JP7760940B2 - Authentication system and authentication method - Google Patents

Description

The present invention relates to an authentication system and method that includes requesting authentication for access to a device and performing that authentication.

Regarding authentication, Patent Document 1 describes a password method in which user authentication is performed by converting values of input half-width characters using a character code table in which the characters are randomly arranged.
However, conventional authentication methods have the problem of insufficient security. In particular, if passwords are limited to half-width characters, the calculation time required to illegitimately identify a password tends to be short. This makes it difficult to ensure security.
Furthermore, if full-width characters are allowed in passwords to increase the number of characters that can be used to improve security, it can be difficult to determine whether a password is correct by comparing character codes, because there are multiple character codes assigned to full-width characters.

Japanese Patent Application Laid-Open No. 2007-310475

The present invention aims to provide an authentication system that makes it easy to increase security.

The authentication system according to the present invention comprises an input unit, an input data storage unit that at least temporarily stores input data input to the input unit, an input data imaging unit that generates input image data by imaging the input data stored in the input data storage unit, an original image data storage unit that stores original image data, and an image comparison unit that compares the input image data with the original image data.

The present invention provides an authentication system that makes it easy to increase security.

FIG. 1 is a diagram illustrating an overview of an authentication system. 1 is a diagram showing an overview of an authentication system, focusing on the internal configuration of an authentication device. FIG. 1 shows a flowchart describing the main steps of an authentication method.

An example of an embodiment of the present invention will now be described with reference to the accompanying drawings. Note that the same or equivalent parts in each drawing will be designated by the same reference numerals.

<Authentication system>
An overview of a general authentication system 10 will be described with reference to Fig. 1. Fig. 1 is a diagram showing an overview of the authentication system 10.
The authentication system 10 is a system that authenticates a user's access to an authentication target device 50. The authentication system 10 determines whether or not to grant authentication in response to an authentication request from a user.

<Devices subject to certification>
The authentication target device 50 is a device that must be authenticated in order to be accessed.
1 shows a file server 52 and a printer 54 as examples of the authentication target device 50. The file server 52 is a server used for, for example, a database.

<Authentication device>
The above authentication is performed by the authentication device 30.
The authentication device 30 is a device that determines whether or not to authenticate a user's access to the authentication target device 50 based on an input from the user.
1, a domain controller 301 is shown as an example of the authentication device 30. The domain controller 301 is also called an active directory.
The authentication device 30 and the authentication target device 50 are connected via, for example, an intranet, which will be described later.

<Authentication procedure>
The authentication procedure will be described with reference to FIG.
(1. Enter password)
A request for authentication from a user begins with the user entering a user ID and password.
This input is performed by the user inputting the user ID and password into the input unit 22. The input unit 22 is provided in the terminal device 20 used by the user.

(2. Determination of whether or not to approve certification)
The domain controller 301 compares the input user ID and password with the authentic user ID and password stored in the domain controller 301 to determine whether or not authentication is possible.
The authentic user ID and password refer to the correct user ID and password that serve as the basis for authentication.

(Character code comparison)
Traditionally, user IDs and passwords have been made up of half-width alphanumeric characters, because these characters correspond to a single character code.
Conventionally, the domain controller 301 compares the user ID and password by comparing their character codes. Specifically, if the character codes of the user ID and password entered by the user match the character codes of the authentic user ID and password stored in the domain controller 301, the domain controller 301 authenticates the user's access to the authentication target device 50.
Conversely, if the character codes do not match, the domain controller 301 does not authenticate the user's access to the authentication target device 50 .

(Image comparison)
In contrast to this, in the authentication system 10 of this embodiment, the above comparison is performed using images rather than character codes, as will be explained later.

(3. Authentication (Ticket Issuance))
When the domain controller 301 authenticates the user's access to the authentication target device 50, the domain controller 301 issues a ticket to the user. The ticket is a token of authentication.

