JP7407102B2 - Authentication system - Google Patents

Description

The present invention generally relates to authentication using biometric information using a mobile terminal.

In recent years, electronic lock doors have been installed at the entrances of designated areas (sections) in offices, residences, etc., to restrict entry to non-affiliated persons such as current employees and residents, and to obtain entry history. An entrance control system is in place to prevent theft of assets and confidential information.

Recently, there has been an increase in demand for contactless authentication, and authentication using personally owned mobile terminals, touchless authentication, and cardless authentication are progressing.

In this regard, technology has been disclosed that generates a guest ID based on an ID application, notifies the guest ID to a mobile terminal owned by the guest, and allows the guest to enter a predetermined area when the guest's identity can be confirmed. (See Patent Document 1). The technology described in Patent Document 1 enables an entrance management system that does not require an IC card for guests.

Furthermore, in authentication using a mobile terminal, high security authentication is required.

In this regard, when the user is photographed with a surveillance camera in front of the door and it is confirmed that the user is a registered user, a two-dimensional code is generated and sent to the user's mobile terminal, and the ID authentication is performed. An entrance management system that allows doors to be unlocked has been disclosed (see Patent Document 2).

Further, an entrance management system has been disclosed that performs double personal authentication by transmitting a password and biometric information photographed by the mobile terminal from the mobile terminal (see Patent Document 3).

Japanese Patent Application Publication No. 2016-53864 JP2020-42374A JP2006-172286A

In the technology described in Patent Document 2, if a registered user in front of the door is photographed and another person has the registered user's mobile terminal, unauthorized entry may be possible. Furthermore, with the technology described in Patent Document 3, if the password is stolen by some means and a printed photo of the registered user is taken with a mobile terminal, unauthorized entry may be possible.

As described above, although several techniques have been disclosed for the entrance management system, there is a risk that unauthorized entry may occur.

The present invention has been made in consideration of the above points, and aims to propose an authentication system etc. that can realize highly secure authentication.

In order to solve this problem, the present invention provides an authentication system that authenticates users of a predetermined area using biometric information acquired by a biometric information acquisition device provided at the entrance of the predetermined area. , an acquisition unit that acquires biometric information of the user acquired by the biometric information acquisition device based on the detection of the user at a specific position by a position detection device provided at the entrance; A collation unit that collates the biometric information acquired by the acquisition unit and the user's biometric information stored in the user's mobile terminal is provided.

In the above configuration, biometric information acquired from a user at a specific location is compared with biometric information acquired from a mobile terminal of the user at a specific location. In this way, since authentication is performed using the user's physical location information and the user's biometric information, the security is greater than when authentication is performed using only biometric information or only a mobile terminal. can be increased. Furthermore, since the authentication does not require the user to operate the mobile terminal, such as holding the mobile terminal over a reading device or inputting a password, security can be further enhanced.

According to the present invention, highly secure authentication can be realized.

FIG. 1 is a diagram illustrating an example of a configuration of an authentication system according to a first embodiment. FIG. 3 is a diagram showing an example of an authentication range according to the first embodiment. FIG. 1 is a diagram illustrating an example of a configuration of a mobile terminal according to a first embodiment. 1 is a diagram illustrating an example of a configuration of an entrance management device according to a first embodiment; FIG. FIG. 3 is a diagram showing an example of user information according to the first embodiment. FIG. 3 is a diagram showing an example of information managed by the admission management device according to the first embodiment. FIG. 3 is a diagram illustrating an example of a process for registering personal information and admission area information according to the first embodiment. FIG. 2 is a diagram illustrating an example of a configuration related to registration of biometric information according to the first embodiment. FIG. 3 is a diagram illustrating an example of a process for registering biometric information according to the first embodiment. FIG. 3 is a diagram illustrating an example of a process for registering biometric information according to the first embodiment. FIG. 3 is a diagram showing an example of authentication processing according to the first embodiment.

(1) First Embodiment An embodiment of the present invention will be described in detail below. However, the present invention is not limited to the embodiments.

The authentication system of this embodiment authenticates a user using the user's physical location information and the user's biometric information. For example, when a user of a predetermined area is at a specific location, the present authentication system uses biometric information acquired at the entrance of the predetermined area and biometric information stored in the user's mobile terminal. Verify and authenticate.

