JP6907811B2 - Authentication processing device, IC card, authentication processing method, and authentication processing program - Google Patents

Description

The present invention relates to a technical field of an authentication processing device capable of authenticating a user (personal authentication) using the biometric information of the user and determining whether or not the physical condition of the user satisfies a standard. ..

Conventionally, for example, a drunk driving prevention device as shown in Patent Document 1 has been proposed. In this drunk driving prevention device, when the driver presses the pressing part of the start switch to start the engine of the vehicle, the ECU 30 (control unit 31) irradiates the driver's finger with infrared rays from the infrared light source. In this state, personal authentication is performed using the blood vessel pattern obtained by imaging the finger. Then, when the personal authentication is successful, the ECU 30 detects the alcohol component by the alcohol sensor provided in the start switch, and when the alcohol component is not detected, gives an unlock command to the steering control unit 51 to give the vehicle an unlock command. By releasing the lock of the steering wheel and giving an unlock command to the shift lever control unit 55, the lock of the shift lever of the vehicle is released, and by giving a start command to the engine control unit 53, the engine of the vehicle is started. (Paragraph 0054).

Japanese Unexamined Patent Publication No. 2008-308037

However, in the drunk driving prevention device disclosed in Patent Document 1, the drunk driver may replace the ECU 30 with an illegal device or replace the ECU 30 with the engine control unit 53 or the like in order to avoid the detection of the alcohol component. There is concern about device spoofing, such as connecting an unauthorized device to the network NW to be connected. When such a device is spoofed, for example, by giving a fake start command or the like to the engine control unit 53 or the like, the engine of the vehicle can be started regardless of the detection of the alcohol component.

Therefore, the present invention has been made in view of the above points, and an object of the present invention is to provide an authentication processing device, an IC card, an authentication processing method, and an authentication processing program capable of preventing spoofing of a device. do.

In order to solve the above problems, the invention according to claim 1 comprises a biometric information acquisition sensor that acquires biometric information for use in user authentication, and state information that acquires state information indicating the physical condition of the user. An authentication processing device that includes an acquisition sensor and a non-volatile memory that stores key data and is capable of communicating between a control device that controls the operation of a controlled object, and is the living body acquired by the biometric information acquisition sensor. A user authentication means that authenticates the user using information, and a determination means that determines whether or not the physical condition indicated by the state information acquired by the state information acquisition sensor meets a preset standard. , Authentication is performed between the control device using the key data stored in the non-volatile memory and the authentication data that changes at one frequency in one or a plurality of sessions with the control device. When the device authentication means to be performed and the user authentication by the user authentication means are successful, the determination means determines that the criteria are satisfied, and the authentication by the device authentication means is successful, the control target A generation means for generating response data based on data indicating operation permission for the user and the authentication data used in the authentication, and a transmission means for transmitting the response data to the authentication device. It is characterized by having and.

The invention according to claim 2 is an encryption means for encrypting the response data generated by the generation means with the key data used in the authentication in the authentication processing apparatus according to claim 1, and the above-mentioned. It is characterized by including a transmission means for transmitting the response data encrypted by the encryption means to the control device to which the authentication has been performed.

The invention according to claim 3 is the authentication processing device according to claim 2, wherein the device authentication means receives the first authentication data generated by the control device from the control device. The second step of generating the authentication data, the step of encrypting the received first authentication data with the key data stored in the non-volatile memory, and the generated second step. The step of transmitting the authentication data and the first encrypted data in which the first authentication data is encrypted to the control device, and the verification of the first encrypted data by the control device are successful. In response to this, the step of receiving the second encrypted data in which the second authentication data is encrypted by the control device from the control device, and the step of receiving the received second encrypted data. When the verification is performed and the verification is successful, the step of transmitting the information indicating the success of the authentication to the control device and the operation permission / rejection determination result transmitted from the control device according to the information indicating the success of the authentication. The step of receiving the request and the step of receiving the request are executed, and the transmission means transmits the response data encrypted by the encryption means to the control device in response to the operation permission / rejection determination result request. ..

The invention according to claim 4 stores a biometric information acquisition sensor that acquires biometric information for use in user authentication, a status information acquisition sensor that acquires status information indicating the physical condition of the user, and key data. It is an IC card that has a non-volatile memory that can communicate with a control device that controls the operation of a controlled object, and authenticates the user using the biometric information acquired by the biometric information acquisition sensor. A user authentication means to be performed, a determination means for determining whether or not the physical condition indicated by the state information acquired by the state information acquisition sensor satisfies a preset standard, and stored in the non-volatile memory. A device authentication means that authenticates with the control device using the key data and authentication data that changes at one frequency in one or more sessions with the control device, and the user authentication. When the authentication of the user by the means is successful, the determination means determines that the criteria are satisfied, and the authentication by the device authentication means is successful, the data indicating the operation permission for the control target and the said. It is characterized by including a generation means for generating response data based on the authentication data used in the authentication, and a transmission means for transmitting the response data to the control device on which the authentication has been performed. ..

The invention according to claim 5 stores a state information acquisition sensor that acquires state information indicating a user's physical condition, a biometric information acquisition sensor that acquires biometric information for use in authentication of the user, and key data. This is an authentication processing method performed by a computer having a non-volatile memory and capable of communicating with a control device that controls the operation of a controlled object, using the biometric information acquired by the biometric information acquisition sensor. A user authentication step for authenticating the user, a determination step for determining whether or not the physical condition indicated by the state information acquired by the state information acquisition sensor satisfies a preset standard, and the non-volatile property. A device authentication step for authenticating with the control device using the key data stored in the memory and the authentication data that changes at one frequency in one or more sessions with the control device. When the user authentication by the user authentication step is successful, the determination step determines that the criterion is satisfied, and the authentication by the device authentication step is successful, the operation permission for the control target is granted. Includes a generation step of generating response data based on the indicated data and the authentication data used in the authentication, and a transmission step of transmitting the response data to the authenticated control device. It is characterized by that.

The invention according to claim 6 stores a biometric information acquisition sensor that acquires biometric information for use in user authentication, a status information acquisition sensor that acquires status information indicating the physical condition of the user, and key data. User authentication that authenticates the user by using the biometric information acquired by the biometric information acquisition sensor for a computer that has a non-volatile memory and can communicate with a control device that controls the operation of the controlled object. Means, a determination means for determining whether or not the state of the body indicated by the state information acquired by the state information acquisition sensor satisfies a preset standard, and key data stored in the non-volatile memory. The device authentication means that authenticates with the control device using the authentication data that changes at one frequency in one or a plurality of sessions with the control device, and the user authentication means. When the user authentication is successful, the determination means determines that the criteria are satisfied, and the device authentication means succeeds in the authentication, the data indicating the operation permission for the control target and the data used in the authentication are used. The generation means for generating the response data based on the authentication data and the transmission means for transmitting the response data to the authenticated control device are allowed to function.

According to the present invention, it is possible to authenticate a user using the biometric information of the user and effectively prevent spoofing of a device in an environment for determining whether or not the physical condition of the user satisfies a standard. can.

