Secret information indentification system

0001The present invention relates to personal information identification systems and, more specifically, to an identification system which verifies input secret information.

0002In automatic teller machines and the like installed in banking organs, a user is authenticated by his inputting secret data such as a password, whereby use of his account, for instance, by other persons is prohibited. That is, in this type of system, an input password is compared with a preset password and a machine is allowed to start operating when the two passwords coincide with each other. In such a system, a preset password is generally a fixed one. There are known several types of the system including a first type system which allows a user to input passwords a limitless number of times and another type system in which a password input function is locked, i.e., disabled if passwords are input more than a given number of times (refer to Japanese Unexamined Patent Publication No. 62-219048).

0003The above-described conventional systems have the following disadvantages. In the first type system which allows a user to input passwords a limitless number of times, a password is likely broken by using a computer, for instance. In the other type system in which a password input function is locked to disable subsequent password inputs if passwords are input more than a given number of times, the password input function is locked when wrong passwords are input inadvertently, in which case even the true user is prohibited from using the machine.

0004The present invention has been made to solve the above problems in the art, and therefore an object of the present invention is to provide a system where a secret information is hard to break and an information input function is not locked.

0005According to the present invention, a system for providing authorization by checking whether input information is coincident with predetermined information, includes a first controller which varies permission timing based on a check result of the input information and a second controller which provides the authorization when the check result indicates coincidence at the permission timing. The first controller may elongate an interval of the permission timing based on the check result of the input information. Preferably, the first controller may elongate the interval of the permission timing as the number of check results indicating non-coincidence increases. Further, the first controller may randomly vary an interval of the permission timing based on the check result of the input information.

0006According to an aspect of the present invention, the input information is compared with the predetermined information every time the permission signal is generated and, when a comparison result indicates coincidence, the authorization such as lock release is provided. The cycle or interval of generation of the permission signal is varied according to the number of events of non-coincidence in comparison results.

0007According to another aspect of the invention, the input information is compared with the predetermined information, and the authorization is given in response to generation of the permission signal when a comparison result indicates coincidence. The interval or cycle of generation of the permission signal is varied according to the number of events of non-coincidence in comparison results.

0008Therefore, even if all possible secret information are input, coincidence does not occur. This provides an advantage that the secret information is not easily broken even with the use of a computer or the like. Further, according to the invention, the secret information input function is not locked. This provides another advantage that even after input of incorrect information, the lock of a system can still be released by inputting the predetermined information.

0009The above and other objects and advantages will become apparent from the following detailed description when read in conjunction with the accompanying drawings wherein: <ul id="ul0001" list-style="none" compact="compact"><li>FIG. 1 is a block diagram showing the configuration of a password identification system according to an embodiment of the present invention;</li><li>FIG. 2 is a flowchart showing an operation of the password identification system of FIG. 1;</li><li>FIG. 3 is a time chart showing an example of the operation of the password identification system of FIG. 1;</li><li>FIG. 4 is a time chart showing another example of the operation of the password information identification system of FIG. 1;</li><li>FIG. 5 is a block diagram showing the configuration of a password identification system according to another embodiment of the invention;</li><li>FIG. 6 is a flowchart showing an operation of the password information identification system of FIG. 5;</li><li>FIG. 7 is a time chart showing an example of the operation of the password information identification system of FIG. 5;</li><li>FIG. 8 is a time chart showing another example of the operation of the password information identification system of FIG. 5;</li><li>FIG. 9 is a detailed block diagram showing a first example of a permission signal generator of FIG. 1 or FIG. 5;</li><li>FIG. 10 is time a chart showing an operation of the permission signal generator of FIG. 9; and</li><li>FIG. 11 is a detailed block diagram showing a second example of the permission signal generator of FIG. 1 or FIG. 5;.</li></ul>

0010Referring to FIG. 1, a password identification system according to an embodiment of the present invention has the following configuration. An input device 101 such as a keypad allows a user to input a password PW_IN and other necessary information. A check permitting section 102 transfers the input password PW_IN to a checking section 103 in response to a permission signal S_T. In other words, the check permitting section 102 has a function of permitting a checking operation in response to the permission signal S_T. The checking section 103 checks the input password PW_IN by comparing it with a registered password PW_REG previously stored in a memory 104. When the comparison result is "coincidence," a lock controller 105 releases the lock of a system 106. A permission signal generator 107 receives the comparison result from the checking section 103 and generates the permission signal S_T with varying the cycle of generation of the permission signal S_T based on the comparison result.

