JP6676569B2 - Authentication system, authentication device, and authentication method - Google Patents

Description

  The present invention relates to an authentication system, an authentication device, and an authentication method.

  With the spread of IoT devices and smartphones such as wristband-type wearable terminals, it is not uncommon for users to have multiple terminals alone. In addition, a commercial POS system, a handy terminal, a connection terminal to an in-house system, and the like have been conventionally implemented with dedicated hardware and software, but are recently being replaced by general-purpose products such as a smartphone and a tablet terminal. In addition, with the digitization of business, the number of smartphones and tablet terminals used as business terminals is increasing year by year, and it is unusual for business workers to use multiple business terminals by themselves. Absent.

  Generally, authentication is required at the time of use of a terminal in which personal information or confidential information is held, or a shared terminal for business use in order to prevent unauthorized use. Examples of the authentication method include knowledge authentication using information that only the user can know, such as an ID and a password, and possession authentication using property such as an IC card. Authentication is required every time a terminal is changed or every time a certain session duration elapses. However, in the case of using a plurality of terminals, explicit authentication is frequently required, so that user convenience is reduced. Therefore, in practice, appropriate authentication is omitted for the terminal to be used, simple authentication information is set, authentication information is attached to the terminal, and authentication information is shared by multiple terminals. Examples have been reported. That is, it cannot be said that risk countermeasures have been taken appropriately for unauthorized use of terminals.

  Therefore, technologies and products for simplifying complicated authentication have been proposed. For example, an Android terminal is equipped with a function called SmartLock (registered trademark) to reduce the frequency of authentication. That is, as the authentication information, it is used that the terminal registered in advance exists in the area of the near field communication or that the terminal is connected to the pre-registered Wi-Fi (registered trademark) at home. The device will be unlocked automatically in case.

  In addition, biometric authentication that uses human biometric characteristics instead of complicated password input is known. For example, a method is known in which information such as a fingerprint and an iris is detected using a camera, and a face is shot using a camera for authentication. These authentication methods are convenient because there is no need to store authentication information and the number of belongings does not increase.

  In addition, there is a known technology that detects whether a wearable terminal is attached to a user by detecting the attachment / detachment of the terminal using a special sensor or performing biometric authentication using a biometric signal such as an electrocardiogram at the time of attachment. (See Non-Patent Documents 1 and 2). In these techniques, only when a terminal is worn by a user, another terminal registered in advance within a Bluetooth (registered trademark) communication range of the terminal is unlocked and can be used. In addition, when the terminal is detached, that is, the terminal is released and no biological signal is input to the terminal, the authenticated state is released to make the terminal unauthenticated, thereby improving security.

“Safeband: Ultimate Security System.Bracelet & Tags”, [Online], Indiegogo, [Search January 24, 2017], Internet <URL: https://www.indiegogo.com/projects/1267504> “Nymi | Convenient Authentication Anywhere”, [Online], [Search August 5, 2016], Internet <URL: https://nymi.com/>

  However, in the conventional authentication method as described above, since the measurement error is involved in principle, the accuracy of the authentication cannot be 100%, and there is a possibility that a scene that can be used with high accuracy may be limited. For example, in face authentication, the application is limited to the range reflected in the camera, and the authentication accuracy depends on the light amount, the background, the shooting angle of the target, and the like. In fingerprint authentication, a dedicated authentication device is required for each terminal. In the case of biometric authentication using biometric signals, measurement noise increases when noise such as physical activity accompanying behavior occurs, and high-precision authentication cannot be performed. It is difficult.

  Also, even if the terminal user is authenticated by biometric authentication or the like, if the device that performs biometric authentication and the terminal to be authenticated are separated from each other, only the device within the proximity communication range of this biometric authentication device If the other terminal is authenticated using the authentication information as the authentication information, the possibility of manipulation by another person and unauthorized use cannot be denied.

  The present invention has been made in view of the above, and an object of the present invention is to make it possible to use a plurality of terminals simultaneously owned by the same person with high convenience without lowering the authentication accuracy.

  In order to solve the above-described problems and achieve the object, an authentication system according to the present invention is an authentication system including a biometric authentication terminal, a terminal, and an authentication device, wherein the biometric authentication terminal A biological signal sensor that acquires a signal, an acceleration sensor that measures the acceleration of the biometric authentication terminal, a biological signal of the acquired user, and a transmission unit that transmits a time-series signal of the measured acceleration to the authentication device. An authentication unit that enables the terminal to be used when the user is notified that the user is valid from the authentication device, wherein the terminal is an acceleration sensor that measures the acceleration of the terminal, A transmitting unit that transmits a time-series signal of the acceleration to the authentication device, and an authentication unit that enables its own terminal when notified that the authentication device can be used, the authentication device includes: A storage unit that stores a template of a biometric signal of a valid user of the biometric authentication terminal, and obtains a biometric signal of the user from the biometric authentication terminal, and determines that the biometric signal belongs to the same user as the user of the template In this case, a biometric authentication unit that performs a biometric authentication process for notifying the biometric authentication terminal that the user is valid, and a time-series signal of the biometric authentication terminal and the acceleration of the terminal are acquired and acquired. When the degree of similarity between the biometric authentication terminal and the terminal in the time series change of the acceleration component derived from the physical activity extracted from the acceleration is higher than a predetermined threshold, the terminal is identified by the same person as the biometric authentication terminal. And an action determining unit that determines that the terminal is possessed and notifies the terminal that the terminal is usable.

  Advantageous Effects of Invention According to the present invention, a plurality of terminals possessed by the same person at the same time can be used with high convenience without lowering the authentication accuracy.

