JP2004013753A - User authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide service only to a specific user having a portable terminal. <P>SOLUTION: When a user requests service, a portable terminal 110 reads user's biometric certificate 105 from an IC card 100 owned by the user and transmits the data to an authentication device 160 through a communication network 155. An authentication request monitoring device connected to a data communications network confirms whether the biometric certificate 105 is effective or not by retrieving a lapse biometrics certificate list 158 and sends the result with the biometric certificate to the authentication device 160. The authentication device device 160 reads user's fingerprint by using a fingerprint scanner 190 and performs personal authentication by collating the fingerprint with the registering fingerprint information 105 received from the portable terminal 110. When the authentication device 160 succeeds in the authentication, the authentication device 160 provides the service to the user. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a personal authentication technique for authenticating a user using biometric information when providing a service to a user having a portable terminal.
[0002]
[Prior art]
As a user authentication technique using biometric information, for example, a technique described in JP-A-2001-117878 is known. In this technology, biometric information input by a user from a biometric information input device connected to a mobile phone is transmitted to a service provider that provides a service to a valid user, and the service provider authenticates the received biometric information. Send to server. The authentication server centrally manages the registered biometric information of the user registered in advance, authenticates the user by comparing the received biometric information with the registered biometric information, and transmits the authentication result to the service provider.
[0003]
On the other hand, as a technique for authenticating a user of a computer system in a specific management area, for example, a technique described in JP-A-2001-76270 is known. With this technology, an IC card that records the registered biometric information of the user is issued to a valid user, and when the user enters the management area, the IC card reader installed at the entrance is recorded on the user's IC card. The registered biometric information is read, and the registered biometric information is collated with the biometric information of the user input when using the computer system to authenticate the user.
[0004]
[Problems to be solved by the invention]
In the related art, when managing a list of IDs and registered biometric information (hereinafter referred to as a revocation list) that have been revoked due to consecutive failures in authentication or the like, it is efficient in an environment where management areas and authentication servers are dispersed. Had no idea how to share the revocation list.
[0005]
In the technique described in Japanese Patent Application Laid-Open No. 2001-117878, since the biometric information of the user is collectively managed by the authentication server, the psychological resistance of the user is large, and the authentication is performed when managing a large number of users. The management cost of the biological information in the server increases.
[0006]
[Means for Solving the Problems]
According to the present invention, first, by managing the revocation list in common among a plurality of authentication systems, the security against unauthorized authentication requests is increased, and at the same time, the revocation list is managed at low cost. Provide a system that can be built at low cost without the need.
[0007]
Secondly, the present invention provides a biometric authentication system in which the management cost of biometric information is low and the psychological resistance of the user is small.
[0008]
More specifically, the present invention provides a portable storage device that stores registered biometric information of a user, and a portable terminal that reads registered biometric information from the portable storage device and transmits the registered biometric information and a service request by data communication. And a monitoring device that determines whether the registered biometric information transmitted from the mobile terminal is valid, obtains biometric information input by a user, and obtains the determination result and the registration from the monitoring device. Upon receiving the biometric information and the service request, and collating the input biometric information received by the user with the received registered biometric information when the determination result indicates that the input biometric information is valid, the input biometric information is valid. And providing the requested service to the user when the user authentication is required.
[0009]
Further, the authentication device transmits an input request for the biometric information of the user to the mobile terminal when the determination result indicates that the determination is valid, acquires the biometric information of the user, The mobile terminal provides a user authentication system that presents an input request message to the user in response to the input request for the biometric information.
[0010]
According to this user authentication system, the validity of the transmitted user information is monitored in the data communication network. Therefore, a plurality of user authentication systems can share the revocation list in real time, and the security is improved. Further, since the data communication network manages the revocation list collectively, the system construction cost and the management cost can be reduced.
[0011]
Further, since the reading device of the portable storage device is built in the portable terminal, the authentication device does not need the reading device, and the cost of the authentication device can be reduced. Since third-generation mobile phones, which are expected to become the standard for mobile phones in the future, will have a built-in IC card reader as standard, if a standard third-generation mobile phone is used as a mobile terminal in the present invention, the Does not require additional costs for IC card readers. In addition, by transmitting a message to the user using a display device and a speaker provided as a standard feature of the mobile phone, the authentication device does not require a display device or a speaker, and the cost can be further reduced.
