WO2019026873A1 - Mutual authentication system, authentication image, and recording medium - Google Patents

Abstract

A mutual authentication system is provided for easily performing personal authentication without increasing security risk. A mutual authentication system for mutually authenticating that an issuer and a user are valid, the system using a two-dimensional code including issuer information, application information that includes information about the user that was submitted by the user, and ID information associated with the application information, the ID information being configured by combining a plurality of character strings, wherein the mutual authentication system is characterized by having: a colored figure formation means that forms a unique colored figure diagram that differs according to each of the ID information items; a colored figure determination means that decodes the ID information from the colored figure diagram using a combination pattern of a basic colored figure diagram corresponding to each character string; and an authentication means that determines whether the ID information decoded by the colored figure determination means corresponds to the issuer information included in the two-dimensional code.

Description

Mutual authentication system, authentication image and recording medium

The present invention relates to a mutual authentication system, an authentication image used in the mutual authentication system, or a recording medium on which the authentication image is printed.

In the personal identification system of a financial institution, a method is used in which a sealed letter is mailed based on user information such as an address and a telephone number input by the user for security improvement, and authentication is performed using a code described in the sealed letter. There is.
However, in such a method, it takes time and effort for the user to access the URL written in the sealed letter using his / her portable terminal and the like and to input the PIN code etc. written thereon, which requires the user's authentication. It was a lot of trouble.
In addition, as an example of mailed articles that are difficult to be disguised, for example, a method of using a color print as described in Japanese Patent Application No. 2017-014559 (Japanese Patent Application No. 2016-016243) can be considered. It is difficult to associate with the crest.

In order to avoid such problems, as a method of easily accessing information on the Web using a portable terminal, for example, a method of using a two-dimensional code such as QR code (registered trademark, hereinafter the same) may be considered (for example, Patent Document 1 etc.).
However, since the QR code can basically be accessed by anyone if it can be read, security risks such as being seen by a third party along the way will increase.

In addition, in such a mailing method, for example, when a malicious third party sends a QR code, there is a problem that the user may access carelessly, and the user and the issuer mutually authenticate each other. It is most desirable to be a possible method.

JP, 2009-124311, A

The present invention is intended to solve such a problem, and an object thereof is to provide a mutual authentication system for simply performing personal authentication without increasing security risk.

In order to solve the problems described above, the mutual authentication system of the present invention links the two-dimensional code including the issuer information, the application information including the information of the user who has applied for the user, and the application information. A mutual authentication system for mutually authenticating that an issuer and a user are valid using ID information configured by combining a plurality of character strings, each of the ID information The color print forming means for forming a unique color print figure different depending on the type, the color print judgment means for decoding the ID information from the color print figure using a combination pattern of basic color print figures corresponding to each character string; And authentication means for determining whether or not the ID information decoded by the color design determination means corresponds to the issuer information included in the two-dimensional code.

According to the present invention, user authentication can be easily performed without increasing security risk.

It is a figure which shows an example of the whole structure of the mutual authentication system which concerns on embodiment of this invention. It is a figure which shows an example of the information recorded as application information. It is a figure which shows an example of the information recorded as registration information. It is a figure which shows an example of the information contained in registration information. It is a conceptual diagram about the structural example of the token containing the issuer information shown in FIG. It is a figure which shows the symbol for authentication shown in FIG. It is a flowchart which shows an example of the authentication operation | movement of the mutual authentication system shown in FIG. It is a figure which shows exchange of the data of the mutual authentication system shown in FIG. It is a figure which shows an example of a structure of the 2nd Embodiment of this invention. It is a figure which shows an example of a structure of the modification of this invention.

A mutual authentication system 100 will be described as a first embodiment of the present invention.
The mutual authentication system 100 is registered as a portable terminal 10 as an information communication terminal such as a smartphone or a portable telephone used by the user P, and as a registration means managed by an issuer Q who provides the service to the user P. It is a network system comprised including server 50.
The mutual authentication system 100 generates a printing pattern forming an authentication pattern as an authentication image based on application information including personal information of the user P input by the user P accessing the registration server 50. It has a drop printout issue server 80.
The mutual authentication system 100 has an authentication server 60 as an authentication means for authenticating the user P using an authentication pattern described later.

