing number, the IC chip manufacturing number that was previously associated when the IC chip was reissued, and the user ID Storage means for associating and storing account attribute information indicating validity or invalidity of the user account, and the network A receiving means for receiving an authentication request including the manufacturing number and user ID of the IC chip read and transmitted from the IC chip, and a user ID that matches the received user ID is stored with reference to the storage means The first processing means for determining whether or not the user ID is matched, and if there is a matching user ID as a result of the determination, the latest manufacturing number stored in association with the user ID with reference to the storage means is The second processing means for determining whether or not the received manufacturing number matches, and if the manufacturing number does not match as a result of the determination, determines whether or not the manufacturing number associated with the user ID is unregistered And the third processing means, and as a result of the determination, if it is determined that the manufacturing number is not registered, the received manufacturing number is associated with the user ID and the When new registration processing is performed by storing in the means, and as a result of the determination, it is determined that the manufacturing number is not unregistered, and when the manufacturing number does not match the past manufacturing number stored in the storage means, An authentication apparatus comprising: fourth processing means for performing an update process for effectively changing account attribute information while storing the manufacturing number received from the network terminal in the storage means in association with the user ID.

  The network terminal stores organizational unit information for performing a predetermined operation, and performs a predetermined operation when the organizational unit information notified from the server matches the organizational unit information stored in advance. In the storage unit, the organizational unit information is further stored, and when the second processing unit determines that the production numbers match, or the fourth unit performs a new registration process or Fifth processing means for transmitting account attribute information of the IC chip stored in the storage means to the network terminal and causing the network terminal to execute predetermined processing when update processing is performed; You may have.

  The IC chip further stores a system code indicating whether or not to use an encryption key, and the network terminal reads the encryption key and determines whether or not to use the encryption key. If the encryption key is not used as a result of the determination, the second processing means determines whether or not the latest manufacturing number stored in the storage means matches the received manufacturing number. Thus, the authentication process may be performed.

  An authentication method according to one aspect of the present invention includes an IC chip that stores a manufacturing number that identifies an IC chip and a user ID that identifies a user, and a reading unit that reads data stored in the IC chip; An authentication request is made by transmitting the read IC chip data to the server, and a network terminal that performs a predetermined operation when the authentication is correct is configured to be connectable to the network terminal via communication In association with the user ID, at least the latest IC chip manufacturing number, the IC chip manufacturing number previously associated when the IC chip was reissued, the user ID, and the user account One executed by a computer having storage means for storing account attribute information indicating validity or invalidity in association with each other A process of receiving an authentication request including a manufacturing number and a user ID of an IC chip read and transmitted from the IC chip by the network terminal, and a user who matches the received user ID with reference to the storage means The process of determining whether or not an ID is stored, and if there is a matching user ID as a result of the determination, the latest serial number stored in association with the user ID is stored with reference to the storage means. A process for determining whether or not the received manufacturing number matches, and a process for determining whether or not the manufacturing number associated with the user ID is unregistered when the manufacturing number does not match as a result of the determination; As a result of the determination, if it is determined that the manufacturing number is unregistered and does not match the past manufacturing number stored in the storage means, The newly registered process is performed by associating the received manufacturing number with the user ID and storing it in the storage means, and if it is determined that the manufacturing number is not unregistered as a result of the determination, the network terminal And a process of performing an update process for effectively changing the account attribute information while storing the manufacturing number received from the user ID in association with the user ID.

  An IC chip for storing a manufacturing number for identifying the IC chip and a user ID for identifying a user, reading means for reading data stored in the IC chip, and data of the read IC chip to the server A network terminal that performs a predetermined operation when the authentication is correct, and is configured to be connectable to the network terminal via communication, and is associated with the user ID, at least the latest The IC chip manufacturing number and the IC chip manufacturing number associated in the past when the IC chip is reissued and the account attribute information indicating whether the user ID is valid or invalid as an account are stored in association with each other. Computer program for causing a computer having storage means to function as an authentication device A process of receiving an authentication request including the manufacturing number and user ID of the IC chip read and transmitted from the IC chip to the computer by the network terminal, and referring to the storage means, A process for determining whether or not a user ID that matches the received user ID is stored, and if there is a matching user ID as a result of the determination, the storage means is referred to and stored in association with the user ID. The process of determining whether or not the latest manufacturing number that has been matched with the received manufacturing number, and if the manufacturing number does not match as a result of the determination, the manufacturing number associated with the user ID is not registered And when the manufacturing number is determined to be unregistered as a result of the determination, the received manufacturing number is assigned to the user. -A new registration process is performed by storing it in the storage means in association with the ID, and if it is determined that the manufacturing number is not unregistered as a result of the determination, the manufacturing number received from the network terminal is A computer program for performing an update process for effectively changing account attribute information while being stored in the storage means in association with a user ID.

