JP6118128B2 - Authentication system - Google Patents

Description

  In the authentication process when the terminal accesses the communication network, the terminal issues an access permission to the communication network of the terminal by double authentication based on authentication of the terminal and personal authentication of the user of the terminal. The present invention relates to a multiple authentication system for a communication network.

  In recent years, as a method for personal authentication, a biometric information authentication technique using biometric information of a user as a key has been used. For example, personal authentication using fingerprints, veins, and the like is used for cellular phones and ATM (Automated Teller Machine) devices of financial institutions.

  Patent Document 1 discloses an invention related to a mobile phone that improves the operability by eliminating the need to input a personal identification number by using authentication of whether or not the person is the person by face. In addition, even if the user is using it, if the conditions are met, user authentication is activated and user authentication processing is automatically started. By determining whether or not the user is the owner, the security of the mobile phone is improved by ensuring the safety of communication even if the user does not perform a special operation.

Patent Publication 2005-244589

  However, in Patent Document 1, authentication for specifying a user is mostly performed on a terminal, and processing for enabling communication as a result of the use of the terminal is performed. Moreover, since personal information for biometric authentication is stored in the terminal, it is necessary to register biometric information for each terminal, and preparation time and work are required for each terminal. It was a burden on the system administrator. Also, if the terminal is lost, personal information may be leaked.

  Therefore, the present invention uses biometric information to determine whether the terminal is a terminal that is permitted to access the communication network and whether the user is permitted to access the communication network. Providing an authentication system with improved security of access to the communication network.

An authentication system according to the present invention includes a terminal authentication server having a terminal authentication database for recording terminal authentication information, a personal authentication server having a personal authentication database for recording personal authentication information, and a terminal An authentication network that enables access to the terminal authentication server and the personal authentication server during authentication processing and during authentication of an individual who is a user of the terminal, and authentication of the individual after authentication of the terminal A communication network that allows access to the access terminal, and permits the terminal to access the authentication network during the authentication process of the terminal and the authentication process of the individual, and after the authentication of the terminal and the personal Japanese in that the terminal from the authentication network after authentication and a communication network connecting means for switching to the communication network To.

  The personal authentication information of the authentication system according to the present invention is biometric information, and is not stored in the terminal.

The personal authentication information of the authentication system according to the present invention, before the authentication request from the terminal to reach the personal authentication server, characterized in that stored in the personal identification database.

The terminal of the authentication system according to the present invention is characterized in that the authentication can be obtained by a plurality of users by acquiring the personal authentication information from the user for each authentication request.

In the authentication system according to the present invention, after authentication of the terminal and after authentication of an individual who is a user of the terminal, a plurality of the terminals associated with the authentication of the individual include the authentication of the terminal and the individual Communication network connection means for permitting connection to the communication network as having been authenticated .

  The terminal of the authentication system according to the present invention is a portable terminal.

According to the present invention , double authentication is performed by permitting access to a communication network by performing terminal authentication on a portable terminal and performing personal information authentication on a user. As a result, an authentication system with high security can be provided. In particular, it is possible to perform terminal authentication and personal authentication and connect to a communication network without fixing the user to one individual for a plurality of mobile terminals, so that the terminal can be shared and used by multiple people It becomes possible.
In addition, according to the present invention, the network for authentication is used as a network used only during the authentication process of the communication network, and the terminal is allowed to access the authentication network during the authentication process of the terminal and during the personal authentication process. A configuration is established in which the terminal is switched from the authentication network to the communication network after the terminal authentication and the individual authentication, and the terminal communicates during the terminal authentication process and the personal authentication process. Access to the network can be prevented.

  In addition, when the mobile terminal requests authentication from the personal authentication server, the mobile terminal acquires user authentication information for each authentication request and transmits the personal authentication information to the personal authentication server as an authentication request. For this reason, it is not necessary to store personal authentication information in the mobile terminal, and personal authentication can be performed even if the mobile terminal is shared by a plurality of people.