0011The permission signal generator 107 includes a consecutive-error counter 108 which counts the number of consecutive comparison results of "non-coincidence" received from the checking section 103. A generation interval controller 109 controls the generation interval (or cycle) of the permission signal S_T in accordance with the count of the counter 108 as will be described later. A signal generator 110 generates the permission signal S_T under the control of the controller 109 and supplies it to the check permitting section 102.

0012Referring to FIG. 2, the permission signal generator 107 generates permission signals S_T as trigger signals for permitting the checking operation. Normally, the permission signal generator 107 generates permission signals S_T at minimum intervals. When a password PW_IN is input through the input device 101 (step S201), the check permitting section 102 waits for generation of a permission signal S_T by the permission signal generator 107 (step S202). When a permission signal S_T is detected (YES at step S202), the checking section 103 compares the input password PW_IN with the registered password PW_REG stored in advance in the memory 104 (step S203). If the comparison result is "coincidence," the generation interval of the permission signals S_T is minimized (step S204) and then the lock controller 105 operates to release the lock of the system 106 (step S205), thereby allowing it to operate (step S206).

0013On the other hand, if the input password PW_IN is different from the registered password PW_REG, the checking section 103 detects non-coincidence (step S203). The consecutive-error counter 108 of the permission signal generator 107 counts consecutive errors in input passwords, and the generation interval controller 109 sets a permission signal generation interval in accordance with the count of the counter 108 (step S207). In this embodiment, the permission signal generation interval (cycle) is elongated as the count increases. The signal generator 110 generates permission signals S_T at the thus-set cycle or interval.

0014In this state where the permission signal generation interval (cycle) ha been elongated, even if a password PW_IN2 is again input after a lapse of a short time, the check permitting section 102 does not permit the checking operation of the checking section 103 because no permission signal is generated due to the elongated permission signal generation interval. A user is not given any permission signal generation information. When he further inputs a password PW_IN3 and a permission signal S_T is then generated after a lapse of the permission signal generation interval, the check permitting section 102 permits the checking operation in the checking section 103 (YES at step S202). In response, the checking section 103 compares the input password PW_IN3 with the registered password PW_REG (step S203). The fact that the input password PW_IN2 is not subjected to checking is the important feature of this system. That is, even if the input password PW_IN2 is a registered one, the system 106 is not allowed to operate.

0015If non-coincidence is again detected with an input password PW_IN3, the count of consecutive errors is incremented by one. As a result, the generation interval controller 109 further elongates the permission signal generation interval (step S207), which means that the non-operational time of the checking section 103 is elongated accordingly. If coincidence is detected with the input password PW_IN3, the permission signal generation interval is set at the minimum value (step S204), the lock is released (step S205), and the system 106 is allowed to operate (step S206).

0016A consideration will be given to a case where a registered password is input once after N times of input of wrong passwords. In this case, permission signals S_T are generated at permission signal generation intervals corresponding to the number N of consecutive errors. When a registered password PW_REG is input and the check permitting section 102 receives a permission signal S_T that is generated after a lapse of the permission signal generation interval that corresponds to the number N of consecutive errors, the check permitting section 102 outputs the input password PW_IN to the checking section 103 to permit the checking operation. When the checking section 103 compares the input password PW_IN with the registered password PW_REG and detects coincidence, the permission signal generation interval is returned to the minimum value (step S204), the lock is released (step S205), and the system 106 is allowed to operate (step S206).

0017Next, the permission signal generation interval will be described with reference to time charts of FIGS. 3 and 4. Each of FIGS. 3 and 4 shows input passwords PW_IN, permission signal S_T, comparison outputs indicating a comparison result (coincidence or non-coincidence) of the checking section 103, and lock releasing signal S_RL which is output from the lock controller 105. In each of FIGS. 3 and 4, the horizontal axis represents time while solid segments of the comparison outputs and the lock releasing signals S_RL represent active states and the remaining portions represent inactive states.

