JP7051741B2 - Authentication device and authentication method - Google Patents

Description

The present application relates to an authentication device and an authentication method in which a user authenticates by inputting a password.

An authentication device that authenticates a user by inputting a password into an input device such as a numeric keypad or a keyboard provided in the authentication device is used in many situations such as building entry management. However, the password entered into the authentication device in such a situation must be long enough to be remembered and not forgotten by the person who enters the password, and is actually about 4 digits. It is often used by entering numbers from the numeric keypad.

In particular, in a system in which many users authenticate using the same password, for example, in authentication for entering a building, many users may repeatedly enter the same password, which is provided in the input device. Of the ten keys, the specific number key part corresponding to the password to be entered is entered by collecting fingerprints, observing the dirt or wear condition of the key surface part, and stealing the state of the user's key input. There is a situation where the password can be guessed.

Even in a system such as an ATM (automated teller machine) where an unspecified number of users use different passwords, the people who line up behind the users who are withdrawing cash are the users who are operating. There was a possibility of being damaged by so-called shoulder hacking, in which the password was revealed by looking into the hand.

As a countermeasure against such a problem, in Patent Document 1, not only the password is input, but a plurality of characters that are not the components of the password are input, and the user's sense of touch, hearing, and the like are input during the input of these characters. It is disclosed that the original password is input from the timing notified to the user by any of the visual notification means.

Japanese Unexamined Patent Publication No. 2008-71145

However, in the method according to Patent Document 1, when a visual, auditory, or other signal is used as a means for notifying the user of the timing for inputting the original password, the user is lined up behind the operating user. Even a third party can perceive a signal that tells them when to enter the correct password. In addition, even if a signal is given using the sense of touch, in some cases, a sound is generated when the touch screen is vibrated as a sense of touch, and the sound is perceived by a third party, and as a result, the password is easily inferred. There was a problem that it could end up.

This application is made to solve the above-mentioned problems, and is an authentication device for the purpose of reducing the security risk that the password for authentication is easily inferred by theft or observation from a third party. And provides an authentication method.

The authentication device according to the present application is an authentication start position specifying means for designating a position to be used for authentication among an input character string consisting of a password input from the input device and spoofed characters input before or after the password, and an input character string. Of these, the authentication character that cuts out the authentication character string based on the character number control unit that specifies the number of characters used for authentication, the position specified by the authentication start position specification means from the input character string, and the number of characters specified by the character number control unit. A hash value calculation means for calculating an input hash value from a column cutout unit and an authentication character string cut out by the authentication character string cutout part, and a hash value that stores a registered hash value generated from a pre-registered password. The authentication information comparison means is provided with a storage unit and an authentication information comparison means for confirming whether or not the input hash value calculated by the hash value calculation means matches the registered hash value stored in the hash value storage unit. If the comparison results by A column is cut out, and whether or not the input hash value matches the registered hash value is repeated by the authentication information comparison means.

The authentication method according to the present application is an authentication character by designating a start position used for authentication or the number of characters used for authentication from an input character string consisting of a password input from an input device and spoofed characters input before or after the password. Input calculated by the authentication character string cutting process step for cutting out a column, the hash value calculation processing step for calculating an input hash value from the authentication character string cut out in the authentication character string cutting process step, and the hash value calculation processing step. It is provided with an authentication information comparison processing step for confirming whether or not the hash value matches the registered hash value generated from the pre-registered password, and when the comparison result by the authentication information comparison processing step does not match. The start position used for authentication is sequentially moved by a predetermined number of characters, or the number of characters used for authentication is sequentially changed by a predetermined number of characters, the authentication character string is cut out, and the input hash value is registered by the authentication information comparison processing step. It repeats whether or not it matches the hash value.

In the present application, a third party peeks at the operation at the time of user authentication in various authentication devices in which a user who intends to receive authentication operates a device on an input device to perform authentication by a password. By imitating the contents, it is possible to reduce the security concern that the authentication information is exposed.

It is a block diagram which shows the authentication apparatus which concerns on Embodiment 1. FIG. It is a figure explaining the operation of the character string cutout part for authentication in Embodiment 1. FIG. It is a flowchart which showed the authentication operation which concerns on Embodiment 1. FIG. It is a figure explaining other operation of the character string cutout part for authentication in Embodiment 1. FIG. It is a block diagram which shows the authentication apparatus which concerns on Embodiment 2. It is a figure explaining the operation of the character string cutout part for authentication in Embodiment 2. FIG. It is a flowchart which showed the authentication operation which concerns on Embodiment 2. It is a diagram explaining the block diagram of the authentication apparatus which concerns on Embodiment 3 and the operation of the character string cutout part for authentication. It is a flowchart which showed the authentication operation which concerns on Embodiment 3. It is a block diagram which shows the authentication apparatus which concerns on Embodiment 4. It is a figure which shows the structure of the input device of the authentication device which concerns on Embodiment 4. FIG.

