JP2000047990A - User registering method in personal authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent a recording medium where personal ID information is stored from being appropriated, by utilizing a register program by which personal ID information is stored in the recording medium simultaneously with biometrics feature amount. SOLUTION: A user 102 decodes a register program with his secret key, which has been ciphered with his public key transmitted from a credit card company 106, by his computer 103 and executes it. The user 102 transmits fingerprint information being the biometrics to the computer 103 through the use of a fingerprint input device 108 in accordance with the executed register program and extracts the featured values. Moreover, an unused IC card is inserted to an IC card reader/writer 109 and fingerprint feature amount extracted from fingerprint information and personal ID information ciphered by the secret key of the credit card company 106 are simultaneously stored in the IC card in accordance with the register program.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a personal authentication system using biometrics, and more particularly, to a home EC (Elect) for performing personal authentication using biometrics.
(Ronic Commercial), which relates to a method of registering a user in a financial system. In addition, biometrics means fingerprint, palm print, palm shape, iris, retina, voice print,
Face, ear, dynamic signature, keystroke, vein pattern of back of hand, DNA, etc.

[0002]

2. Description of the Related Art Known procedures for registering biometric information include the following.

[0003] In the case of an entrance / exit management system to which a fingerprint collation device is applied, a fingerprint collation device using a pattern matching method, Osamu Eguchi et al., IEICE technical report, PR
U88-83 (1988) ", a computer, a fingerprint input device for registration and an IC card reader / writer are installed in a controlled room, and personal ID information and fingerprint input for registration are input using the computer. Fingerprint information input using the device is simultaneously stored in the IC card using the IC card reader / writer.

[0004] According to "Virtual City [SMMM] Monitor Recruitment, V-City Issuance Pamphlet", SMMK (Kiosk Terminal) is a kiosk terminal that allows users to purchase and settle goods through Internet connection. SuperMultiMedia K
In IOSK, fingerprint information is stored in a member card (IC card) to confirm the identity of the user. Apply for a membership card by mail and receive it by mail.

[0005]

SUMMARY OF THE INVENTION There are the following problems when registering a user in a home EC or financial system that performs personal authentication using a biometric feature stored in a recording medium held by the user. .

(1) In the example of the entry / exit management system shown in the known example, the registration work is performed in a controlled room. If this is a home EC or financial system, there is an input device for biometrics information at home, so the user wants to perform the registration work at home, but there is no means to perform this at this time without any fraud. If the same means as the entry / exit management system is used in an unmanaged home, the registration operation can be illegally performed.

As a countermeasure, for example, a membership card (IC
Card), the institution that issues the name, expiration date,
A membership card issuance application form in which an address and a credit card number are entered is sent, and the member card issuing organization stores personal ID information such as a credit card number in an IC card and sends it to the user. A method is conceivable in which a user stores his / her fingerprint information on the IC card at home.

However, in this method, before storing fingerprint information of an authorized user, an IC storing personal ID information is stored.
The card may be stolen, and if the fingerprint information of another person is stored in the IC card, the person is spoofed. I
The same is true if the password is stolen even if the C card is protected by a password.

(2) In the SMMK shown in the known example, a procedure such as mailing must be performed for the registration work, which takes time and effort.

[0010]

In order to solve the above problems, the following means have been invented.

(1) A registration program for simultaneously storing, in a recording medium, personal ID information encrypted by an EC and a financial service provider, and biometrics features extracted from the biometrics information obtained from an input device. I will provide a. Accordingly, the recording medium storing the personal ID information is not stolen, and the unregistered home can perform the registration work without any fraud.

(2) A registration application creation program for encrypting a registration application and a registration program including encrypted personal ID information are provided via a network so that a commercially available recording medium can be used as it is. As a result, the registration work can all be performed via the network, and the labor and time can be reduced as compared with mailing.

[0013]

FIG. 1 is a block diagram showing an embodiment of the present invention.
Will be described in detail with reference to FIG.

