JPH11296481A - Information terminal authentication method and authentication device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To secure integrity by adapting to authentication of an information terminal. SOLUTION: A demand of authentication information is first performed prior to authentication (1a). Next, the authentication information generated on the basis of the demand of the authentication information is received (1b). Authentication performed on the basis of the received authentication information. As a result of authentication, if a user can be authenticated (1c; Y), control is performed so that an information terminal can be used and then a demand of the authentication information is made again (1a). If authentication is not successful (1c: N), control is performed so that the information terminal cannot be used (1d) and then the demand of authentication information is performed again (1a). While the information terminal is being used, the authentication processing is repeated.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication device for an information terminal for performing personal verification when using a portable personal computer, an electronic organizer, a car navigation system, a personal computer, a workstation, or the like.

[0002]

2. Description of the Related Art FIG. 14 shows a configuration of a conventional personal authentication device in a computer, for example, 200 is a CPU of the computer, 201 is a storage device for storing a database of authentication information, 202 is a keyboard, and 203 is a keyboard 20.
An input circuit for transferring a key input signal input from the CPU 2 to the CPU 200, a memory 204 in which a program operating on the CPU 200 exists, and a display device 205 for displaying an authentication result and the like. FIG. 16 is a flowchart showing a conventional authentication method. Hereinafter, an authentication method in a conventional computer will be described with reference to FIG. 14 and FIG.

Prior to authentication, a program for authentication resides in the memory 204, and the CPU 200
This program is executed according to the flowchart of FIG. Step 210: user ID (identification number)
And a password from the keyboard 202. The key input user ID and password are transferred by the CPU 200 through the input circuit 203. Next, in step 211, it is determined whether or not the user ID exists in the database of the authentication information stored in the storage device 201.
PU 200 inquires. If the user ID exists in the database of the authentication information, step 212
When the user ID does not exist, a warning indicating that the authentication has failed is displayed on the display device 205 and the computer is controlled so that it cannot be used any more.

In step 212, the CPU 200 checks the database of the authentication information, reads out the password paired with the user ID from the storage device 201, and performs collation. If the password entered from the keyboard 202 matches the password in the database of the authentication information,
The process proceeds to step 213, where data in the computer can be accessed. However, if they do not match, a warning indicating that authentication was not possible is displayed on the display device 205 and the computer is controlled so that it cannot be used any more.

[0005]

The conventional authentication device in a computer is configured as described above, and performs authentication only once before using the computer. In addition, the authentication information is input to a keyboard or a fingerprint detector. Need to enter through. For this reason, there is a problem in that security cannot be ensured when the user leaves the computer while the use of the computer is permitted, or when the computer is stolen, and a complicated authentication information input operation is required.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and provides an authentication method and an authentication apparatus for automatically performing authentication at any time even during use of a computer without forcing the user to perform cumbersome authentication work. The purpose is to:

[0007]

According to an authentication method for an information terminal according to the present invention, a requesting step for requesting authentication information from an information terminal, a receiving step for receiving authentication information generated based on the requesting step, An authentication step for performing authentication based on the authentication information; and a user restriction step for restricting use of the information terminal. If the user is successfully authenticated in the authentication step, the request step is performed. When the user cannot be authenticated, the user is passed through the user restriction step and then returns to the requesting step, whereby the authentication is performed a plurality of times while using the information terminal, and the authentication result of the information terminal is determined based on the authentication result. The use is restricted.

In the receiving step, there is provided a receiving completion confirming step for confirming that the authentication information has been normally received. If it is determined in the receiving completion confirming step that the authentication information has not been normally received, After the user restriction step, the process returns to the request step.

[0009] Further, as the authentication information, a combination of personal information for specifying a user and movement information of the user is used.

In the authentication step, there is an analysis step for analyzing the movement information. If it is determined in this analysis step that the user has movement, the process returns to the request step, and it is determined that the user does not move. If so, the process returns to the requesting step after going through the user restriction step.

The authentication step includes a time monitoring step for monitoring the passage of time, and an authentication information changing step for changing authentication information. When the time monitoring step determines that a predetermined time has elapsed, The process returns to the requesting step through the authentication information changing step.

In the authentication information change step, an authentication information generation step of generating new authentication information, an authentication information change request step of transmitting an authentication information change request, and confirming that the change of the authentication information is completed. A change request for the new authentication information generated in the authentication information generation step is made in the authentication information change request step, and is normally changed in the authentication information change completion check step. If it is determined that the change has been completed, the process returns to the requesting step. If it is determined that the change has not been completed normally, the authentication information change request is sent again in the authentication information changing step.

Further, in the authentication information change completion confirmation step, there is provided a change error detecting step for detecting that the change has not been normally performed at least once,
If it is detected in the change error detection step that the change cannot be performed normally, a warning is issued to the user.

[0014] In the authentication information generation step, at the start of use of the information terminal, information known by the user is used as authentication information.
During use, only the additional information is changed as authentication information using a combination of known information and additional information, and the user returns to the known information at the end of use of the information terminal.

Further, in the authentication device for an information terminal according to the present invention, a first transmitting means for transmitting an authentication information request command from the information terminal, and a second transmitting means for receiving the authentication information generated based on the authentication information request command. 1 receiving means, control means for performing authentication based on the request for the authentication information and authentication information obtained through the first receiving means, and storage means for storing information for performing authentication in the control means. The control unit performs authentication a plurality of times while using the information terminal, and restricts the user from using the information terminal based on the authentication result.

Further, in an authentication apparatus for enhancing security when using an information terminal, a first transmission means for transmitting an authentication information request command from the information terminal, and receiving authentication information generated based on the authentication information request command. First receiving means, control means for performing authentication based on the request for the authentication information and authentication information obtained through the first receiving means, and storage for storing information for performing authentication in the control means Means, an authentication information transmitting means for receiving a request from the first transmitting means and transmitting authentication information,
The control unit performs authentication a plurality of times while using the information terminal, and includes a user restricting unit that restricts a user from using the information terminal based on the authentication result.
The authentication information transmitting means is configured to be separable from the information terminal.