  In addition, this system can clearly grasp the user of the portable terminal by performing the personal information authentication while maintaining the security of the individual terminal by the terminal authentication.

  Further, since the authentication information for personal information authentication is face authentication (face photograph), biometric data for personal identification can be collected and stored in a database without causing psychological pressure on the user.

  Moreover, the camera equipped in the portable terminal can be used for acquiring the authentication information (face photo) data.

  Further, since the authentication information (face photo) for personal information authentication is stored in the personal authentication database, the authentication information (face photo) can be managed centrally.

  Also, since the authentication information (face photo) for personal information authentication is stored in the personal authentication database, it is not necessary to register / store the authentication information (face photo) in each mobile terminal. Maintenance and management can be greatly reduced.

  According to the present invention, when a representative performs terminal authentication and personal information authentication for one mobile terminal, a plurality of mobile terminals associated with the representative perform personal information authentication. It can be considered as a state, and it is considered that a large number of unspecified users have performed terminal authentication and personal information authentication, and permit access to the communication network while maintaining the security of double authentication. I can do it.

It is a figure which shows the concept of the authentication system which concerns on this invention. It is a flowchart of the whole authentication system concerning the present invention. 4 is a flowchart according to a terminal authentication process of the authentication system according to the present invention. It is a flowchart which concerns on the personal authentication process of the authentication system which concerns on this invention. It is a flowchart which concerns on the communication network connection process of the authentication system which concerns on this invention. It is a sequence diagram of the authentication system which concerns on this invention. It is a figure which shows the example of a screen display during face authentication in the portable terminal device of the authentication system which concerns on this invention. It is a figure which shows the concept of the state which connected the several portable terminal of 2nd Example in the authentication system which concerns on this invention.

Hereinafter, the authentication system will be described with reference to the drawings.
[System Overview]
FIG. 1 is a diagram showing an overview of the entire system of the present invention. The authentication system 1 includes a terminal authentication server 3, a terminal authentication database 4, a personal authentication server (face authentication server) 5, a personal authentication database (face authentication database) 6, a mobile terminal 8, and a wireless router 9. It is configured to be connected to the communication network 2.

  The communication network 2 may use the Internet, but can also be used as an in-house LAN (Local Area Network) or a stand-alone network independent of the outside. This is because an independent network has high confidentiality and can prevent intrusion from outside or leakage or destruction of information.

  The temporary network 2a is a virtual network on the communication network 2. The purpose is to access the terminal authentication server 3, the terminal authentication database 4, the personal authentication server (face authentication server) 5, and the personal authentication database (face authentication database) 6. If the user 7 is connected to the communication network 2 before performing the terminal authentication process and the personal authentication process, a security problem arises. Therefore, a route that can be accessed by the wireless router 9 to be described later is changed to a temporary network at the time of authentication. In 2a, after authentication, the route that can access the communication network 2 is switched. The provisional network 2a is a virtual concept on the network configuration, and may be the same network as the communication network 2. Or you may construct | assemble a network of another structure physically.

  The portable terminal 8 is a terminal used by a user. The communication network 2 is accessed, and the material displayed on the screen 11 is browsed and input. In addition, the mobile terminal 8 is equipped with a camera 12 and has a function of displaying a video projected by the camera 12, a captured still image, and a moving image on the screen 11 or transmitting them to the personal authentication server 5.

  The wireless router 9 has a function of communicatively connecting the communication network 2 to the mobile terminal 8, the terminal authentication server 3, and the personal authentication server 5. The communication method may be a wireless connection such as Bluetooth (registered trademark) or Wi-Fi (wireless fidelity: registered trademark), or a coaxial connection using Ethernet (registered trademark), a wired connection using an optical cable, etc. The mobile terminal 8, the terminal authentication server 3, and the personal authentication server 5 may be configured so that data can be transmitted and received among them.