<Embodiment 1> A first embodiment of the present invention is an Internet shopping system, in which a user, a store, and a credit card company are connected via the Internet.
This is a system that allows users to order products on the shop and make a payment with a credit card at the same time. The user of the present system needs to create an IC card in which the personal digital signature information necessary for the credit card company to judge whether or not settlement is possible, as well as the fingerprint feature amount of the user in advance. At the time of use, the IC card and the fingerprint are presented, the fingerprint feature amount in the IC card is collated with the presented fingerprint, and if it is confirmed that the IC card holder is valid, the personal ID information can be read. In this system, personal authentication is performed in this procedure.

FIG. 1 shows the configuration of this system. In this system, a computer 103 of a user 102, a computer 105 of a store 104, and a computer 107 of a credit card company 106 are connected to the Internet 101. User 1
02 has a fingerprint input device 108 and an IC
The card reader / writer 109 is connected. The computer 103 of the user 102 has input / output devices such as a keyboard 110, a mouse 111, a display 1
12 are connected.

FIG. 2 shows an operation flow of the present system. The operation flow can be broadly divided into a registration phase 201 for a user to obtain a use qualification and a use phase 202 for a user who has obtained a use qualification in the registration phase 201 to actually obtain a service.

The processing and data flow in the registration phase 201 will be described with reference to the block diagram of FIG.

First, the user has to create a registration application form 313, and a registration application creation program required for that purpose is sent to the Internet 101 (for example, WWW (Wo)).
ld Wide Web))
1). This registration application form creation program encrypts with the private key # 1 of the credit card company 106 (public key cryptosystem) in order to be able to confirm whether it has been tampered with.
Have been. To decrypt this, the public key # 1 of the credit card company 106 is separately provided to the Internet 101.
(Eg, WWW) (302).

In the computer 103 of the user 102, the registration application form creation program is transferred to the credit card company 106
Is decrypted with the public key # 1 of this and executed (303). In accordance with the registration application creation program, the user 102 is required to identify his / her name, expiration date, address and other additional information, ie, the credit card company 106, to identify the user 102 as a true cardholder. Information (collectively referred to as personal ID information) is described, and a registration application form is created (304). The registration application creation program generates a pair of the private key # 2 and the public key # 2 of the user 102, and attaches the public key # 2 to the registration application created by the user 102 (305).

Then, the registration application 313 to which the public key # 2 of the user 102 is attached is encrypted with the public key # 1 of the credit card company 106 included in the registration application creation program, and is transmitted to the credit card company 106 via the Internet. The data is transmitted via 101 (306).

The credit card company 106 is the user 10
The registration application 313 encrypted with the public key # 1 of the credit card company 106 transmitted from the credit card company 106 is decrypted with the secret key # 1 of the credit card company 106, and the contents described are confirmed and used for the user 102. Qualification examination is performed (307).

If the result of the examination is unsuccessful, the user 102 is notified to that effect and the present phase ends.

After the screening, the personal ID information described in the registration application form of the user 102 is encrypted with the secret key # 3 of the credit card company 106 (secret key cryptosystem).
Then, it is set as data in a registration program used by the user to perform the registration work. (308). Personal ID encrypted with private key # 3 of credit card company 106
The registration program 314 in which the information is set is encrypted with the public key # 2 of the user 102 included in the registration application 313, and transmitted to the user 102 via the Internet 101 (309).

The user 102 is the credit card company 10
The registration program 314 encrypted with the public key # 2 of the user 102 transmitted from 6 is decrypted and executed by the computer 103 of the user 102 with the secret key # 2 of the user 102 (310). According to the registration program 314, the user 102 sends fingerprint information to the computer 103 using the fingerprint input device 108. The registration program 314 extracts a feature amount from the fingerprint information (311).

The user 102 further registers the registration program 31
According to 4, the unused IC card is inserted into the IC card reader / writer 109. The registration program 314 simultaneously stores the fingerprint feature quantity extracted from the fingerprint information and the personal ID information encrypted with the secret key # 3 of the credit card company 106 in this IC card (312).

As described above, an IC card possessed by a user who is qualified to use the present system is created.

The processing and data flow in the use phase 202 will be described with reference to the block diagram of FIG.

