WO2011099446A1

WO2011099446A1 - Authentication device and authentication method

Info

Publication number: WO2011099446A1
Application number: PCT/JP2011/052518
Authority: WO
Inventors: 竹田　真弓
Original assignee: コニカミノルタホールディングス株式会社
Priority date: 2010-02-12
Filing date: 2011-02-07
Publication date: 2011-08-18
Also published as: JP2013080267A

Abstract

In an information terminal (100), a touch sensor (107) receives input of information for partitioning an image displayed upon a display unit (110). Authentication-use information stored in a third storage unit (157) includes an authentication-use image and partitioning-use information. An authentication assessment unit (154) assesses that user authentication has succeeded upon determining that the result of the authentication-use image being partitioned according to information input into the touch sensor (107) matches the result of the authentication-use image being partitioned according to the partitioning-use information.

Description

Authentication apparatus and authentication method

The present invention relates to an authentication device and an authentication method, and more particularly to an authentication device and an authentication method for performing user authentication based on information input from the outside.

Conventionally, user authentication has been performed electronically in order to permit access to a website.

In the technology related to user authentication, for example, a user name and password are registered in advance in an authentication device, the user is prompted to input a user name and password, and if the registered and the inputted one match, the authentication is successful. There was something to do.

In addition, in such a technique, there is a problem that the user must remember his / her user name and password, which is complicated for the user.

In recent years, in order to eliminate such complications for users, a technique for performing user authentication by displaying an image on a display unit at the time of authentication and inputting information corresponding to the image has been disclosed.

As such a technique, as described in Non-Patent Document 1, for example, an object is displayed on a screen, and authentication is performed based on appropriateness such as a point touching the object and its order, or non-patent As described in Document 2, there are some cases where a plurality of points are displayed on the screen, and authentication is performed based on the suitability of the tracing method (pattern) of the plurality of points.

As described above, according to the technology for performing user authentication based on whether or not the screen is touched in the same pattern as the registered pattern for the displayed image, the user has no meaning (can be associated with other matters). Difficult) It is not a character string such as a password, but the sequence of actions such as stroking the eyes and nose of multiple tigers displayed on the screen in order from the left, and the initials as a trajectory that traces multiple points displayed on the screen User authentication can be performed using items that are relatively easy to remember by being associated with other items, such as the same alphabet trajectory.

However, the user's input action of touching the screen with a specific pattern has a new problem that the contents can be easily estimated by a third party who has seen the action.

Here, when a pattern required for the user to input for authentication is complicated so that it is difficult for a third party to estimate, a situation occurs in which the user is difficult to remember the pattern and is complicated for the user.

In other words, with the conventional technology, if it is attempted to input authentication information in a short time and easily, the content may be easily estimated by a third party, and the security strength cannot be ensured. In this case, there is a problem that it is complicated for the user.

The present invention has been conceived in view of such circumstances, and an object thereof is to achieve both security strength and user convenience in an authentication apparatus.

An authentication apparatus according to the present invention receives an input of information for dividing a predetermined region, a storage unit for storing information related to division of the predetermined region, and an input to the receiving unit A generation unit for generating information for dividing a predetermined area based on the information, and a determination unit for determining whether the information generated by the generation unit matches information stored in the storage unit; Is provided.

An authentication method according to the present invention is a method for authenticating a user at an information terminal, the step of accepting input of information for dividing a predetermined area, and the step of storing information relating to division of the predetermined area; The step of generating information for dividing the predetermined area based on the input information, and the information for dividing the predetermined area generated based on the input information match the information stored in the storage unit Determining whether or not to do so.

According to the present invention, the authentication apparatus can achieve both security strength and user convenience.

