JP4506747B2 - Computer authentication system - Google Patents

Description

  The present invention relates to an authentication system capable of permitting use of a computer when an authentication key is connected to the computer, for example.

Conventionally, by connecting an authentication key storing an encryption code to a computer, the encryption code stored in the computer is compared with the encryption code of the authentication key, and if the verification is established, the computer can be used. There exists an authentication system (for example, patent document 1).
Specifically, in the user authentication system, if the same encryption code as the authentication key is stored in the computer, the computer can be used after the encryption code is verified.
In order to be able to use the computer with the authentication key, a registration operation for storing the encryption code of the authentication key in the computer is required. In the registration operation, a user or the like who uses the computer connects a new authentication key that has not been registered. At this time, the computer receives the encryption code of the new authentication key. The encryption code for the new authentication key is stored in this computer.

As described above, by performing the registration work, one authentication key corresponds to one computer, and a specific computer can be used with the authentication key.
Usually, the user who uses the computer often performs the registration work, and the fact is that the computer corresponding to the authentication key is managed for each user who uses the computer.
JP 2005-174113 A

In the authentication system of Patent Document 1, authentication keys are managed in units of users. Therefore, when the number of computers increases, it is possible to grasp as a whole which authentication key corresponds to which computer. May be difficult.
Therefore, it is very difficult to manage all authentication keys in the conventional authentication system.
In view of the above problems, an object of the present invention is to provide an authentication system in which authentication key management is very easy and the security of a computer can be kept high.

In order to achieve the above object, the present invention takes the following technical means.
That is, the technical means for solving the problems in the present invention includes a plurality of computers arranged on a network, a management server that manages the use of each computer, and a plurality of authentication keys connectable to the computers. The authentication key includes a first encryption storage unit that stores an encryption code for using the computer, a first unique information storage unit that stores unique information unique to the authentication key, and the authentication key stored in the computer. An interface capable of transmitting to the computer unique information unique to the authentication key when connected, and the computer stores a second encryption storage unit that stores an encryption code and unique information unique to the computer The second unique information storage unit, the authentication key unique information transmitted from the authentication key interface, or the computer. An interface capable of transmitting unique information unique to the computer to the management server, a verification unit for verifying the encryption code of the computer and the encryption code of the authentication key with permission from the management server, and verification by the verification unit A use permission unit that permits the use of the computer, an information storage unit that stores the unique information of the plurality of computers and the unique information of the plurality of authentication keys in association with each other, and the transmission from the interface. A determination unit that determines whether or not the connected authentication key is related to the computer based on the authentication key unique information, the computer unique information, and the related information; and the authentication key connected by the determination unit includes: Collation permission that allows the collation unit of the computer to collate with the authentication key when it is determined to be related to the computer In that it has and.

In another technical means of the present invention, the authentication key has a random number generation unit that generates a random number based on a noise signal generated from a noise generation source, and the computer is based on the random number transmitted from the random number generation unit. A cryptographic code generation unit for generating a cryptographic code, and the authentication key interface is configured to transmit a random number generated by the random number generation unit to a computer, and the computer interface is generated by the cryptographic generation unit The encryption code is transmitted to the authentication key.
According to another technical means of the present invention, the authentication key has a first rewriting unit that rewrites a pre-stored encryption code with an encryption code created by the computer's encryption creation unit, and the computer is stored in advance. The second rewriting unit rewrites the existing encryption code with the encryption code created by the encryption creation unit.

  According to another technical means of the present invention, the unique information of the computer includes a computer name for distinguishing each computer, and the unique information of the authentication key includes a device ID for distinguishing the authentication key, A device ID of the authentication key and a computer name are stored as related information in the information storage unit, and the determination unit is a computer name of the computer connected to the device ID of the authentication key connected to the computer in the information storage unit Is associated with the computer, it is determined that the authentication key is associated with the computer.

In another technical means of the present invention, the unique information of the computer includes a hierarchical level of the computer, and the unique information of the authentication key includes a hierarchical level of the authentication key. Is stored in the information storage unit as related information, and the determination unit is authenticated if the hierarchical level of the authentication key connected to the computer is at the same level or higher than the hierarchical level of the connected computer. The key is to determine that the key is associated with the computer.
In another technical means of the present invention, the unique information of the computer includes a hierarchy level and an affiliation destination of the computer, and the unique information of the authentication key includes the hierarchy level and the affiliation destination of the authentication key. And the affiliation destination, the hierarchy level of the authentication key and the affiliation destination are stored as related information in the information storage unit, and the determination unit includes the hierarchy level of the authentication key connected to the computer and the affiliation destination in the information storage unit If the hierarchical level of the connected computer and the affiliation destination are associated with each other, it is determined that the authentication key is associated with the computer.

  Another technical means of the present invention comprises a plurality of computers arranged on a network, a management server for managing the use of each computer, and a plurality of authentication keys connectable to the computers, A first encryption storage unit that stores an encryption code for using the computer, a first unique information storage unit that stores unique information unique to the authentication key, and the authentication key connected to the computer, An interface capable of transmitting unique information unique to the authentication key to the computer, and the management server stores a second encryption storage unit that stores an encryption code corresponding to the computer, an encryption code of the computer, and the authentication key A collation unit that collates the encryption code of the computer, and the unique information of the plurality of computers and the unique information of the plurality of authentication keys are stored in association with each other An information storage unit, a determination unit that determines whether the connected authentication key is related to the computer based on the unique information of the authentication key and the unique information of the computer, and the authentication key connected by the determination unit A collation permitting unit that allows the collation unit to collate with an authentication key when it is determined to be associated with a computer, and a use permission unit that permits use of the computer when collation is established in the collation unit; It is in having.

  According to the present invention, the management associated with the association between the authentication key and the computer is very easy, and the security of the computer can be kept high.

Embodiments of the present invention will be described with reference to the drawings.
[First embodiment]
As shown in FIG. 1, the computer authentication system can, for example, manage computers in a company (inside a company) in an integrated manner. The computer authentication system of the present invention will be described by taking one company (for example, Company X) as an example.
As shown in FIG. 1, Company X is divided into three departments: a head office, a department, and a section. The departments of company X have a hierarchical structure in the order of head office, department, and section. A plurality of computers 1 (clients) are arranged in each department, and each computer 1 can be connected by a network 2 such as an in-house LAN. At the head office, a management server 3 for collectively managing the computers 1 arranged in each department is arranged.

The computer 1 can be used when a user or the like connects the authentication key 4. First, a method for enabling the computer 1 using the authentication key 4 will be briefly described with reference to FIG.
1 indicates information stored in the management server 3, and the frame B in FIG. 1 indicates information stored in the computer 1. In FIG. In the frame C, information stored in the authentication key 4 is shown.
As shown in FIG. 1, each computer 1 stores at least an encryption code (for example, ksiusmjfutknlg) and its own computer name (for example, hirai).

The computer name is information for identifying (distinguishing) one computer 1 from a plurality of computers 1, and the computer name assigned to each computer is different. The computer name is a part of unique information (unique information) of the computer 1.
The authentication key 4 stores at least an encryption code and a device ID (for example, H-23A568). The device ID is information for specifying one authentication key 4 from the plurality of authentication keys 4, and the device ID assigned to each authentication key is different. The device ID is one of unique information (unique information) of the authentication key 4.