[Terminal Authentication Server and Terminal Authentication Database]
When a request for access to the communication network 2 is transmitted from the mobile terminal 8, the terminal authentication server 3 stores the electronic certificate (not shown), ID and password that are sent to the terminal authentication database 4. It has the function of collating with registered information and determining whether authentication is possible. Each mobile terminal 8 provides a management server function such as granting access authority to other servers (not shown) on the communication network, data, data, etc., and collecting accounting information. In the present invention, for example, a RADIUS (Remote Authentication Dial-In User Service) server or the like is used. Note that description of general functions of the RADIUS server is omitted.

[Personal authentication server and personal authentication database]
When the personal authentication server 5 transmits an access request to the communication network 2 from the mobile terminal 8, the personal authentication server 5 collates the biometric information of the user sent with the biometric information registered in the personal authentication database 6. , It has a function of determining whether to authenticate whether the user is permitted to access.

  The authentication method using the biometric information may be any of fingerprint, iris of the pupil, vein authentication of the palm, etc. In the present invention, a face authentication system based on the authentication method using the user's own face photograph will be described.

  Authentication using biometric information such as fingerprints, irises of the eyes, veins of palms, etc. as biometric information is not common compared to face authentication. In particular, fingerprints are collected and registered psychologically by the user. Resistance may occur.

  Face authentication, on the other hand, is a general personal authentication method because it is used with a driver's license, passport, various identification cards, employee ID cards, etc. Few. Therefore, in the present invention, a system employing personal authentication based on face authentication using a face photograph will be described.

  In the conventional face authentication method, the user's face photo is stored in each mobile terminal, and the use restriction of the mobile terminal itself is permitted by authentication, and personal information data such as face photo is stored in each terminal. I kept it. In the present invention, since personal information data is stored in the server, it is not necessary to perform maintenance such as setting for each terminal, and there is a risk of leakage of personal information data when the terminal is lost. It can be avoided. Conventionally, the authentication is for allowing the mobile terminal to access the communication network. However, in the present invention, the authentication is for allowing the individual user to access the communication network.

The personal authentication server 5 has a personal authentication database 6 as shown in FIG. The personal authentication database 6 is a database for storing personal information including biometric information of the user 7. The personal information of the user 7 includes biometric information (face photo), name, age, gender, department name, job title, access authority, and the like. Input / output and access to the personal authentication database 6 are executed by an application installed in the personal authentication server 5. A management server function is provided for each user 7 such as granting access authority to other servers (not shown) on the communication network, data, data, etc., and collecting accounting information.
The personal information is registered in the personal authentication database 6 in advance before the user 7 requests personal authentication.

[Mobile terminal]
The portable terminal 8 is a terminal used by the user 7. The mobile terminal 8 is installed with a display screen 11, a camera 12 for visualizing the user's face, and face authentication software 21. The mobile terminal 8 includes communication terminals (wired LAN, wireless LAN, etc., not shown) for accessing the communication network 2 and application software that allows browsing of materials distributed on the communication network 2. For example, if you have an application environment (such as a WWW browser) that can execute instructions created in a markup language (HTML5, etc.) and a script language, etc., application software that can read texts such as PDF, etc. Regardless of devices such as personal computers, notebook computers, tablets, etc., OS (Operation System) is also used for personal computers such as MS-Windows (registered trademark) and Mac OS (registered trademark), and for mobile terminals (iOS) ), OS such as Android (registered trademark) There. Further, the input device may be any device such as a mouse, a touch panel, or a keyboard that can be operated by a user and input to the terminal. In the present embodiment, a portable terminal having a small and portable touch panel input format will be described as an example.

  The camera 12 is an input device that is installed in front of the portable terminal 8 and visualizes the face of the user 7 who is operating the portable terminal 8. The installation position is not limited as long as the position of the user 7 who is operating the mobile terminal 8 can be photographed. In addition, the camera 12 may be configured to be externally connected to the mobile terminal 8 via a connection cable or the like, as well as a form incorporated in the mobile terminal 8.