[0012]
Furthermore, since the registered biometric information is stored in a portable storage device, for example, an IC card, and managed by the user himself, there is no need to manage the biometric information on the authentication device side, and the system management cost can be reduced. Psychological resistance can be reduced.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, a first embodiment of the present invention will be described using a door management system leading to a management area as an example.
[0014]
FIG. 1 shows the configuration of the door management system of the present embodiment.
[0015]
In the present embodiment shown in the figure, a mobile communication network 155 for passing data exchanged between a user's IC card 100, a portable terminal 110, and a communication device such as a portable terminal, an authentication device (for opening and closing a door). And a door controller 160).
[0016]
Here, the IC card stores a user ID 102 and a biometrics certificate 105. The IC card can be stored inside the portable terminal 110 or inserted into the portable terminal 110.
[0017]
The mobile terminal 110 includes a control device 120 for controlling the operation of the mobile terminal, a communication device 115 for performing communication, a speaker 130 for outputting sound, and an IC card reader 125 for performing communication with an IC card.
[0018]
The door controller 160 controls the entire operation of the door controller 170, a communication device 165 for communication, a fingerprint scanner 190 for reading a user's fingerprint, and checks the read fingerprint with registered fingerprint information to determine whether they match. The verification device 175 includes a lock control device 180 that locks or unlocks a door leading to the management area.
[0019]
The mobile communication network 155 includes a base station 150 that performs wireless communication with a communication device such as a mobile terminal or a door controller, and an authentication request that monitors whether or not the user's biometric certificate transmitted from the mobile terminal is unauthorized. The monitoring device 157 connects, and the authentication request monitoring device 157 manages the revocation biometric certificate list 158.
[0020]
The biometric certificate includes the biometric information of the user and information accompanying the biometric information, and further includes additional information for guaranteeing the integrity of the information. FIG. 5 shows the data format of the biometric certificate.
[0021]
The data 501 is information for specifying a public key for verifying the signature of the issuer of the biometric certificate, such as the serial number of the certificate of the issuer.
[0022]
Data 502 contains the name of the issuer of the biometrics certificate, for example, For example, 500 people.
[0023]
Data 503 is the expiration date of the biometric certificate, for example, the start date and time and the end date and time.
[0024]
Data 504 is the serial number of the certificate issued by the issuer of the biometric certificate.
[0025]
The data 505 is information for uniquely identifying the user who has generated the registered biometric information of the biometric certificate, such as a mail ID or a mobile phone number.
[0026]
Data 506 is registered biometric information serving as a reference for collation, for example, fingerprint information.
[0027]
Data 507 is the signature of the issuer of the biometric certificate for the data 501 to 506.
[0028]
Next, the operation of the door management system according to the present embodiment will be described in detail.
[0029]
FIG. 3 shows a data flow between a user, a portable terminal, a mobile communication network, and a door controller, and a processing procedure. The dotted arrows in the figure indicate the flow of data through the mobile communication network, and the solid lines indicate the flow of other data.
[0030]
When the user enters the management area, the user first makes a door unlock request from the portable terminal 110 in which the user's own IC card 100 is inserted. As a method for the user to make an unlock request, for example, the user can access a URL written on a door.
[0031]
In response to the request from the user, in step 200, the portable terminal 110 reads the user's biometric certificate 105 from the IC card 100, and outputs a door unlock request signal and a biometric certificate via the mobile communication network 155. To the door controller 160.
[0032]
In the mobile communication network 155, the authentication request monitoring device 157, at step 202, transmits the door unlock request signal addressed to the door controller 160 and the data of the biometric certificate of the user according to the destination address of the packet passing through the network. Detect and receive. The authentication request monitoring device 157 verifies the received biometric certificate with the issuer's public key, and further searches the revoked biometric certificate list 158 to check whether the biometric certificate has been revoked. The result of the validity check, the door unlock request signal, and the biometric certificate of the user are transmitted to the door controller 160.
[0033]
The door controller 160 receives the door unlock request signal, the user ID, and the validity confirmation result. If the validity confirmation result is "valid" in step 205, the process proceeds to step 210; An unlocking rejection signal is transmitted to 110.
[0034]
Upon receiving the unlocking rejection signal, the portable terminal 110 presents an unlocking rejection message to the user in step 207.
