WO2007066385A1

WO2007066385A1 - Personal authentication system, method of personal authentication and program for executing personal authentication

Info

Publication number: WO2007066385A1
Application number: PCT/JP2005/022381
Authority: WO
Inventors: Yuichi Konno
Original assignee: Brains Kabushiki Kaisha; Kabushiki Kaisha Kai Corporation
Priority date: 2005-12-06
Filing date: 2005-12-06
Publication date: 2007-06-14
Also published as: JPWO2007066385A1

Abstract

A personal authentication system is provided to effectively prevent a third party from inferring a password element from representation of an element selection group into which a password element and a scramble element are mixed. Preparations and memorization are made in advance for a plurality of mixed element groups into which deeply familiar passwords to users and a plurality of scramble elements are mixed. Element selection groups shuffled at random with elements of the mixed element groups at authentication are represented. Users select the most familiar element from each represented selection group. Authentication or rejection is judged from comparison of the selected element with the password element.

Description

Specification

Personal authentication system, personal authentication method, and program for executing personal authentication Technical field

[0001] The present invention relates to a system, method, and program for authenticating an individual, and more specifically, a system, method, and program for authenticating an individual by selecting a plurality of preset passwords. Regarding that program.

Background technology

[0002] In the bank's online system, a 4-digit number is registered in advance as a password, and when using this online system, this password is entered at an ATM etc., and if the password matches the pre-registered number. can only enter the online system. Personal authentication systems, as exemplified by bank online systems, have been developed and are widely used as systems that allow only specific individuals to use the system, and restrict the use of authorized individuals. .

[0003] In conventional personal authentication systems, system authentication can be obtained by registering a specific password and inputting that password into the system. As the types of systems that individuals use and the number of passwords they register increase, it becomes difficult for individuals to remember their passwords, and unifying passwords increases the impact of damage if a password is stolen. There is a risk of

[0004] As described above, as the use of systems requiring passwords expands, the number of passwords increases and password management becomes extremely complicated. If you forget your password, you will be denied access to the system, so to prevent this from happening, it is a good idea to bring a memo with your registered password. Power There is a big problem.

[0005] In order to address the problems of such conventional password-based personal authentication systems, cases have been introduced in recent years of introducing biometric authentication systems in financial institutions and the like. Biometric authentication is an authentication method that verifies an individual's identity based on their physical characteristics.For example, characteristics such as fingerprints, iris, veins, and face are registered as standard data and used for authentication. Authentication is performed by determining whether the biometric information obtained matches the reference data.

[0006] Biometric authentication is believed to be an authentication method that is theoretically more difficult to ``spoof'' than conventional methods that use personal identification numbers and passwords, but it is not possible to use personal biometric information. There is a possibility that personal information may be illegally collected and impersonated, and once biometric information, which is personal information, is leaked, an irreversible situation will occur. Furthermore, even when the person himself/herself authenticates, the authentication is not always successful (false authentication), and the accuracy of authentication remains unstable. Furthermore, it is necessary to install an input device for inputting biometric information, and the authentication program that verifies the input biometric information with reference data and determines personal authentication becomes extremely complex. As a result, such biometric authentication systems are extremely expensive devices.

[0007] In order to overcome the problems with the above password method, the invention described in Japanese Patent Application Laid-open No. 2002-197062 uses a method in which multiple password elements that are familiar to the user are registered in advance and used as a decoy. We propose a password generation and verification system that performs personal authentication by displaying a combination of scrambled elements and letting the user select one.

[0008] This password generation and verification system performs personal authentication through the process described below. As shown in FIG. 1, the user first enters a familiar password element 1 5 (eg, name) and stores it in a predetermined field 10. Each password element and a predetermined number of scrambling elements are mixed to create a mixed element group. The scramble elements are prepared in advance as scramble element data 12, and their neutral forces are also randomly extracted. First, four scramble elements 2, 4, Κ, (N— 1) are randomly extracted from scramble element data 12 and mixed with password element 1. The mixed five elements are shuffled to randomize the order, producing mixed element group 14. Mixed factor groups are created for the remaining password factors 2 to 5 using the same procedure.

[0009] When mixed element groups are generated, each mixed element group is displayed on the display screen as shown in pages 1 to 5, as shown in FIG. The user sequentially selects familiar elements (password elements) from the displayed mixed element group. That is, on page 1, select password component 1, then password component 2, and so on. When the user selects familiar elements from all mixed element groups, they are checked against pre-registered password elements, and if they all match, authentication is granted. This authentication system Since this method allows the user to select password elements that are familiar to the user, the user can easily select password elements buried among scrambled elements. I don't know!/, it is difficult for others to select all the password elements correctly. It also has the advantage of not requiring any special input device or authentication program such as biometric authentication.

