JP6714930B2 - Authentication system - Google Patents

Description

The present disclosure relates to a technique of an authentication device capable of changing authentication data.

There is known a technology that has many authenticators inside facilities such as hotels and condominiums, and centrally manages authentication data for authenticating each authenticator.
As a technique of this kind, in Patent Document 1, by communicating between a personal computer of an administrator and each authenticator, the administrator centrally manages authentication data for authenticating the authenticator by a management PC that is a personal computer on the management side. The technology of the lock system which does is disclosed.

JP, 2013-23882, A

However, in the lock system of Patent Document 1, it is necessary to generate authentication data when issuing an IC card required for authentication, and record the generated authentication data in both the IC card and the authentication device. Recording on the IC card can be performed by the issuing device, but there is a problem that recording on the authentication device requires communication equipment for communication between the issuing device and the authentication device.

The present disclosure provides a technique that enables an administrator to centrally manage authentication data without requiring communication equipment.

The authentication device of the present disclosure includes a character string generation unit, a generation storage unit, a character string acquisition unit, an authentication determination unit, an authentication permission unit, a first updating unit, and a second updating unit.
The character string generation unit generates an authentication character string that is a character string used for authentication of the authentication device according to a predetermined generation rule. The generation storage unit stores the first authentication character string and the second authentication character string that are the authentication character strings generated by the character string generation unit. The character string acquisition unit acquires an input character string that is a character string that is longer than an authentication character string input from the outside. The authentication determination unit uses the first authentication character string stored in the generation storage unit and the first authentication character string stored in the generation storage unit as a specified character string that is a character string of a predesignated part of the input character string and has the same length as the authentication character string. It is determined whether or not any one of the two authentication character strings matches. The authentication permission unit permits the authentication when the authentication determination unit determines that the designated character string matches one of the first authentication character string and the second authentication character string. When the preset update condition is satisfied, the first update unit causes the character string generation unit to generate the authentication character string, and updates the first authentication character string stored in the generation storage unit with the generated authentication character string. .. The second updating unit stores the specified character string in the generation storage unit by overwriting the first authentication character string with the second authentication character string when the specified authentication character string matches the first authentication character string stored in the generation storage unit. Update the second authentication character string.

With such a configuration, the administrator can centrally manage the authentication data without requiring communication equipment.

It is a block diagram which shows the structure of the authentication system in 1st Embodiment. It is a block diagram showing the composition of the issued character string area in a 1st embodiment. It is a block diagram showing the structure of the authentication character string area|region in 1st Embodiment. It is a flow chart of the issuing character string generation processing in the first embodiment. 6 is a flowchart of an authentication character string generation process in the first embodiment. It is a flow chart of input character string judgment processing in a 1st embodiment. It is a figure showing the time series change of the 1st attestation character string and the 2nd attestation character string in a 1st embodiment. It is a block diagram which shows the structure of the authentication system in 2nd Embodiment. It is a block diagram showing the composition of the attestation character string field in a 2nd embodiment. It is a figure showing the time series change of the 1st attestation character string and the 2nd attestation character string in a 2nd embodiment.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.
[1. First Embodiment]
[1-1. Constitution]
As shown in FIG. 1, the authentication system 1 according to this embodiment includes an issuing device 2 and a plurality of authenticators 3. The issuing device 2 referred to here issues a character string, and the character string is input to the authentication device 3, whereby the authentication device 3 performs control according to the input character string. In the following description of the present embodiment, a character string refers to a character string composed of numbers. The control performed by the authenticator 3 here is, for example, control for unlocking the key provided in the authenticator 3. That is, the authenticator 3 is a device provided for each key such as a hotel or an apartment. Further, the character string used here exists individually for each authentication device 3, and each character string is composed of two parts. Of the two parts that make up the character string, one is a generated character string that is a character string that is generated according to a predetermined rule, and the other is a set character string that is a character string in which arbitrary information can be set. is there.

