Terminal device authentication method, terminal device and program

Disclosed is an authentication method for a terminal device having an authentication function. The authentication method for a terminal device which performs authentication when a security lock is released so as to operate a security-locked function includes comparing a plurality of authentication information used for the authentication with a plurality of authentication keys corresponding to the plurality of authentication information input in accordance with a function operation request so as to perform authentication, and when the authentication is successful, releasing the security lock so as to operate the function. The plurality of authentication information and the plurality of authentication keys respectively include at least one image.

TECHNICAL FIELD

The present invention relates to a terminal device, and in particular, to an authentication method for use in image authentication of a terminal device, a terminal device, and a program.

BACKGROUND ART

In recent years, in a small terminal device, such as a mobile phone or the like, information leakage of terminal data and the like due to loss or misplacement is increasing, so security countermeasures for information stored in the terminal device have become important.

As the related art of the invention, a technique is known for taking a security countermeasure regarding a terminal device, for example, authentication (knowledge authentication) based on knowledge information, such as a personal identification number or a password, or face authentication, or the like for protecting data stored in the terminal device.

Patent Document 1 describes a security system capable of preventing unauthorized use by a malicious third person. In this security system, connection between a mobile phone and a cradle is detected, the characteristic points of authentication image data recorded in advance are compared with the characteristic points of image data captured by the camera of the mobile phone, and when both are identical, predetermined processing, such as charging of the mobile phone or the like, is performed.

DISCLOSURE OF THE INVENTION

As described above, authentication functions, such as knowledge authentication, face authentication, and the like, are generally known as the security countermeasures in a terminal device, such as a mobile phone or the like. However, such authentication functions relate to setting and releasing for security-locking the mobile phone (mobile device). Accordingly, if security is released, all functions are available, and unauthorized use by a third person becomes possible.

The security system described in Patent Document 1 is to prevent unauthorized use by a third person in relation to predetermined processing when the mobile phone is connected to the cradle, not to prevent unauthorized use in relation to respective functions of the mobile phone. For this reason, it is impossible to prevent unauthorized use of the third person in relation to the respective functions, and the security property is insufficient.

OBJECT

It is an object of the invention to provide an authentication method for a terminal device, a terminal device, and a program capable of improving a security property in using the functions of the terminal device.

According to the invention, there is provided an authentication method for a terminal device which performs authentication when a security lock is released so as to operate a security-locked function. The authentication method includes comparing a plurality of authentication information used for the authentication with a plurality of authentication keys corresponding to the plurality of authentication information input in accordance with a function operation request so as to perform authentication, and when the authentication is successful, releasing the security lock so as to operate the function. The plurality of authentication information and the plurality of authentication keys respectively include at least one image.

According to the invention, there is provided a terminal device that performs authentication when a security lock is released so as to operate a security-locked function. The terminal device includes a storage unit storing a plurality of authentication information used for the authentication, an input request unit requesting the input of a plurality of authentication keys corresponding to the plurality of authentication information in accordance with a function operation request, an authentication unit comparing the plurality of input authentication keys with the plurality of authentication information so as to perform authentication, and an activation unit releasing the security lock so as to operate the function when the authentication is successful. The plurality of authentication information and the plurality of authentication keys respectively include at least one image.

According to the invention, there is provided a program for controlling a terminal device which performs authentication when a security lock is released so as to operate a security-locked function. The program includes requesting the input of a plurality of authentication keys corresponding to a plurality of authentication information used for the authentication in accordance with a function operation request, comparing the plurality of input authentication keys with the plurality of authentication information so as to perform authentication, and when the authentication is successful, releasing the security lock so as to operate the function. The plurality of authentication information and the plurality of authentication keys respectively include at least one image.

According to the invention, a plurality of authentication information and a plurality of authentication keys including at least one image can be set relative to the activation of functions of the terminal device, so the level of security in relation to the relevant function is improved.

BEST MODE FOR CARRYING OUT THE INVENTION

An embodiment of the invention will be described with reference to the drawings. In the drawings, the same constituent elements are represented by the same reference numerals, and description will not be repeated.

Embodiment of the Invention

Description of Configuration

An application to a mobile phone terminal as an embodiment of an authentication method for a terminal device, a terminal device, and a program of the invention will be described.