Disclosure of invention

Problems that the invention seeks to solve

[0010] In the password generation and verification system described above, while the password elements are always included in the selection screen, different scramble elements are extracted and displayed each time. In other words, the appearance rate of password elements that appear on the selection screen is different from the appearance rate of scramble elements. In other words, the frequency of occurrence of password elements is high, and the frequency of occurrence of individual scramble elements is lower than the frequency of occurrence of password elements. This difference in appearance rate clearly distinguishes between password elements and scramble elements, and provides clues for guessing password elements.

Means to solve problems

[0011] Therefore, the present invention has been made with the aim of making the appearance rates of password elements and scramble elements that appear on the selection screen almost the same, thereby eliminating the need for guessing the password element. That is, the present invention stores N password element groups selected in advance that also serve as password elements, and generates M scramble element subgroups each consisting of N scramble elements different from the password elements. Then, one password element extracted from the password element group is mixed with M scramble elements created by extracting one scramble element from each scramble element subgroup of the M scramble element groups. This generates N mixed element groups. When creating N mixed element groups, password elements are extracted from the password element groups, yet to be extracted, from the remaining password elements, and scramble elements are extracted from each of said scramble element subgroups, yet to be extracted. , is extracted from the remaining scrambled elements. The created mixed element groups are displayed and the selected elements selected from each mixed element group are stored. Finally , authentication is granted if the stored selection factors all match the password factors. Effect of the invention

[0012] Therefore, according to the present invention, when a password element is selected from a selection screen on which password elements and scramble elements are displayed, the appearance rate of the password element and the appearance rate of the scramble element can be made almost the same. , the difference in appearance rate makes it impossible to guess password elements. Furthermore, since the plagiarism of the password element can be effectively prevented, the reliability of the authentication system can be dramatically improved.

Brief description of the drawing

[0013] FIG. 1 is a diagram illustrating a conventional authentication system.

[Figure 2] A diagram explaining the generation process of password element groups and scramble element groups.

[Figure 3] A diagram explaining the authentication process.

[Figure 4] A flowchart illustrating generation of a password element group and a scramble element group.

[Figure 5] A flowchart explaining the authentication process.

[Figure 6] Shows the hardware configuration of the authentication system.

FIG. 7 is a diagram illustrating a method of generating element selection groups using different methods.

[Figure 8] A block diagram when the present invention is applied to an ATM system of a financial institution.

FIG. 9 is a block diagram showing a system configuration when the authentication system according to the present invention is introduced into a system that provides web services via the Internet.

[Figure 10] A block diagram for explaining the configuration of an authentication system when the present invention is applied to a USB memory.

[FIG. 11] A block diagram for explaining another embodiment in which the authentication system according to the present invention is applied to a USB memory.

Explanation of symbols

[0014] 20 Scrap Nore Element Gnorep

20a Password Element Group

20b, 20c, 20d, 20e, 20f scramble element subgroup 22 Scrambled element data

31, 37, 39, 71 mixed element group

32a, 32b, 32c, 32d, 32e, 32f flags (extracted indicators)

33, 38, 40, 72 element selection group

61 Processing equipment

62 Input device

63 Display device

64 Storage device

PW1 -PW05 No password element

SExl—SEx5 scramble element

REOl, RE02 Replenishment Scramble Element

BEST MODE FOR CARRYING OUT THE INVENTION

[0015] Hereinafter, embodiments of the present invention will be described with reference to the drawings. The present invention can be roughly divided into a process of creating a mixed element group from a password element group and a scrambled element group and storing it in a predetermined memory area, and a process of creating a mixed element group from a password element group and a scramble element group, and using a mixed element loop stored in the memory area. It is divided into authentication processes that carry out authentication procedures. Figure 2 is a diagram illustrating an example of a process for creating a password element group and a scramble element group, and Figure 3 is a diagram illustrating an example of a process for creating a password element group and a scramble element group. FIG. 2 is a diagram illustrating an authentication process in which an authentication procedure is executed using a computer.

[0016] Now, FIG. 2 is a diagram illustrating the generation of password element group 20a and scramble element group 20 (sub-groups 20b, 20c, 20d, 20e, 20f). The user first enters the number of password elements to be used in this personal authentication system, and then inputs the password elements from the keyboard 21. In the following example, five password elements PW01 to PW05 are input and stored in a predetermined memory area as a password element group 20a. Password elements PW01-PW05 are preferably filled with words that are familiar to the user, such as names, place names, pet names, and other long-term memorable words.Typical password elements are: , the names of the user's family, friends, and teachers from when they were students. Name etc. are selected.

[0017] In this embodiment, an example is shown in which the user directly inputs the password element PWOl-PW05 from the keyboard 21, but it is possible to register in advance more names (for example, about 20) that are familiar to the user. Then, when generating the password element group 20a, the user or computer may randomly select a predetermined number of password elements, in this case five password elements PW01 to PW05. The selected password elements are displayed for your reference.

[0018] Further, in this embodiment, a name is input as a password element, but the password element is not limited to this, and any word that is familiar to the user may be used. Note that words are stored as text, which reduces memory usage.Still images, videos, sounds, etc. can also be used as password elements. Furthermore, security can be further improved by encrypting these password elements and storing them in memory.