Further, the authentication information transmitting means includes a storage means for storing authentication information for specifying a user, a second transmitting means for transmitting the authentication information stored in the storage means,
A second receiving unit for receiving the authentication information request command transmitted from the first transmitting unit; and a control unit for controlling the authentication information in the storage unit to be transmitted from the second transmitting unit. It is.

The authentication information transmitting means includes a finger, an arm, a neck,
It is formed in a ring shape that can be attached to a site such as a foot.

Further, when the authentication information transmitting means worn on the user's body is separated from the user, the authentication information stored in the storage means is erased.

Further, the first transmitting means is provided with a first transfer means for receiving an authentication information request command, and the first receiving means is provided with a second transfer means for transferring the authentication information to the control means. The first transmitting means and the first receiving means can be separated from the information terminal.

When the first transmitting means and the first receiving means are separated from the information terminal, use of the information terminal is restricted.

The first receiving means includes a detecting means for detecting that the authentication information has been lost, and when the detecting means determines that the authentication information has been lost, the first receiving means limits the use of the information terminal. It was done.

The authentication information is a combination of personal information for specifying the user and movement information of the user, and the control means analyzes the movement information to determine whether the user has movement. And when the determination means determines that the user has not moved within a predetermined time, the use of the information terminal is restricted.

The control means includes time monitoring means for monitoring the passage of time, authentication information generating means for newly generating authentication information, and change request means for making a request for changing the authentication information. When it is determined that a predetermined time has elapsed, the authentication information is changed by the change request means.

The change request means includes a change instruction generating means for generating a change request command for authentication information, and a confirmation means for confirming that the change made based on the change request for authentication information is completed. The authentication information change command generated by the change command generation means is transmitted from the transmission means, and after confirming that the change of the authentication information has been normally completed by the confirmation means, the authentication information request command is transmitted again by the transmission means. It is configured as follows.

The user restricting means controls the information terminal so as not to display the screen.

The user restricting means controls the information terminal to be turned off.

Further, the user restricting means is controlled so as not to receive an input from the input device of the information terminal.

The first transmitting means for transmitting the authentication information request command from the information terminal is transmitted using radio waves, infrared rays, or electromagnetic coupling.

[0030]

DESCRIPTION OF THE PREFERRED EMBODIMENTS In an information terminal authentication system according to a first embodiment of the present invention, first, authentication information is requested from an information terminal. Next, authentication information generated by the request for authentication information is received and authentication is performed. If the user can be authenticated, the authentication information request is made again. If the authentication is not successful, the use of the information terminal is restricted so that the information terminal cannot be used, and the authentication information request is made again. Requests for authentication information are made multiple times while using an information terminal.
It works to obtain strong security.

In the case where the authentication information cannot be normally received in receiving the authentication information, the use of the information terminal is restricted so that the information terminal cannot be used, so that the security function is ensured.

Further, by combining personal information for specifying a user and movement information of the user as authentication information, robust authentication information can be obtained.

In addition, use of authentication information that combines user's personal information and motion information is used, and if it is determined that the user does not move, use restriction is imposed so that the information terminal cannot be used. can do.

Further, by monitoring the elapse of time from the start of the authentication request and changing the authentication information after a certain period of time, robust authentication information can be obtained.

After making a request to change the authentication information,
If the change of the authentication information is not completed normally, the request for changing the authentication information is made again, thereby preventing the change of the authentication information from being mistaken.

Also, a request for changing the authentication information is made, and if the change of the authentication information is not completed normally more than a certain number of times, a warning is issued to the user to prevent the authentication information from being changed incorrectly. work.

In the change of the authentication information, when the user starts using the information terminal, the user uses the known information as the authentication information,
During use, only the additional information is changed as authentication information using a combination of known information and additional information, and when the use of the information terminal is completed, the user returns to the known information, so one user applies to multiple information terminals can do.

In the authentication apparatus for information terminals configured as described above, when performing authentication, first, the first transmission means transmits an authentication information request command. Next, the authentication information generated based on the authentication information request command is received by the first receiving unit. Next, the control unit compares the authentication information received by the first receiving unit with the authentication information stored in the storage unit. As a result of the comparison by the control means, when the user is authenticated, the first transmission means requests the authentication information again, and when the user is not authenticated, the use of the user is restricted by the user restriction means. Request authentication information again. Since the request for authentication information is made a plurality of times while using the information terminal, it works to obtain strong security.

When performing authentication, an authentication information request command is transmitted from the first transmission means, and the authentication information transmission means which can be separated from the information terminal responds to the request and transmits the authentication information. Received by the receiving means. The control unit compares the received authentication information with the authentication information stored in the storage unit in advance. As a result of the comparison by the control means, if the user is authenticated, the request for authentication information is made again by the first transmission means, and if not, the user is restricted by the user restricting means. A request for authentication information is made again. Since the request for authentication information is made a plurality of times while using the information terminal, it works to obtain strong security.

The authentication information transmitting means operates to transmit the authentication information stored in the storage means immediately upon receiving the authentication information request command.

Further, by configuring the authentication information transmitting means in a ring shape, it works so that it can be easily attached to a part such as a finger, an arm, a neck or a foot.

Further, when the authentication information transmitting means worn on the user's body is detached from the user, the authentication information stored in the storage means is erased.

Further, by providing a first transfer means as the first transmission means and a second transfer means as the reception means, the first transmission means and the first reception means are separated from the information terminal. Because it is possible, one user works so that it can be applied to multiple information terminals.

The first transmitting means and the first transmitting means
When the receiving means is separated from the information terminal, the use of the information terminal is restricted so that it cannot be used in the separated state.

Further, in the first receiving means, when the detecting means detects that the authentication information cannot be normally received, the use of the information terminal is restricted.
Works to eliminate unauthorized use.

Also, using the authentication information in which the personal information for specifying the user and the movement information of the user are combined, the determining means analyzes the movement information and determines that the user has a movement. If the determination means determines that there is no movement within a predetermined time, it is regarded that the user is absent, and the use of the information terminal is restricted to thereby prevent unauthorized use.

The control means includes a time monitoring means for monitoring time, an authentication information generating means for newly generating authentication information, and a change request means for requesting a change of the authentication information. If it is determined that the predetermined time has elapsed, robust authentication information can be obtained by generating new authentication information by the authentication information generating means and requesting a change of the authentication information by the change requesting means.