0018In the permission signals S_T of FIG. 3(b), permission is indicated by a high level. The permission signals S_T of FIG. 4(b) are used as triggers and operations are effected at the rising edges of the triggers. While no password is input, the checking operation is not performed even if a permission signal S_T is generated. In this example, to simplify the description, it is assumed that the registered password PW_REG is "6" and input of only passwords PW_IN ranging from "0" to "9" is accepted.

0019Referring to FIG. 3, in the normal state in which the permission signal generation interval is set to a minimum value ("0" in this example), the lock is released and the system 106 is allowed to operate as soon as the registered password PW_REG of "6" is input.

0020A consideration will be given to a case where a user who intends to break the password inputs all passwords "0" to "9" on a try-everything basis. When a first password PW_IN1 of "0" is input, the checking section 103 detects non-coincidence and the number of consecutive errors becomes 1. As a result, the permission signal generation interval, which was "0" in the initial state, becomes "1." When a next password PW_IN2 of "1" is input, the checking operation is not performed because no permission signal S_T is generated. Since the user is not given the permission signal generation information, he inputs a next password PW_IN3 of "2." Since a permission signal S_T is generated thereafter, the input password is compared with the registered password PW_REG. As a result, non-coincidence is again detected, whereby the number of consecutive errors becomes 2 and the permission signal generation interval also becomes "2."

0021When next passwords PW_IN4 and PW_IN5 (i.e., "3" and "4") are sequentially input, the checking operation is hot performed because no permission signals are generated. When a further next password PW_IN6 of "5" is input, a permission signal S_T is generated thereafter and hence the input password PW_IN6 is subjected to the checking operation. Since non-coincidence is detected, the number of consecutive errors becomes 3 and the permission signal generation interval becomes "3."

0022Although a registered password PW_IN7 of "6" is input next, the checking section 103 does not performs its checking operation because no permission signal S_T is generated. Subsequently, passwords PW_IN8 to PW_IN10 of "7" to "9" are sequentially input. Since a permission signal S_T is generated after the input of the password PW_IN10 of "9," only that password is subjected to the checking operation. Since non-coincidence is again detected, the number of consecutive errors becomes 4 and the permission signal generation interval becomes "4." Thereafter, the checking section 103 does not operate while no password input is made. Therefore, neither coincidence nor non-coincidence is detected and the permission signal generation interval is kept at "4."

0023Even when a registered password PW_IN11 of "6" is thereafter input, the checking operation is not performed until generation of a permission signal S_T. The checking section 103 performs its checking operation when a permission signal S_T is generated at time T1 after a lapse of a permission signal generation interval "4." Since password coincidence is detected at that time, the lock is released and the system 106 is allowed to operate.

0024Referring to FIG. 4, as in the case of the example of FIG. 3, in the normal state, the permission signal generation interval is set to the minimum value. In this example, the permission signal S_T is generated as a trigger signal with rising consecutively. If a registered password PW_REG of "6" is input in this state, the lock is released immediately and the system 106 is allowed to operate.

0025In the case where a user who intends to break the password inputs all passwords "0" to "9" on a try-everything basis, as in the case of the example of FIG. 3, the permission signal generation interval is elongated as the number of consecutive events of non-coincidence in comparison results increases. After the number of consecutive errors becomes 4 and the permission signal generation interval becomes "4", the checking section 103 does not operate while no password input is made. Therefore, neither coincidence nor non-coincidence is detected and the permission signal generation interval is kept at "4."

0026Even when a registered password PW_IN11 of "6" is thereafter input, the checking operation is not performed until generation of a permission signal S_T. The checking section 103 performs its checking operation when a permission signal S_T is generated at time T1 after a lapse of a permission signal generation interval "4." Since password coincidence is detected at that time, the lock is released and the system 106 is allowed to operate.

0027Referring to FIG. 5, a password identification system according to another embodiment of the invention has the following configuration. An input device 301 such as a keypad allows a user to input a password PW_IN and other necessary information. The password PW_IN is output to a checking section 302 which checks the input password PW_IN by comparing it with a registered password PW_REG previously stored in a memory 303. The comparison result of the checking section 302 is output to a lock release permitting section 304 and a permission signal generator 307. The lock release permitting section 304 outputs a lock release permission signal to a lock controller 305 in response to the comparison result of "coincidence" and a permission signal S_T. In other words, the lock release permitting section 304 has a function of permitting lock release in response to the comparison result and the permission signal S_T. when receiving the lock release permission signal from the lock release permitting section 304, the lock controller 305 releases the lock of a system 306. The permission signal generator 307 receives the comparison result from the checking section 302 and generates the permission signal S_T with varying the cycle of generation of the permission signal S_T based on the comparison result.

