JP2011243080A - User authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a user authentication system capable of eliminating a risk that data may be leaked as a result of operation content at an input device being seen by an unauthorized user.SOLUTION: A camera device 230 is juxtaposed to a display device 210 and installed at a position capable of photographing a user facing the display device 210. On the other hand, a camera device 240 is juxtaposed to an input device 220 and installed at a position capable of photographing a user who can visually recognize input content into the input device 220. The camera device 230 and the camera device 240 transmit a user's face image that is photographed to an information processing terminal 200 so that the image may be used, along with a user identification and a password, for user authentication at an authentication server 300.

Description

  The present invention relates to a user authentication system, and more particularly to a user authentication system that uses face information for authentication of a user who uses an information processing terminal.

  When using an information processing terminal, it is common to authenticate the user of the information processing terminal at the time of login (hereinafter referred to as “regular user”) by entering a user ID or password. However, in order to obtain a higher level of security, the face of the person to be authenticated is photographed using a CCD camera or the like, and the photographed face image is compared with a registered face image registered in advance. Authentication techniques for authenticating whether a user is a regular user are known.

  Furthermore, in order to improve security not only at the time of login but also after login, a legitimate user is temporarily away from the information processing terminal, etc. to record the face of the user who approached the information processing terminal when absent A technique that makes it easy to find an operation is also disclosed.

  In addition, in order to effectively suppress information leakage to users other than preset users, a display is displayed when the user's face is not recognized in the video taken by the camera or when a plurality of user's faces are recognized. Technology that can ensure high security for users other than authorized users (hereinafter referred to as “non-regular users”) by stopping the display of the operation screen for and invalidating input operations Is also disclosed.

  However, in any of these conventional technologies, the content of the input operation performed by an authorized user using an input device such as a keyboard is seen by an unauthorized user, and thus the data used by the authorized user is leaked. There is a risk that can occur.

  The reason is that the camera device is installed in a place where the user's face facing the display device such as a display can be photographed, and therefore the input device such as a keyboard other than the position facing the display (outside the camera photographing range). This is because it is difficult to prevent data leakage when there is an unauthorized user within the range where the contents of the input operation can be visually recognized.

  If there is an obstacle with the user even within the shooting range of the camera device, depending on the installation position of the camera device, the range in which the user's face can be recognized from the camera device is actually displayed. This is because there is an error in the range in which the input operation of the device or the input device can be visually recognized, and a blind spot is generated in the shooting range (detectable range) of the camera device. .

JP 2003-067339 A Patent No. 004284309 JP 2007-122493 A JP 2009-211381 A

  The problem to be solved is that it is difficult to eliminate the risk of data leakage due to an unauthorized user seeing the operation content performed by the input device.

  The main feature of the present invention is that a camera device is provided in the input device in order to suppress processing for an operation input when an unauthorized user is recognized within a range in which the input operation can be visually recognized.

  The present invention has an advantage that the risk of leakage of data used by an authorized user can be reduced by allowing an unauthorized user to see an input operation performed by an authorized user using an input device such as a keyboard. The reason is that a camera device for photographing the face of the user to be authenticated is provided together with an input device such as a keyboard.

  Furthermore, by increasing the number of camera devices, the blind spots due to errors that occur in the range where the user's face can be recognized from the camera devices and in the range where the input operation of the display device or input device can be visually recognized can be reduced as much as possible. The above advantages can be expanded.

  In this case, wasteful power consumption of the increased number of camera devices can be suppressed by controlling the power supply so that the camera devices function only when user authentication information is input and / or when a specific application is executed. . The identification and / or the number of camera devices to be controlled may be determined based on a security level registered in advance for the application.

It is a schematic block diagram of the user authentication system by this invention. It is a side sketch showing an example of a user authentication system of the present invention. It is a figure which shows one scene of the peep of the input content by a non-regular user. It is a figure which shows the other scene of the peep of the input content by a non-regular user. It is a flowchart of the power supply automatic control of a camera apparatus. It is a side sketch which shows the effect at the time of providing two or more camera devices for input devices. It is a side sketch which shows the effect at the time of providing two or more camera devices for display devices.