FIG. 1 is a schematic diagram illustrating a schematic configuration of an authentication system according to an embodiment of the present invention. FIG. 2 is an explanatory diagram for explaining an outline of processing of the authentication device according to the present embodiment. FIG. 3 is a sequence diagram illustrating an authentication processing procedure according to the present embodiment. FIG. 4 is a sequence diagram illustrating an authentication processing procedure according to the present embodiment. FIG. 5 is a sequence diagram illustrating an authentication processing procedure according to the present embodiment. FIG. 6 is a sequence diagram illustrating an authentication processing procedure according to the present embodiment. FIG. 7 is a sequence diagram illustrating an authentication processing procedure according to the present embodiment. FIG. 8 is a diagram illustrating a computer that executes an authentication program.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited by this embodiment. In the description of the drawings, the same parts are denoted by the same reference numerals.

[Configuration of Authentication System]
First, a schematic configuration of an authentication system according to the present embodiment will be described with reference to FIG. FIG. 1 is a schematic diagram illustrating a schematic configuration of the authentication system according to the present embodiment. As illustrated in FIG. 1, the authentication system 1 according to the present embodiment can perform biometric authentication such as a wearable terminal that authenticates a valid user by biometric authentication and short-range communication with the biometric authentication terminal 10 such as Bluetooth. And an authentication device 30.

  In the authentication system 1, the authentication device 30 notifies the terminal 20 that has been determined to be owned by the same person as the authenticated biometric authentication terminal 10 by an authentication process described later, and releases the lock to the terminal 20. Perform authentication to enable it.

  FIG. 2 is an explanatory diagram for explaining an outline of processing of the authentication device 30 of the present embodiment. First, as shown in FIG. The biometric authentication terminal 10 transmits the biometric signal of the user acquired by the biometric signal sensor to the authentication device 30, the biometric authentication is performed by the authentication device 30 to compare with the registered template, and when the biometrics are matched, the biometric authentication is performed by a valid user. Judge and authenticate this user.

  It is assumed that the user has a terminal 20 within a communication range of a proximity sensor such as Bluetooth of the biometric authentication terminal 10 together with the authenticated biometric terminal 10 with physical activity such as walking. In that case, the authentication device 30 acquires signals from the acceleration sensors of the terminal 20 and the biometric authentication terminal 10, and extracts behavior information derived from physical activity. When the behavior information of the biometric authentication terminal 10 and the behavior information of the terminal 20 match, the authentication device 30 determines that the terminal 20 is owned by the same person as the biometric authentication terminal 10, and authenticates the user of the terminal 20. At the same time, the authentication device 30 registers the inter-terminal distance between the biometric authentication terminal 10 and the terminal 20 measured from the signal strength of the proximity sensor in the storage unit.

  The authentication device 30 periodically repeats the process of comparing the behavior information acquired from the biometric authentication terminal 10 and the terminal 20 and, when it is determined that the same person possesses it, determines that the same authorized user uses it. Then, the authenticated state of the terminal 20 is continued.

  Further, the authentication device 30 determines whether or not the same person has the same person based on the behavior information as described above, when the user cannot acquire the behavior information without physical activity at the time of resting at desk work or the like. Can not. In this case, the authentication device 30 first performs biometric authentication of the biometric authentication terminal 10 and, when it is determined that the biometric authentication terminal 10 is used by a valid user, continues the authenticated state of the biometric authentication terminal 10. Next, the authentication device 30 compares the measured inter-terminal distance with the inter-terminal distance registered in the storage unit, and determines that the same is used by the same valid user as the biometric authentication terminal 10 if they match. Then, the authenticated state of the terminal 20 is continued.

[Configuration of biometric authentication terminal]
Returning to the description of FIG. The biometric authentication terminal 10 is realized by a personal computer, a tablet, a smartphone, a wearable terminal, an IoT device, or the like having a biometric authentication function. As illustrated in FIG. 1, an input / output unit 11, a proximity communication function unit 12, a communication control unit 13, a storage unit 14, a control unit 15, an acceleration sensor 16, and a biological signal sensor 17.

  The input / output unit 11 is implemented by a touch panel or the like, and inputs various kinds of instruction information to the control unit 15 in response to an input operation by the operator, and also outputs a result of an authentication process described later to the operator. Output. The communication control unit 13 is realized by an NIC (Network Interface Card) or the like, and controls communication between the control unit 15 and an external device such as the authentication device 30 via an electric communication line such as a LAN (Local Area Network) or the Internet. I do.

  The storage unit 14 is realized by a semiconductor memory device such as a random access memory (RAM) or a flash memory, or a storage device such as an optical disk. In the present embodiment, the storage unit 14 stores terminal information 14a. The terminal information 14a represents information on the terminal itself. For example, the terminal information 14a includes the name of the terminal itself, an ID (IDentifier) unique to the terminal, the ID of a registered user, and the like, and is registered in advance. When a plurality of users are registered, the user ID to be used is specified by selecting the user at the start of use, for example.

  The near field communication function unit 12 is connected to the terminal 20 which is in a communication area of the near field communication such as Bluetooth or Wi-Fi, for example, so that information can be mutually communicated by the near field communication.

  The acceleration sensor 16 measures the acceleration of the biometric authentication terminal 10. For example, the acceleration sensor 16 calculates the acceleration of the terminal 10 by detecting a change in the position of the terminal 10.

  The control unit 15 functions as a transmission unit 15a and an authentication unit 15b as illustrated in FIG. 1 by an arithmetic processing device such as a CPU (Central Processing Unit) executing a processing program stored in a memory.

  The transmitting unit 15a transmits the acquired biological signal of the user and the time-series signal of the measured acceleration to the authentication device 30. Specifically, the transmission unit 15a transmits the user's biological signal acquired by the biological signal sensor 17 to the authentication device 30 via the communication control unit (13, 33). The transmitting unit 15a transmits a time-series signal of the acceleration of the terminal 10 measured by the acceleration sensor 16 to the authentication device 30 via the communication control unit (13, 33). At this time, the transmitting unit 15a adds the user ID included in the terminal information 14a of the terminal 10 and transmits the terminal.