  When the face authentication software 21 is installed in the mobile terminal 8 and activated, the face authentication software 21 displays an image of the face of the user 7 captured by the camera 12 on the screen 11 as shown in FIG. And when the user's 7 face photograph is image | photographed, it has the function to transmit the user 7 face photograph image | photographed with respect to the personal authentication server (face authentication server).

  Further, when the mobile terminal 8 transmits a personal authentication connection request (see FIG. 6) to the communication network 2 without recording and storing the biometric information (face photograph) of the user 7 in the mobile terminal 8. In addition, it is obtained from the user 7 each time. Therefore, the owner of the portable terminal 8 is not limited to one user 7 and can be shared by a plurality of users.

[First Embodiment]
[Authentication process]
Next, the processing operation in the first embodiment of the authentication system will be described with reference to FIGS. 2 is a flowchart of the entire authentication system according to the present invention, FIG. 3 is a flowchart according to terminal authentication processing of the authentication system according to the present invention, FIG. 4 is a flowchart according to personal authentication processing of the authentication system according to the present invention, FIG. 5 is a flowchart relating to communication network connection processing of the authentication system according to the present invention, and FIG. 6 is a sequence diagram of the authentication system according to the present invention.

  In the present invention, when permitting access to the communication network 2, there are provided two authentication systems of terminal authentication and personal authentication, and a system with stronger security can be provided by combining both authentication results. it can.

First, as shown in FIG. 2, the user 7 turns on the power of the portable terminal 8 (step S1).
[Terminal authentication processing]
The terminal authentication process will be described below. First, as shown in FIG. 3, the portable terminal 8 transmits an electronic certificate to the terminal authentication server 3 as a connection request for connecting to the temporary network 2 a (communication network 2). This is because after the access authorization of the terminal authentication server 3 is permitted, the personal authentication server 5 can be accessed.

  The portable terminal 8 sends a connection request (electronic certificate) to the terminal authentication server 3 automatically or arbitrarily by the user 7 (step S10). An electronic certificate is added to the communication connection request. Since the electronic certificate may be an electronic certificate used in a RADIUS server or the like, detailed description thereof is omitted. The electronic certificate is registered in advance in each portable terminal 8.

The terminal authentication server 3 determines whether or not the content of the electronic certificate received from the mobile terminal 8 is correct (step S11).
If the electronic certificate of the portable terminal 8 is correct as a result of the determination (Yes in step S11), the process proceeds to the next process (step S13).

  If the electronic certificate of the portable terminal 8 is invalid or has expired (No in step S11), a connection request result indicating that access is denied is transmitted to the portable terminal 8 (step S12), and the portable terminal 8 An error message indicating that the mobile terminal 8 has not been registered is displayed, and the process returns to step S10 to wait for a connection request again.

  When the mobile terminal 8 is permitted to access the provisional network 2a (communication network 2) (Yes in step S11), the terminal authentication server 3 transmits a terminal authentication result notification indicating that access is permitted (step S11). S13). When the mobile terminal 8 receives a terminal authentication result notification indicating that access is permitted from the terminal authentication server 3, the mobile terminal 8 is connected to the temporary network 2a and is permitted access on the communication network 2 (provisional network 2a). Connection within the range becomes possible.

[Personal authentication processing]
Next, personal authentication processing is executed. As shown in FIG. 4, a “start button” (not shown) is pressed at a location where the provisional network 2a is accessible, and the face authentication software 21 installed in the portable terminal 8 is activated (step S20). .

  Next, as shown in FIG. 7, the user 7 prepares to photograph his / her face with the camera 12. The occupation rate h of the face length necessary for the face authentication determination depends on the size of the face photograph of the user 7 registered in the personal authentication database, but generally in the vertical direction of the screen 11. It is preferable that h ≧ 1/3 L or more with respect to the length L.

  After the user 7 determines the position and size of the face on the screen 11, the user presses the shooting button 22, and the face authentication software 21 takes a face photograph of the user 7 as face information (step S21).