First, in order to actually obtain a service, a use program is necessary, and the program is obtained via the Internet 101 (for example, WWW) (401). This use program is encrypted with the private key # 1 of the credit card company 106 (public key cryptosystem) so that it can be confirmed whether the program has been tampered with. In order to decrypt this, the public key # 1 of the credit card company 106 is separately obtained via the Internet 101 (for example, WWW) (402). In the computer 103 of the user 102, the use program is set to the public key # of the credit card
The decryption is performed by 1 and executed (403).

According to the use program, the user 10
2 creates a product purchase application 412 describing the amount, quantity, etc. of the product to be purchased at the virtual mall / shop operated by the store 104 (404). According to the usage program, the user 102 enters the registration phase 20
1 to the IC card reader / writer 10
Insert into 9. The usage program reads out the fingerprint feature amount from this IC card.

Further, the user 102 sends fingerprint information to the computer 103 using the fingerprint input device 108 according to the use program. The usage program uses this fingerprint information and IC
The fingerprint features read from the card are collated (40
5). As a result of the fingerprint collation, if the fingerprint presented at the time of use matches the fingerprint in the IC card, the IC card holder is determined to be valid, and the procedure proceeds to a purchase procedure.

The use program reads the personal ID information 413 encrypted with the secret key # 3 of the credit card company 106 from the IC card, and, together with the product purchase application 412, the credit card company 106 included in the use program. The data is encrypted with the public key # 1 and transmitted to the store 104 via the Internet 101. At the same time, the usage program sends the public key # 4 of the store 104 to the Internet 10
1, the product purchase application 412 is encrypted with the public key # 4, and transmitted to the store 104 via the Internet 101 (406).

The store 104 decrypts the merchandise purchase application 412 transmitted from the user 102, which has been encrypted with the store 104's public key # 4, using the store 104's secret key # 4, and confirms the contents of the application (412). 407). The product purchase application 412 and the personal ID information 413 encrypted with the public key # 1 of the credit card company 106 transmitted at the same time are directly transferred to the credit card company 106 (40).
8). These transfer data are credit card company 10
Since the store 104 is encrypted with the public key # 1 of No. 6, the store 104 cannot decrypt it.

The credit card company 106 is the store 104
Is decrypted with the private key # 1 of the credit card company 106, the product purchase application 412 and the personal ID information 413 encrypted with the public key # 1 of the credit card company 106 transmitted from the company. Since the personal ID information 413 is further encrypted with the secret key # 3 of the credit card company 106 (secret key cryptosystem), it is decrypted with the secret key # 3.
The credit card company 106 determines whether or not the payment indicated in the product purchase application form 412 may be credited to the person indicated by the personal ID information (40).
9). The settlement result 414 is encrypted with the public key # 4 of the store 104 and the store 104
A reply is made via (410).

The store 104 is a credit card company 106
Is decrypted with the secret key # 4 of the store 104, which is encrypted with the public key # 4 of the store 104 transmitted from the company. To the credit card company 106. If not, this is notified to the user 102 and this phase ends (411).

<Second Embodiment> A second embodiment of the present invention relates to an Internet banking system, in which a user and a bank are connected via the Internet. This system provides services such as transfer and purchase interlocking. The user of this system needs to register in advance the personal ID information necessary for the bank to confirm the account, as well as an IC that stores the fingerprint characteristics of the user.
You need to create a card. At the time of use, the IC card and the fingerprint are presented, the fingerprint feature amount in the IC card is collated with the presented fingerprint, and if it is confirmed that the IC card holder is valid, the personal ID information can be read. In this system, personal authentication is performed in this procedure.

FIG. 5 shows the configuration of the present system. In this system, the computer 103 of the user 102 and the computer 502 of the bank 501 are connected to the Internet 101.
A fingerprint input device 108 and an IC card reader / writer 109 are connected to the computer 103 of the user 102.
Further, for example, a keyboard 110, a mouse 111, and a display 112 are connected to the computer 103 of the user 102 as input / output devices.