  The authentication unit 15b enables the terminal 10 when the authentication device 30 notifies the user corresponding to the biological signal that the user is valid. Specifically, the authentication unit 15b releases the lock of the own terminal 10 and enables the user to operate when the authentication device 30 is notified from the authentication device 30 that the user corresponding to the biometric signal is valid in an authentication process described later. Then, the self-terminal 10 is authenticated.

[Terminal configuration]
The terminal 20 is realized by a personal computer, a tablet, a smartphone, a wearable terminal, an IoT device, or the like, and as illustrated in FIG. 1, an input / output unit 21, a proximity communication function unit 22, a communication control unit 23, a storage unit 24, a control unit 25 and an acceleration sensor 26.

  The input / output unit 21 is realized by a touch panel or the like, and inputs various kinds of instruction information to the control unit 15 in response to an input operation by the operator, and outputs a result of an authentication process described later to the operator. Output. The communication control unit 23 is implemented by an NIC or the like, and controls communication between the control unit 25 and an external device such as the authentication device 30 via an electric communication line such as a LAN or the Internet.

  The storage unit 24 is realized by a semiconductor memory device such as a RAM or a flash memory, or a storage device such as an optical disk. In the present embodiment, the storage unit 24 stores terminal information 24a. The terminal information 24a indicates information on the own terminal. For example, similarly to the terminal information 14a of the biometric authentication terminal 10, the terminal information 24a includes the name of the terminal itself, an ID unique to the terminal, the ID of a registered user, and the like, and is registered in advance. When a plurality of users are registered, for example, by selecting the user at the start of use, the ID of the user to use is specified.

  The near field communication function unit 22 is connected to the biometric authentication terminal 10 and another terminal 20 which are in the communication area of the near field communication such as Bluetooth and Wi-Fi so as to be able to communicate with each other by the near field communication.

  The acceleration sensor 26 measures the acceleration of the terminal 20. For example, the acceleration sensor 26 calculates the acceleration of the terminal 20 by detecting a change in the position of the terminal 20.

  The control unit 25 functions as a transmission unit 25a and an authentication unit 25b as illustrated in FIG. 1 by an arithmetic processing device such as a CPU executing a processing program stored in a memory.

  The transmission unit 25a transmits a time-series signal of the measured acceleration to the authentication device 30. Specifically, the transmission unit 25a transmits a time-series signal of the acceleration of the own terminal 20 measured by the acceleration sensor 26 to the authentication device 30 via the communication control unit (23, 33). At this time, the transmission unit 25a adds the user ID included in the terminal information 24a of the terminal 20 and transmits the terminal 20.

  The authentication unit 25b enables its own terminal 20 when notified from the authentication device 30 that the terminal can be used. Specifically, when the authentication unit 25b is notified from the authentication device 30 that the terminal 20 can be used in an authentication process described below, the authentication unit 25b performs an authentication process of unlocking the terminal 20 and enabling the user to operate the terminal. 20 is authenticated. Note that, when the authentication device 30 notifies that it is not usable, the authentication unit 25b executes normal authentication such as passcode authentication or pattern authentication.

  In addition, when the own terminal 20 is usable, the authentication unit 25b measures the distance between the own terminal 20 and the biometric authentication terminal 10 determined to be possessed by the same person using the proximity communication. And notifies the authentication device 30. For example, the authentication unit 25b acquires the signal strength of the Bluetooth signal or the signal strength of Wi-fi transmitted and received between the proximity communication function unit 22 and the proximity communication function unit 12 of the biometric authentication terminal 10, thereby obtaining the biometric authentication terminal. 10, that is, an inter-terminal distance is calculated.

  The distance between the biometric authentication terminals 10 and 20 may be measured by the authentication unit 15b of the biometric authentication terminal 10 and notified to the authentication device 30. In that case, the authentication unit 25b may not perform the process of measuring the distance between the biometric authentication terminal 10 and the terminal 20 and notifying the authentication device 30 of the distance.

[Configuration of Authentication Device]
As shown in FIG. 1, the authentication device 30 according to the present embodiment is realized by a general-purpose computer such as a workstation or a personal computer, and includes an input unit 31, an output unit 32, a communication control unit 33, a storage unit 34, a control unit 35.

  The input unit 31 is realized using an input device such as a keyboard and a mouse, and inputs various kinds of instruction information to the control unit 35 in response to an input operation by an operator. The output unit 32 is realized by a display device such as a liquid crystal display, a printing device such as a printer, an information communication device, or the like, and outputs a result of an authentication process described later to the operator.

  The communication control unit 33 is implemented by an NIC or the like, and controls communication between an external device such as the biometric authentication terminal 10 or the terminal 20 and the control unit 35 via an electric communication line such as a LAN or the Internet.

  The storage unit 34 is realized by a semiconductor memory device such as a RAM and a flash memory, or a storage device such as a hard disk and an optical disk. In the storage unit 34, a processing program for operating the authentication device 30, data used during execution of the processing program, and the like are stored in advance, or temporarily stored for each processing. The storage unit 34 may be configured to communicate with the control unit 35 via the communication control unit 33.

  In the present embodiment, the storage unit 34 stores the biometric authentication information 34a and the distance between terminals 34b. The biometric authentication information 34a is information in which an ID of a valid user of the biometric authentication terminal 20 is associated with a template of a biometric signal of the user, and is stored in advance or by an authentication process described later. The inter-terminal distance 34b is the distance between the biometric authentication terminal 10 and the terminal 20 measured using the proximity communication, and is notified from the terminal 20 and stored in an authentication process described later.

