JP2005240478A - Authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To immediately use a gate even if a person reaches a facility requiring an authentication such as the gate while securing sufficient security by a simple structure. <P>SOLUTION: Original authentication data and original user IDs are stored in a data holding part 25. A user who wishes to pass the gate acquires data to be authenticated from the authentication data acquiring part 51 of a portable terminal 50 midway to the gate 10 and sends it to an authentication part 23. The authentication part 23 collates the original authentication data of the data holding part 25 with the authenticated data, and when they match with each other, authenticates the user and sends the original user ID to a collation part 32. When a tag communication part 31 detects a non-contact IC tag 52 in this state, the collation part acquires the user ID from the non-contact IC tag 52, collates them with each other, and when they match with each other, opens the gate 10. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an authentication system in which an authentication process can be performed before a user reaches an object to be authenticated such as a gate.

  Today's IT (Information Technology) has made remarkable progress, and the technology related to security has also advanced. As such security technology, security by password and biometrics authentication program (BioAPI: Biometrics Application Program Interface) for identifying an individual by biological information such as a voiceprint, fingerprint, retina, iris and the like are known. In particular, biometrics authentication is highly researched and developed with high reliability because there is no trouble such as forgetting a number or wrong number like a password, and there is no fear of theft.

For example, an iris gate authentication system is a system that performs authentication by utilizing the fact that the iris (iris) pattern of a human eye varies from person to person. As such an iris gate authentication system, by detecting the mobile terminal possessed by the user and determining the current position of the user, the authentication data of the user is read from the management device only to the gate that is about to pass through, A system is disclosed in which authentication is started when a user reaches a gate (see Patent Document 1).
JP 2002-339614 A

  However, in the conventional authentication system, the authentication process is started when the user stands, for example, in front of the passing ticket. Therefore, it is necessary to wait in front of the gate until the end of the authentication process, which is not convenient. There was a problem.

  SUMMARY OF THE INVENTION An object of the present invention is to provide an authentication system in which a gate or the like can be used immediately after reaching a facility such as a gate that requires authentication processing.

The present invention adopts the following configuration in order to solve the above points.
<Configuration 1> Authentication data of a user who uses an object to be authenticated that is required for use is acquired in advance as original authentication data, and when the user uses the object to be authenticated, authentication data is newly obtained as authentication data. A data storage unit that stores the original authentication data in an authentication system that authenticates a user and enables use of the object to be authenticated when the original authentication data matches the authentication target data And an authenticated data pre-acquisition means for acquiring and transmitting the authenticated data when the user is approaching the authenticated object, acquiring the original authentication data from the data storage unit, and the authenticated data Receiving pre-authentication data from pre-acquisition means, judging whether they match, and pre-authentication means for performing authentication before the user reaches the authentication object.
<Explanation 1> That is, when the user is approaching the object to be authenticated, the data to be authenticated is acquired and compared with the original authentication data to authenticate the user. Therefore, the user waits for authentication before the object to be authenticated. This saves time and improves convenience.

<Configuration 2> Authentication data of a user who uses an object to be authenticated that is required for use is acquired in advance as original authentication data, and when the user uses the object to be authenticated, authentication data is newly set as authentication data. In an authentication system that acquires and authenticates a user and enables the use of an object to be authenticated when the original authentication data and the authentication target data match, a data storage unit that stores the original authentication data; Carry and acquire the authentication data from the portable terminal that acquires and authenticates wireless data while the user is approaching the object to be authenticated, and the original data from the data storage unit. Pre-authenticating means for receiving wirelessly, judging these matches, and performing authentication before the user reaches the object to be authenticated.
<Explanation 2> That is, since the authenticated data is acquired while the user is approaching the authentication object and compared with the original authentication data, the user is authenticated before the authentication object. This saves time and improves convenience.

<Configuration 3> The mobile terminal includes a contactless IC tag that stores a user identification number assigned to the terminal in advance as a user identification number, and when the data storage unit stores the original authentication data, The user identification number is stored as the original user identification number in correspondence with the original authentication data. When the pre-authentication means wirelessly receives the data to be authenticated, the user is searched for the original authentication data matching the authentication data from the data storage unit. And authenticating the original user identification number corresponding to the matched original authentication data, and when the non-contact IC tag enters a predetermined communication area, wirelessly communicates with the non-contact IC tag and the user identification number The tag communication unit that acquires the user ID and the original user identification number acquired by the authentication unit are compared with the user identification number acquired by the tag communication unit. And a verification unit that makes the authenticated object available.
<Explanation 3> That is, while the user is approaching the object to be authenticated, the data to be authenticated is acquired and compared with the original authentication data, so that the user waits for authentication before the object to be authenticated. This saves time and improves convenience.