It is a figure for demonstrating the whole structure of the information terminal which is 1st Embodiment of the authentication apparatus of this invention. It is a figure which shows the hardware constitutions of the information terminal of FIG. It is a control block diagram of the information terminal of FIG. It is a flowchart of the main routine performed in the information terminal of FIG. 5 is a flowchart of a subroutine of authentication information registration processing of FIG. 4. 5 is a flowchart of a user authentication processing subroutine of FIG. 4. It is a figure which shows an example of the image for authentication displayed in the user authentication process of FIG. It is a figure which shows an example of the image displayed in the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the processing content of the user authentication process of FIG. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is 2nd Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is 2nd Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is a modification of 1st Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the content of the user authentication process performed in the information terminal which is a modification of 1st Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating the case where a user authentication fails in the information terminal which is 1st Embodiment of the authentication apparatus of this invention. It is a figure for demonstrating an example of the interpolation aspect of the data in the authentication apparatus of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each figure, elements having the same function are denoted by the same reference numerals, and description thereof will not be repeated.

[1. First Embodiment]
[1-1. Schematic configuration of information terminal]
FIG. 1 shows an appearance of an information terminal 100 that is the first embodiment of the authentication apparatus of the present invention.

The information terminal 100 has a display unit 110 on its main surface. The display unit 110 is configured by a general display device such as an LCD (liquid crystal display).

Four operation keys 112 to 115 are provided below the display unit 110 on the main surface of the information terminal 100. The function assigned to each of the operation keys 112 to 115 can be changed according to the type of application being executed on the information terminal 100 and the state in which the application is being executed.

On the right side surface of the information terminal 100, a power key 111 for switching ON / OFF of power-on of the information terminal 100 is provided. A card slot 120 for inserting a recording medium such as a memory card into the main body of the information terminal 100 is provided on the lower surface of the information terminal 100.

Further, the information terminal 100 is provided with a touch pen 190 that is separated from the main body of the information terminal 100.

[1-2. Information terminal hardware configuration]
FIG. 2 is a control block diagram of the information terminal 100 of FIG.

Referring to FIG. 2, the information terminal 100 stores a CPU (Central Processing Unit) 101 that controls the entire terminal, a RAM (Random Access Memory) 102 that temporarily stores data, and programs and constants. ROM (Read Only Memory) 103, a hard disk drive (HDD) 104 for storing image data, and a communication interface (I / F) 105 for connecting to a network for communication with other devices , An input unit 106, a touch sensor 107 provided in contact with the display unit 110, and a card reader 108. The input unit 106 includes operation keys 112 to 115 and a power key 111.

The card reader 108 reads and / or writes information with respect to the recording medium inserted into the card slot 120.

[1-3. Block configuration of information terminal]
FIG. 3 is a control block diagram of the information terminal 100.

Referring to FIG. 3, in information terminal 100, when operation is performed on touch sensor 107 and / or operation keys 112-115, input determination unit 151 detects that the operation has been performed and the content thereof. In the information terminal 100, the information input unit 150 is configured by the touch sensor 107, the operation keys 112 to 115, and the input determination unit 151.

The display control unit 155 controls the display content of the display unit 110 via the drawing control unit 156, and stores the screen data displayed on the display unit 110 in the second storage unit 153.

In this embodiment, information used for user authentication is referred to as authentication information. The authentication information includes an authentication image displayed on the display unit 110 at the time of user authentication, and division information that is information for specifying a mode for dividing the authentication image with respect to the authentication image. . The authentication information generation unit 152 stores the authentication image in the first storage unit 158 and stores the division information in the third storage unit 157.

In the information terminal 100, the input determination unit 151, the authentication determination unit 154, the display control unit 155, the drawing control unit 156, the authentication information generation unit 152, and the input information generation unit 159 are stored in the HDD 104 or the like. It is realized by executing the program. Each unit may be realized by a dedicated hardware component such as a dedicated LSI (Large-Scale Integration) having an equivalent function.

[1-4. Main routine]
FIG. 4 is a flowchart of a main routine executed in information terminal 100 of the present embodiment. The main routine is started when the power key 111 is operated from the state where the information terminal 100 is turned off.