  Next, the user 7 depresses an “authentication button” (not shown) of the mobile terminal 8 (step S22), and sends a personal authentication request with the photographed face photograph attached thereto from the mobile terminal 8. It transmits to the server 5 (step S23). Note that the face authentication software 21 may automatically transmit the photographed face photograph of the user 7 to the personal authentication server 5 without pressing the “authentication button” (step S23). In addition to the face photograph, personal information (name, date of birth, affiliation, registration number, etc.) specifying the user 7 may be sent to the personal authentication server 5.

  Next, the personal authentication database 6 is searched / verified using the face photograph image as a search key (step S24). The face photo of the user 7 transmitted from the portable terminal 8 is collated with the face photo registered in the personal authentication database 6 and the received face photo from the search result of the personal authentication database 6. If it is determined that they are the same person (Yes in step S25), the process proceeds to the next process (step S27).

  If the registered face photo and the received face photo are collated and it is determined that the face photo is not registered in the personal authentication database 6 or does not match and is not the same person (No in step S25), the individual The authentication server 5 transmits an authentication result notification indicating that the face authentication result error has occurred to the mobile terminal 8 (step S26), and the mobile terminal 8 does not match the user 7 and the registered face photo (not the person). An error message to that effect is displayed, and the process returns to step S20 to wait for another face photo. It should be noted that since the face authentication software 21 that is a commercially available product may be used for the process of determining whether or not the person is a person using a face photograph, detailed processing contents are omitted in the present invention.

  Here, in the search / collation of the personal authentication database 6 in step S24, the personal authentication server 5 uses any one or more of the personal information transmitted from the mobile terminal 8 in addition to the face photograph as a search key. Alternatively, whether or not the user 7 is registered in the personal authentication database 6 may be searched.

Next, the contents registered in the personal information are collated from the search result of the personal authentication database 6 to collate the access authority of the user 7 to the communication network 2 (step S27). In general, a communication network is limited in the accessible range depending on the job title or department, and thus obtains the access authority of the user 7.

  If the user 7 is permitted to access the communication network 2 (Yes in step S27), the personal authentication server 5 allows the mobile terminal 8 to connect to the communication network 2 with an ID, PASS information, etc. An authentication result notification including “” is transmitted (step S29). When there are multiple IDs and PASS information in the communication network 2 when there are multiple networks that can be accessed by the user (such as belonging to multiple domain names or user groups). The terminal authentication server 3 selects an appropriate access permission and transmits the ID, PASS information, etc. for the communication network 2 to the portable terminal 8.

  If the user 7 is not permitted to communicate with the communication network (No in step S27), the personal authentication server 5 transmits an authentication result notification indicating a search result error to the portable terminal 8 (step S28). The portable terminal 8 displays an error message indicating that the user 7 is an access-permitted person, returns to step S20, and waits for another face photo.

  As described above, personal authentication of the user using personal information (face photo) is completed.

[Communication network connection processing]
Subsequently, the process proceeds to communication network connection processing. In the above-described terminal authentication process and personal authentication process, the use of the communication network 2 is restricted so that only the terminal authentication server 3 and the personal authentication server 5 that are connected to the temporary network 2a and are required for personal authentication can be communicated. Because it is imposed.
As shown in FIG. 5, when the personal authentication of the user of the mobile terminal 8 ends normally, the mobile terminal 8 authenticates the communication connection request to the terminal authentication server 3 automatically or arbitrarily by the user 7. A request is transmitted (step S30). The ID, PASS information, etc. received by the authentication result notification are added to the communication connection request. Also, other authentication information in place of ID, PASS information, etc. may be used.

The terminal authentication server 3 starts searching / collating the terminal authentication database 4. Using the ID and password of the communication connection request as search keys, it is determined whether or not ID, PASS information, etc. are registered in the terminal authentication database 4 (step S31).
As a result of the search, if it is determined that the ID, PASS information, etc. are correct, the terminal authentication server transmits an access permission notification to the portable terminal 8 as an authentication request result (Yes in step S31). .