It is a figure which shows an example of the functional block of the license confirmation apparatus 1 which concerns on this embodiment. (A) is a plan view showing an example of the internal structure when the license confirmation device 1 is an IC card, and (B) is a cross-sectional view showing an example of the internal structure of the IC card shown in (A). .. (A) and (B) are diagrams showing a state in which the pad of the user's finger is in contact with the contact surface 11X of the biometric sensor 11 and the contact surface 12X of the alcohol sensor 12. (A) is a plan view showing an example of the internal structure of the alcohol sensor 12, and (B) and (C) are cross-sectional views showing an example of the internal structure of the alcohol sensor 12 (cross-sectional view of the XX portion). Is. It is a figure which shows the hardware configuration example of the control unit 136. It is a sequence diagram which shows the exchange of data between the license confirmation device 1 and the control unit 2 when a license confirmation process is performed. It is a sequence diagram which shows the exchange of data between the license confirmation device 1 and the control unit 2 when a license confirmation process is performed.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment when the present invention is applied to a license confirmation device that executes an operation permission / rejection determination for a controlled object. Examples of the control target include a vehicle (vehicle, ship, aircraft, train, etc., drive mechanism (for example, engine) of a hoist, a door lock / unlock drive mechanism, an alarm output circuit, and the like.

[1. Configuration and function of license confirmation device 1]
First, the configuration and function of the license confirmation device 1 according to the present embodiment will be described with reference to FIG. 1 and the like. The license confirmation device 1 is an example of the authentication processing device of the present invention. The license confirmation device 1 may be an IC card owned by the user. The IC card is used as a driver's license, an employee card, a personal certificate, and the like. FIG. 1 is a diagram showing an example of a functional block of the license confirmation device 1 according to the present embodiment. As shown in FIG. 1, the license confirmation device 1 according to the present embodiment includes a biometric sensor 11, an alcohol sensor 12, a secure element 13, and the like, and is a control unit 2 (control device) that controls the operation of the control target 3. It is possible to communicate with (one example) via wired or wireless. For example, when the license confirmation device 1 is mounted on a vehicle, the license confirmation device 1 has an engine control unit that controls the operation of the engine, a steering control unit that controls the operation of steering, and a shift lever that controls the operation of the shift lever. Communicate with the control unit. The engine control unit, steering control unit, and shift lever control unit may be connected to a gateway device that serves as an interface with the license confirmation device 1.

The biometric sensor 11 is an example of a biometric information acquisition sensor that acquires biometric information for use in authentication (hereinafter, referred to as “user authentication”) of a user (for example, a driver, an operator, etc.) who uses the license confirmation device 1. Is. In the present embodiment, the pad of the finger of the user is taken as an example as a part of the body of the user, and the fingerprint of the user (the crest on the pad of the finger) is taken as an example of biometric information. The biometric sensor 11 has, for example, tens of thousands of electrodes, a contact surface with which the pad of the user's finger comes into contact, and the like. When the pad of the user's finger comes into contact with the contact surface, the electrode is charged with an amount of electric charge according to the proximity to the contact surface due to the unevenness (that is, the unevenness constituting the fingerprint) on the pad of the user's finger. Accumulate. Then, the biometric sensor 11 detects the amount of electric charge accumulated in each electrode (that is, detects an electrical change with respect to the pad of the user's finger) and converts it into a numerical value (that is, a numerical value according to the amount of electric charge). By converting, the biometric information indicating the fingerprint (matrix corresponding to the image) is acquired, and the acquired biometric information is transmitted to the secure element 13 via a wiring (not shown).

The alcohol sensor 12 is an example of a state information acquisition sensor that acquires state information indicating the physical condition of the user. In this embodiment, the concentration of alcohol is taken as an example of the state information. The alcohol sensor 12 has a contact surface or the like that the pad of the user's finger comes into contact with. When the pad of the user's finger comes into contact with this contact surface, the alcohol sensor 12 detects fluorescence according to the concentration of the alcohol component contained in the user's sweat and sets it to a numerical value (a numerical value according to the intensity of fluorescence). By converting, the state information indicating the intensity of the fluorescence is acquired, and the acquired state information is transmitted to the secure element 13 via a wiring (not shown).

FIG. 2A is a plan view showing an example of the internal structure when the license confirmation device 1 is an IC card, and FIG. 2B is an example of the internal structure of the IC card shown in FIG. 2A. It is a cross-sectional view (cross-sectional view of XX part) which shows. As shown in FIG. 2B, the IC card is insulated by laminating an insulating sheet 1x on a printing sheet 2x (in the example of FIG. 2B, a printing sheet on the lower side (back side)) as a base material. A print sheet 3x (in the example of FIG. 1B, a print sheet on the upper side (front side)) is laminated on the sheet 1x. That is, the insulating sheet 1x is sandwiched between the two printing sheets 2x and 3x. Such a laminated structure is formed by a method such as spin coating or coating. The insulating sheet 1x is made of, for example, a polyimide having a thickness of about 50 μm to 400 μm. The print sheets 2x and 3x are made of, for example, polyethylene terephthalate (PET) or PET-G having a thickness of about 100 μm, respectively. The back side printing 4x is performed on the printing sheet 2x, and the front side printing 5x is performed on the printing sheet 3x.

A biometric sensor 11, an alcohol sensor 12, a secure element 13, and an antenna 14 are mounted on the insulating sheet 1x. In particular, the biometric sensor 11 and the alcohol sensor 12 are arranged side by side on the print sheet 2x so as not to overlap each other in the thickness direction Y of the print sheet 2x. By arranging the biometric sensor 11 and the alcohol sensor 12 side by side on the print sheet 2x in this way, the user can perform personal authentication (user authentication) and alcohol detection (alcohol component detection) without moving the finger. Therefore, if each process is continuously performed, the troublesomeness given to the user who is the subject can be reduced. The contact surface 11X of the biometric sensor 11 and the contact surface 12X of the alcohol sensor 12 can be contacted with the pad of the user's finger through the through hole 101 provided in the printing sheet 3x, respectively.

Further, in the example of FIG. 2B, since the biometric sensor 11, the alcohol sensor 12, and the secure element 13 are fixedly arranged on the printing sheet 2x, the insulating sheet 1x has through holes from the front surface to the back surface. 102 is provided. A biometric sensor 11, an alcohol sensor 12, and a secure element 13 are incorporated (fitted) into the through hole 102, and are adhered to each other, for example. The biometric sensor 11, the alcohol sensor 12, and the secure element 13 each have a thickness equal to or less than the thickness of the insulating sheet 1x. The thickness of the secure element 13 is usually in the range of about 50 μm to 200 μm. The biometric sensor 11 and the alcohol sensor 12 are electrically connected to the secure element 13 via, for example, a wiring pattern formed on the insulating sheet 1x.

