JP4545480B2 - Electronic signature generation device, web server, biometric information authentication device, and user authentication system - Google Patents

Description

  The present invention relates to an electronic signature generation device, a web server, a biometric information authentication device, and a user authentication system.

In a computer system such as a website on the Internet, various user authentications are performed in order to allow access only from a specific user. As a conventional user authentication method, a method of authenticating a user by inputting a user ID and a password, a method of performing identity verification by an electronic certificate or an electronic signature, and the like are known. Among these, as a user authentication method using an electronic signature, for example, there is a user authentication method described in Patent Document 1 below. In this user authentication method, an electronic signature generated based on a user's biometric information is registered in advance in a personal authentication device, and the customer terminal is personal when transmitting information with an electronic signature from the user terminal to the customer terminal. By authenticating the electronic signature by transferring the electronic signature to the authentication apparatus and verifying the electronic signature in the personal authentication apparatus.
JP 2001-265738 A

  However, the above-described conventional user authentication method has the following problems. That is, in order to perform user authentication, it is necessary to register the electronic signature data of all users in advance in the personal authentication device, so that the possibility of leakage of electronic signature data by centrally managing the electronic signature data increases. Further, when the number of users managed in the personal authentication device increases, the processing load when searching for electronic signature data and comparing it with data to be authenticated increases.

  Accordingly, the present invention has been made in view of such problems, and an electronic signature generation device and a web server that can perform user authentication safely and efficiently by managing user authentication data in a distributed manner An object of the present invention is to provide a biometric information authentication device and a user authentication system.

In order to solve the above problems, an electronic signature generation apparatus according to the present invention includes a biometric information receiving unit that receives input of user biometric information and user attribute information, and user attribute information received by the biometric information receiving unit. Is generated by adding an electronic signature using an electronic key to the biometric information received by the biometric information and the attribute information storage means that stores the biometric information in association with the biometric information. An electronic signature adding means, a biometric information transmitting means for transmitting the biometric information to which the electronic signature is added by the electronic signature adding means to the user terminal, a decryption electronic key and an attribute for decrypting the electronic signature Electronic key transmission means for transmitting the network address of the information storage means to a biometric information authentication device for authenticating biometric information.

According to such an electronic signature generation device, the user's biometric information is received, an electronic signature is added to the biometric information to generate authentication biometric information, and the biometric information for authentication is transmitted to the user terminal. Management of local authentication data at the user terminal becomes possible. In addition, since the decryption electronic key for decrypting the electronic signature is transmitted to the biometric information authentication apparatus, the biometric information authentication apparatus can decrypt the authentication biometric information and use it for user authentication. Furthermore, the electronic signature generation apparatus receives and stores attribute information together with biometric information from the user, and transmits the storage destination network address together with the decryption electronic key to the biometric information authentication apparatus. It is possible to notify the biometric information authentication device of the storage destination address while performing distributed management in the generation device.

Or the web server of this invention requests | requires transmission of biometric information to a user terminal according to reception of the connection request | requirement means which receives the connection request which requests | requires access from a user terminal, and the connection request reception means. Biometric information requesting means; biometric information transfer means for receiving from the user terminal biometric information of the user and biometric information for authentication in which an electronic signature is added to the biometric information; and transferring the biometric information to a biometric information authenticating apparatus that authenticates the biometric information Authentication result receiving means for receiving the authentication result of the biometric information and the storage destination network address of the user attribute information from the biometric information authentication device, the storage destination network address received by the authentication result receiving means, and the biometric information of the user based on the attribute information acquisition means for acquiring attribute information of the user, based on the received authentication result by the authentication-result receiving means It includes a user authentication means for permitting a connection request from the user terminal.

According to such a web server, after requesting biometric information in response to a connection request from the user terminal, the biometric information and authentication biometric information are received from the user terminal and transferred to the biometric information authentication apparatus. Thereby, locally managed authentication data and authentication target data can be received and provided to the biometric information authentication apparatus. In addition, since the authentication result is received from the biometric information authentication apparatus and the connection from the user terminal is permitted based on the result, the user authentication can be performed more safely by using locally managed authentication data. it can. Furthermore, since the storage destination network address of the user attribute information is received as the authentication result and the attribute information is acquired based on the network address and the biometric information, the user attribute information can be easily acquired together with the biometric information authentication. it can.