  If the ID, PASS information, etc. are not registered in the terminal authentication database 4 or are determined to be illegal (No in step S31), the terminal authentication server accesses the mobile terminal 8 as an authentication request result. A notification of rejection is transmitted (step S32). The portable terminal 8 displays an error message, returns to step S30, and waits for an authentication request again.

  When the mobile terminal 8 receives the authentication request result notification that the authentication request result indicates that access is permitted, the mobile terminal 8 is connected to the communication network 2 (step S33) and access is permitted on the communication network 2. Assets such as materials can be used within the scope.

  As described above, the double authentication of the restriction of the communication network connection of the terminal by the terminal authentication and the restriction of the user by the personal authentication is permitted, so that for the first time from the connection state of only the temporary network 2a. By permitting access to the communication network 2 and using the assets on the communication network 2, an authentication system with a higher security effect can be obtained.

  In the first embodiment, first, communication network connection processing (step S10 to step S13) by terminal authentication is executed, and secondly personal authentication processing (step S20 to step S29) is executed. The configuration is not limited to the process execution order, and the execution order may be changed and executed.

[Second Embodiment]
[Authentication method]
Next, processing operations in the second embodiment of the authentication system will be described with reference to FIG. Note that the description common to the first embodiment is omitted.

  When an event such as a seminar is held, if there is a user 7 who is not registered in the personal authentication server (face authentication server), it is necessary to register a new user in the personal authentication server (face authentication server). In particular, for seminars of several or more people or hundreds of people, enrollment requires enormous time and effort, and if applications are concentrated immediately before, registration may not be in time by the deadline. Even if you register, it may be used only for the authentication of the seminar and will not be used at a later date.

  Therefore, in this embodiment, when one mobile terminal is approved for terminal authentication and personal authentication, a plurality of mobile terminals associated with the personal authentication are approved for terminal authentication and personal authentication. It is assumed that the user 7 who has not registered the face photograph in the personal authentication server (face authentication server) can also connect to the communication network.

  In the mobile terminals 8a to 8d in FIG. 8, the terminal information of each mobile terminal is registered in the terminal authentication database 4. Further, the biometric information (face photograph) of the user 7 a is registered in the personal authentication database 6. However, the personal information (face photos) of the users 7 b to 7 d is not registered in the personal authentication database 6. Naturally, even if the users 7b to 7d make a personal authentication request to the personal authentication server, the result of the personal authentication approval failure is that the users 7b to 7d cannot access the communication network 2.

  In such a case, the mobile terminals 8a to 8d are registered in the registration information of the user 7a in the personal authentication database 6 as a group of the users 7a. When the user 7a approves personal authentication (step S20 to step S29 shown in FIG. 4) in the temporary network 2a in any one of the mobile terminals 8a to 8d in the group, the mobile terminal When it becomes possible to connect to the communication network 2, all the other three portable terminals are approved as a group of the user 7a by the personal authentication of the user 7a. Each portable terminal can be connected to the communication network 2. Note that a portable terminal without an electronic certificate or another portable terminal 8 with no ID, PASS information, etc. registered cannot be connected to the communication network 2 as a matter of course.

  In other words, the users 7b to 7d can use the mobile terminals 8a to 8d that have been personally authenticated by the user 7a even if the personal information (face photos) of the users 7b to 7d is not registered in the personal authentication database 6. By using 8d, it becomes possible to connect to the communication network 2 as a group of users 7a.

  As described above, in the second embodiment of the present invention, a plurality of portable terminals can access the communication network 2 by personal authentication while maintaining security of terminal authentication.

  This function is effective, for example, when recruiting external participants at a seminar or the like. For example, when the seminar organizer is the user 7a and the participants are the users 7b to 7d, the double authentication by the terminal authentication and the personal authentication is easily performed for all the mobile terminals 8a to 8d. Therefore, the access security for the communication network 2 can be strengthened.

