Authentication system and authentication server
The authentication system uses a terminal and server to verify the proximity of the two-dimensional code reader to its display location, preventing fraudulent use and ensuring secure authentication by limiting access to authorized users.
Patent Information
- Application Number
- JP2024129638
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2024-08-06
- Publication Date
- 2026-02-19
AI Technical Summary
Authentication systems using two-dimensional codes are vulnerable to fraudulent use and tampering, making it difficult to ensure secure and authorized access.
An authentication system that includes a terminal with a two-dimensional code reader and a server with a position comparator, which verifies the proximity of the terminal to the display location of the code, ensuring authentication only when within a predetermined distance.
Prevents unauthorized access by ensuring that the user is physically present at the display location, thereby enhancing the security of authentication procedures.
Smart Images
Figure 2026027618000001_ABST
Abstract
Description
[Technical Field]
[0001] The present invention relates to an authentication system and an authentication server that perform authentication using a two-dimensional code such as a QR code. [Background technology]
[0002] 2. Description of the Related Art An authentication system that reads two-dimensional codes such as QR codes to carry out various applications, requests, payment procedures, and the like is known, for example from Patent Document 1.
[0003] In such authentication systems using two-dimensional codes, a two-dimensional code is presented to the user to be authenticated, who then reads it and sends it to a server, etc., allowing the user to carry out the desired application, request, payment procedure, etc. However, there are cases where the two-dimensional code is sent fraudulently to an unauthorized user, and the unauthorized user uses the two-dimensional code. It should be prevented that unauthorized users can use the two-dimensional code to gain any benefits.
[0004] Furthermore, if a 2D code is tampered with, it is difficult to detect. A user who is presented with a tampered 2D code may read it and access the specified URL without realizing that it has been tampered with. This can result in fraudulent payments, phishing attacks, virus infections, and other damage. For this reason, authentication systems that use 2D codes are required to prevent fraudulent use and tampering of 2D codes and to execute authentication procedures safely. [Prior art documents] [Patent documents]
[0005] [Patent Document 1] Japanese Patent Publication No. 2022-14824 Summary of the Invention [Problem to be solved by the invention]
[0006] In view of the above problems, the present invention aims to provide an authentication system that prevents fraudulent use and tampering of two-dimensional codes and enables authentication procedures to be carried out safely. [Means for solving the problem]
[0007] The authentication system according to the present invention includes a terminal and a server that authenticates the terminal. The terminal includes a two-dimensional code reader that reads a two-dimensional code, a position information generator that generates terminal position information related to the position of the terminal or read position information related to the read position where the two-dimensional code was read, a request generator that presents the two-dimensional code to the server to request authentication, and a connection processor that executes connection processing between the server and the terminal when authentication is received by the server. The server includes a two-dimensional code analyzer that analyzes the two-dimensional code, a position comparator that compares the position indicated by the terminal position information or the read position information with the position where the two-dimensional code is presented, and a request processor that processes the authentication request based on the analysis result of the two-dimensional code analyzer and the comparison result of the position comparator. [Brief explanation of the drawings]
[0008] [Figure 1] 1 is an overall configuration diagram showing an authentication system 1 according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of the configuration of a terminal 10. [Figure 3] FIG. 2 is a block diagram illustrating an example of the configuration of a server 20. [Figure 4] 4 is a flowchart illustrating the operation of the authentication system 1 according to the first embodiment. [Figure 5] 4 is a flowchart illustrating the operation of the authentication system 1 according to the first embodiment. [Figure 6] FIG. 2 is a schematic diagram illustrating the effects of the authentication system 1 according to the first embodiment. [Figure 7] FIG. 10 is a block diagram showing a configuration of a terminal 10 of an authentication system 1 according to a second embodiment. [Figure 8] FIG. 10 is an overall configuration diagram illustrating an authentication system 1 according to a third embodiment. [Figure 9] 10 is a flowchart showing an authentication procedure in the authentication system 1 according to the third embodiment. [Figure 10] FIG. 10 is a block diagram illustrating the configuration of a terminal 10 of an authentication system 1 according to a fourth embodiment. [Figure 11] FIG. 10 is a schematic diagram illustrating the operation of the authentication system 1 according to the fourth embodiment. DETAILED DESCRIPTION OF THE INVENTION
[0009] Hereinafter, the present embodiment will be described with reference to the accompanying drawings. The accompanying drawings illustrate embodiments according to the principles of the present disclosure, but the drawings are for understanding the present disclosure and are not to be used to interpret the present disclosure in a limiting manner. The description in this specification is merely a typical example and does not limit the scope or application of the present disclosure in any way.