<Configuration 4> A portable terminal includes a non-contact IC tag including a data storage unit that stores original authentication data and an authentication unit that searches and authenticates original authentication data that matches the data to be authenticated from the data storage unit. When the mobile device detects that the mobile device has entered the predetermined authentication area, it notifies the mobile device to acquire the data to be authenticated and receives the authentication result in the authentication unit. A portable terminal detection means for outputting a permission signal and enabling use of the object to be authenticated is provided.
<Explanation 4> That is, since the authenticated data is acquired while the user is approaching the authentication object and compared with the original authentication data, the user is authenticated before the authentication object. This saves time and improves convenience.

<Configuration 5> An authentication result determining means for invalidating authentication is provided when an authentication effective condition for determining whether the authentication result is valid is set in advance and the authentication effective condition is not satisfied.
<Explanation 5> That is, even if the authentication is performed, if the authentication valid condition is not satisfied, the authentication is invalidated. For example, even when the user stops passing the gate, the security level can be maintained. .

<Configuration 6> The authentication valid condition is that the pre-authentication unit and the non-contact IC tag can communicate with each other.
<Explanation 6> That is, even if the user is authenticated, the authentication is invalidated if the authentication valid condition is not satisfied, so that the security level can be maintained even when the user stops passing the gate, for example. It becomes possible.

<Configuration 7> A predetermined time after the authentication is performed by the authentication unit is set as an authentication valid condition.
<Explanation 7> That is, even if the user is authenticated, the authentication is invalidated if the authentication valid condition is not satisfied. For example, even if the user stops passing the gate, the security level can be maintained. It becomes possible.

<Configuration 8> An authentication valid condition is set within a predetermined time from when the use permission signal is output.
<Explanation 8> That is, even if the user is authenticated, the authentication is invalidated when the authentication valid condition is not satisfied. For example, even when the user stops passing the gate, the security level can be maintained. It becomes possible.

<Configuration 9> A predetermined time period from when the use permission signal is output is set as an authentication valid condition, and the predetermined time period can be set.
<Explanation 9> That is, for example, when using a personal computer or the like, if the time is set, the frequency of authentication processing is reduced each time the personal computer is accessed, and convenience is improved.

<Configuration 10> A measurement unit is provided that sets the distance between the mobile terminal and the object to be authenticated within a predetermined distance as an authentication effective condition and measures the distance.
<Explanation 10> That is, even if the user is authenticated, the authentication is invalidated when the authentication valid condition is not satisfied, so that the security level can be maintained even when the user stops passing the gate, for example. It becomes possible.

<Configuration 11> A mobile terminal is assumed to be a mobile phone provided with a non-contact IC tag.
<Explanation 11> That is, by providing a mobile terminal with a non-contact IC tag in a mobile phone, new equipment investment can be made inexpensive and the cost can be reduced.
<Configuration 12> The authentication data is data based on biological information such as a voiceprint, fingerprint, retina, iris, and the like.
<Explanation 12> That is, by using ecological information as authentication data, it is possible to prevent inconveniences such as forgetting numbers, wrong numbers, and plagiarism like passwords, and improve reliability.

  According to the authentication system of the present invention, since the authenticated data is acquired while the user is approaching the object to be authenticated and compared with the original authentication data, the user is authenticated before the object to be authenticated. The time for waiting for authentication can be saved and the convenience can be improved.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the following description, the iris authentication method will be described as an example of the authentication method, but the present invention relates to other biometric authentication methods and other authentication methods for identifying an individual based on biological information such as voiceprints, fingerprints, and retinas. Is also available.

<Configuration of Example 1>
FIG. 1 is a block diagram showing the configuration of an authentication system according to the present invention. A gate (object to be authenticated) 10, a management device (pre-authentication means) 20, a gate opening / closing device (pre-authentication means) 30, and a non-contact IC tag reader / writer 40. The mobile terminal 50 is configured.

  The management device 20 acquires authentication data (authenticated data) by wireless communication with the outside, a data storage unit 25 that stores authentication data (original authentication data) and a user identification number (original user ID) assigned to the user. The wireless communication unit 22, the authentication unit 23 that authenticates the user by comparing the original authentication data from the data storage unit 25 and the data to be authenticated received via the wireless communication unit 22, the contactless IC tag reader / writer 40, and the gate opening / closing An IF unit 24 that forms an external interface with the device 30 is provided.

  The portable terminal 50 includes an authentication data acquisition unit 51 that acquires user authentication data, a non-contact IC tag 52 that stores a user ID (user ID), a wireless communication unit 53 that communicates with the wireless communication unit 22 of the management device 20, and the like. It has. The non-contact IC tag 52 incorporates an IC chip that can rewrite data, transmits and receives information by radio waves, and receives power from the radio waves. Of course, the power source may be built-in.