According to the above configuration, since the user does not operate the mobile terminal during authentication, it is possible to achieve higher security than when the user operates the mobile terminal during authentication. Furthermore, with the above configuration, a user can enter a predetermined area simply by having a mobile terminal in his/her possession, thus enabling touchless and cardless entry.

In this specification and the like, expressions such as "first," "second," and "third" are used to identify constituent elements, and do not necessarily limit the number or order. Further, numbers for identifying components are used for each context, and a number used in one context does not necessarily indicate the same configuration in another context. Furthermore, this does not preclude a component identified by a certain number from serving the function of a component identified by another number.

Next, embodiments of the present invention will be described based on the drawings. The following description and drawings are examples for explaining the present invention, and are omitted and simplified as appropriate for clarity of explanation. The present invention can also be implemented in various other forms. Unless specifically limited, each component may be singular or plural.

In the following description, the same elements in the drawings are designated by the same numbers, and the description will be omitted as appropriate.

FIG. 1 is a diagram showing an example of the configuration of an authentication system 100 according to the present embodiment. In this embodiment, entry management for residents who use the building 110 on a daily basis, employees working in the building 110, and the like will be explained as an example. In the following, the residents, employees, etc. of the building 110 will be referred to as "users 111."

The authentication system 100 manages the entrance of the user 111 to a predetermined area (hereinafter referred to as "entrance management area") in the building 110. At the entrance of the entrance management area of the building 110, a position detection device 112, a door device 113, and a biological information acquisition device 114 are provided.

The position detection device 112 is a device for detecting the user 111 (mobile terminal 120) located in an authentication possible position (authentication range). The position detection device 112 is a beacon terminal, a pressure sensor, a photoelectric sensor, or the like. The door device 113 is a device for restricting entry of the user 111 to the entrance management area. The door device 113 is, for example, an electronic lock door. The biometric information acquisition device 114 is a device for acquiring biometric information 115 of the user 111. The biometric information acquisition device 114 is a camera, a fingerprint authentication device, a finger vein authentication device, or the like. The biometric information 115 includes images (for example, facial images), fingerprint information, finger vein information, and the like.

The position detection device 112, the door device 113, and the biological information acquisition device 114 are communicably connected to the communication control device 116. The communication control device 116 is communicably connected to the admission management device 130 via the network 101.

The communication control device 116 receives, for example, biometric information 115 acquired by the biometric information acquisition device 114, and transmits the biometric information 115 to the admission management device 130. Further, for example, the communication control device 116 receives control information for controlling the door device 113 transmitted from the entrance management device 130, and transmits the control information to the door device 113. Note that the communication control device 116 may be provided within the building 110 or may be provided outside the building 110.

The mobile terminal 120 is a smartphone, a tablet terminal, a smart watch, or the like. The mobile terminal 120 includes an admission management application 121.

The admission management application 121 is an application program that performs processing related to admission to the admission management area. The admission management application 121 registers, for example, a mobile terminal ID 122 and user information 123 in the mobile terminal 120. The mobile terminal ID 122 is an ID assigned by the admission management device 130. User information 123 is information registered by user 111. The user information 123 includes personal information 124, biometric information 125, accessible area information 126, and the like.

The entrance management device 130 includes a communication section 131, an instruction section 132, an acquisition section 133, a verification section 134, a door control section 135, and an information management section 136.

The communication unit 131 communicates with the communication control device 116 via the network 101. Furthermore, the communication unit 131 communicates with the mobile terminal 120 via a general network or the like.

The instruction unit 132 instructs the biological information acquisition device 114 to acquire the biological information 115 based on the position information of the user 111 detected by the position detection device 112.

When the position detection device 112 is a beacon terminal, a beacon signal transmitted from the beacon terminal is received by the mobile terminal 120 owned by the user 111, and the mobile terminal 120 receives the received signal strength (RSSI) of the beacon signal. The location information of the user 111 is specified from the Strength Indicator). The mobile terminal 120 can transmit the identified location information to the admission management device 130, and the admission management device 130 can acquire the location information.