3A and 3B are views showing a state in which the pad of the user's finger is in contact with the contact surface 11X of the biometric sensor 11 and the contact surface 12X of the alcohol sensor 12. As shown in FIG. 3B, the biometric sensor 11 and the alcohol sensor 12 are arranged side by side on the IC card (that is, the print sheet 2x) as the license confirmation device 1. By arranging the biometric sensor 11 and the alcohol sensor 12 side by side in this way, the user can perform personal authentication (user authentication) and alcohol detection (alcohol component detection) without moving his / her finger. If this is continuously performed, the annoyance given to the user who is the subject can be reduced.

As another example of the method of arranging the biometric sensor 11, the alcohol sensor 12, and the secure element 13, the biometric sensor 11, the alcohol sensor 12 and the biometric sensor 12 are placed on the surface (upper surface or lower surface) of the insulating sheet 1x. , And the secure element 13 may be arranged (eg, arranged by adhesion). In this case, a spacer sheet or the like is laminated on the side where the biometric sensor 11, the alcohol sensor 12, and the secure element 13 protrude (that is, a spacer sheet or the like is provided between the insulating sheet 1x and the printing sheet 2x or 3x. In addition, a through hole capable of absorbing the height of these components is provided in a portion of the spacer sheet or the like where the biometric sensor 11, the alcohol sensor 12, and the secure element 13 come into contact with each other.

The antenna 14 is, for example, a resist formed on an aluminum foil or the like laminated on an insulating sheet 1x, and only the coil shape is left by a photoetching technique. The antenna 14 is formed so as to be wound for several turns on the 1x surface of the insulating sheet. Further, both ends of the coil forming the antenna 14 are electrically connected to the secure element 13 via, for example, a wiring pattern formed on the insulating sheet 1x. When the IC card is held in the reader / writer RW, electric power is generated in the coil of the antenna 14 by the electromagnetic wave from the reader / writer RW, and the electric power is supplied to the secure element 13. Further, power is supplied from the secure element 13 to the alcohol sensor 12 and the biometric sensor 11 via the wiring pattern. The IC card is, for example, press-laminated in a state where the insulating sheet 1x on which the biometric sensor 11, the alcohol sensor 12, the secure element 13, and the antenna 14 are mounted and the printing sheets 2x and 3x are laminated. Is generated by.

Next, the details of the configuration and function of the alcohol sensor 12 will be described with reference to FIG. 4 (A) is a plan view showing an example of the internal structure of the alcohol sensor 12, and FIGS. 4 (B) and 4 (C) are cross-sectional views (XX parts) showing an example of the internal structure of the alcohol sensor 12. (Cross section). As shown in FIGS. 4A and 4B, the alcohol sensor 12 includes an insulating resin material 121, a light transmitting resin material 122, a dehydrogenase film material 123, an ultraviolet light emitting diode 124, a photosensor 125, and the like. .. Further, the alcohol sensor 12 is formed by laminating a light-transmitting resin material 122 and a dehydrogenase film material 123 on an insulating resin material 121. The insulating resin material 121 is made of, for example, a polyimide having a thickness of 40 μm to 200 μm. The light-transmitting resin material 122 and the dehydrogenase film material 123 have a thickness of about 10 μm to 200 μm, respectively, and the upper surface of the light-transmitting resin material 122 and the dehydrogenase film material 123 is penetrated by the pad of the user's finger. Corresponds to the contact surface that is contacted through the hole 101. The light-transmitting resin material 122 is made of a material that transmits ultraviolet rays from the ultraviolet light emitting diode 124, but does not necessarily have to be provided as a component of the alcohol sensor 12.

An ultraviolet light emitting diode 124 and a photo sensor 125 are attached to the insulating resin material 121. In the example of FIG. 4B, the ultraviolet light emitting diode 124 and the photosensor 125 are incorporated in the same insulating resin material 121 provided on the printing sheet 2x, and in the thickness direction Y of the printing sheet 2x, The light transmissive resin material 122 is arranged on the ultraviolet light emitting diode 124, and the dehydrogenase film material 123 is arranged on the photosensor 125. However, in the example of FIG. 4B, the light emitting surface 124X of the ultraviolet light emitting diode 124 and the detection surface 125X of the photosensor 125 are not covered with the insulating resin material 121, and the light emitting surface 124X is the light transmitting resin material 122. The detection surface 125X is in contact with the dehydrogenase membrane material 123. According to the structure of the alcohol sensor 12 shown in FIG. 4B, the ultraviolet light emitting diode 124 is covered with the insulating resin material 121 and the light transmissive resin layer 122, and the photosensor 125 is the insulating resin material 121 and the dehydrogenase film material. Since it is covered with 123, the durability of the product (IC card) can be improved. Further, according to the structure of the alcohol sensor 12 shown in FIG. 4 (B), the surface of the two modules can be easily shaped by being separated into the resin layer and the module layer, so that the production efficiency of the card can be improved. Can be done. On the other hand, in the example of FIG. 4C, the ultraviolet light emitting diode 124 is arranged on the insulating resin material 121 by, for example, adhesion, and the photosensor 125 is insulated so that its detection surface 125X is not covered by the insulating resin material 121. It is incorporated in the resin material 121, and the dehydrogenase film material 123 is arranged on the photosensor 125 in the thickness direction Y of the base material. According to the structure of the alcohol sensor 12 shown in FIG. 4C, since a permeable resin is not used, the manufacturing cost of members and the like can be kept low. In both cases of FIGS. 4B and 4C, the ultraviolet light emitting diode 124 and the photosensor 125 are arranged side by side on the printing sheet 2x so as not to overlap each other in the thickness direction of the printing sheet 2x.

The ultraviolet light emitting diode 124 receives power from the secure element 13 and emits ultraviolet rays having a wavelength near 340 nm (for example, 300 to 370 nm) from the light emitting surface 124X. The dehydrogenase film material 123 is irradiated with ultraviolet rays from the ultraviolet light emitting diode 124. The dehydrogenase membrane material 123 is produced, for example, by immobilizing a dehydrogenase on a carrier. For the carrier, a chemically stable material is used, which serves as a base for fixing the dehydrogenase. The dehydrogenase membrane material may be produced by solidifying the dehydrogenase itself without using a carrier.

Dehydrogenase is an enzyme that catalyzes the reaction of _{oxidizing alcohol (CH 3} CH ₂ OH: ethanol) to acetaldehyde (CH ₃ CHO) in the presence of coenzyme. As the dehydrogenase, for example, alcohol dehydrogenase (EC.1.1.1.1, EC.1.1.1.2, EC.1.1.1.71) is used. As the coenzyme, NAD ⁺ (oxidized form of nicotinamide adenine dinucleotide) or NADP ⁺ (oxidized form of nicotinamide adenine dinucleotide phosphate) is used. This coenzyme is provided, for example, on the surface of the dehydrogenase membrane material. As shown in the chemical formula (1) or (2) below, acetaldehyde and NADH (reduced form of nicotinamide adenine dinucleotide) or NADPH (nicotinamide) are produced by the enzymatic reaction of alcohol, coenzyme, and dehydrogenase. A reduced form of adenine dinucleotide phosphate) is produced.

