JP2012181645A - Authentication server, authentication program, and authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication server that employs a two-dimensional code, thereby reducing time and effort of inputting a password and providing an authentication method having a higher level of security strength.SOLUTION: An authentication server (1) which is connected to an input display device (2) and a two-dimensional code reading device (3) via a network (4) and performs user authentication, carries out the steps of: imaging, on the screen of the input display device, each of a user two-dimensional code which is obtained by dividing secrecy data relating to a user into a predetermined number (m) of pieces and converting them into a two-dimensional code, and a dummy two-dimensional code which is obtained by dividing at least one row of random numbers into a predetermined number (m) of pieces for each of the row of random numbers and converting them into a two-dimensional code; arranging symbols of the plurality of two-dimensional codes at locations specified by an arrangement instruction; receiving, from the two-dimensional code reading device, connection information in which the plurality of two-dimensional code symbols arranged on the input display device screen are connected; and performing the user authentication by determining whether the received connection information matches the secrecy data.

Description

  The present invention relates to an authentication server, an authentication program, and an authentication system, and in particular, an authentication server that performs user authentication, an input display device that is communicably connected to the authentication server, and a two-dimensional code reader that is communicably connected to the authentication server. And an authentication system.

Currently, with the era of cooperation between broadcasting and communication, various services using communication are also demanded in the broadcasting field. Under these circumstances, services for individuals using communication via television are being studied. In order to provide this personal service, it is necessary for the television itself to change the internal settings in accordance with the user who uses the television, that is, the television needs to change to a style that is specific to each user. Therefore, in order to provide a personal service, an authentication technique for identifying a user is necessary.
As an authentication technique that is widely used at present, there is an authentication method that uses both an ID (IDentification) and a password for identifying a user.

The matrix authentication method of Patent Document 1 is one of authentication methods using an ID and a password. The password associated with the user ID and stored on the authentication server side is information that should be kept secret and information that the user should remember. The matrix authentication method of Patent Document 1 aims to make it easy for a user to remember this password (information to be kept secret) and to ensure high security strength (safety).
In this matrix authentication method of Patent Document 1, (1) the user registers in advance in the authentication server the secret table (the reading order of each column) as the secret information (password). (2) The user reads and memorizes the numbers in the random number table presented at the time of authentication using a previously registered reading method. (3) The user inputs a memorized number and transmits this number string to the authentication server as an input password. (4) The authentication server reads the numeric string (input password) transmitted from the user and the numeric string (judgment password) as a result of reading the presented random number table with the confidential information (the random number table reading method) registered with the user. ) Is authenticated.

In the matrix authentication method of Patent Document 1, in the procedure of (2), for example, the whole random number table can be visually remembered, for example, by reading the letter V, so it is more intuitive than a general password input method. I can remember.
Further, in the matrix authentication method of Patent Document 1, since a user learns how to read a random number table, a numeric string can be used as a one-time password. In other words, the random number table used for authentication is changed every time, and each random number table can be used only once for authentication, so even if the number sequence entered by the user in step (3) is stolen. However, the number string will not be valid as an input password next time. Therefore, high security strength can be ensured. In addition, even if the random number table presented at the same time is stolen at the same time, the random number table has the same numbers in several fields, so the random number table reading method (which is not necessarily confidential information) from the numeric string input by the user ( Reading order) is not known.

Patent No. 4090251 JP 2010-61468 A

  However, in the matrix authentication method of Patent Document 1, it is expected that a numeric string having a length of about 10 to 20 digits is used as the input password for the convenience of manual input by the user in the procedure (3). With such a long string of characters (input password), the risk that the password, which is confidential information (reading method of random number table) pre-registered in the authentication server, is stolen when the authentication server is subjected to an exhaustive search attack There is a problem that is high.

  In addition, when increasing the length of a numeric string (input password) in order to increase the security strength, not only is the user's effort increased, but in the input process of the numeric string, the user looks at the random number table and looks at the specific position. There is also a problem that the probability of human errors such as reading errors and memory errors increases because it involves the movement of the line of sight of temporarily remembering numbers and entering numbers in the input field.

  The present invention has been made in view of the above-described problems. By using a two-dimensional code such as a QR code (registered trademark), it is possible to reduce the time and effort of inputting a password as compared with the conventional matrix authentication method. In addition, an object is to provide an authentication server, an authentication program, and an authentication system having an authentication method with a higher security strength.

  In order to solve the above-described problem, the authentication server according to claim 1 of the present invention images a plurality of two-dimensional codes, arranges the two-dimensional code symbols according to the arrangement instruction, and displays them on the screen. And a plurality of the two-dimensional code symbols arranged on the screen are operated by a user to read a predetermined number (m), and link information including the predetermined number (m) of read data is generated. A plurality of two-dimensional codes connected to a two-dimensional code reading device via a network and based on a user ID received from the display device and arrangement instruction data indicating their arrangement positions are transmitted to the display device. , An authentication server for performing user authentication using the connection information received from the two-dimensional code reader, a storage means, a random number generation means, a secondary It comprises a code generating means, and the two-dimensional code arrangement specifying means, and the two-dimensional code output means, and authentication means.

According to this configuration, the authentication server associates, in the storage unit, a user ID for identifying a user, a reading pattern indicating the arrangement position of the two-dimensional code symbol, and a secret code that is different for each user ID in advance. The stored random number is generated by random number generation means. Then, the two-dimensional code generation means divides the secret code stored in the storage means corresponding to the user ID transmitted from the display device into the predetermined number (m) and Encoding, generating the predetermined number (m) of user two-dimensional codes, obtaining random numbers from the random number generating means to generate at least one random number sequence, and generating the random number sequence for each random number sequence The predetermined number (m) is divided into two-dimensional codes, and dummy two-dimensional codes are generated by multiplying the number of columns of the generated random number sequence by the predetermined number (m). Subsequently, the reading pattern based on the user ID transmitted from the display device is acquired from the storage unit by a two-dimensional code arrangement designation unit, and the user two-dimensional code is arranged along the arrangement position indicated by the reading pattern. The placement instruction data including an instruction to place each code and an instruction to place each dummy two-dimensional code at a position other than the placement position is generated. Further, the predetermined number (m) of user two-dimensional codes and the number of columns of the generated random number sequence multiplied by the predetermined number (m) are included by the two-dimensional code output means. The plurality of two-dimensional codes and the arrangement instruction data are transmitted to the display device. Next, the authentication unit performs user authentication based on whether or not there is a secret code stored in the storage unit that matches the connection information transmitted from the two-dimensional code reader.
As a result, if the user operates the two-dimensional code reader and does not read each of the m two-dimensional code symbols at the correct position (the same as the arrangement position stored in the storage means), the transmission is performed from the two-dimensional code reader. The connection information obtained by connecting the read data is different in data from the data (secret data) before being two-dimensionally encoded in the authentication server. Therefore, user authentication is NG in the authentication means of the authentication server. On the other hand, since each of the m two-dimensional codes is read at a correct position, the connection information matches the data (secret data) before being two-dimensionally encoded in the authentication server. Becomes OK.

  The authentication server according to claim 2 is the authentication server according to claim 1, wherein the two-dimensional code generation means divides the secret code into the predetermined number (m) before the secret code. And encryption means for encrypting the random number sequence by the predetermined encryption method before dividing the random number sequence into the predetermined number (m) for each random number sequence. The authentication unit further includes a concatenated information decrypting unit that decrypts the concatenated information transmitted from the two-dimensional code reader using a decryption method corresponding to the predetermined encryption method.

  As a result, the authentication server encrypts the secret data to be transmitted to the display device, and then divides the secret data into m pieces to form a two-dimensional code. That is, the encrypted secret data is transmitted to the display device. The concatenated information obtained by reading each of the m two-dimensional code symbols at the correct position by the two-dimensional code reader is encrypted secret data. The encrypted secret data is transmitted to the authentication server.

  The authentication server according to claim 3 further comprises time output means for outputting the current time in the authentication server according to claim 2, and the time information acquired from the time output means by the encryption means. The secret code is encrypted, and the authentication means separates the time information and the secret data from the concatenated information decrypted by the concatenated information decryption means, and the current time from the time output means And performing first user authentication as to whether or not the time from the time of the separated time information to the current time is within a predetermined time, and a secret code that matches the separated secret data is Two-step authentication means for performing second user authentication as to whether or not it is stored in the user DB.

  According to this configuration, the authentication server performs time authentication based on the time when the two-dimensional code is transmitted to the display device (time of the time information) and the time when the connection information is received from the two-dimensional code reader (current time). . If the time from the time of the time information to the current time exceeds a predetermined time, the authentication is NG.

  The authentication server according to claim 4 is the authentication server according to any one of claims 1 to 3, wherein the two-dimensional code arrangement specifying means includes the user two-dimensional code and the dummy second. An instruction to arrange the dimension code in a two-dimensional matrix is added to the arrangement instruction data.

  According to such a configuration, since the instruction to arrange the user two-dimensional code and the dummy two-dimensional code in a two-dimensional matrix is transmitted to the display device, the predetermined number (m) of user two-dimensional codes are displayed on the screen of the display device. A plurality of two-dimensional codes including the code and the predetermined number (m) of dummy two-dimensional codes are displayed in a two-dimensional matrix.

  Further, the authentication server according to claim 5 is the authentication server according to any one of claims 1 to 4, wherein the two-dimensional code arrangement designating unit is configured such that the user two-dimensional code or the dummy second An instruction to duplicate the dimension code and place the duplicated duplicate user two-dimensional code or duplicate dummy two-dimensional code at a position other than the arrangement position is added to the arrangement instruction data.

  According to such a configuration, since the user two-dimensional code is duplicated and a plurality of user two-dimensional codes are displayed on one screen, a plurality of “reading patterns” can be apparently produced. However, all of the user ID, the two-dimensional code, the arrangement position of the two-dimensional code symbol (which is an image of the two-dimensional code), and the connection information transmitted from the two-dimensional code reader to the authentication server are all wiretapped. Even if the user is stolen, it is difficult to uniquely identify the “read pattern” corresponding to the user ID, so that the security strength can be further increased.