When the position detection device 112 is a pressure sensor, when the pressure sensor is stepped on by the user 111, a detection signal indicating that the user 111 has been detected by the pressure sensor is sent to the entrance management device 130 via the communication control device 116. sent to. The instruction unit 132 acquires the position information of the pressure sensor as the position information of the user 111. Note that the detection signal may include position information of the pressure sensor, or may include identification information of the pressure sensor.

If the position detection device 112 is a photoelectric sensor, when the user 111 comes between the light emitter of the photoelectric sensor and the light receiver of the photoelectric sensor and the light is blocked, this indicates that the user 111 has been detected by the photoelectric sensor. The detection signal is transmitted to the admission control device 130 via the communication control device 116. The instruction unit 132 acquires the position information of the photoelectric sensor as the position information of the user 111. Note that the detection signal may include position information of the photoelectric sensor, or may include identification information of the photoelectric sensor.

The acquisition unit 133 acquires biometric information 115 of the user 111 acquired by the biometric information acquisition device 114 based on instructions from the instruction unit 132 . Note that when the biometric information 115 is a facial image, the acquisition unit 133 may extract feature points, feature amounts, etc. from the facial image as the biometric information 115.

The verification unit 134 authenticates the mobile terminal 120 by comparing the mobile terminal ID of the mobile terminal 120 detected by the position detection device 112 with the mobile terminal ID managed by the information management unit 136. Further, the verification unit 134 authenticates the user 111 by verifying the biometric information 115 acquired by the acquisition unit 133 and the biometric information 125 stored in the mobile terminal 120 owned by the user 111.

If the authentication of the user 111 by the verification unit 134 is successful, the door control unit 135 transmits control information for unlocking the electric lock of the door device 113 to the door device 113 via the communication control device 116. .

The information management unit 136 manages the biometric information 115 acquired by the biometric information acquisition device 114, the mobile terminal ID 122 registered in the mobile terminal 120, the biological information 125 transmitted from the mobile terminal 120, and the like.

FIG. 2 is a diagram showing an example of an entry authentication range 202 when the user 111 enters the entry management area 201.

Below, the case where the position detection device 112 is the beacon terminal 210, and the biological information acquisition device 114 is the camera 220 will be described as an example. Note that the beacon terminal 210 is provided on the ceiling or floor of the entrance of the admission management area 201 or on the door device 113. The camera 220 is installed on the ceiling of the entrance of the admission management area 201 or on the door device 113.

As shown in FIG. 2, the entrance authentication range 202 indicates the range in which the user 111 is authenticated. The entry authentication range 202 is a range in the passage 203 where entry is not restricted by the door device 113, is within the positioning range 204 of the beacon terminal 210, and is within the photographing range 205 of the camera 220. be. Note that the positioning range 204 is a range in which the strength (reception strength) of the beacon signal that the mobile terminal 120 receives from the beacon terminal 210 is greater than or equal to a threshold value.

The user 111 is in possession of the mobile terminal 120 and enters the positioning range 204, and the user 111 is within the photographing range 205 of the camera 220, or the user 111 is in possession of the mobile terminal 120 and enters the positioning range 204. When the user 111 enters the photographing range 205 and the user 111 is within the positioning range 204, entry to the entrance management area 201 can be authenticated for the first time.

Note that the photographing range 205 of the camera 220 may include the entire positioning range 204 or may include a part of the positioning range 204. If the photographing range 205 of the camera 220 is a range that includes a part of the positioning range 204, whether or not the user 111 is within the photographing range 205 of the camera 220 can be determined by, for example, the camera 220 or the entrance management device 130 using the mobile terminal. The determination may be made based on the position information of the camera 220, or may be determined based on the image acquired by the camera 220.

Here, if the biometric information acquisition device 114 is a device other than the camera 220 that requires contact, such as a fingerprint authentication device or a finger vein authentication device, the entry authentication range 202 is the positioning range 204 of the beacon terminal 210, and , authentication is possible when the user is in contact with the biometric information acquisition device 114.

Note that it is preferable that the door device 113 employs a configuration that allows reliable authentication even when a plurality of users 111 are nearby. For example, the passage width of the door device 113 is a width (for example, 550 mm) that allows each user 111 to pass through. Note that the passage width of the door device 113 may be a width (for example, 900 mm) that allows the user 111 using a wheelchair to pass through. Further, the passage length of the door device 113 is a length (for example, 1700 mm) that takes the time required for authentication into consideration.

