JP4774838B2 - Communication device, authentication method, and authentication program - Google Patents

Description

  The present invention relates to a communication device, an authentication method, and an authentication program, and is suitable for application to authentication between communication devices in an ad hoc network, for example.

  2. Description of the Related Art Conventionally, in an ad hoc network in which a plurality of wireless devices are connected and communicated only on the spot, it is easy to intercept radio waves within the communication range. In order to prevent such information leakage, there is a method of limiting communication targets by mutually authenticating wireless devices that perform communication. At this time, the user has to input settings such as a password and a device ID of the wireless device to be authenticated, and the work for authentication is complicated.

  Therefore, as a method for easily authenticating these wireless devices, there is known a method of identifying a wireless device within a certain distance from its own wireless device and automatically authenticating the identified wireless device. Yes.

In addition, by reducing the transmission output or reception sensitivity of the wireless device, the distance that the radio wave reaches is limited, only the wireless device within the limited distance is specified as the authentication partner, and the specified wireless device is automatically selected. In some cases, authentication is easily performed by authenticating to (see, for example, Patent Document 1).
JP 2002-118557 A

  By the way, in the wireless device having such a configuration, by measuring the distance between wireless devices or limiting the range in which radio waves reach, the wireless device that exists within a certain range from its own wireless device is uniformly authenticated. There is a problem that an unintended wireless device existing in the range is automatically authenticated.

  The present invention has been made in consideration of the above points, and an object of the present invention is to propose a communication device, an authentication method, and an authentication program that can selectively limit a communication target by a simple operation of a user.

In order to solve such a problem, in the communication device of the present invention, the communication device is capable of wireless communication with other communication devices, and authentication information that can be acquired only within a predetermined limited range in response to a user operation is external information. Authentication information acquisition means to acquire, first acquisition device information representing the acquisition device from which the first authentication information has been acquired, and first transmission device information to represent the transmission device that transmits the first authentication information Device information generating means, first authentication information acquired by the authentication information acquiring means, first acquired device information generated by the device information generating means, and first transmitting device information are transmitted to another communication device. A first transmitting unit; a receiving unit configured to receive the second authentication information , the second acquired device information, and the second transmitting device information transmitted from another communication device only for a predetermined monitoring time; Authentication information and second With collating the authentication information, collates the second acquisition device information and the second transmission device information received from another device, it is determined that the two authentication information is acquired from the same external information, and the second Authentication means for authenticating another communication device as a regular communication target when it is determined that the acquired device information and the second transmitting device information match .

  As a result, it is possible to authenticate only communication devices that exist within the limited range and that are performing authentication processing at the same timing.

The authentication method of the present invention is an authentication method used when wirelessly communicating with another communication device, wherein authentication information that can be acquired only within a predetermined limited range according to a user operation is acquired from external information. Device information generation for generating an information acquisition step, first acquisition device information indicating an acquisition device from which the first authentication information has been acquired, and first transmission device information indicating a transmission device that transmits the first authentication information A first transmission for transmitting the first authentication information acquired by the step, the authentication information acquisition step, the first acquired device information generated by the device information generation step, and the first transmission device information to another communication device; a step, the second authentication information transmitted from another communication device, a receiving step of the second acquisition device information and the second transmission device information received only in a predetermined monitoring time, the authentication means, the With matching authentication information and the second authentication information, collates the second acquisition device information and the second transmission device information received from another device, the two authentication information is obtained from the same external information is determined that, and has an authentication step of authenticating the other communication device as a regular communication object when it is determined that the second acquisition device information and the second transmission device information match.

  As a result, it is possible to authenticate only communication devices that exist within the limited range and that are performing authentication processing at the same timing.

Furthermore, in the authentication program of the present invention, when performing wireless communication with another communication device, authentication information that can be acquired only within a predetermined limited range is acquired from external information to the communication device in accordance with a user operation. Device information for generating an authentication information acquisition step, first acquisition device information representing an acquisition device from which the first authentication information has been acquired, and first transmission device information representing a transmission device that transmits the first authentication information A first step of transmitting the first authentication information acquired in the generation step, the authentication information acquisition step, the first acquired device information generated in the device information generation step, and the first transmission device information to another communication device. second authentication information transmitted and transmitting step, from another communication device, receiving means, receiving stearyl for receiving only the second acquisition device information and the second transmission device information to the predetermined monitoring time And flop, while compares the first authentication information and second authentication information, collates the second acquisition device information and the second transmission device information received from another device, the two credentials identical An authentication step of authenticating another communication device as a regular communication target is executed when it is determined that the second acquired device information and the second transmitting device information coincide with each other.

  As a result, it is possible to authenticate only communication devices that exist within the limited range and that are performing authentication processing at the same timing.

According to the present invention, the same external information is acquired only within a predetermined monitoring time within a predetermined limited range, and only the communication device that acquired the external information is authenticated as a regular communication target. Therefore, it is possible to realize only a communication device that is present at the same timing and can perform authentication processing, and thus a communication device, an authentication method, and an authentication program that can selectively limit communication targets by a simple operation of a user.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

(1) Overall Configuration of Authentication System 1 in FIG. 1 shows an authentication system according to the present embodiment as a whole, and a plurality (three in FIG. 1) of personal computers (hereinafter referred to as PCs) 2 (2A 2C), each PC 2 performs mutual authentication based on an authentication program, and communicates between the authorized communication device and the authenticated PC 2 to construct an ad hoc network.

