Authentication system

An authentication system includes a user authentication unit. The user authentication unit performs user authentication by combining password authentication and handwriting authentication, the password authentication being performed by collating an entire character string of a password inputted using an operation input unit and a handwriting input unit with an entire character string of a registration password stored in a storage unit, the handwriting authentication being performed by collating the handwriting information of a part of characters of the password inputted by the handwriting input unit with handwriting information of handwriting data of this inputted character stored in the storage unit.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2018-120012 filed on Jun. 25, 2018, the entire contents of which are incorporated herein by reference.

BACKGROUND

The technology of the present disclosure relates to an authentication system.

In the related art, in electronic devices requiring high level security, there is a case where handwriting of characters handwritten by a user is authenticated in order to verify the identity of the user.

In this type of electronic devices, when the electronic devices are used, it is required to handwrite a password from a predetermined input device for example. The input device, for example, is configured by a touch panel, and a password input field is displayed on the touch panel. The electronic device has a CPU that performs various processes based on input information from the input device. The CPU performs password authentication and handwriting authentication based on character data inputted from the aforementioned input device. In the password authentication, it is determined whether the character data inputted from the input device coincides with a password registered in advance. In the handwriting authentication, the features of the handwriting are extracted from data such as the shape, writing pressure, and writing speed of the inputted character, and it is determined whether the extracted features coincide with the features of handwriting of each user registered in advance.

SUMMARY

An authentication system according to one aspect of the present disclosure includes a storage unit, an operation input unit, a handwriting input unit, a password request unit, and a user authentication unit.

The storage unit stores a registration password including a character string, and handwriting information of handwriting data of the character string. The operation input unit is configured to be able to input characters of a password by a key operation. The handwriting input unit is configured to be able to input characters of a password by handwriting. The password request unit requests the input of a part of characters of a password from the handwriting input unit and requests the input of remaining characters from the operation input unit. The user authentication unit performs user authentication by combining password authentication and handwriting authentication. The password authentication is performed by collating an entire character string of the password inputted using the operation input unit and the handwriting input unit with an entire character string of the registration password stored in the storage unit. The handwriting authentication is performed by collating the handwriting information of a part of characters of the password inputted by the handwriting input unit with handwriting information of the handwriting data of this inputted character stored in the storage unit.

DETAILED DESCRIPTION

Hereinafter, an example of an embodiment will be described in detail on the basis of the drawings. It is noted that the technology of the present disclosure is not limited to the following embodiments.

Embodiment

FIG. 1is a block diagram illustrating a schematic configuration of a network system10including an authentication system1of the present embodiment. The network system10has a multifunction peripheral (MFP)20and an authentication server30that performs authentication of a user who uses the MFP20. The MFP20and the authentication server30are communicably connected to each other via a network11such as a local area network (LAN).

FIG. 2is a block diagram illustrating a schematic configuration of the MFP20. The MFP20has a control unit21that controls an overall operation thereof, a storage unit22configured by a hard disk and the like to store various pieces of data, an operation display unit23that receives an operation of a user, a printing unit24that prints an image on a recording sheet, a reading unit25that optically reads a document image, a facsimile communication unit26that performs facsimile communication via a communication line of a public telephone line and the like, and a network communication unit27that communicates with other devices (the authentication server30and the like) via the network11. The control unit21, the storage unit22, and the authentication server30to be described below constitute an authentication system1.

The control unit21is configured by a microcomputer having a CPU, a ROM, and a RAM. The control unit21switches the function of the MFP20to any one of a printer function, a scanner function, a facsimile function, and a copy function by controlling the aforementioned printing unit24, reading unit25, facsimile communication unit26, and network communication unit27.

The operation display unit23receives an input operation of the user from a touch panel23aor various operation buttons (not illustrated). The touch panel23adetects a contact of the user's finger and outputs a signal corresponding to the input operation to the control unit21.

The control unit21acquires a user ID, a password, and handwriting information thereof inputted by the user through the touch panel23a, and transmits the acquired information to the authentication server30. Then, when receiving a response indicating the success of user authentication from the authentication server30, the control unit21displays a button for performing various functions on the touch panel23aof the MFP20and allows a login to the MFP20. By so doing, the control unit21performs a user authentication process in cooperation with the authentication server30. Details of the user authentication process will be described below.