<Issuing device 2>
The issuing device 2 shown in FIG. 1 includes an issuing device input key 21, a management device 22, and an issuing device 23. In the issuing device 2, the issuing device 23 issues the issuing character string in accordance with the input from the issuing device input key 21. In the following, a person who operates the issuing device 2 is referred to as an issuer.

The issuing device input key 21 is configured to be able to input authentication device information, user identification information, authentication permission date and time, and an issuing instruction of an issuing character string.
The authenticator information is information that specifies the authenticator 3 that is the target of the character string issuance. For example, a list of authenticators 3 or a list of room numbers of rooms to which the authenticators 3 are attached is displayed, and by selecting one from the displayed list, authenticator information is generated. You may comprise.

The user identification information is information that identifies a person who is permitted to authenticate the selected authenticator 3, and includes, for example, information regarding the name and affiliation of the person who is permitted to authenticate.
The authentication permission date and time is the date and time when the user identified by the input user identification information is permitted to authenticate. The authentication permission date and time mentioned here includes a case where only the date is shown and a case where the date and the time zone are shown. Further, the time zone refers to one day divided into a plurality of times.

That is, the issuing device input key 21 can input the user identification information of a person who is permitted to use the room in which the authentication device 3 is installed and the date and time when the authorized person is permitted to use the room. Is configured as follows.

The management device 22 generates an issuance character string according to the input from the issuing device input key 21. That is, the issuing character string is generated based on the authentication device information, the user identification information, the authentication permission date and time, and the issuing instruction input using the issuing device input key 21.

As shown in FIG. 1, the management device 22 is mainly composed of a well-known microcomputer having a management CPU 221 and a semiconductor memory such as RAM, ROM and flash memory (hereinafter, management memory 222). Various functions of the management device 22 are realized by the management CPU 221 executing the programs stored in the non-transitional physical recording medium. In this example, the management memory 222 corresponds to a non-transitional physical recording medium that stores a program. By executing the program stored in the management memory 222, the method corresponding to the program is executed.

It should be noted that the number of microcomputers forming the management device 22 may be one or more. Further, the function realized by the management device 22 is not limited to software, and one or more pieces of hardware may be realized for some or all of the elements. For example, when the above functions are realized by an electronic circuit that is hardware, the electronic circuit may be realized by a digital circuit including a large number of logic circuits, an analog circuit, or a combination thereof.

The management memory 222 includes a management program area 2221, an issued character string area 2222, and an identification information area 2223 as storage areas.
The management program area 2221 stores at least an issuance character string generation program, which is a program for executing an issuance character string generation process described later, as a program executed by the management CPU 221. The issue character string is generated by executing the issue character string generating program.

The issued character string has a management character string corresponding to the above-mentioned generated character string and an additional character string corresponding to the above-mentioned set character string. The management character string is generated based on the authentication device information and the authentication permission date and time acquired via the issuing device input key 21. However, the management character string generated when the authentication permission date and time is only a date is also called a date type, and the management character string generated when the authentication permission date and time is a date and a time zone is also called a date and time type. The management character string is set so that the number of characters differs between the date type and the date/time type. The additional character string is a fixed-length character string generated based on the user identification information acquired via the issuing device input key 21.

As shown in FIG. 2, the issue character string area 2222 is allocated an area for each authenticator 3, and the issue character string generated by the issue character string generating process is stored for each authenticator 3. That is, when each authenticator 3 is the authenticator 3a, the authenticator 3b, and the authenticator 3c, the areas for storing the issuing character strings corresponding to them are the authenticator 3a area, the authenticator 3b area, and the authenticator 3c area. .. Then, in each area prepared for each authentication device 3, an issue character string composed of a management character string and an additional character string is stored for each type of management character string.

The identification information area 2223 stores an identification information table indicating the correspondence between the user identification information acquired via the issuing device input key 21 and the additional character string. The additional character string is generated so as to have a one-to-one correspondence with the user identification information, and the user identification information can be specified from the additional character string.

