JPWO2021181523A5

JPWO2021181523A5 -

Info

Publication number: JPWO2021181523A5
Application number: JP2022507048A
Authority: JP
Filing date: 2020-03-10
Publication date: 2022-09-29
Anticipated expiration: 2040-03-10

Description

本開示に係る認証システムは、中央管理装置と、複数のユーザの識別情報を各々が読み取る複数の認証装置と、を備え、中央管理装置は、複数の認証装置の各々について、複数のユーザのうち当該認証装置についての認証可能ユーザの識別情報を記憶するユーザ情報記憶部と、複数の認証装置の各々について、当該認証装置についての認証可能ユーザの識別情報に基づくブルームフィルタを生成するフィルタ生成部と、識別情報を読み取ったユーザが認証可能ユーザであるかの複数の認証装置の各々からの問い合わせに応答し、複数の認証装置の各々についてフィルタ生成部が生成したブルームフィルタを当該認証装置に配信する通信部と、を備え、複数の認証装置の各々は、通信部から配信されるブルームフィルタを記憶するフィルタ記憶部と、配信されたブルームフィルタをフィルタ記憶部が記憶した後に識別情報を読み取られたユーザが当該ブルームフィルタに基づいて認証不可ユーザであると判定されるときに、中央管理装置に問い合わせることなく当該ユーザの認証を拒否する認証処理部と、を備える認証システムであり、フィルタ生成部は、有効期間を含めてブルームフィルタを生成し、フィルタ記憶部は、有効期間を含めてブルームフィルタを記憶し、認証処理部は、現在の時刻がブルームフィルタの有効期間に含まれないときに、当該ブルームフィルタに基づく認証不可ユーザであるか否かの判定を省略する。 An authentication system according to the present disclosure includes a central management device and a plurality of authentication devices that each read identification information of a plurality of users, and the central management device controls each of the plurality of authentication devices among the plurality of users. a user information storage unit that stores identification information of an authentitable user for the authentication device; and a filter generation unit that generates, for each of the plurality of authentication devices, a bloom filter based on the identification information of the authentitable user for the authentication device. Responding to an inquiry from each of a plurality of authentication devices as to whether the user who has read the identification information is an authenticated user, and distributing the Bloom filter generated by the filter generation unit for each of the plurality of authentication devices to the authentication device. a communication unit, wherein each of the plurality of authentication devices includes a filter storage unit that stores the bloom filter distributed from the communication unit; and the identification information is read after the filter storage unit stores the distributed bloom filter. an authentication processing unit that refuses authentication of the user without asking a central management device when the user is determined to be an unauthenticable user based on the Bloom filter, wherein the filter generation unit is , the Bloom filter is generated including the valid period, the filter storage unit stores the Bloom filter including the valid period, and the authentication processing unit, when the current time is not included in the valid period of the Bloom filter, Determination of whether or not the user is an unauthenticated user based on the Bloom filter is omitted .

本開示に係る中央管理装置は、複数のユーザの識別情報を読み取る複数の認証装置の各々について、複数のユーザのうち当該認証装置についての認証可能ユーザの識別情報を記憶するユーザ情報記憶部と、複数の認証装置の各々について、当該認証装置についての認証可能ユーザの識別情報に基づくブルームフィルタを生成するフィルタ生成部と、識別情報を読み取ったユーザが認証可能ユーザであるかの複数の認証装置の各々からの問い合わせに応答し、複数の認証装置の各々についてフィルタ生成部が生成したブルームフィルタを当該認証装置に配信する通信部と、を備え、フィルタ生成部は、有効期間を含めてブルームフィルタを生成する。 A central management device according to the present disclosure includes, for each of a plurality of authentication devices that read identification information of a plurality of users, a user information storage unit that stores identification information of an authentitable user for the authentication device among the plurality of users; For each of a plurality of authentication devices, a filter generation unit that generates a bloom filter based on identification information of an authentitable user for the authentication device, and a plurality of authentication devices that determine whether a user who has read the identification information is an authentifiable user a communication unit that responds to an inquiry from each of the plurality of authentication devices and distributes the Bloom filter generated by the filter generation unit for each of the plurality of authentication devices to the authentication device , the filter generation unit including the valid period of the Bloom filter Generate .

