User authentication system and mobile terminal

Abstract

To provide a technique for improving safety when performing user authentication on a mobile terminal by using an auxiliary authentication device.SOLUTION: A user authentication system 100 of the present invention includes: a body device 200 including an authentication code transmission request unit that generates an authentication code transmission request including a first value and transmits it to an authentication device 300, a collation unit 272 that determines that authentication is successful when an authentication code transmitted from the authentication device 300 in response to the authentication code transmission request is included in a collation authentication code generated according to the first value, and an unlocking unit 273 that enables a predetermined function when the collation unit 272 determines that the authentication is successful; and the authentication device 300 including an authentication code reply unit that generates the authentication code according to the first value included in the authentication code transmission request and returns it to the body device 200.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to a user authentication technique for an information processing device such as a mobile terminal. This paper relates to a user authentication technology using a user authentication device. [Background technology]

[0002] A security protection technology that restricts the use of information processing devices such as mobile terminals by other people. There are also those that use auxiliary authentication devices other than mobile terminals. For example, Patent Document 1 states, "Other wireless The portable terminal device that performs wireless communication with the communication device is a specific wireless communication device that is registered in advance. A storage means for storing device identification information and a signal receiving means for receiving a signal transmitted from another wireless communication device. The device includes a wireless communication unit and a control unit. The control unit controls a signal received by the wireless communication unit. The identification information included in the number is acquired, and the identification information matches the identification information stored in the storage means. The technology disclosed is "enabling a specific function of a mobile terminal device when the do. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2005-130008 A Summary of the Invention [Problem to be solved by the invention]

[0004] According to the technology disclosed in Patent Document 1, a specific wireless communication device can be identified without performing complicated operations. This prevents the risk of unauthorized use of the portable terminal device. Information for identifying the specific wireless communication device, for example, is transmitted and received wirelessly. The interception or eavesdropping of information is not taken into consideration.

[0005] The present invention has been made in view of the above circumstances, and provides a method for authenticating a user on a mobile terminal using an auxiliary authentication device. An object of the present invention is to provide a technique for improving security when performing user authentication. [Means for solving the problem]

[0006] The present invention is a user authentication system for authenticating a user of a main device, the system comprising a main device and an authentication device that communicates with the main device, the main device storing authentication source information having a plurality of pairs of a first value selected for each transmission and a second value associated with the first value, selecting the first value from the authentication source information based on a predetermined rule, setting the second value stored in the authentication source information in association with the selected first value as a matching authentication code, and generating an authentication code transmission request including the selected first value, a second authentication code transmission request is transmitted to the authentication device, and the authentication device stores biometric information of the user holding the authentication device, which was acquired before authentication, as biometric information for matching, receives the authentication code transmission request transmitted from the main device, stores the original information for authentication, acquires the biometric information in response to the authentication code transmission request, and performs biometric authentication using the biometric information for matching, and if the biometric authentication is successful, generates the second value stored in the original information for authentication in correspondence with the first value as an authentication code and transmits the authentication code to the main device, and if the authentication code transmitted from the authentication device includes the authentication code for matching, the main device determines that the authentication is successful, enables a predetermined function if the authentication is successful, and if the authentication is not successful, Transmitting the authentication code transmission request to the authentication device every time a predetermined time has elapsed. It is characterized by: Effect of the Invention

[0007] According to the present invention, the safety of user authentication in a portable terminal using an auxiliary authentication device is improved. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. It will be revealed. [Brief description of the drawings]

[0008] [Figure 1] 1 is an overall view of a user authentication system according to a first embodiment; [Diagram 2] FIG. 2 is a hardware configuration diagram of a main device according to the first embodiment. [Diagram 3] FIG. 2 is a functional block diagram of a main device according to the first embodiment. [Figure 4] FIG. 2A is a hardware configuration diagram of an authentication device according to a first embodiment, and FIG. 2B is a functional block diagram of the authentication device according to the first embodiment. [Diagram 5] 11 is a flowchart of a user authentication process according to the first embodiment. [Figure 6] FIG. 1A is an explanatory diagram for explaining an example of authentication source information in the first embodiment, FIG. 1B is an explanatory diagram for explaining an example of an authentication code transmission request in the first embodiment, and FIG. 1C is an explanatory diagram for explaining an example of an authentication code in the first embodiment. [Figure 7] FIG. 13A is a hardware configuration diagram of an authentication device according to a second embodiment, and FIG. 13B is a functional block diagram of the authentication device according to the second embodiment. [Figure 8] 13 is a flowchart of a user authentication process according to the second embodiment. [Figure 9] FIG. 13 is an explanatory diagram for explaining an example of authentication source information in the second embodiment, FIG. 13 is an explanatory diagram for explaining an example of an authentication code transmission request in the second embodiment, and FIG. 13 is an explanatory diagram for explaining an example of an authentication code in the second embodiment, [Figure 10] FIG. 13 is a functional block diagram of a main device according to a third embodiment. [Figure 11] FIG. 13A is a hardware configuration diagram of an authentication device according to a third embodiment, and FIG. 13B is a functional block diagram of the authentication device according to the third embodiment. [Figure 12]13 is a flowchart of a user authentication process according to the third embodiment. [Figure 13] FIG. 13A is an explanatory diagram for explaining an example of a behavior history according to the third embodiment, and FIG. 13B is an explanatory diagram for explaining an example of a normal behavior range according to a modified example of the third embodiment. [Figure 14] 13 is a flowchart of a behavior history collection process and an authentication process according to a modified example of the third embodiment. [Figure 15] FIG. 13A is a functional block diagram of a main body device of the fourth embodiment, and FIG. 13B is a functional block diagram of an authentication device of the fourth embodiment. [Figure 16] 13A is a flowchart of an initial setting process according to a fourth embodiment, and FIG. 13B is a flowchart of a modified example of the initial setting process according to the fourth embodiment. [Figure 17] FIG. 13 is an explanatory diagram for explaining an example of a variable output wireless communication device according to a modified example of the fourth embodiment. [Figure 18] 13 is a flowchart of a user authentication process according to a modified example of the present invention. [Figure 19] 13 is a flowchart of a user authentication process according to another modified example of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the above, unless otherwise specified, the same reference numerals are used to denote components having the same functions, and repeated explanations will be omitted. Omitted.

[0010] <<First embodiment>> First, an overview of the first embodiment of the present invention will be described. FIG. 1 shows a user authentication system according to the present embodiment. FIG. 2 is a diagram for explaining an overview of a stem 100.

[0011] The user authentication system 100 includes a main device 200 and an authentication device 300. The authentication device 300 is an auxiliary authentication device used to authenticate the user of the main device 200. That is, in this embodiment, the specific function of the main device 200 is the authentication device. Only users who hold 300 can use it.

[0012] In general, when using such an auxiliary authentication device, the authentication device 300, The authentication code is sent and received via wireless communication between the authentication server and the authentication device 200. Therefore, once the authentication code is intercepted, the authentication device 300 In this embodiment, even a person who does not have a smartphone can use the functions of the main device 200. In order to avoid this, the authentication code transmitted from the authentication device 300 to the main device 200 is This changes the authentication code each time, increasing the confidentiality of the authentication code and improving security when sending and receiving it.

[0013] The user authentication system 100 of this embodiment that realizes the above processing will be described below.

[0014] [Main device] First, the main device 200 will be described. The main device 200 has a wireless communication function and For example, a mobile phone, a smartphone, a tablet, Wearable devices such as watches and head-mounted displays, feature phone or other portable digital device.

[0015] The hardware configuration of the main device 200 is shown in FIG. The processor 200 includes a CPU (Central Processing Unit) 201 and a A system bus 202, a storage device 210, a communication processor 220, an expansion I / F 227, and an operating The actuator 230, the video processor 240, the audio processor 250, and the sensor 26 It has 0.

[0016] The CPU 201 is a microprocessor unit that controls the entire main device 200. A system bus 202 connects the CPU 201 and each operation block in the main device 200. It is a data communication path for sending and receiving data.

[0017] The storage device 210 includes a ROM (Read Only Memory) 211 and a RAM ( The system includes a random access memory (RAM) 212 and a storage 213.

[0018] ROM211 stores basic operating programs such as the operating system and other operating The ROM 211 is a memory in which a program is stored. For example, an EEPROM (EEPROM) Lectrically Erasable and Programmable Re Rewritable ROM such as Ad Only Memory or Flash ROM is used. I can.

[0019] The storage 213 stores the operation program and operation setting values ​​of the main device 200, It stores various programs and data necessary to realize each function.

[0020] The storage 213 is in a state where the main device 200 is not receiving power from an external source. For this reason, the storage 213 contains, for example, flash memory. Flash ROM, SSD (Solid State Drive), HDD (Hard Disk Devices such as the .sk Drive are used.