0028The permission signal generator 307 includes a consecutive-error counter 308 which counts the number of consecutive comparison results of "non-coincidence" received from the checking section 302. A generation interval controller 309 controls the generation interval (or cycle) of the permission signal S_T in accordance with the count of the counter 308 as will be described later. A signal generator 310 generates the permission signal S_T under the control of the controller 309 and supplies it to the lock release permitting section 304.

0029Referring to FIG. 6, the permission signal generator 307 generates permission signals S_T as trigger signals for permitting the lock release operation. Normally, the permission signal generator 307 generates permission signals S_T at minimum intervals. When a password PW_IN is input through the input device 301 (step S401), the checking section 302 compares the input password PW_IN with a registered password PW_REG stored in advance in the memory 303 (step S402). If the comparison result is "coincidence," the lock release permitting section 304 waits for generation of a permission signal S_T by the permission signal generator 307 (step S403). When a permission signal S_T is received (YES at step S403), after the permission signal generation interval is reset to the minimum value (step S404), the lock release permitting section 304 outputs the lock release permission signal to the lock controller 305. The lock controller 305, in response to the lock release permission signal, operates to release the lock of the system 306 (step S405), thereby allowing it to operate (step S406).

0030On the other hand, if the input password PW_IN is different from the registered password PW_REG, the checking section 302 detects non-coincidence (step S402). The consecutive-error counter 308 of the permission signal generator 307 counts errors in input passwords, and the generation interval controller 309 sets a permission signal generation interval in accordance with the count of the counter 308. The signal generator 310 generates the permission signal S_T whose generation interval (cycle) is elongated in accordance with the set permission signal generation interval (step S407).

0031If a password PW_IN2 is input in this state and non-coincidence is detected, the error count is incremented by one and hence the permission signal generation interval is further elongated. On the other hand, even if coincidence is detected in this state, the lock release permitting section 304 does not immediately permit lock release because no permission signal is generated due to the elongated permission signal generation interval.

0032A user is not given any permission signal generation information. When he further inputs a password PW_IN3, the checking operation is performed, and a permission signal S_T is then generated after a lapse of the permission signal generation interval. If a comparison result of the password PW_IN3 is "non-coincidence", control returns to the password input waiting state (step S401). If the comparison result is "coincidence," the permission signal generation interval is made the minimum value (step S404), the lock is released (step S405), and the system 306 is allowed to operate. The fact that as described above the lock is not released even if the input password PW_IN2 is a registered one and the comparison result is "coincidence" is the important feature of this system. If non-coincidence is again detected with an input password PW_IN3, the error count is incremented by one. As a result, the permission signal generation interval is further elongated, which means that the lock release prohibition time is elongated accordingly.

0033A consideration will be given to a case where a registered password is input once after N times of input of wrong passwords. In this case, permission signals S_T are generated at permission signal generation intervals corresponding to the number N of errors. When a registered password PW_REG is input, the checking section 302 detects coincidence and the lock release permitting section 304 detects a permission signal S_T that is generated after a lapse of the permission signal generation interval that corresponds to the number N of errors and permits the lock release operation. Then, the permission signal generation interval is returned to the minimum value (step S404), the lock is released (step S405), and the system 306 is allowed to operate (step S406).

0034Next, the permission signal generation interval will be described with reference to time charts of FIGS. 7 and 8. Each of FIGS. 7 and 8 show input passwords PW_IN, permission signals S_T, comparison outputs indicating comparison results of the checking section 302, and lock release signals S_RL which are output from the lock controller 305. In each of FIGS. 7 and 8, the horizontal axis represents time while solid segments of the comparison outputs and the lock release signals S_RL represent active states and broken lines represent inactive states.