CH ₃ CH ₂ OH + NAD ⁺ → CH ₃ CHO + NADH + H ⁺ ... (1)

CH ₃ CH ₂ OH + NADP ⁺ → CH ₃ CHO + NADPH + H ⁺ ... (2)

Here, NADH or NADPH is a substance produced in the dehydrogenase membrane material 123 by an alcohol component contained in the user's sweat (for example, sweat sweated from the pad of the user's finger), and depends on the concentration of alcohol. do. NADH or NADPH emits excited fluorescence by absorbing the ultraviolet rays emitted from the ultraviolet light emitting diode 124. That is, NADH or NADPH absorbs ultraviolet rays in the vicinity of 340 nm to change from the ground state to the excited state and emit fluorescence.

The photosensor 125 is configured to include a photodiode, and detects fluorescence emitted by NADH or NADPH generated in the dehydrogenase film material 123 due to an alcohol component contained in the user's sweat by absorbing ultraviolet rays in the vicinity of 340 nm. Detected through surface 125X. The fluorescence detected in this way is converted into a numerical value as described above, and is transmitted to the secure element 13 via wiring as state information. Since the wavelength of the fluorescence emitted as described above is 450 to 510 nm, a photosensor 125 that detects fluorescence having a wavelength of 450 to 510 nm is adopted.

Next, the details of the configuration and the function of the secure element 13 will be described. The secure element 13 includes a program storage unit 131, a data storage unit 132, a transmission / reception unit 133 to 135, a control unit 136, and the like, and communicates with the control unit 2 via wired or wireless communication and is a biometric sensor. It controls the operation of the 11 and the alcohol sensor 12. The program storage unit 131 and the data storage unit 132 are composed of, for example, at least one of a ROM (Read Only Memory) and an NVM (Non Volatile Memory). Programs such as an OS (operating system) and an application are stored in the program storage unit 131. The data storage unit 132 stores collation data for collation used for user authentication, determination standard data indicating a determination standard (for example, a threshold value) for determining the physical condition of the user, and the like. Here, biometric information acquired in advance by the biometric sensor 11 is used as the collation data. Therefore, the collation data indicates a fingerprint on the pad of the user's finger. Further, the data storage unit 132 stores key data (for example, a set of the private key and the public key of the license confirmation device 1 and the public key of the control unit 2, or a common key of the license confirmation device 1 and the control unit 2). Will be done. The control unit 2 has key data (for example, a set of a private key and a public key of the control unit 2 and a public key of the license confirmation device 1 and the control unit 2, or a common key of the license confirmation device 1 and the control unit 2). ) Is provided with a non-volatile memory.

The transmission / reception unit 133 serves as an interface for communicating with the control unit 2. The transmission / reception unit 134 includes a connection terminal connected to the wiring from the biometric sensor 11, and serves as an interface for communicating with the biometric sensor 11. The transmission / reception unit 135 includes a connection terminal connected to the wiring from the alcohol sensor 12, and serves as an interface for communicating with the alcohol sensor 12.

FIG. 5 is a diagram showing a hardware configuration example of the control unit 136 (an example of a computer). As shown in FIG. 5, the control unit 136 is configured to include a RAM (Random Access Memory) 136a, a CPU (Central Processing Unit) 136b, a random number generator 136c, and the like, and the control unit 136 is from the control unit 2. In response to the request, mutual authentication and license confirmation processing are executed according to the program stored in the program storage unit 131. In the mutual authentication and license confirmation process, the license confirmation device 1 performs mutual authentication with the control unit 2 and confirms whether or not the operation permission is given to the controlled object 3 (in other words, the license is granted) (in other words, whether the license is granted). That is, it is a process (which determines whether the operation is permitted or not).

In this mutual authentication and license confirmation process, the CPU 136b of the control unit 136 includes an information acquisition unit 1361, a user authentication unit 1362 (an example of a user authentication means), a state determination unit 1363 (an example of a determination means), and a mutual authentication unit 1364 (device). It functions as an authentication means), a response data generation unit 1365 (an example of a generation means), a response data encryption unit 1366 (an example of an encryption means), an information transmission unit 1367 (an example of a transmission means), and the like.

The information acquisition unit 1361 activates the biometric sensor 11 by transmitting an activation signal to the biometric sensor 11 via the transmission / reception unit 134. In this state, when the pad of the user's finger is placed on the contact surface of the biometric sensor 11, the biometric sensor 11 detects the amount of charge accumulated in the electrode and acquires biometric information indicating a fingerprint, which is acquired. Biometric information is transmitted to the secure element 13 via wiring. As a result, the information acquisition unit 1361 receives (acquires) the biometric information acquired by the biometric sensor 11 via the transmission / reception unit 134.

Further, the information acquisition unit 1361 activates the alcohol sensor 12 by transmitting an activation signal to the alcohol sensor 12 via the transmission / reception unit 135. When the alcohol sensor 12 is activated by the activation signal, it emits ultraviolet rays from the ultraviolet light emitting diode 124. In this state, when the pad of the user's finger is placed on the contact surface of the alcohol sensor 12, the alcohol sensor 12 acquires the state information indicating the fluorescence intensity detected by the photo sensor 125, and the acquired state information is wired. Is transmitted to the secure element 13 via. As a result, the information acquisition unit 1361 receives (acquires) the state information acquired by the alcohol sensor 12 via the transmission / reception unit 135.

The user authentication unit 1362 authenticates the user using the biometric information acquired by the biometric sensor 11. For example, the user authentication unit 1362 collates the fingerprint indicated by the biometric information acquired by the biometric sensor 11 with the fingerprint indicated by the collation data stored in the data storage unit 132, and a plurality of feature points (a plurality of feature points in both fingerprints). For example, when the end point and the branch point) match a predetermined number or more, it is determined that the user authentication is successful.

The state determination unit 1363 determines the user state using the state information acquired by the alcohol sensor 12. For example, the state determination unit 1363 determines whether the fluorescence intensity indicated by the state information (an example of the user's physical condition) is less than the determination standard (in other words, does the user's physical condition satisfy a preset standard). Whether or not it is determined (this is referred to as user status determination). Here, the determination standard is, for example, a threshold value indicated by the determination reference data stored in the data storage unit 132, and if the fluorescence intensity is equal to or higher than the threshold value, the alcohol concentration is considered to exceed the reference value.

The mutual authentication unit 1364 is a mutual authentication data (an example of authentication data) that changes at one frequency in one or a plurality of sessions between the key data stored in the data storage unit 132 and the control unit 2. Mutual authentication is performed with the control unit 2 using and. The mutual authentication data that changes once in one session is an ad hoc session code. That is, in this case, the mutual authentication unit 1364 uses the key data stored in the data storage unit 132 and the mutual authentication data that changes for each session (that is, for each mutual authentication) between the control unit 2. Mutual authentication will be performed with the control unit 2. Here, as the mutual authentication data, a random number generated by the random number generator 136c may be used, but a one-time password may also be used.