FIG. 1is a diagram showing the exterior configuration of a mobile phone according to an embodiment of the invention. A mobile phone100includes a display section101, a keyboard102, a speaker103, and a microphone104at the front surface of a housing, and also includes a camera105at the rear surface of the housing. This example shows a configuration example of an integrated housing, but a folder or sliding type housing may be used. The display section101can perform menu display, input screen display for inputting a personal identification number or image information as an authentication key, and display of various kinds of information, such as mails or the like, and user data. The speaker103and the microphone104are used for a telephone call or the like. The camera105is partially exposed from a housing100aof the mobile phone100to the outside and used to capture various images, such as still images or motion images including landscapes or facial images.

FIG. 2is a diagram showing main parts of the circuit configuration of the mobile phone of the invention. The configuration and functions of respective sections of the mobile phone100will be described below. The mobile phone100of this embodiment has mounted therein a central processing unit (CPU)12constituting a computer serving as a control section. The CPU12is connected to the respective sections in the device through a bus13.

A read only memory (ROM)14stores various control programs executed by the CPU12or fixed data, such as a dictionary for use in Japanese character conversion or the like. The CPU12reads a program stored in the ROM14, is controlled by the read program, and controls the functions of the respective sections.

A work memory15is composed of a random access memory (RAM) and stores data which is temporarily required when the CPU12executes a program.

A camera section16can read a two-dimensional code, such as a barcode or a QR code, or perform macro photographing for use in handwritten characters, numerals, and figures (handwritten information) recognition. In order to realize two-dimensional code read processing or handwritten information recognition processing, programs for executing the processing may be stored in the ROM14or the like, and the relevant program may be executed by the CPU12. After the handwritten information recognition processing, processing for converting recognized characters into character codes may be executed.

A characteristic point extraction section17is an engine that extracts characteristic points from a still image captured by the camera section16. This engine may be composed of a device by hardware or may be realized by software processing using the CPU12. The characteristic point extraction section17can read a still image attached to a mail, a still image downloaded from a site, and a still image stored in an external memory, as well as the still image captured by the camera section16, so as to extract characteristic points. A microphone section18is a device that is used to manage time (clock) and notifies of an event at a set time.

A key input section19is used to input numerals or characters and to select and call (activate) functions, such as data folders or data files, application programs, or the like.

A user memory20is a storage section that stores data files created by a user or data files acquired from the outside, such as address book data, still image data, mail data, and the like. The user can add or delete data files with respect to the user memory20.

A display control section21is a control circuit that controls display of a display section22. The display section22is arranged at the front surface of a device main body (not shown), and is a display device, such as a monochrome or color liquid crystal panel, an organic electrofluorescent (EL), or the like.

A transmitting/receiving section23is a circuit that performs data transmission/reception in a wireless manner and is mainly used to perform communication with a base station.

An external memory slot24is a device that allows an external storage device, such as an SD card, a mini SD, a micro SD, or the like, to be attached/detached to/from the mobile phone100. The external device can store various data files, such as address book data, still image data, mail data, and motion images. Data can be copied or moved to a memory in the mobile phone100.

Next, an authentication method of the mobile phone100of this embodiment will be described in detail. The authentication method for a terminal device which performs authentication when a security lock is released so as to operate a security-locked function may include comparing a plurality of authentication information used for authentication with a plurality of authentication keys corresponding to a plurality of authentication information input in accordance with a function operation request, and when the authentication is successful, releasing the security lock so as to operate the function. The plurality of authentication information and the plurality of authentication keys may respectively include at least one image.

The user memory20or the like of the mobile phone100stores various data files, such as an address book, schedule, mails, and captured images. If the data files are not security-locked, a person who acquires the mobile phone100can easily read or use data.

This embodiment is not limited to a security lock for the use as a whole, such as at the time of power supply to the mobile phone100, but a security lock can be provided in units of a function (in units of a target function) relative to the use of data files, data folders, application programs, and the like. That is, a function subject to a security lock may be an application program which can be executed on the terminal device. Further, a function subject to a security lock may be at least one of data folders and data files which can be opened on the terminal device. Specifically, a security lock can be provided for the use in units of a data file or a data folder obtained by collecting individual data, or in units of a mailer, a browser, a scheduler, an application program, such as electronic payment, or the like.

