JPH1125047A - Authentication system and its method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system capable of preventing reliability and security for user's authentication from being lost. SOLUTION: An authentication card 101 inherently allocated to each user and having a response means for outputting a response signal corresponding to each of plural different input signals and a terminal 102 for connecting the card 101 to a communication enterprise 104 are used for the authentication system. At the time of executing certification authentication, the enterprise 104 transmits a authentication check signal to the card 101 through the terminal 102 and a card reader interface 103 in accordance with a connection request from the terminal 102. The card 101 returns a response signal corresponding to the authentication check signal to the enterprise 104. The enterprise 104 receiving the response signal from the card 101 authenticates the user by collating the transmitted authentication check signal with the returned response signal.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication system and a method for authenticating a user who uses a communication line by a connection service to the communication line provided by a communication carrier.

[0002]

2. Description of the Related Art Generally, an encryption key system for encrypting and transferring information is widely used for authentication of a user who uses a communication line by a connection service for the communication line provided by a communication carrier. This encryption key method includes DES,
There are a secret key method such as FEAL, RC-2 / RC-4 / RC-5, and an RSA public key method. In addition, SSL that performs encryption at a specific layer of a communication protocol is widely known.

In addition to this encryption key system, an authentication method using a response system for transmitting a specific signal or a random number required for authentication from an authentication card or the like has been proposed.

[0004]

However, in the authentication method using the encryption key system or the response system described above, encrypted information indicating information necessary for authentication or specific information is intercepted by a third party during communication. In this case, there is a possibility that the encrypted information or specific information intercepted by the third party may be decrypted, and the abuse of the third party may not be able to properly authenticate the user. There is a risk that the reliability and security of the authentication of the user will be impaired.

It is an object of the present invention to provide an authentication system and an authentication method in which the reliability and security of user authentication are not impaired.

[0006]

According to the first aspect of the present invention,
In an authentication system for authenticating a user who uses a communication line by a connection service to a communication line provided by a communication carrier, a response signal uniquely assigned to the user and corresponding to each of a plurality of different input signals An authentication object having response means for outputting the authentication object, and an interface means for connecting the authentication object with the communication carrier, and transmitting an authentication confirmation signal from the communication carrier via the interface means to the authentication object. And transmits a response signal corresponding to the authentication confirmation signal from the object to be authenticated to the communication carrier via the interface means, and the communication carrier transmits the transmitted authentication confirmation signal and the The authentication of the user is performed by comparing the returned response signal with the response signal.

According to a second aspect of the present invention, in the authentication system according to the first aspect, the response means for the object to be authenticated includes a conversion table for converting a plurality of different input signals into corresponding response signals for each of a plurality of different input signals. The communication carrier has the same conversion table as the conversion table, and refers to the conversion table to perform a comparison between the transmitted authentication confirmation signal and the returned response signal. .

According to a third aspect of the present invention, in the authentication system according to the first aspect, the interface means comprises an information processing device for controlling transmission and reception of signals between the object to be authenticated and the communication carrier. Features.

According to a fourth aspect of the present invention, there is provided an authentication method for authenticating a user who uses a communication line by a connection service to the communication line provided by a communication carrier. A connection is made between the object to be authenticated having a response means for outputting a response signal corresponding to each of a plurality of input signals and the communication carrier via the interface means, and authentication is performed from the communication carrier via the interface means. A confirmation signal is transmitted as an input signal to the object to be authenticated, and a response signal corresponding to the authentication confirmation signal is returned from the object to be authenticated to the communication carrier via the interface means. The authentication of the user is performed by comparing the transmitted authentication confirmation signal with the returned response signal.

According to a fifth aspect of the present invention, in the authentication method according to the fourth aspect, the response means for the object to be authenticated includes a conversion table for converting a plurality of different input signals into corresponding response signals. The communication carrier has the same conversion table as the conversion table, and refers to the conversion table to perform a comparison between the transmitted authentication confirmation signal and the returned response signal. .

[0011]

Embodiments of the present invention will be described below with reference to the drawings.

(First Embodiment) FIG. 1 is a schematic diagram showing the configuration of an authentication system according to a first embodiment of the present invention, and FIG. 2 is a conceptual diagram of an authentication card used in the authentication system of FIG.

