JP5247124B2 - Authentication device, in-vehicle device, and authentication system - Google Patents

Description

  The present invention relates to an authentication apparatus that performs user authentication using a portable terminal, and more particularly to an authentication apparatus in an authentication system that requires high security.

  2. Description of the Related Art In recent years, a technique for performing user authentication in order to ensure security for a vehicle door lock release control device and an in-vehicle control device such as a car audio has been spreading. For example, as a user authentication method for door lock release control, smart entry technology using an immobilizer (electronic mobile lock device) that performs authentication using a unique ID (IDentifier) code of a transponder (electronic chip), a mobile phone, etc. There is a method using a portable terminal. Unlike normal data communication security assurance, it is desirable that security can be ensured by a simple operation in user authentication for a device that a user uses on a daily basis, such as an in-vehicle control device.

  For example, in Patent Document 1 below, a vehicle equipped with a vehicle anti-theft device that enables the use of a car audio with the same ID code as the immobilizer in order to prevent the car audio from being stolen without a complicated operation by the user. An electronic device theft prevention device is disclosed. Further, Patent Document 2 below discloses a technology that enables a vehicle-mounted electronic device to be used when a user transmits user data using a mobile phone and the user data matches. In Patent Document 3 below, the telephone number of the mobile terminal of the user who is permitted to use is registered in advance, and the mobile terminal is not connected to the connector of the control device, or the mobile number is not registered. A vehicle anti-theft system is disclosed that operates an anti-theft function when power is turned on while a terminal is connected to a connector of a control device.

JP 2000-71893 A JP 2002-205604 A Japanese Patent Laid-Open No. 2002-220029

  However, the above conventional technique does not require a complicated operation by the user, but user authentication is performed by matching the ID code or the user information, so that there is a problem that sufficient security cannot be ensured. there were. For example, the smart entry technology is a simple method in which the key terminal returns an ID in response to a request from the authentication terminal. In addition, although it is said that the immobilizer has a very complicated ID code and it is difficult to generate a spare, the key is in the hands of a third party when creating a spare key or immediately before delivery, so it is said that it is completely safe. can not cut.

  The present invention has been made to solve the above-described problems caused by the prior art, and an authentication device, an in-vehicle device, and an in-vehicle device that can perform high-security user authentication without performing complicated operations by the user. The purpose is to provide an authentication system.

In order to solve the above-described problems and achieve the object, an authentication apparatus according to the invention of claim 1 is an authentication apparatus that performs user authentication based on information received from a portable terminal. A communication unit that establishes a communication connection, a storage unit that stores registration information used for user authentication for each mobile terminal, first authentication information that is unique information generated for each mobile terminal, and each mobile terminal An authentication unit that performs registration processing for storing the registration information including the generated second authentication information in the storage unit, and compares the registration information stored in the storage unit with information received from the portable terminal When the authentication based on the first authentication information is successful, the communication unit permits communication connection with the mobile terminal that has been successfully authenticated, and the authentication unit, after permitting communication connection, Based on the second authentication information There line authentication, the first authentication information and the plurality of items among the plurality of items, if an item of which the comparison results do not coincide is one, the registration information corresponding to the mobile terminal The value of the item of which the comparison result does not match is updated to the value of the item included in the information received from the mobile terminal .

  According to the first aspect of the present invention, user authentication using a plurality of pieces of authentication information can be performed without complicated operations by the user.

Moreover, the vehicle-mounted apparatus which concerns on invention of Claim 4 is provided with the authentication apparatus any one of Claims 1-3 , and the control part which restrict | limits operation of an own apparatus based on the authentication result of the said authentication apparatus. It is characterized by.

According to the fourth aspect of the present invention, it is possible to limit the operation of the in-vehicle device without a complicated operation by the user.

An authentication system according to a seventh aspect of the invention includes an authentication device according to any one of the first to third aspects, a mobile terminal that transmits information for user authentication to the authentication device, and a user authentication for each mobile terminal. And a server that manages registration information used for the mobile terminal, wherein the mobile terminal accesses the server using identification information for identifying the mobile terminal, and transmits the registration information corresponding to the mobile terminal after the access. In addition, the registration information cannot be read from an application other than the authentication device, and the server stores the transmitted registration information in association with the identification information.

According to the invention of claim 7 , since registration information is not transmitted and received between portable terminals, security can be improved.

  According to the invention of claim 1, since authentication is performed using a plurality of pieces of authentication information, there is an effect that high security can be ensured without a complicated operation by the user.

According to the invention of claim 4 , there is an effect that high security can be ensured without a complicated operation by the user, and the in-vehicle device and the vehicle can be prevented from being stolen.

According to the invention of claim 7 , since registration information is not transmitted and received between portable terminals, there is an effect that security can be improved.

  Exemplary embodiments of an authentication device, an in-vehicle device, and an authentication system according to the present invention will be described below in detail with reference to the accompanying drawings.

  FIG. 1 is a diagram showing a functional configuration example of an embodiment of an authentication system including an authentication apparatus according to the present invention. As shown in FIG. 1, the authentication system of this embodiment includes an authentication device 1 and a mobile terminal 2. The authentication device 1 includes an authentication unit 11 that performs user authentication control processing, a storage unit 12 that stores data necessary for user authentication control processing, and a Bluetooth (registered trademark) device, and is based on Bluetooth (registered trademark). The communication unit 15 includes a communication unit 15, an input unit 16 that receives input from the user, and a display unit 17 that displays information notified to the user. The authentication unit 11 includes a verification unit 13 and an information unit 14.

