JP6058990B2 - Information processing apparatus, authentication method, and program - Google Patents

Description

  The present invention relates to an information processing apparatus that performs authentication processing using an image, an authentication method, and a program.

  In a conventional information system, an authentication method is used in which a user and the system share specific confidential information, such as a password, and the user is authorized to access the information by correctly indicating the confidential information. It is done. Among the authentication methods, there is a method characterized by simplifying authentication using an image. For example, a certificate issued by entering a user name and password from a display screen of an MFP (Multi Function Peripheral) can be stored in an IC card, and login can be performed by holding the IC card over the next time (patent) Reference 1).

  There are also authentication systems that use images without entering a user name and password. For example, authentication is performed by registering a plurality of images that are correct in advance as in the “matching picture” method, and successively selecting the correct image from the displayed correct images and other images at the time of authentication. The user can perform an authentication operation by selecting an image.

JP 2007-219827 A

  However, these technologies require a special device for identifying the IC card in order to perform simple authentication. Also, if the IC card is lost, the MFP may not be used or may be misused by a third party. Also, in a system that authenticates by continuously selecting correct images in authentication using images, it is necessary to select correct images continuously from a plurality of random images. It is troublesome for me.

  In order to solve the above problems, the present invention has the following configuration. That is, an information processing apparatus that performs authentication processing, the first holding unit that holds an image and word information associated with a region included in the image, user information, and a plurality of word information The second holding means that holds the information in association with each other, and when authenticating the user, the plurality of word information associated with the user information of the user is acquired from the second holding means, and the acquired plurality Selected from the first holding means, a display means for displaying the image selected by the selection means, and a display means for displaying the image selected by the selection means. In response to the user specifying one of the positions in the image, the specifying means for specifying the word information associated with the area including the position, the word information specified by the specifying means, the user Authentication means for performing authentication processing by comparing with word information associated with the user information, the authentication means, when the user is successfully authenticated, Simple authentication is performed using a smaller number of pieces of word information than the number of pieces of word information associated with the user information of the user.

  Convenience is improved because a specific device is not required for simple authentication and authentication can be performed with fewer operations than normal authentication processing.

The figure which shows the structural example of information processing apparatus. The figure which shows the structural example of the software module which concerns on a 1st Example. The figure which shows the structural example of the software module which concerns on a 1st Example. The figure which shows the structural example of image data with a tag. The figure which shows the example of an image. The figure which shows the example of a tagged image. The figure which shows the structural example of the user registration information record which concerns on a 1st Example. The flowchart of the process which concerns on a 1st Example. The figure which shows the structural example of an authentication user interface. The figure which shows the structural example of the software module which concerns on a 2nd Example. The figure which shows the structural example of the software module which concerns on a 2nd Example. The figure which shows the structural example of the dummy tag data which concern on a 2nd Example. The figure which shows the example of the image with a tag which concerns on a 2nd Example. The figure which shows the structure of the user registration information record which concerns on a 2nd Example. The flowchart of the process which concerns on a 2nd Example. The flowchart of the process which concerns on a 2nd Example. The figure which shows the structural example of the software module which concerns on a 3rd Example. The flowchart of the process which concerns on a 3rd Example. The figure which shows the structural example of the software module which concerns on a 4th Example. The figure which shows the structural example of the software module which concerns on a 4th Example. The figure which shows the structural example of the schedule data record which concerns on a 4th Example. The figure which shows the structural example of the schedule list data which concern on a 4th Example. The flowchart of the process which concerns on a 4th Example.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. In the present specification, performing simple authentication processing with a smaller number of operations than normal authentication processing is referred to as “simple authentication”.

<First embodiment>
[System configuration]
FIG. 1 schematically shows an internal configuration of an information processing apparatus 1002 in which the authentication system according to the first embodiment of the present invention operates. An information processing apparatus 1002 is connected to the network 1001. A central processing unit (hereinafter referred to as CPU) 1101 controls the entire information processing apparatus 1002. Note that there may be one CPU 1101 as shown in FIG. The CPU 1101 is connected to the system bus 1201.

  A read-only memory (hereinafter referred to as ROM) 1301 is a read-only storage unit and is connected to the system bus 1201. A readable / writable memory (hereinafter referred to as RAM) 1302 is a readable / writable storage unit. The secondary storage device 1304 is a storage unit that stores programs and various data according to the present embodiment. The secondary storage interface 1303 is an interface for connecting the secondary storage device 1304 to the system bus 1201. Hereinafter, the interface is expressed as I / F.

  The information processing apparatus 1002 includes a keyboard 1306 and a pointing device 1307 such as a mouse as input devices. An input device I / F 1305 is an I / F for connecting the system bus 1201 to the keyboard 1306, the pointing device 1307, and the like.

  A network I / F 1308 is an I / F for connecting the network 1001 and the information processing apparatus 1002. The display device 1310 is a display unit and displays various types of information to the user. A display device I / F 1309 connects the system bus 1201 and the display device 1310.

[Module configuration]
The module configuration of the authentication system according to the first embodiment of the present invention will be described below. FIG. 2 is a diagram schematically illustrating the configuration of the software module according to the present embodiment. The authentication user interface 2001 is an interface provided to the user at the time of authentication. Hereinafter, the user interface is represented as UI. Details of the authentication UI 2001 will be described later. The information processing apparatus 1002 according to the present embodiment includes a tagged image database 2003 (first holding unit) and a user registration information database 2005 (second holding unit). Hereinafter, the database is referred to as DB.

  FIG. 4A schematically shows an example of tagged image data held in the tagged image DB 2003. The tagged image data 3000 is composed of one image data and one or a plurality of tag data. In FIG. 4A, the tagged image data 3000 includes N pieces of tag data 3101 to 3109. Tag data 3101 is the first tag data. Tag data 3102 is second tag data. Tag data 3109 is the Nth tag data.