FIG. 3is a block diagram illustrating a schematic configuration of the authentication server30. The authentication server30has a control unit31, a storage unit32that stores various pieces of data, and a network communication unit33that communicates with other devices (the MFP20and the like) via the network11.

The control unit31is configured by a microcomputer having a CPU, a ROM, and a RAM. The storage unit32is configured by a hard disk and the like and is connected to the control unit31to be able to transmit and receive data. The storage unit32stores user registration data32ainputted through the touch panel23aof the MFP20.

The control unit31performs password authentication and handwriting authentication based on a password and handwriting information of a user who has received an authentication request from the MFP20and the aforementioned user registration data stored in the storage unit32. When both the password authentication and the handwriting authentication have succeeded, the control unit31transmits a response indicating the success in the user authentication to the MFP20. On the other hand, when at least one of the password authentication and the handwriting authentication has failed, the control unit31transmits a response indicating the failure in the user authentication to the MFP20. By so doing, the control unit31serves as a user authentication unit.

FIG. 4illustrates an example of the user registration data32astored in the storage unit32of the authentication server30. The user registration data32ais data obtained by associating a user ID (user identification information), a registration password, a user authority level, and handwriting information with one another, and is stored in the storage unit32in the form of table data for example.

The user ID is an arbitrary character string for identifying a user himself/herself and for example, includes five alphabetic characters in the present embodiment. The registration password is a character string assigned to each user ID and for example, includes five alphanumeric characters in the present embodiment. It is noted that characters constituting the character string include symbols and the like in addition to the alphabetic characters and the numerical characters.

As each user's authority level, two levels of authority of administrator authority and general user authority can be set as an example. The administrator authority is higher than the general user authority. In the general user authority, the use of specific functions in the MFP20is prohibited, but in the administrator authority, the use of the specific functions is permitted. The specific functions, for example, include an edition function and the like of the user registration data32a. It is noted that the authority level is not limited to the two levels of authority of administrator authority and general user authority as in the present embodiment and for example, may be three or more.

The handwriting information is information obtained by recording coordinate information of a finger tip, which moves on the touch panel23aof the operation display unit23, along the time series. It is noted that the handwriting information is not limited thereto and may be matrix data and the like obtained by extracting feature amounts related to handwriting (for example, writing pressure, a writing speed, and a handwriting shape).

Next, with reference toFIG. 5andFIG. 6, a registration process for newly registering user information in the aforementioned user registration data32a(hereinafter, referred to as a user registration process) will be described.

The user registration process is started when a setting registration button (not illustrated) displayed on the touch panel23aof the operation display unit23is pressed in a state in which the MFP20has been logged in with the administrator authority. When the control unit21of the MFP20detects that the setting registration button is pressed, the control unit21displays a user ID registration screen100(seeFIG. 5) on the touch panel23a.

The user ID registration screen100has an input box101for inputting a user ID of a user to be registered, a soft keyboard102for inputting characters to the input box101, an authority setting button103for setting an authority level of the user to be registered, and a completion button104for notifying the MFP20that the input has been completed.FIG. 6illustrates an example in which “fghij” is inputted as the user ID and the general user authority is set as the authority level of the user.

When the control unit21detects that the completion button is pressed on the user ID registration screen100, the control unit21displays a password registration screen110(seeFIG. 6) on the touch panel23a.

The password registration screen110has an input box111for inputting a password to be registered by a key operation, and a handwriting input field113for inputting the password by a handwriting operation. On the right side of the input box111, a button112displayed as a “keyboard” is provided, and when the user presses the button112, a soft keyboard is displayed on a separate screen (not illustrated) and characters can be inputted to the input box111by a keyboard operation. On the other hand, the handwriting input field113is configured with five boxes114arranged in the horizontal direction of the screen and characters are handwritten in each box114one by one. It is noted that the handwriting input includes not only the case where a character is drawn by directly contacting the touch panel23awith a finger tip, but also the case where a character is drawn on the touch panel23aby using a device such as a touch pen.