  Further, the authentication server according to claim 6 is the authentication server according to any one of claims 1 to 5, wherein the two-dimensional code arrangement designating means includes one piece per screen display. An instruction to arrange the user two-dimensional code and at least one dummy two-dimensional code and an instruction to perform the predetermined number (m) of screen transitions are added to the arrangement instruction data.

  According to this configuration, the display device that has received the arrangement instruction data generates as many screens (m screens) as the number of screen transitions, and one user two-dimensional code and at least one dummy two for each screen. The dimension code is arranged and displayed. Thereby, the number of two-dimensional code symbols displayed on one screen can be reduced.

  The user authentication program according to claim 7 is arranged on the screen, a display device that images each of the plurality of two-dimensional codes and arranges the two-dimensional code symbols according to the arrangement instruction and displays them on the screen. A two-dimensional code reader and a network for reading a predetermined number (m) of a plurality of the two-dimensional code symbols operated by a user and generating concatenated information including the predetermined number (m) of read data. The plurality of two-dimensional codes related to the user and arrangement instruction data indicating their arrangement positions are transmitted to the display apparatus based on the user ID received from the display apparatus, and from the two-dimensional code reading apparatus. In order to perform user authentication using the received connection information, a communication means for transmitting and receiving data, a user ID for identifying the user, A computer of an authentication server provided with a storage unit that stores in advance a correspondence between a reading pattern indicating an arrangement position of a two-dimensional code symbol and a secret code that is different for each user ID, a random number generation unit, an encryption unit, a two-dimensional It functions as a code generation means, a two-dimensional code arrangement designation means, a two-dimensional code output means, and an authentication means.

  According to this configuration, the user authentication program generates a random number by the random number generation unit, and the secret code stored in the storage unit in association with the user ID transmitted from the display device by the encryption unit. Is obtained from the storage means, the secret code is encrypted by a predetermined encryption method to generate encrypted user data, and a random number is obtained from the random number generation means to generate at least one random number sequence, The random number sequence is encrypted by the predetermined encryption method for each random number sequence to generate encrypted dummy data. The two-dimensional code generation means divides the encrypted user data into the predetermined number (m) and converts them into two-dimensional codes to generate the predetermined number (m) of user two-dimensional codes, and the encryption The dummy dummy data is divided into the predetermined number (m), each of which is converted into a two-dimensional code, and the number of dummy two-dimensional codes obtained by multiplying the number of columns of the generated random number sequence by the predetermined number (m). Generate. Subsequently, the reading pattern based on the user ID transmitted from the display device is acquired from the storage unit by a two-dimensional code arrangement designation unit, and the user two-dimensional code is arranged along the arrangement position indicated by the reading pattern. The placement instruction data including an instruction to place each code and an instruction to place each dummy two-dimensional code at a position other than the placement position is generated. Further, the predetermined number (m) of user two-dimensional codes and the number of columns of the generated random number sequence multiplied by the predetermined number (m) are included by the two-dimensional code output means. The plurality of two-dimensional codes and the arrangement instruction data are transmitted to the display device to the communication unit. Next, the storage means that acquires the secret data by decrypting the concatenation information transmitted from the two-dimensional code reading device by the decryption method corresponding to the predetermined encryption method by the authentication means, and matches the secret data Whether or not the user authentication is successful is determined by whether or not there is a secret code stored in.

  An authentication system according to claim 8 is an authentication system including an authentication server for performing user authentication, an input display device for displaying an image on a screen, and a two-dimensional code reading device. An input means, a communication means, and a display means, the two-dimensional code reader comprises an operation means, a connection information generation means, and a transmission means, and the authentication server comprises a communication means and a storage means. And a random number generation means, an encryption means, a two-dimensional code generation means, a two-dimensional code arrangement designation means, a two-dimensional code output means, and an authentication means.

According to such a configuration, in the authentication system, the input display device transmits / receives data to / from the authentication server by the communication unit, in which the user ID is input from the user by the input unit, and the two-dimensional code is displayed by the display unit. Is converted into a two-dimensional code symbol, and a plurality of the two-dimensional code symbols are arranged and displayed on the screen in accordance with the arrangement instruction.
In the authentication system, the two-dimensional code reading device receives an operation from the user by an operation unit, and is operated by the user by the two-dimensional code reading unit and displayed on the screen of the input display device. A two-dimensional code symbol is read to obtain a predetermined number (m) of read data. Then, the connection information generating means concatenates the predetermined number (m) of the read data to generate connection information, and the transmission means transmits the data to the authentication server.

  Further, in the authentication system, the authentication server has three types of storage means: a user ID for identifying the user, a reading pattern indicating an arrangement position of the two-dimensional code symbol, and a secret code that is different for each user ID. Are stored in advance in association with each other. Further, the communication means transmits / receives data to / from the input display device and receives data from the two-dimensional code reader. Then, a random number is generated by the random number generation means, and the secret code stored in the storage means corresponding to the user ID transmitted from the input display device is acquired by the encryption means. To generate encrypted user data, obtain a random number from the random number generation means to generate at least one random number sequence, and the random number sequence for each random number sequence Encrypted with a predetermined encryption method to generate encrypted dummy data. Then, by the two-dimensional code generation means, the encrypted user data is divided into the predetermined number (m), each of which is converted into a two-dimensional code, and the predetermined number (m) of the user data for each encrypted dummy data. A dimensional code is generated, and the encrypted dummy data is divided into the predetermined number (m), each of which is two-dimensionally encoded, and the predetermined number (m) is added to the number of columns of the generated random number sequence. Generate a dummy two-dimensional code of the multiplied number. Subsequently, the reading pattern based on the user ID transmitted from the input display device is acquired from the storage unit by a two-dimensional code arrangement specifying unit, and the user two-dimensional code is arranged along the arrangement position of the reading pattern. Arrangement instruction data including an instruction to arrange each and an instruction to arrange each dummy two-dimensional code at a position other than the arrangement position is generated. Further, the predetermined number (m) of user two-dimensional codes and the number of columns of the generated random number sequence multiplied by the predetermined number (m) are included by the two-dimensional code output means. The plurality of two-dimensional codes and the arrangement instruction data are transmitted to the input display device. Next, the storage means that acquires the secret data by decrypting the concatenation information transmitted from the two-dimensional code reading device by the decryption method corresponding to the predetermined encryption method by the authentication means, and matches the secret data Whether or not the user authentication is successful is determined by whether or not there is a secret code stored in.

  The authentication system according to claim 9 is the authentication system according to claim 8, wherein the input display device includes a second display unit and a read pattern acquisition unit, and the authentication server includes a secret code. A generation unit and a user registration unit are provided.

According to such a configuration, in the authentication system, the input display device arranges a plurality of pseudo two-dimensional code symbols by the display unit and displays them on the screen in a selectable manner, and by the user by the reading pattern acquisition unit. By selecting a predetermined number (m) of the pseudo two-dimensional code symbols via the input means, the predetermined number (m) of arrangement positions of the pseudo two-dimensional code symbols are acquired as a read pattern.
In the authentication system, the authentication server acquires the user ID and the reading pattern transmitted from the input display device by a secret code generation unit, generates a secret code including them, and by a user registration unit, The user ID, the reading pattern, and the secret code are associated with each other and stored in the storage unit.

The present invention has the following excellent effects.
According to the invention of claim 1, claim 7 or claim 8, the secret data to be authenticated is two-dimensionally encoded. Since data up to several Kbytes can be input to this two-dimensional code, secret data of m × 100 digits or more can be used as a password by dividing the secret data into m pieces and converting it into a two-dimensional code. Can be high.
According to such a configuration, since the user only has to remember the correct positions of each of the m two-dimensional code symbols to be read, the labor of inputting a password is reduced and a human error such as a memory error occurs. Probability can be reduced.

  Further, for example, by using a mobile phone equipped with a CCD (Charge Coupled Device) camera in the two-dimensional code reader, the user can photograph each two-dimensional code symbol displayed on the screen of the mobile phone with one click. (Read). In this operation, since the user does not move the line of sight from the screen of the mobile phone, it is possible to reduce the probability that a human error such as a reading error or a memory error will occur.

  According to the invention described in claim 2, since the secret code is encrypted, the encrypted secret data is transmitted / received on the network. Thereby, an authentication server with high security strength can be provided.

  According to the invention described in claim 3, since the authentication server performs time authentication, the two-dimensional code transmitted to the display device can be used as a one-time password with an expiration date, and the security strength can be increased.

  According to the fourth aspect of the present invention, since a plurality of two-dimensional code symbols are displayed in a two-dimensional matrix form on the screen of the display device, the user can select the correct position (the same as the arrangement position stored in the storage means). ) To learn visually. Therefore, it is possible to reduce the trouble of inputting the password to the user and reduce the probability that a human error such as a difference in memory occurs.

  According to the fifth aspect of the present invention, a plurality of “reading patterns” can be apparently generated, but the user ID, the two-dimensional code, the arrangement position of the two-dimensional code symbol (which is an image of the two-dimensional code), two Even if all of the link information transmitted from the dimension code reader to the authentication server is stolen by eavesdropping or the like, the “reading pattern” corresponding to the user ID cannot be uniquely identified. Can be further enhanced.

  According to the sixth aspect of the present invention, since one is arranged for each screen display, the number of two-dimensional code symbols displayed on one screen can be reduced. Thereby, the size of the matrix can be reduced, and thereby a display space can be obtained, so that the two-dimensional code symbol can be easily read. Then, it is possible to relieve the display space and the usability restrictions caused by the display space.

It is a figure which shows the authentication system which concerns on 1st Embodiment. It is a block diagram of the authentication server which concerns on 1st Embodiment. It is a figure which shows an example of the two-dimensional code symbol arranged and displayed on the input display apparatus which concerns on 1st Embodiment. It is a figure which shows an example of the data memorize | stored in user DB of the authentication server which concerns on 1st Embodiment. (A) User data [Du], (b) Encrypted user data [cDu], (c) Encrypted user data with address [URL * cDu], (d) Divided data [div * u], (e) Specific It is a figure which shows the divided data [div * u] to which the character string [&] of (2) was given, and (f) user two-dimensional code [QR * u]. 6 is a time chart of a user registration processing operation performed between the input display device and the authentication server in the authentication system according to the first embodiment. It is a flowchart of the two-dimensional code arrangement | positioning processing operation of the authentication server which concerns on 1st Embodiment. It is a flowchart of the two-dimensional code arrangement | positioning processing operation of the authentication server which concerns on 1st Embodiment following FIG. It is a flowchart of a user authentication execution processing operation of the authentication server according to the first embodiment. It is a block diagram of the authentication server which concerns on 2nd Embodiment.