Embodiment 1.
Hereinafter, the authentication device according to the first embodiment of the present application will be described with reference to FIGS. 1 to 4.
1 is a configuration diagram showing a basic configuration example of the authentication device according to the first embodiment, FIG. 2 is a diagram illustrating the operation of the character string cutting portion in the first embodiment, and FIG. 3 is the first embodiment. FIG. 4 is a flowchart showing the flow of processing of the authentication device, and FIG. 4 is a diagram illustrating another operation of the character string cutting unit in the first embodiment.

In FIG. 1, the authentication device includes an input device 1 for a user who performs authentication to input a password, and the input device 1 is a means for inputting an input character string 2 such as a numeric keypad or a keyboard ( (Not shown) is provided. Of the input character string 2 input from the input device 1, the authentication start position specifying means 3 for designating the position used for authentication, and the character number control unit 4 for specifying the number of characters used for authentication among the input character string 2 are provided. The authentication character string cutout designation processing unit 5 is provided.

Further, the authentication device includes an authentication character string cutting unit 6 that cuts out an authentication character string 7 from the input character string 2 based on the position designated by the authentication start position designating means 3 and the number of characters specified by the character number control unit 4. Hash value calculation means 8 for calculating the input hash value 9 from the authentication character string 7 cut out by the authentication character string cutting unit 6, and hash value storage that stores the registered hash value generated from the password registered in advance. A unit 10 and an authentication information comparison unit 11 for confirming whether or not the input hash value 9 calculated by the hash value calculation unit 8 matches the registered hash value stored in the hash value storage unit 10 are provided. The authentication information comparison means 11 has an authentication result holding unit 12 that holds the result when the hash values match.

When the comparison result by the authentication information comparison means 11 does not match, the position specified by the authentication start position specifying means 3 is sequentially moved by a predetermined number of characters, or the number of characters specified by the character number control unit 4 is sequentially determined by a predetermined number of characters. While changing the minutes, the comparison is performed using the authentication information comparison means 11, and whether or not the input hash value 9 matches the registered hash value stored in the hash value storage unit 10 is repeated. The authentication information comparison means 11 repeats the authentication information comparison for all the combinations of predetermined cutting methods as the authentication character string 7.

When inputting the input character string 2, the user inputs "ABC" as the preceding impersonation character string 101 before the character string "DEFG" shown in the part of the password character string 102, as shown in FIG. After that, as the additional spoofing character string 103, a series of 12 characters in which "HIJKL" is combined is input as the input character string 2.

The input character string 2 input from the input device 1 by the user has the number of characters specified by the character number control unit 4 from the position designated by the authentication start position specifying means 3 in the authentication character string cutting unit 6. , Is cut out as an authentication character string 7.
Here, the character number control unit 4 sequentially increases the number of characters from the character separately specified as the minimum length of the password character string (here, 3 characters) to the number of characters of the input character string 2 to 12 characters, and the number of characters. To specify.

The authentication start position specifying means 3 specifies a start position for sequentially cutting out characters of the number of characters specified by the character number control unit 4 from the input character string 2, but here, one character is sequentially cut out from the first character of the input character string 2. It is carried out as a process of shifting backwards one by one.
In FIG. 2, the content of the input character string 2 is an authentication character string obtained as a result of being cut out by the authentication character string cutting unit 6 due to changes in the designated values of the authentication start position designating means 3 and the character number control unit 4. The state in which 7 is sequentially changed is shown in time series with reference numerals 104a to 104e.

First, the authentication start position designating means 3 designates the first character of the input character string 2. The character number control unit 4 specifies three characters held as the minimum password character string, which are determined in advance as initial values. That is, the character string first cut out from the input character string 2 by the authentication character string cutting unit 6 is the character string from the first character to the third character of the input character string 2. The authentication character string 7 obtained as a result is the character string "ABC" represented by the reference numeral 104a.

The process performed by the authentication character string cutting unit 6 of FIG. 1 corresponds to the authentication character string cutting process step S500 of FIG. The subsequent processing will be described with reference to the flowchart of FIG.
First, a case where a character string indicated by reference numeral 104a in FIG. 2 is obtained as the first cutting result will be described. The character string obtained in the authentication character string cutting process step S500 becomes an input value in the next hash value calculation process step S502, and in the hash value calculation process step S502, the character string “ABC” indicated by reference numeral 104a in FIG. Is used as the input value, and the input hash value 9 which is the result of the operation by the hash value generation polynomial determined in advance is obtained.

In the next authentication information comparison processing step S503, the value held in the hash value storage unit 10 shown in FIG. 1 is used. The value held here is the registered hash which is the result of calculating the original password character string "DEFG" registered in advance by using the same hash value generation polynomial used in the hash value calculation processing step S502. The value.