  Each tag data includes area information indicating the position of an area in the image and word information which is a character string indicating an object (area) included in the image. Region information 3201 is region information included in the first tag data 3101. Word information 3301 is word information included in the first tag data 3101. Area information 3202 is area information included in the second tag data 3102. Word information 3302 is word information included in the second tag data 3102. Similarly, the area information 3209 is area information included in the Nth tag data 3109, and the word information 3309 is word information included in the Nth tag data 3109.

  FIG. 4B is a diagram illustrating a configuration example of the region information. The nth area information 320n indicates an area represented by a rectangle on the image data 3001. The rectangle is specifically designated by the x coordinate and y coordinate of the two vertices of the diagonal line. The coordinate 3501 is the x coordinate of the first vertex on the diagonal line, and the coordinate 3502 is the y coordinate of the first vertex. The coordinate 3503 is the x coordinate of the second vertex on the same diagonal, and the coordinate 3504 is the y coordinate of the second vertex. For example, each coordinate can be defined by treating the lower left corner of the image data 3001 as the origin.

  FIG. 4C is a diagram illustrating a configuration example of word information. The nth word information 330n includes a word 3601 and a locale 3602. The locale 3602 is an area and language attribute corresponding to the word 3601. For example, the locale “ja_JP” indicates Japanese used in Japan. The word information may actually hold words from a plurality of different locales. In that case, the word information can be configured to be followed by information indicating the second word and the locale of the second word.

  FIG. 5A shows an example of image data 3001 of tagged image data 3000. Image data 3002 shown in FIG. 5B is another example of image data. 6 schematically shows how the tag data is configured with respect to the image data shown in FIG. In the image data 3001 shown in FIG. 6A, the tag data 3101 is associated with the rectangular area 4201 of the image data 3001. Since the brand logo 4301 is reflected in the rectangular area 4201 of the image data 3001, the tag data 3101 includes area information 3201 representing the rectangular area 4201 and word information 3301 representing the word “brand logo”.

  The area information 3201 holds diagonal coordinates of the rectangular area 4201. The word information 3301 holds “brand logo” as the word 3601. The locale 3602 of word information of the word information 3301 holds “ja_JP”. It is assumed that the locale of all word information appearing in the following description is “ja_JP” unless otherwise specified. The tag data 3101 is held in the tagged image data 3000.

  Similarly, tag data 3102 is configured from the rectangular area 4202 and the word “shutter button” 4302 associated therewith, and is similarly stored in the tagged image data 3000. The rectangular area 4203 and the word “flash” 4303 and the rectangular area 4204 and the word “lens” 4304 have the same relationship.

  The image data 3002 shown in FIG. 6B includes a camera similar to that shown in FIG. The brand logo 4301 in FIG. 6A and the brand logo 4501 in FIG. 6B are associated with the same word “brand logo”, but are stored as different tag data because the image data is different. The same applies to other information.

  FIG. 7 is a diagram schematically showing a configuration of a user registration information record 5000 that is user information stored in the user registration information DB 2005. The user identification name 5001 is an identification name for uniquely identifying a user in the user registration information. The shadow password 5002 is stored for use in alternative authentication. Alternative authentication refers to another means for authentication used when it is difficult to perform image authentication based on the present invention due to some systematic cause or accessibility. Whether to prepare alternative authentication means can be changed according to the implementation.

  The simple word list data 5003 is used for authentication of a user whose data is stored in the user registration information record 5000. Here, the simple word means word information used at the time of simple authentication. The word list length data 5101 indicates the total number of words included in the simple word list data 5003. The word list 5104 includes one or more words. A locale 5102 is a locale of words included in the word 5201 included in the word list 5104. For example, the locale 5102 of the simple word list data 5003 of the user A whose user identification name 5001 is “USER_A” is defined as “ja_JP”, and the word list 5104 is defined as “shutter button”.

  An expiration date 5103 is an expiration date of the simple word list data 5003. For example, when performing authentication, if the expiration date of the simple word list data is past the date and time information indicated by the system, that is, if the expiration date has passed, the authentication based on the simple word list data becomes invalid and authentication fails. The expiration date may be a date such as “September 19, 2012” or may be defined by a time such as “12:00:00”. Alternatively, it may be a date and time such as both date and time, and whether to prepare means for setting such information can be configured according to the implementation.

  A word 5201 is a word that is the first entry in the word list 5104. The word (520n) included in the word list 5104 and the word 3601 constituting the word information (330n) are stored in a mutually comparable data format. For example, if the word included in the word list 5104 is a “shutter button” and the word 3601 included in the specific tag data 310n is also a “shutter button”, it is determined that the two match.

  In this comparison, the fact that the locales 3602 and 5102 associated therewith match can be added to the condition for matching words. Or, if these locales are different and the words themselves do not match, it is possible to automatically translate one of the words from that locale to the other locale and make the result match the other word It is.

  The complex word list data 5004 is used for authentication of a user whose data is stored in the user registration information record 5000. The word list length data 5301 indicates the total number of words included in the complex word list data 5004. The word list 5303 includes one or more words. A locale 5302 is a locale of words 5401 to 5409 included in the word list 5303.

  In the system for performing simple authentication, it is preferable that the word list 5104 is smaller than the word list 5303. The number of each word can be configured according to the implementation.

  Next, FIG. 3 will be described. The user identification name input UI module 2101 performs screen display for inputting the user identification name and acquisition of the input information. The user identification name inquiry module 2102 inquires of the user registration information DB 2005 about the user identification name, and acquires the user registration information record 5000 if it is registered. The image authentication UI module 2103 displays the image data 3001 and acquires the user's instruction content.