The issuer 23 issues the character string generated by the manager 22 as an issue character string. The issuer 23 is, for example, a display screen included in the issuing device 2, and issues an issue character string by displaying the issue character string on the display screen. The issued character string may be a simple connection of the management character string and the additional character string, or may be shuffled according to a predetermined rule. Hereinafter, the rule used when generating the issue character string from the management character string and the additional character string is referred to as a connection rule.

<Authentication machine 3>
The authenticator 3 shown in FIG. 1 has the same configuration, and includes an authenticator input key 31, a character string determiner 32, and a controller 33. Hereinafter, a user is a person who is permitted to use the room in which the authentication device 3 is installed.

In the authenticator 3, a character string is input via the authenticator input key 31, the input character string is determined by the character string determiner 32, and the controller 33 operates according to the determination.
The authentication machine input key 31 is configured to be able to input a character string to be authenticated and an instruction to execute authentication. In this embodiment, it is a numeric keypad for inputting numbers. Hereinafter, the character string input to the numeric keypad will be referred to as an input character string.

In the following, of the input character strings, the character string composed of the characters extracted from the position where the characters that make up the management character string are arranged is specified as the character string according to the connection rules when generating the above-mentioned issue character string. A character string composed of characters extracted from the position where the characters forming the set character string are arranged is called an additional character string. In addition, there are input character strings having the number of characters corresponding to the date type and those having the number of characters corresponding to the date/time type.

The character string determiner 32 determines whether the designated character string extracted from the input character string and the authentication character string generated by the authenticator 3 are the same. The character string determiner 32 also stores the additional character string extracted from the input character string.

As shown in FIG. 1, the character string determiner 32 is mainly composed of a well-known microcomputer having an authentication CPU 321, and a semiconductor memory (hereinafter, authentication memory) 322 such as RAM, ROM and flash memory. Various functions of the character string determiner 32 are realized by the authentication CPU 321 executing a program stored in the non-transitional physical recording medium. In this example, the authentication memory 322 corresponds to the non-transitional substantive recording medium storing the program. By executing the program stored in the authentication memory 322, the method corresponding to the program is executed.

It should be noted that the number of microcomputers forming the character string determiner 32 may be one or more. Further, the function realized by the character string determiner 32 is not limited to software, and one or more hardware may be realized for some or all of the elements. For example, when the above functions are realized by an electronic circuit that is hardware, the electronic circuit may be realized by a digital circuit including a large number of logic circuits, an analog circuit, or a combination thereof.

The authentication memory 322 includes an authentication program area 3221, an authentication character string area 3222, and an additional character string area 3223 as storage areas.
The authentication program area 3221 stores at least an authentication character string generation program for performing an authentication character string generation process and an input character string determination program for performing an input character string determination process, which will be described later, as programs executed by the authentication CPU 321.

As shown in FIG. 3, the authentication character string area 3222 stores the authentication character string generated by the authentication character string generation program. The authentication character string is the same as the management character string in the issuing character string issued by the issuing device 2, and the date type and the date/time type exist. Then, two authentication character strings are stored for each type. One of these two recognition character strings is called a first authentication character string, and the other is called a second authentication character string.

In the additional character string area 3223, the additional character string extracted from the input character string is sequentially stored together with the time when the input character was input.
The controller 33 is a device for performing an operation according to the determination made by the character string determiner 32. That is, for example, it is a device that is provided outside the authenticator 3 and that unlocks the lock.

[1-2. processing]
<Issuing character string generation process>
Next, the issuing character string generation process executed by the management device 22 provided in the issuing device 2 will be described with reference to the flowchart of FIG. The issuing character string generation process is executed by inputting the authentication device information, the user identification information, and the authentication permission date and time by the issuing device input key 21, and then further inputting the issuing instruction.