[0021] RAM212 is a work area for executing basic operation programs and other operation programs. It is.

[0022] The ROM 211 and the RAM 212 may be integrated with the CPU 201. In addition, the ROM 211 is not an independent structure as shown in FIG. In other words, a part of the storage 213 may be used for R The functions of OM211 may be entirely or partially replaced.

[0023] Each operation program stored in the ROM 211 or the storage 213 may be, for example, Updates and feature expansions can be performed by downloading from each distribution server on the network. can.

[0024] The communication processor 220 includes a LAN (Local Area Network) communicator 221. , a telephone network communication device 222, a wired communication device 223, a close-proximity wireless communication device 224, and a wireless communication device 225 and is equipped.

[0025] The LAN communication device 221 is an access point via a wireless connection such as Wi-Fi (registered trademark). It is connected to the network via an AP (Access Point) device and shares data with other devices on the network. Send and receive.

[0026] The telephone network communicator 222 communicates with a base station of a mobile telephone network by radio, and transmits and receives calls and data. Send and receive.

[0027] The wired communication device 223 is a wired communication device such as a USB (Universal Serial Bus). The connection means allows the main device 200 to transmit and receive data to and from other devices in the vicinity of the main device 200 .

[0028] The close proximity wireless communication device 224 transmits data to and receives data from other devices equipped with close proximity wireless communication devices through wireless communication. The close-proximity wireless communication device 224 is, for example, a near field communication (NFC) It is an interface for Field Communication (FFC), and has a range of several centimeters to approximately 1 meter. It enables two-way communication between devices equipped with NFC chips over extremely short distances of about 1000m. For example, a service using a contactless IC chip such as electronic money mounted on the main device 200 may be used. It corresponds to the vis.

[0029] The wireless communication device 225 transmits and receives data to and from other devices equipped with wireless communication devices via wireless communication. For example, Bluetooth (registered trademark) can be used to communicate over distances of several meters to several tens of meters. It enables simple information exchange between information devices using radio waves.

[0030] A LAN communication device 221, a telephone network communication device 222, a wired communication device 223, and a close-proximity wireless communication device The radio communication device 224 and the radio communication device 225 each include an encoding circuit, a decoding circuit, an antenna, and the like. The communication processor 220 further includes a communication unit for implementing infrared communication and other communication units. It's fine if it is.

[0031] The expansion I / F 227 is a group of interfaces for expanding the functions of the main device 200. In this embodiment, the interface includes a video / audio I / F, an operation device I / F, a memory I / F, and the like. The video / audio I / F is used to input video / audio signals from external video / audio output devices, Output of video / audio signals to video / audio input devices, etc. External operation devices such as keyboards The device is connected via the operation device I / F. The memory I / F is used to transfer memory cards and other memory It connects a memory medium to send and receive data.

[0032] The operation unit 230 inputs an operation instruction to the main device 200. , a touch panel and button switches arranged on top of the display 241 It is also possible to have only one of them. The main device 200 may be operated using a connected keyboard or the like. The main device 200 is connected to a separate mobile information terminal device by a telephone or wireless communication. The display 241 may also have a touch panel function. .

[0033] The video processor 240 includes a display 241, an image signal processor 242, and a camera. It is equipped with a camera 243.

[0034] The display 241 is a display device such as a liquid crystal panel, and The image data processed by the image display unit 242 is displayed and provided to the user of the main device 200. The signal processor 242 includes a video RAM (not shown), and The display 241 is driven based on the image data. 2. If necessary, you can convert the format, display the menu or other OSD (On-Screen Display) The camera 243 performs superimposition processing of the display signal. Coupled Device) and CMOS (Complementary Metal Using electronic devices such as a silicon oxide semiconductor (SiO2) sensor, By converting the light input from the sensor into an electrical signal, the surroundings and objects are captured as image data. It is a photographic device.

[0035] The audio processor 250 includes a speaker 251, an audio signal processor 252, and a microphone. The speaker 251 outputs the audio processed by the audio signal processor 252. The microphone 253 provides a signal to the user of the main device 200. Convert it into data and enter it.

[0036] The sensor 260 is a group of sensors for detecting the state of the main device 200. For example, GPS (Global Positioning System) receiver a signal receiving unit 261, a gyro sensor 262, a geomagnetic sensor 263, and an acceleration sensor 264. , an illuminance sensor 265, a proximity sensor 266, and a biological information sensor 267.

[0037] These sensors detect the position, inclination, direction, movement, and surroundings of the main device 200. The main device 200 detects brightness, biometric information of the user, etc. The device may further include a pressure sensor or other sensors. The location information is acquired by a GPS receiver 261. In places where GPS signals are difficult to receive, the LAN communication device 221 can be used to obtain the information via Wi-Fi. Alternatively, the location information of the AP device of the Fi may be used. The location information is acquired by a method of acquiring location information using the location information of base stations and the propagation delay of telephone communication radio waves. In addition, it is not necessary to include all of these sensors.

[0038] Note that the configuration example of the main device 200 shown in FIG. 2 includes many components that are not essential to this embodiment. However, even if these are not provided, the effect of this embodiment is not impaired. In addition, the configuration not shown, such as a digital broadcast receiving function and an electronic money payment function, is not shown. Further additions may be made.

[0039] [Main device functional configuration] The functions realized by the main device 200 will be described with reference to FIG. When a user tries to execute a certain function, the main body device 200 in the form of an authentication device It requests user authentication, and if the authentication is successful, allows the function to be executed.

[0040] To achieve this, the main device 200 includes an authentication code transmission request generating unit 271 and a The lock control unit 275 includes a lock release unit 273, a transmission / reception unit 274, and an operation control unit 275. do.

[0041] These functions are implemented by the CPU 201 executing programs stored in the ROM 211 in the RAM. This is realized by expanding the program 212 as an execution program 291 and executing it. FIG. 3 shows functions realized by programs stored in ROM 211.

[0042] In addition, the storage 213 (main body storage unit) stores the authentication source information 2 as reference information 280. 81, an authentication code generation algorithm 282, and a transmission request generation algorithm 283 are stored. These data are stored in advance in the storage 213. When the data is read, the CPU 201 stores the data in the temporary storage area 292 of the RAM 212. In addition, the RAM 212 temporarily stores the programs stored in the ROM 211. Data generated during the execution of the program and data obtained as a result of the execution are stored. will be done.

[0043] The transmission / reception unit 274 is a communication processor 220 or an expansion I / F 227, for example, a USB / F controls sending and receiving data to and from external devices.

[0044] The authentication code transmission request generating unit 271 requests the authentication device 300 to transmit an authentication code. The authentication code transmission request is generated by, for example, It is generated when an instruction to execute a function that requires authentication is received. This authentication code transmission request is generated according to the transmission request generation algorithm 283. At this time, a different authentication code is generated for each request.

[0045] The generated authentication code transmission request is transmitted to the authentication device 300 via the transmission / reception unit 274. That is, the authentication code transmission request generating unit 271 and the transmitting / receiving unit 274 generate the authentication code. It functions as a code transmission request unit.

[0046] The verification unit 272 checks the authentication code returned from the authentication device 300 in response to the authentication code transmission request. In this embodiment, the authenticity of the code is confirmed by sending an authentication code request and authenticating source information 281. and an authentication code generation algorithm 282 to generate a verification authentication code. The generated verification code is compared with the returned verification code to verify its validity. For example, the authentication code sent from the authentication device 300 is a verification authentication code If it matches, it is determined that the authentication is successful.

[0047] When the verification unit 272 determines that the authentication code is valid, the lock release unit 273 is executable (enabled).

[0048] The operation control unit 275 realizes the authentication-required functions that are permitted to be executed by the lock release unit 273. In addition, the controller 230 controls each part of the main device 200. It also functions as a reception unit that accepts

[0049] [Hardware configuration of authentication device] Next, the authentication device 300 will be described. The authentication code is stored in the user's possession who is authorized to operate the main device 200. Generate and reply to the message.

[0050] The hardware configuration of the authentication device 300 that realizes this is shown in FIG. As shown in the figure, the authentication device 300 includes a CPU 301, a system bus 302, and a storage device 303. 10 and a communication processor 320.

[0051] The CPU 301 is a microprocessor unit that controls the overall operation of the authentication device 300. The system bus 302 connects the CPU 301 and each operation block in the authentication device 300. It is a data communication path for transmitting and receiving data between.

[0052] The memory device 310 includes a ROM 311, a RAM 312, and a storage 313. These have basically the same functions and configurations as the components of the main device 200 with the same names.

[0053] The communication processor 320 includes a wired communication device 323, a close-proximity wireless communication device 324, and a wireless communication device 325. These also have basically the same functions and configurations as the main device 200. It has a composition.

