JP2003132025A - Authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication method which is easy to recall and modify, is capable of raising its authentication level, is not copied and not forcibly stolen, and does not become lost, and by which an access opportunity can be automatically got even if the method is forgot. SOLUTION: In the authentication method which, after a device user inputs an ID number or a symbol from an external of an authentication means, collates and uses a specific character string stored in a storage means in the authentication means for user authentication, at least two character strings of finite length are previously stored as a group in the authentication means. One of the character strings is set as a character string which the authentication means displays as message at a password input scene on the authentication means. The user inputs the rest as a password from the external of the authentication means, and the authentication means uses the rest as a character string to be compared with for seeking a match with an inputted character string.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication method using a set of character strings stored in advance in a device for user identification and authentication.

[0002]

2. Description of the Related Art Conventionally, when logging in to a computer system or entering a controlled area, a method of inputting an ID number or a symbol and a password such as an encryption key in order to authenticate the user himself, How to read and process from one ID card with the authentication code written,
Recently, in order to prevent theft or loss, a method of authenticating the person by using a part of the body such as eyes, fingers and voice is used.

[0003]

The conventional method of inputting a password is a method of inquiring the user from the system after inputting an ID number or a symbol, and it is easy to forget the password. There was always a tendency to set columns such as columns and alphabetic strings for names. Even with a numeric password, it was easy to find out by others because it was often used for birthdays, anniversaries, or the same as the PIN of other cash cards. Also, if your system administrator asks you to change your password frequently,
Due to the drawbacks that are easy to forget, users were not able to manage themselves to the extent necessary for security management even if they were changed.

In the method using the ID card, there is a possibility that the key will be stolen or lost as in the case of the ordinary key, and another method having high security has been desired. In response to this, authentication using fingerprints, voiceprints, and iris of eyes has been developed and considered for application.

However, the fingerprint is an image of the pattern and may be a copy if it is the same as the image of the registered fingerprint. Therefore, the finger itself cannot be forgotten or stolen. But the pattern could be stolen. In addition, even in the case of voiceprints, in the modern times when the recording technology has been developed, once the coded utterance is recorded, there is a possibility that it will be indistinguishable whether it is due to the person's voice or the voice from the recorder. I can't deny it. At the same time, there is an undeniable possibility that a person using a part of the body will be copied as an image or audio signal and misused in the process of authentication. Furthermore, when protecting valuable assets and information with these authentication methods, if you use a system that authenticates with a part of your body such as a finger, you can authenticate with only that part regardless of the intention of the person, Even if you refuse to authenticate, you may be forced to authenticate, which can lead to crimes.

In order to improve the system of such authentication, the present invention is easy to remember, easy to change, can increase the level of authentication, not to be copied, not to be stolen, not to be lost, and even to be accessed even if it is forgotten. It is a highly secure authentication method that can significantly reduce the success rate of password searching by "exhaustive crushing" using a computer that can automatically obtain the opportunity of.

[0007]

The first invention of the present invention is as follows:
In the authentication method in which the device user inputs the ID number or symbol from outside the authentication means, and then collates and uses a specific character string stored in the storage means in the authentication means for user authentication, two finite lengths are used. The character strings are stored in the authentication means in advance, one of them is used as a character string that the authentication means displays as a message when the password of the authentication means is input, and the rest is used as a password from outside the authentication means by the user. There is provided an authentication method characterized by being input and used as a character string to be compared by an authentication means for obtaining a match with the input character string.

According to a second aspect of the present invention, a plurality of sets of two character strings having a finite length are stored in the storage means in the authentication means for user authentication, and the authentication means stores the character strings. Select one or two or more sets from the set, and the authentication method displays one character string of the selected set as a message in the password input scene, and displays the remaining character strings of the selected set. The user inputs it as a password from outside the authentication method,
An authentication method according to the first aspect of the present invention is provided, wherein the authentication means uses the character string as a compared character string to obtain a match with the input character string.

According to a third aspect of the invention, after the device user is identified and authenticated by the authentication method described in the first aspect, the user adds, rewrites and changes two character strings having a finite length. It is possible to provide an authentication method according to the first and second inventions.

According to a fourth aspect of the present invention, the device manager or the authentication means uses the personal information of the user or the use status of the system,
It is the authentication method according to any one of the first to third inventions, characterized in that one or two or more sets of two character strings having a finite length stored in the storage means in the authentication means are rewritten.

Furthermore, a fifth aspect of the present invention stores a plurality of sets of two character strings having a finite length in the storage means in the authentication means for user authentication, and the authentication means sets the character strings. Select one or two or more pairs from among, and in the password input scene, the authentication means displays one character string of the selected group as a message and uses the remaining character string of the selected group. Person inputs it as a password from outside the authentication method,
In the authentication method used as the compared character string for the authentication means to match with the input character string, the authentication means selects all of the finite length character string sets used in the password input scene. Forcibly enter the password when it is confirmed that one of the character strings in the set and the character string entered by the user as a password from outside the authentication means do not match the compared character string stored in the storage means of the authentication means. The present invention provides an authentication method according to any one of the first to fourth inventions, which is characterized by disconnecting the session.