[0035]
The door controller 160 transmits a fingerprint input request signal to the portable terminal 110 in step 210.
[0036]
The portable terminal 110 receives the fingerprint input signal, and in step 215, requests the user to input a fingerprint by voice from the speaker 130.
[0037]
In step 220, the door controller 160 reads the fingerprint input by the user from the fingerprint scanner 190. Next, in step 225, the collation device 175 collates the input fingerprint information with the received registered fingerprint information. As a result of the collation, when it is determined that the fingerprints match, the lock control device 180 unlocks the door.
[0038]
As described above, in the present embodiment, the authentication request monitoring device directly connected to the mobile communication network verifies and validates the biometric certificate. When a user sends registered biometric information stored in an IC card to a door controller, the registered biometric information always passes through a mobile communication network. Therefore, even when there are multiple door controllers, an authentication request monitoring device is provided at each location. There is no need to set up a revocation list, and system construction costs and operation management costs can be reduced. In addition, when fingerprint collation fails consecutively, the door controller notifies the authentication request monitoring device, and in response, the authentication request monitoring device can add the corresponding registered biometric information to the revocation list. As a result, when an unauthorized user performs an attack such as continuously issuing an authentication request to a plurality of door controllers using another person's IC card, fingerprint matching fails continuously in one door controller. Immediately after that, an authentication request to another door controller can be correctly rejected.
[0039]
If a mobile phone equipped with an IC card and an IC card reader, such as a standard third-generation mobile phone, is used as a mobile terminal, an IC card reader is not required on the authentication device side, and biometric information can be obtained at low cost. Can be used to construct a user authentication system.
[0040]
Hereinafter, a second embodiment of the present invention will be described using a mobile banking system that provides a banking service to a user having a mobile terminal as an example.
[0041]
FIG. 3 shows a configuration of the mobile banking system of the present embodiment.
[0042]
In the present embodiment shown in the figure, a mobile communication network 155 and the Internet 355 through which data exchanged between an IC card 100 owned by a user, a mobile terminal 110, and a communication device such as a mobile terminal, an Internet 355, and an authentication device (mobile Banking server 360).
[0043]
Here, the IC card stores a user ID 302 and registered biometric information 305. The IC card can be stored inside the portable terminal 110 or inserted into the portable terminal 110.
[0044]
The mobile terminal 110 includes a control device 320 for controlling the operation of the mobile terminal, a communication device 115 for performing communication, a display device 330 for displaying a message for the user, an IC card reader 125 for performing communication with an IC card, and a fingerprint of the user. And a fingerprint scanner 335 that reads the data.
[0045]
The mobile banking server 360 includes a control device 370 that controls the operation of the entire mobile banking server, a communication device 365 that communicates by connecting to the Internet 355, a collation device 175 that collates fingerprints to determine whether they match, a valid user. And a bank service providing device 375 that provides a bank service to the user when it is confirmed that
[0046]
The base station 150 is connected to the mobile communication network 155, and performs wireless communication with the communication device 115 of the portable terminal. Also, it connects to the Internet 355 via the gateway 350. The communication device 115 of the mobile terminal and the communication device 365 of the mobile banking server perform mobile communication via the mobile communication network 155 and the Internet 355. An authentication request monitoring device 347 for confirming that the user ID transmitted from the portable terminal is valid is connected to the mobile communication network 155, and the authentication request monitoring 347 manages a revocation ID list 348. .
[0047]
Next, the operation of the mobile banking system according to the present embodiment will be described in detail.
[0048]
FIG. 4 shows a data flow between a user, a portable terminal, a mobile communication network and the Internet, and a mobile banking server, and a processing procedure. The dotted arrows in the figure indicate the flow of data by wireless communication, and the solid lines indicate the flow of other data.
[0049]
When the user receives the mobile banking service, the user first requests the mobile banking service from the portable terminal 110 in which the user's own IC card 100 is inserted. As a method for the user to make a service request, for example, the user can make a call to a telephone number unique to the mobile banking server.
[0050]
In response to the request from the user, in step 400, the portable terminal 110 reads the user ID 302 from the IC card 100 and transmits a service request signal and an ID.
[0051]
The mobile communication network 155 receives the ID and the service request signal, and in step 402, the authentication request monitor 347 searches the revocation ID list 348 to confirm whether the ID is valid. The confirmation result, the ID, and the service request signal are transmitted to the mobile banking server 360.