Therefore, the mobile phone100of this embodiment requests the user to input knowledge information, such as a personal identification number or a password, or an image as an authentication key at the time of the use of various data files stored in the user memory20or the like, or at the time of the use or activation of application programs stored in the user memory20or the ROM14.

For this reason, the user memory20or the like stores in advance identification information for identifying the function of a data file, a data folder, an application program, or the like in association with authentication information serving as comparison data which is used in authentication for releasing a security lock. An authentication type (still image, personal identification number, or the like) may be stored in association with the functions and the authentication information.

The authentication key and authentication information may be images stored in the user memory20. In this case, first characteristic points representing shape characteristics of captured objects on images included in the authentication keys and second characteristic points representing shape characteristics of captured objects on images included in comparison data may be extracted, and the first characteristic points and the second characteristic points may be compared with each other so as to perform authentication. In this case, the same authentication operation can be performed based on images stored in an external storage device, such as an SD card or the like, inserted into the external memory slot24.

Examples of information with a function, an authentication type, and authentication information associated with each other stored in the user memory20in advance will be described with reference toFIGS. 3,4, and5.

FIG. 3is a diagram showing examples of an authentication type and authentication information when a function subject to a security lock is in units of a data folder. With regard to a still image of data folder storage information, an address book, a scheduler, a mail, a motion image, . . . , an authentication type and authentication information are stored in association with each other.

For example, with regard to the use of a data folder of still images, a personal identification number and still image authentication of a user's face are set as an authentication type, and authentication information includes a personal identification number 1234 and a still image1of the user's face. With regard to the use of a data folder of an address book, still image authentication of the user's face and authentication of a personal identification number are set as an authentication type, and authentication information includes the same still image1and personal identification number 1234. With regard to the use of a data folder of a schedule, still image authentication of a face and still image authentication of an object, such as a personal possession or the like, are set as an authentication type, and authentication information includes the still image1and a still image2. With regard to the use of a data folder of mails, authentication by a personal identification number and still image authentication of a stored image are set as an authentication type, and authentication information includes the personal identification number 1234 and a still image3. With regard to a motion image, no authentication type and authentication information are set, and no authentication is required for the use of the motion image.

FIG. 4is a diagram showing examples of an authentication type and authentication information when a function subject to a security lock is a data file. With regard to individual data, that is, first still image data1, third mail data3, fifth schedule5, 21st address book21, a second motion image2, . . . of stored information, authentication types are stored in association with authentication information.

For example, with regard to the use of still image data1, two kinds of still image authentication are set as an authentication type, and authentication information includes a still image1and a still image3. With regard to the use of the schedule5, still image authentication and authentication by two personal identification numbers are set as an authentication type, and authentication information includes a still image2, a number 9876, and a number 1234. With regard to the use of the address book21, a personal identification number and still image authentication are set as an authentication type, and authentication information includes a number 1929 and a still image5. With regard to the motion image2, no authentication type and authentication information are set, and no authentication is required for the use.

FIG. 5is a diagram showing examples of an authentication type and authentication information when a function subject to a security lock is an application program. With regard to a camera, a mailer, a browser, a scheduler, electronic payment, in units of an application function, authentication types are stored in association with authentication information.

For example, with regard to the use of the mailer, authentication by a personal identification number and still image authentication are set as an authentication type, and authentication information includes a number 9876 and a still image4. With regard to the use of the browser and the scheduler, a combination and an input sequence of two kinds of still image authentication are set as an authentication type, and authentication information includes a still image3and a still image4, and the still image4and the still image3, respectively. With regard to the use of the electronic system, three kinds of still image authentication are set as an authentication type, and authentication information includes a still image1, a still image2, and the still image3. With regard to the camera, no authentication type and authentication information are set, and no authentication is required for the use.

FIG. 6is a diagram showing a processing function of the mobile phone100according to the embodiment of the invention. The mobile phone100includes a control section200, an input section300, and a storage section400as the basic configuration of functional units. The CPU12of theFIG. 2forms the control section200, the key input section19or the camera section16ofFIG. 2forms the input section300, and the user memory20or the like ofFIG. 2forms the storage section400.