[0012]

A well-known authentication system is a system in which a password is inquired from the system to a user after inputting one ID number or symbol as described above. In the present invention, for example, in a password file for recording this password, one or a plurality of combinations of a message and a password are recorded for one ID number or symbol, and when a password is requested, one is arbitrarily selected from them. A message is displayed and a password is requested later. The contents of the message and the password can be rewritten by a person who is allowed to write each as a set. If an incorrect password is entered due to a typo or the like, the above-mentioned normal authentication method waits for the same password to be entered, but in the present invention, it is possible to select another message and password combination. Display the other message that was issued and request the password later. As a result, even if one password cannot be remembered by any means, it can be remedied by displaying the message of the following message and password combination and entering the password.

By registering a sentence, a symbol, a word, etc., which makes it easy to remember the password, in the message of the recorded message and the password combination, the password of the user can be compared with the case where the password is simply entered. The forgetting rate of can be reduced. Even if the password is changed, if the message can be used as a keyword for the password, it is easy to change the password.

The message may be in the form of a question and the password may be the answer. For example, "Birthday"
The question is to set a birthday as a password for the question format message.

Also, the fact that the system automatically writes a combination of a plurality of messages and passwords can be used as one of the measures for increasing the level of authentication security. For example, a combination of asking a part of the personal information registered in the system and answering it, or entering the password of the user's usage date in response to the message display that asks the previous usage date. is there. The password input based on the combination of the message display and the password input according to the present invention will be hereinafter referred to as a "question type password input method".

[0016] Now, if the password input in the question form is set to be authenticated only if it is passed twice, the probability of breaking the password and making an illegal entry is the same as entering the two IDs as compared with the conventional probability. Therefore, it is the square of the probability of one illegal entry. If the probability is 1/1000, then 1 / million
The probability is. In addition, the security level of authentication can be dramatically increased by increasing the number of times the password is input in the question form. Also, if you register your own age as a password in the question "Age is" in your personal information, the probability that someone else will steal your personal information and then apply your password is high, as in the past. "Konowa
If you set a password such as "tashiha22desu", you can easily generate a password that is easy to remember and has a long code.

Such setting information is in the memory of the person himself and is neither copied nor forcibly stolen. Furthermore, it is possible to make it easier to forget by setting a message that reminds me of such a password setting.

As a method of breaking a password, there is known a method of narrowing down the password to birthdays or wedding anniversaries and attacking the combination of numerical values with a computer thousands, tens of thousands, and millions of times. However, unlike conventional systems that require the same password, the password that you enter is selected from a combination of stored messages and passwords, and the message appears according to the setting or randomly, so all of these passwords are required. It is hard to think about forgetting it many times, and it becomes possible to judge unauthorized intrusion in a few times, and it is possible to set up a defense program in the system. Further, as described above, by adding a character string that is easy to remember for a question without directly entering the age and birthday, it is possible to extremely reduce the success of the “exhaustive crushing” method.

(Embodiment) FIGS. 1 to 4 are for explaining the above-described embodiment of the present invention as a concrete example, and FIGS. 1 and 2 are flowcharts showing an operation at the time of authentication.
3 and 4 are diagrams showing a dialog box for authentication.

In FIG. 1, when the initial setting of the authentication has already been made and the ID for the authentication means is input by the user (step S1), the process proceeds to the next step S2 for all the IDs. In step S2, if an ID that has not been registered is input, it is considered as an ID that has been set for disapproval, and the question message set with this ID will be used, but all password authentication is rejected. do. In step S3, an authentication dialog box (see FIG. 3) is displayed, in which a message of a character string for one question is displayed. The user inputs a character string ID password as an answer corresponding to the message (step S4). It is determined whether or not the input ID password is correct (step S5). If it is correct, authentication is performed. If it is not correct, the process returns to the start and the input of the ID starts.

In the above-mentioned example, the authentication is performed by the combination of one message and one ID password, but it may be performed by the combination of a plurality of messages and the ID password. That is, in FIG. 2, when the initial setting of authentication has already been made and the ID for the authentication means is input by the user (step S11), the process proceeds to the next step S12 for all the IDs. However, if an ID that has not been registered is entered, the ID specified for unauthorized use
Therefore, the question message set with this ID will be used, but all password authentication will be rejected. In step S12, a count is made to prepare for displaying the question message. I = 1 for the first time.
When the question message is displayed several times and the process goes through step S13, it is determined whether the number of times the message has been displayed exceeds the number stored in the message, or the number of times of permission for aborting the authentication process exceeds the set value. To be judged. As a result of the determination, when it is true that the number of times the message is displayed reaches the number of times the authentication process is terminated, the process proceeds to step S20 and returns to the ID input step S11. Alternatively, here, the password input may be disconnected and the unauthorized access process may be started.