0035In the permission signals S_T of FIG. 7(b), permission is indicated by a high level. The permission signals S_T of FIG. 8(b) are used as triggers and operations are effected at the rising edges of the triggers. While no password is input, the checking operation is not performed. In this example, to simplify the description, it is assumed that the registered password PW_REG is "6" and input of only passwords PW_IN of "0" to "9" is accepted.

0036Referring to FIG. 7, in the normal state in which the permission signal generation interval is set to a minimum value ("0" in this example), the lock is released and the system 306 is allowed to operate as soon as the registered password PW_REG of "6" is input.

0037A consideration will be given to a case where a user who intends to break the password inputs all passwords "0" to "9", on a try-everything basis. When a first password PW_IN of "0" is input, the checking section 302 detects non-coincidence and the number of errors becomes 1. As a result, the permission signal generation interval, which was "0" in the initial state, becomes "1." When a next password PW_IN of "1" is input, the checking section 302 detects non-coincidence and hence the number of errors becomes 2 and the permission signal generation interval becomes "2." Then, passwords PW_IN of "3" to "5" are sequentially input, so that the number of errors becomes 6 and the permission signal generation interval becomes "6."

0038When a registered password PW_IN of "6" is input subsequently, the checking section 302 detects coincidence. However, since no permission signal S_T is generated, the lock release permitting section 304 does not permit lock release. Subsequently, passwords PW_IN of "7" to "9" are sequentially input, so that the number of errors becomes 9 and the permission signal generation interval becomes "9." Thereafter, the checking section 302 does not operate while no password input is made. Therefore, neither coincidence nor non-coincidence is detected and the permission signal generation interval is kept at "9."

0039When a registered password PW_IN of "6" is thereafter input, coincidence is detected but the lock is not released until generation of a permission signal S_T. When a permission signal S_T is generated at time T2 after a lapse of a permission signal generation interval "9," the permission signal generation interval is made the minimum value, the lock is released, and the system 306 is allowed to operate.

0040Referring to FIG. 8, as in the case of the example of FIG. 7, in the normal state the permission signal generation interval is minimum and permission signals S_T rise consecutively at minimum intervals. If a registered password PW_REG of "6" is input in this state, the lock is released immediately and the system 306 is allowed to operate.

0041A consideration will be given to a case where a user who intends to break the password inputs all passwords "0" to "9" on a try-everything basis. In this case, as in the case of the example of FIG. 7, the permission signal generation interval is elongated as the number of events of non-coincidence in comparison results increases. After the number of errors becomes 9 and the permission signal generation interval becomes "9", the checking section 302 does not operate while no password input is made. Since neither coincidence nor non-coincidence is detected, the permission signal generation interval is kept at "9."

0042When a registered password PW_REG of "6" is thereafter input, coincidence is detected but the lock is not released while no permission signal S_T is generated. When a permission signal S_T is generated at time T2 after a lapse of a permission signal generation interval "9", the permission signal generation interval is made the minimum value, the lock is released, and the system 306 is allowed to operate.

0043Referring to FIG. 9, the permission signal generator 107 or 307 may be constituted of the following components, for example. A reference oscillator 501 outputs a reference clock signal CLK to a counter 502. The counter 502 performs a counting operation in response to clock pulses of the reference clock signal CLK. A logic circuit 503 receives the outputs of the counter 502 and generates clock signals S_T0 to S_T2 of different cycles based on the count outputs of the counter 502. A counter 505 receives the non-coincidence signal from the checking section 103 or 302 and outputs the number N_E of errors by counting the number of non-coincidence events. Further, the counter 505 receives the lock release signal S_RL as a count reset signal from the lock controller 105 or 305. Alternatively, the lock release permission signal may be received from the lock release permitting section 304 in the embodiment as shown in FIG. 5. A selector 504 selects one of the clock signals S_T0 to S_T2 in accordance with the number N_E of errors and outputs the selected one as a permission signal S_T to the check permitting section 102 or the lock release permitting section 304.

0044The logic circuit 503 consists of a NAND gate NAND1 having inverted outputs <img file="EP0809217A2_D0001.tif" /> and <img file="EP0809217A2_D0002.tif" /> of the counter 502 as inputs and another NAND gate NAND2 having inverted outputs <img file="EP0809217A2_D0002.tif" /> and <img file="EP0809217A2_D0003.tif" /> of the counter 502 as inputs. The NAND gates NAND1 and NAND2 output the clock signals S_T1 and S_T2 to the selector 504. An inverted output <img file="EP0809217A2_D0001.tif" /> of the counter 502 is also supplied to the selector 504 as the clock signal S_T0.