In this embodiment, a method is described in which the user P applies for acquisition of the credit card issuing service provided by the issuer Q, and the user P and the issuer Q mutually authenticate each other, but the present invention is limited to such a configuration. It is not something to be done.
Moreover, although the registration server 50 and the authentication server 60 are separately provided in the present embodiment, the integrated server may have the function of the registration server 50 and the function of the authentication server 60.
Further, in the present embodiment, for simplification of the description, as shown in FIG. 1, the issuer Q is configured to manage all of the registration server 50, the authentication server 60, and the color print issue server 80. It is not limited to the configuration. For example, the issuer Q may use the external registration server 50, the color print issuing server 80, or the authentication server 60.

The registration server 50 is a web server that provides a service provided by the issuer Q, here, for example, a credit card issue service.
The registration server 50 has an information input unit 51 for the user P to register the user's own personal information, that is, the application information R, and the application information R of the user P and the issuer Q inputted to the information input unit 51. And a token issuing unit 52 that issues a token such as JWT (JSON Web Token) based on the issuer information.

Here, the application information R is information including personal information such as the address and telephone number of the user P as shown in FIG. 2, and the registration server 50 receives such information input by the user P itself and the issuer Based on the information such as the identification number of Q, it is recorded as registration information R 'including the information of the issuer Q, with the color print ID 92' and the effective period added as shown in FIG.
The color print ID 92 'is an ID number composed of an array of 6 to 8 alphanumeric characters, and is randomly issued ID information. In the present embodiment, the color print ID 92 'is represented by an array of 6 to 8 alphanumeric characters. However, the present invention is not limited to such a configuration, and an arbitrary number of digits, a character string, a symbol or the like may be used. It is possible.
According to the structure of a signature to be described later, the color print ID 92 'itself may be duplicated, and a combination of the color print ID 92' and the registration information R 'is registered in the registration information R'.
As shown in FIGS. 4 and 5, the token issuing unit 52 issues at least an issuer identification number for identifying the issuer Q, an issue date and time, a valid period, a start date / end date of the valid period, a destination, etc. Issue JWT, which is a token that contains The JWT is a URL safe token, and is signed using the color printing ID 92 '.
Note that "URL safe" indicates that characters such as symbols that can not be included in the URL are not included, and here, the token itself is used in a sense that it can be used as part of the URL.

Before describing JWT, a process called HMAC (Hash-based Message Authentication Code), which is also called keyed hash, will be described.
HMAC is a mechanism for detecting tampering and impersonation by using an iterative encryption hash function such as SHA-2 in combination with a key.
JWT is a token obtained using such HMAC, and as shown in FIG. 5, it is divided into a header, an entity, and a footer.
The JWT matches the footer (or entity) when processing the value in the entity (or footer) by the header algorithm.
That is, the JWT is generated by extracting some information from the registration information R ′, for example, the information shown in FIG. 4 as an entity, and processing based on an algorithm included in the header with the color printing ID 92 ′ as a key. It is a token.
In the present embodiment, such a process is described as “(JWT) is signed by the fingerprint ID 92 ′”, but such a process uses the fingerprint ID 92 ′ as an entity in FIG. The contents of the entity of are also established as a key.

It is desirable that the JWT include a one-time key as a countermeasure against a so-called replay operation in which authentication is performed multiple times using the same token. That is, in this embodiment, the number control function of limiting the number of readings to the token is added.
With this configuration, since the authentication operation by the authentication server 60 described later is authenticated only at the first time, the security strength is further improved.
In the present embodiment, an entity of a token is created using information as shown in FIG. 4 in particular. However, the present invention is not limited to such a configuration, and other information may be included as additional information.

The registration server 50 transmits the registration information R ′ to the color print issuance server 80.
In the present embodiment, although the registration server 50 for performing authentication and token issuance and the separate server from the color print issue server 80 are described as being connected via a network, the configuration is limited to such a configuration. is not.
For example, it may be configured to have all functions of authentication, token issuance, and color printing on the same terminal.