In S100, the management device 22 acquires the authentication device information, the user identification information, and the authentication permission date and time, which are input using the issuing device input key 21.
In S110, the management device 22 uses the seed data based on the authentication device information and the authentication permission date acquired in S100 to generate a management character string that is a character string used for authentication according to a predetermined generation algorithm. For the seed data, for example, the authenticator information and the authentication permission date and time may be used as they are, or, for example, the serial number of the authenticator 3 specified from the authenticator information, such as the authenticator information and the authentication permission date and time, may be in a one-to-one correspondence. Any corresponding data may be used. A known encryption algorithm can be used as the generation algorithm.

In S120, the management device 22 creates an additional character string based on the user identification information acquired in S100. Specifically, the additional character string is created by converting the user identification information into a number. The additional character string may be a character string that is previously assigned to the user or may be a character string that is temporarily assigned to the user. In the former case, the identification information table in the identification information area 2223 may be a preset one, and conversion may be performed by referring to the identification information table. In the latter case, a different serial number is assigned each time the user identification information is input, so that the user identification information is converted into a number, and the assigned number (that is, the serial number) and the user identification information It is sufficient to register the correspondence relationship of No. in the identification information table of the identification information area 2223.

In S130, the management device 22 generates an issue character string by connecting the management character string generated in S110 and the additional character string generated in S120 according to the connection rule.
In S140, the management device 22 stores the issue character string generated in S130 in the issue character string area 2222. As a result, the history of issued issue character strings is stored for each authentication device 3 in the issue character string area.

In S150, the management device 22 causes the issuing device 23 to issue the issue character string generated in S130, and ends the process.
The management device 22 functions as a management generation unit by executing the process of S110, and functions as an additional character string addition unit by executing the process of S130.

<Authentication character string generation process>
Next, the authentication character string generation process executed by the character string determiner 32 included in the authenticator 3 will be described with reference to the flowchart of FIG. The authentication character string generation process is executed every time the date or time zone defined in the description of the management character string type is switched. However, in the following description, when this process is activated at the time of switching the date, the time data representing the date after the switching is used to update the information regarding the date type of the authentication character string area 3222. Further, when this process is activated at the time of switching the time zone, the time data representing the date and the time zone is used to update the information on the date and time type of the authentication character string area 3222. Furthermore, when the date and the time zone are switched at the same time, the processing is executed individually for each.

In step S200, the character string determination unit 32 generates an authentication character string according to the above-described generation algorithm using the authentication device information and time data of the own device as seed data. That is, the authentication character string is generated according to the same generation rule as the generation rule in S110 of the issuing character string generation process.

In S210, the character string determination unit 32 stores the authentication character string generated in S200 as the first authentication character string in the authentication character string area 3222, and ends the process.
That is, by executing this process, the date-type first authentication character string is updated each time the date is switched, and the date-type first authentication character string is updated each time the time zone is switched. Note that the initial value of the second authentication character string stored in the authentication character string area 3222 is set to the same value as the first authentication character string initially generated by the authentication character string generation processing.

The character string determination unit 32 functions as an issued character string generation unit and a first updating unit by executing the process of S200, and functions as a generation storage unit by executing the process of S210.
<Input character string determination process>
Next, the input character string determination process executed by the character string determiner 32 included in the authenticator 3 will be described with reference to the flowchart of FIG. The input character string determination process is executed by inputting an input character string with the authenticator input key 31 and then inputting an authentication instruction.

In S300, the character string determination unit 32 acquires and stores the input character string input by the user using the authenticator input key 31. At this time, if the number of characters of the input character string is confirmed and if the number of characters corresponds to the date type, in the following process, the first authentication character string and the second authentication character related to the date type stored in the authentication character string area 3222 Use columns. If the number of characters corresponds to the date/time type, the first authentication character string and the second authentication character string related to the date/time type in the authentication character string area 3222 are used in the following process.

In S310, the character string determiner 32 extracts the specified character string from the input character string acquired in S300, and the extracted specified character string matches the second authentication character string stored in the authentication character string area 3222. Is determined.