[0052]
The mobile banking server 360 receives the service request signal, the above ID, and the result of the validity check, and proceeds to step 405 if the result of the validity check is “valid” in step 403. To send a denial of service signal.
[0053]
Upon receiving the denial of service signal, the portable terminal 110 presents a denial of service message to the user in step 404.
[0054]
If the validity confirmation result is “valid”, the mobile banking server 360 transmits a request signal of the registered fingerprint information of the user and the input fingerprint information to the portable terminal 110 in step 405.
[0055]
The portable terminal 110 receives the request signal of the registered fingerprint information and the input fingerprint information, and reads the registered biometric information 305 of the user from the IC card 100 in step 410. Further, a message prompting the user to input a fingerprint is displayed on the display device 330, thereby requesting the user to input the fingerprint. Next, in step 415, the fingerprint input by the user is read from the fingerprint scanner 335, and in step 420, the registered fingerprint information 305 and the input fingerprint information are transmitted to the mobile banking server 360.
[0056]
The mobile banking server 360 receives the registered fingerprint information and the input fingerprint information of the user, and compares them at step 425. As a result of the collation, when it is determined that the fingerprints match, the bank service providing apparatus 375 provides the bank service to the user.
[0057]
In the above embodiment, a fingerprint is used as biometric information used for user authentication. However, biometric information other than a fingerprint, such as a face or a voiceprint, may be used. Especially when using a voiceprint, a mobile terminal does not require a special input device such as a fingerprint scanner, and can input biometric information using a built-in microphone. it can.
[0058]
【The invention's effect】
As described above, according to the present invention, a plurality of distributed authentication apparatuses can share a revocation list in real time, thereby improving security.
[0059]
Further, since the mobile communication network manages the revocation list collectively, the system construction cost and the revocation list management cost can be reduced.
[0060]
Further, the operation management cost of the registered biometric information can be reduced, and the psychological resistance of the user can be reduced.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a first embodiment of the personal authentication system of the present invention.
FIG. 2 is a flowchart showing an operation of the embodiment.
FIG. 3 is a block diagram showing a second embodiment of the personal authentication system of the present invention.
FIG. 4 is a flowchart showing the operation of the embodiment.
[Explanation of symbols]
100 IC card 102 User ID
105 Registered fingerprint information 110 Mobile terminal 115 Communication device 120 Control device 125 IC card reader 130 Speaker 150 Base station 155 Mobile communication network 157 Authentication request monitoring device 158 Revocation biometric certificate list 160 Door controller 165 Communication device 170 Management device 175 Verification Device 180 Tablet control device 190 Fingerprint scanner

Claims (4)

A portable storage device that stores registered biometric information of a user, a unit that reads registered biometric information from the portable storage device, a mobile terminal that transmits the registered biometric information and a service request by data communication,
A monitoring device that determines whether the registered biometric information transmitted from the mobile terminal is valid,
Acquiring means for acquiring biometric information input by a user, means for receiving the judgment result, the registered biometric information and the service request from the monitoring device, and when the judgment result indicates that the judgment result is valid. Means for comparing the input biometric information input by the user with the received registered biometric information, and means for providing the requested service to the user when the input biometric information is valid. And a user authentication system. The user authentication system according to claim 1,
The authentication device, when the determination result indicates that it is valid, to the portable terminal, a means for transmitting a request for input of the user's biometric information, and means for obtaining the user's biometric information With
Means for presenting an input request message to the user in response to an input request for the biometric information, the user authentication system comprising: A portable storage device that stores user registration information, a unit that reads registration information from the portable storage device, an acquisition unit that acquires biometric information input by a user, and the registered biometric information by data communication. A mobile device that submits the service request;
A monitoring device that determines whether the registration information transmitted from the mobile terminal is valid,
Means for receiving the determination result, the registration information, and the service request from the monitoring device; and the input biometric information by the user and the registered biometric information of the user when the determination result indicates validity. Means for collating information with the information, and an authentication device having means for providing the requested service to the user when the input biometric information is valid. User authentication system. The user authentication system according to claim 3,
The authentication device, when the determination result indicates validity, the portable terminal, the registered biometric information of the user and means for requesting transmission of the biometric information input of the user Prepare,
Means for presenting an input request message to the user in response to an input request for the biometric information, the user authentication system comprising:

Images