  The word list data acquisition module 2104 acquires simple word list data 5003 included in the user registration information record 5000 acquired from the user registration information DB 2005. The word list word acquisition module 2105 extracts the word list 5104 from the acquired simple word list data 5003, and takes out the words 5201 to 5209 therefrom. The tagged image extraction module 2106 acquires tagged image data 3000 from the tagged image DB 2003. The image data extraction module 2107 extracts the image data 3001 from the acquired tagged image data 3000.

  The coordinate word collation module 2108 combines the coordinates designated by the user in the image authentication UI module 2103 and the word extracted from the word list word acquisition module 2105 (any one of the words 5201, 5401 to 5409) with a tag. Check on data 3000. The coordinate word collation module 2108 determines whether or not there is a word that matches the coordinates indicated in the tag data 3101 to 3109 given to the tagged image data 3000.

  The authentication result determination module 2109 holds the authentication result. The dummy authentication module 2110 protects against an attacker's brute force attack by pretending to continue the authentication process when authentication fails in the middle. The random image extraction module 2111 randomly extracts the tagged image data 3000 used by the dummy authentication module 2110 from the tagged image DB 2003.

  The simple word list data expiration date determination module 2112 determines whether the simple word list data 5003 is valid or invalid with reference to the expiration date 5103 when authenticating. The simple word list data generation module 2113 extracts and sets the word list 5104 of the simple word list data 5003 from the word information 3309 of the tagged image data 3000.

  Each module according to this embodiment described in FIG. 2 and FIG. 3 is realized by software read into the RAM 1302 on the information processing apparatus 1002 and executed by the CPU 1101.

  FIG. 9 shows an example of the screen of the authentication UI 2001. A user identification name input screen 7001 shown in FIG. 9A is a screen displayed on the display device 1310 in S6101 in FIG. The user identification name input screen 7001 has a user identification name input field 7101 and an authentication start button 7102. An authentication start button 7102 is a button for instructing the start of authentication when the user presses the user identification name in the user identification name input field 7101 and then presses it.

  An image authentication screen 7002 shown in FIG. 9B is a screen displayed after acquiring the user identification name in S6102. The image display area 7201 displays the image data 3001 held in the tagged image data 3000 for authentication. A cancel button 7202 is a button for canceling the authentication and returning to the user identification name input screen 7001. A simple word reset button 7203 is a button for recreating the word list of the simple word list. Authentication redo button 7204 is a button for redoing authentication.

  A simple word generation notification screen 7003 shown in FIG. 9C is a screen displayed after successful authentication in S6801. A notification area 7301 is an area for notifying simple word generation. Notification icon 7302 is an icon indicating that a simple word has been generated. When the user presses the notification icon 7302, a transition is made to a simple word display screen 7004 shown in FIG. A simple word display screen 7004 presents simple words. The simple word display area 7401 is an area for displaying simple words. An OK button 7402 is a button for closing the simple word display screen 7004.

[Overall operation]
Next, the overall operation of the authentication system of the first embodiment will be described with reference to FIG. When the process starts, the user identification name input UI module 2101 of the authentication UI 2001 displays a user identification name input screen 7001 shown in FIG. 9A on the display device 1310. In step S6101, the user identification name input UI module 2101 determines whether the user has issued an instruction to start user authentication. If the authentication start instruction has not been issued (NO in step S6101), the process returns to step S6101 and continues. If an instruction to start authentication is given (YES in S6101), the process proceeds to S6102.

  In step S6102, the user identification name input UI module 2101 acquires the user identification name input by the user, and passes it to the user identification name query module 2102. Thereafter, the image authentication UI module 2103 displays an image authentication screen 7002 shown in FIG. 9B on the display device 1310.

  In step S6103, the user identification name inquiry module 2102 inquires whether the user identification name acquired in step S6102 is registered in the user registration information DB 2005. If registered in user registration information DB 2005 (YES in S6103), the process proceeds to S6104. If not (NO in S6103), the process proceeds to S6601.

  In S6104, the simple word list data expiration date determination module 2112 extracts the expiration date 5103 from the simple word list data 5003 and compares it with the current date and time of the system. As a result of the comparison, if the expiration date 5103 is past the current date and time of the system, that is, if the expiration date has passed (NO in S6104), the process proceeds to S6401. If expiration date 5103 is the same as the current date and time in the system or in the future (YES in S6104), the process proceeds to S6201.

  In S6201, the word list data acquisition module 2104 acquires the user information record of the user registered in association with the input user identification name from the user registration information DB 2005, and from this, the simple word list data 5003 is acquired. To get. In step S6202, the word list data acquisition module 2104 enters a loop (S6203 to S6210) that repeats the number of times of the word list length data 5101 extracted from the acquired simple word list data 5003. If the loop has not been repeated a specified number of times, the process proceeds to S6203. If the loop has been repeated a specified number of times, the process advances to S6301.

  In S6203, the word list word acquisition module 2105 acquires words one by one from the word list 5104 included in the simple word list data 5003 each time the loop process is executed once. For example, in the first execution of the loop, the word 5201 that is the first word included in the word list 5104 is acquired. The order in which the word list word acquisition module 2105 acquires words may be from the first word in the word list. Or you may employ | adopt another acquisition order known for a user.

  In step S6204, the tagged image extraction module 2106 searches for tagged image data 3000 in which tag data 310n including a word acquired from the tagged image DB 2003 is held. If only one piece of tagged image data 3000 is found as a result of the search, the tagged image extraction module 2106 acquires it. When a plurality of tagged image data 3000 are registered, the tagged image extraction module 2106 randomly selects and acquires one of them.