Alternatively, the biometric information authentication apparatus according to the present invention includes a decryption electronic key and user attribute information corresponding to the electronic key used when the electronic signature is added to the biometric information from the electronic signature generation apparatus that receives input of the biometric information of the user. An electronic key receiving means for receiving the storage destination network address, biometric information receiving means for receiving the biometric information of the user and the biometric information for authentication in which an electronic signature is added to the biometric information from the web server, and the biometric for authentication A biometric information decrypting unit that decrypts the biometric information for authentication using the electronic key by searching an electronic key for decrypting information from among the decrypting electronic keys received by the electronic key receiving unit; Biometric information authenticating means for authenticating a user by collating the biometric information for authentication decrypted by the biometric information decrypting means with the biometric information of the user, and biometric information authentication And an authentication result transmitting unit that transmits the storage destination network address received with the authentication result and the electronic key biological information decoding means is used for the user to the web server by stage.

According to such a biometric information authentication device, the authentication biometric information decryption electronic key is received from the electronic signature generation device, the user biometric information and the authentication biometric information are received from the web server, and the authentication biometric information is received. An electronic key that can decrypt the information is searched, and the biometric information for authentication is decrypted. Further, the biometric information of the user is collated and authenticated using the decrypted biometric information for authentication, and the authentication result is transmitted to the web server. Thereby, the authentication data managed locally and the biometric information acquired from the user are used to ensure the reliability of the authentication data and to realize more efficient user authentication. Further, the storage destination network address of the user attribute information is received together with the decryption electronic key from the electronic signature generation apparatus, and the storage destination network address corresponding to the decryption electronic key used for decrypting the authentication biometric information is stored in the web server. Therefore, it is possible to reliably notify the attribute information storage destination related to the user who has made the connection request.

  Alternatively, a user authentication that includes the above-described electronic signature generation device, the above-described web server, and the above-described biometric information authentication device, and performs communication between the electronic signature generation device, the web server, and the biometric information authentication device. It may be constructed or operated as a system.

  ADVANTAGE OF THE INVENTION According to this invention, user authentication can be performed safely and efficiently by managing the user authentication data in a distributed manner.

  Hereinafter, preferred embodiments of a user authentication system according to the present invention will be described in detail with reference to the drawings. In the description of the drawings, the same elements are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 1 is a schematic configuration diagram showing a preferred embodiment of a user authentication system 1 according to the present invention. This user authentication system 1 is a network system for generating biometric information with a user's electronic signature in an apparatus installed in a store or the like and realizing user authentication at the time of accessing a website using the biometric information with the electronic signature. is there. As shown in the figure, a user authentication system 1 includes an electronic signature generation device 3 comprising a user terminal 2 used by a user to be authenticated, a store terminal 3A installed in a plurality of stores, and a database (DB) server 3B. And a web server 4 that provides information on a home page and a biometric information authentication device 5 that performs user authentication processing. The user terminal 2, the store terminal 3 </ b> A, the DB server 3 </ b> B, the web server 4, and the biometric information authentication device 5 can perform data communication with each other via the communication network 6. Hereinafter, for convenience of explanation, it is assumed that the electronic signature generation device 3 is installed in the store X.

  The user terminal 2 is a communication terminal used by a user to be authenticated in the user authentication system 1 and has a short-range wireless communication function such as a non-contact IC (Integrated Circuit) communication method and an infrared communication method, and a mobile communication method. Is configured to be connectable to the communication network 6. Examples of such communication terminals include mobile phones, PHS (Personal Handyphone System), PDA (Personal Digital Assistants), and portable personal computers.

  The user terminal 2 includes a biological information reading unit 201 that receives input of biological information from the user. Examples of biometric information that can be input include fingerprint images, finger vein images, palm print images, retinal images, red images, facial images, and the like. The user terminal 2 stores biometric information read by the biometric information reading unit 201 and biometric information storage unit 202 that stores biometric information for authentication (details will be described later) generated by the digital signature generation device 3. Is provided. The biometric information storage unit 202 is preferably a data area having tamper resistance for preventing information acquisition or falsification by an illegal procedure from the outside. Furthermore, the user terminal 2 sends the biometric information for authentication from the electronic signature generation device 3 by short-range wireless communication and the biometric information for authentication and the biometric information received from the user to the web server 4 by mobile communication. And a function to transmit.