  The PCs 2 </ b> A to 2 </ b> C exist in one room separated by walls, for example, are arranged so as to be able to image a common object 3 that can be imaged only in the room, and can communicate with each other via a wireless LAN. .

  In this authentication system 1, as shown in FIG. 2, for example, among the users of PCs 2 </ b> A to 2 </ b> C, the operation unit 15 of the PCs 2 </ b> A to 2 </ b> C is operated all at once according to an instruction from the reader. The same object 3 is imaged simultaneously and the image is recorded, and the image of the imaged object 3 is transmitted and received between the PCs 2A to 2C, and the received image and the image captured by the self are captured. Are mutually verified by collating with.

  Thus, in the authentication system 1, for example, the authentication process can be started by a simple operation in which the user simply presses the operation key of the operation unit 15.

(2) Configuration of PC As shown in FIG. 3, the PC 2 sends a ROM (Read Only Memory) 11 and a RAM (Random) to a CPU (Central Processing Unit) 10 that controls the entire PC 2 via a bus 18. Access
Memory, a HDD (Hard Disc Drive) 13, a camera unit 14 such as a CCD (Charge-coupled device), an operation unit 15, a wireless communication interface 16, a LCD (Liquid Crystal Display), etc. It is comprised by connecting with the part 17. FIG.

  The CPU 10 executes various processes by controlling each unit based on various applications such as a basic program and an authentication program stored in the ROM 11 and the HDD 13.

  Then, the CPU 10 performs an imaging process by the camera unit 14 according to the operation of the operation unit 15 by the user, displays the image data obtained by the imaging process on the display unit 17, and temporarily stores the image data in the RAM 12. Yes.

  Further, the CPU 10 transmits image data temporarily stored in the RAM 12 from the wireless communication interface 16 to another PC 2 by a method such as Bluetooth (registered trademark), IEEE (Institute of Electrical and Electronics Engineers) 802.11g, and the like. The data received from the PC 2 is temporarily stored in the RAM 12.

(3) Authentication process in authentication system Next, the authentication process of PC2 in the authentication system 1 mentioned above is demonstrated. As described above, in this authentication system 1, since a plurality of PCs 2 authenticate each other, the authentication is executed a plurality of times. However, for convenience of explanation, one PC 2 is connected to one other Only an authentication process performed on the PC 2 (hereinafter referred to as an authentication target PC) will be described.

(3-1) Preparation for Authentication CPU10 of PC2 starts an authentication program according to operation of the operation part 15 (FIG. 3) by a user, and starts an authentication process. At this time, the CPU 10 displays the moving image supplied from the camera unit 14 on the display unit 17.

  For this reason, the user can adjust the position of the PC 2 while visually recognizing the moving image displayed on the display unit 17 and move the PC 2 to a position where the object 3 can be captured. As a result, the position of the PC 2 is adjusted by the user, and the PC 2 is arranged at a position where the object 3 can be imaged.

  When the CPU 10 recognizes an input operation by the user via the operation unit 15, the CPU 10 starts the image transmission process and the image reception process at the same time, and continuously executes the collation process.

(3-2) Image Transmission Processing In this image transmission processing, the CPU 10 sends an imaging command, which is a command for capturing a still image, to the camera unit 14.

  As a result, the CPU 10 is provided with still image data (hereinafter referred to as captured image data) RD (FIG. 4A) captured by the camera unit 14 as a response result of the imaging command. The CPU 10 recognizes the time when the captured image data RD is supplied as an imaging time, generates an imaging time code TC representing the imaging time, and temporarily stores it in the RAM 12 together with the captured image data RD.

  Then, when the imaging time code is added to the head of the captured image data RD, for example, the CPU 10 generates imaging device information MS representing the device that captured the captured image data RD based on the device ID of the PC 2, and this imaging device information MS. Is added to the end of the captured image data RD, for example, to generate image data DD with imaging information (FIG. 4B). Thereby, in addition to the imaging time of the captured image data RD, the device ID of the PC 2 is added to the image data with captured information DD as the imaging device information MS.

  Then, the CPU 10 (FIG. 3) generates transmission device information MJ representing the transmitted device from the device ID of the PC 2. The CPU 10 uses the transmission device information MJ as image data DD with imaging information as transmission image data SD (FIG. 5) via the wireless communication interface 16 (FIG. 3) as another PC 2 (hereinafter referred to as an authentication target PC). ).

  In this way, the PC 2 acquires the captured image data RD that can be captured only in the room in which the object 3 exists in accordance with the user's operation, and acquires the captured image data TC, the imaging device information MS, and the transmission device. Along with the information MJ, the transmission image data SD is transmitted wirelessly.

(3-3) Image Reception Process On the other hand, in this authentication process, the PC 2 sends the transmission image data SD transmitted through the above-described image transmission process from the other PC 2 as the authentication target PC in parallel with the image transmission process. The transmission image data SDa is acquired. Hereinafter, the data obtained from the transmission image data SDa will be described by adding a to the code corresponding to the data generated by the PC 2 in the image transmission process.