[0019] Returning to FIG. 2, when the password element PWOl-PW05 input from the keyboard 21 is stored in a predetermined memory area, generation of the scramble element group 20 starts next. It is desirable that the scramble element that serves as a decoy for the password element belongs to the same category as the password element in order to avoid providing material for inferring the password element. Therefore, if a name is selected as the nosword element, it is desirable to also generate a name in the scramble element.

[0020] Once a name is selected as the category of the word element, the scramble element is randomly selected from the scramble element data 22, which is a database of as many different names as possible. In this example, five password elements are input, so five scramble elements SExl-SEx5 (X: 1-5) are generated in scramble element subgroups 20b, 20c, 20d, 20e, and 20f, respectively. . The scrambling element must be different from the password element, and if the same scrambling element as the password element is selected, that scrambling element is discarded and a new scrambling element is selected from the scrambling element data 22. Ru.

[0021] Note that the password element and scramble element shown in Figure 2 are provided with a flag or an extracted indicator (which may also be a counter) in association with the element, and as described below. During the generation process of a mixed element group, if that element is selected, a flag of 1 is set to prevent duplicate elements from being selected. The password and scrambling elements shown in Figure 2 have not yet started generating mixed element groups, so all flags are set to 0.

[0022] When the password element group 20a and the scramble element subgroups 20b, 20c, 20d, 20e, and 20f are generated through the above process, they are stored in a predetermined area of memory, and the authentication process described below used in the process. Note that it is desirable that the password element loop and scramble element group be encrypted to prevent unauthorized viewing or theft by others.

[0023] Next, the authentication process will be explained. In the authentication process, element selection groups created based on password element groups and scramble element groups are displayed on a display screen, and the certifier is asked to repeatedly select a password element from the displayed element selection groups a predetermined number of times. It is a process of

[0024] In FIG. 3(a), the password element group 20a and screen element subgnores 20b, 20c, 20d, 20e, 20f stored in a predetermined area are read out. First, one password element PW03 is randomly extracted from password element group 20a. Next, one scramble element SE12 is randomly extracted from the scramble element subgroup 20b. Similarly, scramble element subgroups 20c, 20d, 20e, and 20f force scramble elements SE25, SE31, SE42, and SE54 are each randomly extracted to generate a first mixed element group 31.

[0025] When an element is extracted, a flag associated with that element is set to 1 to prevent extraction of the same element. For example, when password element PW03 is extracted as described above, flag 32a associated with password element PW03 is changed from 0 to 1. Similarly, the scramble elements SE12, SE25, SE32, SE42, and SE54 will also have their associated flags changed to 1.

[0026] When the first mixed element group 31 is generated, the positions of the elements included in the first mixed element group 31 are shuffled to arrange them in random order, and the first element selection group 33 is It is formed. This first element selection group is for liquid crystal displays and cathode ray tube displays. displayed on the display screen 34.

[0027] When the first element selection group 33 is displayed on the display screen 34, the authenticator selects the selection element. That is, among the displayed elements, the certifier can select the element (familiar element PW03) that has been registered in advance as a password element by placing the pointer on it and clicking on it. The selected elements selected in this way are temporarily stored in memory 35.

be done.

[0028] Next, moving to FIG. 3(b), the second element selection group force also selects the selection element. That is, the password element P W1 is randomly extracted from the elements whose flag strength is ^ in the password element group 36a. Similarly, the scrambling elements SE13, SE24, SE35, SE45, and SE53 are randomly extracted from the scrambling element subgroups 36b, 36c, 36d, 36e, and 36f to generate a second mixed element group 37. The generated second mixed element group 37 is shuffled to arrange the elements included therein in random order, and is converted into a second element selection group 38.

[0029] The second element selection group 38 is displayed on the display device 34, and the authenticator places the pointer on the element (here, PW01) that is recognized as a password element and selects the selection element. The selected element is temporarily stored in memory 35 as a selected element.

[0030] The above process is repeatedly executed, and a third mixed element group force, a third element selection loop, a fourth mixed element group force, and a fourth element selection group are generated, respectively, and are displayed on the display screen. A selected element is selected from the third element selection group and the fourth element selection group and stored. Finally, as shown in Figure 3(c), the elements P W04, SE11, SE22, SE33, SE41, SE52 whose flag is 0 are extracted to generate the fifth mixed element group 39. The fifth mixed element group 39 is shuffled and converted into a fifth element selection group 40. A fifth factor selection group 40 is displayed on the display screen 34, and the authenticator hovers over and selects the factor that he or she believes to be a password factor.

[0031] The selected elements selected in the above manner are compared with previously registered nosword elements, and if all match, the authenticator authenticates the identity of the authenticator. Depending on the authentication result, the specified An authentication flag may be set at the position of , and an authentication signal may be sent. Additionally, if authentication is not possible, a non-authentication signal may be sent.