  The electronic signature generation device 3 is a computer system that is installed in a place such as a store where a user conducts a commercial transaction, and adds an electronic signature to biometric information acquired from the user. FIG. 2 is a schematic configuration diagram of the electronic signature generation apparatus 3. As shown in the figure, the store terminal 3A includes, as functional components, a biometric information receiving unit (biometric information receiving unit) 301, an electronic key generating unit 302, an electronic signature adding unit (electronic signature adding unit) 303, A biometric information transmission unit (biometric information transmission unit) 304 and an electronic key transmission unit (electronic key transmission unit) 305 are provided. The DB server 3B includes an attribute information storage unit (attribute information storage unit) 306. Hereinafter, components of the electronic signature generation device 3 will be described in detail.

  The biometric information accepting unit 301 is a part that accepts input of biometric information of a user, and has a physical configuration such as a sensor such as a fingerprint sensor or an image data acquisition camera. The biometric information received includes a fingerprint image, a finger vein image, a palm print image, a retina image, a red image, a facial image, and the like, as with the user terminal 2. The biometric information receiving unit 301 outputs the received biometric information of the user to the electronic signature adding unit 303 as digital data.

  The biometric information receiving unit 301 also has a function of receiving input of attribute information indicating personal attributes of the corresponding user together with the above biometric information. The biometric information accepting unit 301 can accept input of user attribute information from an information input unit such as a keyboard provided in the store terminal 3A, an information reading device such as a disk drive device, and the near field communication from the user terminal 2. Can also be received. When receiving the user's attribute information, the biometric information receiving unit 301 stores the attribute information in the attribute information storage unit 306 of the DB server 3B in association with the corresponding user's biometric information. FIG. 5 is a diagram showing a data configuration of the attribute information stored in the attribute information storage unit 306 in this way. As shown in the figure, the attribute information of the user is the name “Taro Yamada”, the user ID “yamada”, the address “Tokyo Metropolitan XX City ×× Town”, the date of birth “19751001”, and the mail address “yamada” Information such as “@xxxx” is stored in association with the biometric information “ABC0002134” of the corresponding user.

  Returning to FIG. 2, the electronic key generation unit 302 is a part that generates an electronic key used for encryption of an electronic signature in the store terminal 3A. Specifically, the electronic key generation unit 302 generates a private key, which is an electronic key used when generating an electronic signature by a public key cryptosystem, and then decrypts the electronic signature (decryption). Electronic key) is also generated. The electronic key generation unit 302 outputs the generated private key to the electronic signature addition unit 303 and outputs a public key corresponding to the private key to the electronic key transmission unit 305.

  The electronic signature adding unit 303 is a part that generates an electronic signature for the biometric information of the user received by the biometric information receiving unit 301 using the secret key generated by the electronic key generating unit 302. Specifically, the digital signature adding unit 303 converts biometric information, which is digital data having an arbitrary bit length, into a fixed-length hash value using a hash function, and encrypts the hash value using a public key cryptosystem. To generate an electronic signature. Also, the electronic signature adding unit 303 adds the generated electronic signature to the user's biometric information received by the biometric information receiving unit 301 and outputs the biometric information to the biometric information transmitting unit 304 as authentication biometric information for the user.

  The biometric information transmitting unit 304 transmits the biometric information for authentication generated by the electronic signature adding unit 303 to the user terminal 2 using short-range wireless communication. In the user terminal 2, the transmitted biometric information for authentication is stored in the biometric information storage unit 202.

  The electronic key transmission unit 305 sends the public key generated by the electronic key generation unit 302 and the DB server information including the network address of the attribute information storage unit 306, which is the IP address of the DB server 3B, to the biometric information authentication device 5. Send.

  The web server 4 is a WWW (World Wide Web) server system that transmits to the user terminal 2 a home page on which information such as commercial transaction information that requires user authentication and member-specific information is posted. FIG. 3 is a schematic configuration diagram of the web server 4. As shown in the figure, the web server 4 includes, as functional components, a connection request receiving unit (connection request receiving unit) 401, a biometric information request unit (biological information request unit) 402, and a biometric information transfer unit (biological information). A transfer unit) 403, an authentication result receiving unit (authentication result receiving unit) 404, an attribute information acquisition unit (attribute information acquisition unit) 405, and a user authentication unit (user authentication unit) 406. Hereinafter, the components of the web server 4 will be described in detail.