  The mobile terminal 50 may be a dedicated terminal or a mobile phone. Many mobile phones in recent years have a built-in camera, and the user's authentication data can be acquired by such a camera and transmitted by its communication function. Therefore, the mobile terminal provided with the authentication data acquisition unit 51 and the wireless communication unit 53 Compared with the case where the 50 is newly manufactured, there is an advantage that the cost can be reduced and the trouble of having to carry both the mobile terminal 50 and the mobile phone can be prevented.

  The gate opening / closing device 30 detects the non-contact IC tag 52 of the mobile terminal 50 and acquires the user ID stored in the non-contact IC tag 52 via the tag communication unit 31. A collation unit 32 that collates the received user ID with the original user ID acquired from the management device 20, an opening / closing locking unit 36 that opens / closes the gate 10, and a locking condition that determines whether the gate 10 is unlocked A determination unit (authentication result determination means) 35, an IF unit 33 that forms an external interface with the management apparatus 20, a time measurement unit 37 that measures time, and an authentication valid condition storage that stores a determination criterion for determining whether or not to invalidate an authentication result Part 38 and the like.

  When the non-contact IC tag reader / writer 40 detects the non-contact IC tag 52 in a predetermined communication area, it performs wireless communication to read and write information.

<Operation of Example 1>
A registration procedure of original authentication data and an authentication procedure when passing through the gate 10 with such a configuration will be described. First, the registration procedure of original authentication data will be described. FIG. 2 is a diagram showing only the configuration used for registration of original authentication data extracted from the configuration shown in FIG. 1, and FIG. 3 is a flowchart showing the registration procedure of original authentication data.

  A user acquires original authentication data by the authentication data acquisition part 51 (step SA1). The original authentication data is transmitted to the management apparatus 20 via the wireless communication units 53 and 22 together with the original user ID and user information input from an input unit (not shown) of the portable terminal 50 and stored in the data storage unit 25. (Step SA2). Examples of user information include the user's name, sex, birthday, and sex. Further, the original user ID, user information, and the like may be directly input from the management apparatus 20.

  This original user ID is sent as a user ID to the non-contact IC tag reader / writer 40, and is recorded on the non-contact IC tag 52 by the non-contact IC tag reader / writer 40 (step SC3). In this way, the original authentication data of the user, the original user ID, the user information, and the like are stored in the data storage unit 25 of the management apparatus 20, and the user ID is stored in the non-contact IC tag 52, thereby completing the registration process.

  Next, an authentication procedure when passing through the gate 10 will be described. 4 is a diagram showing only the configuration used for the authentication procedure extracted from the configuration shown in FIG. 1, and FIG. 5 is a flowchart showing the authentication procedure. In order to pass through the gate 10, the user acquires data to be authenticated by the authentication data acquisition unit 51 of the portable terminal 50 being carried (step SB <b> 1).

  This data to be authenticated is transmitted to the management apparatus 20 via the wireless communication units 53 and 22 (step SB2). The authentication unit 23 of the management apparatus 20 searches the data storage unit 25 for original authentication data that matches the received authentication data, and authenticates the user if there is matching original authentication data (step SB3).

  Next, the original user ID stored corresponding to the original authentication data of the authenticated user is specified, and this is transmitted to the verification unit 32 of the gate opening / closing device 30 via the IF units 24 and 33 (step SB5). ). As a result, the original user ID of the user who intends to pass through the gate 10 is stored in the verification unit 32. When a plurality of users use the gate 10, a plurality of original user IDs are stored in the verification unit 32 according to the procedure described above.

  In such a state, the tag communication unit 31 waits for detection of the non-contact IC tag 52 (step SB6). The original user ID is held in the collation unit 32 only for the original user ID holding time (authentication valid condition), and the detection of the non-contact IC tag 52 by the tag communication unit 31 is valid within this original user ID holding time (step SB7). ). After the time has elapsed, the authentication is canceled (invalidated), and the original user ID stored in the verification unit 32 is deleted.

  The original user ID holding time starts when the original user ID is received by the verification unit 32 as the start time. Then, when the timer 37 measures the original user ID holding time, the collation unit 32 deletes the stored original user ID.

  As described above, the detection of the non-contact IC tag 52 is made valid only for a preset time. The user acquires the data to be authenticated and transmits it to the management device 20 in an attempt to pass through the gate 10. If it is possible to cancel the passage of the gate 10, if the authentication is made valid and the original user ID is stored in the verification unit 32, the occurrence of a situation where the reliability of security is lowered is prevented. It is to do. In addition, when the gate 10 is used by a plurality of users such as an office, a laboratory, or a factory, a situation in which a large amount of original user IDs are stored in the collation unit 32 may cause overflow. This is to prevent it from happening. When a plurality of users use one gate 10, the detection waiting time of the non-contact IC tag 52 is managed for each original user ID (that is, for each user).