The management server 3 stores at least computer names of a plurality of computers 1 and device IDs of a plurality of authentication keys 4. The management server 3 stores the computer name of the computer 1 and the device ID of the authentication key 4 in association with each other, and the authentication key 4 corresponding to the computer 1 can be known from this information.
As shown in FIG. 1, when the authentication key 4 is connected to the computer 1 after starting the computer 1, the computer 1 transmits its computer name to the management server 3. Further, the authentication key 4 transmits its own device ID to the management server 3.

The management server 3 calls the device ID of the authentication key 4 associated with the computer name based on the computer name transmitted from the computer 1. Then, the management server 3 determines whether or not the device ID called from the management server 3 matches the device ID transmitted from the authentication key 4.
Next, if the device ID called by the management server 3 matches the device ID transmitted from the authentication key 4, the management server 3 associates the computer 1 with the authentication key 4 connected to the computer 1. And the verification of the encryption code of the computer 1 and the encryption code of the authentication key 4 is permitted.

When verification permission is granted from the management server 3, verification between the encryption code stored in the computer 1 and the encryption code stored in the authentication key 4 is performed between the computer 1 and the authentication key 4. .
If the verification of the encryption code of the computer 1 and the encryption code of the authentication key 4 is established, the computer 1 finally completes startup. As a result, the computer 1 can be used.
Hereinafter, the authentication system of the computer 1 of the present invention will be described in detail.

The computer authentication system includes a plurality of computers 1 arranged on a network 2, a management server 3, and a plurality of authentication keys 4.
First, the configuration of the authentication key 4 will be described.
As shown in FIG. 2, the authentication key 4 includes an interface 8 that can be connected to an interface 7 (for example, USB) of the computer 1, a storage unit 9, a control unit 10, and a random number generation unit 11.
The random number generator 11 is composed of an IC chip or the like. The random number generator 11 amplifies thermal noise (white noise) generated inside the device in an analog manner, samples the signal, binarizes it, and generates a digital number, thereby generating a true random number.

As shown in FIG. 3, the random number generator 11 includes a noise source 12 that outputs a noise signal, an amplifier 13 that amplifies the noise signal output from the noise source 12, and a binary that binarizes the amplified noise signal. And the conversion device 14.
The noise source 12 uses semiconductor thermal noise as noise. When the semiconductor thermal noise is used, a random signal having no periodicity can be obtained compared to a pseudo random number. Further, the device that becomes the noise source 12 is provided inside the IC chip, and no external parts are required.
The amplifier 13 amplifies the noise of the noise source 12 and includes operational amplifiers 13a and 13b. The noise signal amplified by the amplifier 13 is input to the Schmitt trigger gate 15, and a square wave having a pulse width corresponding to the magnitude of the noise signal is output.

The Schmitt trigger is a circuit that raises (or falls) the output pulse when the input voltage (noise signal) exceeds a certain value, and falls (or rises) the output pulse when the input voltage falls below another certain value. is there.
Therefore, the Schmitt trigger gate 15 converts the analog noise signal into a digital noise signal (TTL level) having a pulse width corresponding to the magnitude. As described above, the Schmitt trigger gate 15 functions as a converter that converts a noise signal into a digital noise signal (TTL level).

The binarization device 14 is configured by a serial register (also referred to as a serial shift register) using a sampling clock. The input of the serial register 14 is a noise signal, and the output (high voltage and low voltage) of 1 or 0 of the Schmitt trigger gate 15 is input to the serial register 14.
The serial register 14 is configured as a serial input and serial output shift register and operates with clocks CLK0 and CLK1. Note that the clock CLK0 and the clock CLK1 are clocks having the same frequency and whose phases are shifted by a half cycle.

The serial register 14 is configured by serially connecting D flip-flops 14a, 14b, and 14c in three stages (multiple stages). In the D flip-flop, the clock CLK0 is supplied to the first stage 14a and the third stage 14c, and the clock CLK1 is supplied to the second stage 14b.
As shown in FIGS. 4 and 5, in detail, the binarization device 14 binarizes the noise signal at the timing of the clock CLK0 (sampling clock). The pulse-like noise signal output from the Schmitt trigger gate 15 is sampled at the rising timing of the clock CLK0 signal by the first stage D flip-flop 14a, and the output Q of the first stage D flip-flop 14a is 1. Or 0, and becomes a quantitative (sampled) numerical value at the timing of the clock CLK0 which is a sampling clock.

Then, the output of the first-stage D flip-flop 14a is shifted to the second-stage D flip-flop 14b at the rising timing of the clock CLK1 shifted by a half cycle.
Further, at the next rising timing of CLK0, the first-stage D flip-flop 14a samples the noise signal again, and the output of the second-stage D flip-flop 14b is the third-stage D flip-flop. Shift to step 15c. That is, it is output from the serial register 14.
The above is repeated, and the sampling result by the first stage 14a appears as an output of the serial register 14 after being delayed by one cycle of the clock CLK0. Since the noise signal is a random signal, a digital physical random number (intrinsic random number) synchronized with the sampling CLK can be obtained by binarizing the noise signal. The random number generator 11 always generates a genuine random number by generating a noise signal.

In this embodiment, the binarized serial intrinsic random number is converted into a parallel signal by a parallel converter. For example, the parallel signal is 8 bits, and the number of random numbers can be 256 types (0 to 255).
As shown in FIG. 2, the storage unit 9 of the authentication key 4 is composed of a semiconductor memory or the like. The storage unit 9 includes a first encryption storage unit 20 that stores an encryption code for enabling the computer 1 and a first unique information storage unit 21 that stores unique information of the authentication key 4. Yes.

The 1st encryption memory | storage part 20 has memorize | stored the encryption code comprised from several continuous alphanumeric characters etc., for example. The first unique information storage unit 21 stores at least the device ID of the authentication key 4 that is a part of the unique information of the authentication key 4.
The authentication key 4 control unit 10 controls the interface 8, the storage unit 9, and the random number generation unit 11. For example, the authentication key 4 control unit 10 rewrites the encryption code stored in the first encryption storage unit 20 or the first unique information storage unit. Processing such as transmitting the device ID stored in the computer 21 to the computer 1 is performed.

In addition, the control unit 10 includes a first rewriting unit 22. The first rewriting unit 22 rewrites a pre-stored encryption code with a new encryption code.
Specifically, when the encryption code of the authentication key 4 and the encryption code of the computer 1 are collated, a new encryption code is transmitted from the computer 1 to the authentication key 4. The first rewriting unit 22 issues a command to write a new encryption code transmitted from the computer 1 to the first encryption storage unit 20 and rewrites the old encryption code with a new encryption code.
The interface 8 transmits information on the authentication key 4 to the computer 1 based on a command from the control unit 10 or the like, or receives information from the computer 1 based on a command from the control unit 10 or the like.

Specifically, the interface 8 transmits the device ID of the authentication key 4 to the computer 1, and transmits the encryption code of the authentication key 4, the genuine random number generated by the random number generator 11, and the like to the computer 1. The interface 8 receives an encryption code newly generated by the computer 1 from the computer.
Next, the configuration of the computer 1 will be described.
As shown in FIG. 1, each computer 1 is hierarchized on a network 2, and an authority level is given according to the hierarchy level. That is, the same authority level is given to the computer 1 of each department, and the authority level becomes higher as the hierarchical level in each department becomes higher.