Further, the change request means includes a change instruction generating means for generating an authentication information change request instruction, and a confirmation means for confirming that the change made based on the authentication information change request is completed. By generating the authentication information change command by the change command generation means, confirming that the change of the authentication information has been completed normally by the checking means, and transmitting the authentication information request command again, the robust authentication information can be obtained. can get.

In the above-mentioned user restricting means, if the user cannot be authenticated, control is performed so that the screen of the information terminal cannot be displayed, and the data stored in the information terminal is exposed to the eyes of a third party. Work as if not.

In the above-mentioned user restricting means, if the user cannot be authenticated, the information terminal is controlled to be turned off so that the data stored in the information terminal is not exposed to the eyes of a third party. Work like that.

In the above-mentioned user restricting means, if the user cannot be authenticated, all the input from the input device of the information terminal is rejected, and the data stored in the information terminal is transmitted to the third party. Work invisibly.

In the first transmitting means, transmission is performed using radio waves, infrared rays, and electromagnetic coupling.
Since authentication information can be transmitted wirelessly, it works to reduce restrictions on users when using it.

Hereinafter, the present invention will be described in detail with reference to the drawings showing the embodiments. Embodiment 1 FIG. FIG. 1 is a flowchart showing the concept of the information terminal authentication method according to the first embodiment of the present invention. In the figure, step 1a is a step of transmitting a command for reading authentication information, step 1b is a step of receiving authentication information issued based on step 1a, and step 1c is based on the authentication information received in step 1b. Step 1d is a step of prohibiting input from the input device.

FIG. 2 is a flowchart showing an authentication method for an information terminal according to the first embodiment of the present invention. In the figure, 2a is a step of waiting for input of a login password, 2b is a step of monitoring whether login authentication is successful, 2c is a step of monitoring time elapsed since the previous authentication was completed, and 2d is A step of transmitting a command for reading the user identification password and the movement information; a step 2e for monitoring the time elapsed after transmitting the command for reading the authentication information; and a step 2f for performing a first authentication process for performing authentication. Step.

FIG. 3 is a flowchart showing the processing of step 2f in FIG. 3a is a step of detecting that authentication information is received, 3b is a step of performing authentication based on a password, 3c is a step of determining whether or not the user has a movement from the movement information, and 3d is a step of determining that there is no movement in the step 3c. The step of increasing the counter N1 by 1 when it is determined, the step of setting the counter N1 to 0 when it is determined in step 3c that there is a motion in step 3c, and the step of determining whether the counter N1 is N1> NMAX1 compared to the predetermined value NMAX1. The step 3g is a step of controlling the input device so that, for example, keyboard input of an information terminal cannot be performed.

The information terminal authentication method according to the first embodiment will be described below with reference to FIGS. First, in FIG. 1, in step 1a, a command for reading, for example, a user password is transmitted as authentication information. Next, in step 1b, a password read command is transmitted, and the process waits until a password is transmitted. In step 1c, authentication is performed based on the received password. If the user is successfully authenticated, the process returns to step 1a. If authentication is not successful in step 1c, step 1d
Then, the operation is locked so that the input operation of the information terminal cannot be performed, and the process returns to step 1a. When the process returns to step 1a, a command for reading out the password of the user is transmitted again.
Steps 1a, 1b, and 1c are repeated during use of the information terminal.

Next, a detailed flow of the information terminal authentication method according to the first embodiment will be described with reference to FIG. In using the information terminal, first, as shown in step 2a, the system waits for input of a login password from a keyboard. Next, as shown in step 2b, authentication is performed based on the login password, and if the login authentication is successful, the user can use the information terminal.

Next, at step 2c, it is first determined whether or not the time elapsed since the previous authentication coincides with the predetermined time T1. If they do not match, step 2c is executed again, and if they match, the process proceeds to step 2d,
Send a command to read authentication information. Here, the authentication information is different from the password used for login authentication,
Use a combination of a user identification password and motion information. In step 2e, the time elapsed after execution of step 2d is monitored. If it is determined that the predetermined time T2 has elapsed, the process proceeds to step 2f. If it is determined that the predetermined time T2 has not been reached, step 2e is performed again. Execute.

Next, the flow of step 2f will be described with reference to FIG. In step 3a, it is determined whether or not the authentication information has been received. If it is determined in step 2e that the authentication information has not been received even after waiting for the predetermined time T2, the process proceeds to step 3g to prevent the keyboard input of the information terminal from being accepted. After that, the process returns to step 2c. If it is determined in step 3a that the authentication information has been received, the user is authenticated in step 3b based on the user identification password included in the authentication information. Here, the user identification password may be a known or unknown user.

If the user has not been authenticated in step 3b, the process proceeds to step 3g, where the keyboard input is not accepted, and the process returns to step 2c in FIG. If the user can be authenticated in step 3b, the process proceeds to step 3c, and it is determined whether or not the user has a motion from the motion information included in the authentication information. Step 3
If it is determined in step c that the user has not moved, the process proceeds to step 3d, and the motion counter value N1 is increased by one.

On the other hand, if it is determined in step 3c that the user is moving, the motion counter value N1 is set to 0 in step 3e, and the process returns to step 2c in FIG. After incrementing the motion counter value N1 by one in step 3d, N1 is larger than the predetermined value NMAX1 in step 3f by N1> NM.
It is checked whether or not AX1 is satisfied. If N1> NMAX1, the process proceeds to step 3g. After the keyboard input of the information terminal is not accepted, the process returns to step 2c in FIG. Also,
If N1> NMAX1 is not satisfied in step 3f, the process returns to step 2c. The elapsed time from the end of the processing in step 2e is monitored in step 2c, and if it is determined that the time T1 has elapsed, the process proceeds to step 2d.

As described above, strong security can be ensured by repeating the processes starting from step 2c to step 2f while using the information terminal.

Embodiment 2 Next, a second embodiment of the present invention will be described. In the information terminal authentication method according to the second embodiment, only step 2f in FIG.
And different. Therefore, only the detailed operation of step 2f will be described, and description of the same parts as in the first embodiment will be omitted.

