JP4361882B2 - Authentication system - Google Patents

Description

  The present invention relates to authenticating a person using a finger or the like.

  Passwords such as personal identification numbers are widely used for authentication of identity. However, the theft of personal identification numbers is continually problematic. In connection with this, it has been proposed to authenticate the identity of the person using biometric data such as fingerprints (Patent Documents 1 and 2). However, if the fingerprint is used for authentication, the fingerprint is stored on the authentication device side, and there is a possibility that privacy leaks out or a fingerprint stolen from the authentication device side is abused.

For example, when a fingerprint is used for transactions on the Internet, it is conceivable that the buyer sends his / her fingerprint to the seller, and the seller makes an inquiry to a center or the like that stores the fingerprint information to confirm whether or not the buyer is the person himself / herself. In this case, if personal information such as a fingerprint is transmitted via the Internet, the information may be stolen in the middle. In addition, the possibility that a malicious seller abuses the buyer's fingerprint cannot be denied. Considering the case where fingerprints are handled by existing terminals such as bank ATMs, the current ATMs are not designed to read fingerprints and need to be modified. In order to be able to read fingerprints accurately with all ATMs, considerable costs and technical development are required.
JP-A-3-288954 JP-A-10-154231

An object of the present invention is to make it possible to easily and reliably authenticate the identity of an existing terminal provided with simple input means such as a numeric keypad.
An additional object of the present invention is to authenticate the identity of the person using secret data that is relatively easy to remember.

The authentication system of the present invention is an authentication system (2) in which an authentication device (4) and a terminal (6) are connected via a communication line,
The terminal (6) is provided with a card reader (32), a display unit (30) and a numeric keypad (36),
The authentication device (4) includes a secret data storage unit (12) for storing a secret finger number consisting of 0 to 9 assigned to ten fingers and 1: 1, and a random number generator. (14) and display the random number generated by the random number generator (14) on the display (30) of the terminal (6),
The authentication device (4) further includes 0 for each combination of the first number and the random number from the first number and the random number input by the user from the numeric keypad (36) for the display of the random number. A mantissa generator (18) for generating a mantissa by means of a table describing mantissas consisting of integers of ~ 9;
A conversion unit (20) for specifying a finger corresponding to a finger number equal to the temporary number is specified by the generated temporary number and the finger number stored in the secret data storage unit (12), and specified by the conversion unit (20) A reconversion unit (22) for obtaining the finger numbers of the fingers on both sides of the finger from the finger numbers stored in the secret data storage unit (12), and a second number and reconversion unit (22 And an authentication unit (24) that performs authentication by comparing the finger numbers of the fingers on both sides obtained in (1).

In the present invention, a mantissa consisting of any number from 0 to 9 is generated from the random number and the number input by the user. If the user is the user, the mantissa should be converted into a specific finger, converted into other fingers on both sides of the specific finger, and the obtained other fingers should be converted back into the mantissa and input. If the input data is compared with data obtained in the same way on the authentication device side, it can be authenticated whether or not the user is the person. If the type of data representing the code (mantissa) is a number from 0 to 9, a terminal having a numeric keypad can be authenticated, and fingerprint reading is not necessary. If the range of data is numbers and characters, it is not necessary to modify the hardware if the terminal can input characters and numbers.

  The authentication system of the present invention is preferably used in combination with password authentication such as a personal identification number as an auxiliary to increase its strength, but may be used alone for personal authentication. For example, if the data input by the user after reconversion is a two-digit number, even if it is input on a per-field basis, a correct answer is obtained with a probability of about 1/100. However, since this number changes depending on a random number, attacks such as voyeuring the person's input to the terminal or estimating the birthday or phone number as a clue cannot be established. Assuming that the user can enter and re-execute only once in the case of incorrect input, when using a two-digit number, there is a probability of about 98% even after the PIN is stolen. It can prevent fraud such as.

As secret data, the number of 0-9 is made to correspond to ten fingers at 1: 1, and the number of 0-9 in this case is called a secret finger number. The fingers may be assumed to be fingers of both hands or fingers of both feet, but it is easy to learn by numbering the fingers and does not require notes. Therefore, if a secret finger number is used, the user can easily store secret data, which is highly secure.