Referring to FIG. 4, first, in step S1, CPU 101 was operating another key (any one of operation keys 112 to 115) during operation of power key 111, which was a condition for starting the main routine. If it is determined that it has been operated, the process proceeds to step S2, and if it is determined that it has not been operated, the process proceeds to step S3.

In step S2, the CPU 101 executes an authentication information registration process and proceeds to step S4. Details of the authentication information registration process will be described later.

In step S3, the CPU 101 executes a user authentication process and advances the process to step S4.

In step S4, the CPU 101 determines whether or not an operation for turning off the information terminal 100 has been performed. If it is determined that the operation has not been performed, the process proceeds to step S5.

In step S5, the CPU 101 executes a process corresponding to the content of the operation on the information terminal 100, and advances the process to step S4.

In the information terminal 100, the process of step S5 is continued until an operation to turn off the power is performed. If the CPU 101 determines in step S4 that an operation to turn off the power has been performed, the CPU 101 ends the process.

[1-5. Authentication information registration process]
FIG. 5 is a flowchart of a subroutine of authentication information registration processing in step S2.

Referring to FIG. 5, in the authentication information registration process, in step S21, CPU 101 registers information for specifying the authentication image in first storage unit 158, and the process proceeds to step S22.

Here, the authentication image may be specified by information input by a user who operates the information terminal 100, or the CPU 101 stores it in a storage device such as the HDD 104 or another device on the network using a random number or the like. It may be configured to select from the images that are displayed.

In step S22, the CPU 101 registers the above division information in the third storage unit 157, and returns the process to FIG.

The division information may be generated and registered based on the operation contents for the touch sensor 107 and the operation keys 112 to 115, or information selected by the CPU 101 using a random number or the like may be registered.

Further, the division information can be, for example, information on how many areas the display unit 110 is divided into.

[1-6. User authentication process]
FIG. 6 is a flowchart of the user authentication processing subroutine in step S3.

In the user authentication process, first, in step S31, the CPU 101 causes the display control unit 155 to acquire the authentication image stored in the first storage unit 158, and advances the process to step S32.

In step S32, the display control unit 155 sends the authentication image acquired in step S31 to the drawing control unit 156, causes the display unit 110 to display the image, and proceeds to step S33.

In step S33, the CPU 101 activates the input device (touch sensor 107 and operation keys 112 to 115), and advances the process to step S34.

In step S34, the process waits until there is an input to the input device, and in step S35, it is determined whether or not an input has been made. If it is determined that an input to the input device has been made, the process proceeds to step S36.

In step S36, the display control unit 155 updates the display content of the display unit 110 based on the information input to the touch sensor 107, and the process proceeds to step S37.

In step S37, the input determination unit 151 determines whether or not the input of information to the touch sensor 107 has been completed. When it is determined that the input has not been completed, the process returns to step S34, and when it is determined that the input has been completed, the process proceeds to step S38. Proceed with the process. In step S37, for example, an operation key (any one of the operation keys 112 to 115) that is a condition for completing the input is operated, or an input to the touch sensor 107 is not continuously performed for a predetermined time. It is determined that the input is completed as a condition.

In step S38, the input information generation unit 159 generates information for dividing the display unit 110 based on the information input to the touch sensor 107, and advances the process to step S39.

In step S39, the authentication determination unit 154 compares the input information generated by the input information generation unit 159 in step S38 with the division information stored in the third storage unit 157, thereby obtaining the result of user authentication. The authentication determination result is displayed on the display unit 110, the user authentication process is terminated, and the process returns to FIG.

When the process returns to FIG. 4, if the result of the authentication process in step S39 is an authentication success, the process proceeds to step S4 and subsequent steps, but if the authentication fails, the process does not proceed to step S4 and subsequent steps. An error notification or the like is made.