本開示に係る認証装置は、複数のユーザの各々の識別情報を読み取る読取部と、複数のユーザのうち認証可能ユーザの識別情報を登録する中央管理装置から配信される認証可能ユーザの識別情報に基づいて生成されたブルームフィルタを記憶するフィルタ記憶部と、配信されたブルームフィルタをフィルタ記憶部が記憶した後に識別情報を読取部に読み取られたユーザが当該ブルームフィルタに基づいて認証不可ユーザであると判定されるときに、中央管理装置に問い合わせることなく当該ユーザの認証を拒否する認証処理部と、を備え、フィルタ記憶部は、有効期間を含めてブルームフィルタを記憶し、認証処理部は、現在の時刻がブルームフィルタの有効期間に含まれないときに、当該ブルームフィルタに基づく認証不可ユーザであるか否かの判定を省略する。 The authentication device according to the present disclosure includes a reading unit that reads identification information of each of a plurality of users, and a central management device that registers the identification information of the certifiable users among the plurality of users. A user whose identification information is read by the reading unit after the filter storage unit stores the Bloom filter generated based on the filter storage unit and the delivered Bloom filter is stored by the reading unit is an unauthenticated user based on the Bloom filter. and an authentication processing unit that refuses authentication of the user without inquiring the central management device when it is determined that the filter storage unit stores the Bloom filter including the valid period, and the authentication processing unit When the current time is not included in the effective period of the Bloom filter, the determination of whether or not the user is an authenticated user based on the Bloom filter is omitted .

本開示に係る認証方法は、複数のユーザのうち認証可能ユーザの識別情報を登録する中央管理装置から配信される認証可能ユーザの識別情報に基づいて生成されたブルームフィルタを記憶するフィルタ記憶ステップと、フィルタ記憶ステップの後に、複数のユーザのうちのいずれかのユーザの識別情報を読み取る読取ステップと、読取ステップにおいて識別情報を読み取られたユーザがフィルタ記憶ステップにおいて記憶されたブルームフィルタに基づいて認証不可ユーザであると判定されるときに、中央管理装置に問い合わせることなく当該ユーザの認証を拒否する認証処理ステップと、を備え、フィルタ記憶ステップにおいて、ブルームフィルタは有効期間を含めて記憶され、認証処理ステップにおいて、現在の時刻がブルームフィルタの有効期間に含まれないときに、当該ブルームフィルタに基づく認証不可ユーザであるか否かの判定が省略される。 An authentication method according to the present disclosure includes a filter storage step of storing a Bloom filter generated based on identification information of an authenticatable user distributed from a central management device that registers identification information of an authenticatable user among a plurality of users; a reading step of reading identification information of one of a plurality of users after the filter storing step; and authenticating the user whose identification information is read in the reading step based on the bloom filter stored in the filter storing step. an authentication processing step of rejecting authentication of the user without inquiry to the central management device when the user is determined to be an unauthorized user; and In the processing step, when the current time is not included in the effective period of the Bloom filter, the determination of whether or not the user is an authenticated user based on the Bloom filter is omitted .

本開示に係る認証プログラムは、複数のユーザのうち認証可能ユーザの識別情報を登録する中央管理装置から配信される認証可能ユーザの識別情報に基づいて生成されたブルームフィルタを記憶するフィルタ記憶ステップと、フィルタ記憶ステップの後に、複数のユーザのうちのいずれかのユーザの識別情報を読み取る読取ステップと、読取ステップにおいて識別情報を読み取られたユーザがフィルタ記憶ステップにおいて記憶されたブルームフィルタに基づいて認証不可ユーザであると判定されるときに、中央管理装置に問い合わせることなく当該ユーザの認証を拒否する認証処理ステップと、を認証装置に実行させ、フィルタ記憶ステップにおいて、有効期間を含めてブルームフィルタを認証装置に記憶させ、認証処理ステップにおいて、現在の時刻がブルームフィルタの有効期間に含まれないときに、当該ブルームフィルタに基づく認証不可ユーザであるか否かの判定を認証装置に省略させる。 An authentication program according to the present disclosure includes a filter storage step of storing a Bloom filter generated based on identification information of an authentitable user distributed from a central management device that registers identification information of an authentifiable user among a plurality of users; a reading step of reading identification information of one of a plurality of users after the filter storing step; and authenticating the user whose identification information is read in the reading step based on the bloom filter stored in the filter storing step. an authentication processing step of rejecting authentication of the user without inquiry to the central management device when it is determined that the user is an unauthorized user ; The information is stored in the authentication device, and in the authentication processing step, when the current time is not included in the effective period of the Bloom filter, the authentication device omits determination of whether or not the user is an unauthenticated user based on the Bloom filter .