The operation flow of this system can be roughly divided into a registration phase and a use phase, as in FIG.

The processing and data flow in the registration phase will be described with reference to the block diagram of FIG.

First, the user must create a registration application form 613, and obtains a registration application form creation program necessary for that via the Internet 101 (for example, WWW) (601). This registration application form creation program is encrypted (public key cryptosystem) with the private key # 5 of the bank 501 so that it can be checked whether it has been tampered with. To decrypt this, the bank 501
Public key # 5 of the Internet 101 (for example, WW
W) (602).

In the computer 103 of the user 102, the registration application creation program is decrypted with the public key # 5 of the bank 501 and executed (603). In accordance with the registration application creation program, the user 102 has a name, address and other additional information,
2 describes information necessary for identifying the person indeed (collectively referred to as personal ID information), and creates a registration application form (604). The registration application form creation program generates a pair of the private key # 6 and the public key # 6 of the user 102, and adds the public key # to the registration application created by the user 102.
6 is attached (605).

The registration application 613 to which the public key # 6 of the user 102 is attached is encrypted with the public key # 5 of the bank 501 included in the registration application creation program.
01 via the Internet 101 (60
6).

The bank 501 decrypts the registration application 613 transmitted from the user 102 with the public key # 5 of the bank 501 using the private key # 5 of the bank 501, confirms the contents of the application, and uses it. A qualification examination is performed on the user 102 (607). If the result of the examination is unsuccessful, this fact is notified to the user 102 and this phase ends. After the screening, the personal ID information described in the registration application form of the user 102 is encrypted with the secret key # 7 of the bank 501 (secret key cryptosystem), and is used for the user to perform the registration work. It is set as data in the registration program (608). The registration program 614 in which the personal ID information encrypted with the private key # 7 of the bank 501 is set, and the registration application form 613
With the public key # 6 of the user 102 included in the
The data is transmitted to the user 102 via the Internet 101 (609).

The user 102 transmits the encrypted registration program 614 using the public key # 6 of the user 102 transmitted from the bank 501 to the computer 103 of the user 102 using the secret key # 6 of the user 102. Decrypt and execute (610). According to the registration program 614, the user 102 sends fingerprint information to the computer 103 using the fingerprint input device 108. The registration program 614 extracts a feature amount from the fingerprint information (611). User 102
Inserts an unused IC card into the IC card reader / writer 109 according to the registration program 614. The registration program 614 stores the fingerprint feature quantity extracted from the fingerprint information and the personal ID encrypted with the private key # 7 of the bank 501.
Information is simultaneously stored in this IC card (612).

As described above, an IC card owned by a user who is qualified to use this system is created.

The processing and data flow in the use phase will be described with reference to the block diagram of FIG.

First, in order to actually obtain a service, a use program is necessary, and the program is obtained via the Internet 101 (for example, WWW) (701). This use program is encrypted with the private key # 5 of the bank 501 (public key cryptosystem) so that it can be checked whether the program has been tampered with. To decrypt this, the bank 501
Public key # 5 of the Internet 101 (for example, WW
W) (702). In the computer 103 of the user 102, the use program is decrypted with the public key # 5 of the bank 501 and executed (703).

According to the use program, the user 10
2 inputs desired account operation contents 710 for the financial service provided by the bank 501 (704). According to the use program, the user 102 inserts the IC card created in the registration phase into the IC card reader / writer 109. The usage program reads out the fingerprint feature amount from this IC card. Further, the user 102 sends fingerprint information to the computer 103 using the fingerprint input device 108 according to the use program.

The use program collates the fingerprint information with the fingerprint feature read out from the IC card (705). As a result of the fingerprint collation, if the fingerprint presented at the time of use matches the fingerprint in the IC card, the IC card holder is determined to be valid, and the process proceeds to an account operation procedure. The use program reads the personal ID information 709 encrypted with the private key # 7 of the bank 501 from the IC card, and reads the account operation contents 710.
At the same time, the data is encrypted with the public key # 5 of the bank 501 included in the usage program and transmitted to the bank 501 via the Internet 101 (706).