[1-7. Display contents in user authentication processing]
Here, the content of the user authentication process described with reference to FIG. 6 will be described in more detail together with the change in the display content on the display unit 110.

FIG. 7 is a diagram illustrating an example of an authentication image displayed on the display unit 110 in step S32 in the user authentication process. The authentication image 990 in FIG. 7 includes an image of the watermelon 900.

FIG. 8 is a diagram showing the screen updated so as to add a locus of input to the touch sensor 107 in step S36.

Referring to FIG. 8, on line 991 displayed on display unit 110, two

lines

901 and 902 are added and displayed in addition to image 990 shown in FIG.

Lines

901 and 902 represent two linear trajectories input to the touch sensor 107.

Next, generation of input information in step S38 will be described from two linear trajectories represented by

lines

901 and 902. FIG.

FIG. 9 shows a virtual state in which only the

lines

901 and 902 shown on the screen 990 in FIG. 8 are displayed on the display unit 110 with the watermelon 900 omitted.

The input information generation unit 159 interpolates each of the two

lines

901 and 902 input to the touch sensor 107 using a well-known method such as a Lagrangian interpolation method, so as to reach the end of the display unit 110. The data is interpolated so that the line segment reaches.

FIG. 10 shows a state where the line 901 is interpolated. The interpolated portion is indicated by a broken line.

Furthermore, the state in which the line 902 is also interpolated is shown in FIG. In FIG. 11, a portion extended by interpolation is indicated by a broken line.

The input information generation unit 159 is an area in which the display area of the display unit 110 is divided by the locus of input to the touch sensor 107 and the line obtained by interpolating the locus as shown in FIG. The number of is calculated. In the example shown in FIG. 11, the display area of the display unit 110 is divided into four areas.

In step S39, the authentication determination unit 154 determines the number of areas acquired by the input information generation unit 159 in the manner described with reference to FIG. 11 and the areas stored in advance in the third storage unit 157. The numbers are compared, and if they match, it is determined that the user authentication has succeeded, and if they do not match, it is determined that the user authentication has failed.

And the determination result about the user authentication by the said authentication determination part 154 is displayed on the display part 110 by step S39.

[1-8. Modification of processing of input information generation unit]
As described above with reference to FIGS. 10 and 11, if two lines obtained as the locus of the touch operation on the touch sensor 107 intersect, as described with reference to FIG. 11. In addition, information for dividing the display unit 110 can be generated by interpolating the lines of the trajectories.

Note that, as shown as

lines

911 and 912 in FIG. 12, the end of one line 911 is in contact with the other line 912 in the locus of two lines obtained as the locus of the touch operation. For example, two types of interpolation modes can be considered.

First, as shown in FIG. 13, the display area of the display unit 110 is divided into three without interpolating data at the end of the line 911 that is in contact with the line 912. To do.

Second, as shown in FIG. 14, the end of the line 911 that is in contact with the line 912 is also interpolated in the same manner as the end of the non-contacting end. The display area of the display unit 110 is divided into four.

Which interpolation mode is used in the information terminal 100 may be set in advance in the information terminal 100, or may be set based on information input to the input device by the user.

[1-9. Division mode for inputting division information]
In the present embodiment described above, it is only necessary to input information for dividing the display area of the display unit 110 such that the division information stored in the third storage unit 157 is generated.

That is, for example, when the division information stored in the third storage unit 157 is “dividing the display area of the display unit 110 into four”, the line 931 shown in FIG. The touch sensor 107 may be touched so as to draw the trajectory of two lines 932, or the trajectories of

lines

941, 942, and 943 that do not intersect each other may be input as shown in FIG. Further, as shown in FIG. 18C, a touch operation along

lines

951, 952, and 953 including a curve 953 may be performed. Since either input is an input of information for dividing the display area of the display unit 110 into four, it is determined that the input information matches the information for division, and it is determined that the user authentication is successful.