FIG. 4 is a flowchart of the first authentication processing step 2f according to the second embodiment of the present invention. In the figure, 4a is a step for detecting the reception of the authentication information, 4b is a step for performing authentication based on the user identification password, and 4c is a time T3 since the last time the user identification password was changed. 4d is a step of generating a new user identification password, 4e is a step of transmitting a request for changing the user identification password, and 4f is a step of transmitting the newly generated user identification password. is there.

4g is a step for receiving a notification that the change of the user identification password has been normally completed. 4h is a step for determining whether the user identification password has been normally changed based on the notification received in step 4g. 4i is a step for increasing the password change error counter value E1 by one, and 4j is a step for changing the change error counter value E1 to a predetermined value EMAX1.
In comparison with the step of checking whether E1> EMAX1, 4k is a step of displaying as a warning to the user of the information terminal, for example, a message indicating that the password change has failed on the display screen. This is a step of controlling not to accept.

The detailed flow of the information terminal authentication method according to the second embodiment will be described below with reference to FIG. Step 4
In a, it is determined whether or not the authentication information is received. If it is determined in step 2e that the authentication information has not been received even after waiting for a predetermined time T2, the process proceeds to step 41 to prevent the keyboard input of the information terminal from being accepted. After that, the process returns to step 2c. If it is determined in step 4a that the authentication information has been received, the user is authenticated based on the user identification password included in the authentication information in step 4b.

Here, a password known to the user is used as the user identification password. If the user is not authenticated in step 4b, the process proceeds to step 4l, where the keyboard input of the information terminal is not accepted, and then the process returns to step 2c. If the user can be authenticated in step 4b, it is determined in step 4c whether a predetermined time T3 has elapsed since the previous password change. If it is determined in step 4c that the predetermined time T3 has elapsed, the process proceeds to step 4d to generate a new user identification password. If it is determined that the password has not yet elapsed, the process returns to step 2c.

When the user identification password is generated in step 4d, for example, a random variable is combined as the additional information with the user identification password that the user has already known. Is changed to generate a new user identification password. After generating a new user identification password in step 4d, a password change command is transmitted in step 4e, and then a new user identification password is transmitted in step 4f. Next, in step 4g, a notification that the user identification password has been normally changed is received, and based on this, it is determined in step 4h whether the password has been normally checked.

If it is determined in step 4h that the change has been completed normally, the process returns to step 2c. If it is determined that the change has not been completed normally, the change error counter value E1 is incremented by one in step 4i. To step 4j. In step 4j, the change error counter value E1
Is compared with a predetermined value EMAX1 to check whether E1> EMAX1. If E1> EMAX1, the process shifts to step 4k to display a message indicating that the password change has failed on the display screen of the information terminal. If E1> EMAX1 is not satisfied, the process returns to step 4e again to transmit the password change command.
The elapsed time from the end of the process in step 2f is monitored in step 2c, and if it is determined that the time T1 has elapsed, the process proceeds to step 2d.

As described above, according to the second embodiment, the processing from step 2c to step 2f is repeated while the information terminal is used, and the user identification password is changed a plurality of times. As a result, strong security can be secured.

Embodiment 3 Next, a third embodiment of the present invention will be described with reference to FIGS. FIG. 5 is a diagram showing a configuration of an information terminal authentication device according to the third embodiment. Reference numeral 10 denotes an antenna for transmitting and receiving authentication information and the like by radio waves, and 11 denotes a filter process for transmitting a radio signal from the antenna 10. Transmitter that performs pre-processing of
2 is a modulator for modulating a signal upon transmission, 13 is a CPU of an information terminal, 14 is a storage device for storing a login password and a user identification password as authentication information, and 15 is a signal for receiving a signal received from the antenna 10. A receiver for performing post-processing such as filter processing, and 16 is a receiver 1
A demodulator for demodulating the signal output from 5; a keyboard 17 for operating the information terminal; a display device 18 for displaying the result of the authentication; a timer 19 for monitoring the elapsed time; It is a memory for storing.

FIG. 6 is a flowchart showing a program stored in the memory 20. The third embodiment will be described with reference to FIG. When using the information terminal, first, as shown in step 30m, the system waits for input of a login password from a keyboard. Next, step 30n
As shown in (2), the login password entered by the user is compared with the login password stored in the storage device 14 in advance, and if they match, the user can use the information terminal for the time being, and the process proceeds to step 30a. I do.
If they do not match, the process returns to step 30m again, and waits for input of a login password.

In step 30a, the CPU 13
9 is a step of inquiring about the elapsed time and waiting until a predetermined time t has elapsed from the first authentication or the previous authentication.
Next, in step 30b, the CPU 13 controls the modulator 12 to modulate an instruction for reading the authentication information. Here, it is assumed that the authentication information includes a user identification password different from the login password and information on whether or not the user is moving.

At step 30 c, the transmitter 11 performs a pre-process on the read command of the authentication information sent from the modulator 12, and transmits the command from the antenna 11. Then step 30
In d, the CPU 13 checks whether the authentication information issued based on step 30c has been received by the receiver 15. If the authentication information cannot be received by the check of the CPU 13, as shown in step 3g of FIG.
CPU to not accept keyboard input of information terminal
13 controls.

At step 30d, the authentication information is
If the authentication information is received, the authentication information is demodulated by the demodulator 16 as shown in step 30e, and
Causes the CPU 13 to read the authentication information from the storage device 14. Next, as shown in step 30g, the CPU 13 compares the user identification password in the authentication information received based on the authentication information read command with the user identification password stored in the storage device 14 in advance. If they match, control is passed to step 30h, and if they do not match, as shown in step 30k, control is performed so as not to accept keyboard input of the information terminal, and then control returns to step 30a.

On the other hand, in step 30 h, the CPU 13 analyzes the motion information in the authentication information received by the receiver 15, and if it is determined that the user has not moved, the process proceeds to step 3.
0i, the CPU 13 sets the motion counter value N2 to 1
If it is determined that there is a movement, N2 is set to 0, and the process returns to step 30a. If the motion counter N2 is incremented by 1 in step 30i, step 30j
As shown in the figure, N2 is compared with a predetermined value NMAX2, and N2> NMAX
If it is 2, control is performed so that keyboard input of the information terminal is not accepted in step 30k, and if N2> NMAX2 is not satisfied, the process returns to step 30a.