Below the handwriting input field113, a completion button115for notifying the MFP20that the input of the password has been completed is provided.

Next, with reference to the flowcharts ofFIG. 7AandFIG. 7B, an example of the aforementioned user registration process will be described. The user registration process is performed by cooperation between the control unit21of the MFP20and the control unit31of the authentication server30(when each of the control units21and31executes a program in the ROM).

In step S1, the control unit21of the MFP20determines whether the user registration button displayed on the touch panel23ais pressed. When this determination is NO, the control unit21returns, and when this determination is YES, the control unit21proceeds to step S2.

In step S2, the control unit21determines whether a user currently logged in to the MFP20has the administration authority. This determination is performed by reading an authority level corresponding to the user by referring to the user registration data32ain the authentication server30. When this determination is NO, the control unit21proceeds to step S3to display a message indicating that the user has no registration authority on the touch panel23a, and then returns. On the other hand, when this determination is YES, the control unit21proceeds to step S4.

In step S4, the control unit21of the MFP20instructs the operation display unit23to display the user ID registration screen100(seeFIG. 5) on the touch panel23aof the MFP20.

In step S5, the control unit21of the MFP20determines whether a pressing signal of the completion button is received from the touch panel23a. When this determination is NO, the control unit21returns to step S4, and when this determination is YES, the control unit21proceeds to step S6.

In step S6, the control unit21of the MFP20instructs the operation display unit23to display the password registration screen110(seeFIG. 6) on the touch panel23aof the MFP20.

In step S7, the control unit21of the MFP20determines whether the input of a password to the input box111by the operation of the soft keyboard has been completed. When this determination is NO, the control unit21performs the process of the present step S7again, and when this determination is YES, the control unit21proceeds to step S8.

In step S8, the control unit21of the MFP20determines whether the handwriting input of the password to the handwriting input field113has been completed. When this determination is NO, the control unit21performs the process of the present step SB again, and when this determination is YES, the control unit21proceeds to step S9.

In step S9, the control unit21of the MFP20determines whether the input password by the operation of the soft keyboard (step S7) and the input password by the handwriting (step SB) coincide with each other. When this determination is NO, the control unit21proceeds to step S10to display an error and then returns to step S6to urge re-input. On the other hand, when this determination is YES, the control unit21proceeds to step S1l(seeFIG. 7B).

In step S11, the control unit21transmits the user ID inputted in step S5, the password inputted in step S7, and handwriting information of the password handwritten in step S7from the MFP20to the authentication server30.

In step S12, the control unit31of the authentication server30receives the user ID, the password, and the handwriting information transmitted from the MFP20, registers the received information in the user registration data32astored in the storage unit32, and then returns.

Next, with reference toFIG. 8toFIG. 10, a user authentication process in an embodiment will be described. The user authentication process is a process for authenticating whether a user who tries to log in to the MFP20is the user himself/herself registered in the user registration data32a.

In the user authentication process, firstly, the control unit21of the MFP20causes a user ID input screen120(seeFIG. 8) to be displayed on the touch panel23a. The user ID input screen120has an input box121for inputting a user ID of a user who tries to log in, a soft keyboard122for inputting characters to the input box121, and a completion button123for notifying the MFP20that the input has been completed. The touch panel23aserves as a user identification information input unit by displaying the user ID input screen120.

When the control unit21detects that the completion button123is pressed on the user ID input screen120, the control unit21displays a password input screen130on the touch panel23ato request password input by the user. By so doing, the control unit21serve as a password request unit.

The password input screen130includes two screens of a screen (seeFIG. 9) for inputting characters by a soft key operation and a screen (seeFIG. 10) for inputting characters by handwriting input. The control unit21requests password input while appropriately switching these two screens.

Specifically, the password input screen130has an input box131for inputting a password. Below the input box131, a character input unit132for inputting characters to the input box131is provided, and below the character input unit132, a completion button133for notifying the MFP20that the input of all character strings constituting the password has been completed is provided. It is noted that in the examples ofFIG. 9andFIG. 10, the characters inputted in the input box131are displayed as “*”, but this is because a blind function for preventing the theft of the password is turned on and when the blind function is turned off, the inputted characters can also be displayed in the input box131as is.