The color print issuing server 80 hashes the JWT obtained based on the registration information R ′ and embeds it in the form of a two-dimensional code such as a QR code, and combines a list of numbers of color print ID 92 ′ with basic color print figures Convert to a color pattern using a pattern.
In other words, the color print issuing server 80 issues a color print forming unit 81 that forms a color print pattern based on the color print ID 92 ′ and a QR code 91 as a first two-dimensional code based on the registration information R ′. And a dimensional code generation means 82.
In the present embodiment, the QR code is used as a two-dimensional code to increase the availability of reading, but the present invention is not limited to this configuration, and other two-dimensional codes may be used. Moreover, a barcode etc. may be sufficient.

The two-dimensional code generation means 82 forms a hash code, which is an access code obtained by hashing the JWT in particular among the registration information R ′, as a QR code 91 as shown in FIG.
The URL of the authentication server 60 is described in the QR code 91. For example, the portable terminal is connected to the URL such as http: // ********** / hash code / etc. ing.

Based on the color printing ID 92 ', the color printing pattern forming means 81 converts the pattern of serial numbers into a precise geometric pattern combining unique wavy lines, arcs or circles as shown in FIG.
The pattern at this time is referred to as a "color print" and illustrated as a color print figure 92.
Such a color pattern is a unique pattern configured to be all different based on each of the color ID 92 ', so the color forming means 81 forms a unique color pattern that is different for each of the ID information. .
The color print is a set of basic figures defined by 6 to 8 alphanumeric characters in the present embodiment, and it is easy to guess the numbers when the user P or a third party sees the color print 92. It is stylized so that it can not be done.
With this configuration, even if the third person steals the color pattern 92, it is difficult to forge or copy.

In addition, regarding the generation means and the printing method of the color design graphic 92, for example, the patterns of ten types of basic color design graphic of 0 to 9 specific shapes are superimposed in a specific size at a specific position by the number of digits. Methods are conceivable.
In addition, printing may be performed by the printing method as shown in Japanese Patent Application No. 2016-016243 already mentioned.

The color print issuing server 80 uses the QR code 91 and the color print 92 formed so as to surround the QR code 91 as a sheet 90 as an authentication pattern 93 that functions as an authentication image that is an integrated design. Print on a sheet of paper.

In addition to the authentication symbol 93, for example, the delivery address of the user P, the name, the expiration date of the authentication symbol 93, the guidance of the authentication method, etc. may be described on the sheet 90.
Further, for example, a pass code such as a PIN code input by the user P at the time of applying for the application information R may be written for identification.
That is, the sheet 90 functions as a recording medium for authentication used in the mutual authentication system 100 in the present embodiment.

The issuer Q sends the mailed sheet 90 outputted by the color print issuing server 80 to the user P by mail.
As described above, by sending the sheet 90 to the place designated by the application information R, it is confirmed that the applicant user P who is required for the examination item of the card is the person of the registered address and name. be able to.
In addition, although it was set as mail here, another method may be used. Further, in the present embodiment, the sheet 90 which is a printed matter is delivered to the user P as mail because it is a credit card application process, but in the case where personal identification may be looser, For example, the authentication symbol 93 may be sent by e-mail or the like.

The authentication server 60 determines whether or not the color design determination means 61 for identifying the color design figure 92 from the image of the authentication pattern 93 and the color design figure 92 identified by the color design determination means 61 are valid. And a color print authentication means 62.
The authentication server 60 includes a token database 63 in which tokens issued by the token issuing unit 52 are recorded, and a QR code authentication unit 64 that authenticates the validity of the QR code 91 using the token database 63 and the QR code 91; have.

The color design determination unit 61 is an image recognition unit that decomposes and identifies the color pattern 92 and the QR code 91 from the image data in which the QR code 91 and the color pattern 92 are included in the same image.
For example, in the case of an authentication pattern as shown in FIG. 6, the QR code 91 is read using the identifiers arranged at the four corners of the QR code 91, and a portion other than the QR code 91 is used among the image data. And identify the color pattern 92.

Now, a mechanism for mutual authentication using the mailed sheet 90 will be described with reference to FIGS. 7 and 8. FIG.