<< First Embodiment >>
Next, the first embodiment will be described in detail with reference to the drawings as appropriate. Each figure is only schematically showing the present invention. Therefore, the present invention is not limited to the illustrated example. Moreover, in each figure, the same code | symbol is attached | subjected about the common component and the same component, and those overlapping description is abbreviate | omitted.

1. System Configuration As shown in FIG. 1, the authentication system 100 includes an authentication server 1, an input display device 2, a two-dimensional code reader device 3 with a communication function, and a network 4 that connects them in a communicable manner. Has been. In the present embodiment, a QR code (registered trademark) is adopted as a two-dimensional code.

(Authentication server 1)
The authentication server 1 generates a plurality of two-dimensional codes by dividing a series of data for performing user authentication, and transmits (outputs) the generated plurality of two-dimensional codes and their arrangement positions to the input display device 2. And a function of performing user authentication based on connection information obtained by connecting (reading) the read two-dimensional code (read data) received from the two-dimensional code reader 3.
Although details will be described later, the authentication server 1 includes a communication input / output unit 10 that is communicably connected to the input display device 2 and the two-dimensional code reader 3, a storage unit 20 that stores data, and a registration that performs user registration processing. Means 30; two-dimensional code generation / arrangement means 40 for generating and arranging a two-dimensional code from information relating to the registered user; and authentication means 50 for performing user authentication.

(Input display device 2)
The input display device 2 converts the two-dimensional code into a two-dimensional code symbol so that the two-dimensional code reader 3 can read the image and can visually recognize the two-dimensional code symbol. An apparatus comprising means (display means) for displaying and displaying dimension code symbols on a screen, means for inputting data from a user (input means), and means for transmitting / receiving data to / from the authentication server 1 (communication means) It is. Details will be described later.
The input display device 2 includes an arithmetic device such as a CPU (Central Processing Unit), a storage device such as a memory and a hard disk, an input device that detects input of information from the outside such as a mouse and a keyboard, and various types of external information. The computer includes an interface device that transmits and receives data, a display device such as an LCD (Liquid Crystal Display), and a program installed in the computer.

The input display device 2 displays a user registration screen or a user authentication screen in accordance with an instruction input from the user.
<User registration screen>
The input display device 2 displays a user registration screen, prompts the user ID to be input, and causes the user ID to be input.
Next, the input display device 2 displays n × m pseudo two-dimensional code symbol buttons (pseudo buttons) arranged in n rows and m columns on the screen, and the position of the pressed button (read pattern) is a password. The user is notified of this and urges the user to press a predetermined number (m) of buttons in accordance with a predetermined rule. Here, the fact that the buttons of the pseudo two-dimensional code symbol are arranged and displayed in n rows and m columns is stored in advance as pseudo button arrangement position information in a storage unit (not shown) included in the input display device 2. Here, the pseudo button arrangement position information is information related to the arrangement position information generated by the two-dimensional code arrangement designation unit 45 described later, and n × m pseudo buttons are arranged in a matrix of n rows and m columns. Information.

For example, as shown in FIG. 3, pseudo two-dimensional code symbol buttons (pseudo buttons) are arranged and displayed on the screen of the input display device 2 in a 4 × 4 matrix. Here, the predetermined rule is to select one pseudo button from each column. According to the user performing user registration, the first row of the first column (column A), the third row of the second column (column B), the fourth row of the third column (column C), the first row When the pseudo button in the first row of the fourth column (D column) is selected, the two-dimensional code reading pattern input unit 13 acquires (1, 3, 4, 1) as the reading pattern.
Then, the input display device 2 transmits a user registration request to the authentication server 1 with the input user ID and the read pattern. As a result, the reading pattern is input to the authentication server 1.

<User authentication screen>
The input display device 2 displays a user authentication screen to prompt input of a user ID, and transmits a user authentication request to the authentication server 1 together with the input user ID.
Thereafter, as will be described later, the input display device 2 sends “n × m two-dimensional codes [QR]” and “two-dimensional code symbol arrangement position information” from the authentication server 1 (two-dimensional code generation / arrangement means 40). Receive. Here, [] is a code and indicates that the name with the code is a data string.
Then, the input display device 2 is arranged so that “n × m pieces” along the “two-dimensional code symbol arrangement position information” so that the two-dimensional code reader 3 can read and the user can visually recognize the input display device 2. The two-dimensional code [QR] is arranged on the screen.
Thereby, as shown in FIG. 3, two-dimensional code symbols (QR code (registered trademark)) are arranged and displayed on the screen of the input display device 2.

Here, the description returns to FIG.
(Two-dimensional code reader 3)
The two-dimensional code reader 3 is a means operated by the user (operation means) and a means (reading the two-dimensional code by reading the two-dimensional code symbol displayed on the input display device 2 to obtain the read data) Two-dimensional code reading means), means for connecting the read data obtained by decoding each two-dimensional code to generate linked read data (link information), and a destination (authentication server) from the linked read data 1) an apparatus that extracts the address of 1) and transmits the linked read data (linked information) to the authentication server 1. Details will be described later.
The two-dimensional code reader 3 is, for example, a mobile phone or a smartphone that can read a two-dimensional code including a CCD (Charge Coupled Device) camera. An arithmetic device such as a CPU (Central Processing Unit), a storage device such as a memory and a hard disk, an input device that detects input of information from the outside such as buttons and a touch panel, and an interface device that transmits and receives various types of information to and from the outside The computer includes a display device such as an LCD (Liquid Crystal Display), an image processing device such as a CCD image sensor that reads a two-dimensional code symbol, and a program installed in the computer.

At the time of authentication, the user remembers the position (reading pattern) at which the button (pseudo button) of the pseudo two-dimensional code symbol is pressed on the user registration screen displayed on the input display device 2 at the time of registration. The 2D code symbol arranged on the screen is read by the 2D code reader 3.
As a result, the two-dimensional code reader 3 reads the two-dimensional code symbol, decodes the two-dimensional code, and acquires the read data. Here, since the two-dimensional code symbol is a QR code, the read data includes information when the QR code is generated. The read data of the present embodiment includes information when a series of data is divided and a QR code is generated from each divided data. From the total number of divided data and the divided first QR code, The allocated order (symbol string indicator) and the like are included. Details of the information included in the read data will be described later.
Then, the two-dimensional code reader 3 concatenates the read data in order based on the symbol string indicator (order allocated from the divided first QR code) obtained from the read data after decoding, and connects the read data ( Link information). Here, if there is an address of the authentication server 1 (here, URL (Uniform Resource Locator)) so that it can be connected to the authentication server 1 via the network 4 at the beginning of the linked read data, that address is extracted. Then, the link read data (link information) is transmitted to the authentication server 1.
Here, the two-dimensional code reader 3 may store the address of the authentication server 1 in advance, and transmit the linked read data (link information) to the authentication server 1 using the address.

(Network 4)
The network 4 is a communication line that connects the authentication server 1 and the input display device 2 in a communicable manner, and further connects the authentication server 1 and the two-dimensional code reader 3 in a communicable manner. For example, Ethernet (registered trademark) Or Wi-Fi (registered trademark). Through this network 4, data can be exchanged between the devices according to a communication protocol such as IP (Internet Protocol).

2. System Operation Overview Here, the user authentication according to the first embodiment performed by the authentication system 100 will be briefly described.
First, in the storage unit 20 of the authentication server 1, function processing including a “user ID” for specifying a user, a “reading pattern” in which the user has set the arrangement position of the two-dimensional code, and the user ID and the reading pattern is performed. The three data “secret code” are stored in association with each other.
The two-dimensional code generation / arrangement means 40 of the authentication server 1 divides the data obtained by encrypting the secret code into a predetermined number, and divides the divided data [div * u] (details will be described later (FIG. 5D)) into two. Dimensional coding (encoding) is performed to generate a user two-dimensional code [QR * u] (details will be described later (FIG. 5 (f)). In order to generate a QR code from div * u], the generated user two-dimensional code [QR * u] is a QR code, so that the user-coded two-dimensional code [QR * u] Common information (parity data) generated based on data (divided data [div * u]) to be used as a QR code is allocated, and includes information such as the order (symbol string indicator) and the number of divisions. , Two-dimensional code The generation arrangement unit 40 also divides the encrypted data of the random number sequence into a predetermined number, and two-dimensionally encodes (encodes) each of the divided data [div * d] to generate the dummy two-dimensional code [QR * d]. ] Is generated.
The two-dimensional code generation / arrangement means 40 then positions the generated user two-dimensional code [QR * u], dummy two-dimensional code [QR * d], and the user two-dimensional code [QR * u] along the reading pattern. And placement position information (placement instruction data) for placing the dummy two-dimensional code [QR * d] at other positions is output to the input display device 2.

The input display device 2 receives the user two-dimensional code [QR * u], the dummy two-dimensional code [QR * d], and the arrangement position information (arrangement instruction data), and converts these two-dimensional codes according to the arrangement position information. An imaged two-dimensional code symbol is placed on the screen. As a result, the two-dimensional code symbols are arranged and displayed on the screen.
The user recalls the reading pattern registered by the user, and causes the two-dimensional code reading device 3 to read the two-dimensional code symbol arranged on the screen of the input display device 2.

  The two-dimensional code reader 3 reads a two-dimensional code symbol, decodes the two-dimensional code, and acquires divided data. At this time, if the user is reading correctly according to the reading pattern, the divided data [div * u] obtained by decoding the user two-dimensional code [QR * u] is acquired. These divided data [div * u] are concatenated to generate concatenated read data (consolidation information), and the concatenated read data (consolidation information) is transmitted to the authentication server 1.