  In this image reception process, the wireless communication interface 16 (FIG. 3) of the PC 2 sequentially sends received signals received via an antenna (not shown) to the CPU 10.

  The CPU 10 monitors whether or not the received image data is included in the received signal over a predetermined monitoring time. When the CPU 10 detects the transmission image data SDa from the received signal, the CPU 10 extracts the transmission image data SDa as shown in FIG. 6A and acquires the image data DDa with imaging information and the transmission device acquired as a result. Information MJa is temporarily stored in the RAM 12.

  On the other hand, when the transmitted image data SDa is not detected from the received signal over the monitoring time, the CPU 10 (FIG. 3) displays on the display unit 17 that the authentication has not been established, and notifies the user. To notify that authentication has not been established. And CPU10 complete | finishes the monitoring of a received signal, and complete | finishes an authentication process.

  Thereby, since the CPU 10 does not acquire the transmission image data SDa received before the start of the image reception process and after the monitoring time described above, the authentication target is the authentication target that has transmitted the transmission image data SDa within this monitoring time. It is possible to limit to a PC, for example, a wireless device in an adjacent room that is within the communicable range but cannot know the timing of starting detailed image reception processing can be excluded from authentication, and information leakage to the outside It is designed to reduce the risk.

  Note that this monitoring time can be freely changed by user settings. In this case, for example, the monitoring time may be set in advance for the PC 2 and the authentication target PC in advance, or may be set to a common time or different times. Also, by setting the PC 2 or one authentication target PC as the host PC and transmitting the setting information about the monitoring time from the host PC wirelessly immediately before starting the authentication process, the other PC 2 or the authentication target PC The monitoring time may be set to a common time.

  Further, a pressing period during which the user presses an operation key (not shown) on the operation unit 15 may be set as a monitoring time for monitoring the received signal described above. Similarly, monitoring of the received signal may be started in response to a first operation of the operation unit 15 by the user, and monitoring of the received signal may be ended by a second operation. As a result, the PC 2 does not cause the user to perform any time setting operation, for example, by causing the user to press the operation button in response to an instruction from the reader when starting the authentication process. It is possible to cause the CPU 10 to monitor the received signal over almost the same monitoring time between the authentication target PCs.

  In this way, the PC 2 acquires the transmission image data SDa transmitted from the authentication target PC only within the monitoring time as authentication information, and authenticates the wireless device that has not executed the image transmission processing within the monitoring time. Excluded from the target.

(3-4) Collation Processing After completing the image transmission processing and image reception processing, the PC 2 continues to perform collation processing.

  As shown in FIG. 6B, the CPU 10 of the PC 2 captures the image capturing device information MSa indicating the device ID of the image capturing device added to the image data DDa with image capturing information acquired by the image receiving process, and the device ID of the transmitting device. Is compared with the transmitting device information MJa representing.

  When the pieces of device information match as a result of the comparison and collation, the CPU 10 (FIG. 3) and the image pickup device that picked up the picked-up image data RDa and the transmission device that sent the send-out image data SDa, that is, the authentication target PC, Therefore, it is determined that the captured image data RDa has been captured by the authentication target PC.

  On the other hand, when the two do not match, the CPU 10 does not match the imaging device and the authentication target PC, and the authentication target PC uses the captured image data RDa captured by the imaging device other than the authentication target PC. It is determined that there is a possibility that transmission processing has been executed, and authentication of the authentication target PC is rejected. Then, the CPU 10 displays on the display unit 17 that the authentication has not been established, and terminates the authentication process when notifying the user that the authentication has not been established.

  As a result, the CPU 10 illegally acquires the image data DDa with imaging information captured by, for example, a legitimate authentication target PC by hacking, cross-flowing, or the like, and sends image data SDa using the image data DDa with imaging information that has been illegally acquired. Is detected, and at the same time, it is possible to prevent the authentication of the unauthorized authentication target PC.

  Further, the CPU 10 compares and compares the captured image time code TCa that represents the imaging time by the authentication target PC added to the image data with imaging information DDa and the imaging time code TC that represents the own imaging time read from the RAM 12.

  When the CPU 10 (FIG. 3) recognizes that the time difference between the imaging times represented by the respective time codes is equal to or less than a predetermined time difference threshold and the two imaging times are substantially the same as a result of the comparison and collation. Then, it is determined that the captured image data RDa by the authentication object PC and the captured image data RD by the PC 2 are captured at substantially the same timing.

  On the other hand, if the two do not match, the CPU 10 determines that there is a possibility that the authentication target PC has improperly transmitted the transmission image data SDa using the captured image data RDa captured at different timings. Deny authentication of the target PC. Further, the CPU 10 displays on the display unit 17 that the authentication has not been established, and terminates the authentication process when notifying the user that the authentication has not been established.

  As a result, the CPU 10 detects an unauthorized authentication target PC that has transmitted the transmission image data SDa by using the captured image data RDa captured at different timings, for example, using image data prepared in advance as the authentication target PC. At the same time, it is possible to prevent such unauthorized authentication target PCs from being authenticated.

  Further, as shown in FIG. 7B, the CPU 10 compares and compares the captured image data RDa, which is the image data portion of the image data DDa with captured information, with the captured image data RD captured by itself read from the RAM 12.