As shown in FIG. 7, when the sheet 90 is delivered to the user P, it is confirmed that the “address” and the “user P”, which are the conditions necessary for the authentication of the financial institution, are valid. Ru.
The user P first captures the sheet 90 using the application 102 installed on the portable terminal 101 in hand.
At this time, the user P captures an image such that at least a part of the authentication symbol 93 fits in the same image, and acquires the image data 94 (step S101). In addition, although "at least one part" may be suitably designed in the range which the certification | authentication of the authentication pattern 93 passes, that all the identifiers arrange | positioned at the four corners of QR Code 91 enter, 1/4 or more of the color pattern 92 It is desirable to satisfy two points of including.
Since the color pattern 92 has periodicity, it is possible to determine the color ID 92 'if there is 1/4 or more of the whole.

Also, in step S101, for example, the application 102 may, as its function, identify whether the mailed paper itself is definitely that of the issuer Q or not.
Specifically, for example, a minute color print, a graphic for identification, or the like may be printed on the sheet 90 itself, and the recognition pattern 93 may be recognized on condition that the color print for identification is recognized. .
According to this configuration, for example, even when the third party spoofs the issuer Q and sends a similar product of the sheet 90, there is an advantage that the user P is not made to access unnecessarily.

When the application 102 captures the image data 94, it reads the QR code 91 (step S102).
As described above, since the URL of the authentication server 60 is designated as the access destination in the QR code 91, the application 102 connects to the corresponding URL (authentication server 60) according to the instruction.
At this time, the URI of the connection destination is a connection destination unique to the user P because the JWT includes the hash code hashed.
The application 102 then transmits the image data 94 to the authentication server 60 (step S103).
The authentication server 60 decomposes and identifies the image data 94 into the color pattern 92 and the QR code 91 using the color pattern determination unit 61 (step S104).

The color print authentication means 62 decodes the 6 to 8 digit color print ID 92 ′ based on the combination of the periodicity and the shape of the color print 92 by an operation reverse to that performed by the color print forming means 81. In other words, the color design graphic 92 which has been decomposed is inversely converted from the color design graphic 92 to the color print ID 92 'by the color print authentication means 62 (step S105).

For the QR code 91 divided in step S104, in parallel with the authentication by the color print authentication unit 62, the authentication of the QR code 91 itself is advanced by the QR code authentication unit 64.
The QR code authentication means 64 reads the QR code 91, and compares the obtained hash code with the corresponding JWT recorded in the token database 63 with a signature signed using the fingerprint ID 92 'as a key ( Step S110).
As a result of this comparison, the combination of the image pattern 94, that is, the combination of the color design graphic 92 written on the sheet 90 delivered to the user P and the QR code 91 corresponds to the registration information R ′ recorded in the registration server 50. It can be determined without referring to the registration information R '.

This point is specifically described.
Although the registration information R ′ registered in the registration server 50 includes various personal information, it is possible to transmit and receive the registration information R ′ as it is between the registration server 50 and the authentication server 60 on the way route. Create unnecessary security risks such as reading.
Therefore, in the present embodiment, the JWT is generated based on the registration information R ′, and the result obtained by signing the JWT with the HMAC is further hashed into a hash code using the color print ID 92 ′ as a key.
The hash code is a connection destination of the QR code 91, and can be restored from the QR code 91.
Here, if the application 102 performs processing to download the JWT main body when accessing the above hash code, the hash code included in the URI read from the QR code is compared with the hash of the JWT main body downloaded from the URI -By confirming, it is possible to confirm that the JWT main body in the authentication server 60 is not falsified also on the user P side.
Such comparison may not be made. In such a case, the application 102 only needs to receive authentication as described later, and there is no need to download the JWT main body, so there is an advantage that transmission and reception of the JWT becomes unnecessary and the entity of the JWT is not acquired illegally.

Now, when the JWT is signed using the HMAC with the color print ID 92 'as a key, the original information can not be restored from the hash code which is a hash value obtained from the JWT.
At this time, JWT is a token including the registration information R ′ transmitted by the user P to the registration server 50.

If an entity generated based on the registration information R 'is signed by the fingerprint ID 92' by the same procedure, the same token can be obtained. Therefore, since the hash value is identical, it is used for the signature in the HMAC. It is possible to certify that the combination of the printed color print ID 92 'and the token is valid.