When it is determined in S310 that the designated character string and the second authentication character string match, in S320, the character string determiner 32 determines that the authentication is successful, permits the operation of the controller 33, and ends the process.

When it is determined in S310 that the designated character string and the second authentication character string do not match, the process proceeds to S330.
In S330, the character string determination unit 32 determines whether or not the designated character string and the first authentication character string match.

When it is determined in S330 that the designated character string and the first authentication character string do not match, in S340, the character string determiner 32 determines that the authentication has failed, prohibits the operation of the controller 33, and ends the processing. To do.

When it is determined in S330 that the designated character string and the first authentication character string match, in S350, the character string determiner 32 causes the second authentication character string to be the same character string as the first authentication character string. Update.

The character string determiner 32 executes the process of S300 to serve as the character string acquisition unit and the additional character string storage unit, and the processes of S310 and S330 to perform the process of S350 as the authentication determination unit. This functions as the second updating unit.
<Change in authentication string over time>
FIG. 7 illustrates how the first authentication character string and the second authentication character string change in time series. Here, the date type authentication character string will be described. In this example, August 1 to August 7 is shown. The first authentication character string is updated every time the date changes. On the other hand, the second authentication character string is updated in the recognizer 3 each time the input character string matches the first authentication character string, and the same character string as the first authentication character string at the updated timing is the second authentication character string. It is set as a character string.

For example, regarding a room of a certain hotel, a character string for unlocking distributed to a customer who is permitted to use on 8/1, that is, a character string corresponding to 8/1 is set as an unlocking key KA, and similarly, 8 The unlocking character string distributed to the customer who is allowed to use on 1/2 is the unlocking key KB, and the unlocking character string distributed to the customer who is allowed to use on 8/4 is the unlocking key KC. To do. The customer to whom the unlocking key KA is distributed can use the room not only on 8/1 but also on 8/2 until the unlocking key KB is used. The customer to whom the unlocking key KB is distributed can use the room after that by using the unlocking key KB at an arbitrary timing of 8/2, and the unlocking key KA is also invalidated. Further, the room can be used with the same unlocking key KB for any number of days until the unlocking key KC of the customer who is permitted to use is used after the next day.

Although the date type has been described here, in the date and time type, the same operation is performed only by replacing the date delimiter with the time zone delimiter.
[1-3. effect]
According to the first embodiment described in detail above, the following effects are achieved.

(1a) According to the authentication system 1 of the present dismantlement, the issuing device 2 and the authenticator 3 generate the issuing character string and the authenticating character string by the same generating algorithm. Since the issuing character string and the authentication character string correspond to each other, the administrator centrally manages the authentication data of the authenticating device 3 by the issuing device 2 without requiring communication equipment between the issuing device 2 and the authenticating device 3. can do.

(1b) According to the authentication system 1 of the present embodiment, by combining the first authentication character string that changes every day and the second authentication character string that changes every time the first authentication character string is input, The second authentication character string can be continuously used until one authentication character string is input. As a result, when authentication is required across dates, for example, even when the same user uses the same room across dates, there is no need to issue a new character string each time the date changes, and the same character You can continue to use the queue. That is, since a plurality of keys are not required for unlocking, the risk of loss or forgetting can be reduced.

(1c) Since the issuing device 2 and the authentication device 3 generate a character string for authentication with the same generation rule using the date as seed data, when the issuing device 2 issues a new issue character string, It is not necessary to notify the authenticator 3 of the necessary seed data again. That is, since the issuing device 2 and the authentication device 3 do not need to be connected via a network or the like, the installation work can be easily performed.

(1d) According to the authentication system 1 of the present embodiment, the input character string is input to the additional character string area 6223 of the authentication device 3 each time the input character string is input, that is, each time the unlocking operation is performed. User recognition information, which is an additional character string extracted from, is recorded with time. Therefore, for example, even when a plurality of character strings (that is, unlocking keys) that can be used in the same date and time zone are issued by changing only the user recognition information, the information stored in the additional character string area 6223 and the issuing The user can be identified by checking the identification information table stored in the identification information area 2223 of the device 2.