[0032] The creation process of the password element group and scramble element group and the authentication process described above will be further explained using a flowchart. Figure 4 is a flowchart showing the creation process of password element groups and scramble element groups. In step 41, you will be asked to enter the user ID of the person setting the password. By requesting the input of a user ID, it is possible to associate the user ID with a password element, and to identify who is requesting authentication in the authentication process described below. If the entered user ID matches the ID preset on the computer, it is determined that a password element has already been set, the password element setting is rejected, and the user is prompted to enter a new user ID. If it is determined in step 42 that the user ID is a new user ID, the process moves to step 43.

[0033] In step 43, many familiar password elements are input. It is preferable that the password elements to be input be limited to elements belonging to the same category, such as names, for example. Once the password elements have been entered, the process moves to step 44, where the number N of password elements to be included in the password element group is set. This set number corresponds to the number of times a password element is selected on the display screen during the authentication process, as described below. In the example above, the number of settings is 5. Once the set number of password elements has been entered, password element groups are formed in step 45. That is, from among the password elements input in step 43, password elements matching the set number are randomly selected. The selected password elements constitute a password element group. Password elements selected as a password element group may be displayed for reference.

[0034] Note that in steps 43 to 45, a password element loop is generated by selecting password elements constituting a password element group from password elements input in advance. A password element group may be generated by the user inputting the set number of password elements. [0035] Once the password element group is generated, in step 46, a scramble element group is generated. That is, M scramble element subgroups containing N scramble elements are generated. The scramble elements are stored in advance in the computer as scramble element data, and the required number is selected at random from among them, so that they do not overlap with the password elements. Once the no.word element group and the M scramble element subgroups have been generated, they are stored in a predetermined memory area in step 47. The password elements and scrambling elements included in the generated password element group and scrambling element group are preferably encrypted and stored in order to prevent misuse. Once the password element group and the scramble element group have been generated and stored in the predetermined memory area, the process of creating the password element group and the scramble element group is complete.

[0036] FIG. 5 is a flowchart illustrating the process of authenticating an individual. The authentication process will be explained below, following the flow in Figure 5 and referring to Figure 3 as appropriate. First, in step 501, the user is asked to enter a user ID in order to identify who is requesting authentication. If the user ID is found in step 502, the authentication process corresponding to that user ID begins in step 503.

[0037] In step 503, the password element group stored in the memory is read, and one password element (for example, PW03) is selected at random from the password element group (20a). Once a password element is selected, a flag (32a) associated with the password element is set in step 504 so that the password element is not selected twice. Next, similarly to step 503, the scramble element group stored in the memory is read out, and each scramble element subgroup 20b, 20c, 20d, 20e, 20f constituting the scramble element group is also one scramble element. (For example, SE1 2, SE25, SE32, SE42, SE54) Force ^Randomly selected. At step 506, flags associated with each selected scramble element are set, similar to step 504.

[0038] The selected password element and the scramble element are combined and, in step 507, one A mixed element group (31) is formed. Proceeding to step 508, this mixed element group is shuffled to generate an element selection group (33) in order to change the arrangement of the elements it contains during each authentication process. The shuffled element selection group is displayed on the display device (34) in step 509, and the authenticator selects an element to be considered as a password element from the displayed element selection group. The selected selection element is temporarily stored in a predetermined memory area (35) in step 510.

[0039] The process then moves to step 511 where it is determined whether all element selection groups have been displayed. If it is determined that all element selection groups are not displayed, the process returns to step 503 and repeats the processes from step 503 to step 510 described above. When it is determined that all element selection groups have been displayed, the process proceeds to step 512, where the selection elements collected in step 510 and the password elements registered in advance are compared. If all of the selected elements match the no-word element, the process proceeds to step 513, where the authenticator authenticates himself or herself and sets a predetermined authentication flag. If they do not match, no authentication is granted in step 514 and the authentication process ends.

[0040] FIG. 6 is a block diagram showing an example of a hardware configuration for realizing the authentication system according to the present invention. Although the block diagram shown here is simplified to facilitate understanding of the present invention, the actual hardware will include many more peripheral devices.

[0041] The processing device 61 may be any device that can process information, generally a personal computer. For example, as described below, this includes bank ATM terminals and mobile phones. Furthermore, the input device 62 is an input device such as a keyboard, numeric keypad, or mouse. Furthermore, the display device 63 corresponds to a display device such as a CRT or a liquid crystal display device. Further, the password element group, scramble element group, and scramble element data are stored in the storage device 64, but any type of memory can be used as long as the data can be maintained, such as a magnetic storage device. do. The processing device 61, the input device 62, the display device 63, and the magnetic storage device 64 do not necessarily have to be connected by wire, but may be connected to each other wirelessly or both.