  The authentication data for comparison with the user's input is converted into a code by converting the code to a specific finger, converting the converted specific finger to another finger having a predetermined positional relationship with respect to this finger, and It may be converted. However, when the data representing the first code is short, for example, consisting of a 2-digit number, the authentication device may store a table for converting the data representing the first code into authentication data.

  In the following, an optimum embodiment for carrying out the present invention will be shown.

1 to 9 show an authentication device 4 and an authentication program 26 according to the embodiment. Reference numeral 2 denotes an authentication system in which a terminal 6 such as an ATM is connected to the authentication device 4 via a communication line. The authentication device 4 is provided with a personal identification number storage unit 8 to authenticate the person using the personal identification number. If necessary, another biometric data storage unit 10 is provided to authenticate the individual using the biometric data. The biometric data uses a finger vein pattern in addition to a fingerprint. The secret data storage unit 12 stores secret data shared by the user and the authentication device 4. The secret data uses, for example, a code indicating which number corresponds to which finger when the number of 0 to 9 corresponds to 10 fingers to 1: 1 . The random number generator 14 generates random numbers, and the database 16 stores various data for the IDs of cards such as cash cards and credit cards. The database 16 may not be provided.

  The mantissa generation unit 18 generates a mantissa by combining the random number generated by the random number generation unit 14 and the number input by the user from the terminal 6. The conversion unit 20 converts the mantissa into a secret value using the secret data, and the re-conversion unit 22 converts the secret value according to a predetermined rule, and then re-converts it with the secret data. As a result, authentication data is obtained. The authentication unit 24 compares the data input by the user from the numeric keypad 36 of the terminal 6 and the authentication data obtained by the re-conversion unit 22 and authenticates the identity when they match.

  An authentication program 26 is stored in the authentication device 4, for example. Instead of processing the mantissa with the conversion unit and the re-conversion unit to obtain authentication data, a table for converting the mantissa into authentication data may be stored in the storage unit 28. In this case, the table is provided separately for each secret data, in other words, for each user.

  The terminal 6 includes a display unit 30, a card reader 32, a biometric data reader 34, and a numeric keypad 36. The terminal 6 is connected to the authentication device 4 via a communication line, the display unit 30 is configured by a liquid crystal display, and the biometric data reader 34, the numeric keypad 36, and the like are configured by a pressure sensitive switch provided to overlap the liquid crystal display. Then, it becomes a normal touch panel. If the biometric data reader 34 is not provided, an existing terminal such as ATM can be used as the terminal 6 as it is.

FIG. 2 shows a procedure for identity authentication in the embodiment. When the user inputs the password using the numeric keypad 36 and matches the password stored in the password storage unit 8, the user proceeds to authentication using the finger number and generates and displays a random number on the authentication device 4 side. . Apart from this, the user also determines and inputs a random number as appropriate. A random number generated on the authentication apparatus side and a random number input by the user are combined to generate and store a mantissa f (x). The range of the mantissa is an integer from 0 to 9 , the mantissa is, for example, a finger number, and x is one of ten fingers. For the finger determined by the mantissa f (x), for example, another two fingers are determined according to a predetermined rule. For example, here, two fingers on both sides of the finger indicated by x are used, the mantissas f (x−1) and f (x + 1) are obtained for these, and the user inputs them from the numeric keypad.

Similarly, on the authentication device side, the mantissa is converted to x by the conversion unit, the re-conversion unit 22 obtains two authentication data f (x−1) and f ( x + 1 ), and the value input by the user Check for a match. If they match, further authenticate yourself by authenticating with biometric data if necessary. When performing authentication using biometric data, for example, a fingerprint for a finger is stored in a biometric data storage unit, and a biometric data reader is provided for each numeric keypad. When the data to be input by the user is, for example, 8 and 9, the numeric keys 8 and 9 are touched with a predetermined finger determined by secret data, and the fingerprint is read. In this case, since the user inputs the numbers 8 and 9, it proves that the secret data is held, and the fingerprint corresponding to the finger is read to enhance the accuracy of the personal authentication.