The authentication unit 50 of the authentication server 1 receives the concatenated read data (concatenation information) from the two-dimensional code reader 3, decrypts the concatenated read data (concatenation information), and acquires a secret code from the decrypted data. The authenticating means 50 compares whether or not this secret code matches the secret code stored in the storage means 20. If there is a matching secret code, it is authenticated (authentication OK).
Above, the brief description about the user authentication which concerns on 1st Embodiment is complete | finished.

3. Details of each part << authentication server 1 >>
Details of each unit included in the authentication server 1 will be described with reference to FIG.
<< Communication input / output means 10 >>
The communication input / output means 10 is means for transmitting / receiving data to / from the input display device 2 and the two-dimensional code reading device 3 connected via the network 4 and inputting the data to the authentication server 1. The communication input / output unit 10 includes a communication unit 11, a user ID input unit 12, a two-dimensional code reading pattern input unit 13, and a connection information input unit 14.

(Communication means 11)
The communication unit 11 is an interface that receives data transmitted from other devices such as the input display device 2 and the two-dimensional code reader 3 connected via the network 4. It is also an interface that transmits data to other devices.

(User ID input means 12)
The user ID input unit 12 is a unit that acquires the “user ID” from the transmission data received by the communication unit 11 from the input display device 2. As a result, the user ID is input to the authentication server 1. Here, if the user ID input means 12 is the user ID acquired together with the user registration request, the user ID input means 12 outputs it to the secret code generation means 31 described later. If the user ID is acquired together with the user authentication request, the user ID is output to the user DB 21 described later and the two-dimensional code arrangement specifying means 45 described later.

(Two-dimensional code reading pattern input means 13)
The two-dimensional code reading pattern input means 13 acquires a “reading pattern” (a two-dimensional code arrangement position encoded according to a predetermined rule) from the data transmitted from the input display device 2 and received by the communication means 11. Means.

(Linked information input means 14)
The connection information input means 14 is means for extracting connection information from the connection read data transmitted from the two-dimensional code reader 3 and received by the communication means 11.
For example, if the two-dimensional code symbol is read with the correct reading pattern by the two-dimensional code reading device 3 operated by the user, the connection information input unit 14 acquires the connection information from the connection read data received by the communication unit 11. To do. As a result, the connection information is input to the authentication server 1.
Then, the connection information input unit 14 outputs the extracted connection information to the connection information decoding unit 51 described later.

<< Storage means 20 >>
The storage unit 20 is a unit that stores data and programs, and is a storage unit such as an HD (Hard Disc), a RAM (Random Access Memory), or an optical disc. The storage unit 20 includes a user DB 21.

(User DB 21)
The user DB 21 includes a “user ID” that identifies the user, a “reading pattern” that indicates the arrangement position of the two-dimensional code set by the user, and a “secret code” that is functionally processed including the user ID and the reading pattern. This is means for storing three data in association with each other. For example, as illustrated in FIG. 4, the user DB 21 stores a user ID “Haruto” in association with a read pattern (1, 3, 4, 1) and a secret code “0xFA039CDC.
Further, when the user DB 21 acquires the “user ID” from the user ID input unit 12, the user DB 21 outputs the “secret code” stored in association with the “user ID” to the encryption unit 43 described later. It has a function.

<< Registration means 30 >>
The registration means 30 is a means for performing a user registration process. By performing the user registration process, the user DB 21 stores three pieces of data “user ID”, “read pattern”, and “secret code” in association with each other. Let The registration unit 30 includes a secret code generation unit 31 and a user registration unit 32.

(Secret code generation means 31)
The secret code generating unit 31 generates a secret code from the user ID input to the user ID input unit 12 and the reading pattern input to the two-dimensional code reading pattern input unit 13 using a one-way function. It is.

(User registration means 32)
The user registration means 32 is a means for associating the user ID, the reading pattern, and the generated secret code with each other and storing them in the user DB 21 (database).

<< Two-dimensional code generation / arrangement means 40 >>
The two-dimensional code generation / arrangement means 40 is a means for performing a two-dimensional code arrangement process. By performing the two-dimensional code arrangement process, the user two-dimensional code [QR * u] and the dummy two-dimensional code [QR * d] N × m two-dimensional code [QR] and arrangement position information of the two-dimensional code [QR] are generated. The two-dimensional code generation / arrangement means 40 includes a random number generation means 41, a time output means 42, an encryption means 43, a two-dimensional code generation means 44, a two-dimensional code arrangement designation means 45, and a two-dimensional code output means. 46.

(Random number generator 41)
The random number generation means 41 is a means for generating a random number. The random number generation means 41 generates a random number using a general random number generation algorithm. This random number is a number, a letter, or a combination thereof.
(Time output means 42)
The time output means 42 is a means for obtaining the time of operation (current time).

(Encryption means 43)
The encryption means 43 generates one user data [Du] and n-1 dummy data [Dd], encrypts each, and adds an address [URL] in front of each. Means. Thereby, one [URL * cDu] and n-1 [URL * cDd] are generated.
This address [URL] is an address at which the two-dimensional code reader 3 can be connected to the authentication server 1 via the network 4. For example, a URL that is information for identifying the server location on the Internet, a mail address, etc. But you can.
The number “n” indicates the number of rows (n) of two-dimensional code symbols displayed in a matrix on the display screen of the input display device 2 shown in FIG.

First, the encryption unit 43 acquires a “secret code” from the user DB 21. This is because when the user ID input means 12 outputs the “user ID” acquired together with the user authentication request to the user DB 21, the user DB 21 stores the “secret code” stored in association with the “user ID”. The data is output to the encryption means 43. Thereby, the encryption means 43 can acquire the “secret code” from the user DB 21.
Further, the encryption unit 43 acquires the current time information from the time output unit 42.
Then, the encryption unit 43 concatenates the “secret code” acquired from the user DB 21 and the “time information” acquired from the time output unit 42 to generate user data [Du] (FIG. 5A). . In the figure, “time information” is connected to the end of “secret code”, but it may be after “secret code”.

  Further, the encryption unit 43 acquires a random number from the random number generation unit 41 and generates dummy data [Dd] in which the random numbers are enumerated. This process is repeated a predetermined number of times (n-1 times), and the encryption unit 43 generates n-1 dummy data [Dd]. If n = 4, three dummy data [Dd1], [Dd2], and [Dd3] are generated.

The encryption unit 43 encrypts one piece of user data [Du] and n−1 pieces of dummy data [Dd], respectively, and one piece of encrypted user data [cDu] and n−1 pieces of data. Encrypted dummy data [cDd] is generated. Here, if n = 4, encrypted user data [cDu] and three encrypted dummy data [cDd1], [cDd2], and [cDd3] are generated (FIG. 5B).
Here, it is not necessary to specify the encryption method, but a common key encryption such as AES (Advanced Encryption Standard) may be used.

  The encrypting means 43 includes a two-dimensional code reader 3 connected to the network 4 at the head of each of the generated encrypted user data [cDu] and n−1 encrypted dummy data [cDd]. An address [URL] that enables connection to the authentication server 1 is added. Thereby, one piece of encrypted user data with address [URL * cDu] and n−1 pieces of encrypted dummy data with address [URL * cDd] are generated. Here, if n = 4, one addressed encrypted user data [URL * cDu] and three addressed encrypted dummy data [URL * cDd1], [URL * cDd2], [URL * cDd3] is generated (FIG. 5C).

  Finally, the encryption unit 43 generates, for example, one encrypted user data with address [URL * cDu] and n−1 encrypted dummy data with address [URL * cDd] as a two-dimensional code generation unit. 44.

(Two-dimensional code generation means 44)
The two-dimensional code generation unit 44 is a unit that divides data into m pieces, adds a specific character string [&] to the end of the divided data column, and generates a two-dimensional code.
The number “m” indicates the number of columns (m) of two-dimensional code symbols displayed in a matrix on the display screen of the input display device 2 shown in FIG.

  Here, the two-dimensional code generation means 44 adds a specific character string [&] to the end of the divided data string. For example, in this embodiment, a specific character string [&] is assumed to be “__” in which two underscores (_) are continued. In this case, if this specific character string [&] is added to the URL character string, it is recognized as a URL including “_”, and the authentication server 1 cannot be accessed. Therefore, when the URL character string is divided, this specific character string [&] is not added. Thereby, when the two-dimensional code reader 3 connects the divided character strings of two URLs, the character string of URLs that can be connected to the authentication server 1 can be acquired. Further, the specific character string [&] does not need to be an underscore (_) and may be an arbitrary character string.

First, the two-dimensional code generation unit 44 divides the encrypted user data with address [URL * cDu] acquired from the encryption unit 43 into m pieces. As a result, m pieces of divided data [div * u] are generated. Here, if m = 4, four pieces of divided data [div1 * u], [div2 * u], [div3 * u], and [div4 * u] are generated (FIG. 5D).
Then, the two-dimensional code generation unit 44 adds a specific character string [&] to the end of the divided data string. Thus, if m = 4, [div1 * u] [&], [div2 * u] [&], [div3 * u] [&], [div4 * u] [&] are generated ( FIG. 5 (e)).
Next, the two-dimensional code generation means 44 converts these data to which a specific character string [&] is assigned into a two-dimensional code to generate m user two-dimensional codes [QR * u]. Accordingly, if m = 4, [QR1 * u] is generated from [div1 * u] [&], [QR2 * u] is generated from [div2 * u] [&], and [div3 [QR3 * u] is generated from * u] [&], and [QR4 * u] is generated from [div4 * u] [&] (FIG. 5 (f)).

  Similarly, the two-dimensional code generation unit 44 divides each of the n−1 addressed encrypted dummy data [URL * cDd] into m pieces. A specific character string [&] is added to the end of the divided data column, and these data are converted into a two-dimensional code, and (n−1) × m dummy two-dimensional codes [QR * d] are obtained. Generate.