  Specifically, the CPU 10 (FIG. 3) collates the feature amount extracted from the captured image data RD with the feature amount extracted from the captured image data RDa. Here, since the position where the PC 2 images the object 3 and the position where the authentication target PC images the object 3 do not match, the CPU 10 sets the determination threshold and extracts the feature amount, for example. In consideration of the difference in image data caused by the displacement of the position captured by the above, it is determined whether the PC 2 and the authentication object PC have captured the same object 3 or not.

  Then, the CPU 10 recognizes that the result of comparison and matching between the feature amount of the captured image data RD and the feature amount of the captured image data RDa exceeds a predetermined determination threshold, and the captured image data RD and the captured image data RDa are similar. In this case, it is determined that the authentication target PC has captured the same object 3 as the PC 2.

  As a result, the CPU 10 determines that the image data DDa with imaging information is image data obtained by imaging the same object 3, authenticates that the authentication target PC is a regular communication target, and establishes authentication. When the information indicating that the authentication has been established is displayed on the display unit 17, communication is started.

  As a result, the CPU 10 can use only the authentication target PCs for which authentication has been established as regular communication targets, and can communicate only between the limited regular communication targets, thereby reducing the risk of information leakage to the outside, Safety can be improved.

  On the other hand, when the two are not similar, the object 3 of the captured image data RD and the object of the captured image data RDa are not the same, and the authentication target PC is different from the object 3. It is determined that there is a possibility that the transmission image data SDa has been illegally transmitted using the captured image data RDa obtained by imaging the object, and authentication of the authentication target PC is rejected. Then, the CPU 10 displays on the display unit 17 that the authentication has not been established, and terminates the authentication process when notifying the user that the authentication has not been established.

  Thus, the CPU 10 selects only the authentication target PC that can acquire the object 3 that can be imaged only in the same room as the regular communication target, thereby selecting the communication target as the authentication target PC existing in the same room. Can be limited.

  Further, the CPU 10 detects an unauthorized authentication target PC that is present in a different location and has transmitted the transmission image data SDa using the captured image data RDa obtained by capturing an object other than the object 3, for example. Therefore, it is possible to prevent unauthorized authentication target PCs from being authenticated and to exclude them from regular communication targets.

  In this way, the CPU 10 verifies the authentication target PC only when it determines that the authentication target PC has captured the same object 3 at the same timing as the PC 2 by collating the transmission image data SDa. It is designed to authenticate as a communication target.

(4) Procedure of PC in Authentication Process Next, the procedure of the PC 2 in the authentication process will be described with reference to the flowcharts of FIGS. In this authentication process, when the authentication program is activated by the operation of the operation unit 15 by the user, the image transmission processing procedure RT1 and the image reception processing procedure RT2 are started in accordance with subsequent operation instructions by the user and proceed simultaneously.

(4-1) Image Transmission Processing Procedure When the CPU 10 of the PC 2 recognizes that the operation key input of the operation unit 15 has been performed by the user when the authentication program is activated, a start step of the image transmission processing procedure RT1 shown in FIG. And go to step SP1.

  In step SP1, when the CPU 10 images the object 3 by the camera unit 14 and generates captured image data RD (FIG. 4A), the process proceeds to step SP2.

  In step SP2, the CPU 10 generates an imaging time code TC indicating the imaging time of the captured image data RD, and when the imaging time code TC is added to the captured image data RD, the process proceeds to the next step SP3.

  In step SP3, the CPU 10 generates imaging device information MS indicating the device ID of the PC 2 that is the imaging device, adds the imaging device information MS to the captured image data RD to which the imaging time code TC is added in step SP2, When the image data DD with imaging information (FIG. 4B) is generated, the process proceeds to the next step SP4.

  In step SP4, the CPU 10 generates transmission device information MJ representing the device ID of the transmission device PC2, and together with the image data DD with imaging information generated in step SP3, the transmission image data SD via the communication device interface 16. The image transmission process ends.

(4-2) Image Reception Processing Procedure When the CPU 10 of the PC 2 recognizes that the operation key input of the operation unit 15 has been performed by the user at the time of starting the authentication program, the start step of the image reception processing procedure RT2 shown in FIG. And go to step SP11.

  In step SP11, the CPU 10 monitors a reception signal supplied from the communication interface 16 as needed for a predetermined time, for example, for 5 seconds, waits for reception of the transmission image data SDa, and when this standby is completed, the next step SP12 is performed. Move on.

  In step SP12, the CPU 10 confirms whether or not the transmission image data SDa has been received.

  If an affirmative result is obtained here, this means that there is an authentication target PC that is performing transmission processing at the same timing. At this time, the CPU 10 sends the transmission image data SDa to the transmission device. Information MJa and image data with imaging information DDa are temporarily stored in the RAM 12, and the process proceeds to the next step SP13.

  In step SP13, the CPU 10 proceeds to the next collation processing procedure RT3, starts collation processing for the received transmission image data SDa, and ends the image reception processing.

  On the other hand, if a negative result is obtained in step SP12, this means that there is no authentication target PC that is simultaneously performing image transmission processing. At this time, the CPU 10 proceeds to the next step SP14.