In the response data generation unit 1365, the user authentication by the user authentication unit 1362 is successful, and the fluorescence intensity indicated by the state information is less than the determination standard by the state determination unit 1363 (that is, the physical condition of the user is preset). When it is determined that the mutual authentication is satisfied by the mutual authentication unit 1364 and the mutual authentication is successful, the data indicating the license validity (that is, the data indicating the operation permission for the controlled object 3) and the data indicating the operation permission for the controlled object 3 are used in the mutual authentication. Response data is generated based on the mutual authentication data. On the other hand, in the response data generation unit 1365, the mutual authentication by the mutual authentication unit 1364 succeeded, but the authentication by the user authentication unit 1362 failed, or the fluorescence intensity indicated by the state information 1363 by the state determination unit 1363 was less than the determination standard. If it is determined that this is not the case, response data is generated based on the data indicating that the license is invalid (that is, the data indicating that the operation is not permitted for the controlled object 3) and the mutual authentication data used in the mutual authentication.

Here, the data indicating the license validity may be any data as long as the control unit 2 can recognize that the operation with respect to the control target 3 is permitted. For example, "11111". It is data such as. On the other hand, the data indicating that the license is invalid is data such as "00000" that can be distinguished from the data indicating that the license is valid. The data indicating that the license is valid and the data indicating that the license is invalid are predetermined as common information between the license confirmation device 1 and the control unit 2. Further, the response data is generated by, for example, substituting the data indicating license validity and the data for mutual authentication into a predetermined calculation formula shared with the control unit 2. For example, the response data may be generated as an exclusive OR (XOR) of the data indicating license validity and the data for mutual authentication.

The response data encryption unit 1366 encrypts the response data generated by the response data generation unit 1365 with the key data used in the mutual authentication. Then, the information transmission unit 1367 transmits (responses) the response data encrypted by the response data encryption unit 1366 to the control unit 2 in which the mutual authentication has been performed via the transmission / reception unit 133. The response data may be obfuscated by a code generated by an irreversible function such as a hash function and transmitted instead of being encrypted by the key data.

[2. Operation of license confirmation device 1 and control unit]
Next, with reference to FIGS. 6 and 7, data exchange between the license confirmation device 1 and the control unit 2 when mutual authentication and license confirmation processing are performed will be described. 6 and 7 are sequence diagrams showing data exchange between the license confirmation device 1 and the control unit 2 when the license confirmation process is performed.

First, in FIG. 6, when power supply to the control unit 2 is started by turning on the power, for example, the control unit 2 transmits a reset (signal) to the license confirmation device 1 (step S1). When the control unit 136 of the license confirmation device 1 receives the reset from the control unit 2, it transmits a reset response to the control unit 2 via the transmission / reception unit 133 (step S2). When the control unit 2 receives the reset response from the license confirmation device 1, the control unit 2 generates a random number A (an example of the first mutual authentication data) by the random number generator (not shown) (step S3) and is generated. The random number A and the authentication request are transmitted to the control unit 136 (mutual authentication unit 1364) of the license confirmation device 1 (step S4).

When the control unit 136 (mutual authentication unit 1364) of the license confirmation device 1 receives the random number A and the authentication request from the control unit 2, the control unit 136 starts the mutual authentication process. When the mutual authentication process starts, the control unit 136 (mutual authentication unit 1364) generates a random number B (an example of the second mutual authentication data) by the random number generator 136c (step S5). Next, the control unit 136 (mutual authentication unit 1364) encrypts the received random number A with the key data stored in the data storage unit 132 (step S6). For encryption, for example, DSA, RSA encryption method, or the like is used. For example, the random number A is encrypted by the common key of the license confirmation device 1 and the control unit 2. Alternatively, the random number A may be signed by the private key of the license confirmation device 1. In the example of FIG. 6, the random number A is configured to be encrypted after the random number B is generated, but the random number B may be generated after the random number A is encrypted. Next, the control unit 136 (mutual authentication unit 1364) has a random number B generated in step S5 and a random number A encrypted in step S6 (an example of the first encrypted data, hereinafter, "encrypted random number A". Is transmitted to the control unit 2 via the transmission / reception unit 133 (step S7).

When the control unit 2 receives the random number B and the encrypted random number A from the license confirmation device 1, the control unit 2 decrypts the received encrypted random number A with the key data stored in the non-volatile memory (step S8). For example, the encrypted random number A is decrypted by the common key of the license confirmation device 1 and the control unit 2. Alternatively, the signature verification of the random number A may be performed by the public key of the license confirmation device 1. If the encrypted random number A cannot be decrypted by the key data, error processing is performed. Next, the control unit 2 verifies by determining whether or not the value (decoded value) decoded in step S8 and the random number A transmitted in step S4 match (step S9). When the value decoded in step S8 and the random number A transmitted in step S4 match, the control unit 2 determines that the verification is successful (step S9: success), and makes the received random number B non-volatile. It is encrypted with the key data stored in the memory (step S10), and the process proceeds to step S11. For example, the random number B is encrypted by the common key of the license confirmation device 1 and the control unit 2. Alternatively, the random number A may be signed by the private key of the control unit 2. Then, in step S11, the control unit 2 transfers the random number B (an example of the second encrypted data, hereinafter referred to as “encrypted random number B”) encrypted in step S10 to the control unit 136 of the license confirmation device 1. It is transmitted to the mutual authentication unit 1364). On the other hand, if the value decoded in step S8 and the random number A transmitted in step S4 do not match, the control unit 2 determines that the verification has failed (step S9: failure) and performs error processing (for example, mutual authentication). Information indicating the failure of the above is transmitted, and processing is stopped) (step S12).

The control unit 136 (mutual authentication unit 1364) receives the encrypted random number B from the control unit 2 (that is, receives the encrypted random number B transmitted from the control unit 2 in response to the successful verification of the encrypted random number A). (Received), the received encrypted random number B is decrypted by the key data stored in the data storage unit 132 (step S13). For example, the encrypted random number B is decrypted by the common key of the license confirmation device 1 and the control unit 2. Alternatively, the signature verification for the random number B may be performed by the public key of the control unit 2. If the encrypted random number B cannot be decrypted by the key data, error processing is performed. Next, the control unit 136 (mutual authentication unit 1364) verifies by determining whether or not the value (decoded value) decoded in step S13 and the random number B transmitted in step S7 match ( Step S14). When the value decoded in step S13 and the random number B transmitted in step S7 match, the control unit 136 (mutual authentication unit 1364) determines that the verification is successful (step S14: success), and performs mutual authentication. Information indicating success (mutual authentication success information) is transmitted to the control unit 2 via the transmission / reception unit 133 (step S15). That is, the control unit 136 (mutual authentication unit 1364) verifies the encrypted random number B, and when the verification is successful, the control unit 136 transmits the mutual authentication success information to the control unit 2. On the other hand, if the value decoded in step S13 and the random number B transmitted in step S7 do not match, the control unit 136 (mutual authentication unit 1364) determines that the verification has failed (step S14: failure) and an error occurs. Processing (for example, transmitting information indicating the failure of mutual authentication and stopping the processing) is performed (step S14e). In this way, the license confirmation device 1 completes mutual authentication with the control unit 2.