According to the third embodiment, while using the information terminal, the CPU 13 repeatedly performs the authentication process according to the flowchart shown in FIG.
Strong security can be secured.

Embodiment 4 FIG. 7 is a diagram showing a configuration of an information terminal authentication apparatus according to Embodiment 4 of the present invention.
0 is an authentication identifier for transmitting authentication information, 41a and 41b are antennas, 42 is a band for winding around a wrist or the like,
43 is a conducting wire having a predetermined resistance laid around the back of the band 42, 44a and 44b are metal plates such as copper plates which come into contact with each other when the band 42 is attached to a wrist or the like, 45 is an information terminal, and 46 is The authentication identification device is attached to the expansion slot of the information terminal 45 and receives authentication information. FIG. 8A is a side view of the band 42 of the identifier 40 extended from the conductor 43 side, and FIG. 8B is a side view thereof.

FIG. 9 shows an authentication identifying device 46 and an information terminal 45.
Is a first transmitter for performing pre-processing such as filtering to transmit a radio signal from an antenna 41b, 51 is a first modulator for performing modulation upon transmission, and 52 is an antenna 41b. A first receiver 53 that performs post-processing such as filtering on the received radio signal,
Is a first demodulator that performs demodulation upon reception, 54 is the CPU of the information terminal, 55 is an input circuit that receives a signal from the CPU 54 and transfers it to the first modulator, and 56 is a signal that is received from the first demodulator 53 Is a reference signal generation circuit that sends a predetermined reference signal to the CPU 54, 58 is a storage device that stores a login password and a user identification password, and 59 is a program that operates on the CPU 54. Memory to store, 6
0 is a timer for monitoring time, 61 is a display device of the information terminal, and 62 is a keyboard of the information terminal.

FIG. 10 is a block diagram of the authentication identifier 40. Reference numeral 70 denotes a second transmitter which performs preprocessing such as filtering to transmit a radio signal from the antenna 41a;
71 is a second modulator for performing modulation upon transmission, 72
Is a second receiver that performs post-processing such as filtering on radio waves received by the antenna 41a, 73 is a second demodulator that performs demodulation upon reception, 74 is a CPU, and 75 is an identifier 4
0 is a motion detector for detecting the motion of 0, 76 is a storage device for storing a password for user identification, 77 is an ammeter for measuring the current flowing through the conductor 43, and 78 is a warning that emits a warning sound such as a buzzer as a warning. Sound generator 79 is CPU 74
Is a memory in which a program to be executed is stored.

FIGS. 11 and 12 show the CP of the information terminal 45.
FIG. 13 is a flowchart of a program operated by the CPU 74 of the authentication identifier 40. Embodiment 4 of the present invention will be described below with reference to FIGS. A user using the information terminal 45 attaches the authentication identifier 40 to the wrist or the like via the band 42 and attaches the authentication identification device 46 to the extension slot of the information terminal 45. The storage device 58 and the storage device 76 store a user identification password known to the user in advance, and the storage device 58 further stores a login password.

When using the information terminal, first, as shown in step 901 of FIG. 11, the input terminal waits for the input of the login password from the keyboard. Next, as shown in step 90m, the login password input by the user is compared with the login password stored in the storage device 58 in advance, and if they match, the user can use the information terminal, Move to step 90a. Also,
If they do not match, the process returns to step 901 again, and waits for the login password. As shown in step 90a, the CPU 54 queries the timer 60 for the elapsed time,
It waits until a predetermined time t has elapsed from the first authentication or the previous authentication.

Next, at step 90b, the CPU 54 determines whether or not a reference signal can be detected from the reference signal generation circuit 57. If the CPU 54 cannot detect the reference signal, it is regarded that the authentication identifying device 46 is not mounted on the information terminal 45, and the input from the keyboard 62 is controlled in step 90k. Reference signal is CP
If U54 is detected, the process proceeds to steps 90c and 90d to transmit a command for reading a user identification password different from the login password. That is, the authentication information read command is input to the input circuit 5.
5 modulates the signal with the first modulator 51 and the first transmitter 5
At 0, preprocessing is performed and transmission is performed from the antenna 41b.

Next, the operation of the CPU 74 of the authentication identifier 40 will be described with reference to the flowchart of FIG. As shown in step 110a of FIG. 13, the CPU 74 monitors whether the second receiver 72 has received an instruction. If it is determined that the command has been received, the command is demodulated by the second demodulator 73 as shown in step 110b. Next, as shown in step 110c, it is determined whether the received command is a user identification password reading command. If the command is a password read command, the process proceeds to step 110d as shown in step 110c, and if not, the process proceeds to step 110j.

At step 110d, the current value i measured by the ammeter 77 is compared with a predetermined value I. Here, the predetermined value I is i> I if the metal plates 44a and 44b are in contact, and i is i if the metal plates 44a and 44b are not in contact and the conductor 43 is cut.
> I is set not to be satisfied. In step 11d, i
If> I, the storage device 76 is determined in step 110e.
Reads the user identification password from. If i> I is not satisfied, the user discards the user identification password stored in the storage device 76 assuming that the user has removed the authentication identifier 40 from the body, and a warning is issued from the warning sound generator 78 in step 110i. Emits a sound. The user identification password read from the storage device 76 in step 110e is modulated by the second modulator 71 as shown in step 110f, and transmitted from the antenna 41a via the second transmitter 70 in step 110g. .

In the authentication identifying device 46, step 9 in FIG.
As indicated by 0e, the reception of a user identification password is awaited. As shown in step 90e, when the first receiver 52 successfully receives the user identification password, the first demodulator 53 demodulates the user identification password in step 90f. However, if the user
If the signal is not received even after a predetermined time elapses, for example, when the user leaves the terminal 5, control is performed in step 90 k so that the input from the keyboard 62 is not accepted.
Return to a. When the user identification password is demodulated in step 90f, the user identification password is read from the storage device 58 as shown in step 90g. Next, the user identification password received in step 90h is compared with the user identification password stored in the storage device 58, and if they match, the process proceeds to step 90i. Then, the process returns to step 90a after controlling so as not to receive the input from.

At step 90i, the timer 60 is inquired whether the user identification password is changed for the first time or the time T4 has elapsed since the last time the user identification password was changed. If it is determined that the time T4 has elapsed, a password change process is performed in step 90j. If the time T4 has not elapsed, the process returns to step 90a.