  The control unit 35 functions as a biometric authentication unit 35a, a behavior determination unit 35b, and a distance determination unit 35c as illustrated in FIG. 1 by an arithmetic processing device such as a CPU executing a processing program stored in a memory. .

  The biometric authentication unit 35a acquires the biometric signal of the user from the biometric authentication terminal 20, and when the biometric signal is determined to be the same as the user of the template of the biometric authentication information 34a, the user is valid. Then, a biometric authentication process for notifying the biometric authentication terminal 10 of the fact is executed.

  Specifically, the biometric authentication unit 35a acquires a user ID and a biometric signal used from the biometric authentication terminal 20. Further, referring to the biometric authentication information 34a, the template corresponding to the acquired user ID is compared with the acquired biometric signal. For example, when the patterns match, it is determined that the user belongs to the same person. In this case, the biometric authentication unit 35a determines that the user is a valid user of the biometric authentication terminal 10 and can use the biometric authentication terminal 10, and notifies the biometric authentication terminal 10.

  As will be described later, the biometric authentication unit 35a executes the biometric authentication process again when the behavior determination unit 35b cannot acquire a time-series acceleration signal.

  The action determination unit 35b acquires a time-series signal of the acceleration of the biometric authentication terminal 10 and the terminal 20, and calculates the time-series change of the acceleration component derived from the physical activity extracted from the acquired acceleration. If the degree of similarity is higher than a predetermined threshold value, it is determined that the terminal 20 is owned by the same person as the biometric authentication terminal 10, and the terminal 20 is notified that the terminal 20 can be used.

  Specifically, the action determining unit 35b acquires, from each of the biometric authentication terminal 10 and the terminal 20, a time-series signal of the acceleration to which the same user ID is added. That is, the action determination unit 35b acquires a time-series signal of the acceleration transmitted from the transmission unit 15a of the biometric authentication terminal 10 via the communication control unit (13, 33). In addition, the behavior determination unit 35b acquires a time-series signal of acceleration transmitted from the transmission unit 25a of the terminal 20 via the communication control units (23, 33).

  Next, the behavior determining unit 35b extracts an acceleration component derived from human physical activity from the acquired acceleration. Here, the acquired time-series signal of the acceleration of each terminal (10, 20) includes an acceleration component derived from an external environment such as a vehicle and an acceleration component derived from human physical activity.

  In a vehicle such as an elevator or a train, acceleration / deceleration control is performed electronically, and thus a time-series signal of acceleration shows a change different from that caused by walking or the like controlled by a human musculoskeletal system. That is, in many cases, electronic acceleration / deceleration control in a vehicle or the like is ideally designed to draw a gentle sinusoidal curve in order to reduce discomfort to passengers. Therefore, for example, by using an index such as a jerk, that is, a change in a differential value of acceleration, as a feature amount, it is possible to discriminate an acceleration component derived from an external environment from an acceleration component derived from human physical activity.

  Specifically, comparing the frequency components obtained by the power spectrum analysis, the acceleration component derived from the external environment is distributed into low-frequency components such as acceleration and deceleration of a vehicle and high-frequency components such as vibration noise. On the other hand, acceleration components derived from human physical activity are distributed in a frequency band of approximately 0.25 to 2.5 Hertz. Therefore, by designing a filter that excludes the low frequency band and the high frequency band of the acceleration component derived from the external environment, it is possible to extract the acceleration component derived from human physical activity.

  Therefore, the action determination unit 35b compares the frequency components by, for example, power spectrum analysis, and performs signal processing using filters such as HF (High-pass Filter), LF (Low-pass Filter), and BF (Band-pass Filter). Then, an acceleration component derived from human physical activity is extracted.

  In addition, for example, noise associated with the drop or contact of each terminal (10, 20) is larger than the acceleration component derived from physical activity. On the other hand, the acceleration component of the vehicle, such as the elevation of the elevator, is controlled to take a small value so as not to give the passenger discomfort. Therefore, the behavior determination unit 35b can distinguish between the acceleration component derived from the human physical activity and the acceleration component derived from the external environment using the predetermined threshold.

  Further, in order to collect an action log, a technique of determining an action state such as a posture, walking, running, climbing up and down stairs, or running a bicycle using acceleration obtained from an accelerometer worn or carried on the body is disclosed. . Therefore, the behavior determination unit 35b can also apply this technique to extract an acceleration component derived from human physical activity.

  In addition, the behavior determination unit 35b compares the time-series change of the acceleration component derived from the physical activity extracted from the biometric authentication terminal 10 and the terminal 20 as the behavior information derived from the physical activity. When the degree of similarity of the action information between the biometric authentication terminal 10 and the terminal 20 is higher than a predetermined threshold, the action determination unit 35b holds the biometric authentication terminal 10 and the terminal 20 by the same person. And notifies the terminal 20 that it can be used.

  For example, when the same person has the biometric authentication terminal 10 and the terminal 20, similarity is recognized in the time domain and the frequency domain in the acceleration component derived from the physical activity of the human. For example, the periods at which peaks appear in the time domain coincide, or the positions of the peaks coincide in the frequency domain.

  Specifically, consider the acceleration applied to each terminal (10, 20) possessed by the same person during walking. At the time of transition from the swing leg period to the standing stage of walking, acceleration derived from the impact of touching is applied to a terminal such as a wearable terminal mounted on the wrist and a terminal such as a smartphone in a pocket. Since the acceleration applied here propagates from the lower limb, the time-series change of the acceleration for each step is always delayed at the wrist terminal than at the pocket terminal. Therefore, the behavior determining unit 35b analyzes, for example, the timing of appearance of the positive and negative peaks of the time series signal of the acceleration, and if the degree of coincidence of the cycle in which the peak appears, that is, the degree of similarity is higher than a predetermined threshold, possesses the same person Can be determined.