  In step S6205, the image data extraction module 2107 extracts the image data 3001 of the tagged image data 3000 acquired in step S6204, and passes the image data 3001 to the image authentication UI module 2103. The image authentication UI module 2103 displays the passed image data 3001 in the image display area 7201 of the image authentication screen 7002. In step S6206, the image authentication UI module 2103 waits for the user to specify any coordinates in the image display area 7201 using the pointing device 1307. Alternatively, the user waits for the user to press the cancel button 7202 to specify cancellation. When the user makes some designation, the image authentication UI module 2103 obtains the designated coordinates and an instruction to press the cancel button 7202 or the simple word reset button 7203.

  If the user instructs cancellation (YES in S6207), the process returns to S6101 and continues. Otherwise (NO in S6207), the process proceeds to S6208. If the user instructs re-authentication (YES in step S6208), the process advances to step S6201. Otherwise (NO in S6208), the process proceeds to S6209. If the user instructs simple word reset (YES in S6209), the process proceeds to S6401. Otherwise (NO at S6209), the process proceeds to S6210.

  In step S6210, the image authentication UI module 2103 passes the coordinates designated by the user to the coordinate word collation module 2108. Then, the coordinate word matching module 2108 determines whether or not the instructed coordinates are within the area defined by the area information of the tag data including the target word. For example, it is assumed that area information constituting tag data including the acquired word information is defined as a rectangle (100, 100)-(200, 200). If the coordinates designated by the user are (150, 150), it is determined that the coordinates designated by the user are within the area indicated by the area information. Therefore, the user has correctly selected the word that must be selected in the authentication.

  On the other hand, if the coordinates designated by the user are (250, 250), for example, it is determined that the coordinates are not in the area, and the user has not been able to select a word that must be selected. Become. If the word that the user must select can be correctly selected (YES in S6210), the process returns to S6202 and continues.

  If the user has not correctly selected a word (NO in S6210), the process proceeds to S6401. If the loop has been executed a specified number of times in S6202, the process advances to S6301. In S6301, the simple word list data expiration date determination module 2112 extracts the expiration date 5103 from the simple word list data 5003 and compares it with the current date and time of the system. As a result of the comparison, if the expiration date 5103 is past the current date and time of the system (NO in S6301), the process proceeds to S6401. If expiration date 5103 is the same as the current date and time in the system or in the future (YES in S6301), the process proceeds to S6505.

  In step S6505, the authentication result determination module 2109 holds information indicating that the authentication is successful. Thereafter, the process proceeds to S6801.

  In step S6401, the word list data acquisition module 2104 acquires the user registration information record 5000 of the user registered with the user identification name input from the user registration information DB 2005, and the complex word list data 5004 is obtained therefrom. get. In step S6402, the word list data acquisition module 2104 enters a loop (S6403 to S6409) that repeats the number of times of the word list length data 5301 extracted from the complex word list data 5004. If the loop has not been repeated a specified number of times, the process advances to S6403. If the loop has been repeated a specified number of times, the process proceeds to S6501.

  In S6403, the word list word acquisition module 2105 acquires words one by one from the word list 5303 included in the complex word list data 5004 each time the loop is executed once. For example, in the first execution of the loop, the word 5401 that is the first word included in the word list 5303 is acquired. The order in which the word list word acquisition module 2105 acquires words may be from the first word in the word list. Or you may employ | adopt another acquisition order known for a user.

  In step S6404, the tagged image extraction module 2106 searches for tagged image data 3000 in which tag data 310n including words acquired from the tagged image DB 2003 is held. If only one piece of tagged image data 3000 is found as a result of the search, the tagged image extraction module 2106 acquires it. When a plurality of tagged image data 3000 are registered, the tagged image extraction module 2106 randomly selects and acquires one of them.

  In step S6405, the image data extraction module 2107 extracts the image data 3001 of the tagged image data 3000 acquired in step S6404 and passes the image data 3001 to the image authentication UI module 2103. The image authentication UI module 2103 displays the passed image data 3001 in the image display area 7201 of the image authentication screen 7002. In step S <b> 6406, the image authentication UI module 2103 waits for the user to specify any coordinate in the image display area 7201 using the pointing device 1307. Alternatively, the user waits for the user to press the cancel button 7202 to specify cancellation. When the user makes some designation, the image authentication UI module 2103 acquires the designated coordinates or the press of the cancel button 7202.

  If the user instructs cancellation (YES in S6407), the process returns to S6101 and continues. Otherwise (NO in S6407), the process proceeds to S6408. If the user instructs authentication redo button 7204 (YES in step S6408), the process advances to step S6201. Otherwise (NO in S6408), the process proceeds to S6409.

  In step S <b> 6409, the image authentication UI module 2103 passes the coordinates designated by the user to the coordinate word matching module 2108. Then, the coordinate word matching module 2108 determines whether or not the instructed coordinates are within the area defined by the area information of the tag data including the target word. The determination here is the same method as in S6210. If the word that the user must select can be correctly selected (YES in S6409), the process returns to S6402 and continues. If the user has not correctly selected a word (NO in S6409), the process proceeds to S6601.

  If the loop has been executed a specified number of times in S6402, the process advances to S6501. In step S6501, the image authentication UI module 2103 determines whether the user has pressed the simple word reset button 7203. If simple word reset button 7203 has been pressed (YES in S6501), the process proceeds to S6503. If simple word reset button 7203 has not been pressed (NO in step S6501), the process proceeds to step S6502. In S6502, the simple word list data expiration date determination module 2112 extracts the expiration date 5103 from the simple word list data 5003 and compares it with the current date and time of the system. As a result of the comparison, if the expiration date 5103 is past the current date and time of the system (NO in S6502), the process proceeds to S6503. If expiration date 5103 is the same as the current date and time of the system or in the future (YES in S6502), the process proceeds to S6505.