  The purpose of eliminating the risk of unauthorized users seeing the operation content performed by the input device is realized by providing a camera device in the input device.

  FIG. 1 is a schematic configuration diagram of a user authentication system of the present invention. This user authentication system performs user authentication with a user ID and a password, but adds authentication based on the user's face image. For this reason, this user authentication system is used to perform an operation input with an information processing terminal 200 such as a personal computer that can be used by the user 100, a display device 210 such as a display connected to the information processing terminal 200, and the like. An input device 220 such as a keyboard; a camera device 230 provided alongside the display device 210; a camera device 240 provided alongside the input device 220; an authentication server 300 to which the information processing terminal 200 is connected via a network; The authentication server 300 includes a user authentication registration database 310.

  At the time of user authentication, the user 100 inputs a user ID and a password from the input device 220 to the information processing terminal 200. The user 100 here includes not only a regular user who can legally use the information processing terminal 200 but also an unauthorized user who intends to use the information processing terminal 200 illegally.

  The camera device 230 is attached to the display device 210 and is installed at a position where a user who faces the display device 210 can be photographed. On the other hand, the camera device 240 is attached to the input device 220 and is installed at a position where a user who can visually recognize the content input to the input device 220 can be photographed.

  FIG. 2 is a side view illustrating a positional relationship among the user 100, the display device 210, the input device 220, the camera device 230, and the camera device 240 when the information processing terminal 200 is a stand-alone personal computer. The display device 210 is a liquid crystal display, and the input device 220 is a keyboard. The camera device 230 is attached to the upper edge of the display device 210 toward the face of the user 100 who uses the information processing terminal 200 in a state of being substantially parallel to the surface on which the input device 220 is placed. On the other hand, the camera device 240 is attached to the input device 220 in a state close to the back.

  The function of the camera device 240 will be described with reference to FIGS. The camera device 230 captures the face of the user 100. However, even if a wide-angle lens is provided, it is often impossible to photograph the face of the user 101 located behind the display device 210 (FIG. 3) or the user 102 located behind the user 100 (FIG. 4). Let's go. The camera device 240 also captures the face of the user 101 or the user 102.

  The elevation angle of the camera device 240 is selected to meet this purpose. For example, the line connecting the eye position of the user 100 and the lens of the camera device 240 when the user 100 is seated at a fixed position to use the information processing terminal 200, the lens of the camera device 230, and the lens of the camera device 240 You may make it turn to the center of the angle made with a connecting line. However, the present invention is not limited to this, and may be appropriately selected according to the sitting height of the user 100, the assumed height of the users 101 and 102, the height of the display device 210, and the like.

  The camera device 230 for the display device and the camera device 240 for the input device send the captured user's face image to the information processing terminal 200. The information processing terminal 200 determines whether monitoring by the camera device is necessary based on the OS or application. The information processing terminal 200 transmits the user ID and password to the authentication server 300 when monitoring by the camera device is unnecessary.

  On the other hand, when monitoring by the camera device is necessary, the camera device 230, 240 captures the user's face image and transmits the face image together with the user ID and password to the authentication server 300. At this time, the alive state of the camera devices 230 and 240 is checked by, for example, turning on / off the power, and the camera devices 230 and 240 are made to function or not to function depending on cases. This control may be performed individually by the camera device 230 and the camera device 240 by the OS or application using a camera device control driver or the like.

  This control can be performed according to the set security level. That is, the information processing terminal 200 can cause the camera device 230 and the camera device 240 to function, or only the camera device 230 to function, or none of the camera devices to function depending on the security level.

  A user ID, password, and authentication face image are registered in the user authentication registration database 310, and the authentication server 300 performs user authentication by comparing the transmitted data with the user authentication registration database 310. The result is transmitted to the information processing terminal 200.

