JPH0535677A - Authentication system - Google Patents

Abstract

PURPOSE:To prevent that a password leaks in an unfair way by providing a password correct/error decision deciding means, a penalty calculating means and a password input request means. CONSTITUTION:A password correct/error decision deciding means 2 has a means 3 to count and store the frequency to input erroneously a password and a means 4 to count and store the number of erroneous characters in the inputted password. A penalty calculating means 5 calculates a penalty P which increases as the input frequency and the number of the erroneous characters increase and decreases by the input of the correct password, and an input request means 7 requests the inputting person to input the correct password until the penalty P becomes zero. Thus, it can be prevented that the password in an unfair way leaks, and even when the above person to know the correct password repeats the simple input error, the input of the correct password does not become impossible and on the other hand, the possibility that an evil-minded third person not knowing the correct password can appropriate the correct password is lowered.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication method for preventing unauthorized leakage of a password in a system for checking a user's qualification with a password.

[0002]

2. Description of the Related Art Recently, in cash dispensers and computers of banks, a system for checking a user's qualification by allowing the user to input a personal identification number and a password has become widespread. In this type of system, an authentication method is required to prevent the password from being stolen by a malicious person.

In the conventional authentication method, a malicious person can reach a correct password by inputting a large number of times while arbitrarily changing the number. Therefore,
In order to prevent this, when the number of times an incorrect password is input exceeds a prescribed number of times, a method has been adopted in which further input is impossible.

However, according to this method, even if the person who knows the correct password repeatedly makes a simple input error, if the input reaches the specified number of times, it becomes impossible to input any more, and as a result, the correct password is input. You lose the chance to type. On the other hand, malicious others have the chance to steal passwords by entering them within the specified number of times.

[0005]

As described above, in the conventional authentication method, even if the person who knows the correct password repeats a simple input error a prescribed number of times, the correct password cannot be input. There is a drawback that even a person who does not know the correct password can steal the correct password within the prescribed number of input times.

The present invention eliminates the drawbacks of the conventional authentication methods described above, and the person who knows the correct password does not become unable to enter the password even if he / she makes a simple input error, while the correct password is known. The purpose is to provide an authentication method in which there is a low possibility that someone else can steal the correct password.

[0007]

The authentication method according to the present invention is a system for checking the qualification of a user by allowing the user to input a password, and means for determining whether the entered password is correct or not. It is provided with means for calculating a penalty according to whether the password is correct or incorrect, and means for requesting the input person to input a correct password according to the calculated penalty.

The password correctness determining means has means for counting and storing the number of times the password is input by mistake, and means for counting and storing the number of incorrect characters in the input password. And a penalty that increases as the number of erroneous characters increases and decreases with the input of the correct password, and the input request means is configured to require the enterer to enter the correct password until the penalty becomes zero. It

[0009]

According to the authentication method having the above-mentioned configuration, in the system for checking the qualification of the user by prompting the user to enter the password, the user is penalized according to the input error until the penalty becomes zero. Require users to enter the correct password.

The penalty is calculated and stored based on the number of incorrect password inputs and the number of incorrect characters. . An input error by the person who knows the correct password is a simple one, such as one character difference, and the penalty is small even if it is repeated, and the penalty is eliminated by immediately noticing and entering the correct password the number of times corresponding to the penalty.

However, a malicious person who does not know the correct password has a large number of incorrect characters and the number of times of input, and therefore the penalty is increased each time the input is requested, and as a result, it is almost impossible to obtain the authentication. Become.

[0012]

Embodiments of the present invention will now be described in detail with reference to the drawings. FIG. 1 shows the configuration of the present invention. Figure 1
In, the input unit 1 is where the user inputs the password. The password correctness determination unit 2 determines whether the input password is correct.

The password correctness determination unit 2 outputs a signal indicating whether the password is correct or incorrect to the penalty calculation unit 5. If the password is incorrect, the number of error characters is output to the error character number storage unit 4, and the input count (error count) is output to the error count storage unit 3.

The penalty calculation unit 5 sends a signal indicating whether the password is correct or incorrect from the password correctness determination unit 2, a signal from the error count storage unit 3 indicating the number of errors, and a signal from the error character number storage unit 4 indicating the number of error characters. Input,
Based on these pieces of information, a penalty P indicating the degree of user's password input error is calculated.