The mobile phone100of this embodiment is a terminal device that performs authentication when a security lock is released so as to operate a security-locked function. The mobile phone100may include the storage section400storing a plurality of authentication information used for the authentication, an input request section (input request unit)210requesting the input of a plurality of authentication keys corresponding to a plurality of authentication information, and an authentication section (authentication unit)220comparing the plurality of input authentication keys with the plurality of authentication information so as to perform authentication, and an activation section (activation unit)230releasing the security lock so as to operate the function when the authentication is successful. The plurality of authentication information and the plurality of authentication keys may respectively include at least one image.

In the mobile phone100of this embodiment, the entire portion or a portion of the configuration may be realized by hardware or may be realized by a computer program (or a program code) for causing the control section200(the CPU12) to execute processing. The control section200(the CPU12) reads the computer program from the storage section400(the ROM14or the like) and executes the computer program.

The computer program is a program for controlling the terminal device which performs authentication when a security lock is released so as to operate a security-locked function. The computer program may include input request processing for requesting the input of a plurality of authentication keys corresponding to a plurality of authentication information used for authentication in accordance with a function operation request, authentication processing for comparing the plurality of input authentication keys with the plurality of authentication information so as to perform authentication, and activation processing for releasing the security lock so as to operate the function when the authentication is successful. The plurality of authentication information and the plurality of authentication keys may respectively include at least one image.

The control section200functions as the input request section210which, when the user performs an input operation310to select or activate a data folder, a data file, or an application program, determines whether an authentication type is a personal identification number or a still image with reference to information410of a corresponding authentication type of the storage section400, and displays an input request screen for requesting the input of an authentication key on the display section22. The control section200also functions as an authentication section220which, when the user inputs a personal identification number in response to the input request or performs an input operation320of an authentication key by inputting an image captured by the camera or selecting a stored image, compares the input authentication key with authentication information in terms of characteristic points or the like with reference to corresponding authentication information420of the storage section400. The control section200also functions as an activation section230which, when the authentication is successful, starts to select or activate a data folder, a data file, or an application program on the basis of stored information430. These functions are realized by a control program read from the ROM14by the CPU12.

The operation of the embodiment of the authentication method, the terminal device, and the program according to the invention will be described.

First, processing for setting a security lock in units of a function according to this embodiment will be described.FIG. 7is a diagram showing a processing example for setting authentication information and authentication keys for a plurality of functions of the mobile phone100. In setting of authentication information and authentication keys for the functions of the mobile phone100, first, if an initial target function is selected (Step S11), and the user's face is photographed by the internal camera, a stored image is selected, or a personal identification number is input as authentication information and an authentication key (Step S12), the CPU12of the mobile phone100transfers the captured image or the stored image to the characteristic point extraction section17so as to extract a characteristic point (Step S13), and stores the extracted characteristic point, the personal identification number, and the like as authentication information in the user memory20, together with the authentication type (Step S14). Next, it is determined whether or not subsequent setting of authentication information and authentication exists with respect to the initial target function, and if subsequent authentication information and authentication key exist (YES in Step S15), the process returns to Step S12, and the same setting processing is repeated (Steps S12to S15). If no subsequent setting of authentication information and authentication key exists (NO in Step S15), when there is a target function for which additional authentication information and an authentication key are set (YES in Step S16), the process returns to Step S11, and the above-described setting processing is repeated in the same manner (Steps S11to S16). If there is no target function for which additional authentication information and an authentication key are set (NO in Step S16), the setting of the security lock ends.

Next, an authentication operation of this embodiment will be described.

FIG. 8is a diagram showing a processing example of an authentication operation based on different authentication information and authentication keys between the functions of the mobile phone100. If the user selects any one function of security-locked data folders, data files, application programs, and the like of the mobile phone100(Step S21), the control section200requests the input of an authentication key and displays the input request on the display section22(Step S22). For example, if the user photographs his/her face (an object to be captured) by the camera section16(an internal camera of the terminal device) (Step S23), the control section200performs authentication processing for extracting the characteristic point of the image by the characteristic point extraction section17(Step S24), and comparing the characteristic point with the characteristic point of the same still image stored as authentication information read from the storage section400in advance (Step S25). If the authentication is successful (YES in Step S26), it is determined whether or not next authentication exists with respect to the relevant selected function, and when next authentication is required (YES in Step S27), the process returns to Step S22, and the same processing as described above is repeated (Steps S23to S27). If all kinds of authentication set in advance are successful (No in Step S27), the control section200operates the relevant function, for example, allows reading of the selected data folder or data file, or activates or ends the application program (Step S28).