Therefore, the authentication server 60 receives the JWT from the registration server 50 and records it in the token database 63.
Since the JWT is recorded in the token database 63, the sheet 90 possessed by the user P and the JWT obtained from the registration information R 'are valid when the token authentication means 62 performs the operation of step S110. It can authenticate that it is a thing.

The authentication server 60 determines whether or not both step S106, which is the color printing authentication step of the color printing authentication means 62, and step S110, which is the QR code authentication step of the QR code authentication means 64, are approved. (Step S120).
In step S120, on the condition that all are authenticated as valid, the authentication server 60 returns the result of having been authenticated to the portable terminal and transmits the instruction code 65 to the portable terminal (step S201).
If it is determined in step S120 that the content is not valid, the fact that authentication is not possible is returned to the portable terminal (step S121).

In the present embodiment, the instruction code 65 is a code for instructing to make a call to the registration server 50 managed by the issuer Q or a specific telephone number.
In step S201, when the application 102 receives the instruction code 65, the application 102 calls a specific telephone number and the user P is required to input the PIN code input by the user P at the time of registration (step S202).
In step S202, it can be confirmed whether the telephone number of the user P, which is required in the registration conditions of the financial institution, is the user P's own personal number.
With this configuration, when it is necessary to confirm the telephone number of the user P, it is possible to simultaneously confirm whether or not the telephone number of the user P has been called by carrying out such processing.

In addition, since the telephone number is required as the registration condition of the financial institution in step S201 and subsequent steps, it is performed by the mutual authentication system, but the registration condition is appropriately changed according to each field. good.
Here, since it is assumed that the PIN code is entered by the user P at the time of registration, it is not necessary to enter the PIN code on the sheet 90, and it is possible to register the financial institution in consideration of security.

In addition, if the sheet 90 is distributed to the address of a voter registered in a family register, it can be a voting ticket used for electronic voting on condition that the certification is established. According to this configuration, it is possible to easily detect a plurality of votes by electronic voting using the JWT one-time key, and for the exchange for a regular voting ticket, confirmation may be made at the exchange station as before. The effort is reduced.

In the present embodiment, the color pattern figure 92 is colored using the color pattern forming means 82 that forms unique color pattern figures different depending on the color pattern ID 92 'and the combination pattern of the basic color pattern figures corresponding to each character string. Authentication to determine whether or not the color design determination unit 61 that decodes the pattern ID 92 ′ and the color formation ID 92 ′ that is decoded by the color design determination unit 61 correspond to the issuer information included in the QR code And a means 60.
With this configuration, user authentication can be easily performed without increasing security risk.
In addition, since the user P only needs to send the image data 94 obtained by photographing the authentication symbol 93, the complexity of the operation at the time of authentication can be reduced.

In the present embodiment, a QR code is used as a two-dimensional code. With this configuration, the speed of reading is improved to improve convenience, but authentication is not performed only by reading. Therefore, even if a third party steals the sheet 90, there is no security problem. Reduce security risk.

Further, in the present embodiment, the QR code 91 is formed based on a token including issuer information.
With this configuration, if tampering is performed including the information of the issuer Q, the authentication by the token is not passed, thereby enhancing security.

Further, in the present embodiment, the JWT has a frequency control function for limiting the number of times of reading.
With this configuration, it is possible to take measures such as displaying a warning screen by multiple registration even when, for example, the already-used sheet 90 tries to pass through the authentication of the authentication server 60 again.

Further, in the present embodiment, the authentication server 60 authenticates that the JWT including the information of the issuer Q described in the QR code 91 is signed with the color print ID 92 ′ as a key.
With this configuration, the authentication does not pass even when the information of the issuer Q is falsified, so the security against impersonation is enhanced.

Moreover, the mutual authentication system of this embodiment authenticates using the authentication pattern 93 in which the QR code 91 and the color design figure 92 were integrally formed, and the sheet | seat 90 on which the authentication pattern 93 was printed. .
The authentication server 60 confirms that the seat 90 is valid by photographing the authentication symbol 93.
With this configuration, the user P can authenticate that the mail delivered to the user P is genuine only by photographing the authentication symbol 93, thereby achieving both security improvement and convenience improvement. it can.