  When the non-contact IC tag 52 is detected, the user ID stored in the non-contact IC tag 52 is read by the tag communication unit 31 and sent to the verification unit 32 (step SB8). As a result, the collation unit 32 stores the original user ID acquired from the management device 20 and the user ID acquired from the tag communication unit 31, and the collation unit 32 determines a match between them (step SB9). .

  As a result of the collation, if they match, the user approaching the gate 10 (that is, the user in the communication area of the tag communication unit 31) is identified as the user authenticated by the authentication unit 23, and the collation unit 32 is opened / closed. The unit 36 is instructed to unlock the gate 10 so that it can pass through the gate 10 (steps SB10 and SB11). Of course, if they do not match, the gate 10 does not open.

  When the gate 10 is unlocked, the unlocking condition determination unit 35 waits for the elapse of a preset unlocking time (authentication valid condition), and when this time is counted, instructs the unlocking / locking unit 36 to unlock. Then, the gate 10 is closed (steps SB12 and SB13).

  The unlocking time starts when the original user ID is received by the verification unit 32 as the starting time. Then, when the timing unit 37 counts the unlocking time, the locking condition determination unit 35 deletes the stored original user ID and invalidates the user authentication.

  The unlocking time can be set as a time until it can be predicted that the user will pass through the gate 10 after detecting the non-contact IC tag 52 when the user walks at a general walking speed. In this case, it is assumed that there is a staircase in front of the gate and it may take longer than in the case of other gates. Therefore, it is preferable that the unlocking time be settable.

  In addition to the time, for example, a distance at which the tag communication unit 31 can communicate with the non-contact IC tag 52 can be set as an authentication valid condition. In this case, the tag communication unit 31 detects the non-contact IC tag 52 once, notifies the collation unit 32 that it can no longer be detected, and the collation unit 32 thereby deletes the original user ID held by the collation unit 32. .

  In addition, a measuring device (for example, a distance measuring device using infrared rays or a distance measuring device using ultrasonic waves) that measures the distance between the tag communication unit 31 and the non-contact IC tag 52 is provided so that the non-contact IC tag 52 is within a predetermined distance. When it comes out (distant), the tag communication unit 31 notifies the collation unit 32 that the non-contact IC tag 52 can no longer be detected, whereby the collation unit 32 deletes the stored original user ID. By doing. In this case, convenience can be improved if the distance for invalidating the authentication can be set.

<Effect of Example 1>
As described above, since the user authentication is completed before the user reaches the gate, it is possible to save the waiting time for the authentication in front of the gate while maintaining a sufficient security level with a simple configuration. To improve.

  Even if the user is authenticated, the authentication result is invalidated when the authentication valid condition is not satisfied, so that the security level can be maintained.

  Further, by using the mobile terminal 50 as a mobile phone provided with the non-contact IC tag 52, new equipment investment can be made inexpensive and the cost can be reduced.

  Furthermore, by using biometrics authentication based on biometric information such as voiceprints, fingerprints, retinas, irises, etc., the authentication method can prevent inconveniences such as forgetting numbers, wrong numbers, and plagiarism, and improve reliability. It becomes possible.

<Configuration of Example 2>
Next, Example 2 will be described. In the first embodiment, the case where the authentication system according to the present invention is applied to authentication through a gate has been described. The second embodiment is applied to authentication processing of a personal computer (hereinafter referred to as a PC) used by a user. As shown in FIG. 6, the schematic configuration is almost the same as the configuration shown in FIG. 1, but a computer management device 60 is provided instead of the gate opening / closing device 30.

  The computer management device 60 detects the non-contact IC tag 52 of the portable terminal 50 and acquires the user ID recorded in the non-contact IC tag 52 via the tag communication unit 64. The collation unit 62 that collates the received user ID and the original user ID acquired from the management device 20, the access management unit 65 that manages the access of the PC 11, and the user account name (an indicator for identifying the PC user) The account setting unit 66 that makes the PC 11 usable by setting the PC 11 password), the IF unit 66 that forms an external interface with the management apparatus 20, and the time measuring unit 67 that measures time. And an authentication valid condition holding unit 68 for storing a criterion for determining whether or not to invalidate the authentication result.

<Operation of Example 2>
With this configuration, registration of original authentication data when the user uses the PC 11 is performed according to the procedure shown in FIG. 7 under the configuration shown in FIG. First, the user acquires original authentication data by the authentication data acquisition unit 51 (step SC1). This original authentication data is transmitted to the management apparatus 20 via the wireless communication units 53 and 22 together with the original user ID, user information, user account name, etc., and stored in the data storage unit 25 (step SC2). Examples of user information include the user's name, gender, birthday, gender, and the like. In addition, user information, original user ID, and the like may be directly input from the management apparatus 20.