[2. Second Embodiment]
In the first embodiment described above, the “number” of divided areas generated by dividing the display area of the display unit 110 is used as the authentication information.

In the present embodiment, an image including a plurality of objects is displayed on display unit 110, and the division information is divided so that a specific condition is satisfied for the image displayed on display unit 110. The image displayed on the display unit 110 can be divided so as to generate a closed region.

Here, the specific condition is, for example, to include only a specific object in the selected area among the objects displayed on the display unit 110, or classify the objects into a plurality of groups. The selection area is generated so that objects of a certain group are accommodated but objects of another group are not included.

For example, in the latter case, the authentication image information stored in the first storage unit 158 includes information for displaying the image 980 in FIG.

Referring to FIG. 19, an image 980 is an image including six objects of watermelon 961, pineapple 962, melon 963, cherry 964, apple 965, and orange 966.

In the first storage unit 158, information about each object is stored as shown in Table 1, for example.

Table 1 stores information (display label) that defines image information and display position of each object.

The division information stored in the third storage unit 157 includes, for example, grouping information for displayed objects as shown in Table 2.

In the example shown in Table 2, object number 5 “apple” (apple 965 in FIG. 19) and object number 6 “orange” (orange 966 in FIG. 19) are grouped into group number “1”. It is divided. Further, “pineapple” of object number 2 (pineapple 962 in FIG. 19) is grouped into group number 2.

Further, as the division information in the third storage unit 157, conditions for dividing the region including the relationship between these groups are further stored. As an example of such a condition, for example, “to generate a divided region that accommodates objects of group 1 and does not accommodate objects of group 2” can be cited.

FIG. 20 shows a region that satisfies such a condition.
Referring to FIG. 20, similar to image 980 in FIG. 19, image 981 shows six objects such as watermelon 961, and operates touch sensor 107 while image 981 is displayed on display unit 110. Thus, the locus of the image 981A input is shown.

The image 981A includes all the objects classified as group number 1 in Table 2 (that is, apple 965 and orange 966), but the object of group number 2 (pineapple 962) represents the whole. Not included.

[3. Other modifications]
In the image 982 in FIG. 21, six objects including the watermelon 961 are displayed, as in the image 980 in FIG. Further, the image 982 shows a locus input by a touch operation on the touch sensor 107 when the image 982 is displayed on the display unit 110.

The closed region 982A constituted by the locus includes melon 963 and the whole of the apples 965 and orange 966 of group number 1 in Table 2, and at least for the pineapple 962 of group number 2 A part is located outside the locus 972. Accordingly, it is determined that the information generated by the input information generation unit 159 matches the division information stored in the third storage unit 157 in the same way as the locus 971 in FIG. Judge as successful.

Note that in the information terminal 100, the input information generation unit 159 receives the information for designating a plurality of points as indicated by the points P1 to P8 in FIG. A closed figure shown as an image 981 may be generated by an existing interpolation method using points (Lagrange interpolation method or the like) to perform user authentication.

[4. Example when user authentication fails]
In the image 983 in FIG. 23, six objects such as the watermelon 961 are displayed, as in the image 980 in FIG.

The image 983 includes a region 983A. The region 983A is a locus of a touch operation performed on the touch sensor 107 when the image 983 is displayed on the display unit 110, and is generated by the input information generation unit 159.
In FIG. 23, at least a part of apples 965 and orange 966 that are objects classified into group number 1 is not included in region 983A. Thus, even if the image 983 is divided by the region 983A, the conditions stored in Table 2 cannot be satisfied.

Therefore, in such a case, the authentication determination unit 154 determines that the information stored in the second storage unit 153 and the information stored in the third storage unit 157 (dividing information) do not match, and performs user authentication. Judge that it failed.

[5. Interpolation of input data]
In the present specification described above, interpolation of data input based on a touch operation or the like has been described with reference to FIG.

In addition, as another aspect of data interpolation, there is interpolation when the input locus is not continuous, as shown as a locus 985 in FIG.