Next, in FIG. 7, when the control unit 2 receives the information indicating the success of mutual authentication from the license confirmation device 1, the control unit 2 issues a license confirmation request (that is, an execution request for operation permission / rejection determination for the controlled object 3). It is transmitted to the control unit 136 (user authentication unit 1362) of 1 (step S16). If the mutual authentication fails, the license confirmation request is not transmitted to the license confirmation device 1. When the control unit 136 of the license confirmation device 1 receives the license confirmation request from the control unit 2, the control unit 136 starts the license confirmation process. In the examples of FIGS. 6 and 7, the license confirmation process is configured to start after the mutual authentication process is completed. However, the mutual authentication process and the license confirmation process are performed in parallel by, for example, multitasking of the OS. It may be configured to be executed in. In this case, the control unit 2 transmits the license confirmation request to the license confirmation device 1 together with the authentication request in step S4. The mutual authentication process may be started after the license confirmation process is completed.

When the license confirmation process starts, the control unit 136 (user authentication unit 1362, etc.) executes the user authentication process (step S17). In the user authentication process, the control unit 136 (information acquisition unit 1361) activates the biometric sensor 11 by transmitting an activation signal to the biometric sensor 11 via the transmission / reception unit 134, and the pad of the user's finger is biometric. By being placed on the contact surface of the metric sensor 11, the biometric information acquired by the biometric sensor 11 is acquired (received) via the transmission / reception unit 134. Next, the control unit 136 (user authentication unit 1362) performs user authentication using the acquired biometric information. For example, the control unit 136 (user authentication unit 1362) collates the fingerprint indicated by the acquired biometric information with the fingerprint indicated by the collation data stored in the data storage unit 132, and determines a plurality of feature points in both fingerprints. Determine if there are more than a few matches. Then, when a plurality of feature points on both fingerprints match a predetermined number or more, the control unit 136 (user authentication unit 1362) determines that the user authentication is successful, and stores information indicating the user authentication success (for example, the user). Turn on (1) the flag indicating authentication success). On the other hand, when a plurality of feature points on both fingerprints do not match a predetermined number or more, the control unit 136 (user authentication unit 1362) determines that the user authentication has failed and stores information indicating the user authentication failure (for example, the user). Turn off (0) the flag indicating authentication success).

Next, the control unit 136 (state determination unit 1363) executes the user state determination process (step S18). In the user state determination process, the control unit 136 (information acquisition unit 1361) activates the alcohol sensor 12 by transmitting an activation signal to the alcohol sensor 12 via the transmission / reception unit 135, and the user touches the contact surface of the alcohol sensor 12. The state information indicating the intensity of fluorescence detected by the alcohol sensor 12 with the pad of the finger placed is acquired (received) via the transmission / reception unit 135. Next, the control unit 136 (state determination unit 1363) determines the user state using the acquired state information. For example, the control unit 136 (state determination unit 1363) determines whether or not the fluorescence intensity indicated by the acquired state information is less than the determination standard. Then, when the control unit 136 (state determination unit 1363) determines that the fluorescence intensity is less than the determination standard (that is, determines that the user condition is good), the control unit 136 stores information indicating that the user condition is good (for example, the user condition is good). Turn on (1) the flag indicating. On the other hand, when the control unit 136 (state determination unit 1363) determines that the fluorescence intensity is not less than the determination standard, the control unit 136 stores the information indicating the user condition failure (for example, the flag indicating the user condition good condition is set to off (0)). )do. The user status determination process may be executed immediately before the user authentication process.

Next, the control unit 136 determines whether or not the user authentication is successful and the user state is good (step S19). In step S17, it was determined that the user authentication was successful (that is, the information indicating that the user authentication was successful was stored), and in step S18, it was determined that the user condition was good (that is, the information indicating that the user condition was good was stored). Whether or not it is determined. When the control unit 136 determines that the user authentication is successful and the user state is good (step S19: YES), the control unit 136 stores data indicating license validity (license validity record) (step S20). On the other hand, when the control unit 136 determines that the user authentication has failed or the user state is not good (step S20: NO), the control unit 136 stores data indicating license invalidity (license invalidation record) (step S21).

Next, the control unit 136 (response data generation unit 1365) includes the data indicating license validity stored in step S20 or the data indicating license invalidity stored in step S21, and the random numbers A and random numbers used in the above mutual authentication. Response data is generated by substituting B into a predetermined calculation formula shared with the control unit 2 (step S22). For example, the exclusive OR of the data indicating the license validity, the random number A, and the random number B is generated as the response data. Here, the exclusive OR of the data indicating the license validity and the random number A (or the random number B) may be generated as the response data.

When the mutual authentication process and the license confirmation process are executed in parallel, the control unit 2 confirms the license when it receives the information indicating the success of the mutual authentication transmitted from the license confirmation device 1 in step S15. By transmitting the result request (that is, the operation permission / rejection determination result request) to the license confirmation device 1, the control unit 136 performs the process of step S22 in response to this request. In this case, when the license confirmation result request is received, if the data indicating that the license is valid or the data indicating that the license is invalid is not yet stored, the control unit 136 (response data generation unit 1365) requests the license confirmation result. The response data is generated when the data indicating that the license is valid or the data indicating that the license is invalid is stored in the waiting state.

Next, the control unit 136 (response data encryption unit 1366) encrypts the response data generated in step S22 with the key data used in the mutual authentication (step S23). For example, the response data is encrypted by the common key of the license confirmation device 1 and the control unit 2. Alternatively, the signature verification of the response data may be performed by the public key of the control unit 2. Next, the control unit 136 (information transmission unit 1367) transmits the response data encrypted in step S23 to the control unit 2 where the mutual authentication has been performed via the transmission / reception unit 133 (step S24). That is, the control unit 136 (information transmission unit 1367) transmits the response data encrypted in step S23 to the control unit 2 in response to the license confirmation result request.

When the control unit 2 receives the encrypted response data from the license confirmation device 1, the control unit 2 decrypts the received response data with the key data used in the mutual authentication (step S25). For example, the response data is decrypted by the common key of the license confirmation device 1 and the control unit 2. Alternatively, the response data may be signed by the private key of the control unit 2. Next, the control unit 2 determines whether or not the license confirmation result indicates license validity based on the response data decrypted in step S25 (step S26). For example, the control unit 2 shares a predetermined data indicating license validity with the license confirmation device 1 and the random numbers A and B used in the mutual authentication with the license confirmation device 1. Confirmation data is generated by substituting into the calculation formula. For example, the exclusive OR of the data indicating the license validity, the random number A, and the random number B is generated as confirmation data.