[0010] Although the present embodiment has been described in sufficient detail to enable those skilled in the art to implement the present disclosure, it should be understood that other implementations and forms are possible, and that changes in configuration and structure and substitutions of various elements are possible without departing from the scope and spirit of the technical ideas of the present disclosure. Therefore, the following description should not be interpreted as being limited thereto.
[0011] [First embodiment] An authentication system 1 according to a first embodiment will be described with reference to FIG. 1. The authentication system 1 includes a server 20 that receives an authentication request from a terminal 10 operated by a user who is to be authenticated by the authentication system 1 using a two-dimensional code (e.g., a QR code (registered trademark)). The server 20 executes an authentication procedure after receiving an authentication request from the terminal 10. The terminal 10 is, for example, a smartphone, a tablet, or the like, and has a communication function that captures and reads a two-dimensional code, such as a QR code, displayed on a bulletin board SB or the like, and sends an authentication request to the server 20 using the read QR code. The terminal 10 is configured to be able to communicate with the server 20 via a network NW. The terminal 10 can also acquire its own location information by receiving a satellite signal from a GPS satellite ST, for example. Instead of acquiring the location information based on the satellite signal, the location information can also be acquired based on a recognition signal and a response signal received from a router RT that provides an Internet connection, for example.
[0012] The bulletin board SB may include not only a bulletin board on which paper with a QR code printed thereon is posted, but also an electronic bulletin board on which a QR code is displayed on a display or the like. Information regarding the location of the bulletin board SB is acquired in advance by the server 20 and used for the authentication procedure. In addition, in the various embodiments below, a QR code is used as an example of a two-dimensional code, but other types of two-dimensional codes may be used instead of the QR code. For example, a stacked two-dimensional code in which conventional barcodes are stacked vertically may be used. Furthermore, DataMatrix, VeriCode, etc. may be used as a matrix two-dimensional code similar to a QR code.
[0013] The server 20 includes, for example, a QR code display position database 30, a QR code information database 40, a user information database 50, and the like for authenticating the QR code.
[0014] 0000 The QR code display position database 30 is a database that stores position information of, for example, a bulletin board SB where a QR code is displayed. The QR code information database 40 is a database that stores information about QR codes displayed on the bulletin board SB, etc. The user information database 50 is a database that stores information (for example, user ID, address, email address, name, gender, age, date of birth, etc.) of people (users) who are pre-registered as users of the authentication system 1.
[0015] An example of the configuration of the terminal 10 will be described with reference to Fig. 2. The terminal 10 may include, for example, a CPU 101, a RAM 102, a ROM 103, an input / output interface 104, a storage device 105, a display unit 106, a speaker 107, a microphone 108, a sensor 109, a communication control unit 111, and a camera 112.
[0016] The CPU 101 is a computing device that handles various calculations for the present authentication system 1. In addition to the CPU 101, a GPU (Graphical Processing Unit) that handles image processing may be provided. The RAM 102 has the function of temporarily storing various data for executing the authentication program of the present authentication system 1. The ROM 103 stores the program for executing the present authentication system, as well as BIOS, firmware for peripheral devices, and various other data. The input / output interface 104 is an interface device that handles input and output of data and signals to and from external devices.
[0017] The storage device 105 is a storage device, such as a solid state drive, that stores the above-mentioned programs as well as various data obtained in the authentication operation. The RAM 103, ROM 104, and storage device 105 are examples of storage devices, and it goes without saying that other storage device configurations can be adopted. The display unit 106 is a display device (such as a liquid crystal display) for displaying various data.