  Here, if m = 4, the two-dimensional code generation means 44 converts the encrypted dummy data with address [URL * cDd1], [URL * cDd2], and [URL * cDd3] into four (m) each. By dividing, [QR1 * d1], [QR2 * d1], [QR3 * d1], and [QR4 * d1] are generated from the addressed encrypted dummy data [URL * cDd1]. Furthermore, [QR1 * d2], [QR2 * d2], [QR3 * d2], and [QR4 * d2] are generated from the encrypted dummy data with address [URL * cDd2]. Then, [QR1 * d3], [QR2 * d3], [QR3 * d3], and [QR4 * d3] are generated from the encrypted dummy data with address [URL * cDd3]. Thus, (n−1) × m, that is, 12 dummy two-dimensional codes [QR * d] are generated.

  The two-dimensional code generation means 44 uses a method disclosed in Japanese Patent Laid-Open No. 2010-61468 (Patent Document 2) to generate an arbitrary QR when generating a plurality of two-dimensional codes (QR code (registered trademark)) by dividing. Structurally connected reading of code (registered trademark) (sequentially reading a plurality of QR code (registered trademark) images (two-dimensional code symbols) and connecting read data obtained by decoding each QR code (registered trademark)) Is possible.

For example, the two-dimensional code generation / arrangement means 40 divides the addressed encrypted user data [URL * cDu] (FIG. 5C) to generate a plurality of user two-dimensional codes [QR * u] (QR code (registered trademark)). )) (FIG. 5 (f)), the information including the total number of divisions (m) of data and the order (symbol string indicator) allocated from the first QR code after division is included. Two-dimensional codes [QR1 * u], [QR2 * u], [QR3 * u], and [QR4 * u] are generated. That is, [QR1 * u] includes information of “total number of divisions = 4” and “order (symbol column indicator) = 1”.
The two-dimensional code generation / arrangement means 40 is generated on the basis of data to be QR code (registered trademark), that is, divided data [div * u] [&] to which a specific character string [&] is added. Common information (parity data) is allocated. Thus, the two-dimensional code reader 3 that reads the QR code can definitely restore the original data by sequentially connecting only the same parity data included in the decoded QR code. This parity data is an 8-bit code obtained by taking XOR (exclusive OR) for each byte of data to be a QR code (registered trademark).

  Finally, the two-dimensional code generation means 44 uses a total of n × m of m user two-dimensional codes [QR * u] and (n−1) × m dummy two-dimensional codes [QR * d]. The two-dimensional codes are output to the two-dimensional code arrangement specifying means 45.

(Two-dimensional code arrangement designation means 45)
The two-dimensional code arrangement designation unit 45 is a unit that designates the arrangement position of the two-dimensional code symbol on the display screen of the input display device 2.
First, the two-dimensional code arrangement specifying unit 45 acquires a user ID from the user ID input unit 12 and acquires a “read pattern” corresponding to the user ID from the user DB 21.
Further, from the two-dimensional code generation means 44, one set (m) of user two-dimensional codes [QR * u] and (n−1) sets of ((n−1) × m) dummy two-dimensional codes [QR]. * D] n × m two-dimensional codes [QR] are acquired.

  Then, the two-dimensional code arrangement designating unit 45 uses a two-dimensional code [QR] to arrange the two-dimensional code symbols in a matrix of n rows and m columns as in the display screen of the input display device 2 shown in FIG. Specify the placement position of. At this time, first, m user two-dimensional codes [QR * u] are arranged at positions along the “read pattern”, and (n−1) × m dummy two-dimensional codes [QR] are arranged at other positions. * D] is specified. Then, arrangement position information (arrangement instruction data) for designating the arrangement position of the two-dimensional code is generated.

  Finally, the two-dimensional code arrangement designating means 45 is an nxm number of two elements composed of the user two-dimensional code [QR * u] and the dummy two-dimensional code [QR * d] acquired from the two-dimensional code generation means 44. The two-dimensional code output means 46 outputs the dimension code [QR] and arrangement position information for designating the arrangement position of these two-dimensional codes.

Here, an example is shown in which the two-dimensional code arrangement designating unit 45 generates arrangement position information for arranging the two-dimensional code symbols in a 4 × 4 matrix on the input display device 2 (see FIG. 3 as appropriate).
The two-dimensional code arrangement designating unit 45 receives a set of four user two-dimensional codes [QR * u]; [QR1 * u], [QR2 * u], [QR3 * u] from the two-dimensional code generation unit 44. , [QR4 * u], and four sets of dummy two-dimensional codes [QR * d], 3 sets ([QR * d1], [QR * d2], [QR * d3]) Dummy two-dimensional code [QR * d1] ([QR1 * d1], [QR2 * d1], [QR3 * d1], [QR4 * d1]), [QR * d2] ([QR1 * d2], [QR2 * d2], [QR3 * d2], [QR4 * d2]), [QR * d3] ([QR1 * d3], [QR2 * d3], [QR3 * d3], [QR4 * d3]). .

The two-dimensional code arrangement designating unit 45 determines whether the two-dimensional code arrangement designating unit 45 is a set of user two-dimensional data when the “read pattern” acquired from the user DB 21 is (1, 3, 4, 1). Place the code [QR * u] in the 4 × 4 matrix position along the “read pattern”, [QR1 * u] in the first column, first row, and [QR2 * u] in the second The third column, [QR3 * u] is specified to be arranged at the third column, fourth row, and [QR4 * u] is arranged at the fourth column, first row.
Similarly, a total of 3 sets of 12 dummy two-dimensional codes [QR * d] are arranged in a 4 × 4 matrix. At this time, it is specified that all twelve dummy two-dimensional codes are arranged at positions other than the position where one set of user two-dimensional codes are arranged. For example, in the first column, [QR1 * d1] is the first column second row, [QR1 * d3] is the first column third row, and [QR1 * d2] is the first column fourth row. In the second column, [QR2 * d2] is in the second column, first row, [QR2 * d3] is in the second column, second row, and [QR2 * d1] Is arranged at the position of the second column and the fourth row.

(Two-dimensional code output means 46)
The two-dimensional code output means 46 acquires “n × m two-dimensional codes [QR]” and “two-dimensional code symbol arrangement position information” from the two-dimensional code arrangement designation means 45, and transmits them to the communication means 11. Generates transmission data so as to be transmitted to the input display device 2.

<< Authentication means 50 >>
The authentication unit 50 includes a linked information decryption unit 51, an information separation unit 52, and a two-step authentication unit 53.
(Concatenated information decoding means 51)
The link information decoding unit 51 is a unit that removes a specific character string from the link information acquired from the link information input unit 14 to obtain a series of data (continuous data), and decodes the series of data (continuous data). .

  The connection information decoding means 51 acquires the connection information from the connection information input means 14, removes a specific character string [&] from the connection information, and generates continuous data in which the character string is continuous. This specific character string [&] is given to the two-dimensional code generation means 44.

  For example, if the two-dimensional code symbol is read with the correct reading pattern by the two-dimensional code reader 3 operated by the user, the link information decoding unit 51 receives [div1A * u as link information from the link information input unit 14. ] [&] [Div2 * u] [&] [div3 * u] [&] [div4 * u] [&]. The continuous data [div1A * u] [div2 * u] [div3 * u] [div4 * u] is acquired by removing [&] from the concatenation information. This continuous data is encrypted user data [cDu] before being divided into m pieces by the two-dimensional code generation means 44. Here, [div1A * u] is data obtained by removing the address [URL] from the divided data [div1 * u] shown in FIG.

And the connection information decoding means 51 decodes continuous data. This decryption method corresponds to the encryption method performed by the encryption unit 43.
For example, if the two-dimensional code symbol is read with the correct reading pattern by the two-dimensional code reader 3 operated by the user, the concatenated information decrypting means 51 decrypts the encrypted user data [cDu] to obtain the user data Obtain [Du].
The linked information decoding unit 51 outputs this user data [Du] to the information separating unit 52.

(Information separating means 52)
The information separating unit 52 is a unit that separates the data acquired from the linked information decoding unit 51 to acquire “time part information” and “authenticated part information”. The information separating unit 52 outputs the acquired time part information and the authenticated part information to the two-step authentication unit 53.
Here, if the two-dimensional code symbol is read with a correct reading pattern, the information separating means 52 acquires user data [Du] from the linked information decoding means 51. The user data [Du] is separated, and the information of the time portion of the “region in which the time information is embedded” and the information of the authenticated portion of the “region in which the secret code is embedded” are acquired. The information on the time part is “time information” acquired from the time output unit 42 by the encryption unit 43, and the information on the authenticated part is the “secret code” acquired from the user DB 21 by the encryption unit 43.

(Two-step authentication means 53)
The two-step authentication means 53 is a means for performing in-time determination (first determination) of “time part information” and user authentication determination (second determination) of “authenticated part information”. Then, the authentication result is output via the communication means 11. The output destination is the two-dimensional code reading device 3 and / or the input display device 2.

The two-step authentication unit 53 acquires “time part information” and “authenticated part information” from the information separation unit 52 and performs in-time determination.
(In-time judgment)
The two-step authentication unit 53 acquires the current time from the time output unit 42 and performs a first determination as to whether or not the time from “time part information” to “current time” is within a predetermined effective time. .
Here, if the “time portion information” is not the time information, it is determined as the first determination NG. Moreover, if it is over valid time, it will determine with 1st determination NG. On the other hand, if it is within the valid time, it is determined as the first determination OK. If the first determination is OK, authentication determination is performed next.
For example, if the two-dimensional code symbol is read with a correct reading pattern, the “time portion information” is “time information” acquired from the time output means 42 by the encryption means 43. The two-step authentication means 53 determines whether or not the time from the “time part information” (“time information”) to the “current time” is within a predetermined effective time.

(User authentication judgment)
Next, the two-step authentication means 53 performs a second determination as to whether or not “information of the part to be authenticated” matches the “secret code” stored in the user DB 21.
For example, if the two-dimensional code symbol is read with a correct reading pattern, the “authenticated part information” is the “secret code” acquired from the user DB 21 by the encryption unit 43. The two-step authentication means 53 determines whether or not this “information of the part to be authenticated” matches the “secret code” stored in the user DB 21. At this time, if there is a matching “secret code”, it is determined that the authentication is OK. On the other hand, if there is no matching “secret code”, it is determined as authentication NG.