For example, in Company X, the authority level (Lv1) of the computer 1 at the head office is the highest, and then the authority level (Lv2) of the computer 1 of each department (accounting department, sales department and development department) is intermediate, and each section (accounting department, The authority level of the computer 1 in the sales section 1, sales section 2, development section 1 and development section 2) is the lowest. The authority level of each computer 1 and the hierarchical level of the computer 1 are the same. The authority level (hierarchy level) of the management server 3 is the highest (for example, authority level Lv0).
These computers 1 are constituted by, for example, personal computers 1.

An operating system (OS) for controlling desired application software is recorded on the computer 1, and for example, customer data can be managed by using the application software. The computer 1 is connected to an input device (keyboard, mouse) for inputting characters, numbers, and the like and a monitor for displaying characters, numbers, images, and the like.
As shown in FIG. 2, the computer 1 includes an interface 7 to which an authentication key 4 can be connected and a cable of the network 2 and the like, a storage unit 23, and a control unit 24.

The storage unit 23 of the computer 1 includes a semiconductor memory, an HDD, and the like. The storage unit 23 includes a second encryption storage unit 25 that stores an encryption code, and a second unique information storage unit 26 that stores unique information of the computer 1.
The second encryption storage unit 25 stores, for example, an encryption code composed of a plurality of continuous alphanumeric characters and the like. The second unique information storage unit 26 stores a computer name, a user ID, and a PIN code that are part of the unique information of the computer 1.
The control unit 24 of the computer 1 controls the interface 7, the storage unit 23, and the like. The control unit 24 includes a collation unit 27, a use permission unit 28, a cipher creation unit 29, and a second rewriting unit 30.

The collation unit 27 starts collation between the encryption code of the computer 1 and the encryption code of the authentication key 4 with permission from the management server 3. The use permission unit 28 permits the use of the computer 1 when the collation is established by the collation unit 27.
The encryption creation unit 29 creates an encryption code based on the genuine random number generated by the random number generation unit 11 of the authentication key 4. Specifically, when collating the encryption code of the authentication key 4 with the encryption code of the computer 1, a genuine random number is generated by the random number generation unit 11 of the authentication key 4, and this genuine random number is transmitted to the computer 1. The encryption creation unit 29 of the computer 1 creates an encryption code based on the transmitted genuine random number.

When an encryption code is newly created by the encryption creation unit 29, the second rewriting unit 30 of the computer 1 issues a command to write the new encryption code to the second encryption storage unit 25, and the new encryption code is sent to the second encryption storage unit. The code is rewritten to a new one by writing to 25.
The interface 7 has a USB interface and a LAN interface.
The LAN interface transmits information (for example, device ID) received from the authentication key 4 to the management server 3 and transmits information (for example, computer name) of the computer 1 to the management server 3. Further, the LAN interface receives information from the management server 3 (for example, verification permission and verification non-permission).

The USB interface transmits information of the computer 1 (for example, a new encryption code) to the authentication key 4 and receives information of the authentication key 4 (for example, a device ID and a true random number).
Next, the configuration of the management server 3 will be described.
The management server 3 includes an interface 32 that can be connected to a plurality of computers 1 through the network 2, a storage unit 33, and a control unit 34. The management server 3 is connected to an input device (keyboard, mouse) for inputting characters, numbers, etc., a monitor for displaying characters, numbers, images, and the like.

The storage unit 33 of the management server 3 includes a semiconductor memory, an HDD, and the like. The storage unit 33 includes an information storage unit 35 that stores the unique information of the plurality of computers 1 and the unique information of the plurality of authentication keys 4 in association with each other as related information.
Specifically, as shown in FIG. 6, the information storage unit 35 stores a computer name for identifying (distinguishing) the computer 1, and the affiliation and hierarchy of the computer 1 corresponding to the computer name. The level, user ID, PIN code, and the like are stored.
The information storage unit 35 stores a device ID for identifying (distinguishing) the authentication key 4, and also stores an encryption code, a user ID, and the like of the authentication key 4 corresponding to the device ID.

Further, the information storage unit 35 stores association information for storing the unique information of the computer 1 and the unique information of the authentication key 4 in association with each other. The association information associates a device ID with a computer name, and this association means that verification between a specific computer 1 having a computer name and a specific authentication key 4 having a device ID is permitted. Is.
Unique information (computer name, computer 1 affiliation, hierarchy level, user ID, PIN code, etc.) and authentication key 4 unique information (device ID, hierarchy level, encryption) stored in the information storage unit 35 Code) and the association information can be freely changed by operating an input device connected to the management server 3. In other words, by operating the input device connected to the management server 3, the unique information of the computer 1, the unique information of the authentication key 4, and the contents of the association information can be added, deleted, rewritten, etc., respectively.

The control unit 34 of the management server 3 controls the interface 32, the storage unit 33, and the like. The control unit 34 includes a determination unit 36 and a verification permission unit 37.
The determination unit 36 determines whether or not the connected authentication key 4 is related to the computer 1 based on the unique information of the authentication key 4 transmitted from the authentication key 4 and the unique information and related information of the computer 1. To do. The collation permission unit 37 permits the collation unit 27 of the computer 1 to collate with the authentication key 4 when it is determined that the authentication key 4 connected by the determination unit 36 is related to the computer 1.

Next, the operation of the management server 3 when the authentication key 4 is connected to the computer 1 will be briefly described.
When the authentication key 4 is connected to the computer 1, a device ID that is one of the unique information of the authentication key 4 and a computer name that is one of the unique information of the computer 1 are transmitted to the management server 3.
First, the control unit 34 of the management server 3 specifies the computer 1 and the authentication key 4 corresponding to the computer 1 using the computer name transmitted from the computer 1.

Specifically, the control unit 34 uses the computer name transmitted from the computer 1 to call a device ID (sometimes referred to as storage information) associated with the computer name from the information storage unit 35.
Then, the determination unit 36 determines whether or not the device ID (sometimes referred to as transmission information) transmitted from the authentication key 4 matches the stored information.
The determination unit 36 determines that there is a relationship between the computer 1 and the authentication key 4 if the transmission information and the storage information match. If the transmission information and the storage information do not match, the determination unit 36 determines that the computer 1 in the verification. And the authentication key 4 are determined not to be related.

If the determination unit 36 determines that the computer 1 and the authentication key 4 are related, the verification permission unit 37 transmits a verification permission signal to the computer 1. When the computer 1 receives the verification permission signal, the verification unit 27 verifies the encryption code of the authentication key 4 with the encryption code of the computer 1. If the verification of the encryption code of the authentication key 4 and the encryption code of the computer 1 is established, for example, if the encryption code of the authentication key 4 and the encryption code of the computer 1 match, the activation of the OS of the computer 1 is completed. be able to.
On the other hand, when the determination unit 36 determines that there is no relevance in the verification between the computer 1 and the authentication key 4, the verification permission unit 37 transmits a verification non-permission signal to the computer 1.