  In S6503, the simple word list data generation module 2113 acquires tagged image data 3000 including the same word from the tagged image DB 2003. For example, when tag data including the word “shutter button” is stored in the image data 3001, and tag data including the word “shutter button” is stored in the image data 3002 as well, the image data 3001 and the image data Data 3002 is acquired. The simple word list data generation module 2113 extracts data including the same word from tag data included in each image data. In step S6504, the simple word list data generation module 2113 stores the simple word list data 5003 in the word list 5104. There may be one or more word lists to be stored, and the number of words to be stored is not particularly limited as long as it is one or more. If a plurality of different words are extracted, one of them is selected and acquired at random. The simple word list data generation module 2113 sets the expiration date to the expiration date 5103 of the simple word list data 5003 after storing the simple word.

  If the user identification name is not registered in user registration information DB 2005 (NO in S6103), or if the designated coordinates are not in the area information area (NO in S6409), the process proceeds to S6601.

  In S6601, the dummy authentication module 2110 randomly determines the number of loops, and repeats the following steps (S6602 to S6605) by that number. If the loop has not been executed the specified number of times, the process proceeds to S6602. If the specified number of loop executions have been completed, the process proceeds to S6601.

  In S6602, the random image extraction module 2111 acquires any of the tagged image data 3000 from the tagged image DB 2003 at random. In step S6603, the random image extraction module extracts the image data 3001 from the acquired tagged image data 3000 and passes the image data 3001 to the image authentication UI module 2103. The image authentication UI module 2103 displays the passed image data 3001 in the image display area 7201 of the image authentication screen 7002.

  In S6601 to S6605, when the user cannot correctly input the user identification name or when the word to be selected cannot be correctly selected, the user is actually an attacker. This is because the case is taken into consideration. If the attacker can know immediately whether the user identifier entered by the attacker is correct, or whether the specified coordinates have selected the correct word, it is possible to immediately move on to the next attempt. . This increases the probability of a successful brute force attack. To prevent this, a certain number of dummy authentication images are displayed even after the user has failed to authenticate, and if the user does not specify it, it will not be possible to know if authentication has succeeded in the end. To do.

  In step S <b> 6604, the image authentication UI module 2103 waits for the user to specify any coordinate in the image display area 7201 using the pointing device 1307 or to press the cancel button 7202 to specify cancellation. When the user designates either one, the coordinate or the press of the cancel button 7202 is acquired. If the user designates cancellation (YES in S6605), the process returns to S6101 and continues. Otherwise (NO in S6605), the process returns to S6601 and continues. If the loop has been executed a predetermined number of times in S6601, the process proceeds to S6701, and the authentication result determination module 2109 determines that the authentication has failed, and holds the result.

  In step S6801, the image authentication UI module 2103 determines whether the screen authentication is successful. If the authentication is successful (YES in S6801), the process proceeds to S6802. If authentication fails (NO in S6801), the process proceeds to S6002. In step S6802, the image authentication UI module 2103 displays a simple word generation notification screen 7003 illustrated in FIG.

  In step S6803, the image authentication UI module 2103 waits whether the user presses the notification icon 7302 or designates another location on the simple word generation notification screen 7003 with the pointing device 1307. When the user designates one of them, the image authentication UI module 2103 acquires a designated coordinate or an instruction to press the notification icon 7302. If the user designates notification icon 7302 (YES in S6803), the process proceeds to S6804. Otherwise (NO in S6803), the process flow ends. In step S6804, the image authentication UI module 2103 displays a simple word display screen 7004 shown in FIG. Here, the image authentication UI module 2103 acquires the simple word saved by the simple word list data generation module 2113 and displays it in the simple word display area 7401 of the simple word display screen 7004. Thereafter, this processing flow ends.

  When this processing flow ends, the authentication result determination module 2109 ends the entire authentication process and holds the result of the authentication process.

  In this embodiment, it is assumed that the user inputs the user identification name from the keyboard 1306 on the user identification name input screen 7001. Alternatively, it is assumed that the pointing device 1307 performs input on the virtual keyboard displayed on the display device 1310. However, other means may be used.

  Thus, by using the simple word list data 5003 as authentication data, the authentication process can be made simpler than when authentication is performed using the normal complex word list data 5004 as authentication data. For example, it is assumed that “shutter button” is set in the word list of the simple word list data 5003 and “brand logo”, “lens”, and “flash” are set in the word list of the complex word list data 5004. In this case, after the first authentication is successful, the user can perform authentication only by specifying the position of the shutter button in the subsequent authentication processing. The simple word list data 5003 cannot always be authenticated with the same word because the valid condition is set. The mechanism that periodically changes the word by determining the effective date and time in this embodiment, even if a third party looks into the user's operation, even if the same operation is performed, authentication fails and misuse can be prevented It becomes possible.

  In this embodiment, the date and time information is used as the default condition for performing simple authentication. However, it may be determined using the number of times simple authentication is performed. In this case, a mechanism that changes the word by the set number of times may be used.

<Second Example>
Next, a second embodiment according to the present invention will be described with reference to the drawings. In this embodiment, at the time of simple authentication, authentication is performed not by an area in an image corresponding to a character string but by an instruction for a predetermined range in the image. The internal configuration of the information processing apparatus in which the authentication system of the second embodiment operates is the same as that shown in FIG. 1 of the first embodiment.

  10 and 11 show an example of the module configuration of the authentication system according to the second embodiment of the present invention. Only differences from FIG. 2 will be described. In FIG. 10, the information processing apparatus 1002 further includes a dummy tag DB 8001 (third holding means).