In the authentication processing described above, when the authentication has failed once (NO in Step S26), the control section200rejects the operation of the relevant function and displays an indication on the display section22or the like. When the authentication has failed (NO in Step S26), the process may return to Step S22, the user may be requested to input the authentication key again, and when the authentication has failed a predetermined number of times in the same input, the operation of the relevant function may be rejected.

Although in the above description, an example where an image captured by the internal camera is input as an authentication key, as shown inFIGS. 3,4, and5, a personal identification number may be input or a stored image may be selected through the key input section19.

In this case, it is preferable that, when requesting the user to input an authentication key in accordance with a function selected by the user with reference to information of the storage section400(Step S22), the control section200can perform processing for displaying an input screen of a personal identification number on the display section22or for requesting the user to select a stored image, and when inputting an authentication key (Step S23), the user can input a personal identification number or select a stored image through the input section300.

As described above, according to this embodiment, a plurality of authentication information and a plurality of authentication keys may include an image, or a combination of an image and knowledge information including at least one of a personal identification number and a password, and a plurality of images. Therefore, if authentication priority or the like is set, security can be suitably set for each function with different strength.

In this embodiment, the characteristic points are extracted and used for authentication processing based on still images, so it is possible to reduce authentication information and also to limit the allowable range at the time of authentication. For this reason, it is possible to achieve high security using a still image itself while reducing the amount of data to be stored, suppressing the memory usage, and suppressing a processing burden.

Other Embodiments of the Invention

In the description about the operation of the mobile phone100, with regard to an object to be captured, all of photographable objects can be used as authentication information, and a captured object on an image includes at least one of a biological object, a two-dimensional code, and handwritten information. For example, a biological object, such as fingerprint, digital vein, retina, or the like, an object that the user carries everyday, for example, a ball pen, a pass, a license, or the like, may be used as an object to be photographed. Further, handwritten information may be used as an object to be photographed.

FIG. 9is a diagram showing an example where handwritten information is read and input as an authentication key. As shown inFIG. 9(a) to (c), a card on which a signature or a figure is written may be used, in addition to handwritten characters or numerals. The user carries this card as a security card, photographs the card at the time of authentication, and combines handwriting or figures so as to release security. Further, if a film or the like is used, color information may also be used for authentication. As described above, if the mobile phone100can recognize handwritten information by using the camera section16and convert the recognized characters into character codes, knowledge authentication can be performed with the character codes as an authentication key. In addition, if the mobile phone100can read a two-dimensional code, such as a barcode or a QR code, by using the camera section16and convert the read two-dimensional code into an information code, knowledge authentication can be performed with the information code as an authentication key.

As the still image, a photographed image stored inside or outside the mobile phone100may be selected and used. For example, an image acquired from an external storage device (an external memory, such as an SD, mini SD, or micro SD card) connected to the external memory slot24may be input as an authentication key. Therefore, a still image stored in the external memory in advance can be used for authentication.

In addition to the still image captured by the camera, an image received through a communication network which is connected through the transmitting/receiving section23, for example, an image downloaded from a mail or a Web site may be input as an authentication key. Therefore, at the time of the authentication operation, an image for authentication can be acquired through connection to an external server.

Security can be provided such that data can be read only at a specific place. For example, a photographed image for authentication may be provided in a data storage room of a company, and only a person who enters that place may capture an image by a camera and use the functions of the mobile phone110, for example, read secret data or the like. Therefore, double security of entrance check and image authentication can be provided. That is, with regard to information which can be read only at a specific place, a specific subject is provided at that place such that the user can photograph the subject and read information.

As described above, in this embodiment, personal identification numbers, still images, and the like are combined for each target function of the mobile phone100, so while a security function is added with minimum storage of set authentication keys, locking is provided with security at a required level. Therefore, it is possible to significantly increase an insufficient security function at the time of locking of the terminal device as a whole.

The invention is not limited to a mobile phone, and may also be applied to a terminal device, such as a PDA, a personal computer, an ATM at bank, a CD, or the like, containing personal information.

This application is the National Phase of PCT/JP2008/002417, filed Sep. 3, 2008, which claims priority based on Japanese Patent Application No. 2007-234320 filed on Sep. 10, 2007, the disclosure of which is incorporated herein by reference.