  The connection request receiving unit 401 is a part that receives connection request data for requesting transmission of homepage display data provided by the web server 4 from the user terminal 2. This connection request data includes the address of the user terminal 2 that identifies the request source. After receiving the connection request data from the user terminal 2, the connection request receiving unit 401 outputs the address of the user terminal 2 included in the connection request data to the biometric information requesting unit 402.

  The biometric information request unit 402 is a part that requests the user terminal 2 to transmit biometric information in response to the address output of the user terminal 2 from the connection request receiving unit 401. The biometric information request unit 402 makes a biometric information transmission request to the address of the user terminal 2, and then outputs the address of the user terminal 2 to the user authentication unit 406.

  The biometric information transfer unit 403 is a part that receives user biometric information and authentication biometric information transmitted from the user terminal 2 in response to a request from the biometric information request unit 402. The biometric information transmitted from the user terminal 2 is read by the biometric information reading unit 201 of the user terminal 2, and the authentication biometric information is generated in advance by the electronic signature generation device 3 and stored in the biometric information storage unit 202. It has been done. In addition, the biometric information transfer unit 403 transfers the received user biometric information and authentication biometric information to the biometric information authentication device 5 and outputs the biometric information to the attribute information acquisition unit 405.

  The authentication result receiving unit 404 is a part that receives from the biometric information authentication device 5 the result of user authentication performed using the biometric information transferred by the biometric information transfer unit and the biometric information for authentication. Specifically, when the user authentication result in the biometric information authentication device 5 is OK, the authentication result receiving unit 404 receives DB server information including the IP address of the DB server 3B as authentication result information. On the other hand, when the user authentication result in the biometric information authentication device 5 is NG, the authentication result receiving unit 404 receives the authentication result information “NG”. The authentication result reception unit 404 outputs the authentication result information received from the biometric information authentication device 5 to the attribute information acquisition unit 405.

  The attribute information acquisition unit 405 acquires the attribute information of the corresponding user from the DB server 3B based on the authentication result information received from the authentication result reception unit 404 and the user biometric information received from the biometric information transfer unit 403. It is. In this case, the attribute information acquisition unit 405 searches the attribute information storage unit 306 by specifying the IP address of the DB server 3B included in the authentication result information as a reference destination address, and receives the user information received from the biometric information transfer unit 403. Read attribute information including biometric information that matches the biometric information. In the example shown in FIG. 5, when the user's biometric information “098bbbafaji” is received from the biometric information transfer unit 403, the name “Hanako Yamada”, the user ID “hanako”, the address “Osaka Prefecture ○○ ward Δ △ machi”, Get birth date "20000104" and email address "hanako @ xxxx". The attribute information acquisition unit 405 outputs the acquired user attribute information and authentication result information to the user authentication unit 406.

  The user authentication unit 406 is a part that permits a connection request from the user terminal 2 based on the user attribute information and authentication result information received from the attribute information acquisition unit 405. Specifically, when the authentication result information is not “NG” and the attribute information is valid data, the user authentication unit 406 transmits connection response data to the user terminal 2 and then sends the connection response data to the user terminal 2. To allow download of homepage display data. Note that whether or not the attribute information is valid data is determined by checking with some user attribute information stored in advance in the web server 4 or whether or not the attribute information has a predetermined data format. Is done.

  The biometric information authentication device 5 is a computer system for performing user authentication of the user terminal 2 in response to an access request to the web server 4 of the user terminal 2. FIG. 4 is a schematic configuration diagram of the biometric information authentication device 5. As shown in the figure, the biometric information authentication device 5 includes, as functional components, an electronic key receiving unit (electronic key receiving unit) 501, an address information registration unit 502, an electronic key registration unit 503, and a biometric information reception. Unit (biological information receiving unit) 504, biometric information decoding unit (biological information decoding unit) 505, biometric information authentication unit (biological information authentication unit) 506, address information search unit 507, and authentication result transmission unit (authentication result) Transmission means) 508. Hereinafter, the components of the biometric information authentication device 5 will be described in detail.

  The electronic key receiving unit 501 receives the public key transmitted from the electronic key transmitting unit 305 of the store terminal 3A and the DB server information including the IP address of the DB server 3B that is the storage destination network address of the user attribute information. It is. This public key is an electronic key for decryption corresponding to the secret key used when generating biometric information for authentication in the store terminal 3A. The electronic key receiving unit 501 outputs the DB server information to the address information registration unit 502 and outputs the received public key to the electronic key registration unit 503 at the same time.