  In FIG. 11, the information processing apparatus 1002 further includes a dummy word list word acquisition module 8101, a dummy tag extraction module 8102, a dummy coordinate word matching module 8103, and a dummy word list data generation module 8104. The dummy word list word acquisition module 8101 extracts the dummy word list 11201 from the simple word list data 5003 and extracts the word 11301 from the extracted word list. The dummy tag extraction module 8102 acquires dummy tag data 9000 from the dummy tag DB 8001. The dummy coordinate word collation module 8103 collates the coordinate specified by the user in the image authentication UI module 2103 and the word 11301 extracted by the dummy tag extraction module 8102 on the tagged image data 3000. The dummy coordinate word matching module 8103 determines whether or not there is a match between the acquired coordinates and the word in the dummy tag data 9101 to 9109. The dummy word list data generation module 8104 extracts the dummy word list 11201 of the simple word list data 5003 from the word information 9309 of the dummy tag data 9000 and sets it.

  FIG. 12A schematically shows an example of dummy tag data 9000 held in the dummy tag DB 8001. The dummy tag data 9000 is composed of one or a plurality of dummy tag data, and here is composed of N pieces of dummy tag data. The dummy tag data 9101 is the first dummy tag data. The dummy tag data 9102 is second dummy tag data. The dummy tag data 9109 is Nth dummy tag data.

  Each dummy tag data includes dummy area information and word information. The dummy area information 9201 is dummy area information included in the first dummy tag data 9101. The word information 9301 is word information included in the first dummy tag data 9101. The dummy area information 9202 is area information included in the second dummy tag data 9102. The word information 9302 is word information included in the second dummy tag data 9102. Similarly, the dummy area information 9209 is area information included in the Nth dummy tag data 9109, and the word information 9309 is word information included in the Nth dummy tag data 9109.

  FIG. 12B shows a configuration example of dummy area information. The nth dummy area information 920n is represented by a rectangular area on the image data 3001. Specifically, the rectangle is designated by the x coordinate, y coordinate, width, and height of the starting point.

  The coordinate 9501 is the x coordinate of the start point, and the coordinate 9502 is the y coordinate of the start point. A width 9503 indicates a width in the right direction from the starting point, and a height 9504 indicates a height in the downward direction from the starting point. The width 9503 is not a specific numerical value, but the width is calculated from the size of the image. The height 9504 also calculates the height from the size of the image, but a calculation formula is set, and the height is actually calculated by dividing the height of the image by 2. In this embodiment, the area information is represented by a rectangle, but it may be a circle, a polygon, or two rectangles. This embodiment does not limit what area information is used.

The word information for operating the authentication system according to the second embodiment is the same as FIG. 4C described in the first embodiment. FIG. 13 shows an example of dummy area information by dummy tag data. The dummy tag data 9101 is associated with the rectangular area 10201 of the image data 3001. A rectangular area 10201 represents an area of the upper half 10301 with respect to the image data 3001. The dummy tag data 9101 includes dummy area information 9201 representing the rectangular area 10201 and word information 9301 representing the word “upper half”.

  FIG. 14 schematically illustrates a configuration example of a user registration information record 5000 stored in the user registration information DB 2005. The dummy word list length data 11101 indicates the total number of dummy words included in the simple word list data 5003. The dummy word list 11201 is used when performing authentication using dummy tag data. A word 11301 is a word that is the first entry in the dummy word list 11201. The dummy word list 11201 includes one or more words.

  The user identification name input screen 7001 and the image authentication screen 7002 in the authentication UI 2001 of the authentication system of the second embodiment are the same as those shown in FIGS. 9A and 9B described in the first embodiment.

(Overall processing)
15 and 16 outline the overall operation of the authentication system according to the second embodiment of the present invention and will be described below. Here, only differences from the processing described in FIG. 8 will be described in detail.

  This will be described with reference to FIG. After the process of S6202 of FIG. 8, the dummy word list word acquisition module 8101 enters a loop (S12102 to S12109) that repeats the number of times of the dummy word list length data 11101 extracted from the simple word list data 5003 in S12101. If the loop has not been repeated a specified number of times, the process proceeds to S12102. If the loop has been repeated a specified number of times, the process proceeds to S6301.

  In S12102, the dummy word list word acquisition module 8101 acquires words one by one from the dummy word list 11201 included in the simple word list data 5003 for each execution of the loop. For example, in the first execution of the loop, the word 11301 is acquired. The order in which the dummy word list word acquisition module 8101 acquires words may be from the first word in the word list. Or you may employ | adopt another acquisition order known for a user.

  In step S <b> 12103, the tagged image extraction module 2106 searches for and acquires tagged image data 3000 from the tagged image DB 2003 at random. In step S12104, the image data extraction module 2107 extracts the image data 3001 of the tagged image data 3000 acquired in step S12103, and passes the image data 3001 to the image authentication UI module 2103. The image authentication UI module 2103 displays the passed image data 3001 in the image display area 7201 of the image authentication screen 7002. In step S <b> 12105, the image authentication UI module 2103 waits for the user to specify any coordinate in the image display area 7201 using the pointing device 1307. Alternatively, the user waits for the user to press the cancel button 7202 to specify cancellation. When the user makes some designation, the image authentication UI module 2103 obtains the designated coordinates and an instruction to press the cancel button 7202 or the simple word reset button 7203.

  If the user instructs cancellation (YES in S12106), the process returns to S6101 and continues. Otherwise (NO in S12106), the process proceeds to S12107. If the user instructs authentication redo button 7204 (YES in S12107), the process proceeds to S6201. Otherwise (NO in S12107), the process proceeds to S12108. If the user instructs simple word reset button 7203 (YES in S12108), the process proceeds to S6401. Otherwise (NO in S12108), the process proceeds to S12109.

  In step S <b> 12109, the image authentication UI module 2103 passes the coordinates designated by the user to the coordinate word matching module 2108. Then, the dummy coordinate word collation module 8103 determines whether or not the instructed coordinate is within the area defined by the area information of the tag data including the target word. The determination here is the same method as S6210 of FIG. 8 described in the first embodiment. In addition, when the rectangular data indicates an L-shaped coordinate and the user designates an operation that traces the L-shape with a pointing device, the traced operation is within the L-shaped area. If it is determined that, the word may be selected correctly. If the word that the user must select can be correctly selected (YES in S12109), the process returns to S12101 and continues.