  The mobile terminal 2 is a terminal capable of performing wireless communication such as a mobile phone, and includes a communication unit 21 including a Bluetooth (registered trademark) device and having a communication function based on Bluetooth (registered trademark), and a user authentication user. And a storage unit 23 for storing information necessary for user authentication control. Moreover, although not shown in figure, the portable terminal 2 shall be provided with input devices, such as a button for a user to operate, and the display which performs a display. The portable terminal 2 communicates with the authentication device 1 using Bluetooth (registered trademark). In this embodiment, the communication between the authentication device 1 and the portable terminal 2 is performed by Bluetooth (registered trademark). However, the present invention is not limited to this, and another wireless method may be used.

  FIG. 2 is a diagram showing a configuration example of an in-vehicle device authentication system when the authentication device according to the present invention is incorporated in an in-vehicle device. As shown in FIG. 2, the in-vehicle device authentication system includes a vehicle door device 3, a navigation (navigation) device 4, in-vehicle devices 5-1 and 5-2, and a mobile terminal 2. The vehicle door device 3, the navigation device 4, and the on-vehicle devices 5-1 and 5-2 are mounted on the vehicle. The portable terminal 2 has the same configuration as the portable terminal 2 shown in FIG.

  The vehicle door device 3 includes a vehicle door lock 32, a control device 31 that controls the door lock 32, and the components of the authentication device 1 shown in FIG. 1 (authentication unit 11, storage unit 12, communication unit 15, input unit). 16 and a display unit 17). The navigation device 4 includes a navigation power control device 42 that controls turning on / off of the power of the navigation device, a control device 41 that controls the navigation power control device 42, and the components of the authentication device 1 shown in FIG. I have. The vehicle-mounted devices 5-1 and 5-2 are vehicle-mounted devices (for example, car audio) other than the vehicle door device 3 and the navigation device 4, and as the vehicle door device 3 and the navigation device 4, the authentication device 1 is used. It has a function.

  2 is one configuration example, and the vehicle door device 3, the navigation device 4, and the in-vehicle devices 5-1 and 5-2 are configured to include any one or more of these. I just need it.

  Next, the operation of this embodiment will be described. FIG. 3 is a chart diagram illustrating an example of an authentication processing procedure according to the present embodiment. Here, an example in which the authentication device 1 is incorporated in the vehicle door device 3 will be described as an example. First, when the mobile terminal 2 enters the communication range with the vehicle door device 3 (step S10), the communication unit 15 of the vehicle door device 3 starts authentication of the mobile terminal (in this case, the mobile terminal 2) (step S10). S11). Then, the communication unit 15 acquires a MAC address that is a physical address unique to the BT (Bluetooth (registered trademark)) device of the mobile terminal 2 (step S12). Specifically, for example, the communication unit 15 requests the communication unit 21 of the mobile terminal 2 to acquire the MAC address of the BT device, and the communication unit 21 transmits the MAC address of the BT device to the communication unit 15. In the present embodiment, the communication unit 21 includes the MAC address of the BT device included in the communication unit 21 and a PIN (Personal Identification Number) code that is a personal identification number necessary for identifying the individual, and a fixed corresponding to the portable terminal 2. It is assumed that the communication unit 21 holds the name (name of the mobile terminal 2 that can be set by the user).

  Next, the communication unit 15 outputs the acquired MAC address of the BT device to the authentication unit 11 of the vehicle door device 3 (step S13), and the authentication unit 11 authenticates the MAC address (step S14). Specifically, authentication is performed by comparing the MAC address stored in the storage unit 12 by the authentication unit 11 in the registration process described later and the MAC address output in step S13. If they match, the authentication is performed. Here, a description will be given assuming that the MAC address is authenticated.

  Next, the authentication unit 11 outputs a PIN code request (requested to transmit the PIN code) to the mobile terminal 2 to the communication unit 15 (step S15). When receiving the PIN code request, the communication unit 15 transmits the PIN code request to the portable terminal 2 (step S16).

  After step S12 or after step S16, the communication unit 21 notifies the control device 22 that the authentication is being performed, and the control device 22 displays the fact that the authentication is being performed on the display of the portable terminal 2 and displays the user. (Step S17).

  When receiving the PIN code request transmitted in step S16, the communication unit 21 of the portable terminal 2 acquires a registered PIN code (step S18), and transmits the acquired PIN code as a PIN code response to the communication unit 15 (step). S19). The acquisition of the registered PIN code in step S18 is performed using a general-purpose function of Bluetooth (registered trademark). Next, when receiving the PIN code response, the communication unit 15 outputs the PIN code included in the PIN code response to the authentication unit 11 (step S20). Then, the authentication unit 11 performs PIN code authentication (step S21). Specifically, authentication is performed by comparing the PIN code stored in the storage unit 12 by the authentication unit 11 and the PIN code output in step S20 in the registration process described later, and authentication is performed when they match. Here, it is assumed that the PIN code has been authenticated.