When the computer 1 receives the verification non-permission signal, the verification unit 27 does not verify the encryption code of the authentication key 4 with the encryption code of the computer 1 and keeps the computer 1 unusable. The state in which the computer 1 cannot be used is, for example, that even when the computer 1 is turned on, the startup of the OS stored in the computer 1 is not completely completed, or even if the OS is completely started up. The computer 1 completely rejects input from the keyboard and mouse.
Next, the operation of the authentication system will be described with reference to FIGS. 6 to 8, taking as an example the case where the authentication key 4 is connected to the computer 1a with the computer name “yamamoto”.

As shown in FIG. 7, in step 10, when a user using the computer 1a turns on the computer 1a, a predetermined OS (for example, Windows (registered trademark) manufactured by Microsoft) installed in the computer 1a is displayed. Startup starts.
In step 10, it is assumed that the computer 1a is turned on after the authentication key 4 is connected to the computer 1a.
In step 11, the computer name “yamamoto” stored in the second unique information storage unit 26 of the computer 1 a is transmitted to the management server 3 according to a command from the control unit 34 of the computer 1 a.

In step 12, the authentication key 4 transmits the device ID stored in the first unique information storage unit 21 to the computer 1a.
In step 13, the computer 1 a transmits the device ID of the authentication key 4 to the management server 3 after receiving the device ID from the authentication key 4.
In step 14, the management server 3 receives the device ID of the authentication key 4 and the computer name “yamamoto”, and uses the computer name “yamamoto” transmitted from the computer 1 a according to a command from the control unit 34 of the management server 3. Then, the device ID “H-11B368” associated with the computer name is called from the information storage unit 35 (see FIG. 6).

In step 15, the determination unit 36 of the management server 3 sends the device ID (transmission information) transmitted from the authentication key 4 via the computer 1 a and the device ID “H-11B368” called in step 14, that is, stored information. Whether or not is consistent.
For example, if the transmission information is “H-11B368” in step 15, it matches the stored information “H-11B368”, so the process proceeds to step 16. For example, if the transmission information is not “H-11B368” in step 15 and is different from this transmission information, the transmission information does not match the stored information, and the process proceeds to step 17.

In step 16, the verification permission unit 37 of the management server 3 transmits a verification permission signal to the computer 1a (permits verification between the computer and the authentication key). In step 17, the verification permission unit 37 of the management server 3 transmits a verification non-permission signal to the computer 1a (permission of verification between the computer and the authentication key is not permitted).
As shown in FIG. 8, in step 18, a screen for inputting a PIN code is displayed on the monitor in accordance with an instruction from the control unit 34 of the computer 1a.
In step 19, it is determined whether or not the PIN code input by the control unit 34 via the keyboard or the like matches the PIN code recorded in the second unique information storage unit 26 of the computer 1 a. That is, if the PIN code recorded in the computer 1a matches the input PIN code, the process proceeds to step 20, and if not, the process returns to step 18.

In step 20, the computer 1 a side (control unit 24) requests the authentication key 4 to transmit an encryption code, and is recorded in the first encryption recording unit 20 of the authentication key 4 under the control of the control unit 10 of the authentication key 4. The encryption code transmitted from the authentication key 4 and the encryption code recorded in the second encryption recording unit 26 of the computer 1a are verified by the verification unit 27 of the computer 1a. If the encryption code of the authentication key 4 matches the encryption code of the computer 1a, the process proceeds to step 21.
In step 20, if the verification of the encryption code of the authentication key 4 and the encryption code of the computer 1a is not established, the process is terminated, and for example, the OS program is set so that the OS of the computer 1a cannot finally complete startup. Stop reading. Alternatively, even if the OS of the computer 1a is completed, the input of the input device is rejected so that the computer 1a cannot be operated by an input device such as a keyboard or a mouse.

In step 21, the use permission unit 28 permits the use of the computer 1a, that is, permits the user to log in to the OS (Windows (registered trademark)).
In step 22, a transmission request for transmitting a random number to the authentication key 4 is made from the computer 1 a side (control unit 24), and a genuine random number generated in the random number generation unit 11 is called under the control of the control unit 10 of the authentication key 4, It transmits to the computer 1a. After that, when the computer 1a receives the genuine random number, the encryption creating unit 29 creates an encryption code based on the genuine random number.
For example, the authentication key 4 takes out 16 bits from random number data (0, 1 data) generated by the random number generation unit 11 on the authentication key 4 side when a transmission request for transmitting random numbers is made from the computer 1a side. The cipher creation unit 29 of the computer 1a converts the received 16-bit random number into a character or a number to obtain a new cipher code.

Note that the 16-bit random number data itself generated by the random number generation unit 11 may be used as an encryption code.
In step 23, the computer 1 a side rewrites the old encryption code recorded in the second encryption recording unit 25 of the computer 1 a with the created new encryption code, and transmits the newly created encryption code to the authentication key 4. The authentication key 4 side receives a new encryption code, and rewrites the old encryption code recorded in the first encryption recording unit 20 of the authentication key 4 with a new encryption code.

  As described above, according to the authentication system of the present invention, the management server 3 associates and stores the unique information of the computer 1 and the unique information of the authentication key 4, the unique information of the authentication key 4 and the unique information of the computer 1. When determining that the authentication key 4 is related to the computer 1 based on the unique information, and when determining that the authentication key 4 connected by the determination unit 36 is related to the computer 1 In addition, since the collation unit 27 of the computer 1 permits the collation with the authentication key 4 to be collated, the management server 3 can easily manage the association between the authentication key 4 and the computer 1 collectively. can do. Furthermore, since the device ID corresponding to the computer 1 can be rewritten on the management server 3 side, even if the authentication key 4 is lost, the device ID corresponding to the lost authentication key 4 is changed to the device ID of another authentication key 4. By rewriting, the computer 1 can be put into use using another authentication key 4.

Further, since the authentication key 4 includes the random number generation unit 11 and the first rewriting unit 22, and the computer 1 includes the encryption creation unit 29 and the second rewriting unit 30, the authentication key 4 is stored in the computer 1. After the connection and collation are completed, the encryption code can be rewritten to a new encryption code using the genuine random number generated by the random number generation unit 11.
Therefore, since the encryption code is rewritten every time when the encryption code of the authentication key 4 and the encryption code of the computer 1 are established, the security level of the computer 1 can be improved.

[Second Embodiment]
The computer authentication system according to the second embodiment changes the determination of the determination unit 36 in the management server 3 after assigning a hierarchical level to the authentication key as compared with the first embodiment. FIG. 9 shows the operation of the authentication system in the second embodiment.
A hierarchy level is assigned to the authentication key. Specifically, as shown in FIG. 6, the hierarchical level is stored in the unique information of the authentication key. In this embodiment, a level “Lv1” corresponding to the hierarchical level of the head office computer is set for the authentication key 4a that can start the head office computer. Further, a level “Lv2” corresponding to the hierarchical level of the computer of each unit is set for the authentication key 4b that can start the computer of each unit.