(4. Ticket submission and 5. Access permission)
The user can receive access permission from the authentication target device 50 by submitting the received ticket to the authentication target device 50 .
"4. Submit ticket" and "5. Access permission" in FIG. 1 indicate access to the file server 52.
Access to the printer 54 is similar to access to the file server 52. "6. Submit ticket" and "7. Access permission" in FIG.
By submitting the ticket and receiving the access permission, the user is allowed to access the authentication target device 50 .

1, "3. Authentication (Ticket Issuance),""4. Ticket Submission,""5. Access Permission,""6. Ticket Submission," and "7. Access Permission" can be performed as processes that are transparent to the user. In other words, the user can access the authentication target device 50 without any special operation by the user.
This is because the domain controller 301 can notify the authentication target device 50 that the user's access has been authenticated.
For this reason, in Figure 1, the arrows indicating "3. Authentication (Ticket Issuance)", "4. Ticket Submission", "5. Access Granted", "6. Ticket Submission", and "7. Access Granted" are dotted lines instead of solid lines.

<Domain Controller>
Here, we will explain the reason why the domain controller 301 is used for authentication. As shown in Figure 1, the terminal device 20 used by a user is generally connected to the Internet 100. Therefore, the terminal device 20 is susceptible to infection by a virus V or to hacking H.
Therefore, a network separate from the Internet is constructed, such as an in-house intranet, and a domain controller 301 is placed in the constructed separate network.The domain controller 301 then authenticates user access.
This makes it possible to prevent the domain controller 301 from being infected with a virus V or being the victim of hacking H.
In addition, other devices connected to the intranet, such as file servers, can be prevented from being infected with a virus V or from falling victim to hacking H.
For the above reasons, the domain controller 301 is used for authentication.

<Authentication System of the Present Embodiment>
The authentication system 10 of this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an overview of the authentication system 10 of this embodiment.
The authentication system 10 of this embodiment differs from conventional authentication systems in the authentication method. In conventional authentication systems, authentication is performed by comparing character codes, as described above. In contrast, in the authentication system 10 of this embodiment, authentication is performed by comparing images. That is, "2. Determination of authentication feasibility" by the domain controller 301 shown in FIG. 1 is performed by comparing images, not by comparing character codes.

<Domain Controller>
The configuration of the domain controller 301 of this embodiment will be described below. The domain controller 301 includes various components that conventional domain controllers do not include in order to determine whether authentication is possible by comparing images.
That is, the domain controller 301 includes an input data holding unit 32, an input data imaging unit 34, an original image data storage unit 36, an image comparison unit 38, and an authentication unit 40. Each of these will be described in order below.

<Input data storage unit>
The input data entered by each user is transmitted from terminal device 20 to input data storage unit 32 .
The input data holding unit 32 is a part that holds input data at least temporarily.
The input data is stored in the input data storage unit 32 in the format of the character code corresponding to the characters, etc., input by the user. For example, if the characters input by the user are hiragana characters, the data is stored in the format of a character code corresponding to the settings of the terminal device 20, such as UTF-8, Shift JIS, EUC JP, etc. Similarly, if the characters input by the user are kanji characters, the data is stored in the format of a character code corresponding to the settings of the terminal device 20, such as UTF-8.

<Input data imaging unit>
The input data imaging unit 34 is a part that images the input data input by the user.
The input data imaging unit 34 acquires input data from the input data holding unit 32. Then, the input data in character code format is imaged to generate input image data. The input image data is data in image format.

<Original image data storage unit>
The original image data storage unit 36 is a part that stores image data of the original password.
The image data of the original may be referred to as the original image data.
The original image data is image data that is compared with the input image data when determining whether or not authentication is possible.
The original image data storage unit 36 stores the original password for each user ID as original image data. The original image data is stored in the original image data storage unit 36 in advance.