  The behavior determination unit 35b periodically repeats the process of comparing the behavior information acquired from the biometric authentication terminal 10 and the terminal 20. If it is determined that the same person possesses the information, the behavior determination unit 35b uses the same person. It is determined that the terminal 20 has been authenticated.

  In addition, when the behavior determining unit 35b determines that the user of the terminal 20 is not the same person as the legitimate user of the biometric authentication terminal 10, the behavior determination unit 35b notifies the terminal 20 and performs passcode authentication or pattern authentication of the terminal 20. Perform normal authentication of.

  The distance determination unit 35c calculates the distance between the terminal 20 and the biometric authentication terminal 10 notified from the terminal 20 that is determined to be owned by the same person as the biometric authentication terminal 10 in the storage unit 34. 34a.

  When the action determination unit 35b cannot acquire the time-series signal of the acceleration, the distance determination unit 35c determines the distance between the terminal 20 and the biometric authentication terminal 10 notified from the terminal 20 and the terminal of the storage unit 34. If the distance stored in the distance 34a matches, the terminal 20 is notified that the terminal 20 can be used.

  Specifically, when the behavior determining unit 35b cannot extract the behavior information at the time of rest of the user, for example, it is determined that the same user possesses the information by matching the behavior information between the biometric authentication terminal 10 and the terminal 20. Can not. In this case, in the authentication device 30, first, the biometric authentication unit 34a performs biometric authentication again to determine that the user of the biometric authentication terminal 10 is valid, and continues the authenticated state of the biometric authentication terminal 10. Let it.

  Next, the distance determination unit 35c calculates the distance between the terminal 20 and the biometric authentication terminal 10 notified from the terminal 20, and the distance between the terminals of the storage unit 34 registered when the latest behavior information is extracted. Compare with the distance stored in 34a. For example, when the two distances are within the same range, or when the difference between the two distances is within a predetermined range, the distance determination unit 35c determines that the two distances match. In this case, the distance determination unit 35c determines that the user of the terminal 20 is the same legitimate user as the biometric authentication terminal 10 and notifies the terminal 20 that the terminal 20 can be used. To continue.

  When the two distances do not match, the distance determination unit 35c notifies the terminal 20 to execute normal authentication such as passcode authentication or pattern authentication.

[Authentication process]
Next, an authentication processing procedure of the authentication device 30 will be described with reference to FIGS. 3 to 7 are sequence diagrams illustrating the authentication processing procedure according to the present embodiment. First, FIG. 3 shows a processing procedure of processing for registering biometric authentication information 34a used for biometric authentication of the biometric authentication terminal 10 in the authentication device 30. The sequence in FIG. 3 is started, for example, at a timing when a user's operation input instructing start is performed.

  The user accesses the authentication device 30 in advance and registers an account, that is, a user ID (steps S1 to S3). Next, when the user wears the biometric authentication terminal 10 (S4), the biometric authentication terminal 10 transmits the template of the biometric signal measured by the biometric signal sensor 17 to the authentication device 30 (Step S5). After the registration of the biometric signal template in association with the user ID in the biometric authentication information 34a of the authentication device 30 is completed (steps S6 to S8), the user accesses the authentication device 30 and obtains the terminal information 14a of the terminal to be used. Is registered (steps S9 to S10).

  Next, FIG. 4 shows a processing procedure when the user uses the biometric authentication terminal 10 and the terminal 20 for the first time. The sequence in FIG. 4 is started, for example, at the timing when the user wears the biometric authentication terminal 10 (step S11).

  The biometric authentication terminal 10 transmits the biometric signal measured by the biometric signal sensor 17 and the terminal information including the user ID to the authentication device 30 (Step S12). In the authentication device 30, the biometric authentication unit 35a refers to the biometric authentication information 34a, and compares the biometric signal template registered in association with the user with the received biometric signal. When determining that the template of the biometric signal matches the received biometric signal, the biometric authentication unit 35a notifies the biometric authentication terminal 10 of a determination result indicating that the biometric authentication terminal 35 has been used by a valid user (step S13).

  Here, each of the biometric authentication terminal 10 and the terminal 20 periodically transmits a signal including the behavior information measured by the acceleration sensor and terminal information including the user ID to the authentication device 30 (step S15). When the user grips the terminal 20 in the proximity communication range of the biometric authentication terminal 10 (step S14), the action determination unit 35b of the authentication device 30 compares the action information extracted from the received signal with the same user ID. I do. When determining that the persons in the behavior information match, the behavior determination unit 35b notifies the terminal 20 of a determination result indicating that the terminal 20 is usable (step S16).

  The terminal 20 that has been notified of the determination result indicating that the terminal 20 can be used performs login processing and starts using the terminal 20 of the user (step S17).

  Further, the terminal 20 and / or the biometric authentication terminal 10 measures the relative distance (distance between the terminals) using the proximity communication and transmits the measured distance to the authentication device 30 (step S18). The authentication device 30 registers the received relative distance in the terminal distance 34b (step S19).

  FIG. 5 shows an authentication processing procedure subsequent to the processing shown in FIG. The process in FIG. 5 is started, for example, at the timing when the terminal 20 that has been authenticated in the process illustrated in FIG. 4 is grasped again (step S21).

