JPH04258049A - Individual identification system - Google Patents

Abstract

PURPOSE:To attain individual identification with high safety without increasing the burden of the user by providing a means verifying the user of a device to be a correct user in parallel with the system in addition to an individual identification deputy device. CONSTITUTION:The user of an information processing unit 3 connects at first an ownership warrant device 1 and an individual identification deputy device 2 to start each processing section. A management section of both the devices communicates mutually information registered to them and sets the right of use based on the result of ownership discrimination processing. That is, when the information stored in an ownership warrant information storage section 101 of the ownership warrant device 1 and the information stored in an ownership discrimination information storage section 201 of the person identification deputy device 2 are coincident, an ownership discrimination processing section 202 sets use permission/reject information of the individual identification deputy device 2 to a device use right information setting section 205.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a personal identification method for guaranteeing the legitimacy of an accessing person in an information system in which the authenticity of the accessing person must be confirmed.

0002

2. Description of the Related Art Conventionally, a typical method for verifying the legitimacy of a person accessing an information system has been to have the individual input a memorized password. Since this method uses personal memory information as the PIN number, using a large number of digits causes problems with memory ability and operability, and using a small number of digits causes problems with security in terms of PIN number theft. . As a method to solve the above problem, I
The most likely method is to use C cards. In this method, a required capacity of information corresponding to a personal identification number is stored in an IC card, and this information is used to enable the IC card to perform a personal identification proxy function. That is, in this method,
Since it can utilize not only the storage function of an IC card but also the information processing and information input/output functions, it is possible to apply the latest cryptographic authentication technology, such as peer authentication such as zero-knowledge proof method, which is known in the field of cryptographic authentication. .

0003

[Problem to be solved by the invention] However, even in the above-mentioned method of using an IC card, a new problem is solved in that even if the IC card is stolen by another person, the personal identification agency function is automatically executed. In order to solve this problem, it is necessary to ensure that the IC card is being used by its legitimate owner. If, for example, a method of inputting a password is used, the user will end up returning to the first problem. The present invention has been made in view of the above circumstances, and its purpose is to solve the above-mentioned problems in the conventional technology and to perform highly secure personal identification without increasing the burden on users. The purpose of the present invention is to provide a personal identification method that can be used to identify individuals.

0004

[Means for Solving the Problems] The above object of the present invention is a personal identification system that uses a personal identification agent device owned by a specific individual to confirm the legitimacy of a person accessing an information processing device, etc. , comprising an owner guarantee device for guaranteeing the legitimacy of the user of the personal identification agent device, a means for storing ownership guarantee information in the owner guarantee device, and a means for storing ownership determination information in the personal identification agent device. A storage means and a means for determining whether the information in both the means match are provided, and when the determining means determines that the information in both the means match, the user of the personal identification agency device is authenticated. This is achieved through a personal identification method that is characterized by confirming the person's gender. Note that the information in both of the above-mentioned means also includes encryption key information.

[0005]

[Operation] In the personal identification system according to the present invention, in addition to the conventional personal identification agent device, a means for ensuring that the user of the personal identification agent device is a legitimate user is introduced. , these are used in parallel to identify individuals, so there is no increase in the burden on users.
This makes it possible to perform highly secure personal identification.

[0006]

Embodiments Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIGS. 2A and 2B (hereinafter collectively referred to as "FIG. 2") are block diagrams showing the configuration of a personal identification system that is an embodiment of the present invention. In the figure, 1 is an ownership guarantee device, 2 is a personal identification agency device, and 3 is an information processing device. In the personal identification system according to this embodiment, when an individual who has a legitimate right to use the information processing device 3 attempts to use the information processing device 3, the ownership guarantee device 1
, the personal identification proxy device 2 is used to make the information processing device 3 confirm that it is the authorized accessor. The ownership guarantee device 1 described above includes a management section 100, an ownership guarantee information storage section 101, and an ownership guarantee processing section 102.
, a communication processing section 103, and the personal identification agency device 2 includes a management section 200, an ownership determination information storage section 201, an ownership determination processing section 202, a communication processing section 203, and a device usage right information setting section. 205, personal identification information storage unit 206 and personal identification support processing unit 207, the information processing device 3 includes a management unit 300, personal identification information storage unit 301, personal identification processing unit 302, communication processing unit 303, personal access right information setting 305. Note that the ownership guarantee device 1 herein may be, for example, an accessory such as a watch, a tie pin, a ring, etc., in which information to be described later is stored in the accessory. Further, as the personal identification agency device 2, an IC card can be used. The connection between the ownership guarantee device 1 and the personal identification agency device 2 is as follows.
This may be done electrically, optically, or electromagnetically.

[0007] A user of the information processing device 3 first connects the ownership guarantee device 1 and the personal identification agent device 2 and starts each processing section. The management units 100 and 200 of each of the ownership guarantee device 1 and the personal identification agency device 2 communicate with each other through their communication processing units 103 and 203, the ownership guarantee information storage unit 101 and the ownership determination information storage unit 201, respectively. The ownership guarantee processing unit 102 mutually exchanges information registered in the
, ownership determination processing unit 202 is executed, and the usage right is set in the device usage right information setting unit 205 based on the ownership determination processing result. FIG. 1 shows that information C1 stored in the ownership guarantee information storage unit 101 of the ownership guarantee device 1 described above matches information C2 stored in the ownership determination information storage unit 201 of the personal identification agency device 2. If you do,
An example of information exchange when setting device usage permission/denial information (Y/N) in the device usage right information setting section 205 is shown. In this case, the process in the ownership guarantee processing unit 102 of the ownership guarantee device 1 described above is unnecessary, and the ownership determination processing unit 202 of the personal identification agent device 2 processes the ownership guarantee information storage unit 101 of the ownership guarantee device 1. From, communication processing unit 10
3. The information C1 received via the communication processing unit 203 of the personal identification proxy device 2 is compared with the information C2 stored in the ownership determination information storage unit 201 of the personal identification proxy device 2, and a match is determined. Depending on whether or not to do so, usage permission/denial information (Y/N) for the personal identification proxy device 2 is set in the device usage right information setting unit 205.