  When it is authenticated that the user is an authorized user, an operation input to the information processing terminal 200 by the authorized user thereafter becomes possible. On the other hand, when it is determined that the user is not an authorized user or when a plurality of users are recognized, the operation input to the information processing terminal 200 is suppressed, and the user ID and password are requested again. Then, the information processing terminal 200 may display a warning, make a sound, or display information because an unauthorized user may see information displayed on the display device 210 or information input by the input device 220 and leak information. Information leakage is prevented by taking measures such as temporarily stopping.

  Note that user authentication based on face images is not limited to when a user ID and password are input, but may be performed when an application for which information leakage is to be prevented is being executed. Thereby, for example, it is possible to prevent leakage of information due to a peep at the time of word processing document creation or database input.

  In addition, the user authentication is preferably performed by continuing the user authentication operation after the completion of the authentication at the time of login to prevent information leakage to the unauthorized user.

  As described above, in the present invention, in addition to the camera device 230 for the display device 210, the camera device 240 for the input device 220 is provided, so that the non-regular user is within a range where the input operation to the input device 220 can be visually recognized. Is recognized, it is possible to suppress processing for an operation input to the information processing apparatus 200.

  FIG. 5 is a flowchart showing an example of automatic power control for the camera device. When the information processing terminal 200 detects that a user ID or password input screen is displayed on the display device 210 (step S1) and determines that monitoring by the camera device is required by the OS or application (step S2), If the power of the camera device is not turned on (step S3), the OS or application automatically turns on the power of the camera device using a camera device control driver or the like (step S4).

  If it is determined in step S2 that monitoring by the camera device is not necessary from the beginning, or if input of a user ID, password, or the like is completed and monitoring by the camera device is no longer necessary, the camera device If the power of the camera device is not turned off (step S5), the OS or application uses the camera device control driver or the like to automatically shut off the power of the camera device (step S6). As described above, by shifting the system from the monitoring state by the camera device to the normal use state, a power-saving monitoring system can be realized, which can contribute to environmental conservation.

  In the first embodiment, since there is one camera device 230 provided in the display device 210 and one camera device 240 provided in the input device 220, there is a blind spot in the photographing range of the authentication image. There is a concern. Here, by arranging a plurality of camera devices in the display device 210 and / or the input device 220, it is possible to increase the recognition accuracy of the non-regular user by minimizing blind spots and to prevent information leakage.

  6 and 7 are side plan views showing the second embodiment. 6 shows an example in which a camera device 240 and a camera device 241 are provided together with the input device 220, and FIG. 7 shows an example in which the camera device 230 and the camera device 231 are provided together with the display device 210.

  In the first embodiment (FIG. 2), one camera device 240 is installed in the input device 220. However, as shown in FIG. 6, if there is an obstacle 400 between the unauthorized user 101 at this installation position, The unauthorized user 101 cannot be recognized from the camera device 240. Therefore, by installing the camera device 241 on the opposite side of the input device 220, the unauthorized user 101 can be recognized. When the unauthorized user 101 is recognized, information leakage to the unauthorized user 101 can be prevented by suppressing processing for an operation input to the information processing terminal 200.

  Similarly, in the first embodiment (FIG. 2), one camera device 230 is installed on the display device 210. However, as shown in FIG. 7, there is an obstacle 401 between the non-regular user 102 at this installation position. If there is, the non-regular user 102 cannot be recognized from the camera device 230. Therefore, by installing the camera device 231 on the opposite side of the display device 210, the unauthorized user 102 can be recognized. When the unauthorized user 102 is recognized, information leakage to the unauthorized user 102 can be prevented by suppressing processing for an operation input to the information processing terminal 200.

  Two or more camera devices may be provided in the input device 220 and two or more camera devices in the display device 210. As the number increases, the user recognition rate improves. Therefore, it is only necessary to set a security level for each application and select the number according to the security level. However, as the number of camera devices installed increases, the accuracy of blind spot elimination increases, but the power consumption increases accordingly, so the power control of the camera device described with reference to FIG. 5 becomes even more important. .