If it is determined to be false in step S13, the process proceeds to step S14, and an authentication dialog box (see FIG. 3) is displayed, in which a message of a character string for one question is displayed. The user inputs an ID password of a character string as an answer corresponding to the message (step S15). It is determined whether or not the input ID password is correct (step S16), and if it is correct, it is regarded as a correct answer, and 1 is added to the correct answer number n in step S17 of counting the correct answer. If not, step S1
Returning to the message input preparation stage of 2 while keeping the message display count (I). In step S18, if the number n of correct answers is greater than or equal to the value set as the number of times required for authentication, authentication is performed, and if not, the number of message display times (I) is held in the message input preparation step of step S12. Return.

In either of the flows shown in FIGS. 1 and 2, a step (not shown) for changing the message and the ID password after being authenticated may be provided.

Next, referring to FIG. 3, there is shown an authentication dialog box displayed in step S3 or step S12. In FIG. 2, the message “age is” 12 set at the authentication setting stage is displayed in the dialog box 10 as a question. For the message of this character string, the ID password “konowatasha22desu” set at the authentication setting stage is input. A check box 16 for setting the input condition may be provided. Further, a button "next" 18 is provided to proceed to the next step (step S5 or step S14) for judging whether or not the input ID password is correct.

FIG. 4 shows another example of the authentication dialog box. In the embodiment shown in FIG.
Although it was determined whether or not the D password is correct by providing individual steps, in this embodiment, it can be performed in one dialog box. In this dialog box 10, a plurality of question messages 12 are displayed, and the user can input the ID password 14 for them. For example, the ID password “konowatashiha22desu” is input for the question message “Age is” 12 and “Aomori prefecture” is input for the message “Hometown”. In addition, in this example, a plurality of (for example, two) ID passwords, for example, a double-byte capital letter “WHITE” and a katakana “magenta” are input for one question message, for example, “favorite color is”. The thing is provided. Then, a drop-down button 20 may be provided that allows a logical product (AND) or a logical sum (OR) to be selected for the plurality of ID passwords. Note that similar drop-down buttons may be provided between the messages, and the authentication may be determined by an arbitrary combination of the logical product or logical sum of the ID passwords.

[0026]

As described above, according to the present invention,
It provides an authentication method that is easy to remember, easy to change, can increase the level of authentication, and can be automatically accessed without being copied, forcibly stolen, lost, or forgotten.

[Brief description of drawings]

FIG. 1 is a flowchart showing an operation at the time of authentication.

FIG. 2 is a flowchart showing an operation at the time of authentication in another embodiment.

FIG. 3 is a diagram showing a dialog box for authentication.

FIG. 4 is a diagram showing a dialog box for authentication according to another embodiment.

[Explanation of symbols]

10 dialog boxes 12 messages 14 ID password 16 Input condition setting button

Claims (5)

[Claims] 1. An authentication method in which a device user inputs an ID number or a symbol from outside the authentication means and then collates and uses a specific character string stored in a storage means in the authentication means for user authentication, At least two character strings of finite length are made into a set and stored in advance in the authentication means.One of the character strings is the character string that the authentication means displays as a message when the password of the authentication means is input, and the rest is set by the user. An authentication method characterized by being input as a password from outside the authentication means and used as a compared character string for the authentication means to seek a match with the input character string. 2. A plurality of character string groups having at least two finite lengths are stored in a memory means in the authentication means for user authentication, and the authentication means selects one from the character string groups. Or, select two or more sets arbitrarily, and when the password is entered, the authentication means displays one character string of the selected set as a message, and the remaining character string of the selected set is displayed by the user. The authentication method according to claim 1, wherein the authentication method is input as a password from the outside, and is used as a compared character string for the authentication means to seek a match with the input character string. 3. After the device user has been identified and authenticated by the authentication method according to claim 1, it is possible for the user to add, rewrite and change at least two finite length character strings. The authentication method according to claim 1, characterized in that 4. A set of at least two character strings of finite length stored in a storage means in the authentication means based on the personal information of the user or the usage status of the system by the device manager or the authentication means. One or two or more are rewritten, The authentication method as described in any one of Claims 1-3. 5. A plurality of sets of character strings having at least two finite lengths are stored in a storage unit in the authentication unit for user authentication, and the authentication unit selects one from the set of character strings. Or, select two or more sets arbitrarily, and when the password is entered, the authentication means displays one character string of the selected set as a message, and the remaining character string of the selected set is displayed by the user. In the authentication method, which is input as a password from the outside and used as a compared character string for the authentication means to seek a match with the input character string, there is also one small thing of the set of character strings of finite length used. , The character string of one of the pairs selected by the authentication means in the password input scene and the character string input by the user as a password from outside the authentication means do not match the compared character string stored in the storage means of the authentication means. Is confirmed Authentication method according to forcibly cutting the password input session one of claims 1 to 4, characterized in the case.