In the authentication information comparison processing step S503, the registered hash value held in the hash value storage unit 10 and the input hash value 9 calculated by the hash value calculation means 8 are compared, and it is confirmed whether they match. As a result of comparing the hash values, if they match, the result match output process step S506 is executed, and the authentication process ends.

If the results of the authentication information comparison processing step S503 do not match, the process proceeds to the input character string end confirmation step S504, and it is confirmed whether the processing has been completed for the authentication character string 7 cut out from all the input character strings. If the character string can still be cut out (No), the process proceeds to the authentication character string cutout designation process step S505, and the position specified by the authentication start position specifying means 3 and the number of characters specified by the character number control unit 4 are changed. , The authentication character string 7 is cut out from the input character string 2 in the authentication character string cutting process step S500.
In the input character string end confirmation step S504, when all the combinations that can be cut out are completed among the combinations of the position specified by the authentication start position designating means 3 and the number of characters specified by the character number control unit 4 (Yes). , The result mismatch output processing step S507 is executed, and the authentication processing is terminated as a failure.

If the character string can be further cut out in the input character string end confirmation step S504, the next cutout character designation process is performed in the authentication character string cutout designation process step S505. Specifically, when the authentication character string 7 acquired last time is the acquisition of three characters from the beginning of the input character string 2 indicated by the reference numeral 104a in FIG. 2, it is designated by the authentication start position designating means 3. The position is moved backward by one character, the first character is set from the second character, and the number of characters specified by the character number control unit 4 is left as 3 characters. The result of the authentication character string 7 obtained in this case is the three characters of "BCD" represented by the reference numeral 104b.

Similarly, when the processing comes to the authentication character string cutout designation processing step S505 next time, the first character is set from the third character, and the number of characters from the beginning is sequentially acquired from here. While shifting to the back, the authentication character string cutting process step S500, the hash value calculation process step S502, and the authentication information comparison process step S503 are repeatedly executed.
Here, when the number of characters specified by the character number control unit 4 is 3, the position at the end that can be cut out from the input character string 2 is indicated by the code 104c, which is the "JKL" at the 10th character from the beginning. ". Since it is not possible to cut out with 3 characters any more, if the results of the authentication information comparison processing step S503 repeated up to this point do not match, the value of the number of characters specified by the character number control unit 4 is advanced by 1. 4 characters.

At the timing when the value of the number of characters specified by the character number control unit 4 advances by 1, the value specified by the authentication start position designating means 3 shall set the beginning of the input character string 2. The value of the authentication character string 7 thus acquired becomes the character string of "ABCD" represented by the reference numeral 104d.
After that, similarly, in the state where the value of the number of characters specified by the character number control unit 4 is 4, the value specified by the authentication start position specifying means 3 is advanced one character at a time, and the authentication character string cutting process step S500 and the hash value calculation are performed. The processing of the processing step S502 and the authentication information comparison processing step S503 will be repeated.

In this embodiment, since the password character string 102 is 4 characters, when the value specified by the authentication start position designating means 3 becomes 4, the content of the authentication character string 7 is represented by the reference numeral 104e. It becomes "DEFG" and matches the contents of the password character string 102.
At this time, the content to be compared in the authentication information comparison processing step S503 is the same as the registered hash value corresponding to the password character string 102 stored in the hash value storage unit 10, so that the result matching output processing step S506 is performed. It is executed, the authentication is approved, and it ends.

As described above, in the first embodiment, the character number control unit 4 controls each cutout start position while sequentially moving the cutout start position of the input character string 2 designated by the authentication start position designating means 3. The process of cutting out the character string of the input character string 2 for the specified number of characters was performed, but this may be in the reverse order. For example, while fixing the character string cutout start position specified by the authentication start position designating means 3 first, the number of cutout characters specified by the character number control unit 4 is sequentially increased, and when the cutout cannot be performed, the cutout start position is advanced next. It may be processed in the order of.

FIG. 4 shows a state of cutting out a character string when the number of cut-out characters is sequentially increased while fixing the cut-out start position.
In reference numerals 200a to 200c in FIG. 4, the first character to be cut out is the first character, and the number of cutout characters is increased by one character in order from the three characters predetermined as the minimum number of characters for password use. There is. The state in which the number of cut-out characters is the same as the length of the input character string 2 is represented by the figure indicated by reference numeral 200c. After that, the first character designated by the authentication start position designating means 3 becomes the second character B, and the number of cut-out characters designated by the character number control unit 4 is increased in order from 3 characters.