Then, the control unit 2 determines whether or not the generated confirmation data and the response data decoded in step S25 match, and if the confirmation data and the response data match, the control unit 2 determines. It is determined that the license confirmation result indicates that the license is valid (step S26: YES). In this case, the control unit 2 starts the operation of the control target 3 by transmitting a drive signal (that is, an operation permission signal) to the control target 3 (step S27). For example, when the control unit 2 is an engine control unit, the engine is started by transmitting a start signal (an example of a drive signal) indicating engine start to the control target 3. On the other hand, for example, when the control unit 2 is a steering control unit or a shift lever control unit, the lock of the steering or shift lever is released by transmitting an unlock signal (an example of a drive signal) to the control target 3. On the other hand, for example, when the control unit 2 is a gateway device, a drive signal is transmitted to the engine control unit, and an unlock signal (an example of the drive signal) is transmitted to the steering control unit and the shift lever control unit. On the other hand, when the control unit 2 is a lock / unlock control unit that controls the lock / unlock of the door, the door is unlocked by transmitting an unlock signal (an example of a drive signal) to the control target 3.

On the other hand, in step S26, if the generated confirmation data and the response data do not match, the control unit 2 determines that the license confirmation result does not indicate the license validity (that is, indicates the license invalidity) (step). S26: NO). In this case, the control unit 2 locks the operation of the control target 3 by transmitting a lock signal (that is, an operation disallowance signal) or an error signal to the control target 3 (step S28). For example, when the control unit 2 is an engine control unit, the drive signal is not transmitted to the control target 3. On the other hand, for example, when the control unit 2 is a steering control unit or a shift lever control unit, the steering or shift lever is locked by transmitting a lock signal to the control target 3. On the other hand, for example, when the control unit 2 is a gateway device, a lock signal is transmitted to the steering control unit and the shift lever control unit. On the other hand, when the control unit 2 is a lock / unlock control unit that controls the locking / unlocking of the door, the unlocking signal is not transmitted to the control target 3. When the control unit 2 is a control unit that controls the alarm output circuit, an error signal is transmitted to the control target 3 to output an alarm.

As described above, according to the above embodiment, in the license confirmation device 1, the user authentication by the user authentication unit 1362 is successful, the state determination unit 1363 determines that the user state is good, and the mutual authentication unit 1364 When the mutual authentication by the above is successful, the response data is generated based on the data indicating the license validity and the mutual authentication data used in the mutual authentication, and the generated response data is used in the above mutual authentication. Since it is configured to be encrypted with the key data and transmitted to the control unit 2 where the mutual authentication is performed, it is possible to effectively prevent spoofing of the device in the environment where the user authentication and the user state determination are performed. That is, since the response data is generated based on the mutual authentication data that changes for each session, even if the data (signal) is extracted by the probe from the transmission route between the license confirmation device 1 and the control unit 2. Even so, it can be difficult to analyze whether the data indicates license validity or license invalidity. Therefore, for example, it is possible to prevent an unauthorized device from being connected to the transmission route between the license confirmation device 1 and the control unit 2 to transmit a fake drive signal to the control unit 2, and to prevent spoofing of the device. Further, for example, if the license confirmation device 1 is installed in the vehicle as an IC card and is configured to communicate with an engine control unit or the like that controls the operation of the engine, the verification data for verification used for user authentication ( Since the biometric information) is stored in the IC card (data storage unit 132), it is not left in the vehicle as in the prior art, so that both privacy protection and security improvement can be realized.

In the above embodiment, the alcohol sensor 12 is configured to acquire state information showing fluorescence according to the concentration of alcohol by using an enzyme light emitting sensor, and is disclosed in, for example, Japanese Patent Application Laid-Open No. 2008-308037. By using a semiconductor-type gas sensor (semiconductor-type sensor) using tin oxide, the "resistance value of tin oxide" according to the concentration of alcohol may be acquired as state information. In this case, if the resistance value indicated by the state information acquired by the alcohol sensor 12 is less than the threshold value indicated by the determination reference data stored in advance in the data storage unit 132, the state determination unit 1363 changes the physical condition of the user. It is determined that the preset criteria are satisfied (that is, it is determined that the user condition is good). Further, the alcohol sensor 12 may be configured to acquire a "current value" according to the concentration of alcohol as state information by using an electrochemical sensor in addition to the enzyme light emitting sensor and the semiconductor sensor. The electrochemical sensor has a platinum selective catalytic electrode in which the alcohol is electrochemically oxidized to generate an electrode current. The higher the concentration of alcohol generated by the user, the higher the electrode current value. The electrochemical sensor has a longer life and higher high temperature resistance than the enzyme-emitting sensor, and the selection accuracy of the gas to be detected is higher than that of the semiconductor sensor, and the operation time until the operation becomes stable is high. There are merits such as being short. When the electrochemical sensor is used, the state determination unit 1363 is the state information obtained from the finger on which the contact surface 12X of the alcohol sensor 12 is detected, and is an electrode indicated by the state information acquired by the alcohol sensor 12. If the current value is less than the threshold value indicated by the determination reference data stored in advance in the data storage unit 132, it is determined that the physical condition of the user satisfies the preset criterion (that is, it is determined that the user condition is good).

Further, in the above embodiment, the concentration of the alcohol component has been described as an example of the state information indicating the state of the user's body. For example, the substrate disclosed in JP-A-2009-168671 (the substrate of the dehydrogenase). It may be the concentration of the component. In this case, the state information acquisition sensor acquires the state information indicating the concentration of the component and transmits the state information to the secure element 13. Then, the state determination unit 1363 determines that the user's physical condition satisfies the preset standard if the concentration of the above component is less than the threshold value indicated by the determination reference data stored in the data storage unit 132 in advance ( That is, it is determined that the user condition is good). Alternatively, the pulse rate of the user may be used as another example of the state information indicating the physical state of the user. In this case, the state information acquisition sensor acquires the state information indicating the pulse rate of the user and transmits the state information to the secure element 13. Then, the state determination unit 1363 determines that the user's physical condition satisfies the preset standard if the pulse rate of the user is less than the threshold value indicated by the determination reference data stored in the data storage unit 132 in advance ( That is, it is determined that the user condition is good). The state information indicating the state of the user's body may be the body temperature of the user. In this case, the state information acquisition sensor acquires the state information indicating the user's body temperature and transmits the state information to the secure element 13. Then, the state determination unit 1363 determines that the user's physical condition satisfies the preset standard if the body temperature is less than the threshold value indicated by the determination reference data stored in the data storage unit 132 in advance (that is,). Judge that the user condition is good).

Further, in the above embodiment, the biometric sensor 11 is configured to acquire the fingerprint of the user as biometric information, but it may be configured to acquire the crest (palm crest) on the palm of the user as biometric information. good. In this case, the user authentication unit 1362 collates the palm print indicated by the biometric information acquired by the biometric sensor 11 with the palm print indicated by the collation data stored in the data storage unit 132, and a plurality of feature points in both palm prints. If is more than a predetermined number, it is determined that the user authentication is successful.