本開示に係るデータ構造は、複数のユーザの識別情報を読み取る認証装置について、複数のユーザのうち認証可能ユーザの識別情報を登録する中央管理装置が複数のユーザのうち認証可能ユーザの識別情報に基づいて生成するブルームフィルタを含み、認証装置に識別情報を読み取られたユーザがブルームフィルタに基づいて認証不可ユーザであると判定されるときに中央管理装置に問い合わせることなく当該ユーザの認証を拒否する認証処理に、認証装置が用いるデータ構造であり、ブルームフィルタの有効期間を含み、現在の時刻が有効期間に含まれないときにブルームフィルタに基づく認証不可ユーザであるか否かの判定を省略する処理に、認証装置が用いるデータ構造である。
In the data structure according to the present disclosure, for an authentication device that reads identification information of a plurality of users, a central management device that registers identification information of an authentifiable user among a plurality of users stores identification information of an authentifiable user among a plurality of users. including a bloom filter generated based on the authentication device, and rejecting the authentication of the user without inquiry to the central management device when the user whose identification information is read by the authentication device is determined to be an unauthenticable user based on the bloom filter A data structure used by the authentication device for authentication processing, including the effective period of the Bloom filter, and omitting the determination of whether or not the user is an unauthenticated user based on the Bloom filter when the current time is not included in the effective period. This is the data structure used by the authenticator for processing .

Claims

a central management device;
a plurality of authentication devices each reading identification information of a plurality of users;
with
The central management device
a user information storage unit that stores, for each of the plurality of authentication devices, identification information of an authentitable user for the authentication device among the plurality of users;
a filter generation unit that generates, for each of the plurality of authentication devices, a Bloom filter based on identification information of an authentitable user for the authentication device;
responding to an inquiry from each of the plurality of authentication devices as to whether the user who has read the identification information is an authentifiable user, and generating the bloom filter generated by the filter generation unit for each of the plurality of authentication devices to the authentication device; a communication unit that delivers to
with
each of the plurality of authentication devices,
a filter storage unit that stores the Bloom filter distributed from the communication unit;
After the distributed Bloom filter is stored in the filter storage unit, when the user whose identification information is read is determined to be an unauthenticated user based on the Bloom filter, without inquiring of the central management device an authentication processing unit that refuses user authentication;
is an authentication system comprising
The filter generation unit generates the Bloom filter including an effective period,
The filter storage unit stores the Bloom filter including the valid period,
When the current time is not included in the effective period of the Bloom filter, the authentication processing unit omits determination of whether or not the user is an unauthenticated user based on the Bloom filter.
Authentication system.

The central management device
a cache generation unit that generates cache data including identification information of at least some of the authenticatable users for each of the plurality of authentication devices;
each of the plurality of authentication devices,
a cache storage unit that stores the cache data;
The communication unit distributes the cache data generated by the cache generation unit for each of the plurality of authentication devices to the authentication device regardless of whether there is an inquiry from the authentication device.
The authentication system according to claim 1 .

When the cache data stored in the cache storage unit includes identification information of a user who was not determined to be an unauthenticable user in the determination based on the Bloom filter, the authentication processing unit performs authentication based on the cache data. Determining whether or not the user is authenticated without inquiring of the central management device, and inquiring of the central management device whether the user is an authentitable user when the identification information of the user is not included in the cache data. judge by
The authentication system according to claim 2 .

The central management device
a learning unit that learns an authentication pattern for authentication of the plurality of users in the plurality of authentication devices;
The cache generation unit generates the cache data based on the authentication pattern learned by the learning unit.
The authentication system according to claim 2 or 3 .

The learning unit learns, as the authentication pattern, the authentication frequency for each time period of each of the plurality of users in each of the plurality of authentication devices,
The cache generation unit generates the cache data for each time period so that identification information of an authentitable user is preferentially included as the frequency of authentication is higher.
The authentication system according to claim 4 .

The learning unit learns the authentication order of each of the plurality of authentication devices for each of the plurality of users as the authentication pattern,
When the communication unit receives an inquiry from a first authentication device among the plurality of authentication devices as to whether a user whose identification information is read is an authenticated user, the cache generation unit performs the first authentication method in the authentication pattern. generating cache data for a second authentication device for which authentication processing of the user is performed after the authentication device so as to include identification information of the user;
The communication unit delivers the cache data to the second authentication device before the second authentication device reads the identification information of the user.
The authentication system according to claim 4 or 5 .

a user information storage unit that stores, for each of a plurality of authentication devices that read identification information of a plurality of users, identification information of an authentitable user for the authentication device among the plurality of users;
a filter generation unit that generates, for each of the plurality of authentication devices, a Bloom filter based on identification information of an authentitable user for the authentication device;
responding to an inquiry from each of the plurality of authentication devices as to whether the user who has read the identification information is an authentifiable user, and generating the bloom filter generated by the filter generation unit for each of the plurality of authentication devices to the authentication device; a communication unit that delivers to
with
The filter generation unit generates the Bloom filter including an effective period.
Central control unit.

a cache generation unit that generates cache data including identification information of at least some of the authenticatable users for each of the plurality of authentication devices;
The communication unit distributes the cache data generated by the cache generation unit for each of the plurality of authentication devices to the authentication device regardless of whether there is an inquiry from the authentication device.
The central management device according to claim 7 .

a learning unit that learns an authentication pattern for authentication of the plurality of users in the plurality of authentication devices;
The cache generation unit generates the cache data based on the authentication pattern learned by the learning unit.
9. The central management device according to claim 8 .