Further, a level “Lv3” corresponding to the hierarchical level of the computer of each section is set for the authentication key 4c that can activate the computer of each section.
The determination unit 36 of the management server 3 determines that the authentication key 4 is a computer if the hierarchical level of the authentication key 4 connected to the computer 1 is the same level as the hierarchical level of the computer 1 or higher than the hierarchical level of the computer 1. 1 is determined to be associated.
Further, the determination unit 36 determines that the authentication key 4 is not associated with the computer 1 when the hierarchical level of the authentication key 4 is equal to or lower than the hierarchical level of the computer 1.

The operation of the authentication system in the second embodiment will be described with reference to the flowchart of FIG. In FIG. 9, steps 10 to 13 are the same as those in the first embodiment, and thus the description thereof is omitted. Further, the processing after Step 16 is the same as the processing of Step 18, Step 19 and Step 21 to Step 23 shown in FIG. Description of portions common to the processing shown in FIG. 8 is omitted.
In step 14 ', the management server 3 calls the hierarchical level of the computer 1 corresponding to the computer name and also calls the hierarchical level of the authentication key 4 corresponding to the device ID.

In step 15 ′, the determination unit 36 of the management server 3 determines that the hierarchical level of the authentication key 4 is the same level as the hierarchical level of the computer 1, or the hierarchical level of the authentication key 4 is higher than the hierarchical level of the computer 1. Is also determined to be higher. In step 15 ′, if the hierarchical level of the authentication key 4 is the same level as the hierarchical level of the computer 1, or if the hierarchical level of the authentication key 4 is higher than the hierarchical level of the computer 1, the process goes to step 16a. If not, go to Step 17.
For example, as shown in FIG. 6, when the authentication key 4 with the device ID “H-11B368” is connected to the computer 1a with the computer name “yamamoto”, the hierarchy level of the authentication key 4 and the hierarchy level of the computer 1a Therefore, the determination unit 36 determines that the computer 1a and the authentication key 4 are related.

On the other hand, when the authentication key 4 with the device ID “H-11B368” is connected to the computer 1b with the computer name “hirai”, the hierarchical level of the authentication key 4 is lower than the hierarchical level of the computer 1b. Therefore, the determination unit 36 determines that the computer 1b and the authentication key 4 are not related.
In step 16a, if the encryption code of the authentication key 4 connected to the computer 1 is stored in the management server 3, the management server 3 stores the authentication key 4 connected to the computer 1 to which the authentication key 4 is connected. Send encryption code. Thereby, the computer 1 can recognize the encryption code of the authentication key 4.

In step 20 in this embodiment, the verification unit 27 of the computer 1a uses the encryption code of the authentication key 4 transmitted from the management server 3 in step 16a and the encryption recorded in the second encryption recording unit 26 of the computer 1a. The code is collated, and if the encryption code of the authentication key 4 matches the encryption code of the computer 1a, the process proceeds to step 21.
According to this embodiment, for example, as shown in FIGS. 1 and 6, the hierarchical level of the authentication key 4 a that enables the computer 1 at the head office is set to the same level as the hierarchical level of the computer 1 at the head office. Therefore, the computer 1 of each department (accounting department, sales department, development department) and the computer 1 of each department (accounting department, sales department 1, sales department 2, development department 1, development department 2) using the authentication key 4a of the head office. Can be activated.

On the other hand, since the hierarchy level of the authentication key 4b enabling the computer 1 of the accounting section is lower than the hierarchy level of the computer 1 of the head office or each department, each department (accounting department, sales department) The computer 1 of the department or the development department) or the computer 1 of the head office cannot be activated.
As described above, if the authentication key hierarchy level is higher than or equal to the hierarchy level of the computer, all the computers satisfying this condition can be started and top-down management can be performed. Can do.

[Third embodiment]
The computer authentication system in the third embodiment is obtained by changing the judgment of the judgment unit 36 in the management server 3 after assigning a hierarchy level and an affiliation destination to the authentication key as compared with the first embodiment. FIG. 10 shows the operation of the authentication system in the third embodiment.
The authentication key is assigned a hierarchy level and an affiliation destination. Specifically, as shown in FIG. 6, the hierarchical level and the affiliation destination are stored in the unique information of the authentication key.
If the hierarchy level of the authentication key 4 connected to the computer 1 and the hierarchy level of the computer 1 connected to the affiliation destination and the affiliation destination are associated with each other in the information storage unit 35, the determination unit 36 determines that the authentication key 4 is the computer 1. Is determined to be associated with.

The operation of the authentication system in the third embodiment will be described with reference to the flowchart of FIG. In FIG. 10, Steps 10 to 13 are the same as those in the first embodiment, and thus description thereof is omitted. Further, the processing after Step 16 is the same as the processing of Step 18, Step 19 and Step 21 to Step 23 shown in FIG. Description of portions common to the processing shown in FIG. 8 is omitted.
In step 14 '', the management server 3 calls the hierarchy level and the affiliation of the computer 1 corresponding to the computer name, and also calls the hierarchy level and the affiliation of the authentication key 4 corresponding to the device ID.

In step 15 ″, the determination unit 36 of the management server 3 determines whether or not the hierarchy level of the authentication key 4 and the hierarchy level of the computer are the same, and the affiliation destination of the authentication key 4 and the affiliation of the computer 1 It is determined whether or not the destination is the same. In step 15 '', if the hierarchical level of the authentication key 4 and the hierarchical level of the computer 1 are the same, and the affiliation destination of the authentication key 4 and the affiliation destination of the computer 1 are the same, the process proceeds to step 16a. Otherwise, go to step 17.
For example, as shown in FIG. 6, when an authentication key 4c with a device ID “H-08C788” is connected to a computer 1c with a computer name “okamoto”, the hierarchy level of the authentication key 4c and the hierarchy level of the computer 1c Are the same, and the affiliation destination of the authentication key 4 and the affiliation destination of the computer 1c are the same, the determination unit 36 determines that the computer 1c and the authentication key 4 are related.

On the other hand, when the authentication key 4c whose device ID is “H-08C788” is the computer 1d whose computer name is “saitou”, the hierarchical level of the authentication key 4 and the hierarchical level of the computer 1d are the same. However, since the affiliation destination of the authentication key 4 is different from the affiliation place of the computer 1d, the determination unit 36 determines that the computer 1d and the authentication key 4 are not related.
In step 16a, if the encryption code of the authentication key 4 connected to the computer 1 is stored in the management server 3, the management server 3 stores the authentication key 4 connected to the computer 1 to which the authentication key 4 is connected. Send encryption code. Thereby, the computer 1 can recognize the encryption code of the authentication key 4.

In step 20 in this embodiment, the verification unit 27 of the computer 1 uses the encryption code of the authentication key 4 transmitted from the management server 3 in step 16 a and the encryption recorded in the second encryption recording unit 26 of the computer 1. The code is collated, and if the encryption code of the authentication key 4 matches the encryption code of the computer 1, the process proceeds to step 21.
According to this embodiment, for example, as shown in FIG. 1, with the authentication key 4 belonging to the development department, the computer 1 of the development department that has the same hierarchical level and the same affiliation destination. Can be activated. On the other hand, even with the authentication key 4 belonging to the development department, the computer 1 such as an accounting department or sales department with a different affiliation destination cannot be started.