  This original user ID is sent as a user ID to the non-contact IC tag reader / writer 40, and is stored in the non-contact IC tag 52 by the non-contact IC tag reader / writer 40 (step SC3). In this way, the user authentication data, the original user ID, the user information, the user account name, and the like are stored in the data storage unit 25 of the management apparatus 20, and the user ID is stored in the non-contact IC tag 52 and registered. Processing is complete.

  Next, an authentication procedure when starting to use the PC 11 will be described. FIG. 8 is a diagram showing only the configuration used for the authentication procedure extracted from the configuration shown in FIG. 6, and FIG. 9 is a flowchart showing the authentication procedure. In order to use the PC 11, the user acquires data to be authenticated by the authentication data acquisition unit 51 of the portable terminal 50 being carried (step SD <b> 1).

  This data to be authenticated is transmitted to the management apparatus 20 via the wireless communication units 53 and 22 (step SD2), and the authentication unit 23 searches the data storage unit 25 for original authentication data that matches the received data to be authenticated. If there is matching original authentication data, the user is authenticated (step SD3).

  Then, the original user ID and the user account name stored in correspondence with the original authentication data of the authenticated user are specified, and this is transmitted to the verification unit 62 of the computer management apparatus 60 via the IF units 24 and 33. (Step SD4). As a result, the original user ID and the user account name of the user who intends to pass through the gate 10 are stored in the verification unit 62.

  In such a state, the tag communication unit 64 waits for detection of the non-contact IC tag 52 (step SD5). The original user ID and the user account name are held in the collation unit 62 for the original user ID holding time (authentication valid condition), and the detection of the non-contact IC tag 52 by the tag communication unit 64 is valid within this time (step SD6). ).

  The original user ID holding time starts when the original user ID is received by the verification unit 32 as the start time. Then, when the timer 67 measures the original user ID holding time, the collation unit 62 deletes the stored original user ID.

After the elapse of the time, the authentication result is canceled (invalidated), and the original user ID and user account name stored in the verification unit 62 are deleted. The original user ID holding time can be started when the authentication unit 23 authenticates the user or when the collation unit 62 receives the original user ID or the like.

  The original user ID holding time can be set as a time that can be predicted as the time from detection of the non-contact IC tag 52 until reaching the PC 11 when the user walks at a general walking speed. In this case, it is assumed that there is a stairway in the middle and it may take more time than in other cases. Therefore, it is preferable that the time be settable.

  In addition to the time, for example, a distance at which the tag communication unit 31 can communicate with the non-contact IC tag 52 can be set as an authentication valid condition. In this case, the tag communication unit 31 notifies the collation unit 62 that the contactless IC tag 52 can no longer be detected, so that the collation unit 62 deletes the original user ID held by the collation unit 62.

  In addition, a measuring device (for example, a distance measuring device using infrared rays or a distance measuring device using ultrasonic waves) that measures the distance between the tag communication unit 31 and the non-contact IC tag 52 is provided so that the non-contact IC tag 52 is within a predetermined distance. When it comes out, the tag communication unit 31 notifies the collation unit 62 that the non-contact IC tag 52 can no longer be detected, so that the collation unit 62 deletes the original user ID held therein. In this case, convenience can be improved if the distance for invalidating the authentication can be set.

  When the non-contact IC tag 52 is detected, the user ID stored in the non-contact IC tag 52 is read and sent to the collation unit 62 (step SD7). Thus, the collation unit 62 has the original user ID acquired from the management device 20 and the user ID acquired from the tag communication unit 64, and determines that these user IDs match (step SD8). The collation unit 62 sends the user account name to the account setting unit 66 (step SD9). The account setting unit 66 sets the user account name by transmitting it to the PC 11 (step SD10).

  Then, after the account valid time stored in the authentication valid condition storage unit 68 has elapsed since the account setting unit 66 transmitted the user account name, the access management unit 65 invalidates the user access (step SD11, SD12). This is to maintain the security state when the user stops using the PC 11 or leaves the seat for a long time while using the PC 11.

  The account valid time starts when the collation unit 62 receives the original user ID. When the time counting unit 67 counts the account valid time, the lock condition determination unit 35 deletes the stored original user ID and invalidates the user authentication.

  If this time can be set by the user, it is possible to reduce the trouble of performing authentication every time the user accesses the PC 11 and improve convenience. When the PC 11 is used, a usage signal is sent from the PC 11 to the access management unit 65 via the account setting unit 66, and when this signal is not received (for example, a screen saver or the like in a personal computer). In such a situation, the access may be invalidated.

  Further, the case where the authentication process is performed when logging on to the PC 11 has been described. However, when the screen lock is released, when a specific application is started, when a specific file or folder is accessed, the authentication process is performed. It may be.