[0042] FIG. 7 is a diagram illustrating a second method of generating element selection group 72 using a different method. In Figure 7, password element group 73 and scramble element group 74 The scramble element data force is selected as introduced in Figure 2 and the discussion associated with that figure. Once the password factor group 73 and the scramble factor group 74 are selected, their data is stored in memory and recalled from memory to generate the mixed factor group each time the authentication process is performed. However, in the second method, the mixed element group 71 is generated by further adding supplementary scrambling elements REOl, RE02. The supplementary scramble elements REOl, RE02 are selected from the scramble element data 75 each time a mixed element group is generated. The supplementary scramble element R EOl, RE02 must be a different element from the password element and the scramble element, and if the same element is selected, a new element is selected again from the scramble element data 75.

[0043] By adding the supplementary scramble elements REOl and RE02 in this way, the frequency of appearance of the password element and scramble element and the supplementary scramble element can be made different, thereby confusing the detection of the password element.

[0044] Next, some specific examples in which the authentication system according to the present invention is utilized will be described below. The specific examples shown herein are for the purpose of showing typical examples and are not intended to limit the invention to these examples.

[0045] Bank ATM system

FIG. 8 shows a block diagram when the present invention is applied to an ATM system of a financial institution. An ATM 802 installed in a branch office 801 of a financial institution is connected via a dedicated line 800 to a host computer 812 installed in a data center 811 of the financial institution. The ATM 802 includes a display device 803, an input device 804, and a cash card reader 805, which are controlled by an ATM control device 806.

[0046] The host computer 812 includes accounting software 813 for processing operations related to normal financial transactions, accounting data 814 that stores various customer financial data, and account information 815 that stores customer account information. , authentication software 816 for performing authentication according to the present invention, memories 817, 818, and 819 for storing password element group, scramble element group, and scrambling element data, respectively. Operations related to communication and financial transactions with ATM802 and authentication operations are controlled by ATM control software. Ru.

[0047] In the ATM system configured as described above, the authentication system according to the present invention is realized as follows. The financial institution stores the customer's password element in the password element group 817 based on the password element registration application from the customer. Furthermore, the scramble element group 818 is randomly selected from the elements stored in the scramble element data 819 through processing by the authentication software 816. Such password element group 817 and scramble element group 818 are individually maintained for each customer's account and managed in association with the account number.

[0048] The procedure at the time of authentication is executed as follows. First, the customer inputs the transaction type from the ATM input device 804 and inserts the cash card into the cash card reader 805, and the transaction begins. ATM control device 806 transmits transaction type and cash card information to ATM control software 820 via dedicated line 800. If the ATM control software 820 determines that it is necessary to authenticate the customer's identity, the ATM control software 820 transmits the account number of the cash card information to the authentication software 816 and requests the authentication software 816 to start authentication. The authentication software 816 selects the password element group 817 and the scramble element group 818 linked to the account number, and generates an element selection group. When the element selection group is sent to ATM control software 820, ATM control software 820 sends the element selection group via communication line 800 to ATM controller 806 instructing it to display the element selection group. Upon receiving the element selection group, the ATM control device 806 displays the element selection group on the display device 803.

[0049] When the customer selects the desired element in the element selection group force via the input device 804, the ATM controller transmits the selected selection element to the ATM control software 820 via the communication line 820. ATM control software 820 communicates the selection to authentication software 816, which stores the selection in a predetermined memory location. When the number of selection factors required for authentication is completed, the authentication software 816 compares the selection factors with the password factor group 817, transmits the authentication or non-authentication result to the ATM control software 820, and displays the display screen. Also displayed on 803. If the authentication is successful, the ATM control software 820 allows the banking software 813 to start the transaction. However, in the case of non-authentication, the continuation of the transaction will be discontinued.

[0050] Internet' Web Service

FIG. 9 is a block diagram showing a system configuration when the authentication system according to the present invention is introduced into a system that provides web services via the Internet. A client 901 connects a personal computer, set-top box, mobile phone, etc. in an office or home 902 to the Internet 900 to receive web services. Personal computers, set-top boxes, mobile phones, etc. are generally equipped with an input device 903 and a display device 904, and receive web services using a browser 905 installed on them.

[0051] The web service provider's data center 911 stores various information for the client 901 and the application server 912 that controls requests from the client 901 and services corresponding to the requests. Equipped with database 'server 91 3. The application server 912 controls the web server 914 that controls communication with the Internet 900 using public telephone lines, private lines, wireless, etc., and the application software 915 that realizes the provision of services to the client 901. It consists of authentication software 916 that operates the authentication system. Additionally, the database server 913 holds application data 917 provided to the client, client user ID 918, password element group 919 used in the authentication system, scramble element group 920, and scramble element data 921.

[0052] Authentication procedures when providing web services via the Internet will be described below.

First, when a user initiates a connection to the application server 912 using the web browser 905 of the client 901, the application software 915 determines whether the user needs to be authenticated. If it is determined that it is necessary, the application software 915 instructs the authentication software 916 to start authentication.

[0053] Upon receiving the authentication instruction, the authentication software 916 instructs the web server 914 to display a user ID input screen. When the web server 914 sends the instruction to the web browser 905, the web browser 905 displays a user ID input screen on the display device 904. When a user enters a user ID from an input device 903, a web'browser 90 5 sends the entered user ID to the web server 914 via the Internet 900. Once the web'server 914 receives the user ID, the user ID is communicated to the authentication software 916.