  The address information registration unit 502 associates the DB server information including the IP address of the DB server 3B received from the electronic key receiving unit 501 with the store ID for identifying the store X in which the DB server 3B is installed, Store in the storage unit 509. FIG. 6 is a diagram showing the configuration of data stored in the address information storage unit 509 in this way. As shown in the figure, DB server information including a store name “Store X”, a storage destination IP address “192.168.X.X1” which is an IP address of the DB server 3B, and a store registration date “20031224”. Are stored in association with the store ID “0001” for identifying the store X. Returning to FIG. 4, the address information registration unit 502 outputs the store ID added to the DB server information to the electronic key registration unit 503.

  The electronic key registration unit 503 is a part that stores the public key received from the electronic key reception unit 501 and the store ID received from the address information registration unit 502 in the electronic key storage unit 510 in association with each other. FIG. 7 is a diagram showing a configuration of data stored in the electronic key storage unit 510. As shown in the figure, the public key “01CA3D126FFF” received from the electronic key receiving unit 501 and the expiration date “20051223” of the public key are stored in association with the store ID “0001” for identifying the store X. .

  The biometric information receiving unit 504 is a part that receives the user's biometric information and authentication biometric information transferred from the biometric information transfer unit 403 of the web server 4 via the communication network 6. The biometric information receiving unit 504 outputs the received biometric information of the user to the biometric information authentication unit 506, and outputs the received biometric information for authentication to the biometric information decoding unit 505.

  The biometric information decryption unit 505 is a part that searches the electronic key storage unit 510 for an electronic key that can be decrypted after extracting the electronic signature from the biometric information for authentication. Specifically, the biometric information decryption unit 505 performs decryption processing on the extracted electronic signature using a public key stored in the electronic key storage unit 510 whose current time is before the electronic key expiration date. Do. As a result of the decryption process, the biometric information decryption unit 505 searches for a public key that has been successfully decrypted, identifies a store ID corresponding to the public key, and outputs the store ID to the address information search unit 507. Whether or not the decryption process has been normally completed is determined by comparing the decrypted electronic signature with the biometric information included in the biometric information for authentication and determining whether or not they match. The biometric information decryption unit 505 outputs the decrypted electronic signature to the biometric information authentication unit 506.

  The biometric information authenticating unit 506 is a unit that authenticates the user of the user terminal 2 by collating the electronic signature decrypted by the biometric information decrypting unit 505 with the biometric information received from the biometric information receiving unit 504. Specifically, the biometric information authentication unit 506 converts the biometric information into a hash value using the same hash function as the hash function used by the store terminal 3A, compares the hash value with the electronic signature, The user authentication is performed based on whether or not the difference in data is within a predetermined error range. The biometric information authentication unit 506 outputs authentication result information “OK / NG” regarding the user authentication process to the address information search unit 507.

  The address information search unit 507 is a part that searches for the storage destination network address of the attribute information of the user based on the store ID received from the biometric information decryption unit 505 and the authentication result information received from the biometric information authentication unit 506. is there. Specifically, when the authentication result information is “OK”, the address information search unit 507 searches the address information storage unit 509 using the store ID as a search key, and reads the DB server information corresponding to the store ID. In the example illustrated in FIG. 6, when the store ID “0002” is received from the biometric information decryption unit 505, the storage destination IP address “192.168.X.X2” and the store name “store Y” corresponding to the store ID “0002” are stored. And read. The address information search unit 507 adds the read DB server information to the authentication result information “OK / NG” and outputs it to the authentication result transmission unit 508.

  Returning to FIG. 4, the authentication result transmission unit 508 transmits the authentication result information received from the address information search unit 507 to the web server 4. In this case, if the authentication result information is “OK”, the authentication result transmission unit 508 adds the DB server information to the authentication result information and transmits it.

  Next, the operation of the user authentication system 1 will be described. FIG. 8 is a flowchart showing operations at the time of generating biometric information for authentication and registering an electronic key for decryption, and FIG. 9 is a flowchart showing user authentication processing when accessing the web server 4 from the user terminal 2. First, the biometric information generation process for authentication and the electronic key registration process for decryption will be described with reference to FIG.