[0054] In addition, the authentication device 300 may have the same configuration as the main device 200. For example, the main device 200 may further include an expansion I / F 227. The hardware configuration may include all of the above.

[0055] [Authentication device functional configuration] Next, the functions realized by the authentication device 300 will be described with reference to FIG. As described above, the authentication device 300 of the present embodiment performs authentication in response to a request from the main device 200. Reply with the code.

[0056] To achieve this, the authentication device 300 includes an authentication code generating unit 371 and a transmitting / receiving unit 3 These functions are implemented by the CPU 30 by executing a program stored in the ROM 311. 1 is expanded in the RAM 312 as an execution program 391 and executed. .

[0057] In addition, the storage 313 (authentication storage unit) stores the authentication source information 2 as reference information 380. The authentication code generation algorithm 282 is stored in the main device. It is a copy of the data of the same name contained in Chair 200.

[0058] When each of the above functions is executed, the CPU 301 stores these data in a temporary The temporary storage area of ​​the RAM 312 is stored in the ROM 3 Each program stored in 11, data generated during execution, and results of execution Data to be displayed, etc. are stored.

[0059] The transmission / reception unit 372 controls the transmission and reception of data to and from an external device via the communication processor 320. do.

[0060] The authentication code generating unit 371 receives an authentication code from the main device 200 via the transmitting / receiving unit 372. When the authentication code transmission request is received, an authentication code is generated. Using the included information, the authentication source information 281, and the authentication code generation algorithm 282, The generation method is that the verification unit 272 of the main device 200 generates a verification authentication code. This is the same method used to create the

[0061] The generated authentication code is returned to the main device 200 via the transmission / reception unit 372. That is, the authentication code generating unit 371 and the transmitting / receiving unit 372 function as an authentication code returning unit. It works.

[0062] [User authentication process flow] Next, a flow of user authentication processing in this embodiment will be described. This process is a flow of authentication processing, for example, when an instruction to execute the above-mentioned authentication-required function is received. It was started when the

[0063] First, the transmission / reception unit 274 of the main device 200 sends a communication start signal to the authenticated device 300. A request is made (step S1101).

[0064] When the transmission / reception unit 372 of the authenticated device 300 receives the communication start request (step S12 01, S1202), a process for establishing communication is performed between the request source device (main device 200). (Steps S1203, S1102).

[0065] The communication is established, for example, by continuously polling the authentication device 300 side and receiving a predetermined Alternatively, the main device 200 may be detected when it comes within range, and two-way communication may be established. .

[0066] The authentication device 300 continues to wait until communication is established (step S12 On the other hand, in the case where the communication is not established after the main device 200 transmits the communication start request, If the predetermined time has elapsed (step S1103), the process returns to step S1101 and the call is A communication start request is made.

[0067] On the other hand, if the predetermined time has elapsed, the time is expired (step S1104), and the collation unit 2 In this case, the collation unit 272 sets an authentication failure flag ( Step S1105), the process ends.

[0068] When two-way communication is established (steps S1204 and S1103), first, the main device 2 The authentication code transmission request generating unit 271 of 00 generates an authentication code transmission request (step S1 110), and transmits it to the authentication device 300 (step S1111).

[0069] On the authentication device 300 side, when the transmission / reception unit 372 receives the authentication code transmission request (step The authentication code generating unit 371 generates an authentication code (step S1205). 06). Then, the transmitting / receiving unit 372 transmits the generated authentication code to the main device 200. (step S1207).

[0070] When the transceiver unit 274 of the main device 200 receives the authentication code (step S1112 ), and the collation unit 272 judges the validity (step S1113). In this way, the verification unit 27 checks whether the code matches the verification authentication code generated in advance. 2 determines that the authentication has been successful, sets the authentication success flag (step S1114), and ends the process. Complete.

[0071] On the other hand, if they do not match, the collation unit 272 determines that the authentication has failed, and the process proceeds to step S1105. To carry out.

[0072] The authentication failure flag and the authentication success flag are stored in the temporary storage area 292. will be done.

[0073] In addition, when the above-mentioned user authentication process is completed and the authentication success flag is set, the lock is released. The unit 273 unlocks the authentication-required function that has been instructed to be executed, making it available for use. accepts instructions from the user regarding the function.

[0074] In the user authentication process of this embodiment, the main device 200 and the authentication device 30 0, for example, wireless communication using wireless communication devices 225 and 325. It is done by.

[0075] Next, the authentication code transmission request generation process in step S1110 and step S120 6 explains the authentication code generation process.

[0076] First, the authentication source information 281, the authentication code generation algorithm 282, and The transmission request generation algorithm 283 will now be described.

[0077] The authentication information 281 of this embodiment corresponds to a first value and a second value different from the first value. When you specify the first value, the second value that is registered in correspondence with it is At this time, a different first value is specified for each authentication code transmission request. A different authentication code will be returned each time.

[0078] FIG. 6(a) is an example of the authentication source information 281 of this embodiment. As shown in this figure, The authentication information 281 includes a first value, which is an address 281a, and a second value corresponding to each address 281a. In this embodiment, the authentication code transmission request includes the code 281b. Then, the address 281a is specified. The code 281b is used as the authentication code.

[0079] In this embodiment, the main device 200 transmits the authentication code as shown in FIG. In the request 285, one or more addresses 281a are transmitted. Then, the authentication device 300 6(c), a corresponding code 281b is generated as an authentication code 286. do.

[0080] The transmission request generation algorithm 283 generates the information to be transmitted as the authentication code transmission request 285. In this embodiment, the generation method (rules) of the authentication code to be included in the authentication code transmission request 285 is defined. A method for determining the address 281a of the user information 281 is defined. For example, The last digit of the clock time at the time of generation is used, or a random number generator is used. A random number generator is provided in the main device 200. 6(b), when multiple addresses 281a are included in the authentication code transmission request 285, The order may also be specified.

[0081] The transmission request generation algorithm 283 is not limited to the above. Each time the address is changed, a different address 281a or a different set of addresses 281a is set. In addition, the transmission request generation algorithm 283 can be set and changed by the user. It is also possible to use the following.

[0082] The authentication code transmission request generating unit 271 generates an authentication code according to a transmission request generating algorithm 283. The address 281a of the source information 281 is identified. Then, authentication is performed using the identified address 281a. The code transmission request 285 is generated. In addition, the information of the specified address 281a is Also output to .

[0083] The authentication code generation algorithm 282 defines the method (rules) for generating the authentication code 286. In this embodiment, the authentication code is associated with the address 281a included in the authentication code transmission request 285. The process of extracting the code registered in the authentication source information 281 and generating it as an authentication code is registered. can be.

[0084] The authentication code generation unit 371 generates an authentication code according to the authentication code generation algorithm 282. A code corresponding to the address 281a included in the transmission request 285 is extracted from the authentication source information 281. and generate authentication code 286.

[0085] For example, when the authentication source information 281 shown in FIG. 6(a) is used, the authentication code transmission request 28 In the example shown in FIG. 6(b), the addresses 2, 5, 7, and 9 are specified as the address 281a. In this case, as shown in FIG. 6(c), the authentication code 286, which includes 8, f, g, and 2, is generated. is generated and returned.

[0086] As described above, the user authentication system 100 of the present embodiment includes the main device 200 and an authentication device 300. The main device 200 is Generate an authentication code transmission request including the value of and transmit it to the authentication device 300. generating a verification authentication code according to the request portion and a first value included in the authentication code transmission request; The authentication code transmitted from the authentication device 300 in response to the authentication code transmission request is generated If the authentication code for verification is included, the verification unit 272 determines that the authentication is successful. and an unlocking unit 273 that enables a predetermined function when it is determined that the authentication is successful. In addition, the authentication device 300 generates an authentication code according to a first value included in the authentication code transmission request. The device generates a response code and returns it to the main device 200.

[0087] At this time, the main device 200 and the authentication device 300 exchange the first value and the first value and a second value corresponding to the first value. The authentication code generation algorithm 282 generates an authentication code from the authentication code. The authentication code transmission request unit selects a first value from the authentication source information 281 according to a predetermined rule. The authentication code reply unit stores the first value in the authentication source information 281 in association with the transmitted first value. The second value is generated as an authentication code.

[0088] In this way, according to this embodiment, a different authentication code is returned every time an authentication code is requested. Therefore, even if the returned authentication code is intercepted or eavesdropped, the next The authentication code is not used during authentication. 0) to perform authentication in the mobile terminal (main device 200), and You can get.

[0089] <Modification> The authentication code generation algorithm 282 may be a function. The original information 281 may not be provided. For example, the authentication code transmission request generating unit 271 may The request for sending the authentication code is sent by including a number of variables in the request for sending the authentication code. Generated according to rhythm 283.