FIG. 3 is a diagram illustrating an example of the configuration of the mobile terminal 120.

As shown in FIG. 3, the mobile terminal 120 includes a processor 310 that processes information, an input/output device 320 that can input and output information, a storage device 330 that stores information, and a wireless communication device that performs wireless communication. A device 340 is provided. Each component is communicably connected via a bus, I/F (interface), or the like.

The processor 310 is, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an AI (Artificial Intelligence) chip, or the like.

The input/output device 320 includes a touch panel 321 , a camera 322 , a fingerprint authentication section 323 , and a finger vein authentication section 324 .

The storage device 330 stores information used by the processor 310, information input/output by the input/output device 320, and the like. The storage device 330 is a ROM (Read Only Memory), a RAM (Random Access Memory), or the like. The ROM includes SRAM (Static Random Access Memory), NVRAM (Non Volatile RAM), Mask ROM (Mask Read Only Memory), PROM (Programmable ROM), and the like. The RAM is a DRAM (Dynamic Random Access Memory) or the like.

The functions of the mobile terminal 120 (admission management application 121, etc.) may be realized, for example, by the processor 310 reading a program into the storage device 330 and executing it (software), or by hardware such as a dedicated circuit. or may be realized by a combination of software and hardware.

Note that one function of the mobile terminal 120 may be divided into a plurality of functions, or a plurality of functions may be combined into one function. Further, some of the functions of the mobile terminal 120 may be provided as separate functions or may be included in other functions. Furthermore, some of the functions of the mobile terminal 120 may be realized by another computer that can communicate with the mobile terminal 120.

The mobile terminal 120 downloads the entrance management application 121 from a predetermined server device and installs it on the mobile terminal 120 in response to the operation of the touch panel 321 by the user 111. The admission management application 121 includes a user information registration section 331, an image analysis section 332, an encryption section 333, and a personal image confirmation section 334.

The user information registration unit 331 registers the user information 123 of the user 111 in response to the operation of the touch panel 321 by the user 111. The image analysis unit 332 extracts biometric information 125 from an image captured by a camera 322 mounted on the mobile terminal 120. The encryption unit 333 encrypts the biometric information 125 extracted by the image analysis unit 332, the biometric information 125 acquired by the fingerprint authentication unit 323, and the biometric information 125 acquired by the finger vein authentication unit 324, and generates an encrypted biometric information. Information 337 is generated. The personal image confirmation unit 334 performs processing related to confirmation by the user 111 whether the image acquired by the camera 220 or the camera 322 at the time of registration of the biometric information 125 is that of the user 111.

Note that the storage device 330 stores, as user information 123, name information 335 and affiliation information 336 (personal information 124) of the user 111, encrypted biometric information 337 (biometric information 125), and an admission management area where the user 111 enters. Admission area information 338 (admission area information 126) specifying 201 is stored.

In addition, the biometric information 115 and the biometric information 125 may be an image of the user 111, or may be feature points, feature amounts, etc. extracted from the image of the user 111. The biometric information 115 and the biometric information 125 may or may not be encrypted.

The wireless communication device 340 is a wireless communication device capable of wireless communication such as NFC (Near field communication), Wi-Fi (registered trademark), Bluetooth (registered trademark), and the like. Wireless communication device 340 receives a beacon signal from beacon terminal 210, for example.

FIG. 4 is a diagram illustrating an example of the configuration of the admission management device 130.

The admission management device 130 includes a processor 410, a main storage device 420, an auxiliary storage device 430, an input device 440, an output device 450, and a communication device 460 as components. Each component is communicably connected via a bus or the like.

Processor 410 is a device that performs arithmetic processing. The processor 410 is, for example, a CPU, MPU, GPU, AI chip, or the like.

The main storage device 420 is a device that stores programs, data, and the like. The main storage device 420 is, for example, a ROM, a RAM, or the like.

The auxiliary storage device 430 is a hard disk drive, a flash memory, a solid state drive (SSD), an optical storage device, or the like. Optical storage devices include CDs (Compact Discs) and DVDs (Digital Versatile Discs). Programs, data, etc. stored in the auxiliary storage device 430 are read into the main storage device 420 at any time.