Further, in the present embodiment, the authentication symbol 93 is formed integrally with the QR code 91 and the color design figure 92, and the color design figure 92 is formed to surround the QR code 91.
With this configuration, if the QR code 91 and the color pattern 92 can not be recognized in the same image at the time of shooting, the authentication fails, so the authentication does not pass unless it is an identical copy, so security risks such as spoofing etc. It can be reduced.

As a second embodiment of the present invention, a mode in which the authentication server 60 is not used will also be described.
In the present embodiment, as shown in FIG. 9, the mutual authentication system 200 is a mutual authentication system using a distributed file management system called InterPlanetary File System (IPFS) that determines an address using a hash of a data object.

The mutual authentication system 200 has the same configuration as that of the first embodiment but differs only in the authentication method.
In the IPFS distributed file management system, when the user P records the application information R in the registration server 50, the registration server 50 adds the information of the issuer Q to the application information R to generate registration information R '. .
Further, the token issuing unit 52 issues the JWT signed with the color print ID 92 'in the form including the information of the issuer Q similarly to the first embodiment based on the registration information R'.
Since such a JWT is generated at the same time as the hash value obtained by hashing the JWT becomes an address, the generation of the registration information R ′ including the color print ID 92 ′ makes it impossible to know the color print ID 92 ′ or the QR code 91 As long as the address is not reached.

When the user P shoots the color pattern 92 and the QR code 91 using the application 102, the QR code 91 is first read, and a hash code having a hashed JWT is generated as in the first embodiment. Ru.
Since the hash code is the address of the main body of the JWT issued by the token issuing unit 52, the application 102 can connect to the address of the JWT to download the JWT main body.

The mutual authentication system 200 decodes the color print ID 92 ′ from the image data 94, and the one obtained by signing the JWT main body placed at the address specified by the QR code 91 with the color print ID 92 ′ matches the address. Determine if it is.
When they match, the JWT main body at the address concerned is transmitted to the portable terminal, and when it does not match, it is displayed on the application 102 that the authentication has not been performed.
Such determination is an action similar to step S120 in the first embodiment, and the mutual authentication system 200 itself has a function as an authentication unit.
By such a method, the registration information R ′ is stored at an address that can not be analogized from the outside simultaneously with the generation of the JWT, and only the user P possessing the sheet 90 can access the address, It can be authenticated that the user P is a valid user.

In this embodiment, such an authentication means is performed by the IPFS file system itself, but it is sufficient if the address is determined by the hash and the signature is made by the ID information corresponding to the color print ID. Specifically, even in the case of a distributed ledger system such as a block chain, for example, a similar authentication system is established (see Non-Patent Document 1 for the IPFS implementation of the block chain).

In addition, as a modified example of the present invention, a point giving system using the color design graphic 92 and the QR code 91 will be described. In the following description, the same parts as those in the first embodiment will be assigned the same reference numerals and descriptions thereof will be omitted.

The point provision system 300 is an authentication system using a sheet 90 on which a QR code 91 and a color design graphic 92 are integrally printed, as in the first embodiment.
The point grant system 300 includes a token issuing unit 52 that issues a token such as JWT using the registration information R ′, a color print issue server 80, and an authentication server 60.

In the present modification, the registration information R 'is, for example, product information created based on information such as a sold store or item, a price, etc., and includes a color print ID 92'.

The color print issuing server 80 generates a color print forming means 81 that forms a unique color print figure different for each color print ID 92 ', and generates a two-dimensional code that issues a first two-dimensional code based on the registration information R'. And means 82.

The point grant system 300 sends a sheet 90 as a delivery note such as a receipt sent to the user P when the user P purchases at a store or a net shop.

Among such point grant systems, it is known that, for example, a printed matter in which a point code is described is enclosed in a product and the user P is caused to input the point code.
In addition, in the over-the-counter sales, there is also known one that presents a point card held by the user P in advance.
On the other hand, such a point code has the disadvantage that it takes time and effort to input and that the convenience of the user P is low because the point card must be possessed.
Also, if identity authentication is not performed at this time, it is not realistic because it can not cope with unauthorized acquisition of points by forgery or impersonation.
On the other hand, if the identity authentication is to be strictly carried out, the user P is required to input personal information which should not necessarily be necessary only for authentication, and the security risk is rather increased. There was also.