[0090] In this case, the collation unit 272 uses the value returned by the function according to the variable as the authentication code for collation. The authentication code generation unit 371 also authenticates the value returned by the function according to the transmitted variables. Reply with code 286.

[0091] In addition, to generate the authentication code, a function such as a token that outputs a different authentication code for each output is required. In the case of a token, for example, the timing or number of times of a request to transmit an authentication code may be set. In this case, the algorithm for generating the authentication code is The rhythm is shared between the main device 200 and the authenticated device 300.

[0092] In addition, each code in the authentication information 281 is not limited to a single alphanumeric character. It may be a string of numbers, symbols, etc.

[0093] By applying these modified examples, the confidentiality of transmitted and received data is further improved.

[0094] <<Second embodiment>> Next, a second embodiment of the present invention will be described. In this embodiment, the authentication device Furthermore, taking into account the results of the identity authentication, an authentication code is generated and returned.

[0095] The overall configuration of the user authentication system 100 of this embodiment is basically the same as that of the first embodiment. Hereinafter, the present embodiment will be described with a focus on the configuration different from the first embodiment. do.

[0096] In this embodiment, communication is established between the main device 200 and the authentication device 300. Then, the main device 200 transmits an authentication code to the authentication device 300 in the same manner as in the first embodiment. The authentication device 300 receives the authentication code transmission request 285. Then, the identity of the user who holds the authentication device 300 is authenticated, and the authentication code is generated based on the result of the authentication. It generates and returns code 286.

[0097] [Main device] The main device 200 of this embodiment has the following hardware configuration and function blocks: Both are similar to the first embodiment.

[0098] However, as described later, the authentication device 300 performs identity authentication. The result is added to the authentication code 286. 1 and the authentication code generation algorithm 282 contain information that can distinguish whether the authentication is successful or not. It is added.

[0099] The collation unit 272 compares the original authentication information 281 and the authentication code generation algorithm 282. However, the verification unit 272 generates a verification authentication code using the above. The authentication code returned when the authentication is successful and the authentication code returned when the authentication is unsuccessful are The verification unit 272 generates the ID so that the ID can be distinguished from the ID returned when the user authentication is successful. Alternatively, the user may create only the authentication code that

[0100] For example, the verification unit 272 may generate a verification authentication code for verifying the authentication code returned when the personal authentication fails. If it matches, it notifies the operation control unit 275. Then, the operation control unit 275 For example, a message indicating that a legitimate authentication device 300 is held by an unauthorized person may be displayed. The message may be configured to be displayed on the display 241.

[0101] [Authentication device] The authentication device 300 of this embodiment will be described. Then, as described above, the user authentication is performed. For this purpose, the authentication device 300 of this embodiment is It has functions and configurations for personal authentication.

[0102] FIG. 7(a) is a hardware configuration diagram of the authentication device 300 of this embodiment. As shown, the authentication device 300 of this embodiment is the same as the authentication device 300 of the first embodiment. In addition to the above configuration, a biological information sensor 367 is further provided.

[0103] The biometric information sensor 367 is a sensor that collects biometric information. For example, the authentication device 3 If the sensor 00 is a wristwatch-type wearable device, it may be a pulse wave sensor or a heart rate sensor. Alternatively, an imaging device such as a camera that captures fingerprints, veins, irises, etc. may be used. The biometric information sensor 367 functions as a biometric information acquisition unit together with a biometric authentication unit 373 described later. It works.

[0104] FIG. 7(b) is a functional block diagram of the authentication device 300 of this embodiment. As described above, the authentication device 300 of this embodiment has a biometric authentication unit in addition to the configuration of the first embodiment. That is, the ROM 311 further includes a program for implementing the biometric authentication unit 373. Equipped with ram.

[0105] In addition, the reference information 380 in the storage 313 includes the valid user ( The biometric information of the person who has the ID card is further registered as biometric information for verification 383. The information 383 is acquired in advance when a valid holder takes possession of the authenticated device 300 . For example, if it is a wristwatch type device, when you first put it on, it will be turned on for a certain period of time (for example, 10 seconds). , 1 minute, etc.) the pulse wave or heart rate is acquired by the biometric information sensor 367. The biometric information for verification 383 is stored in the storage 313 .

[0106] The biometric authentication unit 373 of this embodiment receives an authentication code transmission request 28 via the transmission / reception unit 372. When the ID 5 is received, the biometric information of the holder is acquired at that point. The biometric information is The biometric information is acquired via the biometric information acquisition section 367. The acquired biometric information is then compared with the biometric information for comparison 383. The result of the comparison is output to the authentication code generation unit 371.

[0107] The authentication code generating unit 371 generates the authentication code 286 taking into account the result of the comparison. Specific examples will be given later.

[0108] The flow of the user authentication process of this embodiment will be described below. 11 is a process flow of authentication processing according to the second embodiment. Note that descriptions of the same parts as those in the first embodiment will be omitted.

[0109] When two-way communication is established (steps S1204 and S1103), the main device 200 The authentication code transmission request generating unit 271 generates an authentication code transmission request 285 (step S1 110), and transmits it to the authentication device 300 (step S1111).

[0110] On the authentication device 300 side, when the transmission / reception unit 372 receives the authentication code transmission request 285, (Step S1205), the biometric authentication unit 373 performs identity authentication (Step S2201). Here, biometric information is collected for a predetermined period of time. The biometric information is collected by a biometric sensor 367. The acquired biometric information is then compared with the biometric information for verification 383. The comparison result is output to the authentication code generation unit 371 .

[0111] The authentication code generating unit 371 generates an authentication code (step S2202) and transmits it to the transmitting / receiving unit 3 The device 72 transmits the generated authentication code to the main device 200 (step S1207). A specific example of the authentication code generated here will be described later.

[0112] When the transceiver unit 274 of the main device 200 receives the authentication code (step S1112 ), and the collation unit 272 judges its validity (step S1113). If the received authentication code matches the authentication code generated in advance, the verification unit 272 determines that the authentication is successful, sets the authentication success flag (step S1114), and ends the process. do.

[0113] On the other hand, if they do not match, the collation unit 272 determines that the authentication has failed, and the process proceeds to step S1105. To carry out.

[0114] When the above user authentication process is completed and the authentication success flag is set, the lock is released. The unit 273 unlocks the authentication-required function that has been instructed to be executed, making it available for use. accepts instructions from the user regarding the function.

[0115] Next, a specific example of the authentication code generated in this embodiment will be described. A specific example of the authentication source information 281 prepared in this embodiment will be described. The information 281 corresponds to the first value and includes a second value that is returned when the authentication is successful, and A third value that is returned when person authentication fails is stored.

[0116] FIG. 9(a) shows an example of the authentication source information 281 of this embodiment. As shown in this figure, The authentication information 281 includes a first value, which is an address 281a, and a second value corresponding to each address 281a. The first value is Code1 (281b), and the second value is Code2 (281c). The second value is a value that is returned if the authentication is successful, and the third value is a value that is returned if the authentication is successful. This is the value to return if the request fails.

[0117] In this embodiment, the main device 200 also transmits an authentication code transmission request 285. The information to be authenticated is an address 281a having a value of 1 or more. Depending on the success or failure of the authentication code, the corresponding code 1 (281b) or code 2 (281c) is entered as the authentication code. The command is generated as code 286 and returned.

[0118] In this embodiment, the matching unit 272 of the main device 200 returns a response when the user authentication is successful. You can generate an authentication code using Code 1 (281b) as a verification authentication code. stomach.

[0119] For example, when the authentication source information 281 shown in FIG. 9(a) is used, the authentication code transmission request 28 In the example shown in FIG. 9(b), the addresses 2, 5, 7, and 9 are specified as the address 281a. In this case, if biometric authentication is successful, 8, f, g, and 2 are An authentication code 286 containing the biometric information is generated and returned. On the other hand, if the biometric authentication fails, As shown in FIG. 9(d), an authentication code 286 containing t, 4, 2, and g is generated and returned. can be.

[0120] As described above, in this embodiment, in addition to the configuration of the first embodiment, an authentication device The chair 300 performs biometric authentication of the user and outputs an authentication code including the result of the biometric authentication. and returning the

[0121] Therefore, according to this embodiment, the main device 200 is The main device 200 can also know whether the authentication has been successful. Depending on the code, the authentication device 300 can determine not only whether the device is legitimate, but also whether it is a legitimate user. It can also be determined whether the information is held or not.

[0122] Therefore, according to this embodiment, even if the authentication device 300 is legitimate, If the user is not the legitimate owner, the circumstances of the loss or theft of the authentication device 300 can be identified. Therefore, if the authentication device 300 is lost or stolen, But you can ensure security.