4). User Authentication Process In this embodiment, user authentication is realized by the following three processes.
(1) User registration processing (2) Two-dimensional code placement processing (3) User authentication execution processing

  First, the user performs user registration (user registration processing) in accordance with an instruction on a user registration screen displayed on the input display device 2. Thereafter, each time the user performs user authentication in accordance with the user authentication instruction displayed on the input display device 2, a user authentication execution process is performed following the two-dimensional code arrangement process. Hereinafter, each processing will be described.

(1) User Registration Process Next, a user registration process operation performed between the authentication server 1 and the input display device 2 of the authentication system 100 will be described with reference to FIG. 6 (refer to FIGS. 1 to 3 as appropriate). reference).

  First, the input display device 2 displays a user registration screen (step S101). The user inputs the user ID according to the instruction displayed on the user ID input screen (step S102). The input display device 2 transmits user registration request data including the input user ID to the authentication server 1 (step S103).

  The communication unit 11 of the authentication server 1 receives user registration request data from the input display device 2. The user ID input means 12 acquires a user ID (registered user ID) from the received user registration request data (step S104). As a result, the user ID is input to the authentication server 1. At this time, the authentication server 1 may confirm whether or not the same user ID is already registered in the user DB 21.

  Next, the input display device 2 to which the user ID has been input displays a screen on which pseudo symbols (pseudo two-dimensional code symbols) similar to the two-dimensional code are arranged in a predetermined arrangement (step S105). These symbols are buttons and can be selected and input, and the user selects a predetermined number (m) of symbols (pseudo two-dimensional code symbols) according to a predetermined rule (step S106). As a result, the input display device 2 generates a “read pattern” composed of the arrangement positions of the selected symbols (step S107).

  Hereinafter, it is assumed that the input display device 2 generates a read pattern of (1, 3, 4, 1) in step S107. The input display device 2 transmits this read pattern to the authentication server 1 (step S108).

  The communication unit 11 of the authentication server 1 receives the data transmitted by the input display device 2, and the two-dimensional code reading pattern input unit 13 acquires the reading pattern from the data (step S109), whereby the reading pattern is transferred to the authentication server. It is input. At this time, a reading pattern of (1, 3, 4, 1) is input.

  The secret code generation unit 31 acquires a user ID from the user ID input unit 12 and acquires a reading pattern from the two-dimensional code reading pattern input unit 13. The secret code generation unit 31 generates a secret code from the user ID and the reading pattern using a one-way function (step S110). Next, the secret code generation unit 31 outputs three data of the user ID, the reading pattern, and the secret code to the user registration unit 32.

  The user registration unit 32 associates the three data of the user ID acquired from the secret code generation unit 31, the reading pattern, and the secret code, and stores them in the user DB 21 (step S111). As described above, the authentication system 100 ends the user registration processing operation.

(2) Two-dimensional Code Placement Processing Next, the two-dimensional code placement processing operation of the authentication server 1 will be described with reference to FIGS. 7 and 8 (refer to FIGS. 1 to 6 as appropriate).

  First, the input display device 2 displays a user authentication screen, and the user inputs a user ID. The input display device 2 transmits user authentication request data including the input user ID to the authentication server 1. Since this is the same processing as steps S101 to S103 in FIG. 6, description thereof is omitted here.

  The communication unit 11 of the authentication server 1 receives user authentication request data from the input display device 2. The user ID input means 12 acquires a user ID from the received user authentication request data (step S201). As a result, the user ID is input to the authentication server 1. The user ID input unit 12 refers to the user DB 21, acquires a secret code associated with the acquired user ID (step S 202), and provides it to the encryption unit 43.

  The encryption unit 43 acquires time information indicating the current time from the time output unit 42 (step S203). The encryption means 43 concatenates the secret code and the time information to generate user data [Du] (step S204) (FIG. 5A), encrypts the user data [Du], and encrypts the user data. [CDu] is generated (step S205) (FIG. 5B).

  Next, the encryption unit 43 causes the random number generation unit 41 to generate a random number, obtains a random number from the random number generation unit 41, and generates a sequence of random numbers (dummy data [Dd]) (step S206). The generated random number sequence is encrypted to generate encrypted dummy data [cDd] ([cDd1]) (step S207). Then, it is determined whether or not the number of generated encrypted dummy data [cDd] has reached a predetermined number (n−1) (number of [cDd] = predetermined number (n−1)?) (Step S208). ). If the number of encrypted dummy data [cDd] is less than a predetermined number (n−1) (number of [cDd] <predetermined number (n−1)) (No in step S208), the process of step S206 is performed. Again, encrypted dummy data [cDd] ([cDd2]) is generated.

On the other hand, if the number of encrypted dummy data [cDd] is a predetermined number (n−1) (number of [cDd] = predetermined number (n−1)) (step S208, Yes), the encryption means 43 Executes step S209.
At this time, the encryption unit 43 encrypts the encrypted user data [cDu] and the n-1 encrypted dummy data [cDd] ([cDd1], [cDd2],..., [CDd (n−1 )]) And are generated.

Next, the encryption unit 43 acquires an address [URL] for accessing the authentication server 1 (stored in the storage unit 20) (step S209).
Then, the encrypted address data [URL * cDu] is generated by concatenating the acquired address [URL] before the encrypted user data [cDu] encrypted in step S205 (step S210) (FIG. 5 (c)).
Further, the encryption unit 43 encrypts the dummy random data [cDd] ([cDd1], [cDd2],..., [CDd (n− 1)]) Before each, the acquired address [URL] is concatenated, and n−1 encrypted dummy data with addresses [URL * cDd] ([URL * cDd1], [URL * cDd2], ... [URL * cDd (n-1)]) is generated (step S211). The encryption unit 43 outputs the encrypted user data with address [URL * cDu] and the n−1 encrypted dummy data with address [URL * cDd] to the two-dimensional code generation unit 44.

The two-dimensional code generation means 44 divides the addressed encrypted user data [URL * cDu] into a predetermined number (m) (step S212, FIG. 8). As a result, m pieces of divided data [div * u] are generated (FIG. 5D). Then, the two-dimensional code generation unit 44 adds a specific character string [&] to the end of the divided data string. If m = 4, [div1 * u] [&], [div2 * u] [&], [div3 * u] [&], [div4 * u] [&] are generated (FIG. 5 ( e)).
Then, each of these m pieces of data is two-dimensionally encoded to generate m user two-dimensional codes [QR * u] (step S213) (FIG. 5 (f)).

Similarly, the two-dimensional code generation unit 44 divides each of the n−1 encrypted dummy data with addresses [URL * cDd] into a predetermined number (m) (step S214). As a result, a specific character string [&] is added to the end of the divided data string, and these data are two-dimensionally encoded, and (n−1) × m two-dimensional codes [QR * d ] Is generated (step S215).
Through the processes in steps S212 to S215, n × m two-dimensional codes [QR] are generated.

The two-dimensional code arrangement specifying unit 45 acquires a user ID from the user ID input unit 12, and acquires a reading pattern corresponding to the user ID from the user DB 21 (step S216).
Next, the two-dimensional code arrangement specifying means 45 displays the two-dimensional code symbol of the addressed encrypted user data [URL * cDu] along the read pattern on the screen of the input display device 2. , M user two-dimensional codes [QR * u] of addressed encrypted user data [URL * cDu] and addressed encrypted dummy data [URL * cDd] ([URL * cDd1], [URL * cDd2]) ,..., [URL * cDd (n−1)]) (n−1) × m dummy two-dimensional codes [QR * d] are arranged on the screen of the input display device 2. Is generated (step S217).

  The two-dimensional code output means 46 includes n × m two-dimensional codes [QR] (user two-dimensional code [QR * u] and dummy two-dimensional code [QR * d]) and arrangement position information of these two-dimensional codes. Is generated so that the communication means 11 transmits to the input display device 2 (step S218). Thereby, the authentication server 1 (communication means 11) transmits the transmission data to the input display device 2. Then, the authentication server 1 ends the two-dimensional code arrangement process.

<< Two-dimensional code symbol arrangement processing of the input display device 2 >>
Thereafter, the input display device 2 receives the transmission data from the authentication server 1 and receives n × m two-dimensional codes [QR] (user two-dimensional code [QR * u] and dummy two-dimensional code [QR * d]). And the arrangement position information of these two-dimensional codes.
Next, the input display device 2 images each of the n × m two-dimensional codes [QR] to form a two-dimensional code symbol. Each of the two-dimensional code symbols obtained by imaging m user two-dimensional codes [QR * u] and the two-dimensional code obtained by imaging (n−1) × m dummy two-dimensional codes [QR * d]. Each symbol is arranged based on the arrangement position information and displayed on the screen.

<< Connection information transmission process of two-dimensional code reader 3 >>
Thereafter, the two-dimensional code reading device 3 is operated by the user and reads the two-dimensional code symbol displayed on the screen of the input display device 2.
As a result, the two-dimensional code reader 3 reads the two-dimensional code symbol, decodes the two-dimensional code, and acquires the read data. Then, based on the symbol string indicator obtained from the read data, the read data is sequentially connected to generate the connected read data (connection information). Further, the address [URL] of the transmission destination (authentication server 1) is extracted from the read data and connected to the authentication server 1 via the network 4 using the address [URL] to authenticate the linked read data (link information). Send to server 1.

(3) User Authentication Execution Processing Next, the user authentication execution processing operation of the authentication server 1 will be described with reference to FIG. 9 (refer to FIGS. 1 to 5 as appropriate).

  The link information input means 14 receives the link read data from the two-dimensional code reader 3, and extracts link information from the link read data (step S301). Here, if the two-dimensional code symbol is read with a correct reading pattern, the extracted concatenated information is [div1A * u] [&] [div2 * u] in which the address [URL] is removed from the concatenated read data. [&] [Div3 * u] [&] [div4 * u] [&] are acquired.

  The link information decoding unit 51 receives the link information ([div1A * u] [&] [div2 * u] [&] [div3 * u] [&] [div4 * u] [&]) from the link information input unit 14. Acquire and remove the specific character string [&] from the concatenation information to obtain continuous data (step S302). Here, if the two-dimensional code symbol is read with a correct reading pattern, the acquired continuous data is [div1A * u] [div2 * u] [div3 * u] [div4 * u], and the two-dimensional code is obtained. The encrypted user data [cDu] before being divided into m pieces by the generation unit 44.