[0054] When authentication software 916 receives a user ID, authentication software 916 selects password element group 919 and scramble element group 920 linked to the user ID, and generates an element selection group. When the element selection group is sent to the web server 914, the web server 914 sends the element selection group to the web browser 905 via the Internet 900 and instructs it to display an element selection screen. Upon receiving the element selection loop, the web browser 905 displays an element selection screen on the display device 904.

[0055] When the user selects a desired element using the input device 903, the web browser 905 transmits the selected selection element to the web server 914 via the Internet 900. Web server 914 communicates the selection to authentication software 916, which stores the selection in a predetermined memory location. Once the selection factors have been selected the number of times required for authentication, the authentication software 916 checks the selection factors against the password factor group 919 and transmits the authentication or non-authentication results to the web server 914. Also displayed on display screen 904. If the authentication is successful, the web server 914 allows the application 'software 915 to provide the web' service; if the authentication is not successful, the web server 914 stops providing the web service.

[0056] USB memory

A USB memory is a memory device that can be connected to a computer's USB port.It is small and lightweight, making it easy to carry, but if it is lost, the contents stored in the memory can be stolen. It has the following drawback. By applying the present invention to a USB memory, the contents of the memory cannot be referenced without going through an authentication procedure, thereby increasing the security of the USB memory.

[0057] FIG. 10 is a block diagram for explaining the configuration of an authentication system when the present invention is applied to a USB memory. The USB memory 101 is used as an external memory for general-purpose personal computers (PCs) 1 10, so it will be used as an external memory for Windows, Macintosh, etc. An application example will be described in which the device is connected to a personal computer 110 equipped with a USB interface 100. As shown in FIG. 10, the computer 110 has a display device 111 and an input device 112, and typically executes predetermined processing by executing application software 113.

[0058] The USB memory 101 is divided into a non-access restricted memory area 102 which is not always restricted from access from the personal computer 110, and an access restricted memory area 103 where access is restricted. Access to the restricted access memory area 103 from the personal computer 110 is controlled by an access control unit 104. In other words, the access control unit 104 normally blocks access from the personal computer 110 to the limited access memory area 103. If authentication is obtained, the access control unit 104 opens the limited access memory area 103 to the personal computer 110. do. A non-access restricted memory area 102 stores an authentication software 'image 105, which is a program necessary to carry out an authentication procedure, all data 106 of a mixed element group containing both a password element and a scramble element, and scramble element data 107. I remember. These data only need to be retained for one user by the owner of the USB memory. The access restricted memory area 103 is provided with a data file 108 as an area for computer users to store various information.

[0059] The password factor settings for authentication on the USB memory 101 configured as above are as follows. When the password element is set and the USB memory 101 is inserted into the USB interface 100, the OS driver 114 downloads the authentication software image 105 from the non-access restricted memory area 102 to the personal computer 110 as the authentication software 115. When the authentication software 115 starts, a password element input screen appears on the display device 111, and the user inputs a predetermined number of password elements according to the instructions. The authentication software 115 uses the scrambled element data 107 to generate a scrambled element group corresponding to the inputted password element group, and creates a mixed element group together with the inputted password element group to all data 106 of the mixed element group. Store. In addition, the input password element groups are arranged in a predetermined order and then converted into a single character string. This converted string is encrypted to generate a unique encryption key. This encryption key 109 is sent to the access control unit 104 and stored for access.

[0060] The procedure at the time of authentication is executed as follows. When the user inserts the USB memory 101 into the USB port of the personal computer 110, the OS driver 114 of the personal computer 110 reads the authentication software 'image 105 from the non-access restricted memory area 102 to the personal computer 110, and starts the authentication software 115. When the authentication software 115 starts up, the authentication procedure begins. Authentication software 115 reads all data 106 of the mixed element group from non-access restricted memory area 102 and generates selected element groups created from the mixed element groups. The selected element group is then displayed on the display device.

[0061] When the user selects a desired element in the selection element grouping force using the input device 112, the authentication software 115 stores the selected selection element. When the number of selection elements required for authentication is completed, the authentication software 115 arranges the selection element groups in a predetermined order and converts them into one character string. This converted character string is subjected to the same encryption process described above to generate an authentication key. This generated authentication key is sent to the access control unit 104. The access control unit 104 checks whether the encryption key 109 held by the access control unit 104 and the authentication key match. If they match, the access control unit 104 grants authentication and opens the restricted access memory 103 to the personal computer 110, and if they do not match, it considers the authentication to be unauthorized and transmits the result to the authentication software.