[0123] In this way, according to the present embodiment, it is possible to maintain high security during transmission and reception. Furthermore, a highly secure user authentication system can be provided.

[0124] As with the first embodiment, various modifications can be made to this embodiment as well.

[0125] <Modification> In addition, when the user authentication is successful in the authentication device 300, the history of the successful authentication is recorded in the authentication device 300. In this embodiment, as described above, the authentication code transmission request is Each time a request is received, the authentication device 300 performs authentication. The success or failure is stored in the storage 313 in association with the above.

[0126] When the user's identity is successfully authenticated a specified number of times in succession, or when the user's identity is only successfully authenticated intermittently, Alternatively, the authentication code 286 may be returned in such a manner that it is possible to distinguish whether the authentication code 286 is returned or not.

[0127] For example, as shown in FIG. 9(a), the authentication source information 281 is associated with the first value. Then, the fourth value (Code 3 (281d)) is stored. Then, the identity authentication is performed continuously. If successful, return the second value. If authentication is only intermittently successful, return , and returns the fourth value.

[0128] As a result, the main device 200 detects that the authentication device 300 is not attached to the body of the original user. You can check the situation such as whether or not the person has left the room, or if they have left the room even once. If the identity verification fails or there is some other suspicious situation, for example, you may be asked to enter a PIN code again. Security may be increased, including by requiring force.

[0129] <<Third embodiment>> Next, a third embodiment of the present invention will be described. In this embodiment, the main device 200 is The authentication device 300 and the authentication device 300 both record the behavior history of the holder. If they match, the authentication is considered successful.

[0130] The user authentication system 100 of this embodiment basically has the same configuration as the first embodiment. The present embodiment will be described below with a focus on the configuration different from the first embodiment. .

[0131] [Main device] The hardware configuration of the main device 200 of this embodiment is basically the same as that of the first embodiment. However, the functions realized by the main device 200 are different. 2 shows functional blocks of the main device 200.

[0132] As shown in the figure, the main device 200 of this embodiment has the following configuration in addition to the configuration of the first embodiment: Specifically, the program that realizes the location information acquisition unit 277 is The program is stored in the ROM 211, and the CPU 201 loads this program into the RAM 212. By downloading and executing it, the function of the position information acquisition unit 277 is realized.

[0133] The location information acquisition unit 277 acquires current location information via, for example, the GPS receiver 261. The acquired location information is stored in the storage 213 as a behavior history 28 in association with the time of acquisition. In this embodiment, the behavior history 284 is used as the original information for authentication. can be.

[0134] The transmission request generation algorithm 283 of this embodiment, for example, The authentication code generation algorithm 282 is defined to specify a time period. The location information for the specified time period (period) is defined to be extracted from the behavior history 284.

[0135] In addition, the verification unit 272 of the main device performs the authentication code transmission request 285 during the period specified by the authentication code transmission request 285. The behavior history (location information) is extracted from the behavior history 284, and a verification authentication code is generated.

[0136] [Authentication device] Next, the authentication device 300 of this embodiment will be described. FIG. 1 is a hardware configuration diagram of an authentication device 300 according to the present embodiment. The authentication device 300 includes a GPS receiver 361 in addition to the configuration of the first embodiment.

[0137] FIG. 11(b) is a functional block diagram of the authentication device 300 of this embodiment. As described above, the authentication device 300 of this embodiment has the configuration of the first embodiment, and further has the following features: The storage 313 also includes an acquisition unit 374. The storage 313 stores the acquired location information in association with time. The information processing device further includes a behavior history 384 that is registered according to the behavior.

[0138] When the power supply of the authentication device 300 is turned on, the position information acquisition unit 374 of this embodiment acquires a predetermined At regular intervals, the GPS receiver 361 receives a GPS signal and transmits its own position information. The calculation result is stored in the storage as the behavior history 384 in association with the time. Store in 313.

[0139] In this embodiment, the authentication code generation unit 371 transmits the authentication code for the period specified in the authentication code transmission request 285. The behavioral history (location information) is extracted from the behavioral history 384 and used as an authentication code.

[0140] In this embodiment, the main device 200 and the authentication device 300 exchange position information as follows: It is preferable to synchronize and obtain the same intervals. However, if this is difficult, The code generating unit 371 generates the code closest to the start and end points of the period specified in the authentication code transmission request 285. Determine the closest acquisition time, extract the location information between the two acquisition times, and generate the authentication code 286. do.

[0141] In addition, the collation unit 272 sets a predetermined tolerance range for the collation, and if the value falls within the tolerance range, The system may be configured to determine that a match occurs if the

[0142] The flow of the user authentication process of this embodiment will be described below. 13 is a process flow of authentication processing. Note that a description of the same parts as in the first embodiment will be omitted.

[0143] When two-way communication is established (steps S1204 and S1103), the main device 200 The authentication code transmission request generating unit 271 generates an action history transmission request as an authentication code transmission request 285. The authentication request is generated (step S3110) and transmitted to the authentication device 300 (step S311 1) Here, the period to be extracted from the stored behavior history 284 is specified.

[0144] When the transmission / reception unit 372 of the authentication device 300 receives the action history transmission request (step S 3201), the authentication code generating unit 371 of the authentication device 300 stores the authentication code in the storage 313 From the action history 384, action history (location information) for a specified period is extracted (step S3203), generates an authentication code 286. Then, the transmitting / receiving unit 372 The authentication code 286 (behavior history) is transmitted to the main device 200 (step S3204).

[0145] When the transceiver unit 274 of the main device 200 receives the authentication code (step S3102 ), and the collation unit 272 judges the validity (step S3103). In this embodiment, the timing of collecting location information is Depending on the code, the authentication code sent may not match the verification code. Therefore, as described above, a predetermined tolerance may be set to determine whether the two match or not.

[0146] If they match, the collation unit 272 determines that the authentication is successful and sets the authentication success flag (step Step S1114) and the process ends.

[0147] On the other hand, if they do not match, the collation unit 272 determines that the authentication has failed, and the process proceeds to step S1105. To carry out.

[0148] Here, examples of the behavioral histories 284 and 384 of this embodiment are shown. As shown in FIG. 2, an example of the behavior history 284 is shown. In the case of 4, latitude and longitude information is registered as position information 284b in association with time 284a. FIG. 13(a) shows an example in which the location information 284b is registered, for example, every minute.

[0149] For example, a request to send action history requests location information from 8:00 to 10:00 on November 1, 2017. When requested, the authentication code generation unit 371 stores the location information corresponding to this period in the behavior history 38. 4 and use it as authentication code 286. Considering the degree, not all digits may be used.

[0150] According to this embodiment, both the main device 200 and the authentication device 300 can detect the position of the The information is stored as a behavior history. Then, the authentication code is sent from the authentication device 300 to the user. Receive activity history for a period of time.

[0151] In this embodiment, the authentication code sent is different for each authentication. In the present embodiment, the security of transmitting and receiving the authentication code is high. There is no need for the authentication source information to be shared between the authentication device 200 and the authentication device 300. Since there is no data transmission to share this authentication information, users can enjoy a higher level of security. You can get a certification system.

[0152] As with the first embodiment, various modifications can be made to this embodiment as well.

[0153] <Modification> In this embodiment, both the main device 200 and the authentication device 300 always Location information is acquired and recorded as a behavior history, but the method is not limited to this. For example, Depending on whether the location where the specific processing is performed is within the normal range of movement or outside the normal range of movement, , and may control the execution of the authentication process.

[0154] For example, the main device 200 may collect information based on the results of successful authentication processing associated with the specific processing. The range of movement is identified from the location information.

[0155] In this modified example, for example, as shown in FIG. 13(b), the collation unit 272 determines that the authentication is successful. Each time authentication is performed, the position information 284c at the time of the authentication is associated with the position information 284c at the time of the authentication. The position information 284c is stored in the position information acquisition unit 374. The location information 284c is stored in the behavior history 284. Uses information specified by longitude.

[0156] Then, the collation unit 272 recognizes the position where the number of successful authentications 284d is equal to or greater than a predetermined number. The authentication result position is defined as the authentication result position. Also, the range specified by the position information 284c corresponding to this authentication result position is In FIG. 13B, for example, the number of successful authentications is set as the normal movement range 284e. 284d considers a location where the person has been identified as ... 284e, i.e., location information 284c of normal movement range 284e and authentication success The number of times 284d is stored in the storage 213 instead of the action history 284. ,Positions that differ within the tolerance are considered to be the same position.

[0157] The collation unit 272 checks whether the location of the main device 200 at the time of authentication is within the normal movement range 284e. It is determined whether or not the specific process is important within the normal range of action 284e. If not, the authentication by the authentication device 300 is omitted, and the user is not allowed to deviate from the normal range of behavior 284e. If the specific process is important, the authentication device 300 performs authentication. do.