According to the present invention, it is possible to centrally manage network authentication of IC chip mounted devices such as IC cards and mobile phones on the network.
In addition, even if an IC chip mounted device such as an IC card or a mobile phone is lost or damaged, the network administrator does not modify the associated information, and the user information and the It is possible to automatically associate the IC chip information.

Hereinafter, embodiments according to embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic view showing an overall outline of one embodiment according to the present invention.
1, in the present invention, an Active Directory server 1, a network terminal 2 configured to be connectable to the Active Directory server 1 via communication, an IC chip reader / writer 3 connected to the network terminal 2, and an IC chip mounted device 4. It has a database server 5 that updates and manages the entry / exit history.

The Active Directory server 1 is a server that performs network authentication in a Windows (registered trademark) network. As shown in FIG. 2, the Active Directory server 1 can store at least a password and an IC chip manufacturing number in association with a user ID for identifying a user, as shown in FIG. In addition to these, in this example, organizational unit information (OU: Organizational Unit) to which the user belongs and account attribute validity / invalidity can be stored. In addition, as unlocking conditions, organizational unit information that can unlock the electronic lock in which the network terminal 2 is installed is stored in association with the identification information of the network terminal 2.
The IC chip manufacturing number is the latest IC chip manufacturing number currently used by the user (3333333333 in this example), and if the IC chip has been reissued for this user ID in the past, The past IC chip manufacturing numbers (in this example, 00000000000000 and 1111111111) can be stored in association with each other.
The user ID of the Active Directory server 1 and the IC chip manufacturing number associate the user authorized to authenticate to the Windows (registered trademark) network with the IC chip mounted device.

The network terminal 2 is configured to be connectable to the Active Directory server 1 via a Windows (registered trademark) network line.
The network terminal 2 can be configured by, for example, a so-called personal computer, PDA (Personal Data Assistance), or the like. Examples of the IC chip-mounted device 4 include so-called IC cards, mobile phones, and RFID (Radio Frequency).
IDentification).
The network terminal 2 controls the IC chip reader / writer 3 to read and authenticate data stored in the memory of the IC chip mounted device 4.

Further, the network terminal 2 has a communication control unit that performs communication processing via a LAN, a WAN, or the like, and the communication control unit transmits / receives predetermined data to / from the Active Directory server 1 or the database server 5. Processing can be performed.
The network terminal 2 has an authentication processing unit that authenticates the IC chip mounted device 4 by transmitting data read by the IC chip reader / writer 3 to the Active Directory server 1 and requesting verification.
In this example, the network terminal 2 stores in advance organizational unit information (OU) that can be unlocked as an unlocking condition in a storage unit such as a memory or a hard disk drive. Thereby, authentication by the Active Directory server 1 is completed, and it is determined whether or not the transmitted organizational unit information of the user matches the organizational unit information stored in the storage unit in advance. Is configured to perform unlocking.
The network terminal 2 also includes a history update processing unit that transmits a log of the authentication result to the database server 5 and updates the history information.
In addition, it has a correction processing unit that corrects inconsistencies found by comparing the acquired data with Active Directory.
In this example, the network terminal 2 can be constituted by a high-function network terminal that can be connected to the IC card reader / writer 3.

The IC chip reader / writer 3 is a device that is connected to the network terminal 2 and reads / writes data in the IC chip of the IC chip mounting device 4 according to a request from the network terminal 2.
In this example, the IC chip reader / writer 3 and the network terminal 2 are described as separate devices. However, the IC chip reader / writer 3 and the network terminal 2 may be integrated.

The IC chip mounting device 4 is a device held by a person entering or leaving the room. Specifically, the IC chip mounted device 4 can be configured by, for example, an IC card, a mobile phone, an RFID chip, or the like.
This IC chip mounted device 4 has a memory, and a user ID for identifying a person entering and leaving the room and a unique device manufacturing number assigned to the IC chip mounted device 4 can be stored in this memory. Yes.
In addition, the IC chip-mounted device 4 may store personal information such as names of persons entering and leaving the room, and passwords.

The database server 5 is a device that stores and manages network authentication history log data in the network.
The database server 5 is connected to a network, and updates the history database by receiving authentication history log information through the network line.