The penalty P calculated by the penalty calculation unit 5 is stored in the penalty storage unit 6. The penalty storage unit 6 outputs the penalty P to the input request determination unit 7.
When the penalty P is not zero, the input request determination unit 7
Send an input request signal to the input unit 1. When the input unit 1 receives the input request signal, the input unit 1 prompts the user to input the password again.

FIG. 2 is a flow chart showing the operation of the circuit of FIG. In the flowchart of the password check shown in FIG. 2, P is a penalty, N is the number of inputs, E is the number of error characters, and M is an addition mode for calculating the penalty. In step (S) 2, P and N are set to zero. Also,
The addition mode M is set to 1 to 4.

In S3, the password is input to the input unit 1. The password correctness determination unit 2 increments N by 1 and outputs it to the number-of-errors storage unit 3, counts the number of error characters E, outputs this to the number-of-error-characters storage unit 4, and stores each.

The password correctness determination unit 2 notifies the penalty calculation unit 5 of the determination as to whether the password is correct (S).
4). The penalty calculation unit 5 calculates the penalty P as follows. If the password is incorrect, the penalty calculation unit 5 performs different calculations depending on the addition mode as described below.

(1) In the case of mode 1 P = previous P +
1 (S6) (2) In the case of mode 2 P = previous P + error character count E
(S71) (3) In the case of mode 3. P = previous P + total number of inputs N so far N (S8) (4) In the case of mode 4. P = previous P + error character count E
* Total number of inputs N up to now N (S9)

If the password is correct, the penalty calculation unit 5 checks the penalty P stored in the penalty storage unit 6 (S5). If the penalty P is 0, the password check ends.

If the penalty P is not zero even if the password is correct, the penalty calculation unit 5 decrements the penalty P by 1 (S10). The penalty P obtained by the penalty calculation unit 5 as described above is stored in the penalty storage unit 6. The input request determination unit 7 determines that the penalty P stored in the penalty storage unit 6 is not zero,
An input request is sent to the input unit 1.

As mentioned above, the penalty P decreases only when the correct password is entered. Therefore, it is easy for the person who knows the correct password to eliminate the penalty. For example, the correct password is "1
In the case of “111”, if “1112” is input by mistake, the penalty becomes P = 1 and the input request is made.

If "1112" is further input by mistake, the penalty becomes P = 2 and the input request is made again. If the correct password "1111" is entered here, the penalty is reduced to 1, but a further input request is made. If you enter the correct password "1111" again, the penalty is 0
And the password check ends.

On the other hand, it is impossible for a malicious person who does not know the correct password to eliminate the penalty. Although the present embodiment is configured so that any one of the four modes can be selected, it goes without saying that only one of the modes may be selected. In that case, one or both of the error number storage unit 3 and the error character number storage unit 4 become unnecessary.

[0025]

According to the present invention, in a system for checking a user's qualification by using a password, the correct password cannot be input even if the person who knows the correct password repeats a simple input error. On the other hand, it is extremely unlikely that a malicious person who does not know the correct password can steal the correct password.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of the present invention.

FIG. 2 is a flowchart showing the operation of the present invention.

[Explanation of symbols]

1 Input section 2 Password correctness judgment part 3 Error count storage 4 Error character number storage 5 Penalty calculation section 6 Penalty memory 7 Input request judgment section P penalty N input count E Number of error characters M addition mode S1-S11 steps

Claims (2)

[Claims] 1. A system for checking the qualification of a user by prompting the user to enter a password, means for determining whether the entered password is correct, and means for calculating a penalty based on whether the entered password is correct. An authentication method, comprising means for requesting an input person to input a correct password according to the calculated penalty. 2. The password correctness determining means includes means for counting and storing the number of times the password is input incorrectly, and means for counting and storing the number of incorrect characters in the input password, and the penalty calculating means. Calculates a penalty that increases as the number of erroneous inputs and the number of erroneous characters increases and decreases with the input of a correct password, and the input requesting means inputs the correct password to the input person until the penalty becomes zero. The authentication method according to claim 1, wherein the authentication method is requested.