[0158] Here, the important specific process is, for example, a payment process. This refers to a payment process for amounts above a certain predetermined amount.

[0159] In addition, the main device 200 stores the action history 284 in the storage 2 in association with the process. 13.

[0160] In addition, the normal movement range 284e is not limited to the range specified by the authentication result position. A range within a predetermined distance from the authentication result position may be set as the normal movement range 284e.

[0161] The flow of the behavior history collection process and authentication process of this modified example is shown in FIG. Then, the position information acquisition unit 277 determines whether the process performed by the operation control unit 275 is a specific process. If it is not a specific process, the process is executed (step S33 09) and finish.

[0162] On the other hand, if it is a specific process, the location information is acquired (step S3302). The control unit 275 further determines whether the specific process is an important process (step S3303 If the process is important, authentication is performed (step S3305). If so (step S3306), the collation unit 272 performs the identification process and the acquisition process on the acquired location information. The time is stored as the action history 284 in association with the acquired time (step S3307), and the specific process is performed. At this time, the same action history 2 is also stored in the authentication device 300 (step S3309). 84 (normal movement range 284e) may be stored.

[0163] On the other hand, if the authentication is unsuccessful (step S3306), the operation control unit 275 displays an error message. (step S3308), and the process ends.

[0164] If it is determined in step S3303 that the specific process is not an important process (step In step S3303, the collation unit 272 checks whether the position of the main device 200 is within the normal movement range 284 If it is determined that the range is not the normal movement range 284e, the process proceeds to step S3304. If the user is identified, the process proceeds to step S3305, where authentication processing is performed. If it is determined to be 284e, the process is executed (step S3309) and ends.

[0165] For example, the specific process may be a payment process at a store. The location information of the stores you frequent is registered. When performing a transaction, the lock is not automatically released. In addition to the security, high security can be obtained with respect to the execution of processes.

[0166] The action history 284 for each process may be registered in association with a time period. The embodiment may be combined with the first or second embodiment.

[0167] In this modification, the authentication device 300 stores the authentication result history ( 284c, 284d), and when requesting a verification code, the same data as in the previous verification code is stored. The verification unit 272 may request the transmission of the verification result history (284c, 284d). In this case, The authentication performance history (284c, 284d) of the authentication device 300 returned in response to the request The authentication result history (284c, 284d) is the same as the authentication result history (284c, 284d) recorded in the main device 200. Depending on whether or not there is a password, the validity of the holder of the authentication device 300 is determined.

[0168] <<Fourth embodiment>> Next, a fourth embodiment of the present invention will be described. Prior to this, the main device 200 transmits authentication source information, etc., to the authentication device 300 for user authentication. It is necessary to perform an initial setting to transmit information required for processing. This improves safety when

[0169] In the first, second, and third embodiments, the main device 200 is initially set In the above, the authentication source information 281 and / or the authentication code generation algorithm 282 are set. The authentication device 300 transmits the change to the authentication device 300. That is, the authentication source information 281 and / or or each time the authentication code generation algorithm 282 is newly set or updated, An initial setting shared between the server 200 and the authentication device 300 is performed.

[0170] In each of the above embodiments, the main device 200 transmits the authentication information to the authentication device 300 at the time of initial setting. Here, the information is different based on the first embodiment. I will explain with a focus on the main topic.

[0171] The hardware configuration of the main device 200 and the authentication device 300 of this embodiment is based on the following: This is essentially the same as the first embodiment.

[0172] [Main device] The functional blocks of the main device 200 of this embodiment are shown in FIG. As described above, the main device 200 of this embodiment includes an initial setting unit in addition to the configuration of the first embodiment. Equipped with 278.

[0173] The initial setting unit 278 receives the authentication source information 281 and the authentication The code generation algorithm 282 is sent to the authentication device 300 during the initial setup. At this time, the initial setting unit 278 sets the transmission method used for transmitting and receiving data to and from the normal authentication device 300. Instead of multi-stage communication, choose a communication method with a short reach or wired communication.

[0174] The authentication source information 281 and the authentication code generation algorithm 282 are stored in the main device. The user of the storage 213 registers the information in advance in the storage 213. 278 selects a communication means for initial setup when an initial setup instruction is received from a user. At the same time, initial setting processing is performed.

[0175] As a communication means, a communication device capable of communicating between the main device 200 and the authentication device 300 Among the various means, the most secure communication means is selected. For example, For wireless communication, for example, the near field communication device 224 is used. In this case, the wireless communication with the shortest range, such as the wireless communication that has been used for a long time, is selected.

[0176] The priority order of these selections is, for example, preset and stored in the storage 213 or the like. Alternatively, the communication device to be used may be specified by the user each time.

[0177] In addition, when wired communication is selected, the initial setting unit 278 prompts the user to and displaying a message on the display 241 prompting a wired connection between the authentication device 300 and the The device may be configured to:

[0178] In addition, when the authentication device 300 side includes a USB I / F, the USB Connect the SBI / F and the USB I / F of the authentication device 300 with a USB cable, and then Data transfer may also be performed.

[0179] FIG. 15(b) is a functional block diagram of the authentication device 300 of this embodiment. As shown, in addition to the configuration of the first embodiment, an initial setting unit 375 is provided.

[0180] The initial setting unit 375 receives the authentication source information 281 and the authentication code generation algorithm 282, The process is performed when receiving from the main device 200. The main device 200 sets a communication means corresponding to the communication means set by the main device 200 as a receiving means. Receive information.

[0181] FIG. 16(a) is a flow diagram for explaining the flow of processing during initial setting in this embodiment. At the start of this process, the main device 200 stores the authentication source information 281 and the authentication It is assumed that the code generation algorithm 282 is registered. The process starts when an instruction to start the initial setting is received from the owner of the device 200. .

[0182] First, the initial setting unit 278 of the main device 200 selects a communication means (step S4 101). Then, the authentication device 300 is requested to establish communication using the selected communication means. Then, an initial setting request is transmitted (step S4102).

[0183] When the authentication device 300 receives a communication establishment request as an initial setting request (step S 4201), the initial setting unit 375 performs a process to establish communication by the requested communication means. Then, communication is established by the communication means (step S4202).

[0184] When the communication is established, the initial setting unit 278 transmits the authentication source information 281 and , and the authentication code generation algorithm 282 from the main device 200 to the authentication device 300. (Step S4103).

[0185] The initial setting unit 375 receives the authentication source information 281 and the authentication code generation algorithm 282 is stored in the storage 313 (step S4203). Then, the initial setting unit 375 notifies the initial setting unit 278 that the saving has been completed, and returns the initial setting to the initial setting unit 278. Finish.

[0186] After completing the initial settings, the initial setting unit 278 and the initial setting unit 375 each The communication means of the device is returned to the normally used communication means (steps S4104, S4204), and processing is continued. End the process.

[0187] As shown in Figure 16(b), the normal communication is performed until the communication is established, such as sending the initial setting request. After the communication is established, the communication means is selected (steps S4301 and S4401). The method may be configured to perform the above (steps S4101 and S4202).

[0188] As described above, in this embodiment, at the time of initial setting, that is, the source of the authentication code generation When the main device 200 and the authentication device 300 share the authentication information 281, Therefore, data is sent and received using a communication method that is less likely to leak. This makes it possible to realize a highly reliable user authentication system.

[0189] <Modification> In this embodiment, the wireless communication device 22 used in the user authentication process in each of the above embodiments is 5. By selecting a communication method other than the above, security is increased, but this is not limited to this.

[0190] For example, if the wireless communication device 225 has a variable output, the initial process is a user authentication process. The output may be reduced compared to normal times, such as when the vehicle is stopped or when the vehicle is not in operation.

[0191] FIG. 17 shows an example of the configuration of a variable output wireless communication device 225. The wireless communication device 225 is a signal processing The device includes a logic unit 225a, a variable resistor 225b, an output unit 225c, and an antenna 225d. do.

[0192] For example, the initial setting unit 278 issues an instruction to the wireless communication device 225 during the initial setting, and outputs For example, the resistance value of the variable resistor 225b is increased to suppress the output. After completing the setting, the initial setting unit 278 instructs the wireless communication device 225 to set the resistance value of the variable resistor 225b to to reset it to its original value.

[0193] In addition, according to this embodiment, the authentication source information 281 and the authentication code generation algorithm 28 After sharing 2, the user can use either the method of the first embodiment or the method of the second embodiment. Authentication may also be performed.

[0194] During the initial processing, the authentication source information 281 and the authentication code generation algorithm are generated using the public key. The algorithm 282 is encrypted and transmitted from the main device 200 to the authentication device 300. It may be configured.