Next, a processing method according to the above-described embodiment will be described.
First, an overall outline will be described with reference to FIG.
The example shown in FIG. 1 is an example of entering and leaving the room by unlocking the electronic lock controlled by the network terminal 2 using the IC chip mounted device 4 held by the person entering and leaving the room.
First, the IC chip reader / writer 3 reads data in the IC chip by connecting or holding the IC chip mounted device 4 held by the person entering or leaving the terminal to the terminal of the IC chip reader / writer 3 (S1).
The information read at this time includes at least the user ID stored in the IC chip of the IC chip mounting device 4 and the IC chip manufacturing number, and personal information such as the names of persons entering and leaving the room and passwords. Data may be included.

  When the data in the IC chip is read, the network terminal 2 transmits the read data to the Active Directory server 1 and makes an authentication request for the data in the IC chip (S2).

The Active Directory server 1 performs an authentication process based on the received data, and transmits an approval or denial result to the network terminal 2 (S3).
At this time, the Active Directory server 1 refers to the Active Directory database as necessary, and performs registration and update processing of data of the IC chip mounted device 4 described later.

When there is a notification of approval or denial from the Active Directory server 1, the network terminal 2 performs predetermined processing such as unlocking at the time of approval and transmits the log data to the database server 5 (S4). In the case of denial, the network terminal 2 transmits the log data to the database server 5 by displaying an error message or the like.
Thereby, the database server 5 stores the transmitted log data in the history database, and ends the series of processes.

Next, detailed processing of the Active Directory server 1 in the above-described authentication or denial processing (S3) will be described with reference to FIG.
In FIG. 3, the network terminal 2 reads the system code of the IC chip (S101) and determines whether the system code is set to use the encryption key (S102).
As a result of the determination, when an encryption key is used, mode 2 processing described later is started.

  If not used as a result of the discrimination, as a mode 1 process, the network terminal 2 reads the IC chip manufacturing number and transmits it to the Active Directory server 1 (S103).

The Active Directory server 1 searches the Active Directory database, collates the latest manufacturing number (S104), and determines whether or not the corresponding manufacturing number exists (S105).
If the result of this determination is that there is no such error, error processing described later is performed.

  If the manufacturing number exists in the Active Directory database as a result of the determination, the Active Directory server 1 stores the account attribute of the manufacturing number stored in the Active Directory database and organizational unit information (OU: Organizational Unit). Is acquired (S106).

The Active Directory server 1 collates whether the account attribute information is valid or invalid (S107, S108), and if invalid, performs error processing to be described later.
If the account attribute information is valid as a result of the determination, the Active Directory server 1 compares the organizational unit information (OU) to determine whether the organizational unit information matches the unlocking condition (S109, S110).
If the result of determination is that the unlocking conditions are not met, error processing described later is performed.

  If the unlocking condition is met as a result of the determination, the Active Directory server 1 transmits the electronic unlocking instruction data and the organizational unit information to the network terminal 2, and the network terminal 2 receives the received organizational unit information. It is determined whether the information matches the organizational unit information that can be unlocked and stored in advance in the storage unit, and if applicable, a process of unlocking the electronic lock is performed (S111).

  Further, the network terminal 2 transmits the unlocked log data to the database server 5, whereby the database server 5 stores the log information in the database (S112), and ends the process.

Further, the processing when it is determined that the encryption key is used in the processing of S102 described above (mode 2) will be described with reference to FIG.
In FIG. 4, the network terminal 2 reads the IC chip manufacturing number and the user ID stored in the IC chip, and transmits them to the Active Directory server 1 (S201).

The Active Directory server 1 compares the user ID with reference to the Active Directory database, and determines whether there is a user ID that matches the received user ID (S202, S203).
If there is no matching user ID as a result of the determination, error processing described later is performed as an invalid user ID.

If there is a matching user ID as a result of the determination, the Active Directory server 1 refers to the Active Directory database and associates the IC chip manufacturing number with the user ID specified in S203. It is determined whether or not it matches the latest manufacturing number stored (S204, S205).
As a result of determination, if they do not match, the process proceeds to a new registration or reissue process in mode 3 to be described later.

  If the serial numbers match, the Active Directory server 1 refers to the Active Directory database, refers to the attribute information, the account attribute information of the user ID stored in the Active Directory database, and the organizational unit information ( OU: Organizational Unit is acquired (S206).

The Active Directory server 1 collates whether the account attribute information is valid or invalid (S207, S208), and if invalid, performs error processing to be described later.
If the attribute information is valid as a result of the determination, the Active Directory server 1 refers to the Active Directory database and compares the organizational unit information to determine whether the organizational unit information matches the unlocking condition. (S209, S210).
If the result of determination is that the unlocking conditions are not met, error processing described later is performed.