FIG. 3 shows the encryption key information K stored in the ownership guarantee information storage section 101 of the ownership guarantee device 1 described above.
1 and an ownership determination information storage section 2 of the personal identification agency device 2
An example of information exchange is shown in which device usage permission/rejection information (Y/N) is set in the device usage right information setting section 205 when the encryption key information K2 stored in 01 matches. In this case, first, a random number R generated by the random number generation function of the ownership determination processing section 202 of the personal identification agency device 2 is transmitted to the ownership guarantee device 1 via the communication processing section 203. The ownership guarantee processing unit 102 of the ownership guarantee device 1 encrypts the random number R received via the communication processing unit 103 using the encryption key information K1 stored in the ownership guarantee information storage unit 101 to generate information. Communication processing unit 10
3 to the personal identification agency device 2. The ownership determination processing unit 202 of the personal identification agency device 2 is a communication processing unit
203 and R'' obtained by encrypting the aforementioned random number R using the encryption key information K2 stored in its own ownership determination information storage unit 201. At this time, R' It is determined whether the above-mentioned encryption key information K1 and K2 match based on whether or not the above-mentioned encryption key information K1 and K2 match, and the device usage permission/rejection information (Y
/N). In the process shown in FIG. 3, the ownership guarantee processing unit 102 of the ownership guarantee device 1 encrypts the random number R sent from the personal identification agency device 2 with the encryption key information K1, and generates R''. In addition, the ownership determination processing unit 202 of the personal identification agency device 2 uses the random number R described above.
, the process of encrypting the random number R using the encryption key information K2 to generate R'', and comparing R' and R'', and depending on the result, the above-mentioned device usage permission/rejection information (Y
/N).

Through the process shown in FIG. 1 or 3, it is confirmed that the personal identification agency device 2 is being used by a legitimate owner, based on the device usage permission/rejection information set in the device usage right information setting section 205 ( Once confirmed by Y/N),
Personal identification processing is automatically performed between the personal identification proxy device 2 and the information processing device 3 in the following procedure. First, the personal identification agency device 2 and the information processing device 3 are connected, and each processing section is activated. The respective management units 200 and 300 of the personal identification agency device 2 and the information processing device 3 activate the communication processing units 208 and 303, and mutually exchange the information registered in the personal identification information storage unit 206 and the personal determination information storage unit 301. The personal identification processing unit 207 and the personal identification processing unit 302 execute the processing, and the personal identification processing result is set in the personal access right information setting unit 305. The above-described series of steps completes the personal identification process when accessing the information processing device 3. According to the above embodiment, since a PIN number based on personal memory information is not used, the user is freed from the trouble of memorizing it, and there is an advantage that the operation becomes easier, such as eliminating the need for inputting the PIN number. . It should be noted that the above-mentioned embodiment shows an example of the present invention, and it goes without saying that the present invention should not be limited thereto. For example, the ownership guarantee device 1 is not limited to the above-mentioned accessories such as watches, tie pins, rings, etc., but other applied forms can be used. The same applies to the personal identification agency device 2. Furthermore, the connection between the ownership guarantee device 1 and the personal identification agent device 2 may be made by a method other than electrical, optical, or electromagnetic.

0010

[Effects of the Invention] As explained in detail above, according to the present invention, it is possible to realize a personal identification method that can perform highly secure personal identification without increasing the burden on the user. It is effective.

[0011]

[Brief explanation of the drawing]

FIG. 1 is a diagram showing an example of processing based on information stored in an ownership guarantee device 1 and a personal identification proxy device 2 in a personal identification system that is an embodiment of the present invention.

FIG. 2A is a part of a block diagram showing the configuration of a personal identification system according to an embodiment.

FIG. 2B is another part of a block diagram showing the configuration of the personal identification system of the embodiment.

FIG. 3 is a diagram showing an example of processing based on stored encryption key information of the ownership guarantee device 1 and the personal identification agent device 2 in the personal identification system of the embodiment.

[Explanation of symbols]

1: Ownership guarantee device, 2: Personal identification agent device, 3: Information processing device, 100, 200 and 300: Management department, 10
1: Ownership guarantee information storage unit, 102: Ownership guarantee processing unit, 103, 203, 208 and 303: Communication processing unit,
201: Ownership determination information storage unit, 202: Ownership determination processing unit, 205: Device usage right information setting unit, 206: Personal identification information storage unit, 207: Personal identification support processing unit, 301:
Personal identification information storage unit, 302: Personal identification processing unit, 303
: Communication processing section, 305: Personal access right information setting section.

Claims (2)

[Claims] Claim 1. A personal identification system that uses a personal identification agent device owned by a specific individual to verify the legitimacy of a person accessing an information processing device, etc. means for storing ownership guarantee information in the owner guarantee device; means for storing ownership determination information in the personal identification agency device; Personal identification characterized by providing a means for determining whether the information matches, and confirming the legitimacy of the user of the personal identification agency device when the determining means determines that the information in both of the means matches. method. 2. A personal identification system that uses a personal identification agent device owned by a specific individual to verify the legitimacy of a person accessing an information processing device, etc. means for storing first encryption key information in the owner guarantee device; means for storing second encryption key information in the personal identification agency device; A means is provided for determining whether the encryption key information in both means matches through random number encryption, and when the determining means determines that the information in both means matches, the personal identification agency device is used. A personal identification method characterized by confirming the authenticity of a person.