[0018] The speaker 107 and microphone 108 are acoustic devices for inputting and outputting audio during the authentication operation. The sensor 109 is a variety of sensors for executing the authentication operation, such as a vibration sensor, a light sensor, a magnetic sensor, a temperature sensor, and a fingerprint sensor. The communication control unit 111 controls the transmission and reception of various data for the authentication operation. The camera 112 has a function for capturing image information such as a QR code. It goes without saying that the RAM 102, ROM 103, input / output interface 104, storage device 105, display unit 106, speaker 107, microphone 108, sensor 109, communication control unit 111, and camera 112 can also be used for purposes other than the authentication operation.
[0019] To perform this authentication operation, the terminal 10 includes a QR code reading unit 121, a terminal location information generating unit 122, a request generating unit 123, a connection processing unit 124, and the like, which are realized by the above-mentioned program. The QR code reading unit 121 extracts a QR code from an image captured by the camera 112 and reads the image of the QR code. The terminal location information generating unit 122 generates location information of the terminal 10 to be transmitted to the server 20 for an authentication request based on signals received from a GPS satellite ST or the like. The request generating unit 122 generates an authentication request by presenting the read QR code. The connection processing unit 123 executes connection processing between the server 20 and the terminal 10 when authentication by the server 20 is completed.
[0020] An example of the configuration of the server 20 will be described with reference to Fig. 3. The server 20 includes, for example, a CPU 21, an input / output interface 22, a RAM 23, a ROM 24, and a storage device 25. The CPU 21 is a computing device that handles various calculations for the present authentication system 1. In addition to the CPU 21, a GPU (Graphical Processing Unit) that handles image processing may be provided. The input / output interface 22 is an interface device that handles input and output of data and signals to and from external devices. The RAM 23 has a function of temporarily storing various data for executing the authentication program of the present authentication system 1. The ROM 24 stores the program for executing the present authentication system, as well as BIOS, firmware for peripheral devices, and various other data.
[0021] By executing a program for this authentication system, the server 20 may be equipped with an internal QR code analysis unit 131, a position comparison unit 132, a request processing unit 133, and a communication control unit 134. The QR code analysis unit 131 analyzes the QR code that is captured by the terminal 10 and sent together with the authentication request. The position comparison unit 132 compares the display position of the QR code (e.g., the position of the bulletin board SB) stored in the QR code display position database 30 with the position information of the terminal 10 presented by the terminal 10, and determines whether the terminal 10 is located within a predetermined distance (e.g., within 2 km) from the bulletin board SB. The position (latitude, longitude, etc.) of the bulletin board SB is obtained from the aforementioned QR code display position database 30.
[0022] If it is determined that the terminal 10 and the bulletin board SB are located within a predetermined distance (for example, within 100 m), it is presumed that the user of the terminal 10 has captured the QR code displayed on the bulletin board SB with the camera 112 and acquired the QR code. In this case, the request processing unit 133 of the server 20 performs an authentication operation in response to the authentication request from the terminal 10, and can perform connection processing between the terminal 10 and the server 20. After the connection processing is completed, communication of various data is executed by the communication control unit 134.
[0023] On the other hand, if it is determined that the distance between terminal 10 and bulletin board SB is greater than the predetermined distance, it can be assumed that the user of terminal 10 was not near bulletin board SB and did not acquire the QR code image by capturing the QR code on bulletin board SB, but rather acquired it through another, unauthorized route. In this case, it is not appropriate to perform authentication, so the authentication request can be rejected.
[0024] Specific procedures for an authentication request and authentication processing will be described with reference to the flowcharts of Figures 4 and 5. When performing authentication, the user of terminal 10 activates camera 112 to capture an image of a QR code and obtain image data of the QR code (step S11). Next, terminal 10 generates location information for terminal 10 based on satellite signals from GPS satellites ST or the like (step S12). Then, authentication application (request) information is transmitted to server 20 together with the generated location information and image data of the captured QR code (step S13). As will be described later, server 20 authenticates terminal 10 on the condition that the distance between the display position of the QR code and terminal 10 is within a predetermined distance, and once authentication is successful, the authentication information is received by terminal 10 (steps S14 and S15).