[0062] Next, another embodiment in which the authentication system according to the present invention is applied to a USB memory will be described. FIG. 11 is a block diagram for explaining this embodiment. In FIG. 11, the same reference numerals as those shown in FIG. 10 represent the same elements, so a description thereof will be omitted. The embodiment shown in FIG. 10 allows access to the data stored in the access-restricted memory 108 only to those who have been authenticated, and prohibits access to those who have not been authenticated. prohibit. In contrast, the embodiment shown in FIG. 11 encrypts data 116 using a password element group, and stores the result in encrypted data file 117 of USB memory 101. To read encrypted data, perform the reverse process of encryption to decrypt it.

[0063] The setting of mixed element group 106 is the same as the method described above, and will therefore be omitted. Mixed element group 106 is stored in USB memory 101!, data 116 is U The procedure for storing encrypted data in the SB memory 101 in the file 117 will be explained. When the USB memory 101 is connected to the computer 110, the authentication software image 105 is downloaded and the authentication software 115 is started. Thereafter, when attempting to store the data 116 in the USB memory 101, the authentication software 115 takes in the mixed element group 106 and requests selection of a selection element. Next, by arranging the selected selection elements in a predetermined order and performing hash processing on the array, a key that always has the same value and an appropriate size for the selected selection elements is generated. do. After encrypting the data 116 using this key, it is stored in the encrypted data file 117 in the USB memory 101. Once the encryption process is complete, the key is destroyed.

[0064] Next, the procedure for importing the encrypted data' file 117 into the personal computer 110 will be explained. When the USB memory 101 is connected to the computer 110, the authentication software 'Image 105' is downloaded and the authentication software 115 is started. Thereafter, when an attempt is made to import the encrypted data file 117 in the USB memory 101 to the personal computer 110, the authentication software 115 imports the mixed element group 106 and requests selection of a selection element. Next, the same key as in the encryption process is generated from the selected selection element using the same procedure as in the encryption process. Using this key, the encrypted data file 117 is decrypted by performing the reverse process of encryption. The file obtained in this way is displayed on the display device 111 of the personal computer 110 or stored in the data 116. Once the decryption process is complete, the key is destroyed. Furthermore, if the selected selection element is different from that used for encryption, a key value different from that used for encryption is generated, so the encrypted data file 117 cannot be decrypted.

[0065] In the embodiment described above, the password element group itself is held in the USB memory 101, so even if the USB memory 101 is analyzed and the mixed element group 106 is obtained, the password element group itself is retained. It is difficult to obtain and extremely safe.

Industrial applicability

[0066] Since the frequency of appearance of the password element and the scramble element can be made almost equal, making it difficult to guess the password element, it can be applied to any authentication system, program, device, etc. that requires identity verification.

Claims

The scope of the claims

[1] means for storing a preselected N password element group;

means for generating M scrambling element groups having N scrambling element forces different from the nosword element;

The password element group strength A mixture of one extracted password element and M scramble elements created by extracting one scramble element from each scramble element group of the M scramble element groups. means for generating K element groups, where N, M, and K are positive integers and K≤N, and the password element is generated from remaining nosword elements not yet extracted from the password element group. means for generating mixed element groups, wherein said scramble elements are extracted from each said scramble element group, and residual scramble element forces not yet extracted are also extracted;

Display means for displaying the mixed element group;

means for selecting a selection element from each mixed element group displayed on the display means;

An authentication system comprising: authentication means for providing authentication when the selection element matches the password element.

[2] The authentication system according to claim 1, wherein the nosword element and the scramble element belong to the same category.

[3] The authentication system according to claim 2, wherein the same category is a name.

[4] The authentication system according to claim 1, wherein the password element and the scramble element are composed of at least one of still image information, video information, and sound information.

[5] The authentication system according to claim 1, wherein the nosword element and the scramble element are each associated with an extracted indicator indicating that they have already been extracted.

[6] The scramble elements are randomly selected from pre-stored scramble element data. 2. The authentication system according to claim 1, wherein the authentication system is issued.

[7] The authentication system according to claim 1, further comprising means for shuffling the elements in the mixed element group before displaying the mixed element group on the display means.

[8] The authentication system according to claim 1, wherein the mixed element group is displayed on the display means every time the mixed element group is generated.

[9] The authentication according to claim 1, further comprising means for adding a predetermined number of supplementary scrambling elements different from the nosword element and the scrambling elements included in the scramble element group to the mixed element group. system.

[10] The authentication system according to claim 1, wherein the authentication means provides authentication when the stored selection element partially matches the password element.

[11] A claim characterized in that the display means and the input means are respectively coupled to a means for generating the mixed element duplex and a means for storing the selected element via a telecommunication line. Authentication system described in 1.

[12] Means for generating an encryption key by encrypting the password element group based on a predetermined encryption procedure, and storing the encryption key;

further comprising means for generating an authentication key by encrypting the selection element based on the predetermined encryption procedure,

2. The authentication system according to claim 1, wherein the authentication means provides authentication when the encryption key and the authentication key do not match.

13. The authentication system according to claim 1, further comprising an encryption unit that generates encrypted data by encrypting data using the password element group when the authentication is granted.