  Next, the authentication unit 11 outputs a fixed name request (requested to transmit a fixed name) to the mobile terminal 2 to the communication unit 15 (step S22). Upon receiving this fixed name request, the communication unit 15 transmits the fixed name request to the mobile terminal 2 (step S23).

  When receiving the fixed name request transmitted in step S23, the communication unit 21 of the portable terminal 2 acquires the fixed name of the held portable terminal 2 (step S24), and communicates the acquired fixed name as a fixed name response. It transmits to the part 15 (step S25). Next, when the communication unit 15 receives the fixed name response, the communication unit 15 outputs the fixed name included in the fixed name response to the authentication unit 11 (step S26). Next, the authentication unit 11 performs fixed name authentication (step S27). Specifically, authentication is performed by comparing the fixed name stored in the storage unit 12 by the authentication unit 11 in the registration process described later and the fixed name output in step S26, and authentication is performed when they match. Here, a description will be given assuming that the fixed name is authenticated.

  When the authentication in step S27 is completed, the authentication unit 11 instructs the communication unit 15 to perform pairing with the BT device of the portable terminal 2 (connection procedure between BT devices) (step S28). The communication unit 21 and the communication unit 15 complete the pairing based on the instruction (step S29). When the pairing is completed, the communication unit 21 notifies the authentication unit 11, and the authentication unit 11 sends a mobile terminal specific information request for requesting transmission of the mobile terminal specific information (or authentication key) to the mobile terminal 2 via the communication unit 21. Transmit (step S30). As the portable terminal specific information, any information may be used as long as it is common information generated by the authentication device 1 in the registration process described later and held by the authentication device 1 and the portable terminal 2. Below, the case where it uses as an authentication key as portable terminal specific information is demonstrated.

  When receiving the mobile terminal specific information request, the control device 22 of the mobile terminal 2 acquires the mobile terminal specific information (authentication key) obtained by a registration process described later and stored in the storage unit 23 (step). S31). And the control apparatus 22 of the portable terminal 2 transmits portable terminal specific information (authentication key) to the vehicle door apparatus 3 via the communication part 21 as a portable terminal specific information response, and the authentication part 11 of the vehicle door apparatus 3 is a communication part. 15 receives a mobile terminal specific information response (step S32).

  The authentication unit 11 authenticates the mobile terminal unique information (authentication key) (step S33). Specifically, the mobile terminal specific information (authentication key) generated by the registration process described later and stored in the storage unit 12 and the mobile terminal specific information (authentication key) transmitted in step S32 ( Authentication is performed by comparing the authentication key) (step S33). When the authentication in step S33 is completed, the authentication unit 11 notifies the mobile terminal 2 of the authentication completion via the communication unit 15, and the control device 22 of the mobile terminal 2 receives the authentication completion notification via the communication unit 21 ( Step S34). Next, the control device 22 notifies the user of the completion of authentication by displaying an authentication completion screen on the display (step S35).

  In the above description, the communication unit 21 determines the MAC address and PIN code of the BT device included in the communication unit 21 and the fixed name (name of the mobile terminal 2 that can be set by the user) corresponding to the mobile terminal 2. The communication unit 21 may output the information to the control device 22, and the control device 22 may store the information in the storage unit 23. In this case, when acquiring the MAC address, PIN code, and fixed name, the communication unit 21 requests the acquisition request from the control device 22, and the control device 22 reads the corresponding information from the storage unit 23 to the communication unit 21. What is necessary is just to make it output.

  Next, the registration process of this embodiment will be described. The registration process is a process for registering information necessary for authentication as an initial procedure for authenticating the user. FIG. 4 is a chart diagram illustrating an example of a registration processing procedure according to the present embodiment. First, the user inputs a new registration instruction by operating the input unit 16 of the vehicle door device 3 in order to perform the registration process, and the input unit 16 notifies the authentication unit 11 that there is a new registration instruction (step S41), a new registration process is started (step S42).

  When the new registration process is started, the authentication unit 11 instructs the communication unit 15 to search for a within-range terminal (a portable terminal within a communicable range) (step S43). The communication unit 15 searches for a range terminal based on the instruction (step S44). Any method may be used as a method of searching for a nearby terminal. For example, when the communication unit 15 transmits a predetermined signal and there is a response to the signal, the communication terminal 15 recognizes the within-range terminal. Next, the communication part 15 requests | requires transmission of a fixed name with respect to the terminal recognized as a range terminal as a result of the search of step S44 (step S45).

  The portable terminal 2 acquires the fixed name of the terminal itself (step S46), and transmits the acquired fixed name to the communication unit 15 as a fixed name response (step S47). At this time, the other in-zone terminals also acquire the fixed name of the own terminal in the same manner and transmit it to the communication unit 15 as a fixed name response. The communication unit 15 outputs the fixed name included in the fixed name response transmitted from each in-zone terminal to the authentication unit 11 (step S48). The authentication unit 11 displays the output fixed name on the display unit 17 and displays a screen on the display unit 17 prompting the user to select a fixed name (step S49).