  As described above, according to the present invention, access to a communication network is permitted by performing terminal authentication for a mobile terminal and performing personal information authentication for a user. By undergoing double authentication, an authentication system with high security can be provided. In particular, it is possible to perform terminal authentication and personal authentication and connect to a communication network without fixing the user to one individual for a plurality of mobile terminals, so that the terminal can be shared and used by multiple people It becomes possible.

  In addition, when the mobile terminal requests authentication from the personal authentication server, the mobile terminal acquires user authentication information for each authentication request and transmits the personal authentication information to the personal authentication server as an authentication request. For this reason, it is not necessary to store personal authentication information in the mobile terminal, and personal authentication can be performed even if the mobile terminal is shared by a plurality of people.

  In addition, this system can clearly grasp the user of the portable terminal by performing the personal information authentication while maintaining the security of the individual terminal by the terminal authentication.

  Further, since the authentication information for personal information authentication is face authentication (face photograph), biometric data for personal identification can be collected and stored in a database without causing psychological pressure on the user.

  In addition, a camera equipped in a portable terminal can be used to acquire face authentication (face photo) data.

  Further, since the authentication information (face photo) for personal information authentication is stored in the personal authentication database, the authentication information (face photo) can be managed centrally.

  The plurality of terminals can acquire the personal authentication information from the user for each authentication request, thereby enabling the personal authentication even if one terminal is shared by a plurality of users.

  Also, since the authentication information (face photo) for personal information authentication is stored in the personal authentication database, it is not necessary to register / store the authentication information (face photo) in each mobile terminal. Maintenance and management can be greatly reduced.

  According to the present invention, when a representative performs terminal authentication and personal information authentication for one mobile terminal, a plurality of mobile terminals associated with the representative perform personal information authentication. It can be considered as a state, and it is considered that a large number of unspecified users have performed terminal authentication and personal information authentication, and permit access to the communication network while maintaining the security of double authentication. I can do it.

  The present invention can be embodied in many forms without departing from its essential characteristics. Therefore, it is needless to say that the above-described embodiment is exclusively for description and does not limit the present invention.

1 Authentication System 2 Communication Network 2a Temporary Network 3 Terminal Authentication Server 4 Terminal Authentication Database 5 Personal Authentication Server (Face Authentication Server)
6 Personal Authentication Database 7 User 8 Mobile Terminal 9 Wireless Router 11 Display Screen 12 Camera 21 Face Authentication Software 22 Shooting Button

Claims (6)

A terminal authentication server having a terminal authentication database for recording terminal authentication information;
A personal authentication server having a personal authentication database for recording personal authentication information;
An authentication network that enables access to the terminal authentication server and the personal authentication server at the time of authentication processing of the terminal and at the time of authentication processing of an individual who is a user of the terminal;
A communication network that allows access after authentication of the terminal and after authentication of the individual;
The terminal is allowed to access the authentication network during the terminal authentication process and the personal authentication process, and the terminal is removed from the authentication network after the terminal authentication and after the individual authentication. A communication network connection means for switching to the communication network .   The authentication system according to claim 1, wherein the personal authentication information is biometric information and is not stored in the terminal. The personal authentication information, the authentication system according to claim 1, the authentication request from the terminal is prior to reaching the personal authentication server, characterized in that stored in the personal identification database. The terminal, by obtaining from each time the user of the personal authentication information for each authentication request, to claim 1, be shared by multiple users, characterized in that capable of obtaining the authentication The described authentication system. After authentication of the terminal and after authentication of an individual who is a user of the terminal, a plurality of the terminals associated with the authentication of the individual perform authentication of the terminal and authentication of the individual The authentication system according to any one of claims 1 to 4 , further comprising communication network connection means for permitting connection to the communication network . The authentication system according to claim 1, wherein the terminal is a mobile terminal.

Images