The processing of step 90j will be described with reference to FIG. In step 100a, the user creates a new user identification password by combining the known user identification password with additional information such as a random number. Next, in step 100b, a new user identification password is stored in the storage device 58, and as shown in steps 100c and 100d,
A password change command and a new user identification password are transmitted to the authentication identifier 40.

In the authentication identifier 40, the password change command and the new user identification password sent from the authentication identification device 46 are transmitted to the second receiver 72 via the antenna 41a.
To receive. When the reception is detected in step 110a of FIG. 13, the password change command and the new user identification password are demodulated through step 110b. Next, it is determined in step 110c and step 110j that the command is a password change command. As shown in step 110j, if the command is a password change command, a new user identification password is stored in the storage device 76 in step 110k, and if not, the process returns to step 110a. After storing the new user identification password in step 110k, step 110l
CPU 74 generates a password change completion signal at
Is demodulated by the demodulator 73. Next, at step 110m, a password change completion signal is transmitted from the antenna 41a via the second transmitter 70.

The authentication identifying device 46 waits for the password change completion signal transmitted from the authentication identifier 40 as shown in step 100e of FIG. Step 100
If the password change completion signal is received in step e, the process returns to step 100a. If the password change completion signal is not received after waiting for a predetermined time, step 100a is performed.
As shown in f, the change error counter value E2 is increased by one. In step 100g, if the change error counter value E2 is larger than the predetermined value EMAX2, that is, if E2> EMAX2, a warning is displayed on the display device 61 that the password change could not be performed normally. If E2> EMAX2 is not satisfied, the process returns to step 100b to change the user identification password again.

When the information terminal is powered down, C
The PU 54 removes the random number, which is additional information, from the changed current user identification password, and returns the user to a known user identification password.

The authentication device for information terminals according to the fourth embodiment not only repeatedly performs the authentication but also periodically changes the user identification password, so that the security is further enhanced.

Further, in the first to fourth embodiments, the user identification password different from the login password is used, but the same password may be used.

Further, in the third and fourth embodiments, the information terminal is controlled so as not to accept the input from the keyboard as the use restriction means. However, the present invention is not limited to this. The same effect can be obtained by controlling so as not to be performed or by forcibly turning off the information terminal.

In the third and fourth embodiments, signals such as authentication information are transmitted and received by radio waves. However, the present invention is not limited to this. The effect is obtained.

In the first and third embodiments, the user identification password is used as the authentication information. However, the same effect can be obtained by encrypting the password itself and combining it with information for decrypting the password. can get.

In the second and fourth embodiments, a user combines a known user identification password and additional information such as a random number as authentication information, and changes only the additional information every time a predetermined time elapses. However, the same effect can be obtained by encrypting the authentication information itself and combining it with information for decrypting the same as new authentication information.

[0098]

Since the present invention is configured as described above, it has the following effects.

When performing authentication at the information terminal, first, at the request step, authentication information is requested from the information terminal. Next, in the receiving step, the authentication information generated by the request for the authentication information is received, and the authentication is performed based on the received authentication information in the authentication step. Here, if the user can be authenticated, a request for authentication information is made again in the requesting step, and if the user cannot be authenticated, a use restriction is imposed so that the information terminal cannot be used. While the information terminal is used, by repeating these series of requesting step, receiving step, and authentication step, the authentication can be strengthened and the information terminal can be protected from unauthorized access.

Further, when the authentication information is received in the above-mentioned receiving step, if the reception is not performed normally, the information terminal cannot be used, thereby preventing unauthorized use by a third party. Can be.

Further, by combining personal information for identifying a user and user movement information as authentication information, stronger authentication can be performed than when only personal information is used.

Also, when performing authentication at the information terminal, personal information for specifying the user is combined with the movement information of the user as authentication information, and if it is determined that the user does not move, the information terminal cannot be used. By doing so, the information terminal can be protected from unauthorized operation by a third party.

Further, by periodically changing the authentication information at regular time intervals, stronger authentication can be performed than by using predetermined authentication information.

If the change of the authentication information is made but the change of the authentication information is not completed normally, the change of the authentication information is requested again, thereby preventing erroneous authentication due to a mistake in the change of the authentication information. be able to.

Further, a request for changing the authentication information is made, and if the change of the authentication information is not completed normally more than a predetermined number of times, a warning is issued to the user, thereby preventing erroneous authentication due to an incorrect change of the authentication information. be able to.

Also, when changing the authentication information, when the user starts using the information terminal, the user uses the known information as the authentication information, and during use, changes the combination of the known information and the additional information as the authentication information and changes only the additional information. However, at the end of use of the information terminal, the user returns to the known information, so that one user can apply to a plurality of information terminals.

Further, when performing authentication of the information terminal, first, an authentication information request command is transmitted from the first transmitting means. The control unit compares the authentication information received by the first receiving unit based on the transmission of the authentication information request command with the authentication information stored in the storage unit. As a result of the comparison by the control means, if the user is authenticated, the request for authentication information is made again by the first transmission means. A request for authentication information is made by the first transmitting means. Since the authentication information request command is repeatedly transmitted as described above, strong authentication can be performed.

When performing authentication of the information terminal, an authentication information request command is transmitted from the first transmitting means, and the authentication information transmitting means separable from the information terminal transmits the authentication information in response to the request. The control unit compares the authentication information received by the first receiving unit with the authentication information stored in the storage unit. As a result of the comparison by the control means, when the user is authenticated, the request for the authentication information is made again by the first transmitting means, and when the user is not authenticated, the use of the user is restricted by the user restricting means. After that, a request for authentication information is made again by the first transmission means. As described above, since the authentication information request command is repeatedly transmitted to the authentication information transmitting means that can be separated from the information terminal to perform authentication, strong authentication can be performed.

In the authentication information transmitting means, the authentication information stored in the storage means is transmitted from the second transmitting means as soon as the request for the authentication information is received by the second receiving means. It does not force the user to perform cumbersome authentication work.

Further, since the authentication information transmitting means is formed in a ring shape, the authentication information transmitting means can be easily attached to a finger, an arm, a neck, a foot or the like, and the physical load on the user can be reduced.