  If the user has not correctly selected a word (NO in S12109), the process proceeds to S6401. If the loop has been executed a specified number of times, the process proceeds to S6301.

  Next, it demonstrates using FIG. After the process of S6504 in FIG. 8, in S12201, the dummy word list data generation module 8104 randomly extracts dummy words from the dummy tag DB 8001. In step S 12202, the dummy word list data generation module 8104 stores the dummy word in the dummy word list 11201 of the simple word list data 5003. One or a plurality of word lists may be stored, and the number of word lists is not particularly limited as long as the number is one or more.

  Here, the process proceeds to the process of S12101 after S6202, and the dummy tag authentication is performed. However, even if a setting is made to proceed to the process of S6301 without performing the dummy tag authentication, the user can select which process to perform. I do not care.

<Third embodiment>
Next, a third embodiment according to the present invention will be described with reference to the drawings. In the present embodiment, any of word information associated with the area in the screen used for the previous authentication is selected and used as a simple word. The internal configuration of the information processing apparatus in which the authentication system of the third embodiment operates is the same as that shown in FIG. 1 of the first embodiment.

  FIG. 17 shows an example of the module configuration of the authentication system of the third embodiment. Only differences from FIG. 11 shown in the second embodiment will be described. The authentication UI 2001 further includes a final image simple word list data generation module 13101. The final image simple word list data generation module 13101 extracts simple tag data from the last image used for the previous authentication and sets words in the simple word list data 5003.

  The tagged image data of the third embodiment is the same as that shown in FIG. 4 of the first embodiment. Examples of tagged image data of the third embodiment are the same as those shown in FIGS. The configuration of the user registration information record stored in the user registration information DB 2005 of the third embodiment is the same as that shown in FIG. An example of the screen of the authentication UI 2001 of the third embodiment is the same as that shown in FIG.

  The overall operation according to the third embodiment will be described with reference to FIG. Here, only the differences from those described with reference to FIG. 6 of the first embodiment and FIGS. 15 and 16 of the second embodiment will be described in detail.

  If it is determined in S6502 of FIG. 8 that the expiration date is past the current date and time of the system (NO in S6502), the process proceeds to S14101. In S14101, the final image simple word list data generation module 13101 extracts a word from the tag image data used last, and acquires tagged image data 3000 including the same word as the word. There may be one or more word lists to be stored, and the number of words to be stored is not particularly limited as long as it is one or more. When a plurality of words are extracted, the final image simple word list data generation module 13101 randomly selects and acquires one of them. When there is no tagged image data 3000 including the same word, the final image simple word list data generation module 13101 randomly acquires a word from the words of the tagged image data used last. Thereafter, the process proceeds to S6504.

  Here, the process proceeds to the process of S14101 after S6502, and a simple word is generated from the last image. However, a setting may be made to proceed to the processing of S6503 without generating a simple word from the last image in the previous authentication, and the user may select which processing is to be performed.

<Fourth embodiment>
Next, a fourth embodiment according to the present invention will be described with reference to the drawings. In this embodiment, the user's schedule information is held, and a character string included in the schedule is used as a simple word used in simple authentication. The internal configuration of the information processing apparatus in which the authentication system of the fourth embodiment operates is the same as that shown in FIG. 1 of the first embodiment.

  19 and 20 show an example of the module configuration of the authentication system of the fourth embodiment. Only differences from the second embodiment shown in FIGS. 10 and 11 will be described.

  In FIG. 19, the information processing apparatus 1002 further includes a schedule DB 15001 that includes schedule information. In FIG. 20, the authentication UI 2001 further includes a schedule data extraction module 15101 and a schedule simple word list data generation module 15102.

  The schedule data extraction module 15101 acquires schedule data 16001 from the schedule DB 15001. The simple schedule word list data generation module 15102 extracts the schedule schedule data 16103 from the schedule data 16001 and generates a simple schedule word. The simple schedule word list data generation module 15102 searches the word information 3309 of the tagged image data 3000 included in the schedule schedule data 16103.

  The tagged image data of the fourth embodiment is the same as that shown in FIG. 4 of the first embodiment. Examples of tagged image data in the fourth embodiment are the same as those shown in FIGS. The configuration of the user registration information record stored in the user registration information DB 2005 of the fourth embodiment is the same as that shown in FIG. An example of the screen of the authentication UI 2001 of the fourth embodiment is the same as that shown in FIG.

  FIG. 21 schematically shows a configuration example of a schedule data record 16000 that is schedule information stored in the schedule DB 15001. The schedule data record 16000 includes one or a plurality of schedule data. In the present embodiment, the schedule data record 16000 includes N pieces of schedule data 16001 to 16009. Date / time data 16101 is date / time data included in the schedule data 16001. The schedule data 16102 is data describing a schedule included in the schedule data 16001.

  The schedule data 16902 included in the schedule data record 16000 and the word 3601 constituting the word information are stored in a mutually comparable data format. For example, when the data included in the schedule data 16902 is “scheduled to buy a lens” and is the word 3601 “lens” included in the specific tag data 310N, these pieces of information are compared with each other as “lens” "Is determined to be included.

  FIG. 22 schematically shows a configuration example of the schedule list data 17000 acquired by the schedule data extraction module 15101 from the schedule DB 15001. The schedule list data 17000 includes one or a plurality of schedule data. In this embodiment, the schedule list data 17000 includes N pieces of schedule data 17101 to 17109. The schedule list length data 17001 is the number of schedule data included in the schedule list data 17000. The schedule data 17101 is schedule data included in the schedule list data. Date / time data 17201 is date / time data included in the schedule data 17101. The schedule data 17202 is data describing a schedule included in the schedule data 17101.