  In step SP14, the CPU 10 displays a result indicating that the authentication has not been established on the display unit 17, ends the image reception process, and ends the authentication process.

  In this manner, the CPU 10 is configured to receive only the transmission image data SDa included in the reception signal during the monitoring time of 5 seconds.

(4-3) Collation Processing Procedure After the step SP13 of the image reception processing procedure RT2 (FIG. 9), the CPU 10 of the PC 2 enters from the start step of the collation processing procedure RT3 shown in FIG. 10 and proceeds to step SP41.

  In step SP41, the CPU 10 compares and compares the imaging device information MSa representing the device that captured the image data with imaging information DDa and the transmission device information MJa representing the device that transmitted the image data with imaging information DDa (FIG. 6 ( B)), and the process proceeds to the next step SP42 (FIG. 10).

  In step SP42, the CPU 10 confirms in step 41 whether the imaging device information MSa and the transmission device information MJa match.

  If an affirmative result is obtained here, this indicates that the captured image data RDa has been captured by the authentication target PC that is the transmission device of the image data DDa with captured information. The process proceeds to step SP43.

  As a result, the CPU 10 can detect the authentication target PC using the image data captured by the imaging device other than the authentication target PC, and thus improper authentication using the captured image data RDa illegally acquired by hacking, cross-flowing, or the like. It is possible to prevent the target PC from being authenticated.

  In step SP43, the CPU 10 compares and collates the imaging time code TCa representing the time when the image data with imaging information DDa was imaged with the imaging time code TC representing the imaging time of the own captured image data RD read from the RAM 12. The process proceeds to the next step SP44 (FIG. 10).

  In step SP44, as a result of the comparison and collation, the CPU 10 confirms whether or not the time difference between the imaging time codes TC and TCa is, for example, 2 seconds or less as a predetermined time difference threshold value.

  If an affirmative result is obtained here, this indicates that the captured image data RDa and the captured image data RD have been captured at substantially the same timing, and at this time, the CPU 10 proceeds to the next step SP45. .

  Thereby, since the CPU 10 can detect the captured image data RDa having different imaging times, it is possible to prevent an unauthorized authentication target PC using the prepared captured image data RDa from being authenticated.

  In step SP45, the CPU 10 compares and compares the captured image data RDa, which is the image data portion in the image data with captured information DDa, with the captured image data RD read from the RAM 12 (FIG. 7B). The process proceeds to step SP46.

  In step SP46, the CPU 10 confirms whether the captured image data RDa and the captured image data RD are similar as a result of the comparison and collation.

  If a positive result is obtained here, this means that the captured image data RD and the captured image data RDa are image data obtained by capturing the same object 3, and at this time, the CPU 10 Moves to the next step SP47.

  As a result, the CPU 10 can detect the captured image data RDa that is not similar to the captured image data RD, and an unauthorized authentication target PC using the captured image data RDa obtained by capturing an object different from the object 3 is authenticated. Can be prevented.

  In step SP47, the CPU 10 authenticates the PC to be authenticated as a regular communication target, and when the display unit 17 displays a notification that authentication has been established, moves to the next step SP48.

  In step SP48, the CPU 10 confirms whether or not the collation processing for all the transmission image data SDa stored in the RAM 12 has been completed.

  If a positive result is obtained here, the CPU 10 ends the verification process and ends the authentication process.

  On the other hand, when a negative result is obtained in step SP48 and it is determined that there is transmission image data SDa that has not yet been subjected to collation processing, the CPU 10 returns to step SP41 and executes the collation processing. The collation process is executed for the unsent transmission image data SDa.

  On the other hand, if a negative result is obtained in step SP42 and the imaging device information MSa and the transmission device information MJa do not match, this indicates that the captured image data RDa has not been captured by the authentication target PC. At this time, the CPU 10 proceeds to step SP60.

  Similarly, if a negative result is obtained in step SP44 and the time difference between the imaging time code TC and the time code TCa exceeds the predetermined time difference threshold of 2 seconds, this means that the image with imaging information is included. This means that the data DDa is not captured at the same timing as the image data DD with imaging information, and the CPU 10 moves to step SP60 at this time.

  Further, when a negative result is obtained in step SP46 and the captured image data RD and the captured image data RDa are not similar, this means that the object to be captured of the captured image data RDa is the same as the captured image data RD. This indicates that there is a possibility that the object 3 is not present. At this time, the CPU 10 proceeds to step SP60.

  In step SP60, the CPU 10 displays a notification that the authentication has not been established on the display unit 17, and proceeds to the next step SP51.

  In this way, the PC 2 sends and receives the captured image data RD of the object 3 and collates them, so that the authentication object PC images the same object 3 as the PC 2 at the same timing as the PC 2. The authentication target PC is authenticated only when it is determined that the communication target is within the range where the object 3 can be imaged, and is selectively limited to the authentication target PC that has been authenticated at the same timing as the PC 2. It is made to do.

(5) Operation and Effect According to the configuration described above, in the authentication system 1 of the present invention, the object 3 is imaged as external information that can be acquired only by a plurality of PCs 2 within a limited range, and the acquired captured image data RD. Is transmitted and received between the PCs 2 as authentication information, and mutual authentication is performed.