  FIG. 3 shows an outline of the authentication program 26. The authentication program 26 prompts the authentication device 4 to execute the command. In the secret data storing instruction 40, the secret data is stored. The random number generation instruction 42 generates a random number, and the mantissa generation instruction 44 generates a mantissa. In the biometric data storage instruction 44, biometric data such as a fingerprint is stored. In the conversion command 48, the mantissa is converted into a secret value such as a specific finger by using secret data, and in the reconversion command 50, the secret value is converted in accordance with a predetermined rule, and then converted again by the secret data for authentication. Data. In the authentication command 52, it is checked whether the authentication data matches the data input by the user. Instead of providing the conversion command 48 and the reconversion command 50, a storage command 54 may be provided to store a table of authentication data for the mantissa f (x).

  4 to 9 show specific examples of authentication using ten fingers of the left hand and the right hand. FIG. 4 shows secret data, and the numbers 0 to 9 correspond to 1: 1 for 10 fingers. A code consisting of a correspondence between each finger and a number is secret data.

Figure 5 shows the data for creating the matrix table for the mantissa occurs, are the number of 9-0 to 10 fingers of the left hand and right hand systematically correspond.

  FIG. 6 shows data for creating a matrix table. The right hand and the left hand have two orientations, the back of the hand and the palm of the hand, and there are a total of four combinations of the orientation of the right hand and the left hand. If the right hand and the left hand are not arranged separately as shown in FIG. 6 and are arranged so that the right hand and the left hand cross each other in the middle, four new combinations can be made by left-right inversion. In addition, when the right hand and the left hand are overlapped with the palms of the hands, two arrangements can be made depending on which one is face up. In this way, for example, a total of 10 arrangements can be made. The matrix table of FIG. 7 shows these arrangements in a matrix. Then, only the inside of the double line in FIG. 7 is displayed on the display unit of the terminal, and a specific cell is selected by combining a one-digit random number generated on the authentication device side and a one-digit number input by the user. To do. For example, when a column in the table of FIG. 7 is selected by a random number on the authentication device side and a row is selected by a number input by the user, one number is determined from the table. This number is preferably selected at random, so the display unit does not display the random number generated by the diagnostic device or the number selected by the person outside the double line. Here, it is preferable that the authentication apparatus side and the user input independently, and the user input numbers 0 to 9 without knowing which column is selected. Alternatively, the number input by the user may be converted into a random number of 0 to 9, and it may be determined which row of Table 7 is used with the obtained random number.

  FIG. 8 shows an authentication procedure using ten fingers. It is assumed that authentication with a password is completed first. Therefore, only the data inside the double line in the matrix table of FIG. 7 is displayed on the display unit of the terminal. In addition, a one-digit random number, for example, 7 is generated by the authentication apparatus, and the principal also inputs a one-digit random number, for example, 5. The value of the fifth row from the top in the seventh column of the table of FIG. 7 is 2, and the user sets the middle finger of the right hand as a secret value based on the data of FIG. 4 stored in the head. The middle finger of the right hand is converted into another, for example, two fingers according to a predetermined rule, and this rule itself may be public or secret. Here, the index finger and the ring finger on the right hand on both sides of the middle finger are two fingers, and the numbers 8 and 9 corresponding to these fingers are obtained from the secret data in FIG. 4 and input to the numeric keypad. For example, it is assumed that the right and left thumbs are the right and left thumbs, and the left and right little fingers are the right and left fingers, respectively.

  On the authentication device side, 2 is obtained from the input two random numbers 7 and 5 by the matrix table, and 2 corresponds to the middle finger of the right hand by the secret data. Then, 8 and 9 are obtained as finger numbers on both sides, and these are used as authentication data. Therefore, if the user can input in the order of 8 and 9, it can be confirmed that the user is the person himself / herself.

  The conversion algorithm in FIG. 8 is organized and shown in FIG. When the numbers 0 to 9 correspond to ten fingers and the mantissa 2 is determined at random, the middle finger on the right hand is determined from this correspondence. Next, a right index finger and a right ring finger are obtained according to a predetermined rule g (x), and mantissas 8 and 9 are determined and input for authentication.

  The reliability of the personal authentication in the embodiment is examined. When the mantissa 2 is displayed, the probability of a correct answer when two different numbers are input to the data is 1/72 of 1/9 × 1/8. If authentication data fails to be entered once, if it can only be entered once more, the probability that a third party who obtained the cash card and its password illegally will succeed in authentication is 1/30 to 1 / About 40. This means that fraud can be prevented in most cases, since the PIN has already been stolen. Since the authentication data 89 changes every time depending on the mantissa, it is difficult to be stolen and is safe. In order to convert a mantissa such as 2 into authentication data, it is sufficient to store numbers for ten fingers, which is relatively simple.