<Effect of Example 2>
As described above, since the authentication process can be executed before the user arrives at the PC 11, it is possible to save the waiting time for the authentication in front of the PC while ensuring sufficient security with a simple configuration. improves.

  Even if authentication is performed, if the authentication validity condition is not satisfied, the authentication result becomes invalid, so the security level can be maintained, and the troublesomeness of authenticating each time the PC is started can be reduced. become.

  Further, by using the mobile terminal 50 as a mobile phone provided with the non-contact IC tag 52, the cost of new equipment becomes unnecessary and the cost can be reduced.

  Furthermore, by using biometrics authentication based on biometric information such as voiceprints, fingerprints, retinas, irises, etc., the authentication method improves reliability by preventing inconveniences such as forgetting numbers, wrong numbers, and plagiarism like passwords. It becomes possible.

<Configuration of Example 3>
Next, Example 3 will be described. In the authentication system described so far, the original authentication data is acquired in advance and stored in the data storage unit 25. However, when the communication distance of the non-contact IC tag is long or the acquisition time of the data to be authenticated in the authentication data acquisition unit 51 is short, the original authentication data is acquired and stored in the non-contact IC tag 52 in advance, You may enable it to authenticate with a non-contact IC tag.

  FIG. 10 is a block diagram showing a schematic configuration of such an authentication system, which includes a PC (authenticated object) 11, a computer management device 70, a non-contact IC tag reader / writer 40, a portable terminal 50, and the like. In the third embodiment, a case where the authentication system is used for authentication to the PC 11 described in the second embodiment will be described. However, the gate in the first embodiment and other uses can also be applied.

  The mobile terminal 50 includes an authentication data acquisition unit 51 that acquires user authentication data, a user ID assigned to the mobile terminal 50, a user's original authentication data, user information, a user account, a user account name, and the like. When the wireless communication unit 73 that communicates with the wireless communication unit 73 of the computer management device 70 and the non-contact IC tag 54 can communicate with the computer management device 70, the lamp is turned on and blinking, the vibrator is operated, and the sound is emitted. A notification unit (portable terminal detection means) 55 that notifies the user that the user can communicate with the computer management apparatus 70 and can perform authentication processing is provided.

  As shown in FIG. 11, the non-contact IC tag 54 includes an antenna 81, a power source 82 such as a battery, and an IC chip 80. The IC chip 80 includes a memory (data holding unit) 84 in which authentication data, a user account name, and the like are recorded, an authentication unit 83 that executes authentication processing based on the original authentication data recorded in the memory 84, and the like. .

  The computer management device 70 includes a wireless communication unit 73 that communicates with the wireless communication unit 53 of the mobile terminal 50, and a tag communication unit 74 that communicates with the contactless IC tag 54 of the mobile terminal 50 and reads / writes data from / to the memory 84. , An access management unit 71 that manages access to the PC 11, an account setting unit 72 that sets a user account name in the PC 11 and makes the PC 11 usable, an IF unit 75 that forms an external interface with the non-contact IC tag reader / writer 40, time A timing unit 77 that counts the authentication time, an authentication valid condition holding unit 78 that stores a criterion for determining whether or not to invalidate the authentication result, and the like.

<Operation of Example 3>
With this configuration, registration of original authentication data when the user uses the PC 11 is performed according to the procedure shown in FIG. 13 under the configuration shown in FIG. FIG. 12 is a diagram showing a configuration necessary for registration of original authentication data extracted from the configuration shown in FIG. First, the user authentication data is acquired by the authentication data acquisition unit 51 (step SE1).

  The original authentication data is transmitted to the computer management apparatus 70 via the wireless communication units 53 and 73 together with the original user ID, user information, user account name, etc., and is sent from the non-contact IC tag reader / writer 40 to the memory 84 of the non-contact IC tag 54. (Step SE2). Examples of user information include the user's name, sex, birthday, and sex.

  Next, an authentication procedure when starting to use the PC 11 will be described. FIG. 14 shows only the configuration used for the authentication procedure extracted from the configuration shown in FIG. 10, and FIG. 15 is a flowchart showing the authentication procedure. When the user approaches the PC 11 used by the user and enters the communication area of the tag communication unit 74 in the computer management device 70, the tag communication unit 74 detects the non-contact IC tag 54 (step SF1), and the detection signal is wireless communication. It is sent to the notification unit 55 of the portable terminal 50 via the units 73 and 53 (step SF2).

  In response to this detection signal, the notification unit 55 notifies the user that communication with the computer management apparatus 70 is possible and authentication processing is possible by a method such as lighting or blinking the lamp, operating a vibrator, or making a sound. . Therefore, the user acquires the data to be authenticated by the authentication data acquisition unit 51 (step SF3), sends it to the non-contact IC tag 54 via the wireless communication units 53 and 73 and the tag communication unit 74, and records it in the memory 84. (Step SF4).