  First, the biometric information receiving unit 301 of the store terminal 3A installed in the store X receives input of biometric information and attribute information from the user (step S101). The received biometric information and attribute information are stored in the attribute information storage unit 306 by the biometric information reception unit 301 (step S102). Next, based on the biometric information received from the user, the electronic signature adding unit 303 generates an electronic signature using the secret key (step S103). Thereafter, the electronic signature generated by the electronic signature adding unit 303 is added to the biometric information to generate biometric information for authentication (step S104).

  The biometric information for authentication generated as described above and the biometric information received from the user are transmitted to the user terminal 2 by the biometric information transmission unit 304 and stored in the biometric information storage unit 202 of the user terminal 2 ( Step S105). Further, the public key corresponding to the secret key used for encoding the electronic signature and the DB server information including the IP address of the DB server 3B are transmitted to the biometric information authentication apparatus 5 (step S106).

  On the other hand, the address information registration unit 502 of the biometric authentication device 5 stores the DB server information received from the store terminal 3A in the address information storage unit 509 together with the store ID for identifying the store X (step S107). Also, the electronic key registration unit 503 stores the received public key in the electronic key storage unit 510 together with the store ID (step S108).

  Next, with reference to FIG. 9, user authentication processing when accessing the web server 4 from the user terminal 2 will be described.

  First, the connection request receiving unit 401 of the web server 4 receives connection request data from the user terminal 2 (step S201). In response to this, the biometric information request unit 402 requests the user terminal 2 to transmit biometric information (step S202). When the user terminal 2 receives the biometric information transmission request, the biometric information of the user is read by the biometric information reading unit 201 of the user terminal 2 (step S203). Thereafter, the biometric information read from the user terminal 2 and the biometric information for authentication stored in the biometric information storage unit 202 are transmitted to the biometric information transfer unit 403 of the web server 4 (step S204). Next, when the biometric information transfer unit 403 receives the biometric information and the biometric information for authentication, the biometric information transfer unit 403 transfers the biometric information to the biometric information authentication device 5 (step S205).

  Thereafter, the biometric information decryption unit 505 of the biometric information authentication device 5 searches for an electronic key that can decrypt the electronic signature included in the biometric information for authentication from the data stored in the electronic key storage unit 510 (step S206). . As a result, the biometric information decryption unit 505 decrypts the electronic signature using the searched public key (step S207). Next, the biometric information authentication unit 506 performs user authentication by collating the decrypted electronic signature with the biometric information (step S208). Then, after the address information search unit 507 searches the DB server information related to the DB server 3B from the address information storage unit 509, the authentication result transmission unit 508 adds the DB server information to the authentication result information and transmits it to the web server 4. (Step S209).

  The attribute information acquisition unit 405 of the web server 4 uses the storage destination IP address included in the DB server information received from the biometric information authentication device 5 and the biometric information of the user to obtain the attribute information of the corresponding user from the DB server 3B. Obtain (step S210). Next, the user authentication unit 406 permits a connection request from the user terminal 2 based on the acquired attribute information and the authentication result by the biometric information authentication device 5 (step S211). Thereafter, homepage display data is downloaded from the web server 4 to the user terminal 2.

  According to the user authentication system 1 described above, the electronic signature generation device 3 receives the biometric information of the user, adds an electronic signature to the biometric information, generates biometric information for authentication, and generates the biometric information for authentication. Since the data is transmitted to the user terminal 2, local authentication data can be managed in the user terminal 2. Further, in the web server 4, after requesting biometric information in response to a connection request from the user terminal 2, the biometric information and authentication biometric information are received from the user terminal 2 and transferred to the biometric information authentication device 5. . As a result, locally managed authentication data and authentication target data can be received and provided to the biometric information authentication device 5. Further, the biometric information authentication device 5 searches for an electronic key that can decrypt the biometric information for authentication, decrypts the biometric information for authentication, collates and authenticates the biometric information of the user using the biometric information for authentication, The authentication result is transmitted to the web server 4. Further, the web server 4 permits connection from the user terminal 2 based on the authentication result in the biometric information authentication device 5. As a result, by performing authentication using locally managed authentication data and biometric information acquired from the user, the reliability of the authentication data is ensured and safer and more efficient user authentication is achieved. realizable.

  In addition, this invention is not limited to each embodiment mentioned above. For example, when the electronic signature is generated by the electronic signature generation device 3, it may be generated using a secret key cryptosystem.