  A part or all of the above embodiments can be described as in the following supplementary notes, but is not limited thereto.

  (Supplementary note 1) An input device for a user to manually input data to the information processing terminal, a display device for displaying the input data to the user, and the content of the input data on the input device Photographing at least one input device camera device attached to the input device and photographing the face image of the user viewing the content of the displayed data on the display device. In order to authenticate a user who uses the information processing terminal and at least one display device camera device provided in the display device, the user of the photographed user is input together with user authentication information input at the input device. A user authentication system using a face image.

  (Supplementary note 2) The information processing terminal is a stand-alone personal computer, wherein the input device camera device is attached to a hand edge of a keyboard, and the display device camera device is attached to an upper edge of a display. User authentication system.

  (Supplementary Note 3) The elevation angle of the camera device for the input device is the position of the eyes of the user when the information processing terminal is located at a fixed position for using the information processing terminal when viewed from the side, and for the input device. The user authentication system according to appendix 2, wherein the user authentication system is set to the center of an angle formed by a line connecting the lenses of the camera device and a line connecting the lens of the display camera device and the lens of the input device camera device.

  (Additional remark 4) The user authentication system of Additional remarks 2-3 which attaches the said camera apparatus for input devices to the front edge of the said keyboard.

  (Additional remark 5) The user authentication system of Additional remarks 2-3 which attaches the said camera apparatus for display apparatuses to the lower edge of the said display.

  (Additional remark 6) The said camera apparatus for input devices and / or the said camera apparatus for display apparatuses are controlled so that it functions only when the said user authentication information is input and / or when a specific application is performed. The user authentication system described.

  (Supplementary note 7) The user authentication system according to supplementary note 6, wherein the function of the camera device for input device and / or the camera device for display device is controlled by turning on and off power.

(Supplementary note 8) The specification and / or number of the input device camera device and / or the display device camera device whose functions are controlled are determined based on a security level registered in advance for the application. 8. The user authentication system according to 7.

  In addition to personal computers, it can be used to prevent peeping when entering a PIN in a cash dispenser such as an ATM.

DESCRIPTION OF SYMBOLS 100 User 101 Non-regular user 102 Non-regular user 200 Information processing terminal 210 Display device 220 Input device 230 Camera device 231 Camera device 232 Camera device 240 Camera device 241 Camera device 242 Camera device 300 Authentication server 310 User information database 400 Obstacle 401 Failure object

Claims (8)

An input device for a user to manually input data into the information processing terminal;
A display device for displaying the input data to a user;
At least one camera device for an input device provided in the input device to capture a face image of a user who visually recognizes the content of the input data on the input device;
At least one camera device for display device provided in the display device to capture a face image of a user who visually recognizes the content of the displayed data on the display device;
In order to authenticate a user who uses the information processing terminal, a user authentication system using the photographed user's face image together with user authentication information input in the input device. The information processing terminal is a stand-alone personal computer,
2. The user authentication system according to claim 1, wherein the input device camera device is attached to a hand edge of a keyboard, and the display device camera device is attached to an upper edge of the display.   The angle of elevation of the camera device for input device is the position of the eyes of the user when the information processing terminal is viewed from the side and positioned at a fixed position for using the information processing terminal, and the lens of the camera device for input device 3. The user authentication system according to claim 2, wherein the user authentication system is a center of an angle formed by a line connecting the lens of the display camera device and a line connecting the lens of the input device camera device. .   The user authentication system according to claim 2, wherein the input device camera device is attached to a front edge of the keyboard.   The user authentication system according to claim 2, wherein the display device camera device is attached to a lower edge of the display.   6. The input device camera device and / or the display device camera device is controlled to function only when the user authentication information is input and / or when a specific application is executed. The user authentication system described in 1.   7. The user authentication system according to claim 6, wherein the functions of the camera device for input device and / or the camera device for display device are controlled by turning on and off power.   The identification and / or number of the input device camera device and / or the display device camera device whose function is controlled is determined based on a security level registered in advance for an application. 8. The user authentication system according to 7.

Images