  Each of the biometric authentication terminal 10 and the terminal 20 periodically transmits a signal including the behavior information measured by the acceleration sensor and terminal information including the user ID to the authentication device 30 (step S22). When the user holds the terminal 20 (step S21), the action determining unit 35b of the authentication device 30 extracts the action information from the signal having the same received user ID, and confirms the presence or absence of the action information (step S23). . At this time, the action determination unit 35b calculates, for example, an absolute value, an average value, a variance, and the like with respect to the value of each axis of the acceleration information collected from the acceleration sensor or the combined value of each axis, and sets an appropriate threshold. It may be set to determine the presence or absence of an action. Alternatively, the action determination unit 35b may determine the presence or absence of an action using information acquired from another sensor.

  If there is action information (step S23, action is present), the action determination unit 35b compares the extracted action information and indicates that the terminal 20 can be used when it is determined that the persons in the action information match. The determination result is notified to the terminal 20 (step S24).

  The terminal 20 notified of the determination result indicating that the terminal 20 can be used performs a process of continuing the authenticated state, and continues using the terminal 20 of the user (step S25).

  In addition, the terminal 20 and / or the biometric authentication terminal 10 measures the relative distance (distance between the terminals) using the proximity communication and transmits the measured distance to the authentication device 30 (step S26). The authentication device 30 registers the received relative distance in the terminal distance 34b (step S27).

  FIG. 6 shows an authentication processing procedure branched from the processing shown in FIG. If there is no action information in the process of step S23 (step S23, no action), the biometric authentication terminal 10 authenticates the biometric signal measured by the biometric signal sensor 17 and the terminal information including the user ID into the authentication device 30. (Step S31). In the authentication device 30, the biometric authentication unit 35a refers to the biometric authentication information 34a, and compares the biometric signal template registered in association with the user with the received biometric signal. When the biometric authentication unit 35a determines that the biometric signal template matches the received biometric signal, the biometric authentication unit 35a notifies the biometric authentication terminal 10 of a determination result indicating that use by a valid user has been determined (step S32). The biometric authentication terminal 10 notified of the determination result performs a process of continuing the authenticated state, and continues using the biometric authentication terminal 10 by the user.

  In addition, the terminal 20 and / or the biometric authentication terminal 10 measures the relative distance using the proximity communication and transmits the measured distance to the authentication device 30 (step S33). In the authentication device 30, the distance determination unit 35c compares the received relative distance with the distance registered in the inter-terminal distance 34b, and when it is determined that they match, a determination indicating that the terminal 20 is usable. The result is notified to the terminal 20 (step S34).

  The terminal 20 that has been notified of the determination result indicating that the terminal 20 can be used performs a process of continuing the authenticated state, and continues using the terminal 20 of this user (step S35).

  FIG. 7 shows an authentication processing procedure in the case where the user detaches or attaches the biometric authentication terminal 10. When the user attaches or detaches the biometric authentication terminal 10 (Step S41), the biometric signal from the biometric sensor is lost in the biometric authentication terminal 10, and the biometric signal transmitted to the authentication device 30 is lost (Step S42). In that case, the biometric authentication unit 35a of the authentication device 30 determines the loss of the biometric signal, and notifies the biometric authentication terminal 10 of the determination result (Step S43). The biometric authentication terminal 10 that has been notified of the determination result performs a user logout process, cancels the authenticated state, and changes to the non-authenticated state (step S44).

  It should be noted that the biometric authentication unit 35a of the authentication device 30 can be mounted even when abnormal values that cannot be generated when the device is normally mounted on the human body, such as noise generated when the device is released, are collected. It may be regarded as canceled. Also in that case, the biometric authentication unit 35a of the authentication device 30 executes the process of step S43.

  As described above, in the authentication system 1 of the present embodiment, in the biometric authentication terminal 10, the transmitting unit 15 a uses the biometric signal obtained by the biometric signal sensor 17 and the biometric authentication measured by the acceleration sensor 16. A time series signal of the acceleration of the terminal 10 is transmitted to the authentication device 30, and the authentication unit 15b enables the terminal 10 when the authentication device 30 notifies the authentication device 30 that the user is valid. In the terminal 20, the transmitting unit 25a transmits a time-series signal of the acceleration of the terminal 20 measured by the acceleration sensor 26 to the authentication device. When the authentication unit 25b is notified from the authentication device 30 that the terminal 20 can be used, the transmission unit 25a automatically transmits the signal. Enable the terminal 20.

  In the authentication device 30, the biometric authentication unit 35a acquires the biometric signal of the user from the biometric authentication terminal 10, and the biometric signal is the same as the user of the valid user template stored in the storage unit 34. When it is determined that the user belongs, the biometric authentication processing for notifying the biometric authentication terminal 10 that the user is valid is executed. In addition, the behavior determination unit 35b acquires a time-series signal of the acceleration of the biometric authentication terminal 10 and the terminal 20, and the time-series change of the acceleration component derived from the physical activity extracted from the acquired acceleration, that is, the biometric authentication terminal of the behavior information. When the degree of similarity between the terminal 10 and the terminal 20 is higher than a predetermined threshold, it is determined that the terminal 20 is owned by the same person as the biometric authentication terminal 10 and the terminal 20 is notified that the terminal 20 is usable. .

  As a result, the authentication device 30 of the present embodiment confirms that the legitimate user who has the biometric authentication terminal 10 that has been authenticated by highly convenient biometric authentication has the terminal 20 such as a business shared terminal. With the assurance, the terminal 20 can be easily authenticated. In addition, the authentication device 30 always obtains a time-series signal of the acceleration including the behavior information at predetermined time intervals, and determines that the user of the terminal 20 is the same as the legitimate user of the biometric authentication terminal 10. Certified state can be continued. As described above, it is possible to use the biometric authentication terminal 10 and the terminal 20 with high convenience without lowering the authentication accuracy.