In this case, the number of comparisons until the password character string "DEFG" appears as the authentication character string 7 is larger than in the case where the number of cutout characters is fixed first, but which method should be selected is a matter of system design. There is no difference in the results obtained regardless of which one is selected, and not only the two methods shown here, but also the configuration in which the input character string 2 is cut out in order from the back instead of the beginning. good. Further, by adding a limitation of, for example, an even number of characters or an odd number of characters of 3 or more to the password character string 102, the process of changing the number of characters is halved, and the time required for the authentication process can be reduced. Changing the number of characters or the order in which the limitation is applied here is a design matter and does not affect the essence of the present application.

Further, in the present application, the authentication device is disassembled and analyzed by a third party by storing the pre-registered password as a hash value instead of storing it as the registered password itself in the authentication device. As a result, it is possible to eliminate the security risk that the contents of the password are leaked.
It is also possible to save and compare this part as a normal character string instead of using a hash value. In this case, the security risk is higher than when the hash value is used, but the processing amount can be reduced accordingly. Therefore, when high-speed authentication processing is required, a method that does not use the hash value. It can also be.

In this embodiment, 3 characters are added as the preceding spoofing character string 101 before the password character string 102, and 5 characters are added as the additional spoofing character string 103 after the password character string 102. The password or the content is arbitrary, and the spoofed character string may be added only to either the preceding or the addition.
As authentication to various devices, when entering a password, the purpose is to prevent the password from being easily inferred even if it is stolen or observed by a third party, before or after the original password, or one of them. It is possible to enter an arbitrary character string that is not a component of the password, and it is possible to change the input timing of the original password.

Specifically, from the input character string input from the input device 1 that includes characters that are not components of the password, the position where authentication is started and the number of characters used for authentication are sequentially changed. The operation of cutting out the part used for authentication as an authentication character string is repeated over the entire input character string. With this configuration, a third party can be perceived to notify the user when to enter the password string while entering the input string containing characters that are not components of the password. It enables authentication without the need to use any means.

With this configuration, it is possible to make it difficult to guess which key input operation was used to input the password character string, even if a third party steals the input operation of the input character string. Also, even if the fingerprint on the keyboard provided on the authentication device is observed, the fingerprint will be attached to the key top that has nothing to do with the password character string, so it will be included in the password character string. Guessing the key used can be difficult.

In the authentication device, the specification for cutting out the authentication character string from the input character string is the authentication start position specifying means for designating the first character to be used as the authentication character string from the character string included in the input character string. It is determined by 3 and the character number control unit 4 that specifies the number of characters used for this authentication.
However, when the number of characters in the password is fixed, the designation for cutting out the authentication character string only needs to sequentially move the position by the authentication start position designating means 3 by a predetermined number of characters. Further, when the start position of the password is determined in the input character string, the specification for cutting out the authentication character string may be only by sequentially changing the number of characters by the character number control unit 4 by a predetermined number of characters.

Further, the character number control unit 4 can specify a character string to be cut out while sequentially increasing one character at a time from the predetermined minimum number of characters in the password to the number of characters in the input character string. Not limited to the specification method, any combination of characters that satisfy the conditions as a password may be specified in order from the character combinations that make up the input character string, and the objects to be cut out must be arranged in order. However, any method may be used as long as it is possible to extract discrete character strings from the input character string in a predetermined pattern and as a result specify them as continuous authentication character strings.

Embodiment 2.
Next, the authentication device according to the second embodiment of the present application will be described with reference to FIGS. 5 to 7.
FIG. 5 is a configuration diagram showing a configuration example of the authentication device according to the second embodiment, FIG. 6 is a diagram illustrating the operation of the authentication character string cutting unit of the authentication device in the second embodiment, and FIG. 7 is the third embodiment. It is a flowchart which shows the flow of the process of the authentication apparatus which concerns on.
The authentication device according to the second embodiment is used to steal by a third party by further mixing an arbitrary character by the user into an arbitrary position in the authentication character string 7 cut out by the authentication character string cutting unit 6. It shows an example of taking security risk measures by.

The configuration shown in FIG. 5 is obtained by adding a cutout pattern setting information unit 13 to the authentication character string cutout unit 6 in addition to the configuration of FIG. 1 shown in the first embodiment. The cutout pattern setting information unit 13 sets a pattern for deleting characters with a specific mask pattern specified in advance from the cut out authentication character string. Other configurations are the same as those in FIG. 1 of the first embodiment, and the same or corresponding parts are designated by the same reference numerals and the description thereof will be omitted.

This embodiment 2 is designated by the character number control unit 4 from the position designated by the authentication start position designating means 3 in the authentication character string cutting unit 6 in order from the input character string 2 as in the embodiment 1. After cutting out a character string corresponding to the number of characters, the cut out character string is further masked with a pattern set by the cutout pattern setting information unit 13.

In FIG. 6, "ABC" is used as the preceding spoofed character string 101, the password character string 102 is used as the original password character string "DEFG", and every other character is used as the spoofed character "H", "I", Enter "DHEIFJGK", which is a character string obtained as a result of adding "J" and "K", as the password character string 102. Further, an example in which an arbitrary character string "LMNO" of the user is input as the additional camouflage character string 103 is shown.