  The input unit 16 receives a fixed name selection result by the user and outputs the selection result to the authentication unit 11 (step S50). Here, it is assumed that the portable terminal 2 is selected. The authentication unit 11 outputs to the communication unit 15 a MAC address request for requesting transmission of the MAC address request to the mobile terminal 2 corresponding to the selected fixed name (step S51), and the communication unit 15 transmits to the mobile terminal 2. A MAC address request is transmitted (step S52). The communication unit 21 of the portable terminal 2 acquires the MAC address of its own BT device (step S53), and transmits the acquired MAC address of the BT device to the communication unit 15 as a MAC address response (step S54). . Then, the communication unit 15 outputs the MAC address transmitted in step S54 to the authentication unit 11 (step S55).

  Next, the authentication unit 11 randomly determines a PIN code (step S56). Then, the authentication unit 11 outputs the determined PIN code to the display unit 17 (step S57), and the display unit 17 displays the PIN code (step S58).

  Further, after step S57, the authentication unit 11 stores the PIN code together with the fixed name corresponding to the portable terminal 2 and the MAC address of the BT device in the storage unit 12 (step S59). Next, the authentication unit 11 outputs a PIN code request for requesting the portable terminal 2 to input the PIN code to the communication unit 15 (step S60), and the communication unit 15 sends the PIN code to the communication unit 21 of the portable terminal 2. A code request is transmitted (step S61). The communication unit 21 outputs the PIN code request transmitted to the control device 22 of the mobile terminal 2 (Step S62).

  The control device 22 prompts the user to input the PIN code (for example, displays a screen prompting input on the display or prompts the user to input by voice), and inputs the PIN code input by the user using the input device of the mobile terminal 2. Obtained from the input device (step S63). At this time, the control device 22 stores the acquired PIN code in the storage unit 23. Next, the control device 22 outputs the PIN code input by the user to the communication unit 21 (step S64), and the communication unit 21 transmits the output PIN code to the communication unit 15 as a PIN code response (step S65). .

  The communication unit 15 outputs the PIN code transmitted as the PIN code response to the authentication unit 11 (step S66), and the authentication unit 11 performs PIN code authentication (step S67). When the PIN code authentication is completed, the authentication unit 11 instructs the communication unit 15 to perform pairing, and the communication unit 15 completes pairing with the communication unit 21 (step S68).

  Next, the authentication unit 11 generates an original authentication key (which is difficult to estimate from the outside), transmits the generated authentication key to the mobile terminal 2 via the communication unit 21, and the control device 22 of the mobile terminal 2 The authentication key is received via the communication unit 21 (step S69). The authentication key generated in step S69 is an example of the mobile terminal unique information described in the above authentication process. The authentication key may be any authentication key as long as it is different for each portable terminal. For example, there are methods such as randomly generating or generating based on the MAC address.

  The control device 22 of the portable terminal 2 stores the received authentication key in the storage unit 23 (step S70), and transmits the received authentication key to the authentication unit 11 via the communication unit 21 and the communication unit 15 (step S71). ). The authentication unit 11 confirms that the authentication key transmitted in step S71 matches the authentication key generated in step S69 (step S72). And the authentication part 11 notifies the completion of authentication to the control apparatus 22 of the portable terminal 2 (step S73). The control device 22 notifies the user of the completion of authentication by, for example, displaying on the display or notifying by voice (step S74).

  Next, the control device 22 accesses the server using user information such as a telephone number of the mobile terminal (step S75). This server is a server for managing mobile terminal user information and information related to authentication corresponding to the terminal. For example, the server is a computer that can be accessed wirelessly or by wire from the mobile terminal 2. Next, the control device 22 of the mobile terminal 2 transmits the unique name of the terminal itself, the PIN code stored in the storage unit 23, and the authentication key to the server as authentication information (step S76). The server stores (registers) the authentication information in association with the user information of the mobile terminal 2 and notifies the mobile terminal 2 of the completion of registration (step S77).

  Next, the re-registration process when the user of the mobile terminal 2 that has already been registered in the vehicle door device 3 changes the mobile terminal to be used by replacing the mobile terminal will be described. FIG. 5 is a chart showing an example of a procedure for re-registration processing for a new mobile terminal after change. Note that the new mobile terminal also has the same components as the mobile terminal 2 shown in FIG. First, before the re-registration process, the new mobile terminal acquires authentication information from the server. The authentication information is acquired by accessing the server using the user information. The user information at this time is the same as the user information of the portable terminal before the change. Then, the new mobile terminal requests the server to transmit authentication information, and the server reads the authentication information corresponding to the user information (the authentication information stored in step S77 of the registration process described above) and transmits it to the new mobile terminal. To do. And the communication part 21 of a new portable terminal hold | maintains these authentication information.

  In this way, in this embodiment, when it is desired to move the authentication information to another mobile terminal when the mobile terminal is changed, the information is moved via the server. By not transmitting / receiving authentication information directly between portable terminals, higher security can be ensured. Furthermore, it is possible to prevent the authentication information from being transmitted to other portable terminals by making it impossible to read the authentication information from an application other than the processing related to the authentication device 1 of the present embodiment.