In the embodiment, description has been made assuming that ten fingers are fingers of both hands, but fingers of both feet may be used , or fingers imagined in the head may be used. For the finger obtained from the mantissa , the finger numbers on both sides are used as the authentication data. For example, the finger number of the middle finger of the left hand may be used as the authentication data for the middle finger of the right hand. Alternatively, two fingers on the right side of the middle finger of the right hand, for example, the finger number of the right ring and the little finger may be used as authentication data. When it is necessary to improve safety, for example, the right finger three finger numbers, that is, the right hand ring finger, the little finger and left finger little finger numbers may be used as authentication data. In order to further increase the reliability of authentication, for example, when the finger numbers 8 and 9 are input, the fingerprints of the fingers with the finger numbers 8 and 9 and the vein pattern of the finger may be input simultaneously. The authentication device may be regarded as a combination of the terminal 6 and the authentication device 4 of FIG. In the embodiment, the finger is converted into the finger number by re-conversion. However, when the secret data is a function F from number to number, the secret value y is obtained from the mantissa a by y = F (a), and z = F (y) may be used as authentication data.

The embodiment can be used for arbitrary personal authentication, and can be used when a cash card or a credit card is used in a terminal. In addition, when authenticating the identity of the person on the Internet or a mobile phone, it can be used as a reinforcement of a password or password. By storing various ID data of the principal in the IC card, attaching an IC card reader to the mobile phone, and authenticating the identity by the embodiment, election voting and various transactions can be performed safely. In this case, in order to increase the reliability of authentication, it is only necessary to use a fingerprint or a finger vein pattern as described above, and it is preferable to store the vote and the contents of the transaction in the IC card.

Block diagram of the authentication system of the embodiment The flowchart which shows the authentication algorithm in an Example Block diagram of the authentication program of the embodiment The figure which shows the code | symbol as secret data used in the Example The figure which shows the finger number as the public data which is used with execution example The figure explaining the matrix table | surface in an Example as an arrangement | sequence of the finger of both hands The figure which shows the matrix table | surface used in the Example The flowchart which shows the specific example of the personal authentication in an Example The figure which shows the processing algorithm in FIG.

2 Authentication System 4 Authentication Device 6 Terminal 8 PIN Number Storage Unit 10 Biometric Data Storage Unit 12 Secret Data Storage Unit 14 Random Number Generation Unit 16 Database 18 Mantissa Generation Unit 20 Conversion Unit 22 Reconversion Unit 24 Authentication Unit 26 Authentication Program 28 Storage Unit 30 Display Unit 32 Card Reader 34 Biometric Data Reader 36 Numeric Keypad 40 Secret Data Storage Command 42 Random Number Generation Command 44 Mantissa Generation Command 46 Biometric Data Storage Command 48 Conversion Command 50 Reconversion Command 52 Authentication Command 54 Storage Command

Claims (1)

An authentication system (2) in which an authentication device (4) and a terminal (6) are connected via a communication line,
The terminal (6) is provided with a card reader (32), a display unit (30) and a numeric keypad (36),
The authentication device (4) includes a secret data storage unit (12) for storing a secret finger number consisting of 10 fingers and a number of 0 to 9 corresponding to 1: 1, and a random number generator. (14) and display the random number generated by the random number generator (14) on the display unit (30) of the terminal (6),
The authentication device (4) further includes 0 for each combination of the first number and the random number from the first number and the random number input by the user from the numeric keypad (36) for the display of the random number. A mantissa generator (18) for generating a mantissa by means of a table describing mantissas consisting of integers of ~ 9 ;
By the generated number and finger number stored in the secret data storage unit (12) of the provisional number equal conversion unit that identifies the finger corresponding to the finger number of the temporary (20), identified by the converter unit (20) A reconversion unit (22) for obtaining the finger numbers of the fingers on both sides of the finger from the finger numbers stored in the secret data storage unit (12), and a second number and reconversion unit (22 An authentication system provided with an authentication unit (24) that compares and compares the finger numbers of the fingers on both sides obtained in (1).

Images