  Then, the PC 2 acquires only the transmission image data SD received for the predetermined monitoring time of 5 seconds as the transmission image data SDa.

  As a result, the PC 2 can set only the transmitting device that started the image transmission process at the same timing as its own image reception process as the authentication target PC to be authenticated. Since it is possible to prevent authentication of a transmitting device that does not know the authentication processing start timing, it is possible to improve the confidentiality of communication information compared to the conventional method of uniformly authenticating transmitting devices existing within a predetermined range. it can.

  Further, the PC 2 collates the captured image data RDa obtained from the received transmission image data SDa with the captured image data RD captured by itself, and as a result, they are similar, so that the same object 3 is captured. If it is determined that the authentication has been performed, the authentication target PC of the transmission source is authenticated as a regular communication target.

  Thereby, since the PC 2 can authenticate only the authentication target PC existing within the limited range from which the external information can be acquired, for example, only the authentication target PC existing within the reach of the user's eyes can be selectively authenticated, Since unintended authentication target PCs can be excluded, communication targets can be limited only to authentication target PCs that intentionally exist within the limited range.

  Further, the PC 2 collates the transmission device information MJa representing the transmission device obtained from the transmission image data SDa and the imaging device information MSa representing the acquisition device.

  As a result, even if the transmission image data SD flows out of the PC 2 due to hacking, horizontal flow, or the like, the device that captured the captured image data RDa that is the image data portion is the same as the device that transmitted the transmission image data SDa. Since it is possible to verify whether or not there is an authentication object, it is possible to detect the authentication target PC using the transmission image data SD and reject the authentication, so that impersonation can be prevented.

  Further, the PC 2 collates the time code TCa that is the acquisition time information of the captured image data RDa with the imaging time code TC that is the acquisition time information of the captured image data RD of itself.

  As a result, the PC 2 can verify whether or not the captured image data RDa is captured at almost the same timing as the captured time of the captured image data RD. Since it is possible to detect the authentication target PC using the transmission image data SDa prepared in advance and reject the authentication, spoofing can be prevented.

  Further, for example, the authentication process is automatically performed after the user simply presses the operation key of the operation unit 15, and thereafter, the authentication process is automatically performed. Therefore, the mutual authentication between the plurality of PCs 2 can be executed by a simple operation.

  According to the above configuration, the PC 2 of the authentication system 1 is the same as the authentication target PC that has performed the image transmission process at the same timing as the image reception process by the authentication process executed in response to a simple user operation. Only when it is determined that the same external information that can be acquired only within a limited range is acquired at this timing, the authentication target PC is authenticated, so that the communication target can be selectively limited.

(6) Other Embodiments In the above-described embodiment, the object 3 is imaged as common external information, and authentication is performed based on the captured image data RD generated as a result. However, the present invention is not limited to this, and the authentication system 1 may authenticate by acquiring common external information issued from other than the PC 2 to be authenticated, sending and receiving this external information, and collation. .

  For example, as shown in FIG. 11, in the authentication system 60, sound information such as music emitted from the music playback device 63 may be used as external information. In this case, the PC 2 is a camera unit 14 that is an external information acquisition unit. Sound is collected and recorded by the microphone unit 51 corresponding to, recording data is generated instead of the captured image data, and the recording data is transmitted and received between the PCs 2. Then, the CPU 10 adds the recording start time as the recording start time time code to the recording data instead of the imaging time.

  Thereby, in this PC2, since it can collate by synchronizing recording data using this recording start time time code, when performing collation processing based on picked-up image data RD acquired by camera part 14; Compared with this, the accuracy of verification can be further improved. Also, by using such sound information, in addition to sound information such as music that can be intentionally generated, unintentional noise that occurs only at the place of authentication is collected, and the presence or pattern of noise is collated. In this case, forgery of the recorded data becomes more difficult, so that the accuracy of collation can be further improved.

  Furthermore, the authentication system 1 can use various information whose acquisition range can be limited as external information. For example, an object having a predetermined temperature is used as external information, a temperature sensor is used as an external information acquisition unit, and temperature information is used as verification information, or various light beams such as laser beams and directivity are used as external information. You may make it acquire with the various sensors as an external information acquisition part using a certain electromagnetic wave. In this case, the limited range can be limited to a range surrounded by the wall by using information blocked by the presence of the wall. Moreover, the size of the limited range can be freely changed by using information that can be acquired from near and difficult to acquire from a distance. Furthermore, by using information having directivity such as a laser beam, the user can intentionally select the authentication target PC and perform authentication. In this way, in the authentication system 1, it is possible to selectively limit regular communication targets under various conditions by arbitrarily selecting external information.

  Further, in the above-described embodiment, the case has been described in which the PC 2 transmits and receives the authentication target PC and the transmission image data SD that is the authentication information by the image transmission process and the image reception process, but the present invention is not limited thereto. Instead, the transmission image data SD may be encrypted and transmitted / received. As the encryption processing in this case, a public key method, a common key method, or the like is applied.