[2. Second Embodiment]
[2-1. Differences from the first embodiment]
The second embodiment has the same basic configuration as that of the first embodiment, and therefore the differences will be described below. As shown in FIG. 8, the authentication system 4 in this embodiment includes an issuing device 5 and a plurality of authenticators 6. The same reference numerals as those in the first embodiment indicate the same configurations, and refer to the preceding description.

In the above-described first embodiment, the generated character strings are associated with the date and time zone in which the authentication device 3 permits the authentication, but in the present embodiment, the generated character strings are arranged in the order in which the generated character strings are issued for each authentication device 6. The difference is in the correspondence.
<Issuing device 5>
As shown in FIG. 8, the issuing device 5 of the second embodiment has the same basic configuration as the issuing device 2 of the first embodiment, but differs in the following points. That is, the information input via the issuing device input key 51 is partially different, and in this embodiment, the input of the authentication date and time is omitted. Further, the character string generation program stored in the management program area 5221 constituting the management device 52, that is, the content of the character string generation processing realized by the management CPU 221 executing the character string generation program is partially different. The contents of the character string generation process in the second embodiment will be described later.
<Authentication machine 6>
As shown in FIG. 8, the authenticator 6 of the second embodiment has the same basic configuration as the authenticator 3 of the first embodiment, but differs in the following points. That is, in the present embodiment, as shown in FIG. 9, only one set of the first authentication character string and the second authentication character string is stored in the authentication character area 6222 forming the character string determiner 62.

Further, the authentication character string generation program and the input character string determination program stored in the authentication program area 6221 constituting the character string determination unit 62, that is, the authentication character string generation realized by the authentication CPU 621 executing these programs. The contents of the processing and the input character string determination processing are different from those in the first embodiment. Details of the authentication character string generation processing and the input character string determination processing in the second embodiment will be described later.

[2-2. processing]
<Issuing character string generation process>
Next, the issuing character string generation process executed by the management device 52 provided in the issuing device 5 will be described with reference to FIG.

The issued character string generation process executed by the management device 52 is basically the same as the issued character string generation process executed by the management device 22 of the first embodiment, but is different in the following points.
In S100, the authentication device information and the user identification information are acquired.

In S110, as the seed data used when generating the management character string, the latest issue character string stored in the issue character string area 5222 for the authentication device specified from the authentication device information is used instead of the authentication permission date and time. To use. As a result, issue character strings corresponding to the order in which the character strings are issued for each authentication device 6 are generated.
<Authentication character string generation process>
The authentication character string generation process executed by the character string determiner 62 included in the authenticator 6 will be described with reference to FIG.

The authentication character string generation process executed by the character string determination unit 62 is basically the same as the authentication character string generation process executed by the character string determination unit 32 of the first embodiment, but the timing of executing this process. In addition, the following points are different.

In S200, the first authentication character string stored in the authentication character string area 6222 is used as the seed data used when generating the authentication character string, instead of the authentication permission date and time.
The timing of executing this process will be described later.
<Input character string determination process>
The input character string determination process executed by the character string determiner 62 included in the authenticator 6 will be described with reference to FIG.

The input character string determination process executed by the character string determination unit 62 is basically the same as the input character string determination process executed by the character string determination unit 32 of the first embodiment, but is different in the following points. ..
In S350, after updating the second authentication character string with the first authentication character string stored in the authentication character string area 6222, the above-described authentication character string generation processing is executed. As a result, the first authentication character string stored in the authentication character string area 6222 is also updated.
<Change in authentication string over time>
FIG. 10 illustrates how the first authentication character string and the second authentication character string change. Note that the first authentication character string and the second authentication character string are displayed in a vertical time series, and in this example, the users who have different issue character strings from the first person to the fourth person operate each other. Each change is shown. In the second embodiment, the issue character string/authentication character string corresponds to the order of issue/generation. Further, the first authentication character string is a character string in the order of one person after the second authentication character string, and the first authentication character string and the second authentication character string are updated at the same timing.