  If the unlocking condition is met as a result of the determination, the Active Directory server 1 transmits the electronic unlocking instruction data and the organizational unit information to the network terminal 2, and the network terminal 2 receives the received organizational unit information. It is determined whether the information matches the organizational unit information that can be unlocked and stored in advance in the storage unit, and if applicable, a process of unlocking the electronic lock is performed (S211).

  Further, the network terminal 2 transmits the unlocked log data to the database server 5, whereby the database server 5 stores the log information in the history database (S212), and ends the process.

Next, the processing in the case where it is determined in step S205 that the manufacturing number is not registered and is invalid (new registration or reissue processing) will be described with reference to FIG.
In FIG. 5, when it is determined in the above-described processing of S205 that the serial numbers do not match, the Active Directory server 1 starts the serial number update processing, and the Active Directory server 1 refers to the Active Directory database, It is determined whether or not the serial number is not registered (S301).

  As a result of the determination, if the manufacturing number is not registered, that is, if the user ID is registered but the IC chip manufacturing number is not registered, the manufacturing number transmitted from the network terminal 2 is newly registered. Then, the user ID is registered in association with the already registered user ID (S302), the number update process is terminated, and the process from S206 described above is performed.

If it is determined in the process of S301 that the manufacturing numbers do not match, the Active Directory server 1 sets the acquired IC chip manufacturing number to the past IC chip manufacturing number stored in the Active Directory database. It is determined whether or not they match (S303).
As a result of the determination, if it matches the past IC chip manufacturing number, it is assumed that someone is using the lost card, and error processing described later is performed.
Further, when it is determined that the manufacturing number of the past IC chip does not match as a result of the determination, the Active Directory server 1 refers to the Active Directory database and accounts attribute information and organizational unit information (OU: Organizational Unit) is acquired (S304).

The Active Directory server 1 collates whether the account attribute information is invalid (S305, S306).
That is, when the IC chip mounted device 4 is lost, it is determined whether or not the system attribute is invalid because the user has reported the loss and the account attribute information is invalidated by the system administrator. Then, it is determined whether or not the lost IC chip mounting device 4 has been reissued.

  As a result of the determination, if the account attribute is not invalid but valid, error processing described later is performed as an unauthorized IC chip-mounted device.

  If the account attribute information is invalid as a result of determination, the Active Directory server 1 reads the manufacturing number of the Active Directory database associated with the user ID from the IC chip mounted device 4. The number is updated (S307), the status of the manufacturing number is changed to valid and reissue processing is performed (S308), and the processing from S206 described above is performed.

Next, the flow of error processing will be described with reference to FIG.
In FIG. 6, when notified of error processing, the Active Directory server 1 starts error processing and issues an unauthorized intrusion warning (S401). Thus, processing such as notifying the system administrator or the like of an alert is performed.
Then, the Active Directory server 1 notifies the error processing to the database server 5, whereby the database server 5 stores the error processing log (S402) and ends the error processing.

Thus, according to the above-described embodiment, the network authentication of the IC chip mounted device 4 such as an IC card or a mobile phone on the Windows (registered trademark) network can be centrally managed by the Active Directory server 1.
In addition, even if the IC chip mounted device 4 such as an IC card or a mobile phone is lost or damaged, the network administrator can replace the new IC chip mounted device 4 with the above-described update process without correcting the association information. The user information and the IC chip information can be automatically associated by simply holding the chip reader / writer 3 over the chip reader / writer 3, eliminating errors in manual registration, and enabling efficient and accurate registration / update processing. .

Explanation of symbols

1 Active Directory Server 2 Network Terminal 3 IC Chip Reader / Writer 4 IC Chip Device 5 Database Server

Schematic showing the whole structure of the system concerning embodiment of this invention. The figure which showed the data item of the Active Directory database of this embodiment. The figure which showed the processing flow concerning this embodiment. The figure which showed the processing flow of the mode 2 concerning this embodiment. The figure which showed the processing flow of the mode 3 concerning this embodiment. The figure which showed the processing flow of the mode 4 concerning this embodiment.