[0111] When the authentication information transmitting means is detached from the body of the user wearing the authentication information transmitting means, the authentication information stored in the storage means is erased. Can be protected.

Further, a first transfer means is provided as a first transmission means, and a second transfer means is provided as a first reception means, and the first transmission means and the first reception means are separated from the information terminal. Since the configuration is possible, the authentication information transmitting unit and the separable first transmitting unit and the first receiving unit can be applied to a plurality of information terminals.

When the first transmitting means and the first receiving means which can be separated are separated from the information terminal, the use of the information terminal is restricted so that the information terminal cannot be used in the separated state. Can be protected from unauthorized use.

Further, when the first receiving means receives the authentication information, the use of the information terminal is restricted when the detecting means cannot normally detect the reception of the authentication information. It is possible to eliminate the unauthorized use of persons.

[0115] When the control means determines that there is no movement within a predetermined time by using the authentication information in which the personal information for specifying the user and the movement information of the user are combined, the information terminal is used. Since the use of the terminal is restricted, the information terminal can be protected from unauthorized operation by a third party.

Further, in the control means, the authentication information generating means periodically generates new authentication information and requests the change of the authentication information by the change request means, so that the fixed authentication information is used. Stronger authentication can be performed.

Further, when the change request means requests the change of the authentication information, the change command generation means generates a change command of the authentication information, and confirms that the change of the authentication information has been normally completed by the confirmation means. Since the authentication information request command is transmitted again from, the erroneous change of the authentication information can be prevented.

In the above-mentioned user restricting means, if the user cannot be authenticated, the information terminal is controlled not to be displayed on the screen, and the data stored in the information terminal is exposed to the eyes of a third party. Since the information terminal is not provided, security of the information terminal can be ensured.

In the above-mentioned user restricting means, if the user cannot be authenticated, the information terminal is controlled to be turned off so that the data stored in the information terminal is not visible to a third party. As a result, security of the information terminal can be ensured.

In the above-mentioned user restricting means, if the user cannot be authenticated, all the input from the input device of the information terminal is rejected, and the data stored in the information terminal is transmitted to a third party. Since it is not visible, the security of the information terminal can be ensured.

Further, the first transmitting means and the second transmitting means can transmit authentication information wirelessly by using radio waves, infrared rays, and electromagnetic coupling, thereby reducing the burden on the user.

[Brief description of the drawings]

FIG. 1 is a flowchart showing the concept of an information terminal authentication system according to Embodiment 1 of the present invention.

FIG. 2 is a flowchart showing an information terminal authentication method according to the first embodiment.

FIG. 3 is a flowchart of a first authentication process according to the first embodiment.

FIG. 4 is a flowchart of a first authentication process according to the second embodiment of the present invention.

FIG. 5 is a block diagram of an information terminal authentication device according to a third embodiment of the present invention;

FIG. 6 is a flowchart showing a flow of an authentication process according to the third embodiment.

FIG. 7 is a diagram showing a configuration of an information terminal authentication device and an authentication identifier according to Embodiment 4 of the present invention.

FIG. 8 is a diagram illustrating a configuration of an authentication identifier according to the fourth embodiment.

FIG. 9 is a block diagram of an authentication identification device and an information terminal according to a fourth embodiment.

FIG. 10 is a block diagram of an authentication identifier according to the fourth embodiment.

FIG. 11 is a flowchart showing a flow of an authentication process according to the fourth embodiment.

FIG. 12 is a flowchart illustrating a password change process according to the fourth embodiment.

FIG. 13 is a flowchart showing processing with an authentication identifier according to the fourth embodiment.

FIG. 14 is a block diagram of an authentication device in a conventional computer.

FIG. 15 is a flowchart showing an authentication process of an authentication device in a conventional computer.

[Explanation of symbols]

10, 41a, 41b antenna, 11, 50, 70
Transmitter, 12, 51, 71 Modulator, 13, 54, 74
CPU, 14, 58, 76 storage device, 15, 52,
72 receiver, 16, 53, 73 demodulator, 17 keyboard, 18 display device, 19, 60 timer, 20,
59 memory, 40 authentication identifier, 42 band, 43
Conductor, 44a, 44b metal plate, 45 information terminal, 4
6 Authentication / identification machine, 55 input circuit, 56 output circuit, 5
7 Reference signal generation circuit, 75 motion detector.

────────────────────────────────────────────────── ───

[Procedure amendment]

[Submission date] May 8, 1998

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] Claim 7

[Correction method] Change

[Correction contents]

[Procedure amendment 2]

[Document name to be amended] Statement

[Correction target item name] 0002

[Correction method] Change

[Correction contents]

[0002]

2. Description of the Related Art FIG. 14 shows a configuration of a conventional personal authentication device in a computer, for example, 200 is a CPU of the computer, 201 is a storage device for storing a database of authentication information, 202 is a keyboard, and 203 is a keyboard 20.
An input circuit for transferring a key input signal input from the CPU 2 to the CPU 200, a memory 204 in which a program operating on the CPU 200 exists, and a display device 205 for displaying an authentication result and the like. FIG. 15 is a flowchart showing a conventional authentication method. Hereinafter, an authentication method in a conventional computer will be described with reference to FIG. 14 and FIG.

[Procedure amendment 3]

[Document name to be amended] Statement

[Correction target item name] 0013

[Correction method] Change

[Correction contents]

Further, in the authentication information change completion confirming step includes changing error detection step of detecting that the at least one or more times change was not performed properly, change at the change error detection step performed successfully If it is detected that there is no such message, a warning is issued to the user.