As shown in FIG. 1, the authentication system authenticates a user who uses the public line 106 by a connection service to the public line 106 provided by the communication carrier 104. Authentication card 10 having a response means uniquely assigned to a user and outputting a response signal corresponding to each of a plurality of different input signals
1 and a personal computer (hereinafter referred to as a terminal) for connecting between the authentication card 101 and the communication carrier 104.
102 are used.

The authentication card 101 is, as shown in FIG.
A conversion table 203 for converting each of a plurality of different input signals into a corresponding response signal is built in. When a signal is input from the input port 201, the conversion table 203 is referred to and the input signal is handled. A response signal is output.

A terminal 102 has a card reader interface 103 for controlling an interface with the authentication card 101.
Are connected, and the terminal 102 is connected to a communication carrier 104 via a communication line 105.

[0016] When the user operates the communication carrier 104 from the terminal 102,
When communication is performed via the communication line 105 with respect to
First, the authentication card 101 is attached to the card reader interface 103, and a connection request is made from the terminal 102 to the communication carrier 104. Upon receiving the connection request from the terminal 102, the communication carrier 104 sends an authentication confirmation signal to the communication line 1.
05, terminal 102 and card reader interface 1
03 to the authentication card 101. As the authentication confirmation signal, a different signal is used within the range that the authentication card 101 can handle each time the same user is authenticated.

Upon receiving the authentication confirmation signal, the authentication card 101 refers to the conversion table 203 and sends a response signal corresponding to the authentication confirmation signal to the card reader interface 10.
3. Reply to the communication carrier 104 via the terminal 102 and the communication line 105.

The communication carrier 104 that has received the response signal from the authentication card 101 authenticates the user by comparing the transmitted authentication confirmation signal with the returned response signal. Specifically, the communication carrier 104 is the authentication card 101
Has the same conversion table as the conversion table built in,
By referring to the conversion table, the transmitted authentication confirmation signal is compared with the returned response signal, and based on the result of the comparison, it is confirmed that the response signal is from the authentication card 101 unique to the user who made the connection request. Then, connection to the public line 106 is permitted.

Next, the authentication procedure in the present embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing an authentication procedure in the authentication system of FIG.

Referring to FIG. 3, first, the user terminal 1
When a communication request is issued from 02 to the communication carrier 104 (step S301), the communication carrier 104 determines whether or not authentication is necessary (step S302). Is permitted, and the user starts communication using the terminal 102 (step S309).

If it is determined that authentication is necessary, an authentication confirmation signal is transmitted from the communication carrier 104 to the authentication card 101 via the communication line 105, the terminal 102 and the card reader interface 103 (step S30).
3). The transmitted authentication confirmation signal is transmitted to the authentication card 101
(Step S304), a response signal corresponding to the authentication confirmation signal is output from the authentication card 101 (step S305), and the output response signal is transmitted to the card reader interface 103, the terminal 102, and the communication line 105. A reply is sent back to the communication carrier 104 via the network (step S306).

The communication carrier 104 that has received the response signal from the authentication card 101 collates the transmitted authentication confirmation signal with the returned response signal (step S307), and uses the connection request based on the result of the collation. If it is not confirmed that the response signal is from the authentication card 101 unique to the user, the connection to the public line 106 is not permitted, and the user cannot perform communication (step S310). On the other hand, if it is confirmed from the result of the collation that the response signal is from the authentication card 101 unique to the user who made the connection request, the communication carrier 104 transmits a use permission signal to the terminal 102 ( Step S308), public line 10
6 is permitted, and the user starts communication using the terminal 102 (step S309).

As described above, at the time of performing authentication, an authentication confirmation signal is transmitted from the communication carrier 104 to the authentication card 101,
A response signal corresponding to the authentication confirmation signal is returned from the authentication card 101 to the communication carrier 104, and the communication carrier 104 compares the transmitted authentication confirmation signal with the returned response signal to check the user's response. Authenticate,
Unless a third party acquires and misuses the authentication card 101,
The third party does not impersonate the user and is not authenticated.
Further, since a different signal is used as the authentication confirmation signal within a range that can be handled by the authentication card 101 each time the same user is authenticated, even if the communication content is intercepted and decoded by a third party, The decryption result of the intercepted communication content cannot be used in the next authentication, and the third party does not impersonate the user and is not authenticated. Therefore, there is no possibility that the reliability and security of the user authentication are impaired.