<Image comparison section>
The image comparison unit 38 is a part that compares the input image data with the original image data.
The image comparison unit 38 acquires the input image data from the input data imaging unit 34. The image comparison unit 38 also reads out the original image data from the original image data storage unit 36. The image comparison unit 38 then compares the input image data with the original image data and determines whether the input image data matches the original image data.
The result of the determination is then output to the authentication unit 40 .

<Authentication Department>
The authentication unit 40 is a part that authenticates a user's access to the authentication target device 50 and permits the user to access the authentication target device 50 .
If the image comparison unit 38 determines that the input image data matches the original image data, the authentication unit 40 authenticates the user's access to the authentication target device 50 and allows the user to access the authentication target device 50.

<Effects>
(Security)
In the authentication system 10 of this embodiment, the possibility of authentication is determined by comparing images, thereby improving security.
When comparing character codes, there is a risk that the password may be discovered if the calculation takes a long time. In particular, if the characters that can be used in passwords are limited to half-width characters, the calculation time required to illegally find the password tends to be short, making it difficult to ensure security.
In contrast, when determining whether or not to authenticate someone by comparing images, even if it were possible to illicitly find a password by calculation, it would take so much time that it would be virtually impossible. Therefore, the authentication system 10 of this embodiment can dramatically improve security.

(Authentication Process)
When determining whether or not to authenticate by comparing character codes, it is necessary to check each time authentication is performed that the type of character code used when storing the original password matches the type of character code used when entering the password to request authentication.
If the character encoding used does not match, an accurate determination of whether authentication is possible cannot be made, because the character encoding used can change depending on the settings of the device used for input.
In contrast, the authentication system 10 of this embodiment determines whether authentication is possible by comparing images, which eliminates the need to check whether the character code types match each time authentication is performed, simplifying the authentication process.

(Convenience)
In the authentication system 10 of this embodiment, whether or not authentication is possible is determined by comparing images, which makes it easy to use full-width characters such as hiragana, katakana, and kanji characters in passwords.
Full-width characters generally have multiple corresponding character codes. As mentioned above, when determining whether to authenticate by comparing character codes, the character codes used in the original and the input at the time of authentication must match.
Therefore, if a password contains characters that correspond to multiple character codes, determining whether or not to authenticate becomes extremely complicated. For this reason, it has traditionally been unacceptable to use full-width characters in passwords.
In contrast, the authentication system 10 of this embodiment determines whether or not authentication is possible by comparing images, so that it is possible to determine whether or not authentication is possible without being aware of the character code of the input characters.
This allows full-width characters such as hiragana, katakana, and kanji characters to be used in passwords, improving user convenience.
In addition, the number of characters that can be used will increase, further improving security.

Specifically, as shown in the password entered by user A in FIG. 2, a password that contains a mixture of half-width alphanumeric characters and full-width hiragana or kanji characters can be accepted.
Also, as shown in the password entered by user B in FIG. 2, a password consisting only of full-width hiragana and kanji characters can be allowed.

<Authentication method>
The authentication method of this embodiment will be described with reference to Fig. 3. Fig. 3 is a flowchart showing an outline of the authentication method of this embodiment.

S1:
In step S1, the user requests authentication of the authentication device 30 when accessing the authentication target device 50. Specifically, the user inputs a password into the input unit 22. This step starts the authentication method of this embodiment.

S2:
In step S2, the input data holding unit 32 holds the password data input to the input unit 22, that is, the input data. The format of the held data is the character code format for the input characters.

S3:
In step S3, the input data imaging unit 34 acquires the input data from the input data holding unit 32 and images the input data. That is, in step S3, the data format is changed from the character code format to the image format.

S4:
In step S4, the original image data storage unit 36 stores the original image data.
This step is preferably performed before the authentication method starts, i.e., the original image data storage unit 36 preferably stores the original image data before the authentication request is made in step S1.

S5:
In step S5, the image comparison unit 38 acquires the input image data from the input data imaging unit 34. The image comparison unit 38 also reads out the original image data from the original image data storage unit 36.
Then, the input image data is compared with the original image data by comparing the images.