[Procedure amendment 4]

[Document name to be amended] Drawing

[Correction target item name] Fig. 7

[Correction method] Change

[Correction contents]

FIG. 7

Claims (23)

[Claims] 1. An authentication method for enhancing security when using an information terminal, a requesting step of requesting authentication information from the information terminal, a receiving step of receiving authentication information generated based on the requesting step, An authentication step for performing authentication based on the information terminal, and a user restriction step for restricting use of the information terminal. If the user can be authenticated in the authentication step, the process returns to the request step. If the user could not be authenticated, go through the user restriction step and return to the above request step, so that authentication is performed multiple times while using the information terminal, and the use of the information terminal is restricted based on the authentication result. Authentication method for information terminals. 2. The method according to claim 1, wherein the receiving step includes a receiving completion confirming step for confirming that the authentication information has been normally received. If the receiving completion confirming step determines that the authentication information has not been normally received, 2. The information terminal authentication method according to claim 1, wherein the process returns to the requesting step after a user restriction step. 3. The information terminal authentication method according to claim 1, wherein a combination of personal information for specifying a user and movement information of the user is used as the authentication information. 4. The authentication step includes an analysis step of analyzing motion information. If the analysis step determines that the user has a motion, the process returns to the request step,
4. The information terminal authentication method according to claim 3, wherein when it is determined that the user has not moved, the process returns to the requesting step after going through a user restriction step. 5. The authentication step includes a time monitoring step of monitoring the passage of time, and an authentication information changing step of changing authentication information. When the time monitoring step determines that a predetermined time has passed, 2. The information terminal authentication method according to claim 1, wherein the process returns to the requesting step after the authentication information changing step. 6. An authentication information changing step of generating new authentication information, an authentication information change requesting step of transmitting an authentication information change request, and confirming that the change of the authentication information is completed. A change request for the new authentication information generated in the authentication information generation step is made in the authentication information change request step, and is normally changed in the authentication information change completion check step. If it is determined that the change has been completed, the process returns to the requesting step, and if it is determined that the change has not been completed normally, the authentication information change request is sent again in the authentication information changing step. 5
Authentication method for information terminal described. 7. The authentication information change completion confirmation step includes a change error detection step of detecting that the change has not been normally performed at least once, and the change error detection step allows the change to be normally performed. 7. The information terminal authentication method according to claim 6, wherein a warning is issued to the user when the absence is detected. 8. In the authentication information generation step, at the start of use of the information terminal, the user uses known information as authentication information, and during use, a combination of known information and additional information is used as authentication information, and only the additional information is used. 7. The information terminal authentication method according to claim 6, wherein the information is changed and the user returns to known information when the use of the information terminal is completed. 9. An authentication device for enhancing security when using an information terminal, a first transmission means for transmitting an authentication information request command from the information terminal, and receiving authentication information generated based on the authentication information request command. First receiving means, control means for performing authentication based on the request for authentication information and authentication information obtained through the first receiving means, and storage for storing information for performing authentication in the control means Means for authenticating an information terminal, the control means performing authentication a plurality of times during use of the information terminal, and a user restricting means for restricting a user from using the information terminal based on the authentication result. apparatus. 10. An authentication device for enhancing security when using an information terminal, a first transmission means for transmitting an authentication information request command from the information terminal, and receiving authentication information generated based on the authentication information request command. First receiving means, control means for performing authentication based on the request for authentication information and authentication information obtained through the first receiving means, and storage for storing information for performing authentication in the control means Means, an authentication information transmitting means for receiving a request from the first transmitting means and transmitting authentication information, and wherein the control means performs authentication a plurality of times while using the information terminal, and uses the authentication result. User restriction means for restricting the user's use of the information terminal,
An authentication device for an information terminal, wherein the authentication information transmitting means is configured to be separable from the information terminal. 11. An authentication information transmitting unit includes a storage unit that stores authentication information for identifying a user, a second transmitting unit that transmits the authentication information stored in the storage unit, and a first transmission unit. 11. A second receiving means for receiving an authentication information request command transmitted from the means, and a control means for controlling the authentication information in the storage means to be transmitted from the second transmitting means. Authentication device for an information terminal described in the above. 12. The authentication for an information terminal according to claim 10, wherein the authentication information transmitting means is formed in a ring shape that can be attached to a part such as a finger, an arm, a neck, or a foot. apparatus. 13. The authentication information transmitting means mounted on the user's body, wherein the authentication information stored in the storage means is erased when the authentication information transmitting means is detached from the user. Authentication device for information terminals. 14. The first transmitting means is provided with a first transfer means for receiving an authentication information request command, and the first receiving means is provided with a second transfer means for transferring authentication information to a control means. 11. The information terminal authentication device according to claim 10, wherein the first transmitting means and the first receiving means are configured to be separated from the information terminal. 15. The information processing apparatus according to claim 11, wherein when the first transmitting means and the first receiving means are separated from the information terminal, use of the information terminal is restricted. Authentication device for information terminals. 16. The first receiving means includes a detecting means for detecting that the authentication information has been lost, and when the detecting means determines that the authentication information has been lost, the first receiving means restricts the use of the information terminal. 10. The method according to claim 9, wherein
The authentication device for an information terminal according to any one of claims 1 to 15. 17. The authentication information is a combination of personal information specifying a user and motion information of the user, and the control means analyzes the motion information to determine that the user has a motion. 16. The method according to claim 9, wherein when the determination unit determines that the user has not moved within a predetermined time, the use of the information terminal is restricted. 2. The information terminal authentication device according to claim 1. 18. The control means includes a time monitoring means for monitoring the passage of time, an authentication information generating means for newly generating authentication information, and a change request means for making a request for changing the authentication information. 11. The information terminal authentication device according to claim 9, wherein when it is determined that a predetermined time has elapsed, the authentication information is changed by the change request unit. 19. The change request means includes: a change instruction generating means for generating an authentication information change request instruction; and a confirming means for confirming that the change performed based on the authentication information change request has been completed. The authentication information change command generated by the change command generation means is transmitted from the transmission means, and after confirming that the change of the authentication information has been completed normally by the confirmation means, the authentication information request command is transmitted again by the transmission means. 19. The information terminal authentication device according to claim 18, wherein the authentication device is configured to perform the authentication. 20. The information terminal authentication device according to claim 9, wherein the user restricting means controls so as not to display a screen of the information terminal. 21. The information terminal authentication device according to claim 9, wherein the user restricting means controls so as to turn off a power supply of the information terminal. 22. The information terminal authentication according to claim 9, wherein the user restricting means controls so as not to receive an input from an input device of the information terminal. apparatus. 23. The apparatus according to claim 9, wherein the first transmitting means for transmitting the authentication information request command from the information terminal transmits the information using radio waves, infrared rays, or electromagnetic coupling.
The authentication device for an information terminal according to any one of the above.