The content of the input character string 2 exemplified here is "ABCDHEIFJGKLMNO". The process of cutting out the authentication character string cutting unit 6 by the authentication start position designating means 3 and the character number control unit 4 corresponds to the authentication character string cutting process step S500 in the flowchart showing the flow of the process in FIG. 7. do.
In the flowchart of FIG. 7, the cutout pattern setting information mask processing step S501 is added to the flowchart shown in FIG. 3 of the first embodiment. Other configurations are the same as those in FIG. 3 of the first embodiment, and the same or corresponding parts are designated by the same reference numerals and the description thereof will be omitted.

The content of the processing of the cutout pattern setting information mask processing step S501 will be described with reference to FIG. FIG. 6 shows a case where the character string “DHEIFJGK” of the code 104 portion in FIG. 6 is cut out as an example of the authentication character string 7 cut out by the authentication character string cutting unit 6. This corresponds to the case where the value specified by the authentication start position specifying means 3 is 4 and the value specified by the character number control unit is 8 in the processing of the authentication character string cutting unit 6. This is the same as the password character string 102 input in FIG. 6, but the part used as the original password is "DEFG", and the character string "DHEIFJGK" input as the password character string 102 has Extra characters are inserted every other character.

Here, the mask processing is executed by using the pattern information set by the cutout pattern setting information unit 13, in the cutout pattern setting information mask processing step S501. In the cutout pattern setting information mask processing step S501, AND processing is performed with the mask pattern 130 preset in the cutout pattern setting information unit 13 and the content of the authentication character string 7 (reference numeral 104 part), and the original authentication is performed. Extract only the part used for. Here, in the content of the mask pattern 130 shown in FIG. 6 in the cutout pattern setting information unit 13, the part ○ indicates the part used as the original password, and the part × indicates the part masked and not used as the original password. .. This means that the first, third, fifth, and seventh characters of the authentication character string 7 are extracted, and the second, fourth, sixth, and eighth characters are not extracted. The result extracted by this process is the character string indicated by the reference numeral 202, and by removing the blank in the masked portion, the original authentication character string “DEFG” indicated by the reference numeral 203 is obtained as a result. Can be done.

The subsequent processing is the same as the content of the first embodiment, but it should be noted that the number of characters specified by the character number control unit 4 is input to the password character string 102 instead of the number of characters of the original password character string. The number of characters is 8 in this case, and in order to execute the mask processing in the cutout pattern setting information mask processing step S501, the number of characters specified by the character number control unit 4 is as shown in the first embodiment. It is a point that 8 characters are fixed, not something that changes to.

However, since the mask pattern 130 specified by the cutout pattern setting information unit 13 can be arbitrarily determined in advance according to the system configuration, it is an embodiment when all the characters are extracted with this as 4 characters. The configuration can be the same as that of 1.
Further, in the second embodiment, the content of the authentication character string 7 is masked in character units, but this may be performed in bit units. In that case, the mask processing may be performed in bit units. It is also possible to handle all the information specified by the authentication character string cutting unit 6, the authentication start position designating means 3, and the character number control unit 4 as bit units.

As described above, in the second embodiment, the password is stolen by configuring the password character string 102 so that an arbitrary random spoofed character can be input at an arbitrary position in addition to the original password. Even if a third party steals the user's password input multiple times, or even if the password character string is limited to, for example, four characters, four consecutive same key inputs Since it becomes impossible to find the part of, the effect of reducing the security risk can be obtained.

Embodiment 3.
Next, the authentication device according to the third embodiment of the present application will be described with reference to FIGS. 8 and 9.
FIG. 8 is a diagram showing a part of the configuration diagram of the authentication device according to the third embodiment, a diagram illustrating the operation of the character string cutting unit for authentication, and FIG. 9 shows a flow of processing of the authentication device according to the third embodiment. It is a flowchart diagram.
In the third embodiment, immediately before inputting the original password character string 102, a specific predetermined character string pattern is input to the portion corresponding to the end of the preceding spoofed character string 101. The character string pattern determined in advance is stored as pattern information in the cut-out preceding pattern information unit 14 shown in FIG. Other configurations are the same as those in FIG. 1 of the first embodiment, and the same or corresponding parts are designated by the same reference numerals and the description thereof will be omitted.

In the third embodiment, the cut-out preceding pattern information unit 14 holds a specific predetermined character string pattern "XXYZ" in the portion corresponding to the end of the preceding camouflaged character string 101. Therefore, the preceding camouflage character string 101 is "ABCXYZ".
The authentication character string cutting unit 6 sequentially searches for the pattern information "XXYZ" of the cutting leading pattern information unit 14 from the input character string 2, and the cutting leading pattern information "XXYZ" in the input character string 2 is used. The next character at the end of the pattern at the found position is extracted as the position where the authentication character string 7 is stored.