The communication carrier 104 and the authentication card 10
Since authentication is performed by transmitting and receiving a signal to and from the terminal 1 via the terminal 102 or the like, the authentication can be completed in a short time.

Further, since the communication carrier 104 that provides the connection service to the public line 106 performs the authentication, there is no need to make a new contract with the third organization that performs the authentication.
The procedure involved in authentication does not change much.

(Second Embodiment) Next, a second embodiment of the present invention will be described with reference to FIG. FIG. 4 is a flowchart showing an authentication procedure in the second embodiment of the authentication system of the present invention.

This embodiment differs from the first embodiment in that a process of adding a communication connection fee to a communication line fee for a user who is permitted to connect to the public line 106 is added. .

Specifically, as shown in FIG. 4, when a communication request is issued from the user's terminal 102 to the communication carrier 104 (step S401), whether or not authentication is required or the result of the authentication is performed on the public line. The connection to the terminal 106 is permitted, and the user starts communication using the terminal 102 (step S
409) or connection to the public line 106 is not permitted (step S410). Note that the procedure so far is the same as that of the first embodiment described above, and a description thereof will be omitted.

Next, after the connection to the public line 106 is permitted and the user starts communication using the terminal 102 (step S409), the communication line usage fee for the user permitted to connect to the public line 106 is received. Is performed (step S411).

As described above, communication charges can be collected as communication line usage charges.

(Third Embodiment) Next, a third embodiment of the present invention will be described with reference to FIGS. FIGS. 5 and 6 are flowcharts showing an authentication procedure in the third embodiment of the authentication system of the present invention.

The present embodiment is different from the first embodiment in that a function that allows a user to make a money settlement with a money settlement company via the communication carrier 104 is added.

More specifically, as shown in FIG. 5, when a communication request is issued from the user's terminal 102 to the communication carrier 104 (step S501), a public line is determined based on whether authentication is required or not, or as a result of the authentication. The connection to the terminal 106 is permitted, and the user starts communication using the terminal 102 (step S
509) or connection to the public line 106 is not permitted (step S510). Note that the procedure so far is the same as that of the first embodiment described above, and a description thereof will be omitted.

As shown in FIG. 6, after the connection to the public line 106 is permitted and the user starts communication using the terminal 102 (step S509), a monetary settlement occurs due to the purchase of an article or the like, and Public line 1 via terminal 102
When the money settlement request signal is transmitted to the money settlement company on the public line 06 (step S511), the money settlement company transmits the public line 1
The authentication signal of the user is transmitted to the communication carrier 104 via 06 (step S512), and the communication carrier 104 receives the authentication signal of the user (step S513).

Next, the communication carrier 104 checks whether or not the received user authentication signal is a signal indicating a user whose authentication has been confirmed (step S514), and the received user authentication signal confirms the authentication. If the signal indicates that the user has already been authenticated, an authentication confirmation signal is transmitted from the communication carrier 104 to the money settlement company (step S515), and the money settlement company receiving the authentication confirmation signal transmits the money settlement confirmation signal to the user. The message is transmitted to the terminal 102 (step S516). On the other hand, when it is not possible to confirm that the received user authentication signal is a signal indicating the user whose authentication has been confirmed, the communication carrier 104 transmits an authentication confirmation failure signal to the money settlement company (step S517), the money settlement company which has received the authentication confirmation failure signal transmits a money settlement failure signal to the user terminal 102 (step S518).

As described above, the money settlement company can perform online money settlement with a user whose authentication has already been confirmed by the communication carrier 104, and can execute the money settlement through a third organization such as a credit company. There is no need to authenticate.

[0037]

As described above, according to the authentication system of the first aspect, the user is uniquely assigned to the user,
An authenticated object having a response means for outputting a response signal corresponding to each of a plurality of different input signals, and an interface means for connecting the authenticated object and a communication carrier,
The communication carrier transmits an authentication confirmation signal as an input signal to the object to be authenticated via the interface means, and a response signal corresponding to the authentication confirmation signal is returned from the object to the communication carrier via the interface means, and the communication Since the business operator authenticates the user by comparing the transmitted authentication confirmation signal with the returned response signal, there is no risk that the reliability and security of the user authentication will be impaired.