14. The authentication system according to claim 13, further comprising decryption means for decrypting the encrypted data to generate the data using the password element group when the authentication is granted.

[15] storing a preselected N password element group; generating M scramble element groups with N scramble element forces different from the nosword element;

The password element group strength A mixture of one extracted password element and M scramble elements created by extracting one scramble element from each scramble element group of the M scramble element groups. a step of generating K element groups, where N, M, and K are positive integers and K≤N, and the password element is generated from remaining nosword elements not yet extracted from the password element group. generating mixed element groups, wherein the scramble elements are extracted from each of the scramble element groups, and residual scramble element forces not yet extracted are also extracted;

displaying the mixed element group on a display device;

selecting a selection element from each mixed element group displayed on the display;

An authentication method comprising: providing authentication if the selection element matches the password element.

[16] The authentication method according to claim 15, wherein the nosword element and the scramble element belong to the same category.

[17] The authentication method according to claim 16, wherein the same category is a name.

[18] The authentication method according to claim 15, wherein the password element and the scramble element are composed of at least one of still image information, video information, and sound information.

[19] The authentication method according to claim 15, wherein the nosword element and the scramble element are each associated with an extracted indicator indicating that they have already been extracted.

[20] The authentication method according to claim 15, wherein the scramble element is randomly extracted from pre-stored scramble element data.

[21] The recognition device according to claim 15, further comprising means for shuffling the elements in the mixed element group before displaying the mixed element group on the display means. How to prove it.

[22] The authentication method according to claim 15, characterized in that each time the mixed element group is generated, the mixed element group is displayed on the display means.

[23] The authentication method according to claim 15, further comprising means for adding a predetermined number of supplementary scramble elements different from the password element and the scramble elements included in the scramble element group to the mixed element group. .

[24] The authentication method according to claim 15, wherein the step of providing authentication includes a step of providing authentication when the stored selection factor partially matches the password factor.

[25] The method further includes transmitting the mixed element group onto the display device via a telecommunication line, and transmitting the selection element for authentication via the telecommunication line. 16. The authentication method according to claim 15, characterized in that:

[26] generating an encryption key by encrypting the password element group based on a predetermined encryption procedure, and storing the encryption key;

further comprising the step of generating an authentication key by encrypting the selection element based on the predetermined encryption procedure,

providing authentication if the encryption key and the authentication key match;

16. The authentication method according to claim 15, characterized in that:

[27] The authentication according to claim 15, further comprising an encryption step of encrypting data using the password element group to generate encrypted data when the authentication is granted. Method.

28. The authentication method according to claim 27, further comprising a decrypting step of decrypting the encrypted data to generate the data using the password element group when the authentication is granted.

[29] storing a preselected N password element group;

generating M scramble element groups with N scramble element forces different from the nosword element; The password element group strength A mixture of one extracted password element and M scramble elements created by extracting one scramble element from each scramble element group of the M scramble element groups. a step of generating K element groups, where N, M, and K are positive integers and K≤N, and the password element is generated from remaining nosword elements not yet extracted from the password element group. generating mixed element groups, wherein the scramble elements are extracted and the scramble elements are extracted from each scramble element group, and residual scramble element forces not yet extracted are also extracted;

displaying the mixed element group on a display device;

an authentication program for causing a computer to perform the steps of: providing authentication when the selection element matches the password element;

[30] The authentication program according to claim 29, wherein the nosword element and the scramble element belong to the same category.

[31] The authentication program according to claim 30, wherein the same category is a name.

[32] The authentication program according to claim 29, wherein the password element and the scramble element are composed of at least one of still image information, video information, and sound information.

[33] The authentication program according to claim 29, wherein the nosword element and the scramble element are each associated with an extracted indicator indicating that they have already been extracted.

[34] The authentication program according to claim 29, wherein the scramble element is randomly extracted from pre-stored scramble element data.

35. The authentication program according to claim 29, further comprising the step of shuffling the elements in the mixed element group before displaying the mixed element group on the display means.

[36] The authentication program according to claim 29, wherein each time the mixed element group is generated, the generated mixed element group is displayed on the display means.

[37] The authentication program according to claim 29, further comprising the step of adding a predetermined number of supplementary scramble elements different from the password element and the scramble elements included in the scramble element group to the mixed element group. .

[38] The authentication program according to claim 29, wherein the step of providing authentication includes a step of providing authentication when the stored selection factor partially matches the password factor.

[39] The method further includes transmitting the mixed element group onto the display device via a telecommunication line, and transmitting the selection element for authentication via the telecommunication line. 30. The authentication program according to claim 29.

[40] generating an encryption key by encrypting the password element group based on a predetermined encryption procedure, and storing the encryption key;

30. The authentication program according to claim 29.

41. The authentication program according to claim 29, further comprising the step of generating encrypted data by encrypting data using the password element group when the authentication is granted.

42. The authentication program according to claim 41, further comprising the step of decrypting the encrypted data to generate the data using the password element group when the authentication is granted.