  Then, as shown in FIG. 5, when the new portable terminal enters the communication area of the vehicle door device 3 (step S80), the communication unit 21 performs the authentication process of the in-zone terminal in the same manner as in the authentication process of step S11 of FIG. Is started (step S81). Next, as step S82, step S83, and step S84, the same processing as that of step S12, step S13, and step S14 in FIG. 3 is performed. However, in this case, since the mobile terminal is changed, the MAC address of the BT device is changed, and the MAC device corresponding to the new mobile terminal is not stored in the storage unit 12. Accordingly, authentication is not performed during the MAC address authentication in step S84, and the authentication unit 11 determines that an authentication error has occurred (step S85).

  Next, processing similar to that in steps S15 to S16 and steps S19 to S27 of the authentication processing described in FIG. 3 is performed to perform PIN code authentication and fixed name authentication. Here, it is assumed that the PIN code and the fixed name have not been changed since already registered, and that the PIN code and the fixed name have been normally authenticated. When the authentication in step S27 is completed, the authentication unit 11 performs the processing from step S28 onward in FIG. 3 when the authentication is successful for all three items of the MAC address, PIN code, and fixed name. In the example of FIG. 5, authentication of the MAC address is an error. As described above, when only one of the three items results in an error, the authentication unit 11 notifies the communication unit 15 of the completion of authentication, and is a temporary terminal confirmation terminal that is connected to the new mobile terminal for a predetermined time. A pairing instruction is given and the process proceeds to the registered terminal confirmation mode (step S86).

  In the registered terminal confirmation mode, when one of the three items of the MAC address, the PIN code, and the fixed name fails and the other two items are normally authenticated, the item that has failed in the authentication is changed. This is a mode for updating the registered contents of items that have been judged and failed to be authenticated. As in this example, when the terminal is replaced, the MAC address is changed, but not only the MAC address but also the PIN code or unique name may be changed by the user. In this embodiment, in preparation for such a case, the registered contents are automatically updated. If two or more of the three items result in an authentication error, it is determined that the terminal is not a registered terminal and the registered content is not updated.

  The communication unit 21 performs pairing with the communication unit 15 for a predetermined time based on the instruction for temporary pairing for terminal confirmation in step S86 (step S87). And the authentication part 11 transmits the authentication key request | requirement which requests | requires transmission of an authentication key via the communication part 21 to the control apparatus 22 of a new portable terminal via the communication part 21 of a new portable terminal (step S88). Then, the new portable terminal reads and acquires the held authentication key (step S89), and transmits the acquired authentication key as an authentication key response to the authentication unit 11 via the communication unit 21 and the communication unit 15 ( Step S90). The authentication unit 11 authenticates the authentication key transmitted in step S90 (step S91). When the authentication is completed, the authentication unit 11 transmits the authentication completion to the control device 22 of the new mobile terminal via the communication unit 15 and the communication unit 21 of the new mobile terminal (step S92). The control device 22 of the new portable terminal notifies the user of the completion of authentication (step S93). As a notification method to the user, for example, there is a method of displaying on a display unit of a new mobile terminal or notifying by voice.

  Further, after step S91, the authentication unit 11 receives the MAC address of the authentication information (MAC address, PIN code, unique name, authentication key) corresponding to the mobile terminal 2 stored in the storage unit 12 in step S83. Update to the MAC address (step S94).

  In this embodiment, the case where the MAC address is changed has been described. However, when the PIN code or the unique name is changed, the new mobile terminal accesses the server and stores it in the server after the above processing. The authentication information being updated is requested to be updated with the changed contents, and the server updates the authentication information based on this request.

  Moreover, although the above description demonstrated the example in which the authentication apparatus 1 was integrated in the vehicle door apparatus 3, the case where the authentication apparatus 1 is integrated in the navigation apparatus 4 and the vehicle-mounted apparatus 5-1 and 5-2 is the same. Authentication processing, registration processing, and re-registration processing may be performed in the processing procedure.

  Next, the operation of the authentication apparatus 1 of this embodiment including the authentication process shown in FIG. 3 and the re-registration process shown in FIG. 5 will be described. FIG. 6 is a flowchart illustrating an example of a processing procedure of authentication processing and re-registration processing of the authentication device 1 according to the present embodiment. As shown in FIG. 6, first, the communication unit 15 activates the Bluetooth (registered trademark) function (step S101). Next, the communication unit 15 determines whether or not the mobile terminal has entered the service area (step S102). If it is determined that the mobile terminal has entered the service area (Yes in step S102), authentication of the service area terminal is started (step S103). If it is determined that the mobile terminal is not in the service area (No in step S102), the determination in step S102 is performed again.

  After step S103, the communication unit 15 acquires the MAC address, the PIN code, and the fixed name from the authentication information from the mobile terminal (step S104), and the verification unit 13 of the authentication unit 11 is acquired by the communication unit 15. Each authentication information (MAC address, PIN code, fixed name) is authenticated (step S105). In the flowchart of FIG. 6, steps S104 and S105 are collectively described. However, as shown in FIG. 3 or 5, the actual procedure is authentication information (MAC address, PIN code, fixed name). Acquire and authenticate each item.

  Next, the verification unit 13 of the authentication unit 11 determines whether or not all the authentications of the MAC address, the PIN code, and the fixed name are successful (step S106), and when all the authentications are successful (Yes in step S106). The information unit 14 of the authentication unit 11 instructs pairing with the mobile terminal that has entered the communication unit 15, and the communication unit 15 establishes Bluetooth (registered trademark) connection by pairing (step S107). And the information part 14 of the authentication part 11 acquires an authentication key from a portable terminal (step S108), and the collation part 13 of the authentication part 11 authenticates an authentication key (step S109).