Until the pattern information "XXYZ" of the cut-out preceding pattern information unit 14 is found in the input character string 2, the value specified by the character number control unit 4 is the length of the character string of the cut-out preceding pattern information unit 14. By fixing the information as it is and increasing the authentication start position designating means 3 by 1 in order from the beginning of the input character string 2, a process of finding the cut-out preceding pattern information is performed.
The process of cutting out by the authentication character string cutting unit 6 corresponds to the authentication character string cutting process step S500 in the flowchart showing the flow of the process in FIG. 9.

In the flowchart of FIG. 9, the cut-out character string end confirmation step S511 is added from the cut-out preceding pattern information detection processing step S508 to the flowchart shown in FIG. 3 of the first embodiment. Other configurations are the same as those in FIG. 3 of the first embodiment, and the same or corresponding parts are designated by the same reference numerals and the description thereof will be omitted.

In FIG. 9, in the cut-out precedent pattern information detection processing step S508, the pattern information “XXYZ” held in the cut-out precedent pattern information unit 14 with respect to the authentication character string 7 cut out in the authentication character string cut-out process step S500. Performs processing to sequentially detect the character string of.
In the cutout pattern discovery step S509, when the character string cut out by the authentication character string cutout unit 6 matches the pattern information "XXYZ" held in the cutout preceding pattern information unit 14 (Yes), the password character string storage position Proceeding to the calculation processing step S510, at that time, the number of characters of the content of the cut-out preceding pattern information unit 14, that is, the position where 4 characters are added to the position designated by the authentication start position designating means 3, is the input character. It is calculated as the location (8th character) in the column 2 where the password character string 102 is stored.

Therefore, if the same pattern information content as that of the cut-out preceding pattern information unit 14 is found in the authentication character string 7 cut out by the authentication character string cutting unit 6, the process proceeds to the authentication character string cutting out designation processing step S505. After that, the authentication character string cutting unit 6 fixes the value of the authentication start position designating means 3 to the value calculated here (8th character), and then separately specifies the number of characters specified by the character number control unit 4. The authentication character string 7 is cut out by increasing the number of password character strings by 1 in order from the minimum number of characters, and the process proceeds to the hash value calculation process step S502. In the hash value calculation processing step S502, the input hash value 9 is the result of performing an operation using a predetermined hash value generation polynomial using the authentication character string 7 as an input value, as shown in the first embodiment. Is calculated.

In the next authentication information comparison processing step S503, the registered hash value held in the hash value storage unit 10 and the input hash value 9 calculated in the hash value calculation processing step S502 are sequentially compared, and it is confirmed whether they match. do. If the results of the hash value comparison show that they match, the result match output process step S506 is executed, and the authentication process ends.

If the results of the authentication information comparison processing step S503 do not match, the process proceeds to the input character string end confirmation step S504, and it is confirmed whether the processing has been completed for the cut out authentication character string 7. If the character string can still be cut out (No), the process returns to the authentication character string cutout designation process step S505, the number of characters specified by the character number control unit 4 is changed, and the authentication character string 7 is input from the input character string 2. break the ice.
In the input character string end confirmation step S504, when all the combinations that can be cut out are completed among the combinations of the number of characters specified by the character number control unit 4 (Yes), the result mismatch output processing step S507 is executed and authentication is performed. The process ends as a failure.

In the cutout pattern discovery step S509, when the character string cut out by the authentication character string cutout unit 6 does not match the pattern information "XXYZ" held in the cutout preceding pattern information unit 14 (No), the cutout character string The process proceeds to the end confirmation step S511.
If the character string can be further cut out in the cutout character string end confirmation step S511 (No), the process proceeds to the authentication character string cutout designation process step S505 to perform the next cutout character designation process.

In the authentication character string cutout designation process step S505, the position designated by the authentication start position designating means 3 is moved backward by one character as in the first embodiment, and when the movement of all the positions is completed, the position is moved backward. An instruction to sequentially change the number of characters specified by the character number control unit 4 is output to the authentication character string cutting unit 6. Then, the authentication character string cutting unit 6 cuts out the authentication character string 7 in the authentication character string cutting processing step S500.

With this configuration, by finding the same content as the password character string 102 in the input character string 2, the position where the password character string 102 is stored cannot be determined by the length of the password character string 102. Even in this case, it can be specified quickly, and the authentication process can be executed while fixing the position of the beginning of the password character string 102 and sequentially changing only the number of characters specified by the character number control unit 4 as the password character string. can.