In such a case, portions close to each other can be interpolated by Lagrange interpolation or the like to form a continuous locus.

In FIG. 24, lines generated by separation are indicated by broken lines 985A to 985D. The locus 985 can form a closed region together with the end of the display unit 110 by connecting the fragmented portions with broken lines 985A to 985D. Specifically, a closed region is configured by a line formed by a locus 985 connected by broken lines 985A to 985D and an end portion of the lower right portion of the display unit 110, and the closed region includes apples 965 and The whole orange 966 is included.

[6. Other modifications]
In each of the embodiments described above, information for dividing the display area of the display unit 110 is input to the information terminal 100 as information for dividing the area.

Note that the information for dividing the region may not be input to the display device such as the display unit 110 in the recognition device according to the present invention.

The information which divides | segments the said area | region may be input with respect to the input area of input devices, such as a touchpad provided away with respect to the display apparatus. In this case, information for dividing the area (for example, “divide into four areas”) is stored in advance in the information terminal 100 as the authentication information. And the input of the information which divides | segments an area | region with respect to input devices, such as a touchpad, is received from a user. Then, the user authentication is successful depending on whether the result divided by the input information (the number of areas, the selected object, etc.) matches the result divided by the information stored in advance. It is determined whether or not.

According to each embodiment described above, the information that the user needs to input at the time of authentication may be information for dividing a predetermined area (image 980 or the like), and is specified in the object. It does not have to be information for designating the part. That is, for example, when the information that the user needs to input is “information for dividing the input area into three areas”, the information that the user needs to input is the input area vertically Information that is divided into three parts or information that is divided into three parts horizontally may be used.

For this reason, it is possible to make information required to be input highly flexible. From this, the user can change the operation of inputting information each time, so that it is difficult for a third party who sees the act of inputting the information to guess what the user is inputting. .

Therefore, in the authentication device, it is possible to improve the security strength without complicating the contents required for the user for authentication.

The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

100 information terminal, 101 CPU, 102 RAM, 103 ROM, 104 HDD, 105 communication I / F, 106 input unit, 107 touch panel, 108 card reader, 110 display unit, 150 information input unit, 151 input determination unit, 152 for authentication Information generation unit 153, second storage unit, 154 authentication determination unit, 155 display control unit, 156 drawing control unit, 157 third storage unit, 158 first storage unit, 159 input information generation unit, 990 authentication image.

Claims

A receiving unit (107) for receiving an input of information for dividing a predetermined area;
A storage unit (157) for storing information relating to the division of the predetermined area;
A generation unit (159) for generating information for dividing the predetermined area based on information input to the reception unit;
An authentication apparatus comprising: a determination unit (154) for determining whether information generated by the generation unit matches information stored in the storage unit.
The predetermined area is an area corresponding to a predetermined image displayed on the display device;
The authentication device according to claim 1, wherein the storage unit stores information for dividing the predetermined image as information regarding the division of the predetermined area.
The information related to the division of the predetermined area is information for grouping a plurality of elements included in the predetermined image or the number of areas into which the predetermined image is divided. Authentication device.
The reception unit is a touch sensor,
The authentication according to any one of claims 1 to 3, wherein, when information specifying a plurality of points is input to the reception unit, the generation unit generates a closed figure passing through the plurality of points. apparatus.
The reception unit receives information for specifying a line for dividing the predetermined area,
The generation unit extends the input line to the end of the predetermined region so as to reach when the line input to the reception unit does not reach the end of the predetermined region. The authentication apparatus according to any one of claims 1 to 4, wherein an image of a line is generated.
A method for authenticating a user in an information terminal,
Receiving input of information for dividing a predetermined area;
Storing information relating to the division of the predetermined area;
Generating information for dividing the predetermined area based on the input information;
And determining whether information for dividing the predetermined area generated based on the input information matches information stored in the storage unit.