  And the collation part 13 of the authentication part 11 judges whether the authentication of step S109 was successful (step S110), and when it is judged that the authentication was successful (step S110 Yes), the terminal which entered the area is The terminal is confirmed to be a registered terminal (step S111), and the authentication process is completed (step S112). Then, after the authentication process is completed, the authentication unit 11 enables control processing of the in-vehicle device in which the authentication device 1 is incorporated, and the in-vehicle device starts control corresponding to the authenticated mobile terminal (step S113). Return to step S102. For example, when the authentication device 1 is incorporated in the vehicle door device 3, the control device 31 of the in-vehicle device is operated, and the control device 31 performs a control process for opening and closing the vehicle door. As control corresponding to a mobile terminal, for example, in the case of the navigation device 4, setting information for each user (for each mobile terminal) is held, and processing is performed based on the setting information corresponding to the authenticated mobile terminal. Do.

  If it is determined in step S106 that at least one of the MAC address, PIN code, and fixed name is not successfully authenticated (verification failure) (No in step S106), the verification unit 13 of the authentication unit 11 Further, it is determined whether or not there is one item that has failed in collation (step S114). If it is determined that the number of items that have failed to be verified is one (Yes at Step S114), the authentication unit 11 proceeds to the registered terminal confirmation mode (Step S115). And the information part 14 of the authentication part 11 instruct | indicates the pairing with the portable terminal which entered the range to the communication part 15, and the communication part 15 establishes Bluetooth (trademark) connection by pairing (step S116). And the information part 14 of the authentication part 11 acquires an authentication key from a portable terminal (step S117), and the collation part 13 of the authentication part 11 authenticates an authentication key (step S118).

  Next, the collation unit 13 of the authentication unit 11 determines whether or not the authentication in step S118 is successful (step S119). If it is determined that the authentication has succeeded (Yes in step S119), the collation unit 13 of the authentication unit 11 confirms that the terminal that has entered the range is a registered terminal (step S120), and the information unit 14 stores the storage unit 12 In the authentication information corresponding to the terminal that has entered the range stored in the field, the item that failed to be verified is updated to the information acquired in step S104 (step S121), and the process proceeds to step S112.

  If it is determined in step S110 that the authentication has failed (No in step S110), the verification unit 13 of the authentication unit 11 determines that the terminal that has entered the range is not a registered terminal (step S122), and returns to step S102. . If it is determined in step S119 that the authentication has failed (No in step S119), the verification unit 13 of the authentication unit 11 determines that the terminal that has entered the range is not a registered terminal (step S122), and returns to step S102. .

  Next, an operation when the connected mobile terminal leaves the communication range of the authentication device 1 will be described. FIG. 7 is a flowchart illustrating an example of a processing procedure when the connected mobile terminal 2 leaves the communication range. After completion of the authentication process described in step S112 of FIG. 6, the communication unit 15 determines whether or not the authenticated mobile terminal (authentication terminal) and the Bluetooth (registered trademark) connection are disconnected (step S131). If it is determined that the connection has been disconnected (Yes at Step S131), the authentication device 1 executes a process at the time of disconnection (Step S132). If it is determined that it has not been disconnected (No in step S131), the determination in step S131 is continued. Here, the processing at the time of disconnection may be appropriately determined according to the device in which the authentication device 1 is incorporated, but to ensure security, for example, the state where the authentication is completed is returned to the state before the authentication. For example, a process that makes it impossible to use the in-vehicle device is performed. The contents of the process at the time of disconnection are set in advance, but may be changed upon receiving a change request from the user.

  Next, the operation of the authentication apparatus 1 for registration processing for registering authentication information of the mobile terminal will be described. 8A and 8B are flowcharts illustrating an example of a detailed processing procedure of the registration process of the authentication device 1. As shown in FIGS. 8A and 8B, when the user instructs new registration by operating the input unit 16, the registration process starts (step S141). Then, the communication unit 15 searches for a mobile terminal (range terminal) within a range (step S142) and determines whether there is a range terminal (step S143). If it is determined that there is a nearby terminal (step S143 Yes), the communication unit 15 acquires the unique name of the within-range terminal and outputs it to the authentication unit 11 (step S144). On the other hand, if it is determined in step S143 that there is no in-range terminal (No in step S143), the information unit 14 of the authentication unit 11 notifies the user by displaying that there is no in-range terminal on the display unit 17 (step S143). S148), the process is terminated.

  After step S144, the information unit 14 of the authentication unit 11 displays the output unique name on the display unit 17 and prompts the user to select a unique name (step S145). When the user selects (instructs) the unique name of the terminal to be registered by operating the input unit 16, the information unit 14 of the authentication unit 11 receives the selection result from the input unit 16 (step S146). Next, the information unit 14 of the authentication unit 11 acquires the MAC address from the portable terminal (selected terminal) corresponding to the selection result (step S147).