In the third embodiment, the length of the character string of the preceding pattern information in the cut-out preceding pattern information unit 14 is set to 4, but this can be set to any length. Furthermore, if it is configured so that it can be specified as wildcard information that any character may be used as the character string of the cut-out preceding pattern information, and the preceding impersonation character string is only this wildcard, this is the input character string 2. The portion advanced by the length set as the cut-out preceding pattern character string from the beginning of is always designated as the authentication character string 7. That is, it can be considered that only the number of characters from the beginning of the input character string 2 until the password character string 102 is started is specified.

As a method of designating the start position of the part for cutting out the authentication character string from the input character string 2, the authentication start position specifying means 3 inputs to the input device 1 regardless of the content of the input character string 2. From the start of inputting the character string, the position after inputting the number of characters specified in advance is specified as the position to cut out the authentication character string 7 used for authentication. In this case, the position designation by the authentication start position designation means 3 is fixed, and it is not necessary to move them sequentially.

Embodiment 4.
Next, the authentication device according to the fourth embodiment of the present application will be described with reference to FIGS. 10 and 11.
10 is a configuration diagram showing the configuration of the authentication device according to the fourth embodiment, and FIG. 11 is a diagram showing an example of an input device used for the authentication device according to the fourth embodiment.
In FIG. 10, the input device 1 for inputting the input character string 2 is a pattern graphic display unit 16 in which a plurality of dots are displayed on the screen of the touch panel unit 15, and a plurality of input devices 1 displayed on the pattern graphic display unit 16. It is provided with an input value conversion unit 17 that inputs a pattern by touching a dot and converts the position of a dot through which the pattern is passed as a different character. Other configurations are the same as those in FIG. 5 of the second embodiment, and the same or corresponding parts are designated by the same reference numerals and the description thereof will be omitted.

As shown in FIG. 11, as the input device 1, instead of inputting characters with a keyboard, a touch panel is placed on a plurality of dots displayed on the screen of the touch panel unit 15 of the pattern graphic display unit 16 arranged on the input device. Enter using the touch method such as tracing with your finger from above.
The user uses the touch panel unit 15 arranged on the screen to input a character string on a screen in which a plurality of dots are displayed as a passing point for inputting a pattern corresponding to a predetermined password. Enter 2.

In FIG. 11, which shows an example of an input screen in which the user specifies an input value while tracing with a finger or the like, nine dots (dots) are displayed on the screen, and the user can use the nine dots. As a pattern figure determined in advance by a person, among these points, the predetermined points are specified in the order determined in advance by tracing the input value with a finger or the like as shown in the input locus 600.

When input is performed as in the input locus 600, the input value conversion unit 17 converts the points passed by the input locus 600 as uniquely identifiable values, and the numerical values are input in the order in which each passes. It is supposed to be. In the example of FIG. 11, the numerical values 1, 2, 6, and 9 corresponding to the password character string 102 are sequentially input by the user in the order of the points through which the input locus 600 has passed, as shown in the pattern input result 601. And convert.

The input of the preceding spoofed character string 101 before the password character string and the additional spoofed character string 103 after the password character string is arbitrarily fingered on the plurality of dots displayed on the screen of the touch panel unit 15 from above the touch panel. It is done by tracing with.
Subsequent processing is the same as the processing shown in the first embodiment, as compared with the case where a normal numeric keypad or keyboard is arranged on the input device 1 and a password is input using the ten-key or keyboard. It is possible to prevent the security risk caused by the wear of only the key or the fingerprint attached to only a specific key.

In the case of the fourth embodiment, as an overall configuration, the pattern graphic display unit 16 including the input device 1 and having the touch panel unit 15 instead of the keyboard or the numeric keypad (not shown in FIG. 1) is shown in FIG. It is different from the first embodiment in that the content of the input character string 2 is set via the input value conversion unit 17 which is added to the content and is converted from the input pattern of the touch panel unit 15 to the input character string.

Here, the input character string input from the input device 1 is not only the character string input from the keyboard or the ten keys, but also a specific figure such as a dot pattern is displayed on the display screen provided on the input device. For the route information obtained by tracing a specific part of the dot pattern displayed on the display screen in a specific order for a touch panel configured for touch input on the display screen. , Each passing point passed on the route is converted into a uniquely identifiable character string, and the combined one is used as an input character string.

It should be noted that the configuration according to each of the embodiments described so far can be applied to the fourth embodiment, and further, the display content for inputting the pattern figure described here is input by the user. It suffices if the point to be specified can be specified, and the display is not limited to nine points, and the length of the character string that can be input is also for impersonation before and after the pattern input corresponding to the password character string as in the previous embodiments. A pattern input can also be added. Also, if a specific pattern can be input as a specific password preceding pattern immediately before the password character string start position, and the point that has passed the value to be converted by the input value conversion unit 17 can be specified, what if? Techniques can also be used.