Therefore, in the point giving system 300 according to the present embodiment, authentication is completed only by photographing using the application 102 by using the sheet 90 on which the QR code 91 and the color design graphic 92 are integrally printed in the delivery note. Aims to provide such a mutual authentication system.

When the user P captures the sheet 90 using the application 102, the application 102 reads the QR code 91 and transmits the captured image data 94 to the authentication server 60.
The authentication server 60 authenticates in accordance with steps S101 to S120 of the first embodiment whether or not the QR code 91 and the color print ID 92 ′ are a valid combination.
According to such a configuration, it is possible to give points only to the person who has received the product without inputting information such as a point card in advance through the Internet shopping, so the convenience is improved.

Further, since the JWT is used for the QR code 91, it is difficult to disguise the issuer Q and falsify the expiration date, and the security risk can be reduced.
In addition, since the application 102 installed in the portable terminal is used, it is sufficient to link and manage the granted points with the application 102, so that the input of personal information becomes unnecessary, and the convenience of the user P is improved. At the same time, it is possible to reduce the security risk of entering unnecessary personal information.

Although the preferred embodiments of the present invention have been described above, the present invention is not limited to such specific embodiments, and the present invention described in the appended claims unless otherwise specified in the above description. Various modifications and changes are possible within the scope of the present invention.

The effects described in the embodiments of the present invention only list the most preferable effects resulting from the present invention, and the effects according to the present invention are limited to those described in the embodiments of the present invention is not.

50 Registration Server 60 Authentication Method (Authentication Server)
80 color print issuing server 81 color print forming means 82 two-dimensional code generation means 90 recording medium (sheet)
91 1st two-dimensional code (QR code)
92 color pattern 92 'ID information (color pattern ID)
93 Authentication design 100 Mutual authentication system 200 Mutual authentication system 300 Mutual authentication system (Point grant system)
R application information R 'registration information (including issuer information)

Claims (11)

1. A two-dimensional code containing issuer information,
   Application information including the user's own information applied by the user, and
   ID information associated with the application information and configured by combining a plurality of character strings;
   A mutual authentication system for mutually authenticating that an issuer and a user are valid using
   Color-print forming means for forming unique color-patterns that differ depending on each of the ID information;
   Color-print discrimination means for decoding the ID information from the color-arrangement figure using a combination pattern of basic color-arrangement figures corresponding to each character string;
   An authentication unit that determines whether the ID information decoded by the color design determination unit corresponds to the issuer information included in the two-dimensional code. Authentication system.
2. In the mutual authentication system according to claim 1,
   A mutual authentication system characterized by using a QR code as the two-dimensional code.
3. In the mutual authentication system according to claim 2,
   The mutual authentication system, wherein the QR code is formed based on a token including issuer information.
4. The mutual authentication system according to claim 3, wherein
   A mutual authentication system characterized in that a number control function for limiting the number of readings is added to the token.
5. The mutual authentication system according to claim 3 or 4, wherein
   The mutual authentication system characterized in that the authentication means confirms that the token including the issuer information described in the two-dimensional code is signed using the ID information as a key.
6. The mutual authentication system according to claim 5, wherein
   A mutual authentication system characterized by using a distributed file management system in which an address is determined by the token being signed by the ID information as the authentication means.
7. The mutual authentication system according to any one of claims 1 to 6, wherein
   The mutual authentication system, wherein the color print forming means forms a color print pattern by superposing combination patterns of basic color print patterns corresponding to respective character strings constituting the ID information.
8. The mutual authentication system according to any one of claims 1 to 7, wherein
   Using an authentication image in which the two-dimensional code and the color pattern are integrally formed, and a recording medium on which the image is printed,
   The mutual authentication system, wherein the authentication unit confirms that the recording medium is valid by photographing the authentication image.
9. An authentication image used in the mutual authentication system according to claim 8, wherein
   In the authentication image, the two-dimensional code and the color pattern are integrally formed.
   The authentication image characterized in that the color pattern is formed so as to surround the two-dimensional code.
10. A recording medium on which the authentication image according to claim 9 is printed.
11. The mutual authentication system according to any one of claims 1 to 8, wherein
    The mutual authentication system characterized in that the authentication means authenticates at least the two-dimensional code and a part of the color pattern using an authentication image photographed on the same screen.

Images