(In case of image mismatch)
If the comparison shows that the input image data and the original image data do not match, the authentication method ends and the user is not authenticated.
(Image match)
If the comparison shows that the input image data and the original image data match, the process proceeds to step S6.

S6:
In step S6, the access is authenticated by the authentication unit 40. The authentication unit 40 also transmits a notification to the authentication target device 50 that the access has been authenticated.

S7:
In step S7, the authentication target device 50 receives a notification from the authentication unit 40 that the access has been authenticated.

S8:
In step S8, the authentication target device 50 issues an access permission to the terminal device 20.

S9:
In step S9, the terminal device 20 receives an access permission from the authentication target device 50. This allows the terminal device 20 to access the authentication target device 50.
At this step, the authentication method of this embodiment ends.

<Other configurations>
Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and various changes and modifications are possible.
(Input target)
For example, in the above description, a password is used as an example for authentication. As with the password example, the authenticity of a user ID can also be determined by comparing images.

(Character type)
The characters described above include half-width characters such as alphanumeric characters, and full-width characters such as hiragana, katakana, and kanji characters. The types of characters are not limited to these, and any characters that can be input from the input unit 22, such as symbols and pictograms, can be used.

(Input section)
The input unit 22 may be a keyboard, but is not limited to a keyboard. For example, it may be a touchpad.

(Authentication device)
Also, the configuration has been described in which the domain controller 301 is used as the authentication device 30. The input data imaging unit 34 and the like provided in the domain controller 301 may be provided in the terminal device 20.

(Creating original image data)
The configuration in which the input data imaging unit 34 images the input data has also been described. The input data imaging unit 34 can also be used when generating authentic image data. For example, input data for an authentic password is input to the input data imaging unit 34. The input data imaging unit 34 images the input data and generates authentic image data. The generated authentic image data can then be stored in the authentic image data storage unit 36.

(Purpose of use)
Furthermore, the purpose of use of the authentication system 10 and authentication method of this embodiment is not limited to authenticating access to a file server or printer via a domain controller. For example, to protect data created by application software, the created data may be encrypted or a password may be attached to the created data. In these cases, the authentication system 10 and authentication method of this embodiment can also be used to authenticate access to the created data.

10 Authentication system 20 Terminal device 22 Input unit 30 Authentication device 301 Domain controller 32 Input data storage unit 34 Input data imaging unit 36 Original image data storage unit 38 Image comparison unit 40 Authentication unit 50 Device to be authenticated 52 File server 54 Printer 100 Internet A User V Virus H Hacking

Claims (4)

an input unit;
an input data storage unit that at least temporarily stores input data input to the input unit;
an input data imaging unit that generates input image data by imaging the input data held in the input data holding unit;
an original image data storage unit that stores original image data;
an image comparison unit that compares the input image data with the original image data ,
a terminal device including the input unit;
an authentication unit;
an authentication target device connected to the authentication unit,
the authentication unit, when the image comparison unit determines that the input image data and the original image data match, authenticates the access of the terminal device to the authentication target device;
the input data is a password for requesting authentication for the terminal device to access the authentication target device,
The input data includes at least one character selected from the group consisting of hiragana characters, katakana characters, and kanji characters.
Authentication system. the input data holding unit, the input data imaging unit, the original image data storage unit, the image comparison unit, and the authentication unit are provided in a device different from the terminal device;
The authentication system of claim 1 . The device different from the terminal device is a domain controller,
The authentication target device is at least one of a plurality of devices including a file server or a printer.
The authentication system of claim 2 . inputting data to request authorization for access to the device;
imaging the input data;
comparing the imaged data with authentic image data;
and authorizing access to the device if the imaged data matches the original image data ;
The input data is a password for requesting authentication for access to the device,
The input data includes at least one character selected from the group consisting of hiragana characters, katakana characters, and kanji characters.
Authentication method.