The present disclosure describes various exemplary embodiments and examples, although the various features, embodiments, and functions described in one or more embodiments are those of a particular embodiment. It is not limited to application, but can be applied to embodiments alone or in various combinations.
Therefore, innumerable variations not exemplified are envisioned within the scope of the techniques disclosed in the present application. For example, it is assumed that at least one component is modified, added or omitted, and further, at least one component is extracted and combined with the components of other embodiments.

The authentication device according to the present application can be configured by software, and is not only an authentication device equipped with a physical numeric keypad or keyboard, but also a numeric keypad or a numeric keypad displayed on a screen in a mobile device such as a personal computer or a smartphone. It can be introduced in a wide range of devices such as authentication means using other pattern recognition and the like.

1: Input device, 2: Input character string, 3: Authentication start position designation means, 4: Character number control unit,
5: Authentication character string cutout designation processing unit, 6: Authentication character string cutout unit,
7: Authentication character string, 8: Hash value calculation means, 9: Input hash value,
10: Hash value storage unit, 11: Authentication information comparison means, 12: Authentication result holding unit,
13: Cutout pattern setting information unit, 14: Cutout precedent pattern information unit,
15: Touch panel unit, 16: Pattern graphic display unit, 17: Input value conversion unit,
101: preceding spoofing character string, 102: password character string, 103: additional spoofing character string.

Claims (8)

An authentication start position specifying means for designating a position to be used for authentication among an input device, a password input from the input device, and an input character string consisting of spoofed characters input before or after the password, and the input character. Among the columns, a character number control unit that specifies the number of characters to be used for authentication, a position specified by the authentication start position designating means from the input character string, and a character string for authentication based on the number of characters specified by the character number control unit. A hash value calculation means for calculating an input hash value from an authentication character string cutting unit to be cut out, an authentication character string cut out by the authentication character string cutting unit, and a registered hash value generated from a password registered in advance. The hash value storage unit that stores the data, and the authentication information comparison means that confirms whether or not the input hash value calculated by the hash value calculation means matches the registered hash value stored in the hash value storage unit. Equipped with
When the comparison result by the authentication information comparison means does not match, the position designated by the authentication start position specifying means is sequentially moved by a predetermined number of characters, or the number of characters specified by the character number control unit is sequentially moved by a predetermined number of characters. An authentication device characterized by changing, cutting out the authentication character string, and repeating whether or not the input hash value matches the registered hash value by the authentication information comparison means. The authentication device according to claim 1, wherein the number of characters corresponding to the password in the input character string is 3 or more. It is equipped with a cutout pattern setting information unit that sets a pattern for deleting characters with a specific mask pattern specified in advance from the authentication character string.
The authentication character string cutting unit cuts out a password character string in which a predetermined character is mixed as a spoofed character at a predetermined position of the password as an authentication character string, and cuts out the cutout pattern setting information from the cut out authentication character string. The authentication device according to claim 1 or 2, wherein the spoofed character is deleted by the mask pattern specified by the unit to extract the original authentication character string. The authentication device according to claim 3, wherein the number of characters specified by the character number control unit is the same as the number of characters in the password character string. The claim is characterized in that the authentication start position designating means designates a position after inputting a predetermined number of characters from the input start of the input character string as a start position for cutting out an authentication character string used for authentication. The authentication device according to any one of claims 1 to 4. It is provided with a cut-out precedent pattern information unit that holds the character string input at the end of the preceding impersonation character string entered before the password as the cut-out preceding pattern information.
When the character string cut out as the authentication character string matches the cutout precedent pattern information, the authentication character string cutout unit has the number of characters of the cutout precedent pattern information at a position designated by the authentication start position designating means. The authentication device according to any one of claims 1 to 4, wherein the position obtained by adding the above is specified as the beginning of the password character string. The input device inputs a pattern by touching a pattern graphic display unit in which a plurality of dots are displayed on the screen of the touch panel unit and a plurality of dots displayed in the pattern graphic display unit, and the pattern passes through. One of claims 1 to 6, wherein the input value conversion means for converting the positions of the dots as different characters is provided, and the character string converted by the input value conversion means is used as the input character string. The authentication device described in the section. For authentication, the start position used for authentication or the number of characters used for authentication is specified from the input character string consisting of the password input from the input device and the spoofed characters input before or after the password, and the authentication character string is cut out. The character string cutout processing step, the hash value calculation processing step for calculating the input hash value from the authentication character string cut out in the authentication character string cutting processing step, and the input hash value calculated by the hash value calculation processing step are , Equipped with an authentication information comparison processing step to check whether it matches the registered hash value generated from the pre-registered password.
When the comparison result by the authentication information comparison processing step does not match, the start position used for the authentication is sequentially moved by a predetermined number of characters, or the number of characters used for the authentication is sequentially changed by a predetermined number of characters. An authentication method characterized in that the authentication character string is cut out, and whether or not the input hash value matches the registered hash value is repeated by the authentication information comparison processing step.

Images