0045The counter 502 and the logic circuit 503 generate a plurality of clock signals S_T0 to S_T2 having different periods from the reference clock CLK. The selector 504 selects one of the clock signals S_T0 to S_T2 according to the number NE of errors which is counted by the counter 505. The non-coincidence signal, which is one of two comparison results of the checking section 103 or 302, is supplied to the counter 505 as a clock signal. A signal for setting the permission signal generation interval at the minimum value, such as a lock releasing signal S_RL, is also supplied to the counter 505 as a reset signal. In this manner, the function of setting the permission signal generation interval at the minimum value when the comparison result is "coincidence" (step S204 in FIG. 2 or step S404 in FIG. 6) is realized.

0046As shown in FIG. 10, in this example, the selector 504 receives three kinds of waveforms S_T0 to S_T2. When the number N_E of errors is 0 (normal state), a timing clock signal S_T0 having a given cycle is selected as the permission signal S_T. When the number N_E of errors is 1, a frequency-halved timing clock signal S_T1 is selected as the permission signal S_T. When the number N_E of errors is 2, a frequency-quartered timing signal S_T2 is selected as the permission signal S_T. In short, the frequency or cycle of the permission signal S_T is controlled in accordance with the number of events of non-coincidence in comparison results.

0047In this example, the maximum countable number of errors is 3 because the counter 505 is a 2-bit counter. The countable number of errors can be increased by increasing the number of bits of the counter 505 and the kinds of signals generated by the counter 502 and the logic circuit 503, i.e., the kinds of different frequencies. In general, N (N is an integer) frequency dividers having different divisors may be used to produce N clock signals S_T0-S_TN having different frequencies. And a selector selects one from the N clock signals as the permission signal S_T. Further, the circuit configuration of FIG. 9 can easily be implemented by using a known DSP (digital signal processor), a CPU (central processing unit), or the like.

0048As shown in FIG. 11, where circuit blocks similar to those previously described with reference to FIG. 9 are denoted by the same reference numerals, a processor (or a logic circuit) 506 may be used to control the selector 504 based on the number N_E of errors. For example, this configuration can accommodate a case where the number N_E of errors exceeds an allowable range. Specifically, the checking operation may be suspended when the number N_E of errors exceeds an allowable range, for instance, 0 ≤ N_E ≤ 8.

0049It is possible to make a password harder to break by making the relationship between the number N_E of errors and the permission signal generation interval more complex by means of the processor 506. Specifically, random numbers are generated by the processor 506 in accordance with the number N_E of errors, to cause the selector 504 to select the cycles of the clock signals randomly. In this case, since the frequency of the permission signal S_T is randomly varied in accordance with random numbers, it becomes more difficult to break the password.

0050Although in the above embodiments the password is assumed to be a single-digit number for convenience of description, it is apparent that the invention can be applied to a case where the password is a number of two or more digits. In the latter case, the embodiments may be adapted such that the entire input password is compared with the entire password that is stored in advance in the memory.

0051Furthermore, the check permitting section 102 as shown in FIG. 1 may be composed of delay flip-flop circuits which use the permission signal S_T as a timing clock. The lock release permitting section 304 as shown in FIG. 5 may be composed of an AND gate inputting the permission signal S_T and the comparison result. Needless to say, the configuration consisting of the check permitting section 102, the checking section 103, the lock controller 105 and the permission signal generator 107 may be implemented by a program-controlled processor (DSP or CPU). Similarly, the configuration consisting of the checking section 302, the lock release permitting section 304, the lock controller 305 and the permission signal generator 307 may be implemented by a program-controlled processor (DSP or CPU).

0052As described above, according to the present invention, the interval between checking operations or the interval between lock release permitting operations is elongated in accordance with the number of events of non-coincidence in password comparison results. Therefore, even if all possible passwords are input, coincidence does not occur. This provides an advantage that a password is not easily broken even with the use of a computer or the like. Further, according to the invention, the password input function is not locked. This provides another advantage that even after input of a wrong password, the lock of a system can still be released by inputting a registered password.