  Next, the information unit 14 of the authentication unit 11 determines whether or not the MAC address can be acquired from the selected terminal (step S149). If the MAC address can be acquired (step S149 Yes), the unique name is associated with the MAC address. And stored in the storage unit 12 (step S150). Next, the information unit 14 of the authentication unit 11 randomly generates and determines a PIN code (step S151), and stores the determined PIN code in the storage unit 12 in association with the unique name and the MAC address (step S152). ). In addition, the information unit 14 of the authentication unit 11 displays the determined PIN code on the display unit 17 (step S153).

  Next, the information unit 14 of the authentication unit 11 transmits a PIN code request (request for PIN code input) to the selected mobile terminal via the communication unit 15 (step S154). Then, the information unit 14 of the authentication unit 11 determines whether or not the PIN code has been acquired from the selected terminal within a certain time after the PIN code request is transmitted in step S154 (step S155). When the PIN code can be acquired from the selected terminal within a certain time (step S155 Yes), the verification unit 13 of the authentication unit 11 confirms whether the PIN code is correct (the PIN code stored in the storage unit 12 in step S152) It is determined whether or not they match (step S156). If it is determined that the PIN code is correct (Yes in step S156), the information unit 14 of the authentication unit 11 instructs the communication unit 15 to establish a Bluetooth (registered trademark) connection with the selected terminal, and the communication unit 15 determines based on the instruction. To establish a connection (step S157).

  Then, the information unit 14 of the authentication unit 11 generates an authentication key corresponding to the selected terminal (step S158), and transmits the authentication key to the selected terminal via the communication unit 15 (step S159). The information unit 14 of the authentication unit 11 stores the authentication key generated in step S158 in association with other authentication information (MAC address, PIN code, unique name) in the storage unit 12 (step S160), and performs registration processing. Is completed (step S161), and the process is terminated.

  On the other hand, when it is determined in step S149 that the MAC address could not be acquired (No in step S149), the information unit 14 of the authentication unit 11 notifies the user of the error by causing the display unit 17 to display an error ( Step S162). Then, the information unit 14 of the authentication unit 11 deletes the authentication information (MAC address and PIN code) stored in Step S150 and Step S152 from the storage unit 12 (Step S163), and ends the process. If it is determined in step S155 that the PIN code has not been acquired in a certain time (No in step S155), the process proceeds to step S162.

  If it is determined in step S156 that the PIN code is not correct (No in step S156), the information unit 14 transmits a PIN code request to the selected mobile terminal again (step S164), and then performs the processes in and after step S155. repeat.

  When the selected terminal leaves the communication area during establishment of communication by registration processing, an operation when the connected portable terminal leaves the communication area of the authentication device 1 is performed as in the authentication process. .

  In the above description, the operation of the verification unit 13 of the authentication unit 11 and the operation of the information unit 14 of the authentication unit 11 are described separately. However, the operation of the verification unit 13 and the operation of the information unit 14 are illustrated by way of example. Yes, not limited to this, any operation may be performed as long as both operations are performed in the authentication unit 11.

  As described above, in this embodiment, security is ensured by performing authentication using both hardware information (such as a MAC address) and software information (such as an authentication key) of the mobile terminal 2. The mobile terminal 2 stores all authentication information. For example, when a mobile terminal 2 sends an email with specific contents, the mobile terminal 2 deletes authentication information such as an authentication key. If the mobile terminal 2 is lost (including theft), the mail with the specific contents By transmitting, higher security can be realized.

  In this embodiment, authentication is performed using three pieces of authentication information (MAC address, PIN code, fixed name) in addition to authentication by an authentication key, but the MAC address, Any one or more of a PIN code and a fixed name may be used. When only one of the MAC address, PIN code, and fixed name is used, or when any two of the MAC address, PIN code, and fixed name are used, the number of verification failures for performing re-registration processing If the collation fails without making the above determination (determination in step S114), the process may proceed to step S122.

  Further, in this embodiment, each in-vehicle device includes the in-vehicle device, but a single authentication device 1 may be shared by a plurality of in-vehicle devices. In this case, when the authentication device 1 is correctly authenticated, the authentication device 1 notifies the control device of each of the plurality of in-vehicle devices by wire or wireless, and the corresponding in-vehicle device when each control device is correctly authenticated. It is sufficient to perform the control.

  As described above, in this embodiment, when the mobile terminal 2 enters the communicable range of the authentication device 1, the authentication processing of the mobile terminal 2 is automatically started, and the hardware information (MAC address) of the mobile terminal 2 is started. Etc.) and software information such as an authentication key. For this reason, user authentication with high security can be performed without the user performing complicated operations.

  Further, in this embodiment, since the mobile terminal 2 receives the authentication key directly from the authentication device 1, the possibility that the authentication key is passed to a third party can be reduced. Furthermore, the authentication information including the authentication key is not moved between mobile terminals, but in the case of a change of the mobile terminal, the authentication information is moved to the new mobile terminal via the server. Can be increased.

  Furthermore, if only one of the MAC address, PIN code, and fixed name fails to be verified, the process proceeds to the registration terminal confirmation mode, and it is determined that the content of the item that failed to be verified has been updated. Since the contents are changed, re-registration can be easily performed even when the mobile terminal is changed. For example, when an authentication device is used as a vehicle key, if the mobile terminal is changed, it is conventionally necessary to enter the vehicle once with the original key to re-register, without entering the vehicle until the new mobile terminal is re-registered. Although it is necessary to perform the registration process, in this embodiment, the re-registration process can be automatically performed even when the user is outside the vehicle.