[0195] <Modification> In the above embodiments, except for the specific processing of the modified example of the third embodiment, For example, the user authentication function in each of the above embodiments is not limited to the function of authentication using the authentication function 300. The authentication process may be used for authentication when unlocking the screen of the main device 200, or may be used for authentication based on a predetermined It may also be used for authentication when a specific application is executed.

[0196] <Modification> In addition, for example, the main device 200 may be provided with a plurality of user authentication means and configured to use them in combination. An example of the process flow in this case is shown in FIG. 18. Here, the first authentication process The screen is unlocked with the second authentication process, and the specific process is authenticated with the second authentication process. In the case of failure, a third authentication process is performed as a backup. The screen lock state means that the main device 200 is in a standby state and no operations are allowed except for authentication operations. is not accepted.

[0197] First, the operation control unit 275 performs a first authentication process (step S5101). If successful (step S5102), the lock release unit 273 The lock is released (step S5103). If the authentication fails, the process is terminated. Alternatively, the process returns to step S5101 and authentication is performed again.

[0198] The screen lock is released, and an operation instruction is received from the user via the display 241. When this is done (step S5104), the operation control unit 275 determines whether the instruction corresponds to a predetermined specific process. At this time, if it is a specific process, the operation The control unit 275 performs the second authentication process (step S5106). If not, the process continues (step S5108) and ends.

[0199] If the second authentication is successful (step S5107), the process proceeds to step S5108. Carry out the theory.

[0200] On the other hand, if the second authentication fails, the operation control unit 275 displays an error message on the display 241. The display also prompts the user to perform the third authentication (step S5111). If the authentication is established in the third authentication (step S5112; Yes), 8 and execute the process. On the other hand, if the third authentication is not successful ( If step S5112 is No, the operation control unit 275 displays an error (step S5 113), and then the process ends.

[0201] In this modified example, the first authentication, the second authentication, and the third authentication are different from each other. At this time, the above authentication means is used for any of the first authentication, the second authentication, and the third authentication. User authentication using the authentication device 300 may be used.

[0202] For example, the first authentication method uses biometric information such as fingerprints, veins, and irises. In the second authentication, user authentication using the authentication device 300 of each of the above embodiments is applied, and in the third authentication, For the third authentication, an authentication means such as input of a PIN code (password) may be applied.

[0203] For example, in the case of the modified example of the third embodiment described with reference to FIG. 14, the user may If you try to make a payment outside, the authentication will fail and the lock will not be released. In this case, as shown in the figure, when authentication fails in the user authentication means of this embodiment, If you have a third authentication method, you can enter a new store without any problems as long as you know the password. In other words, convenience and safety can be well balanced.

[0204] Also, what authentication methods will be used for the first authentication, second authentication, and third authentication? The user may be able to set whether to use the method.

[0205] In addition, when the main device 200 can use multiple authentication methods, Alternatively, multiple authentications may be performed. The process may be executed only if the authentication is successful. In other words, if at least one authentication is successful, the process may be executed.

[0206] In addition, the system uses multiple authentication methods and executes processing only if all authentications are successful. The processing is, for example, a payment process. In addition, the authentication method to be used is determined according to the payment amount of the payment process. The number of authentication methods used may be varied. That is, as the payment amount increases, the number of authentication methods used may also increase. increase.

[0207] <Modification> Furthermore, a communication establishment process is periodically performed between the main device 200 and the authenticated device 300. The operation control unit 275 periodically performs step S110 as shown in FIG. Attempts to establish communication starting from 1. If communication establishment fails, an authentication failure flag is displayed. In addition to setting a log, the time when communication could not be established is also recorded (step S5 201; non-established time accumulation).

[0208] In step S1103, even if communication is established, a request to transmit an authentication code is not sent. Before generating the ID, the collation unit 272 checks the past communication non-established period (step S5202 At this time, for example, it is determined whether there is a period during which communication has not been established for a predetermined consecutive period. Determine.

[0209] If there is a period of continuous non-established communication for a specified period or more, even if communication is established, On the other hand, in step S5202, the communication If the non-established period is equal to or shorter than the predetermined time, the user authentication process of each of the above embodiments is continued. is performed (step S5203).

[0210] <Modification> In each of the above embodiments, the authentication device 300 is used as the auxiliary authentication device of the main device 200. However, the present invention is not limited to this. For example, the authentication device 300 also uses the main device 2. The main device 200 and the authentication device 300 may have the same functions as those of the authentication device 300. The authentication may be performed mutually between the two.

[0211] For example, if the two devices are a smartphone and a wearable device, When the smartphone performs a specific process, the smartphone functions as the main device 200. The wearable terminal functions as the authentication device 300. In addition, the wearable terminal When executing a process, the wearable terminal functions as the main device 200 and the smart The phone functions as the authentication device 300.

[0212] <Modification> In the above embodiments, one authentication device 3 is provided for one main device 200. 00 is used as an example, but the present invention is not limited to this. 00, multiple authentication devices 300 may be provided. In this case, 300 respectively refer to the authentication source information 281 and / or the authentication The authentication code generation algorithm 282 is provided. On the other hand, if at least one authentication device is used, the authentication may be successful only if the authentication codes match. If the authentication code from the access point 300 matches, the authentication may be deemed successful.

[0213] The present invention is not limited to the above-described embodiment, but includes various modifications. For example, the above-described embodiment is provided for the purpose of easily understanding the present invention. The present invention is not limited to the above-described configuration. It is possible to replace a part of the configuration with the configuration of another embodiment, and the configuration of one embodiment may be It is possible to add the configuration of other embodiments to the configuration of each embodiment. It is possible to add, remove, or replace other configurations.

[0214] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be implemented in whole or in part by, for example, The above configurations and functions may be realized by hardware, such as by designing an integrated circuit. The processor interprets and executes the programs that realize the respective functions. It may be realized by software. Each function may be realized by a program, a table, a file, etc. Information is stored in memory, hard disks, SSDs (Solid State Drives), etc. It can be placed on a recording device, IC card, SD card, DVD, or other recording media. .

[0215] In addition, control lines and information lines are shown as necessary for explanation, and may not necessarily correspond to all This does not necessarily show all control and information lines. In reality, almost all components are interconnected. It can be said that this is the case. [Explanation of symbols]

[0216] 100: User authentication system, 200: main device, 201: CPU, 202: system bus, 210: storage device, 211: ROM, 212: RAM, 213: storage, 220: communication processor, 221: LAN communication device, 222: telephone network communication device, 223: wired communication device, 224: close-proximity wireless communication device, 225: wireless communication device, 225a: signal processor, 225b: variable resistor, 225c: output device, 225d: antenna, 227: expansion I / F, 230: controller, 240: video processor 241: display, 242: image signal processor, 243: camera, 250: audio audio processor, 251: speaker, 252: audio signal processor, 253: microphone, 260: sensor, 261: GPS receiver, 262: gyro sensor, 263: geomagnetic sensor 264: acceleration sensor, 265: illuminance sensor, 266: proximity sensor, 267: biometric sensor Information sensor, 271: authentication code transmission request generating unit, 272: matching unit, 273: lock release unit, 274 : Transmitting and receiving unit, 275: Operation control unit, 277: Location information acquisition unit, 278: Initial setting unit, 28 0: Reference information, 281: Authentication source information, 281a: Address, 281b: Code (1), 28 1c: Code 2, 281d: Code 3, 282: Authentication code generation algorithm, 283: Transmission request generation algorithm, 284: behavior history, 284a: time, 284b: location information, 284c: location information, 284d: number of successful authentications, 285: request to send authentication code, 286: Authentication code, 291: execution program, 292: temporary storage area, 300: authentication device, 301: CPU, 302: system bus, 310: storage device, 311: ROM, 312: RAM, 313: storage, 320: communication processor, 323: Wired communication device, 324: Near field communication device, 325: Wireless communication device, 361: GPS receiver, 3 67: Biometric information sensor, 371: Authentication code generation unit, 372: Transmitter / receiver unit, 373: Biometric recognition verification unit, 374: location information acquisition unit, 375: initial setting unit, 380: reference information, 383: verification Biometric information, 384: Action history, 391: Execution program, 392: Temporary storage area