The bank 501 decrypts the personal ID information 709 and the account operation content 710 encrypted with the public key # 5 of the bank 501 transmitted from the user 102 with the private key # 5 of the bank 501. Since the personal ID information 709 is further encrypted with the private key # 7 of the bank 501 (secret key encryption method), it is decrypted with the private key # 7. The bank 501 examines whether the account operation content 710 can be executed for the person indicated by the personal ID information (707). After passing the examination, the bank 501 executes the account operation content 710. If the account operation content 710 cannot be executed as a result of the examination, the user 102 is notified of the fact and the present phase ends (708).

According to the present invention, in the above-described two embodiments, the IC card storing the personal ID information is not stolen before storing the fingerprint feature quantity, and is not illegally used even in an unmanaged home. User registration work can be performed. In addition, user registration can be performed via a network, which saves labor and time compared to mailing.

In the above-described two embodiments, the medium for storing the personal ID information and the fingerprint feature is I
It does not have to be a C card. In short, any recording medium having sufficient capacity to store personal ID information and fingerprint feature amounts and having high tamper resistance may be used.

Although fingerprints were considered as biometrics, other biometrics such as palm print, palm shape, iris, retina, voice print, face, ear, dynamic signature, keystroke, vein pattern of the back of hand, and DNA are applied. May be. In this case, a corresponding biometric information input device is used.

The above is the detailed embodiment of the present invention. The present invention is widely applicable not only to Internet shopping systems and Internet banking systems but also to network systems requiring personal authentication.

[0054]

According to the present invention, in a home EC or financial system for performing personal authentication using a biometric feature stored in a recording medium held by a user, the personal I
The recording medium storing the D information is not stolen, and the user registration work can be performed without permission in an unmanaged home. In addition, user registration can be performed via a network, which saves labor and time compared to mailing.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of an Internet shopping system using the present invention.

FIG. 2 is an operation flowchart of an Internet shopping system using the present invention.

FIG. 3 is a block diagram of a registration phase of the Internet shopping system using the present invention.

FIG. 4 is a block diagram of a use phase of the Internet shopping system using the present invention.

FIG. 5 is a system configuration diagram of an Internet banking system using the present invention.

FIG. 6 is a block diagram of a registration phase of the Internet banking system using the present invention.

FIG. 7 is a block diagram of a use phase of the Internet banking system using the present invention.

[Explanation of symbols]

101: Internet, 102: User,
104: shops, 106: credit card companies,
108: fingerprint input device; 109: IC card reader / writer; 201: registration phase; 501: bank.

 ────────────────────────────────────────────────── ─── Continued on the front page (72) Inventor Yoshiaki Isobe 1099 Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture Inside the Hitachi, Ltd.System Development Laboratory (72) Inventor Yoichi Seto 1099 Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture Stock Company A term BB09 BC00 CA38 5B043 AA01 AA09 BA01 BA02 CA10 FA04 FA07 GA18 5B058 CA27 KA35 KA38 YA02 YA03 5B064 AA10 5B085 AC03 AC04 AE01 AE29 AE23 AE23 AE23

Claims (4)

[Claims] 1. In a home connected by a network,
Home EC (Elec) that performs personal authentication using the biometric features stored in the recording medium held by the user
In a financial system, in a financial system, at home, biometrics information is obtained from a biometrics information input device, and biometrics features extracted from the biometrics information and information other than biometrics necessary to identify an individual are used. A personal authentication system user, characterized in that a registration program for simultaneously storing personal ID information encrypted by an organization using certain personal ID information at home in a recording medium is provided to the user via a network. Registration method. 2. The personal authentication system user registration method according to claim 1, wherein the home EC and a registration application form required for registration of use of a financial system are encrypted, and a registration application for examining the contents is networked. A personal registration system user registration method, characterized in that a registration application form creation program to be transmitted is provided to a user via a network. 3. The personal authentication system user registration method according to claim 1, wherein the home EC and the financial system are Internet shopping systems. 4. The personal authentication system user registration method according to claim 1, wherein the home EC and the financial system are Internet banking systems.