  As described above, the authentication device, the in-vehicle device, and the authentication system according to the present invention are useful for a system that performs user authentication using a mobile terminal, and are particularly suitable for a system mounted on a vehicle.

It is a figure which shows the function structural example of the Example of the authentication system containing the authentication apparatus concerning this invention. It is a figure which shows the structural example of the vehicle equipment authentication system at the time of incorporating the authentication apparatus concerning this invention in vehicle equipment. It is a chart figure which shows an example of the authentication processing procedure of a present Example. It is a chart figure which shows an example of the registration processing procedure of a present Example. It is a chart figure which shows an example of the procedure of the re-registration process with respect to a new portable terminal. It is a flowchart which shows an example of the process sequence of the authentication process of an authentication apparatus, and a re-registration process. It is a flowchart which shows an example of the process sequence when the connected portable terminal leaves | separates from the communication range. It is a flowchart which shows an example of the detailed process sequence of the registration process of an authentication device. It is a flowchart which shows an example of the detailed process sequence of the registration process of an authentication device.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Authentication apparatus 2 Portable terminal 3 Vehicle door apparatus 4 Navi apparatus 5-1 and 5-2 In-vehicle apparatus 11 Authentication part 12,23 Storage part 13 Verification part 14 Information part 15,21 Communication part 16 Input part 17 Display part 22,31 , 41 Control device 32 Door lock 42 Navigation power supply control device

Claims (9)

An authentication device that performs user authentication based on information received from a mobile terminal,
A communication unit for establishing a communication connection with the portable terminal;
A storage unit for storing registration information used for user authentication for each mobile terminal;
A registration process for storing in the storage unit the registration information including first authentication information that is unique information generated for each mobile terminal and second authentication information generated for each mobile terminal, and An authentication unit that compares the registration information stored in a storage unit with information received from the mobile terminal;
With
The communication unit, when authentication based on the first authentication information is successful, permits communication connection with a mobile terminal that has been successfully authenticated,
Wherein the authentication unit, after permission of the communication connection, have rows authentication based on the second authentication information,
The first authentication information is a plurality of items,
When there is one item that does not match the comparison result among the plurality of items, the value of the item that does not match the comparison result of the registration information corresponding to the mobile terminal is An authentication apparatus, wherein the value is updated to the value of the item included in the information received from the portable terminal . The communication unit detects a mobile terminal that has entered a communicable area,
Wherein the authentication unit, the authentication device according to claim 1, wherein the communication unit when detecting the mobile terminal has entered within communicable, characterized by initiating the authentication process automatically. Including the unique name of the mobile terminal in the first authentication information;
When the authentication unit detects a plurality of portable terminals that have entered a communicable range after the registration process is activated, the authentication unit performs control for displaying the unique name of the detected portable terminal on the display unit. The authentication apparatus according to claim 2 , wherein the authentication apparatus receives the selection of the unique name from the user, and performs registration processing of the mobile terminal corresponding to the selected unique name. An authentication device according to any one of claims 1 to 3 ,
A control unit that restricts the operation of the device based on the authentication result of the authentication device;
A vehicle-mounted device comprising: The controller is
Holding setting information for each mobile terminal;
The in-vehicle device according to claim 4 , wherein the device itself is controlled based on setting information corresponding to a mobile terminal authenticated by the authentication device. The in-vehicle device according to claim 5 , wherein the control unit performs a predetermined operation restriction process when communication with a mobile terminal that has been successfully authenticated is disconnected. An authentication device according to any one of claims 1 to 3 ,
A portable terminal that transmits information for user authentication to the authentication device;
A server for managing registration information used for user authentication for each mobile terminal;
With
The portable terminal accesses the server using identification information for identifying the portable terminal, transmits the registration information corresponding to the own terminal after the access, and the registration from an application other than the authentication device Disabling the reading of information,
The server stores the transmitted registration information in association with the identification information.   An authentication device;
  A portable terminal that transmits information for user authentication to the authentication device;
  A server for managing registration information used for user authentication for each mobile terminal;
  With
  The authentication device
  A communication unit for establishing a communication connection with the mobile terminal;
  A storage unit for storing registration information used for the user authentication for each mobile terminal;
  A registration process for storing in the storage unit the registration information including first authentication information that is unique information generated for each mobile terminal and second authentication information generated for each mobile terminal, and An authentication unit that compares the registration information stored in a storage unit with information received from the mobile terminal;
  With
  The communication unit, when authentication based on the first authentication information is successful, permits communication connection with a mobile terminal that has been successfully authenticated,
  The authentication unit performs authentication based on the second authentication information after permitting communication connection,
  The portable terminal accesses the server using identification information for identifying the portable terminal, transmits the registration information corresponding to the own terminal after the access, and the registration from an application other than the authentication device Disabling the reading of information,
  The server stores the transmitted registration information in association with the identification information.   The server has access using identification information that matches the stored identification information from another portable terminal that is different from the portable terminal that transmitted the registration information, and the registration information from the other portable terminal The authentication system according to claim 8, wherein when there is a transmission request, registration information corresponding to the identification information is transmitted to the other portable terminal.

Images