  Then, the concatenated information decrypting means 51 decrypts the continuous data (encrypted data) (step S303), and outputs the decrypted data to the information separating means 52. Here, if the two-dimensional code symbol is read with a correct reading pattern, the concatenated information decrypting means 51 decrypts the encrypted user data [cDu]. This decoded data is user data [Du].

  The information separating unit 52 separates the decrypted data acquired from the concatenated information decrypting unit 51 to obtain “time part information” and “authenticated part information” (step S304). Then, the acquired “time part information” and “authenticated part information” are output to the two-step authentication means 53. Here, if the two-dimensional code symbol is read with the correct reading pattern, the information separating means 52 separates the user data [Du] and includes information on the time portion of the “area in which the time information is embedded”. , And information on the portion to be authenticated in the “area where the secret code is embedded”. This “time part information” is the “time information” acquired by the encryption unit 43 from the time output unit 42, and the “authenticated part information” is the “secret code” acquired by the encryption unit 43 from the user DB 21. Is.

The two-stage authentication unit 53 acquires “time part information” and “authenticated part information” from the information separation unit 52, and first performs in-time determination.
The two-stage authentication unit 53 acquires the current time from the time output unit 42 (step S305), and determines whether the time from “time part information” to “current time” is within a predetermined valid time. 1 determination is performed (step S306).
If the valid time is exceeded (No at Step S306), it is determined as authentication NG (Step S307). Even if the “time part information” is not time information, it is determined as authentication NG.

On the other hand, if it is within the valid time (step S306, Yes), it is determined that the first determination is OK, and the next authentication determination is performed.
Here, “time part information” is “time information” acquired from the time output unit 42 by the encryption unit 43. In the first determination, the two-step authentication means 53 determines whether or not the time from the “time part information” (“time information”) to the “current time” is within a predetermined effective time.

Next, the two-step authentication means 53 makes a second determination as to whether or not the “authenticated part information” matches the “secret code” stored in the user DB 21 (step S308).
In this process, the “authenticated part information” is a “secret code” acquired from the user DB 21 by the encryption unit 43.

If there is no matching “secret code” (No at Step S308), it is determined as authentication NG (Step S307).
On the other hand, if there is a matching “secret code” (step S308, Yes), it is determined as the second determination OK, and it is determined as the authentication OK (step S309).
Then, the two-step authentication unit 53 transmits the authentication result to the two-dimensional code reading device 3 via the communication unit 11 (step S310), and ends all the processes.

(Second Embodiment)
In the first embodiment, the two-dimensional code arrangement designating unit 45 considers the screen size of the input display device 2 and n (rows) so that all n × m two-dimensional code symbols can fit on one screen. They are arranged in a matrix of × m (column). Therefore, there are n ^m (n to the power of m) reading patterns of the two-dimensional code symbol. The number of "read pattern" affects the security strength, if a malicious user (attacker) has performed an exhaustive search attacks of reading the two-dimensional code symbol randomly successful attack with a probability of 1 / n ^m Resulting in. Therefore, in order to increase the security strength, it is desirable to set the values of m and n as large as possible in consideration of the resolution, display space, usability and the like of the input display device 2.

Therefore, the authentication server 1 according to the second embodiment is not illustrated because the function of the two-dimensional code arrangement specifying unit 45 of the authentication server 1 according to the first embodiment is different, and will be described with reference to FIG. To do. Hereinafter, for convenience, this will be referred to as a two-dimensional code arrangement specifying means 45A.
The two-dimensional code arrangement specifying unit 45A divides the two-dimensional code [QR] into a predetermined number of groups, and generates arrangement position information for displaying the two-dimensional code symbols of each group on one screen. At this time, two-dimensional codes [QR] having the same order (number of symbol string designator) from the first two-dimensional code [QR] after division are set to the same group. Thereby, when the screen of the input display device 2 is changed, one group of two-dimensional code symbols is arranged and displayed on each screen, for example, in a matrix. In this case, one two-dimensional code symbol is read for each screen, and the read pattern recorded in the user DB 21 as a secret code indicates one relative positional relationship for each screen (example of arranging in a matrix) Then, the two-dimensional code symbol (user two-dimensional code [QR * u]) to be read in each screen indicates in what column and in what row. The screen transition is performed by the operation of the input display device 2 by the user. For example, m user two-dimensional codes [QR * u] and (n−1) × m dummy two-dimensional codes [QR * d] have n two-dimensional code symbols arranged on each screen, All m screens are transitioned to read two-dimensional code symbols one by one. The security strength at this time is the same as in the first embodiment ( ^nm reading patterns).

  As described above, the number of two-dimensional code symbols that can be displayed on the one display screen of the input display device 2 due to the screen size by displaying on the input display device 2 is limited. Since the limit number of two-dimensional code symbols that can be displayed on the screen can be increased, the security strength can be further increased. Here, in the first embodiment, n × m two-dimensional code symbols are displayed on the input display device 2 in a matrix on one screen. According to the second embodiment, since the two-dimensional code symbols are displayed over a plurality of screens, the number of two-dimensional code symbols displayed on one screen is reduced from n × m to n. Since the overall size of the matrix is reduced, thereby providing a space between the two-dimensional code symbols, each two-dimensional code symbol is easy to read. Further, since the overall size of the matrix is reduced, the size of each two-dimensional code symbol can be increased. The authentication server 1 should just transmit the instruction | indication which designates the size when displayed on the screen of the input display apparatus 2 to the input display apparatus 2 with arrangement | positioning position information. This frees usability constraints due to display space and display space.

(Third embodiment)
According to the authentication server 1 of the first embodiment and the second embodiment, assuming that the number of divisions is m, (n−1) sets of random number sequences are generated in order to generate n × m two-dimensional codes. Was used. In this method, the attacker steals the user ID, the two-dimensional code symbol, the arrangement position information of the two-dimensional code symbol, and the concatenated read data (concatenation information) transmitted from the two-dimensional code reader 3 to the authentication server 1 by wiretapping or the like. May be. In this case, since the “read pattern” corresponding to the user ID can be uniquely specified, there is a possibility of a security hole.

Therefore, as shown in FIG. 10, the authentication server 1A according to the third embodiment replaces the two-dimensional code arrangement designation unit 45 of the authentication server 1 according to the first embodiment with a two-dimensional code copy arrangement designation unit. 47 is different from the authentication server. Since other configurations are the same, the description is omitted for convenience.
The two-dimensional code duplication arrangement designating unit 47 duplicates the two-dimensional code and arranges and displays a two-dimensional code symbol obtained by imaging the duplicated two-dimensional code on the input display device 2. At this time, the two-dimensional code copied by the two-dimensional code copy arrangement designating unit 47 may be a user two-dimensional code, a dummy two-dimensional code, or both of them. This makes it impossible to specify the “read pattern” from the arrangement position information and the connection information of the two-dimensional code and the two-dimensional code symbol. Specifically, the authentication server 1 duplicates the two-dimensional code [QR] and designates the two-dimensional code [QR] to be arranged at an arbitrary location that does not overlap with the “read pattern” (arrangement position) acquired from the user DB 21. As a result, all or part of the two-dimensional code symbols displayed on the screen of the input display device 2 are overlapped. That is, the same pattern can be generated when a two-dimensional code symbol other than the “read pattern” is read.
As a result, a plurality of “reading patterns” can be apparently produced, but by increasing the number of reading two-dimensional code symbols (number of divisions (m)), the probability of being identical to the “reading pattern” can be reduced. Because it can, security strength will not be significantly reduced. Rather, all of the user ID, the two-dimensional code symbol, the arrangement position information of the two-dimensional code symbol, and the concatenated read data (concatenation information) transmitted from the two-dimensional code reader 3 to the authentication server 1A by the attacker. Even if the user is stolen by eavesdropping or the like, the “reading pattern” corresponding to the user ID cannot be uniquely identified, so that the security strength can be further increased.

  As mentioned above, although each embodiment of the present invention was described, the present invention is not limited to these embodiments. For example, the address [URL] is included in the concatenated read data received by the concatenation information input means 14, but when the two-dimensional code reader 3 extracts the address [URL] from the concatenated read data, the concatenated read data The address [URL] may be deleted.

Further, in each embodiment, the authentication server 1 (1A) includes data (in FIG. 5C) in which the address [URL] that allows the two-dimensional code reader 3 to connect to the authentication server 1 via the network 4 is linked. Encrypted user data with address [URL * cDu]) is two-dimensionally encoded and transmission data including the user two-dimensional code [QR * u] is transmitted to the input display device 2, but the address [URL] is concatenated. It does not have to be. In this case, an address [URL] that allows the two-dimensional code reader 3 to connect to the authentication server 1 (1A) via the network 4 may be stored in advance.
As a result, the linked read data generated by the two-dimensional code reader 3 reading the plurality of two-dimensional code symbols displayed on the screen of the input display device 2 with the correct reading pattern includes the address [URL]. Absent. However, the two-dimensional code reader 3 may transmit the linked read data to the authentication server 1 (1A) using the stored address [URL].
The address [URL] may be a mail address or any information that enables the two-dimensional code reader 3 to connect to the authentication server 1 via the network 4 and transmit the linked read data.

In the present embodiment, since the two-dimensional code symbols are arranged in a matrix of 4 (n) × 4 (m), the number of random number sequences generated by the encryption unit 43 (= number of dummy two-dimensional codes to be generated). Although (n) is set to 3, this number (n) is the maximum value generated when arranging in a 4 × 4 matrix, and may be less than 3.
Similar to the random number table of Patent Document 1, this is a user two-dimensional code [QR * u] ([QR1 * u], [QR2 * u], [QR3 * u], [QR4 * u] divided into four. ) Are arranged at the remaining 12 positions, the user two-dimensional code [QR * u] ([QR1 * u], [QR2 * u], [QR3 * u], [QR4] divided into four is divided. * U]) may be duplicated, and the duplicate two-dimensional code may be arranged, or the two-dimensional code duplicate arrangement specifying means 47 may duplicate the dummy two-dimensional code and arrange the duplicated dummy two-dimensional code at another position. This is because it does not matter.