  For example, the CPU 10 of the PC 2 generates a pair of public key and secret key by the public key method before or simultaneously with the start of the image transmission process and the image reception process, and temporarily stores the secret key in the RAM 12. This public key is transmitted to the PC to be authenticated via the wireless communication interface 16. When the CPU 10 receives the transmission image data SDa encrypted with the public key via the wireless communication interface 16, the CPU 10 decrypts it with the secret key read from the RAM 12, and executes an authentication process. On the other hand, when the CPU 10 similarly receives the public key transmitted from the PC to be authenticated, the CPU 10 transmits the transmission image data SD encrypted with the public key.

  Thus, even if the transmission image data SD being transmitted / received is intercepted by an unauthorized authentication target PC, the PC 2 encrypts the transmission image data SD because the transmission image data SD is encrypted. It is possible to prevent illegal use of the image data SD. Further, since the PC 2 does not output a secret key that can decrypt the encrypted transmission image data SD, the secret key is not acquired by the unauthorized PC to be authenticated, so that the authentication is more safely performed. Processing can be executed.

  Further, the authentication target PC generates a digest of the transmission image data SD, and encrypts the digest with a secret key temporarily stored in the RAM 12 to generate a certificate indicating that it is the authentication target PC. Or a public key or the like may be transmitted to the PC 2. In this case, the PC 2 receives the transmission image data SDa and the electronic signature, the certificate, and the public key from the authentication target PC, the digest obtained by decrypting the received electronic signature with the public key, and the received transmission image. The digest generated from the data SDa is compared. At this time, the PC 2 can verify the presence or absence of falsification of the transmission image data SDa by comparing the two digests.

  Accordingly, the PC 2 can detect the authentication target PC using the transmission image data SDa that has been tampered with, and can prevent unauthorized authentication of the PC to be authenticated using the transmission image data SDa that has been tampered. It becomes possible to limit the authentication target PCs with certainty.

  Further, in the above-described embodiment, the PC 2 captures a still image with the camera unit 14 and collates based on the captured image data RD of the still image. However, the present invention is not limited to this. Alternatively, a moving image may be captured only during the monitoring time, and collation may be performed based on the moving image capturing data.

  In this case, the PC 2 calculates a motion vector from the motion of the object, transmits it to the other PC 2 as authentication information, and collates the motion vector with the motion vector received from the authentication target PC. Thereby, since the movement of the object can be detected and collated, even when the imaging position is deviated between the PCs 2, the movement of the object itself can be compared. Can be reduced, and the accuracy of collation can be improved.

  Furthermore, in the above-described embodiment, the case where the CPU 10 of the PC 2 extracts and compares the feature amounts from the captured image data RD and the captured image data RDa has been described, but the present invention is not limited thereto. Matching can be performed by various methods such as extracting a pattern from an image and matching.

  Further, in the above-described embodiment, the CPU 10 has described the case where the time when the captured image data RD is supplied from the camera unit 14 is recognized as the imaging time. However, the present invention is not limited to this, and imaging is performed. May be recognized as the imaging time. For example, the time when the imaging time code TC is generated may be used as the imaging time.

  Further, in the above-described embodiment, the PC 2 verifies that the imaging timing is the same by comparing the imaging time code TC with the imaging time code TCa added to the transmission image data SDa. However, the present invention is not limited to this, and the imaging time code may be collated in a state where the clocks are synchronized in advance. For example, transmission is performed with transmission time information added to the transmission image data SD, and the authentication target PC and the clock are determined based on the reception time of the received transmission image data SDa and the transmission time information in the transmission image data SDa. You may make it collate in the state which synchronized. As a result, since the PC 2 can perform more accurate collation, the time difference threshold value of the imaging time difference at the same timing can be set smaller than, for example, 2 seconds, and spoofing can be further effectively prevented. .

  Further, in the above-described embodiment, the case where the CPU 10 monitors the received signal over the monitoring time of 5 seconds has been described. However, the present invention is not limited to this, and the distance between the PCs 2 as the operation unit is set. A distance measuring unit for measurement may be provided, and the time for which the authentication devices exist within a predetermined distance by the distance measuring unit may be set as the monitoring time.

  Thus, the user can authenticate the PC 2 more simply by approaching each PC 2 while capturing the object 3 while holding the PC 2 in the authentication preparation mode. Further, since the user can move while performing the imaging process by the PC 2 and can bring the PCs 2 to be authenticated closer to each other, the user can take an image of the object 3 while being closer to the PC 2 to be authenticated, and the positional deviation at the time of imaging Therefore, the accuracy of authentication can be improved. In addition, by bringing the PCs 2 that have not been authenticated closer to each other, the user can automatically execute the authentication process multiple times until the PC 2 is authenticated. Authentication can be performed.

Furthermore, in the above-described embodiment, the case has been described in which the PC 2 executes the image transmission processing procedure, the image reception processing procedure, and the collation processing procedure based on the authentication program stored in the PC 2 in advance. Is not limited to this, but a CD-ROM (Compact Disk-Read Only Memory) or DVD-ROM (Digital
By installing from various storage media such as Versatile Disc-Read Only Memory) and semiconductor memory, the PC 2 may execute the image transmission processing procedure, the image reception processing procedure, and the verification processing procedure based on the authentication program.

  Furthermore, in the above-described embodiment, the PC 2 as a communication device is configured by the camera unit 14 as external information means, the wireless communication interface 16 as transmission means and reception means, and the CPU 10 as authentication means. Although the case has been described, the present invention is not limited to this, and the communication apparatus may be configured by external information acquisition means, transmission means, reception means, and authentication means having various other circuit configurations.