1 is a schematic configuration diagram showing a preferred embodiment of a user authentication system 1 according to the present invention. It is a schematic block diagram of the electronic signature production | generation apparatus of FIG. It is a schematic block diagram of the web server of FIG. It is a schematic block diagram of the biometric information authentication apparatus of FIG. It is a figure which shows the data structure of the attribute information stored in the attribute information storage part of FIG. It is a figure which shows the structure of the data stored in the address information storage part of FIG. It is a figure which shows the structure of the data stored in the electronic key storage part of FIG. 3 is a flowchart showing operations at the time of generating biometric information for authentication and registering an electronic key for decryption in the user authentication system of FIG. 1. It is a flowchart which shows the user authentication process at the time of web server access from a user terminal.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... User authentication system, 2 ... User terminal, 201 ... Biometric information reading part, 202 ... Biometric information storage part, 3 ... Electronic signature production | generation apparatus, 3A ... Store terminal, 3B ... DB server 301 ... Biometric information reception part, 302 ... Electronic key generation unit 303 ... Electronic signature addition unit 304 ... Biometric information transmission unit 305 ... Electronic key transmission unit 306 ... Attribute information storage unit 4 ... Web server 401 ... Connection request reception unit 402 ... Biometric information request 403 ... biometric information transfer unit, 404 ... authentication result reception unit, 405 ... attribute information acquisition unit, 406 ... user authentication unit, 5 ... biometric information authentication device, 501 ... electronic key reception unit, 502 ... address information registration unit, 503: Electronic key registration unit, 504: Biometric information reception unit, 505 ... Biometric information decryption unit, 506 ... Biometric information authentication unit, 507 ... Address information search unit, 508 ... Authentication result transmission unit, 509 Address information storing section, 510 ... electronic key storage unit, 6 ... communication network.

Claims (4)

Biometric information receiving means for receiving input of biometric information of a user and input of attribute information of the user ;
Attribute information storage means for storing the attribute information of the user received by the biological information reception means in association with the biological information;
An electronic signature adding means for generating biometric information for authentication by generating and adding an electronic signature using an electronic key to the biometric information received by the biometric information receiving means;
Biometric information transmitting means for transmitting biometric information for authentication to which an electronic signature is added by the electronic signature adding means to a user terminal;
An electronic key transmitting means for transmitting a decryption electronic key for decrypting the electronic signature and a network address of the attribute information storage means to a biometric information authentication device for authenticating the biometric information;
An electronic signature generation apparatus comprising: Connection request receiving means for receiving a connection request for requesting access from a user terminal;
Biometric information requesting means for requesting the user terminal to transmit biometric information in response to reception of a connection request by the connection request receiving means;
From the user terminal, and biometric information transfer means for receiving the authentication biometric information with an electronic signature added to the biometric information and user's biometric information, and transfers the biometric information in the biometric information authentication device for authenticating,
Authentication result receiving means for receiving the authentication result of the biometric information and the storage destination network address of the attribute information of the user from the biometric information authentication device;
Attribute information acquisition means for acquiring the attribute information of the user based on the storage destination network address received by the authentication result reception means and the biometric information of the user;
User authentication means for permitting a connection request from the user terminal based on the authentication result received by the authentication result receiving means;
A web server comprising: A decryption electronic key corresponding to an electronic key used when an electronic signature is added to the biometric information and a storage network address of the user attribute information are received from an electronic signature generation device that accepts input of the biometric information of the user. An electronic key receiving means;
Biometric information receiving means for receiving biometric information of a user and biometric information for authentication in which an electronic signature is added to the biometric information from a web server;
By searching the electronic key for decryption received by the electronic key receiving means for an electronic key that can decrypt the biometric information for authentication, the biometric information for authentication is decrypted using the electronic key. Biometric information decoding means,
Biometric information authenticating means for authenticating the user by comparing biometric information for authentication decrypted by the biometric information decrypting means with the biometric information of the user;
Authentication result transmission means for transmitting the authentication result of the user by the biometric information authentication means and the storage destination network address received together with the electronic key used by the biometric information decryption means, to the web server;
A biometric information authentication device comprising: An electronic signature generation device according to claim 1;
A web server according to claim 2;
A biometric authentication device according to claim 3;
A user authentication system comprising:

Images