DESCRIPTION OF SYMBOLS 1 Authentication server 2 Input display apparatus 3 Two-dimensional code reader 4 Network 10 Communication input / output means 11 Communication means 12 User ID input means 13 Two-dimensional code reading pattern input means 14 Connection information input means 20 Storage means 21 User DB
DESCRIPTION OF SYMBOLS 30 Registration means 31 Secret code generation means 32 User registration means 40 Two-dimensional code generation arrangement means 41 Random number generation means 42 Time output means 43 Encryption means 44 Two-dimensional code generation means 45 Two-dimensional code arrangement designation means 46 Two-dimensional code output means 46 47 Two-dimensional code replication arrangement designating means 50 Authentication means 51 Concatenated information decoding means 52 Information separating means 53 Two-stage authentication means 100 Authentication system

Claims (9)

A display device that images each of a plurality of two-dimensional codes and arranges each of the two-dimensional code symbols in accordance with an arrangement instruction and displays the two-dimensional code symbols on a screen, and the user operates the plurality of two-dimensional code symbols arranged on the screen The user ID received from the display device is connected via a network to a two-dimensional code reader that reads a predetermined number (m) and generates concatenation information in which the predetermined number (m) of read data is linked. Authentication that transmits the plurality of two-dimensional codes related to the user and arrangement instruction data indicating their arrangement positions to the display device and performs user authentication using the connection information received from the two-dimensional code reader A server,
A storage unit that stores in advance a user ID for identifying a user, a reading pattern indicating an arrangement position of the two-dimensional code symbol, and a secret code that is different for each user ID;
Random number generating means for generating random numbers;
The secret code stored in the storage unit corresponding to the user ID transmitted from the display device is divided into the predetermined number (m) and each is two-dimensionally encoded, and the predetermined number (m ), A random number is obtained from the random number generation means to generate at least one random number sequence, and the random number sequence is set to the predetermined number (m) for each random number sequence. Two-dimensional code generation means for generating a number of dummy two-dimensional codes obtained by dividing each of the generated random numbers into two-dimensional codes and multiplying the number of columns of the generated random number sequence by the predetermined number (m);
An instruction to acquire the read pattern based on the user ID transmitted from the display device from the storage unit and arrange each of the user two-dimensional codes along the arrangement position indicated by the read pattern; Two-dimensional code arrangement designation means for generating the arrangement instruction data including an instruction to arrange each dimension code at a position other than the arrangement position;
The plurality of two-dimensional codes comprising the predetermined number (m) of user two-dimensional codes and the number of columns of the generated random number sequence multiplied by the predetermined number (m); Two-dimensional code output means for transmitting arrangement instruction data to the display device;
Authentication means for determining whether or not user authentication is successful based on whether or not there is a secret code stored in the storage means that matches the connection information transmitted from the two-dimensional code reader. Authentication server to do. Before the two-dimensional code generation means divides the secret code into the predetermined number (m), the secret code is encrypted by a predetermined encryption method, and the predetermined number (m) is used for each random number sequence. An encryption means for encrypting the sequence of random numbers with the predetermined encryption method,
The said authentication means is further provided with the connection information decoding means which decodes the connection information transmitted from the said two-dimensional code reader by the decoding system corresponding to the said predetermined encryption system. Authentication server. It further comprises time output means for outputting the current time,
The encryption means encrypts the secret code including time information acquired from the time output means,
The authentication means includes
Information separating means for separating time information and secret data from the connection information decrypted by the connection information decoding means;
Obtaining the current time from the time output means, performing first user authentication as to whether or not the time from the time of the separated time information to the current time is within a predetermined time, and further, the separated secret The authentication server according to claim 2, further comprising two-step authentication means for performing second user authentication as to whether or not a secret code matching data is stored in the user DB.   4. The two-dimensional code arrangement specifying means adds an instruction to arrange the user two-dimensional code and the dummy two-dimensional code in a two-dimensional matrix to the arrangement instruction data. The authentication server described in any one of the items.   The two-dimensional code arrangement designation means duplicates the user two-dimensional code or the dummy two-dimensional code, and at the time of generating the arrangement instruction data, the duplicated user two-dimensional code or duplicate dummy two-dimensional code is The authentication server according to any one of claims 1 to 4, wherein an instruction to arrange at a position other than an arrangement position is added to the arrangement instruction data.   The two-dimensional code arrangement designating unit is configured to provide an instruction to arrange one user two-dimensional code and at least one dummy two-dimensional code per screen display, and the predetermined number (m) of screen transitions. 6. The authentication server according to claim 1, wherein an instruction to be performed is added to the arrangement instruction data. A display device that images each of a plurality of two-dimensional codes and arranges each of the two-dimensional code symbols in accordance with an arrangement instruction and displays the two-dimensional code symbols on the screen, and operates the plurality of the two-dimensional code symbols arranged on the screen to the user The user ID received from the display device is connected via a network to a two-dimensional code reader that reads a predetermined number (m) and generates concatenation information in which the predetermined number (m) of read data is linked. For transmitting the plurality of two-dimensional codes related to the user and arrangement instruction data indicating their arrangement positions to the display device and performing user authentication using the connection information received from the two-dimensional code reader In addition, a communication means for transmitting and receiving data, a user ID for identifying the user, and a reading pattern indicating the arrangement position of the two-dimensional code symbol. And over down, the computer of the authentication server comprising a storage unit that stores the advance in association with different secret code for each user ID, and
Random number generating means for generating random numbers,
The secret code stored in the storage unit corresponding to the user ID transmitted from the display device is acquired from the storage unit, and the secret code is encrypted by a predetermined encryption method to generate encrypted user data. In addition, the random number is obtained from the random number generation means to generate at least one random number sequence, and the random number sequence is encrypted for each random number sequence by the predetermined encryption method to generate encrypted dummy data. Encryption means to
The encrypted user data is divided into the predetermined number (m) and each is two-dimensionally encoded to generate the predetermined number (m) of user two-dimensional codes, and the encrypted dummy data is converted into the predetermined number (m). Two-dimensional code generation means for generating a number of dummy two-dimensional codes by dividing each of the generated random numbers into two-dimensional codes and multiplying the number of columns of the generated random number sequence by the predetermined number (m) ,
An instruction to acquire the read pattern based on the user ID transmitted from the display device from the storage unit and arrange each of the user two-dimensional codes along the arrangement position indicated by the read pattern; Two-dimensional code arrangement specifying means for generating the arrangement instruction data including an instruction to arrange each dimension code at a position other than the arrangement position;
The plurality of two-dimensional codes comprising the predetermined number (m) of user two-dimensional codes and the number of columns of the generated random number sequence multiplied by the predetermined number (m); Two-dimensional code output means for causing the display device to transmit arrangement instruction data to the communication means; and
The concatenation information transmitted from the two-dimensional code reader is decrypted by a decryption method corresponding to the predetermined encryption method to obtain secret data, and the secret code stored in the storage means that matches the secret data is Authentication means for determining whether or not the user authentication is successful depending on whether or not there is,
User authentication program to function as An authentication system comprising an authentication server that performs user authentication, an input display device that displays an image on a screen, and a two-dimensional code reader,
The input display device
An input means for inputting a user ID from a user;
Communication means for transmitting and receiving data to and from the authentication server;
Display means for converting a two-dimensional code into a two-dimensional code symbol and arranging and displaying a plurality of the two-dimensional code symbols on a screen in accordance with an arrangement instruction;
The two-dimensional code reader is
An operation means for receiving an operation from the user;
Two-dimensional code reading means, which is operated by the user to read a two-dimensional code symbol displayed on the screen of the input display device to obtain a predetermined number (m) of read data;
Connection information generating means for connecting the predetermined number (m) of the read data to generate connection information;
Transmission means for transmitting data to the authentication server,
The authentication server is
A communication means for transmitting and receiving data to and from the input display device and receiving data from the two-dimensional code reader;
Storage means for preliminarily storing a user ID for identifying the user, a reading pattern indicating an arrangement position of the two-dimensional code symbol, and a secret code that is different for each user ID;
Random number generating means for generating random numbers;
Acquiring the secret code stored in the storage unit corresponding to the user ID transmitted from the input display device, encrypting the secret code with a predetermined encryption method, and generating encrypted user data A cipher that obtains a random number from the random number generation means and generates at least one random number sequence, and encrypts the random number sequence by the predetermined encryption method for each random number sequence to generate encrypted dummy data And
The encrypted user data is divided into the predetermined number (m), each of which is two-dimensionally encoded to generate the predetermined number (m) of user two-dimensional codes, and the encrypted dummy data is encrypted. Each dummy data is divided into the predetermined number (m) and each is two-dimensionally encoded, and the dummy two-dimensional code is generated by multiplying the number of columns of the generated random number sequence by the predetermined number (m). Two-dimensional code generation means for
An instruction to acquire the read pattern based on the user ID transmitted from the input display device from the storage unit, and to arrange each of the user two-dimensional codes along an arrangement position indicated by the read pattern; and the dummy Two-dimensional code arrangement designation means for generating arrangement instruction data including an instruction to arrange each two-dimensional code at a position other than the arrangement position;
The plurality of two-dimensional codes comprising the predetermined number (m) of user two-dimensional codes and the number of columns of the generated random number sequence multiplied by the predetermined number (m); Two-dimensional code output means for transmitting arrangement instruction data to the input display device;
The concatenation information transmitted from the two-dimensional code reader is decrypted by a decryption method corresponding to the predetermined encryption method to obtain secret data, and the secret code stored in the storage means that matches the secret data is An authentication system comprising: authentication means for determining whether or not the user authentication is successful depending on whether or not there is. The input display device
The display means arranges a plurality of pseudo two-dimensional code symbols and displays them on the screen in a selectable manner,
Read pattern acquisition means for acquiring an arrangement position of the pseudo two-dimensional code symbol as a read pattern by selecting the pseudo two-dimensional code symbol by the user via the input means;
The authentication server is
A secret code generating means for acquiring the user ID and the reading pattern transmitted from the input display device and generating a secret code including them;
9. The authentication system according to claim 8, further comprising: a user registration unit that associates the user ID, the reading pattern, and the secret code with each other and stores them in the storage unit.

Images