  The communication apparatus, authentication method, and authentication program of the present invention can be applied to authentication in a wireless communication network performed between various electronic devices such as a personal computer using an ad hoc network, a mobile phone, and a home appliance.

It is a basic diagram which shows the whole structure of an authentication system. It is a basic diagram with which it uses for description of mutual authentication of PC. It is a basic diagram which shows the structure of PC. It is a basic diagram which shows captured image data (1). It is a basic diagram which shows captured image data (2). It is an approximate line figure used for explanation of collation processing (1). It is an approximate line figure used for explanation of collation processing (2). It is a flowchart with which it uses for description of an image transmission process procedure. It is a flowchart with which it uses for description of an image reception process procedure. It is a flowchart with which it uses for description of a collation processing procedure. It is a basic diagram with which it uses for description of the authentication system in other embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Authentication system, 2 ... PC, 10 ... CPU, 11 ... ROM, 12 ... RAM, 13 ... HDD, 14 ... Camera part, 15 ... Operation part, 16 ... Wireless communication interface, 17 ... Display, 18 ... Bus.

Claims (8)

A communication device capable of wireless communication with other communication devices,
Authentication information acquisition means for acquiring authentication information that can be acquired only within a predetermined limited range from external information in accordance with an operation by a user;
Device information generating means for generating first acquired device information representing an acquired device from which the first authentication information has been acquired, and first transmitting device information representing a transmitting device that transmits the first authentication information;
1st transmission which transmits 1st authentication information acquired by the said authentication information acquisition means, 1st acquisition apparatus information produced | generated by the said apparatus information production | generation means, and 1st transmission apparatus information to said other communication apparatus. Means,
Receiving means for receiving the second authentication information , the second acquisition device information, and the second transmission device information transmitted from the other communication device only during a predetermined monitoring time;
The first authentication information and the second authentication information are collated , the second acquisition device information and the second transmission device information received from the other device are collated, and the two authentication information Authentication means for authenticating the other communication device as a regular communication target when it is determined that the second acquired device information and the second transmitting device information match, and the comprising Ru communication apparatus. Time information generating means for generating first acquisition time information representing the time at which the first authentication information is acquired;
The transmission means is
Transmitting the first acquisition time information together with the first authentication information;
The receiving means is
Receiving a second acquisition time information to the second authentication information and co,
The verification means is
The first authentication information and the second authentication information are collated, and the second acquisition device information and the second transmission device information received from the other device are collated to obtain two authentication information. when the time difference is less than the predetermined time difference that is acquired at the same time, authenticating the other communication devices
The communication apparatus according to 請 Motomeko 1. The monitoring time is determined according to the user's operation
The communication apparatus according to 請 Motomeko 1. The communication device is
A distance measuring unit for measuring the distance from the other communication device,
The authentication information acquisition means includes
The authentication information is acquired when the distance from the other communication device is within a predetermined value.
The communication apparatus according to 請 Motomeko 1. The above authentication information is
This is image data that captures the subject
The communication apparatus according to 請 Motomeko 1. The above authentication information is
It is voice data that recorded voice
The communication apparatus according to 請 Motomeko 1. An authentication method for wireless communication with other communication devices,
An authentication information acquisition step of acquiring authentication information that can be acquired only within a predetermined limited range from external information in accordance with an operation by the user;
A device information generation step of generating first acquisition device information representing an acquisition device from which the first authentication information has been acquired, and first transmission device information representing a transmission device that transmits the first authentication information;
1st transmission which transmits 1st authentication information acquired by the said authentication information acquisition step, 1st acquisition apparatus information produced | generated by the said apparatus information production | generation step, and 1st transmission apparatus information to said other communication apparatus. Steps,
A reception step of receiving the second authentication information , the second acquisition device information, and the second transmission device information transmitted from the other communication device only during a predetermined monitoring time;
The first authentication information and the second authentication information are collated , the second acquisition device information and the second transmission device information received from the other device are collated, and the two authentication information An authentication step of authenticating the other communication device as a regular communication target when it is determined that the second acquired device information and the second transmitting device information match with each other. authentication method that Ru comprising a. When communicating wirelessly with other communication devices,
An authentication information acquisition step of acquiring authentication information that can be acquired only within a predetermined limited range from external information in accordance with an operation by the user;
A device information generation step of generating first acquisition device information representing an acquisition device from which the first authentication information has been acquired, and first transmission device information representing a transmission device that transmits the first authentication information;
1st transmission which transmits 1st authentication information acquired by the said authentication information acquisition step, 1st acquisition apparatus information produced | generated by the said apparatus information production | generation step, and 1st transmission apparatus information to said other communication apparatus. Steps,
A reception step of receiving the second authentication information , the second acquisition device information, and the second transmission device information transmitted from the other communication device only during a predetermined monitoring time;
The first authentication information and the second authentication information are collated , the second acquisition device information and the second transmission device information received from the other device are collated, and the two authentication information An authentication step of authenticating the other communication device as a regular communication target when it is determined that the second acquired device information and the second transmitting device information match with each other. certification program that Ru allowed to run.

Images