  The overall operation of the authentication system according to the fourth embodiment will be described with reference to FIG. Here, only differences from those described in FIG. 8 of the first embodiment, FIGS. 15 and 16 of the second embodiment, and FIG. 18 of the third embodiment will be described in detail.

  If it is determined in S6502 of FIG. 8 that the expiration date is past the current date and time of the system (NO in S6502), the process proceeds to S18101. In S18101, the schedule data extraction module 15101 acquires the current date and time, and acquires schedule list data 17000 within one week from the current date and time. Then, the schedule data extraction module 15101 sorts the acquired schedule list data 17000 in the order close to the current date and time. In S18102, the schedule simple word list data generation module 15102 enters a loop (S18103 to S18105) that repeats the number of times of the schedule list length data 17001 extracted from the schedule list data 17000. If the loop has not been repeated a specified number of times, the process proceeds to S18103. If the loop has been repeated a specified number of times, the process proceeds to S6503.

  In S18103, the simple schedule word list data generation module 15102 acquires schedules one by one from the schedule data 17101 included in the schedule list data 17000 for each execution of the loop. For example, if it is the first execution of the loop, the schedule data 17202 of the schedule data 17101 is acquired. In S18104, the simple schedule word list data generation module 15102 searches for the words included in the schedule data 17202 from the tagged image data 3000 of the tagged image DB 2003.

  In S18105, the schedule simple word list data generation module 15102 determines whether or not a word has been detected in S18104. If the word can be detected (YES in S18105), the process proceeds to S6504. If the word cannot be detected (NO in S18105), the process returns to S6503 and continues.

  Here, the process proceeds to S6503 after S18102, and a simple word is generated from the last image. However, a setting may be made so as to proceed to the processing of S6503 without generating a simple word from the last image, and the user may select which processing is to be performed.

<Other examples>
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, etc.) of the system or apparatus reads the program. It is a process to be executed.

Claims (12)

An information processing apparatus that performs authentication processing,
First holding means for holding an image and word information associated with a region included in the image;
Second holding means for holding user information and a plurality of word information in association with each other;
When performing user authentication, a plurality of word information associated with the user information of the user is acquired from the second holding unit, and includes an area associated with each of the acquired plurality of word information Selecting means for selecting an image from the first holding means;
Display means for displaying the image selected by the selection means;
A specifying means for specifying word information associated with an area including the position in response to a user specifying any position in the image displayed by the display means;
Authentication means for performing authentication processing by comparing the word information specified by the specifying means and the word information associated with the user information;
When the authentication of the user is successful, the authentication means uses a number of word information smaller than the number of the plurality of word information associated with the user information of the user at the next and subsequent authentications for the user. An information processing apparatus that performs authentication.   The information processing apparatus according to claim 1, further comprising a presentation unit that presents word information used when performing simple authentication to the user when the user is successfully authenticated.   The said authentication means uses the word information different from the word information matched with the user information hold | maintained at said 2nd holding means, when performing simple authentication. Information processing device. A third holding means for holding an image and word information indicating a region included in the image;
The second holding means further holds the word information held by the third holding means and the user information in association with each other,
The information according to claim 2, wherein the authentication unit performs authentication using word information held in the third holding unit and associated with the user information when performing simple authentication. Processing equipment.   The authentication means performs authentication using any of word information associated with a region included in an image used last in previous authentication when performing simple authentication. 2. The information processing apparatus according to 2. It further has means for holding schedule information,
The information processing apparatus according to claim 2, wherein the authentication unit performs authentication using word information including a character string included in the schedule information when performing simple authentication.   The information processing apparatus according to claim 1, wherein the authentication unit returns to normal authentication when a predetermined condition is satisfied while performing simple authentication. The authentication means sets the expiration date of the simple authentication when the user authentication is successful,
The information processing apparatus according to claim 7, wherein the predetermined condition is when the expiration date has passed.   The information processing apparatus according to claim 7, wherein the predetermined condition is the number of times simple authentication is performed.   The information processing apparatus according to claim 1, wherein the word information includes position information in an image and a character string indicating an object included in the image. Information processing comprising first holding means for holding an image and word information associated with a region included in the image, and second holding means for holding user information and a plurality of word information in association with each other An authentication method in a device,
When performing user authentication, a plurality of word information associated with the user information of the user is acquired from the second holding unit, and includes an area associated with each of the acquired plurality of word information A selection step of selecting an image from the first holding means;
A display step of displaying the image selected in the selection step on a display unit;
A specifying step of specifying word information associated with an area including the position in response to the user specifying any position in the image displayed on the display unit;
An authentication step of performing an authentication process by comparing the word information specified in the specifying step and the word information associated with the user information;
If authentication of a user is successful in the authentication step, simple authentication using a smaller number of word information than the number of word information associated with the user information of the user at the next and subsequent authentications for the user An authentication method characterized by performing. Computer
First holding means for holding an image and word information associated with a region included in the image;
Second holding means for holding user information and a plurality of word information in association with each other;
When performing user authentication, a plurality of word information associated with the user information of the user is acquired from the second holding unit, and includes an area associated with each of the acquired plurality of word information Selecting means for selecting an image from the first holding means;
Display means for displaying the image selected by the selection means;
A specifying means for specifying word information associated with an area including the position in response to a user specifying any position in the image displayed by the display means;
The word information specified by the specifying means and the word information associated with the user information are compared to function as an authentication means for performing an authentication process,
When the authentication of the user is successful, the authentication means uses a number of word information smaller than the number of the plurality of word information associated with the user information of the user at the next and subsequent authentications for the user. A program characterized by performing authentication.

Images