As described above, with each department as one group, the computers in one group can be activated by one authentication key, and the management of authentication keys and the management of computers can be performed for each department.
[Fourth embodiment]
The computer authentication system according to the fourth embodiment is such that the information on the authentication key 4 recorded on the management server 3 or the information on the computer 1 can be written into the predetermined authentication key 4 or the computer 1. is there. About another structure, it is the same as said 1st Embodiment to 3rd Embodiment.

The control unit 34 of the management server 3 has a writing unit. The writing unit writes information stored in the information storage unit 35 of the management server 3 into the authentication key 4 or the computer 1.
An operation of writing information stored in the information storage unit 35 of the management server 3 to the authentication key 4 or the computer 1 will be described with reference to the flowchart of FIG.
In step 30, when the authentication key 4 is connected to the computer 1 (hereinafter sometimes referred to as the connected computer 1), the device ID of the authentication key 4 is transmitted to the computer 1.

In step 31, after receiving the device ID of the authentication key 4, the computer 1 transmits the device ID to the management server 3.
In step 32, after the management server 3 receives the device ID, the control unit 34 of the management server 3 uses the device ID to call various information (user ID, encryption code) corresponding to the device ID from the information storage unit 35. .
In step 33, the control unit 34 of the management server 3 uses the device ID to call up the computer name of the computer 1 related to the device ID from the information storage unit 35, and various information (user ID, PIN) corresponding to the computer name. Code).

In step 34, the writing unit of the management server 3 transmits the user ID, PIN code, and encryption code together with the rewrite command signal to the computer 1 having the computer name (hereinafter also referred to as rewrite computer 1).
In step 35, the rewriting computer 1 rewrites the user ID and PIN code in the second unique information storage unit 26 of the rewriting computer 1 after receiving the user ID, PIN code, encryption code, and rewriting command signal.
In step 36, the writing unit of the management server 3 transmits the device ID and the encryption code together with the rewrite command signal to the connected computer 1.

In step 37, the connected computer 1 transmits the user ID, encryption code, and rewrite command signal to the authentication key 4 after receiving the user ID, encryption code, and rewrite command signal.
In step 38, after receiving the user ID, the encryption code, and the rewrite command signal, the authentication key 4 rewrites the encryption code stored in the first encryption storage unit 20 and is stored in the first unique information storage unit 21. Rewrite the user ID.
According to this embodiment, even if the authentication key 4 is set in advance so that the specific computer 1 can be used, the authentication key 4 can use another computer 1 different from the specific computer 1. The information of the computer 1 and the authentication key 4 can be changed freely.

[Fifth Embodiment]
The computer authentication system in the fifth embodiment manages the collation unit 27, the use permission unit 28, the cipher creation unit 29, the second rewriting unit 30, and the second cipher storage unit 25 provided in the computer 1 in the above embodiment. The server 3 is provided. The case where the above-described units provided in the computer 1 are provided in the management server 3 will be described in detail.
As illustrated in FIG. 13, the management server 3 includes an interface 32 that can be connected to a plurality of computers 1 through the network 2, a storage unit 33, and a control unit 34. The management server 3 is connected to an input device (keyboard, mouse) for inputting characters, numbers, etc., a monitor for displaying characters, numbers, images, and the like.

The storage unit 33 of the management server 3 includes a semiconductor memory, an HDD, and the like. The storage unit 33 includes an information storage unit 35 that stores the unique information of the plurality of computers 1 and the unique information of the plurality of authentication keys 4 in association with each other as related information, and the second encryption storage unit 25 ′ that stores the encryption code. Have.
As shown in FIG. 14, the second encryption storage unit 25 stores, for example, an encryption code composed of a plurality of continuous alphanumeric characters and the like. The information storage unit 35 stores a computer name for identifying (distinguishing) the computer 1, and stores an affiliation, a hierarchical level, a user ID, a PIN code, and the like of the computer 1 corresponding to the computer name. .

The information storage unit 35 stores a device ID for identifying (distinguishing) the authentication key 4, and also stores an encryption code, a user ID, and the like of the authentication key 4 corresponding to the device ID.
Furthermore, the information storage unit 35 stores association information for storing the unique information of the computer 1 and the unique information of the authentication key 4 in association with each other. The association information associates a device ID with a computer name, and this association means that verification between a specific computer 1 having a computer name and a specific authentication key 4 having a device ID is permitted. Is.

  Unique information (computer name, computer 1 affiliation, hierarchy level, user ID, PIN code, etc.) and authentication key 4 unique information (device ID, hierarchy level, encryption) stored in the information storage unit 35 Code) and association information can be freely changed by operating an input device connected to the management server 3. In other words, by operating the input device connected to the management server 3, the unique information of the computer 1, the unique information of the authentication key 4, and the contents of the association information can be added, deleted, rewritten, etc., respectively.

The control unit 34 controls the interface 32, the storage unit 33, and the like. The control unit 34 includes a determination unit 36, a verification permission unit 37, a verification unit 27 ′, a use permission unit 28 ′, an encryption creation unit 29 ′, and a second rewriting unit 30 ′.
The determination unit 36 determines whether or not the connected authentication key 4 is related to the computer 1 based on the unique information of the authentication key 4 transmitted from the authentication key 4 and the unique information and related information of the computer 1. To do. The collation permission unit 37 permits the collation unit 27 ′ of the management server 3 to collate with the authentication key 4 when it is determined that the authentication key 4 connected by the determination unit 36 is related to the computer 1.

The verification unit 27 ′ verifies the encryption code stored in the management server 3 corresponding to the computer 1 and the encryption code stored in the authentication key 4 with the permission of the verification permission unit 37 of the management server 3. Start. The use permission unit 28 ′ transmits a use permission signal to the computer 1 to permit the use of the computer 1 when the verification of the encryption code is established by the verification unit 27 ′. When receiving the use permission signal, the control unit 24 of the computer 1 completes the activation of the OS.
The encryption creation unit 29 ′ creates an encryption code based on the genuine random number generated by the random number generation unit 11 of the authentication key 4.

Specifically, when the encryption code of the authentication key 4 and the encryption code stored in the management server 3 corresponding to the computer 1 are collated, a genuine random number is generated by the random number generation unit 11 of the authentication key 4 and this genuine random number is generated. Is transmitted to the management server 3. The encryption creation unit 29 ′ of the management server 3 creates an encryption code based on the transmitted genuine random number.
When an encryption code is newly created by the encryption creation unit 29 ′, the second rewriting unit 30 ′ of the management server 3 issues a command to write a new encryption code to the second encryption storage unit 25 ′, and the new encryption code is 2 The encryption code is rewritten to a new one by writing to the encryption storage unit 25 ′.

Next, the operation of the management server 3 when the authentication key 4 is connected to the computer 1 will be briefly described.
When the authentication key 4 is connected to the computer 1, a device ID that is one of the unique information of the authentication key 4 and a computer name that is one of the unique information of the computer 1 are transmitted to the management server 3.
First, the control unit 34 of the management server 3 specifies the computer 1 and the authentication key 4 corresponding to the computer 1 using the computer name transmitted from the computer 1.

Specifically, the control unit 34 uses the computer name transmitted from the computer 1 to call a device ID (sometimes referred to as storage information) associated with the computer name from the information storage unit 35.
Then, the determination unit 36 determines whether or not the device ID (sometimes referred to as transmission information) transmitted from the authentication key 4 matches the stored information.
The determination unit 36 determines that there is a relationship between the computer 1 and the authentication key 4 if the transmission information and the storage information match. If the transmission information and the storage information do not match, the determination unit 36 determines that the computer 1 in the verification. And the authentication key 4 are determined not to be related.