[0025] The server 20 receives the location information of the terminal 10 from the terminal 10 together with an image of the QR code and an application (request) for authentication (step S21). Next, the server 20 compares the received location information of the terminal 10 with the presentation position of the QR code (step S22). If the comparison determines that the two are within a predetermined distance (YES in step S23), authentication processing of the terminal 10 is executed (step S24). On the other hand, if the distance between the two exceeds the predetermined distance, the authentication processing is rejected (NG) (step S25).
[0026] The effect of this embodiment will be described with reference to Fig. 6. As described above, in the authentication system 1 of this embodiment, authentication processing is performed when the terminal 10 and the display position of the QR code are within a predetermined distance. As an example, as shown in Fig. 6, if a bulletin board SB displaying a QR code is placed in a specific location such as a store or tourist spot, it may be necessary to provide authentication only to a person (user U1) who goes to that location and directly captures the QR code. In response to such a request, in this embodiment, the position of the terminal 10 is compared with the position of the bulletin board SB (QR code), and authentication processing is performed only when the two are within a predetermined distance.
[0027] By performing such processing, it becomes possible to deny authentication to a person (user U2) who has acquired an image PSB of the bulletin board SB in some way, even though he or she has not been near the bulletin board SB, as shown in the lower part of Fig. 9. For example, if a person captures a QR code with a camera and transfers the image data to another person, user U2, user U2 will be authenticated even though he or she has not actually been to the location where the bulletin board SB is located.
[0028] Conventionally, to address such issues, countermeasures such as two-step authentication using SMS or email have been implemented. However, even with two-step authentication, it is possible to separately transfer a passcode to user U2, which would circumvent the two-step authentication. In this sense, two-step authentication only serves to reduce the risk of fraudulent authentication. As in the present embodiment, by determining whether the position of the bulletin board SB and the position of the terminal 10 to be authenticated are within a predetermined distance, such issues can be resolved, and it becomes possible to authenticate only authorized users in QR code authentication.
[0029] [Second embodiment] Next, an authentication system 1 according to a second embodiment will be described with reference to FIG. 7. The overall configuration of this second embodiment may be similar to that of the first embodiment (FIG. 1). However, the terminal 10 of this second embodiment is different from the first embodiment in that it includes an imaging position information generation unit 122A instead of or in addition to the terminal position information generation unit 122 in the terminal 10. The imaging position information generation unit 122A generates information on the position where a QR code on a bulletin board SB or the like is actually imaged. The imaging position information can be generated from a signal from a GPS satellite ST or a signal from a router RT when an image is captured by the camera 112. In the server 20, the position comparison unit 132 can compare this imaging position with the presentation position of the QR code.
[0030] [Third embodiment] Next, an authentication system 1 according to a third embodiment will be described with reference to Fig. 8. In the authentication system 1 according to the third embodiment, instead of a QR code displayed on a bulletin board SB or the like, a QR code displayed on the display of a personal computer 60 or a television 70 can be captured by the terminal 10 for authentication. The server 20 then uses a position comparison unit 132 to compare the position of the personal computer 60 or television 70 with the position of the terminal 10, and performs authentication if the distance between them is within a predetermined distance. The position information of the computer 60 or television 70, which is a display device for the QR code, is registered in advance in the QR code display position database 30. Therefore, the person to be authenticated is limited to a predetermined range, and the same effect as in the first embodiment can be obtained.
[0031] 9 is a flowchart showing the authentication procedure in authentication system 1 of the third embodiment. In step S21', location information of computer 60 or television 70 displaying the QR code is received by server 20 along with application information. Then, in step S22, the location information of computer 60 or 70 is compared with the location information of terminal 10. The subsequent steps are the same as those in the first embodiment (steps S23 to S25).