Alternatively, the biometric sensor 11 may be configured to acquire a blood vessel (vein) pattern (image) in the user's palm or finger as biometric information. In this case, the biometric sensor 11 includes an infrared light emitting unit and a blood vessel imaging unit, and the blood vessel pattern (image) is obtained by imaging the finger with the imaging unit in a state where the infrared light emitting unit irradiates the palm or the finger. Acquired as biometric information. Then, the user authentication unit 1362 collates the blood vessel pattern indicated by the biometric information acquired by the biometric sensor 11 with the blood vessel pattern indicated by the collation data stored in the data storage unit 132, and a plurality of blood vessel patterns in both blood vessel patterns. If the feature points match a predetermined number or more, it is determined that the user authentication is successful. Alternatively, the biometric sensor 11 may be configured to photograph the user's face and acquire it as biometric information. Then, the user authentication unit 1362 collates the face image indicated by the biometric information acquired by the biometric sensor 11 with the face image indicated by the collation data stored in the data storage unit 132, and a plurality of face images in both face images. If the feature points match a predetermined number or more, it is determined that the user authentication is successful.

Further, in the above embodiment, the license confirmation device 1 and the control unit 2 are configured to perform mutual authentication, but instead of the mutual authentication, one-sided authentication (that is, the license confirmation device 1 and the control unit 2 One of the following authentications) may be performed. For example, in this case, the device authentication means of the license confirmation device 1 is for authentication that changes at one frequency in one or a plurality of sessions between the key data stored in the data storage unit 132 and the control unit 2. One-sided authentication is performed with the control unit 2 using the data.

1 License confirmation device 2 Control unit 3 Control target 11 Biometric sensor 12 Alcohol sensor 13 Secure element 121 Insulation resin material 122 Light-transmitting resin material 123 Dehydrogenase membrane material 124 Ultraviolet light emitting diode 125 Photosensor 131 Program storage unit 132 Data storage Units 133 to 135 Transmission / reception unit 136 Control unit 1361 Information acquisition unit 1362 User authentication unit 1363 Status determination unit 1364 Mutual authentication unit 1365 Response data generation unit 1366 Response data encryption unit 1366 Information transmission unit

Claims (6)

A biometric information acquisition sensor that acquires biometric information for use in user authentication, a state information acquisition sensor that acquires state information indicating the user's physical condition, and a non-volatile memory that stores key data are provided and controlled. An authentication processing device that can communicate with a control device that controls the operation of the target.
A user authentication means for authenticating the user using the biometric information acquired by the biometric information acquisition sensor, and
A determination means for determining whether or not the physical condition indicated by the state information acquired by the state information acquisition sensor satisfies a preset standard, and
Authentication is performed between the control device and the key data stored in the non-volatile memory using the authentication data that changes at one frequency in one or a plurality of sessions with the control device. Device authentication means and
If the user authentication means succeeds in authenticating the user, the determination means determines that the criteria are satisfied, and the device authentication means succeeds in the authentication, data indicating operation permission for the control target. And a generation means for generating response data based on the authentication data used in the authentication.
A transmission means for transmitting the response data to the authenticated control device, and
An authentication processing device characterized by comprising. An encryption means that encrypts the response data generated by the generation means with the key data used in the authentication, and
A transmission means for transmitting the response data encrypted by the encryption means to the control device to which the authentication has been performed, and a transmission means.
The authentication processing apparatus according to claim 1, further comprising. The device authentication means is
A step of receiving the first authentication data generated by the control device from the control device, and
The second step of generating the authentication data and
A step of encrypting the received first authentication data with the key data stored in the non-volatile memory, and
A step of transmitting the generated second authentication data and the first encrypted data in which the first authentication data is encrypted to the control device.
In response to the success of the verification of the first encrypted data by the control device, the second encrypted data in which the second authentication data is encrypted by the control device is received from the control device. Steps to do and
A step of verifying the received second encrypted data and, when the verification is successful, transmitting information indicating the success of the authentication to the control device, and a step of transmitting the information indicating the success of the authentication.
A step of receiving an operation permission / rejection determination result request transmitted from the control device according to the information indicating the success of the authentication, and a step of receiving the operation permission / rejection determination result request.
And
The authentication processing device according to claim 2, wherein the transmission means transmits the response data encrypted by the encryption means to the control device in response to the operation permission / rejection determination result request. A biometric information acquisition sensor that acquires biometric information for use in user authentication, a state information acquisition sensor that acquires state information indicating the user's physical condition, and a non-volatile memory that stores key data are provided and controlled. An IC card that can communicate with a control device that controls the operation of the target.
A user authentication means for authenticating the user using the biometric information acquired by the biometric information acquisition sensor, and
A determination means for determining whether or not the physical condition indicated by the state information acquired by the state information acquisition sensor satisfies a preset standard, and
Authentication is performed between the control device and the key data stored in the non-volatile memory using the authentication data that changes at one frequency in one or a plurality of sessions with the control device. Device authentication means and
If the user authentication means succeeds in authenticating the user, the determination means determines that the criteria are satisfied, and the device authentication means succeeds in the authentication, data indicating operation permission for the control target. And a generation means for generating response data based on the authentication data used in the authentication.
A transmission means for transmitting the response data to the authenticated control device, and
An IC card characterized by being provided with. Controlled by including a biometric information acquisition sensor that acquires biometric information for use in user authentication, a status information acquisition sensor that acquires status information indicating the physical condition of the user, and a non-volatile memory that stores key data. An authentication processing method performed by a computer capable of communicating with a control device that controls the operation of the target.
A user authentication step for authenticating the user using the biometric information acquired by the biometric information acquisition sensor, and
A determination step for determining whether or not the physical condition indicated by the state information acquired by the state information acquisition sensor satisfies a preset standard, and
Authentication is performed between the control device and the key data stored in the non-volatile memory using the authentication data that changes at one frequency in one or a plurality of sessions with the control device. Device authentication step and
When the user authentication by the user authentication step is successful, the determination step determines that the criterion is satisfied, and the authentication by the device authentication step is successful, data indicating operation permission for the control target. And a generation step of generating response data based on the authentication data used in the authentication.
A transmission step of transmitting the response data to the authenticated control device, and
An authentication processing method characterized by including. Controlled by including a biometric information acquisition sensor that acquires biometric information for use in user authentication, a status information acquisition sensor that acquires status information indicating the physical condition of the user, and a non-volatile memory that stores key data. A computer that can communicate with the control device that controls the operation of the target
A user authentication means for authenticating the user using the biometric information acquired by the biometric information acquisition sensor, and
A determination means for determining whether or not the physical condition indicated by the state information acquired by the state information acquisition sensor satisfies a preset standard, and
Authentication is performed between the control device and the key data stored in the non-volatile memory using the authentication data that changes at one frequency in one or a plurality of sessions with the control device. Device authentication means and
If the user authentication means succeeds in authenticating the user, the determination means determines that the criteria are satisfied, and the device authentication means succeeds in the authentication, data indicating operation permission for the control target. And a generation means for generating response data based on the authentication data used in the authentication.
An authentication processing program characterized in that the response data functions as a transmission means for transmitting the response data to the authenticated control device.

Images