  Further, when the terminal 20 is usable, the authentication unit 25b of the terminal 20 further sets the distance between the terminal 20 and the biometric authentication terminal 10 determined to be owned by the same person. The measurement is performed using short-range communication and notified to the authentication device. In the authentication device 30, the distance determination unit 35c causes the storage unit 34 to store the distance between the terminal 10 and the biometric authentication terminal 20 notified from the terminal 10, and the action determination unit 34b converts the time-series signal of the acceleration. If it cannot be obtained, the biometric authentication unit 35a performs the biometric authentication process again, and the distance determination unit 35c stores the distance between the terminal 20 and the biometric authentication terminal 10 notified from the terminal 20, When the stored distance matches, the terminal 20 is notified that the terminal 20 can be used.

  This enables the acquisition of behavior information derived from physical activity, such as when resting at desk work where no physical activity has occurred, or when accelerating with a terminal used by another user while riding a train, car, elevator, etc. Even when the terminal 20 cannot be authenticated, the terminal 20 can be easily authenticated and the authenticated state can be maintained.

  Therefore, for example, when an unauthorized user takes the biometric authentication terminal 10, the authentication fails because the biometric signal is different from that of the legitimate user. Further, when the user attempts to use another terminal 20 without possessing the biometric authentication terminal 10, the authenticated biometric authentication terminal 10 is not in the communication range of the near field communication. Certification is required. In this case, the terminal 20 can be used only by a legitimate user authenticated by normal authentication. That is, the strength of security against unauthorized use is equal to that of the conventional authentication method and does not decrease.

  When a valid user α of the biometric authentication terminal 10 hands over the biometric authentication terminal 10 to another user β, first, the biometric authentication terminal 10 State (see FIG. 7). Then, by registering the received biometric signal template of the user β in the authentication device 30 in advance (see FIG. 3), the user β is authenticated as a valid user of the biometric authentication terminal 10. Then, when the user β has another terminal 20 such as a business shared terminal at the same time as the biometric authentication terminal 10, the use of the terminal 20 by the user β is authenticated by the authentication processing of the above-described embodiment, and The authenticated state of both terminals (10, 20) is continued. In this way, even when there is a transfer between legitimate users αβ, the terminals (10, 20) can be continuously used while avoiding the complicated authentication conventionally required.

  Note that the number of terminals 20 is not limited to one, and the authentication processing of the present embodiment can be applied to a plurality of terminals. For example, when the same legitimate user who possesses the biometric authentication terminal 10 and the terminal 20 further possesses another terminal 20, the user who acquires the behavior information derived from the physical activities of the three terminals and possesses it Determine identity. Alternatively, one of the two terminals that have been authenticated and the terminal having the terminal further acquire behavior information derived from the physical activity of the two terminals and determine the identity of the user having the terminal. Good.

  Further, the processing of the action determining unit 35b is not limited to the processing using the acceleration. Instead of or in addition to the acceleration, external environment information such as temperature, humidity, or light amount, movement information such as a GPS log or a Wi-Fi (registered trademark) log, a Bluetooth Proximity profile, an RSSI, and the like. Distance information or the like using signal strength may be used.

  For example, the movement trajectories of the biometric authentication terminal 10 and the terminal 20 by the GPS coincide with each other, and the speed calculated from the movement amount per unit time of the GPS is smaller than a predetermined threshold, and the movement by the vehicle or the like is excluded. In such a case, the same person may be regarded as possessing the same person.

  Alternatively, when the distance between the biometric authentication terminal 10 and the terminal 20 is smaller than a predetermined threshold value in addition to the similarity of the change in acceleration described above, the same person may be regarded as possessed. Thereby, it is possible to easily perform authentication of various terminals 20.

[program]
It is also possible to create a program in which the processes executed by the terminal 10 and the authentication device 30 of the authentication system 1 according to the above-described embodiment are described in a language executable by a computer. As one embodiment, the terminal 10 and the authentication device 30 can be implemented by installing an authentication program for executing the above-described authentication processing as package software or online software on a desired computer. For example, by causing the information processing device to execute the above authentication program, the information processing device can function as the terminal 10 or the authentication device 30. The information processing device referred to here includes a desktop or notebook personal computer. In addition, the information processing apparatus includes a mobile communication terminal such as a smartphone, a mobile phone, or a PHS (Personal Handyphone System), and a slate terminal such as a PDA (Personal Digital Assistants). The authentication device 30 may be implemented as a cloud that provides services related to the above-described authentication processing by outsourcing. Further, the function of the authentication device 30 may be included in either the biometric authentication terminal 10 or the terminal 20. For example, a time-series signal of the acceleration measured by the biometric authentication terminal 10 may be transmitted to the terminal 20, and the identity of the user possessing the biometric authentication terminal 10 may be determined in the terminal 20. Hereinafter, an example of a computer that executes an authentication program that realizes the same functions as those of the biometric authentication terminal 10, the terminal 20, and the authentication device 30 will be described.

  As shown in FIG. 8, the computer 1000 that executes the authentication program includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, a network interface 1070. These components are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. In the disk drive 1041, a removable storage medium such as a magnetic disk or an optical disk is inserted. For example, a mouse 1051 and a keyboard 1052 are connected to the serial port interface 1050. The display 1061 is connected to the video adapter 1060, for example.

  Here, as shown in FIG. 8, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each data described in the above embodiment is stored in, for example, the hard disk drive 1031 or the memory 1010.

  The authentication program is stored in the hard disk drive 1031 as, for example, a program module 1093 in which a command to be executed by the computer 1000 is described. Specifically, the program module 1093 in which each process executed by the authentication device 30 described in the above embodiment is described is stored in the hard disk drive 1031.

  Further, data used for information processing by the authentication program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes the above-described procedures.