The learning unit learns, as the authentication pattern, the authentication frequency for each time period of each of the plurality of users in each of the plurality of authentication devices,
The cache generation unit generates the cache data for each time period so that identification information of an authentitable user is preferentially included as the frequency of authentication is higher.
10. Central management device according to claim 9 .

The learning unit learns the authentication order of each of the plurality of authentication devices for each of the plurality of users as the authentication pattern,
When the communication unit receives an inquiry from a first authentication device among the plurality of authentication devices as to whether a user whose identification information is read is an authenticated user, the cache generation unit performs the first authentication method in the authentication pattern. generating cache data for a second authentication device for which authentication processing of the user is performed after the authentication device so as to include identification information of the user;
The communication unit delivers the cache data to the second authentication device before the second authentication device reads the identification information of the user.
11. The central management device according to claim 9 or 10 .

a reading unit that reads identification information of each of a plurality of users;
a filter storage unit that stores a bloom filter generated based on the identification information of the certifiable users distributed from a central management device that registers the identification information of the certifiable users among the plurality of users;
When the user whose identification information is read by the reading unit after the distributed Bloom filter is stored in the filter storage unit is determined to be an unauthenticated user based on the Bloom filter, the central management device an authentication processing unit that refuses authentication of the user without inquiry;
with
The filter storage unit stores the Bloom filter including an effective period,
When the current time is not included in the effective period of the Bloom filter, the authentication processing unit omits determination of whether or not the user is an unauthenticated user based on the Bloom filter.
Authenticator.

a cache storage unit for storing cache data including identification information of at least a part of authentitable users and distributed from the central management device regardless of whether there is an inquiry from the authentication processing unit;
The authentication device according to claim 12 .

When the cache data stored in the cache storage unit includes identification information of a user who was not determined to be an unauthenticable user in the determination based on the Bloom filter, the authentication processing unit performs authentication based on the cache data. Determining whether or not the user is authenticated without inquiring of the central management device, and inquiring of the central management device whether the user is an authentitable user when the identification information of the user is not included in the cache data. judge by
The authentication device according to claim 13 .

a filter storage step of storing a Bloom filter generated based on the identification information of the certifiable users distributed from a central management device that registers the identification information of the certifiable users among the plurality of users;
a reading step of reading identification information of one of a plurality of users after the filter storing step;
When the user whose identification information is read in the reading step is determined to be an unauthenticable user based on the Bloom filter stored in the filter storing step, authentication of the user is performed without inquiring the central management device. a rejecting authentication processing step;
with
In the filter storage step, the Bloom filter is stored including an effective period,
In the authentication processing step, when the current time is not included in the valid period of the Bloom filter, the determination of whether or not the user is an unauthenticable user based on the Bloom filter is omitted.
Authentication method.

a filter storage step of storing a Bloom filter generated based on the identification information of the certifiable users distributed from a central management device that registers the identification information of the certifiable users among the plurality of users;
a reading step of reading identification information of one of a plurality of users after the filter storing step;
When the user whose identification information is read in the reading step is determined to be an unauthenticable user based on the Bloom filter stored in the filter storing step, authentication of the user is performed without inquiring the central management device. a rejecting authentication processing step;
is executed by the authentication device ,
In the filter storage step, storing the Bloom filter including the validity period in the authentication device;
In the authentication processing step, when the current time is not included in the valid period of the Bloom filter, the authentication device omits determination of whether or not the user is an unauthenticated user based on the Bloom filter.
certification program.

A Bloom filter generated by a central management device for registering identification information of an authentitable user among a plurality of users based on the identification information of an authentifiable user among the plurality of users, for an authentication device that reads the identification information of a plurality of users. including
authentication processing for rejecting authentication of a user whose identification information has been read by the authentication device and is determined to be an unauthenticable user based on the bloom filter without inquiring of the central management device; A data structure used by the device ,
Effective period of said bloom filter
including
A data structure used by the authentication device for processing for omitting determination of whether or not the user is an authentication-impossible user based on the Bloom filter when the current time is not included in the valid period.