Claims

1. A user authentication system for authenticating a user of a main device, the system comprising: a main device; and an authentication device that communicates with the main device, the system comprising: The main body device is storing authentication source information having a plurality of pairs of a first value selected for each transmission and a second value associated with the first value; selecting the first value from the authentication source information based on a predetermined rule; the second value stored in the authentication source information in association with the selected first value is set as a verification authentication code; generating a request for an authentication code including the selected first value; Sending the authentication code transmission request to the authentication device; The authentication device includes: storing biometric information of a holder of the authentication device, which information has been acquired in advance before authentication, as biometric information for matching; receiving the authentication code transmission request transmitted from the main device; storing the authentication source information; In response to the authentication code transmission request, the biometric information is acquired and biometric authentication is performed using the matching biometric information; If the biometric authentication is successful, the second value stored in the authentication source information in association with the first value is generated as an authentication code; Transmitting the authentication code to the main device; The main body device is If the authentication code transmitted from the authentication device includes the verification authentication code, the authentication is determined to be successful; If the authentication is successful, a predetermined function is enabled. If it is determined that the authentication is not successful, the authentication code transmission request is transmitted to the authentication device every time a predetermined time elapses. A user authentication system comprising:

2. 2. The user authentication system according to claim 1, The authentication device is a wearable device. A user authentication system comprising:

3. 2. The user authentication system according to claim 1, The main body device is A variable output wireless communication device; An initial setting unit, The initial setting unit transmits the authentication source information to the authentication device via the wireless communication device before transmitting the authentication code transmission request to the authentication device, and when transmitting the authentication source information, reduces an output of the wireless communication device to a level lower than an output when transmitting the authentication code transmission request. A user authentication system comprising:

4. 2. The user authentication system according to claim 1, The predetermined function is a payment function. A user authentication system comprising:

5. 2. The user authentication system according to claim 1, The main body device is a first authentication unit that performs a first authentication different from authentication using the authentication device; A reception unit that receives an operation instruction, the main body device further enables acceptance of the operation instruction via the acceptance unit when the authentication by the first authentication unit is successful; generating the authentication code transmission request when the operation instruction for executing the predetermined function is received via the reception unit; A user authentication system comprising:

6. 2. The user authentication system according to claim 1, The main body device is a second authentication unit that performs a second authentication different from the authentication using the authentication device; The second authentication unit executes the second authentication when the authentication is not successful. A user authentication system comprising:

7. 2. The user authentication system according to claim 1, The main device includes a transmission / reception unit that establishes communication with the authentication device; a main body storage unit that accumulates a non-establishment period during which the transmission / reception unit was unable to establish the communication, When the accumulated non-establishment period exceeds a predetermined period, the main device does not generate the authentication code transmission request. A user authentication system comprising:

8. 2. The user authentication system according to claim 1, a third value different from the second value is further associated with each of the first values ​​of the authentication source information, When the biometric authentication fails, the authentication device sets the third value stored in the authentication source information in correspondence with the first value as the authentication code. A user authentication system comprising:

9. A mobile terminal, an authentication code transmission request unit that generates an authentication code transmission request including a first value selected for each transmission and transmits the authentication code transmission request to an external device; a verification unit that determines that the authentication is successful when the authentication code transmitted from the external device in response to the authentication code transmission request is included in a verification authentication code generated in accordance with the first value; a release unit that enables a predetermined function when the verification unit determines that the authentication is successful; an authentication code generating unit that, when receiving the authentication code transmission request from the external device, generates the authentication code according to the first value included in the authentication code transmission request and returns the authentication code to the external device; a storage unit configured to store authentication source information having a plurality of pairs of the first value and a second value associated with the first value; a biometric information acquisition unit for acquiring biometric information of a person who holds the portable terminal; A biometric authentication unit, the authentication code transmission request unit selects the first value from the authentication source information in accordance with a predetermined rule; the collation unit sets the second value stored in the authentication source information in association with the first value selected by the authentication code transmission request unit as the collation authentication code, the authentication code generation unit generates, as the authentication code, the second value stored in the authentication source information in association with the first value; The storage unit further stores the biometric information acquired in advance before authentication as biometric information for matching, the biometric authentication unit acquires the biometric information in response to the authentication code transmission request, performs biometric authentication using the biometric information for verification, and outputs a result to the authentication code generation unit; the authentication code generation unit, when the biometric authentication is successful, sets the second value stored in the authentication source information in association with the first value as the authentication code; The release unit is If the verification unit determines that the authentication is successful, a predetermined function is enabled; If the verification unit does not determine that the authentication is successful, the authentication code transmission request is transmitted to the external device every time a predetermined time elapses. A mobile terminal characterized by:

10. The mobile terminal according to claim 9 is a smartphone or a wearable terminal. A mobile terminal characterized by:

11. 10. The mobile terminal according to claim 9, A variable output wireless communication device; An initial setting unit, The initial setting unit transmits the authentication original information to the external device via the wireless communication device before transmitting the authentication code transmission request to the external device, and when transmitting the authentication original information, reduces an output of the wireless communication device to a level lower than an output when transmitting the authentication code transmission request. A mobile terminal characterized by:

12. 10. The mobile terminal according to claim 9, The predetermined function is a payment function. A mobile terminal characterized by:

13. 10. The mobile terminal according to claim 9, a first authentication unit that performs a first authentication different from the authentication using the external device; A reception unit that receives an operation instruction, When the authentication by the first authentication unit is successful, the operation instruction can be accepted via the acceptance unit; generating the authentication code transmission request when the operation instruction for executing the predetermined function is received via the reception unit; A mobile terminal characterized by:

14. 10. The mobile terminal according to claim 9, a second authentication unit that performs a second authentication different from the authentication using the external device; The second authentication unit executes the second authentication when the authentication is not successful. A mobile terminal characterized by:

15. 10. The mobile terminal according to claim 9, A transceiver unit for establishing communication with the external device; a main body storage unit that accumulates a non-establishment period during which the transmission / reception unit was unable to establish the communication, The authentication code transmission request unit does not generate the authentication code transmission request when the accumulated non-establishment period exceeds a predetermined period. A mobile terminal characterized by:

16. 10. The mobile terminal according to claim 9, a third value different from the second value is further associated with each of the first values ​​of the authentication source information, the authentication code generating unit sets the third value stored in the authentication source information in association with the first value as the authentication code when the biometric authentication fails. A mobile terminal characterized by:

17. A mobile terminal, an authentication code transmission request unit that generates an authentication code transmission request including a first value selected for each transmission and transmits the authentication code transmission request to an external device; a verification unit that determines that the authentication is successful when the authentication code transmitted from the external device in response to the authentication code transmission request is included in a verification authentication code generated in accordance with the first value; a release unit that enables a predetermined function when the verification unit determines that the authentication is successful; an authentication code generating unit that, when receiving the authentication code transmission request from the external device, generates the authentication code according to the first value included in the authentication code transmission request and returns the authentication code to the external device; a storage unit configured to store authentication source information having a plurality of pairs of the first value and a second value associated with the first value, the authentication code transmission request unit selects the first value from the authentication source information in accordance with a predetermined rule; the collation unit sets the second value stored in the authentication source information in association with the first value selected by the authentication code transmission request unit as the collation authentication code, the authentication code generation unit generates, as the authentication code, the second value stored in the authentication source information in association with the first value; The release unit is If the verification unit determines that the authentication is successful, a predetermined function is enabled; If the verification unit does not determine that the authentication is successful, the authentication code transmission request is transmitted to the external device every time a predetermined time elapses. A mobile terminal characterized by:

18. 18. The mobile terminal according to claim 17, The external device is a smartphone or a wearable device. A mobile terminal characterized by:

19. 18. The mobile terminal according to claim 17, The mobile terminal includes: A variable output wireless communication device; An initial setting unit, The initial setting unit transmits the authentication original information to the external device via the wireless communication device before transmitting the authentication code transmission request to the external device, and when transmitting the authentication original information, reduces an output of the wireless communication device to a level lower than an output when transmitting the authentication code transmission request. A mobile terminal characterized by:

20. 18. The mobile terminal according to claim 17, The predetermined function is a payment function. A mobile terminal characterized by:

21. 18. The mobile terminal according to claim 17, The mobile terminal includes: a first authentication unit that performs a first authentication different from the authentication using the external device; A reception unit that receives an operation instruction, the mobile terminal further enables acceptance of the operation instruction via the acceptance unit when the authentication by the first authentication unit is successful; generating the authentication code transmission request when the operation instruction for executing the function is received via the reception unit; A mobile terminal characterized by:

22. 18. The mobile terminal according to claim 17, The mobile terminal includes: a second authentication unit that performs a second authentication different from the authentication using the external device; The second authentication unit executes the second authentication when the authentication is not determined to be successful. A mobile terminal characterized by:

23. 18. The mobile terminal according to claim 17, The portable terminal includes a transmitting / receiving unit that establishes communication with the external device; A storage unit, The storage unit accumulates a non-establishment period, which is a period during which the transmission / reception unit was unable to establish the communication; The authentication code transmission request unit does not generate the authentication code transmission request when the accumulated non-establishment period exceeds a predetermined period. A mobile terminal characterized by:

Images