Claims (5)

An IC chip for storing a manufacturing number for identifying the IC chip and a user ID for identifying the user;
Reading means for reading data stored in the IC chip;
An authentication request is made by transmitting the read IC chip data to the server, and a network terminal that performs a predetermined operation when the authentication is correct is configured to be connectable to the network terminal via communication Server,
In association with the user ID, at least the latest IC chip manufacturing number, the IC chip manufacturing number associated in the past when the IC chip was reissued, and the user ID represents whether the user ID is valid or invalid Storage means for storing account attribute information in association with each other;
Receiving means for receiving an authentication request including the manufacturing number and user ID of the IC chip read and transmitted from the IC chip by the network terminal;
Referring to the storage means, a first processing means for determining whether a user ID matching the received user ID is stored;
If there is a matching user ID as a result of the determination, the storage unit is referred to determine whether or not the latest manufacturing number stored in association with the user ID matches the received manufacturing number. A second processing means;
A third processing means for determining whether or not the manufacturing number associated with the user ID is unregistered when the manufacturing number does not match as a result of the determination;
As a result of the determination, if it is determined that the manufacturing number is unregistered, a new registration process is performed by storing the received manufacturing number in the storage unit in association with the user ID, and the determination result. If it is determined that the manufacturing number is not unregistered and does not match the past manufacturing number stored in the storage means, the manufacturing number received from the network terminal is associated with the user ID and stored in the memory. A fourth processing means for performing an update process for effectively changing the account attribute information while being stored in the means;
An authentication apparatus comprising: The network terminal stores organizational unit information for performing a predetermined operation, and performs a predetermined operation when the organizational unit information notified from the server matches the organizational unit information stored in advance. And
The storage means further stores organizational unit information,
The IC chip account stored in the storage means when the second processing means determines that the production numbers match, or when the new registration processing or update processing is performed by the fourth means And fifth processing means for transmitting attribute information to the network terminal and causing the network terminal to execute a predetermined process.
The authentication device according to claim 1. The IC chip further stores a system code indicating whether or not to use an encryption key,
The network terminal reads the encryption key and determines whether or not to use the encryption key;
As a result of the determination, when the encryption key is not used, the second processing means determines whether or not the latest manufacturing number stored in the storage means matches the received manufacturing number. Perform authentication process,
The authentication device according to claim 1 or 2. An IC chip for storing a manufacturing number for identifying the IC chip and a user ID for identifying the user;
Reading means for reading data stored in the IC chip;
An authentication request is made by transmitting the read IC chip data to the server, and a network terminal that performs a predetermined operation when the authentication is correct is configured to be connectable to the network terminal via communication In association with the user ID, at least the latest IC chip manufacturing number, the IC chip manufacturing number previously associated when the IC chip was reissued, the user ID, and the validity of the user account Or a method executed by a computer having storage means for associating and storing account attribute information representing invalidity,
A process of receiving an authentication request including a manufacturing number and a user ID of an IC chip read and transmitted from the IC chip by the network terminal;
A process of referring to the storage means to determine whether or not a user ID that matches the received user ID is stored;
If there is a matching user ID as a result of the determination, the storage unit is referred to determine whether or not the latest manufacturing number stored in association with the user ID matches the received manufacturing number. Processing,
As a result of the determination, if the manufacturing numbers do not match, a process of determining whether the manufacturing number associated with the user ID is unregistered,
As a result of the determination, if it is determined that the manufacturing number is unregistered, a new registration process is performed by storing the received manufacturing number in the storage unit in association with the user ID, and the determination result. If it is determined that the manufacturing number is not unregistered and does not match the past manufacturing number stored in the storage means, the manufacturing number received from the network terminal is associated with the user ID and stored in the memory. A process of performing an update process for effectively changing the account attribute information while being stored in the means,
An authentication method characterized by performing. An IC chip for storing a manufacturing number for identifying the IC chip and a user ID for identifying the user;
Reading means for reading data stored in the IC chip;
An authentication request is made by transmitting the read IC chip data to the server, and a network terminal that performs a predetermined operation when the authentication is correct is configured to be connectable to the network terminal via communication In association with the user ID, at least the latest IC chip manufacturing number and the IC chip manufacturing number previously associated when the IC chip was reissued, and the user ID are valid as an account. Or a computer program for causing a computer having storage means for storing the account attribute information representing invalidity to function as an authentication device,
For the above computer
A process in which the network terminal receives an authentication request including the serial number and user ID of the IC chip read and transmitted from the IC chip;
A process of referring to the storage means to determine whether or not a user ID that matches the received user ID is stored;
If there is a matching user ID as a result of determination, the storage unit is referred to determine whether the latest manufacturing number stored in association with the user ID matches the received manufacturing number. Processing,
As a result of the determination, if the manufacturing number does not match, a process of determining whether or not the manufacturing number associated with the user ID is unregistered,
As a result of the determination, if it is determined that the manufacturing number is unregistered, a new registration process is performed by storing the received manufacturing number in the storage unit in association with the user ID, and the determination result. If it is determined that the manufacturing number is not unregistered and does not match the past manufacturing number stored in the storage means, the manufacturing number received from the network terminal is associated with the user ID and stored in the memory. A process of performing an update process for effectively changing the account attribute information while being stored in the means,
A computer program that allows