The character input unit132is basically configured with a soft keyboard (an operation input unit)132aas illustrated inFIG. 9, and is switched to a handwriting input field (a handwriting input unit)132bat a predetermined timing as illustrated inFIG. 10. The handwriting input field132bis configured with a rectangular box, and the input of a handwriting character is completed by sliding a finger in the box to handwrite a character and then pressing an input button135on the right side. When the input button135is pressed, a character recognition process of the handwriting data in the handwriting input field132bis performed and handwriting information thereof is generated as data in the control unit21of the MFP20. It is noted that the character recognition process is a process of recognizing the handwriting data as alphabetic characters. In the example ofFIG. 10, handwriting data including a combination of a horizontal line and a vertical line in the handwriting input field132bis recognized as an alphabetic character “T” by the character recognition process.

The number of times, by which the handwriting input field132bis used (displayed) when a password is inputted, can be set by an authentication condition setting screen150to be described below. The timing for displaying the handwriting input field132b(that is, which character is to be inputted in the handwriting input field132b, numbered from the initial character of the password) is randomly determined when the control unit21performs a predetermined random number process.

Next, with reference to the flowcharts ofFIG. 11AandFIG. 118, a specific example of the user authentication process will be described. The user authentication process is performed by cooperation between the control unit21of the MFP20and the control unit31of the authentication server30.

In the first step S21, the control unit21of the MFP20instructs the operation display unit23to display the user ID input screen120(seeFIG. 8) on the touch panel23a.

In step S22, the control unit21of the MFP20determines whether a pressing operation of the completion button123in the user ID input screen120is performed. When this determination is NO, the control unit21returns to step S21, and when this determination is YES, the control unit21proceeds to step S23.

In step S23, the control unit21reads the number of characters required for handwriting stored in the storage unit22of the MFP20. The number of characters required for handwriting is set for each user's authority level through the authentication condition setting screen150to be described below. The MFP20recognizes the user's authority level corresponding to the user ID inputted in step S22by communicating with the authentication server30, and reads the number of characters required for handwriting corresponding to the recognized authority level.

In step S24, the control unit21instructs the operation display unit23to display the password input screen130on the touch panel23a. In such a case, the character input unit132of the password input screen130is randomly switched to the handwriting input field132bbased on the soft keyboard132aas a base. After the number of characters inputted in the handwriting input field132breaches the number of characters required for handwriting read in step S23, only the soft keyboard132ais displayed as the character input unit132.

In step S25, the control unit21of the MFP20determines whether the completion button133of the password input screen130is pressed. When this determination is NO, the control unit21returns to step S24, and when this determination is YES, the control unit21proceeds to step S26.

In step S26, the control unit21transmits the user ID inputted from the user ID input screen120(step S21), the entire character string of the password inputted from the password input screen130(the character string including the key input characters and the handwritten characters), and handwriting information of some characters of the handwritten password from the MPP20to the authentication server30.

In step S27(seeFIG. 11B), the control unit31of the authentication server30collates the user ID, the entire character string of the password, and the handwriting information of some characters of the handwritten password, which are transmitted from the MFP20, with the aforementioned user registration data32astored in the storage unit32, thereby performing password authentication and handwriting authentication of some characters of the input password.

In the password authentication, it is authenticated whether the input password of a user coincides with the password of the user registered in the user registration data. In the handwriting authentication, it is authenticated whether the degree of similarity between the handwriting information of some characters of the handwritten password and handwriting information of the characters registered in the user registration data is a predetermined value or more.

In step S28, the control unit31of the authentication server30determines whether both the password authentication and the handwriting authentication have succeeded. When this determination is NO, the control unit31proceeds to step S29to transmit information indicating the failure in the user authentication from the authentication server30to the MFP20, and the MFP20displays an error. On the other hand, when the determination of step S28is YES, the control unit31proceeds to step S30to transmit information indicating the success in the user authentication from the authentication server30to the MFP20and allows login to the MFP20. After the processes of step S29and step S30are ended, the control unit31returns.