  The program module 1093 and the program data 1094 relating to the authentication program are not limited to being stored in the hard disk drive 1031. For example, the program module 1093 and the program data 1094 are stored in a removable storage medium and read out by the CPU 1020 via the disk drive 1041 or the like. May be done. Alternatively, the program module 1093 and the program data 1094 relating to the authentication program are stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read out by the CPU 1020 via the network interface 1070. You may.

  As described above, the embodiment to which the invention made by the inventor is applied has been described. However, the present invention is not limited by the description and the drawings that constitute a part of the disclosure of the present invention according to the present embodiment. That is, other embodiments, examples, operation techniques, and the like performed by those skilled in the art based on this embodiment are all included in the scope of the present invention.

Reference Signs List 1 authentication system 10 biometric authentication terminal 11 input / output unit 12 proximity communication function unit 13 communication control unit 14 storage unit 14a terminal information 15 control unit 15a transmission unit 15b authentication unit 16 acceleration sensor 17 biosignal sensor 20 terminal 21 input / output unit 22 proximity Communication function unit 23 Communication control unit 24 Storage unit 24a Terminal information 25 Control unit 25a Transmission unit 25b Authentication unit 26 Acceleration sensor 30 Authentication device 31 Input unit 32 Output unit 33 Communication control unit 34 Storage unit 34a Biometric authentication information 34b Distance between terminals 35 Control unit 35a Biometric authentication unit 35b Behavior determination unit 35c Distance determination unit

Claims (4)

An authentication system having a biometric authentication terminal, a terminal, and an authentication device,
The biometric authentication terminal,
A biological signal sensor for acquiring a biological signal of the user;
An acceleration sensor for measuring the acceleration of the biometric authentication terminal,
A transmission unit that transmits the acquired biological signal of the user and a time-series signal of the measured acceleration to the authentication device,
When the user is notified that the user is valid from the authentication device, and an authentication unit that enables its own terminal,
The terminal is
An acceleration sensor for measuring the acceleration of the terminal;
A transmitting unit that transmits a time-series signal of the measured acceleration to the authentication device,
An authentication unit that enables its own terminal when notified that the authentication device can be used,
The authentication device,
A storage unit that stores a template of a biometric signal of a valid user of the biometric authentication terminal,
When a biometric signal of a user is acquired from the biometric authentication terminal and the biometric signal is determined to be that of the same user as the user of the template, a biometric notifying the biometric authentication terminal that the user is valid. A biometric authentication unit that performs an authentication process;
To obtain a time series signal of the acceleration of the biometric authentication terminal and the terminal, obtained when extracting the sequence change in acceleration component derived from the time-series signal or found only body activity of the acceleration, extracted in acceleration component When it is determined that the degree of similarity between the biometric authentication terminal and the terminal of the time series change is higher than a predetermined threshold, it is determined that the terminal is owned by the same person as the biometric authentication terminal, An authentication system, comprising: a behavior determination unit that notifies a terminal that the terminal can be used. The authentication unit of the terminal, when the terminal is available, further, the distance between the terminal and the biometric authentication terminal determined to be owned by the same person, using proximity communication Measurement and notify the authentication device,
A distance determination unit that stores the distance between the terminal and the biometric authentication terminal notified from the terminal determined to be owned by the same person as the biometric authentication terminal in the storage unit; Further comprising
When the behavior determination unit cannot acquire the time-series signal of the acceleration, the biometric authentication unit executes the biometric authentication process again, and the distance determination unit determines whether the terminal and the biometrics are notified from the terminal. The authentication system according to claim 1, wherein when the distance between the terminal and the authentication terminal matches the distance stored in the storage unit, the terminal is notified that the terminal is usable. A storage unit that stores a template of a biometric signal of a valid user of the biometric authentication terminal,
When a biometric signal of a user is acquired from the biometric authentication terminal and the biometric signal is determined to be that of the same user as the user of the template, a biometric notifying the biometric authentication terminal that the user is valid. A biometric authentication unit that performs an authentication process;
The biometric authentication terminal and acquires the time series signal of the acceleration of the terminal, when extracting the series changes of the acquired acceleration component derived from the time-series signal or found only body activity of the acceleration, when the extracted acceleration component If it is determined that the degree of similarity between the biometric authentication terminal and the terminal of the series change is higher than a predetermined threshold, it is determined that the terminal is owned by the same person as the biometric authentication terminal, the terminal An action determination unit that notifies the user that the device can be used;
An authentication device comprising: A biometric authentication terminal, a terminal, an authentication method executed in an authentication system having an authentication device,
In the biometric authentication terminal, the biometric signal of the user obtained by a biometric signal sensor that obtains a biometric signal of the user, and a time-series signal of acceleration measured by an acceleration sensor that measures the acceleration of the biometric authentication terminal, the authentication device A transmitting step of transmitting to the
In the authentication device, a biometric signal of a user is acquired from the biometric authentication terminal, and the biometric signal of the same user as a user of a biometric signal template of a valid user of the biometric authentication terminal stored in a storage unit. If it is determined that the biometric authentication terminal notifies the biometric terminal that the user is valid,
In the biometric authentication terminal, when notified that the user is valid from the authentication device, an authentication step of enabling the terminal itself,
In the terminal, a transmission step of transmitting a time-series signal of acceleration measured by an acceleration sensor that measures the acceleration of the terminal to the authentication device,
Wherein the authentication apparatus acquires the time-series signal of the acceleration of the biometric authentication terminal and the terminal, extracts a time series change of the acceleration component from the time-series signal or found only body activities the acquired acceleration, extraction If it is determined that the similarity between the biometric terminal and the terminal in the time series change of the acceleration component is higher than a predetermined threshold, the terminal is owned by the same person as the biometric terminal. Action determination step of notifying the terminal that it can be used,
In the terminal, when notified from the authentication device that it can be used, an authentication step of enabling its own terminal,
An authentication method comprising:

Images