If the determination unit 36 determines that the computer 1 and the authentication key 4 are related, the verification permission unit 37 outputs a verification permission to the verification unit 27 ′.
When the verification unit 27 ′ of the management server 3 receives permission from the verification permission unit 37, the encryption code of the authentication key 4 transmitted to the management server 3 via the computer 1 and the computer 1 to which the authentication key 4 is connected. Corresponding to the encryption code stored in the second encryption storage unit 25 ′ of the management server 3.
In the verification unit 27 ′, verification between the encryption code transmitted from the authentication key 4 and the encryption code stored in the management server 3 is established (the encryption code transmitted from the authentication key 4 and the management server 3 are stored in the computer 1). If the encryption code corresponding to (1) coincides), the use permission unit 28 ′ transmits a use permission signal for permitting the use of the computer 1. After receiving the use permission signal from the management server 3, the control unit 24 of the computer 1 completes startup of the OS and the like of the computer 1.

On the other hand, if the verification permission unit 37 determines that the computer 1 and the authentication key 4 are not related, the verification permission unit 37 transmits a verification non-permission signal to the computer 1. When the computer 1 (the control unit 24) receives the verification non-permission signal, the computer 1 maintains the computer 1 in an unusable state.
The state in which the computer 1 cannot be used is, for example, that even when the computer 1 is turned on, the startup of the OS stored in the computer 1 is not completely completed, or even if the OS is completely started up. The computer 1 completely rejects input from the keyboard and mouse.

Next, the operation of the authentication system in this embodiment will be described with reference to FIGS. 14 to 16, taking as an example the case where the authentication key 4 is connected to the computer 1 a with the computer name “yamamoto”.
As shown in FIG. 15, in step 50, when a user using the computer 1a turns on the computer 1a, a predetermined OS (for example, Windows (registered trademark) manufactured by Microsoft) installed in the computer 1a is displayed. Startup starts.
In step 50, it is assumed that the computer 1a is turned on after the authentication key 4 is connected to the computer 1a.

In step 51, the computer name “yamamoto” stored in the second unique information storage unit 26 of the computer 1 a is transmitted to the management server 3 in accordance with an instruction from the control unit 34 of the computer 1 a.
In step 52, the authentication key 4 transmits the device ID stored in the first unique information storage unit 21 to the computer 1a.
In step 53, the computer 1 a sends the device ID of the authentication key 4 to the management server 3 after receiving the device ID from the authentication key 4.

In step 54, the management server 3 receives the device ID of the authentication key 4 and the computer name “yamamoto”, and uses the computer name “yamamoto” transmitted from the computer 1 a according to a command from the control unit 34 of the management server 3. Then, the device ID “H-11B368” associated with the computer name is called from the information storage unit 35 (see FIG. 14).
In step 55, the determination unit 36 of the management server 3 uses the device ID (transmission information) transmitted from the authentication key 4 via the computer 1a and the device ID “H-11B368” called in step 54, that is, the stored information. Whether or not is consistent.

For example, if the transmission information is “H-11B368” in step 55, it matches the stored information “H-11B368”, so the process proceeds to step 56. For example, if the transmission information is not “H-11B368” in step 15 and is different from this transmission information, the transmission information does not match the stored information, and the process proceeds to step 57.
In step 56, the verification permission unit 37 of the management server 3 outputs a verification permission to the verification unit 27 ′. In step 57, the verification permission unit 37 of the management server 3 transmits a verification non-permission signal to the computer 1a.

As shown in FIG. 16, in step 58, a screen for inputting a PIN code to the monitor is displayed in accordance with an instruction from the control unit 34 of the computer 1a.
In step 59, it is determined whether or not the PIN code input by the control unit 34 via a keyboard or the like matches the PIN code recorded in the second unique information storage unit 26 of the computer 1a. That is, if the PIN code recorded in the computer 1a matches the input PIN code, the process proceeds to step 20, and if not, the process returns to step 58.
In step 59, the PIN code input by the computer 1 using the keyboard or the like of the computer 1 is transmitted to the management server 3, and the PIN code is recorded in the information storage unit 35 by the control unit 34 of the management server 3. It may be determined whether or not it matches the existing PIN code.

In step 60, the management server 3 requests the authentication key 4 to transmit an encryption code, and manages the encryption code recorded in the first encryption recording unit 20 of the authentication key 4 under the control of the control unit 10 of the authentication key 4. Send to server 3. In step 60, the verification unit 27 ′ of the management server 3 compares the encryption code transmitted from the authentication key 4 with the encryption code recorded in the second encryption recording unit 26 ′ of the management server 3, If the encryption code of the authentication key 4 matches the encryption code of the computer 1a, the process proceeds to step 61.
Further, in step 60, if the verification of the encryption code is not established, the process is terminated, and for example, reading of the OS program is stopped so that the OS of the computer 1a cannot finally complete startup. Alternatively, even if the OS of the computer 1a is completed, the input of the input device is rejected so that the computer 1a cannot be operated by an input device such as a keyboard or a mouse.

In step 61, the use permission unit 28 permits the use of the computer 1a, that is, permits the user to log in to the OS (Windows (registered trademark)).
In step 62, a transmission request for transmitting a random number from the management server 3 to the authentication key 4 is made, a genuine random number generated in the random number generation unit 11 is called under the control of the control unit 10 of the authentication key 4 and transmitted to the management server 3. To do. Thereafter, when the management server 3 receives the genuine random number, the encryption creation unit 29 ′ creates an encryption code based on the genuine random number.
For example, the authentication key 4 takes out 16 bits from the random number data (0, 1 data) generated in the random number generation unit 11 on the authentication key 4 side when the transmission request for transmitting random numbers is requested from the management server 3. The encryption creation unit 29 of the management server 3 converts the received 16-bit random number into a character or a number to obtain a new encryption code.

Note that the 16-bit random number data itself generated by the random number generation unit 11 may be used as an encryption code.
In step 63, the management server 3 rewrites the old encryption code recorded in the second encryption recording unit 25 ′ with the created new encryption code, and transmits the newly created encryption code to the authentication key 4. The authentication key 4 receives a new encryption code, and rewrites the old encryption code recorded in the first encryption recording unit 20 of the authentication key 4 with a new encryption code.
According to the authentication system of the present invention, the authentication key 4 includes the first encryption storage unit 20 that stores an encryption code for using the computer 1 and the first unique information storage that stores unique information unique to the authentication key 4. Unit 21 and an interface 8 capable of transmitting unique information unique to the authentication key 4 to the computer 1 when the authentication key 4 is connected to the computer 1, and the management server 3 encrypts corresponding to the computer 1. A second cipher storage unit 25 ′ for storing the code, a collation unit 27 ′ for collating the cipher code of the computer 1 with the cipher code of the authentication key 4, unique information of the plurality of computers 1 and unique information of the plurality of authentication keys Whether the connected authentication key is related to the computer 1 based on the information storage unit 35 that stores the information and the unique information of the authentication key 4 and the unique information of the computer 1. A determination unit 36 that determines whether the authentication key 4 connected by the determination unit 36 is related to the computer 1, a verification permission unit 37 that allows the verification unit 27 ′ to verify the authentication key, Since the use permission unit 28 'that permits the use of the computer when the collation is established by the collation unit 37', the management server 3 collectively associates the authentication key 4 with the computer 1 It can be managed easily. That is, the use of an arbitrary computer 1 can be permitted by the authentication key 4 and the management server 3.