  At this stage, since the original authentication data and user account name registered in advance and the data to be authenticated are recorded in the memory 84, the authentication unit 83 compares these authentication data, If they match, the user is authenticated (step SF5). When the user is authenticated, the contactless IC tag 54 sends the user account name to the account setting unit 72 via the tag communication unit 74 (steps SF6 and SF7), and the account setting unit 72 sets the user account name in the PC 11. (Step SF8).

  Then, after the account setting unit 72 sets the user account name in the PC 11, the access management unit 71 reads the account valid time (authentication valid condition) stored in the authentication valid condition storage unit 78. When this time is counted, the user's access is invalidated (steps SF9 and SF10). This is to maintain the security state when the user stops using the PC 11 or leaves the seat for a long time while using the PC 11.

  If this time can be set by the user, it is possible to save the trouble of performing authentication every time the user accesses the PC 11, and the convenience is improved. When the PC 11 is used, a usage signal is sent from the PC 11 to the access management unit 71 via the account setting unit 72, and when this signal is not received (for example, a screen saver or the like in a personal computer). In such a situation, the access may be invalidated.

  Further, the case where the authentication process is performed when logging on to the PC 11 has been described. However, when the screen lock is released, when a specific application is started, when a specific file or folder is accessed, the authentication process is performed. It may be.

<Effect of Example 3>
As described above, since the original authentication data to be verified previously recorded on the non-contact IC tag is recorded, the data to be authenticated acquired at the time of authentication is recorded, and these are collated with the non-contact IC tag. An authentication information database for storing the data to be verified to be verified is not required, a management device is not required, the system can be downsized, and the cost can be reduced and the installation area can be reduced. .

  In addition, even if authentication is performed, if the authentication validity condition is not satisfied, the authentication is invalidated, so the security level is maintained, and the troublesomeness of performing authentication every time the PC is started can be reduced. Become.

  Further, by using the mobile terminal 50 as a mobile phone provided with the non-contact IC tag 52, the cost of new equipment becomes unnecessary and the cost can be reduced.

  Furthermore, by using biometrics authentication based on biometric information such as voiceprints, fingerprints, retinas, irises, etc., the authentication method improves reliability by preventing inconveniences such as forgetting numbers, wrong numbers, and plagiarism like passwords. It becomes possible.

<Configuration of Example 4>
In each of the first to third embodiments described so far, the data to be authenticated is acquired by the portable terminal 50 carried by the user and transmitted to the management device 20 or the like by wireless communication. However, for the purpose of, for example, standing in front of the gate 10 and waiting for the authentication process, it is also possible to fix the authentication data acquisition means for acquiring the authentication data at the entrance of the building or the branching part of the corridor. Is possible. FIG. 16 is a block diagram of an authentication system showing such a configuration, which is basically the same as the authentication system described so far. In the fourth embodiment, the gate 10 as shown in the first embodiment will be described as an example of the object to be authenticated.

  In this case, the authenticated data pre-acquisition means 90 includes the above-described authentication data acquisition unit 51 and wireless communication unit 53, and the user carries only the non-contact IC tag 52. Note that the data to be authenticated acquired by the authentication data acquisition unit 51 can be used not by wireless communication but also by wired communication. In the following, it is assumed that wireless communication is used. The non-contact IC tag 52 stores the user ID as described above.

<Operation of Example 4>
The registration of the original authentication data is performed according to the procedure described above. Further, in the authentication procedure, the user acquires the data to be authenticated using the data to be authenticated pre-acquisition means 90 provided on the way to the gate 10. Then, this data to be authenticated is wirelessly transmitted to the management apparatus 20, and user authentication is performed by the authentication unit 23 and an original user ID for identifying the user is specified. The original user ID is sent to the verification unit 32 of the gate opening / closing device 30.

  In this state, when the tag communication unit 31 detects the non-contact IC tag 52, the user ID is read from the non-contact IC tag 52, and the original user ID and the user ID are collated. If they match, the gate 10 is unlocked.

<Effect of Example 4>
As described above, since the authentication process can be executed before the user arrives at the object to be authenticated, the time for waiting for authentication in front of the object to be authenticated while ensuring sufficient security with a simple configuration. Save convenience and improve convenience.

  In particular, since it is not necessary for each user to carry an authentication data acquisition unit or the like, portability is improved and equipment costs are reduced.