Further, the result when the user corresponding to each order performs the authentication operation is shown in the right column of FIG. That is, when the user's input character string includes one of the first authentication character string and the second authentication character string, the authentication is successful, and when the user's input character string includes one authentication character string, The 1st authentication character string and the 2nd authentication character string are updated.

[2-3. effect]
According to the second embodiment described in detail above, in addition to the effect (1a) of the first embodiment, the following effect is achieved.

(2a) According to the authentication system 4 of the second embodiment, the issue character string issued first is issued at the time when the issue character string issued later is used for unlocking, regardless of the date and time zone. Can be disabled.

[3. Other Embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments, and various modifications can be implemented.

(3a) In the second embodiment, the user identification information is used as the additional character string, but in this case, the authentication by the authentication character string is successful, and the user identification information permits the authentication in advance. When included in the person, the authentication may be permitted, and the controller may unlock the key. In this case, the authenticator pre-stores table data showing a list of character strings corresponding to users who are permitted to authenticate, and authenticates whether the input character string matches the character string shown in the table data. It may be determined whether or not to permit. The content of the additional character string is not limited to the user identification information. That is, the additional character string may use time zone information. The time zone information referred to here may represent a time zone in which the user is permitted to use, as an additional condition that the user can use. Also, in this case, if the authentication with the authentication character string is successful and the time when the authentication is performed is included in the time period in which the use corresponding to the additional character string is permitted, the authentication is permitted and the controller An operation such as unlocking the key may be performed. In this case, the authentication device stores in advance table data showing a list of character strings corresponding to the time period for which authentication is permitted, and performs authentication depending on whether the input character string matches the character string shown in the table data. It may be determined whether or not to permit. Furthermore, the table data indicating the user identification information and the time when the use associated with each user is permitted is stored in advance, and when the user identification information is input, the use corresponding to the user identification information is stored. If the time is included in the permitted time, the authentication may be permitted, and the controller may unlock the key. The process of performing the determination corresponds to the condition determination unit.

(3b) In each of the above embodiments, the authenticator performs the operation of unlocking the external lock on which the authenticator is installed, but the configuration of the authenticator and the external lock is not limited to this. .. That is, for example, the authentication device and the lock may be integrated. Further, in each of the above-mentioned embodiments, the external lock where the authenticator is installed is the lock of a hotel or condominium room, but the target where the authenticator is installed is not limited to this. That is, it may be installed in a locker, a safe or the like for which security is required.

(3c) Although the issuing device input key and the authenticator input key in each of the above embodiments are numeric keys, the forms of the issuing device input key and the authenticator input key are not limited to these. That is, for example, it may be a keyboard for inputting alphanumeric characters. In this case, the character string in each of the above embodiments may be composed of alphanumeric characters. Moreover, the input method is not limited to the form input by the issuer and the user. That is, the authentication operation may be performed, for example, by issuing an IC card in which the issue character string is recorded by the issuing device and holding the issued IC card over the authentication device. In addition, for example, the issuing device may further include a data transmitting unit, the issuing character string may be transmitted to the device having the IC function of the user, and the user holds the device over the authentication device to perform the authentication operation.

(3d) In each of the above embodiments, the character string determiner 32 acquires and stores the input character string input by the user using the authenticator input key 31, but the input stored by the character string determiner 32 is described. The character string is not limited to this. That is, only the input character string for which the authentication is permitted may be stored. Specifically, instead of S300 of the input character string determination process, the input character string may be stored when the authentication is permitted in S320. Further, the configuration may be stored in both steps of S300 and S320.