In step S30, an operation screen for performing various functions is displayed on the touch panel23aof the MFP20to allow the user to log in to the MFP20, and then the user authentication process is ended.

Next, a setting process of an authentication condition when performing the user authentication process will be described. The authentication condition setting process is performed when a condition setting button (not illustrated) displayed on the touch panel23ais pressed in the state in which the MFP20has been logged in with the administrator authority.

When the condition setting button is pressed, the control unit21of the MFP20displays the authentication condition setting screen150illustrated inFIG. 12on the touch panel23a. The touch panel23aserves as a condition setting unit by displaying the authentication condition setting screen150.

The authentication condition setting screen150has setting boxes151and152for setting the number of characters required for handwriting for each of the administrator authority and the general user authority.

The control unit21stores the number of characters required for handwriting inputted through the authentication condition setting screen150in the storage unit22of the MFP20.

When the number of characters inputted in the setting box151for the administrator authority is equal to or less than the number of characters inputted in the setting box152for the general user authority, the control unit21urges re-input by displaying an error message on the touch panel23a. Consequently, in the present embodiment, the number of characters required for handwriting set for the administrator authority is inevitably larger than the number of characters required for handwriting set for the general user authority.

It is noted that when three or more authority levels are set as the user's authority level, it is preferable that the higher the authority level, the more the number of characters required for handwriting.

Operation and Effect

As described above, according to the authentication system1of the present embodiment, the user authentication is performed by combining the password authentication performed based on the entire character string of the input password and the handwriting authentication performed based on the handwriting information of some characters of the handwritten password.

According to this, since the entire character string of the password is not handwritten on the touch panel23aand only some characters are handwritten, even though someone steals a glance at the touch panel23a, the password is not leaked. Furthermore, it is possible to improve user authentication accuracy by handwriting authentication of some characters. Thus, it is possible to reduce password leakage risk due to the handwriting input of the password while enabling the handwriting authentication of the password.

Furthermore, in the present embodiment, the number of characters required for handwriting can be set through the authentication condition setting screen150. According to this, a user can freely adjust the number of characters required for handwriting such that the number of characters required for handwriting is not excessively larger than the number of characters of a character string constituting a password. Thus, it is possible to prevent the password from being leaked due to the handwriting of most of the character string of the password. From the standpoint of preventing password leakage, the number of characters required for handwriting is preferably equal to or less than ½ of the total number of characters, and more preferably equal to or less than ⅓ thereof.

Furthermore, in the present embodiment, when the control unit21requests the input of a password through the password input screen130, the sequence position of a character required to be inputted in the handwriting input field132b(the timing for displaying the handwriting input field132b) is randomly determined.

According to this, since the timing for using the handwriting input field132bis not fixed, the sequence position of a character inputted in the handwriting input field132b(what number of character numbered from the initial character of the password) is less likely to be sensed by someone else. Thus, it is possible to further reduce password leakage risk.

Furthermore, in the present embodiment, the number of characters required for handwriting is changed according to a user's authority level. According to this, it is possible to increase the degree of freedom of setting of the authentication condition of a password.

In the present embodiment, the control unit21is configured to display an error when the number of characters required for handwriting for the administrator authority is equal to or less than the number of characters required for handwriting for the general user authority. Consequently, the number of characters required for handwriting for the administrator authority is inevitably larger than the number of characters required for handwriting for the general user authority. Thus, for a user with a high authority level, it is possible to enhance the degree of handwriting authentication in the user authentication, thereby tightening the user authentication.

Other Embodiment

In the aforementioned embodiment, a part of a password is handwritten and the rest is inputted by the soft key; however, the technology of the present disclosure is not limited thereto and for example, a hard key may be employed instead of the soft key.

Furthermore, in the aforementioned embodiment, the display timing of the handwriting input field132bis randomly determined; however, the technology of the present disclosure is not limited thereto and character input from the handwriting input field132bmay be requested at a preset timing. For example, when it is determined to handwrite the second and fifth characters from the first character of a password, if the character input timings of the second and fifth characters of the password are reached, the character input unit132is switched from the soft keyboard132ato the handwriting input field132b.