[0032] [Fourth embodiment] Next, an authentication system 1 according to a fourth embodiment will be described with reference to Fig. 10. The overall configuration of the authentication system 1 according to the fourth embodiment is the same as that of the first embodiment (Fig. 1), and therefore a duplicated description will be omitted. However, the authentication system 1 according to the fourth embodiment employs a configuration in which the terminal 10 visualizes at least a portion of the information indicated by the read QR code (e.g., a QR authentication code) using the QR code visualization processing unit 124 and displays it on the display of the terminal 10, allowing the user to confirm the authenticity of the QR code.
[0033] 11, in the authentication system 1 of the fourth embodiment, when a legitimate QR code Qt is read from the bulletin board SB, the QR authentication code is visualized in the QR code visualization unit 124 of the terminal 10 and displayed on the display of the terminal 10. The QR authentication code is notified to the user separately in advance, or is written as part of the bulletin board SB.
[0034] The user checks this QR authentication code and compares it with the QR authentication code that the user has been notified of in advance. If the two match, the QR code displayed on the bulletin board SB can be determined to be authentic, and the authentication request can be continued. The server 20 can receive information from the terminal 10 that the visualized information in the QR code visualization unit 124 has been confirmed, and when this information is received, the server 20 can start authentication processing in the request processing unit 133.
[0035] On the other hand, for example, a fake QR code Qf may be pasted on top of a genuine QR code Qt printed on a bulletin board SB for fraudulent purposes. In this case, even if the fake QR code Qf is captured on the terminal 10, the displayed QR authentication code will be different or will not be displayed at all. By seeing this, the user can know that the captured QR code Qf is not genuine.
[0036] As described above, according to the fourth embodiment, in addition to the effects of the previous embodiments, it is possible to prevent a user from reading a fake QR code and becoming involved in fraudulent processing.
[0037] [others] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations. [Explanation of symbols]
[0038] 1. Authentication system 10...Terminal 20...Server 30...QR code display location database 40...QR code information database 50...User information database NW...Network ST…GPS satellite RT...router
Claims
1. A terminal and a server that authenticates the terminal; An authentication system comprising: The terminal a two-dimensional code reading unit that reads a two-dimensional code; a position information generating unit that generates terminal position information relating to the position of the terminal or reading position information relating to the reading position at which the two-dimensional code is read; a request generating unit that presents the two-dimensional code to the server and requests authentication; a connection processing unit that executes connection processing between the server and the terminal when the terminal is authenticated by the server; Equipped with The server a two-dimensional code analysis unit that analyzes the two-dimensional code; a position comparison unit that compares a position indicated by the terminal position information or the reading position information with a position where the two-dimensional code is presented; a request processing unit that processes an authentication request based on the analysis result of the two-dimensional code analysis unit and the comparison result of the position comparison unit; An authentication system comprising:
2. The authentication system according to claim 1 , wherein the terminal further comprises a two-dimensional code visualization unit that visualizes a part of the information read by the two-dimensional code reader and presents the visualized part to a user of the terminal.
3. The authentication system according to claim 2 , wherein the request processing unit processes the authentication request when information indicating that the visualized information in the two-dimensional code visualization unit has been confirmed is received from the terminal.
4. The authentication system according to claim 2 , wherein the two-dimensional code visualization unit visualizes a confirmation code included in the two-dimensional code.
5. An authentication server that authenticates a terminal, a two-dimensional code analysis unit that analyzes the two-dimensional code read by the terminal; a position comparison unit that compares a position indicated by terminal position information relating to the position of the terminal or read position information relating to the read position at which the terminal read the two-dimensional code with a position at which the two-dimensional code is presented; a request processing unit that processes an authentication request based on the analysis result of the two-dimensional code analysis unit and the comparison result of the position comparison unit; An authentication server comprising:
6. the terminal includes a two-dimensional code visualization unit that visualizes a part of the information read by the two-dimensional code reading unit and presents the visualized part to a user of the terminal; The authentication server according to claim 5 , wherein the request processing unit processes the authentication request when information indicating that the visualized information in the two-dimensional code visualization unit has been confirmed is received from the terminal.
Citation Information
Patent Citations
Entrance check system, unlocking system, utilization management system, entrance check method, unlocking method, and utilization management method
JP2022014824A