(3e) A plurality of functions of one constituent element in the above embodiment may be realized by a plurality of constituent elements, or one function of one constituent element may be realized by a plurality of constituent elements. .. Further, a plurality of functions of a plurality of constituent elements may be realized by one constituent element, or one function realized by a plurality of constituent elements may be realized by one constituent element. Moreover, you may omit a part of structure of the said embodiment. Further, at least a part of the configuration of the above-described embodiment may be added or replaced with the configuration of the other above-described embodiment. Note that all aspects included in the technical idea specified by the wording recited in the claims are embodiments of the present disclosure.

(3f) In addition to the issuing device and the authenticator described above, a system including the issuing device and the authenticator as components, a program for causing a computer to function as the issuing device and the authenticator, a semiconductor memory that records the program, and the like. The present disclosure can be implemented in various forms such as a non-transitional substantive recording medium, an issuing method, and authentication.

1, 4... Authentication system, 2, 5... Issuing device, 3, 6... Recognizer, 21, 51... Issuing device input key, 22, 52... Management device, 23, 53... Issuing device, 31, 61... Authentication device Input keys, 32, 62... Character string determination device, 33, 63... Control device, 221... Management CPU, 222, 522... Management memory, 321... Authentication CPU, 322, 622... Authentication memory, 2221, 5221... Management program area , 2222, 5222... Issued character string area, 2223... Identification information area, 3221, 6221... Authentication program area, 3222, 6222... Authentication character string area, 3223, 6223... Additional character string area.

Claims (8)

An authentication system including an authentication device and an issuing device,
The authenticator is
A character string generation unit configured to generate an authentication character string that is a character string used for authentication of the authentication device according to a predetermined generation rule using the date as seed data ,
A generation storage unit configured to store at least two of a first authentication character string and a second authentication character string, which are authentication character strings generated by the character string generation unit,
A character string acquisition unit configured to acquire an input character string that is a character string longer than the authentication character string input from the outside,
Among the input character strings, a designated character string having the same length as the authentication character string, which is a character string of a part designated in advance, is the first authentication character string and the first character string stored in the generation storage unit. An authentication determination unit configured to determine whether or not it matches one of the two authentication character strings;
An authentication permission unit configured to permit authentication when the authentication determination unit determines that the specified character string matches one of the first authentication character string and the second authentication character string. ,
When the preset update condition is satisfied, the character string generation unit is caused to generate the authentication character string, and the first authentication character string stored in the generation storage unit is updated by the generated authentication character string. A first updating section,
When the specified character string matches the first authentication character string stored in the generation storage unit, the first authentication character string is overwritten on the second authentication character string, thereby storing in the generation storage unit. A second updating unit configured to update the second authentication string
Equipped with
The issuing device is
A management generation unit configured to generate a management character string similar to the authentication character string, using date as seed data, according to a generation rule similar to the character string generation unit,
An additional character string adding unit configured to generate an issue character string including the management character string,
An authentication system comprising. The authentication system according to claim 1, wherein
The authentication system , wherein the update condition is that the second update unit updates the second authentication character string. The authentication system according to claim 1, wherein
The authentication system , wherein the update condition is that a preset time period ends. The authentication system according to claim 3,
The authentication system , wherein the time period is set to a length of 24 hours. The authentication system according to claim 3,
The authentication system , wherein the time zone is set by dividing one day into a plurality of times. The authentication system according to claim 1, wherein
The additional character string addition unit generates a character string including an additional character string that is a character string other than the specified character string, as the issuing character string,
The authentication system further includes an additional character string storage unit configured to store the additional character string in the input character string. The authentication system according to claim 6, wherein
The authentication device further comprises a condition determination unit configured to determine whether the additional character string satisfies a preset additional condition,
The authentication permission unit determines that the specified character string matches one of the first authentication character string and the second authentication character string by the authentication determination unit, and the condition determination unit performs the addition. An authentication system configured to allow authentication if it is determined that the string satisfies the additional conditions. The authentication system according to claim 7 , wherein
The additional character string includes a character string associated with a preset time zone,
The additional condition is that the time of performing the authentication is included in a preset time period associated with the character string included in the additional character string, the authentication system.