According to the authentication system of the second aspect, the response means of the object to be authenticated has a conversion table for converting a plurality of different input signals into corresponding response signals for each of a plurality of different input signals. It can be configured to have the same conversion table as the conversion table, and to collate the authentication confirmation signal transmitted with reference to the conversion table with the returned response signal.

According to the authentication system of the third aspect, the interface means can be constituted by an information processing device for controlling transmission and reception of signals between the object to be authenticated and the communication carrier.

According to the authentication method of the fourth aspect, the authentication object is uniquely assigned to the user and has a response means for outputting a response signal corresponding to each of a plurality of different input signals. Are connected through an interface means, an authentication confirmation signal is transmitted as an input signal to the object to be authenticated from the carrier through the interface means, and a response signal corresponding to the authentication confirmation signal is transmitted from the object to the interface means. Authenticating the user by comparing the authentication confirmation signal transmitted by the telecommunications carrier with the returned response signal, the reliability and security of the authentication of the user are impaired. There is no fear of being caught.

According to the authentication method of the fifth aspect, the response means for the object to be authenticated has a conversion table for converting a plurality of different input signals into corresponding response signals,
The carrier has the same conversion table as the conversion table,
With reference to the conversion table, the transmitted authentication confirmation signal can be compared with the returned response signal.

[Brief description of the drawings]

FIG. 1 is a schematic diagram showing a configuration of a first embodiment of an authentication system of the present invention.

FIG. 2 is a conceptual diagram of an authentication card used in the authentication system of FIG.

FIG. 3 is a flowchart showing an authentication procedure in the authentication system of FIG. 1;

FIG. 4 is a flowchart showing an authentication procedure in a second embodiment of the authentication system of the present invention.

FIG. 5 is a flowchart showing an authentication procedure in a third embodiment of the authentication system of the present invention.

FIG. 6 is a flowchart showing an authentication procedure in an authentication system according to a third embodiment of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 101 Authentication card (authentication object) 102 Terminal 103 Card reader interface 104 Telecommunications carrier 105 Communication line 106 Public line

──────────────────────────────────────────────────の Continued on the front page (51) Int.Cl. ⁶ Identification code FI H04L 9/00 673A

Claims (5)

[Claims] 1. An authentication system for authenticating a user who uses a communication line by a connection service to the communication line provided by a communication carrier, wherein each of a plurality of different input signals uniquely assigned to the user is provided. An authentication target having response means for outputting a response signal corresponding thereto, and interface means for connecting the authentication target and the communication carrier are provided, and an authentication confirmation signal is transmitted from the communication carrier via the interface means. Is transmitted as an input signal to the authenticated object, and a response signal corresponding to the authentication confirmation signal is returned from the authenticated object to the communication carrier through the interface means, and the communication carrier transmits the response signal. An authentication system, wherein the user is authenticated by comparing an authentication confirmation signal with the returned response signal. 2. A method according to claim 1, wherein said response means for said object to be authenticated has a conversion table for converting each of a plurality of different input signals into a corresponding response signal, and said communication carrier performs the same conversion table as said conversion table. The authentication system according to claim 1, further comprising: comparing the transmitted authentication confirmation signal with the returned response signal with reference to the conversion table. 3. The authentication system according to claim 1, wherein said interface means comprises an information processing device for controlling transmission and reception of signals between said authentication target object and said communication carrier. 4. An authentication method for performing authentication of a user who uses a communication line by a connection service to a communication line provided by a communication carrier, wherein each of a plurality of different input signals uniquely assigned to the user is provided. A connection is made between an object to be authenticated having response means for outputting a response signal corresponding thereto and the communication carrier via an interface means, and an authentication confirmation signal is transmitted from the communication carrier via the interface means to the authentication object. Transmitted as an input signal to the object, a response signal corresponding to the authentication confirmation signal from the object to be authenticated is returned to the communication carrier via the interface means, and the authentication confirmation signal transmitted by the communication carrier. An authentication method, wherein the user is authenticated by comparing the returned response signal with the response signal. 5. The response means for the object to be authenticated has a conversion table for converting each of a plurality of different input signals into a corresponding response signal, and the communication carrier has the same conversion table as the conversion table. 5. The authentication method according to claim 4, further comprising: comparing the transmitted authentication confirmation signal with the returned response signal with reference to the conversion table. 6.