The present embodiment is not limited to the above embodiment.
That is, in the above embodiment, the computer 1 can be used with the authentication key 4, but in addition to this, the management server 3 may be used with the authentication key 4. In this case, as shown in FIG. 12, the management server 3 stores the unique information of the management server 3 and the unique information of the authentication key 4 associated with the management server 3. Further, the management server 3 stores association information between the management server 3 and the authentication key 4.
In addition, by replacing the operations of the computer 1 and the authentication key 4 shown in the first to third embodiments with the operations of the management server 3 and the authentication key 4, the management server 3 can be used with the authentication key 4. Can be. If the operations of the computer 1 and the authentication key 4 are replaced with the operations of the management server 3 and the authentication key 4, steps 10 to 17 can be omitted in the flowcharts shown in FIGS.

It is a block diagram of 1st Embodiment which applied the authentication system of the computer to X company. It is the schematic of the authentication system of a computer. It is a block diagram of a random number generation means. It is explanatory drawing of a noise signal and sampling. It is a timing diagram which binarizes a noise signal with a sampling clock. It is a figure which shows the information memorize | stored in the information storage part of the management server. It is a flowchart figure which shows the operation | movement of the first half at the time of starting of the computer of 1st Embodiment. It is a flowchart figure which shows the operation | movement of the second half at the time of starting of the computer of 1st Embodiment. It is a flowchart figure which shows the operation | movement at the time of starting of the computer of 2nd Embodiment. It is a flowchart figure which shows the operation | movement at the time of starting of the computer of 3rd Embodiment. It is an operation | movement flowchart in the authentication system of the computer of 4th Embodiment. It is a figure which shows a part of information memorize | stored in the information storage part of the management server. It is the schematic of the authentication system of the computer of 5th Embodiment. It is a figure which shows the information memorize | stored in the memory | storage part of the management server. It is a flowchart figure which shows the operation | movement of the first half at the time of starting of the computer of 5th Embodiment. It is a flowchart figure which shows the operation | movement of the second half at the time of starting of the computer of 5th Embodiment.

Explanation of symbols

1 Computer 2 Network 3 Management Server 4 Authentication Key 7 Computer Interface 8 Authentication Key Interface 20 First Cryptographic Storage Unit 21 First Specific Information Storage Unit 25 Second Cryptographic Storage Unit 26 Second Specific Information Storage Unit 27 Collation Unit 28 Use Permission unit 29 Cryptographic creation unit 35 Information storage unit 36 Judgment unit 37 Verification permission unit

Claims (7)

A plurality of computers arranged on a network, a management server for managing the use of each computer, and a plurality of authentication keys connectable to the computer,
The authentication key is
A first encryption storage unit for storing an encryption code for using the computer;
A first unique information storage unit for storing unique unique information of the authentication key;
When the authentication key is connected to the computer, it has an interface capable of transmitting unique information unique to the authentication key to the computer,
The computer
A second encryption storage unit for storing the encryption code;
A second unique information storage unit for storing unique unique information of the computer;
An interface capable of transmitting to the management server unique information of the authentication key transmitted from the authentication key interface or unique information of the computer;
A collation unit that collates the encryption code of the computer and the encryption code of the authentication key with permission from the management server;
A use permission unit that permits the use of the computer when collation is established in the collation unit;
The management server
An information storage unit that stores the unique information of the plurality of computers and the unique information of the plurality of authentication keys in association with each other;
A determination unit for determining whether the connected authentication key is related to the computer based on the unique information of the authentication key transmitted from the computer interface, the unique information of the computer, and the related information;
A collation permitting unit that allows the collation unit of the computer to collate with the authentication key when it is determined that the authentication key connected by the determination unit is related to a computer;
A computer authentication system characterized by comprising:   The authentication key has a random number generation unit that generates a random number based on a noise signal generated from a noise generation source, and the computer includes an encryption generation unit that generates an encryption code based on the random number transmitted from the random number generation unit. An authentication key interface configured to transmit the random number generated by the random number generation unit to the computer, and the computer interface transmits the encryption code generated by the encryption generation unit to the authentication key. The computer authentication system according to claim 1, wherein the computer authentication system is configured as follows.   The authentication key has a first rewriting unit that rewrites a pre-stored encryption code with a new encryption code created by the computer's encryption creation unit, and the computer creates a pre-stored encryption code by the encryption creation unit. The computer authentication system according to claim 2, further comprising a second rewriting unit that rewrites the new encrypted code. The unique information of the computer includes a computer name for distinguishing each computer, the unique information of the authentication key includes a device ID for distinguishing the authentication key, and the device ID of the authentication key and the computer name Is stored in the information storage unit as related information,
The determination unit determines that the authentication key is associated with the computer if the device ID of the authentication key connected to the computer is associated with the computer name of the connected computer in the information storage unit. The computer authentication system according to claim 1. The unique information of the computer includes a hierarchy level of the computer, the unique information of the authentication key includes a hierarchy level of the authentication key, and the hierarchy level of the authentication key and the hierarchy level of the computer are related information. Stored in the storage unit,
The determination unit determines that the authentication key is associated with the computer if the hierarchical level of the authentication key connected to the computer is at the same level as or higher than the hierarchical level of the computer. The computer authentication system according to any one of the above. The unique information of the computer includes the hierarchical level and the affiliation of the computer, and the unique information of the authentication key includes the hierarchical level and the affiliation of the authentication key, and the hierarchical level and the affiliation of the computer and the hierarchical level of the authentication key And the affiliation are stored in the information storage unit as related information,
The determination unit determines that the authentication key is associated with the computer if the hierarchy level and the affiliation destination of the authentication key connected to the computer are associated with the hierarchy level and the affiliation destination of the computer in the information storage unit. The computer authentication system according to any one of claims 1 to 3. A plurality of computers arranged on a network, a management server for managing the use of each computer, and a plurality of authentication keys connectable to the computer,
The authentication key is
A first encryption storage unit for storing an encryption code for using the computer;
A first unique information storage unit for storing unique unique information of the authentication key;
When the authentication key is connected to the computer, it has an interface capable of transmitting unique information unique to the authentication key to the computer,
The management server
A second encryption storage unit for storing an encryption code corresponding to the computer;
A collation unit that collates a computer encryption code with the authentication key encryption code;
An information storage unit that stores the unique information of the plurality of computers and the unique information of the plurality of authentication keys in association with each other;
A determination unit that determines whether the connected authentication key is related to the computer based on the unique information of the authentication key and the unique information of the computer;
A collation permission unit that allows the collation unit to collate with the authentication key when it is determined that the authentication key connected by the determination unit is associated with a computer;
When verification is established in the verification unit, a use permission unit that permits use of the computer,
A computer authentication system characterized by comprising:

Images