1 is a block diagram of an authentication system applied to the description of Embodiment 1. FIG. It is a block diagram used for registration of original authentication data. It is a flowchart which shows the registration procedure of original authentication data. It is a block diagram used for authentication. It is a flowchart which shows an authentication procedure. It is a block diagram of an authentication system applied to description of Example 2. FIG. It is a flowchart which shows the registration procedure of original authentication data. It is a block diagram used for authentication. It is a flowchart which shows an authentication procedure. It is a block diagram of an authentication system applied to description of Example 3. FIG. It is a block diagram which shows the structure of a non-contact IC tag. It is a block diagram used for registration of original authentication data. It is a flowchart which shows the registration procedure of original authentication data. It is a block diagram used for authentication. It is a flowchart which shows an authentication procedure. It is a block diagram of an authentication system applied to description of Example 4. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Gate 20 Management apparatus 23,83 Authentication part authentication part 25 Data storage part 30 Gate opening / closing apparatus 31,64,74 Tag communication part Tag communication part 32,62 Verification part 35 Locking condition judgment part 36 Opening / closing lock part 50 Portable terminal 51 Authentication data acquisition unit 52, 54 Non-contact IC tag 55 Notification unit 60 Computer management device 65, 71 Access management unit 66, 72 Account setting unit 70 Computer management device 84 Memory 90 Authentication data pre-acquisition means 37, 67, 77 Timekeeping unit 38, 68, 78 Authentication validity condition holding part

Claims (12)

Authentication data of a user who uses an object to be authenticated that is required for use is acquired in advance as original authentication data, and when the user uses the object to be authenticated, authentication data is newly acquired as data to be authenticated. In the authentication system that authenticates the user and enables the use of the authentication object when the original authentication data and the authentication object data match,
A data storage unit for storing the original authentication data;
An authenticated data pre-acquisition means for acquiring and transmitting the authenticated data when the user is approaching the authenticated object;
Acquiring the original authentication data from the data storage unit, receiving the authenticated data from the authenticated data pre-acquisition means, judging their match, and authenticating before the user reaches the authenticated object An authentication system comprising pre-authentication means for performing Authentication data of a user who uses an object to be authenticated that is required for use is acquired in advance as original authentication data, and when the user uses the object to be authenticated, authentication data is newly acquired as data to be authenticated. In the authentication system that authenticates the user and enables the use of the authentication object when the original authentication data and the authentication object data match,
A data storage unit for storing the original authentication data;
A portable terminal that is carried by a user and wirelessly transmits the authenticated data while the user is approaching the authenticated object;
Obtaining the original authentication data from the data storage unit, receiving the data to be authenticated from the mobile terminal wirelessly, judging their match, and performing authentication before the user reaches the object to be authenticated An authentication system comprising: an authentication unit. The mobile terminal includes a non-contact IC tag that stores a user identification number assigned in advance to the user as a user identification number;
When the data storage unit stores the original authentication data, the user storage number is stored as an original user identification number corresponding to the original authentication data,
When the pre-authentication unit wirelessly receives the data to be authenticated, it searches the original authentication data that matches the data to be authenticated from the data storage unit to authenticate the user, and corresponds to the matched original authentication data An authentication unit that acquires the original user identification number, a tag communication unit that wirelessly communicates with the non-contact IC tag when the non-contact IC tag enters a predetermined communication area, and acquires the user identification number; and the authentication A collation unit that collates the original user identification number acquired by the unit with the user identification number acquired by the tag communication unit, and outputs a use permission signal when the two match and makes the authenticated object available. The authentication system according to claim 2, wherein: The mobile terminal includes the data storage unit that stores the original authentication data, and the authentication unit that authenticates the user by searching the data storage unit for the original authentication data that matches the authentication target data. Equipped with IC tag,
When it is detected that the mobile terminal has entered a predetermined authentication area, the mobile terminal is notified to acquire the data to be authenticated, and the authentication result in the authentication unit is received and the authentication is normally performed. 3. The authentication system according to claim 2, further comprising portable terminal detection means for outputting a use permission signal to enable use of the object to be authenticated.   An authentication result judging means for invalidating the authentication is provided when an authentication valid condition that is a criterion for determining whether or not the authentication result is valid is set in advance and the valid authentication condition is not satisfied. The authentication system according to any one of claims 2 to 4, wherein:   6. The authentication system according to claim 5, wherein the authentication valid condition is that the pre-authentication unit and the non-contact IC tag can communicate with each other.   The authentication system according to claim 5, wherein the authentication valid condition is a predetermined time after authentication by the authentication unit.   The authentication system according to claim 5, wherein the authentication valid condition is a predetermined time from when the use permission signal is output.   6. The authentication system according to claim 5, wherein a predetermined time period from when the use permission signal is output is set as the authentication valid condition, and the predetermined time period can be set.   The authentication system according to claim 5, wherein the authentication effective condition is that a distance between the portable terminal and the object to be authenticated is within a predetermined distance, and a measurement unit that measures the distance is provided. .   The authentication system according to claim 2, wherein the mobile terminal is a mobile phone including the contactless IC tag. The authentication system according to any one of claims 1 to 11, wherein the authentication data is data based on biological information such as a voice print, a fingerprint, a retina, and an iris.

Images