Input device 440 is a user interface that accepts information from the user. The input device 440 is, for example, a keyboard, mouse, card reader, touch panel, or the like.

The output device 450 is a user interface that outputs various information (display output, audio output, print output, etc.). The output device 450 is, for example, a display device that visualizes various information, an audio output device (speaker), a printing device, or the like. The display device is an LCD (Liquid Crystal Display), a graphic card, or the like.

Communication device 460 is a communication interface that communicates with other devices via a communication medium. The communication device 460 is, for example, a NIC (Network Interface Card), a wireless communication module, a USB (Universal Serial Interface) module, a serial communication module, or the like. Communication device 460 can also function as an input device that receives information from other devices with which it is communicatively connected. Communication device 460 can also function as an output device that transmits information to other devices with which it is communicatively connected.

The functions of the entrance management device 130 (communication section 131, instruction section 132, acquisition section 133, collation section 134, door control section 135, information management section 136, etc.) are implemented by the processor 410 using a program stored in the auxiliary storage device 430, for example. It may be realized by reading out to the main storage device 420 and executing it (software), it may be realized by hardware such as a dedicated circuit, or it may be realized by a combination of software and hardware. good.

Note that one function of the admission management device 130 may be divided into a plurality of functions, or a plurality of functions may be combined into one function. Furthermore, some of the functions of the admission management device 130 may be provided as separate functions or may be included in other functions. Furthermore, some of the functions of the admission management device 130 may be realized by another computer that can communicate with the admission management device 130.

FIG. 5 is a diagram showing an example of the user information 123 (user table 500) stored in the mobile terminal 120.

The user table 500 stores information such as a mobile terminal ID item 501, a name item 502, an affiliation item 503, an encrypted biometric information item 504, and an entry area information item 505.

The mobile terminal ID item 501 stores an ID unique to the mobile terminal 120 (mobile terminal ID 122). More specifically, the mobile terminal ID field 501 stores the mobile terminal ID 122 automatically assigned by the admission management device 130 when the user information 123 is registered. The user information 123 acquired via the admission management application 121 is stored in the name item 502, affiliation item 503, encrypted biometric information item 504, and admission area information item 505.

FIG. 6 is a diagram showing an example of information (management information table 600) managed by the information management unit 136 of the admission management device 130.

The management information table 600 includes information on a user ID item 601, a mobile terminal ID item 602, a name item 603, an affiliation item 604, a biometric information item 605, a biometric information item 606, an entry area information item 607, and a passage authority item 608. is memorized.

The user ID item 601 stores a management number that uniquely determines the user 111. The mobile terminal ID field 602 stores the mobile terminal ID 122 automatically assigned by the admission management device 130 when the user information 123 is registered. The biometric information item 605 stores information indicating the storage location of the biometric information 125 transmitted from the mobile terminal 120. The biometric information item 606 stores information indicating the storage location of the biometric information 115 acquired by the camera 220. The biometric information 125 and the biometric information 115 are located in an area where information is temporarily stored, and are not retained by the admission management device 130 for a long period of time for security reasons.

The name item 603, affiliation item 604, and admission area information item 607 include personal information 124 (name information 335, affiliation information 336) sent from the mobile terminal 120, and admission area information 126 (admission area information 338). ) is memorized. The passage authority item 608 stores information indicating the passage authority granted to the user 111 by the entrance management device 130 or a predetermined server device.

FIG. 7 is a diagram illustrating an example of a process for registering personal information 124 and accessible area information 126 in the authentication system 100.

First, in S701, the mobile terminal 120 downloads and installs the admission management application 121 from a predetermined server device in response to the operation of the touch panel 321 by the user 111.

In S702, the mobile terminal 120 transmits a mobile terminal registration request to the admission management apparatus 130 in order to have the admission management apparatus 130 recognize the mobile terminal 120. In order to prevent an unspecified person from transmitting a mobile terminal registration request from the mobile terminal 120, the entrance control device 130 uses a password set by the administrator of the building 110 to prevent an unspecified person from transmitting a mobile terminal registration request. It may also be possible to disable registration requests.

In S703, upon receiving the mobile terminal registration request, the admission management device 130 allocates and stores the mobile terminal ID 122 to the mobile terminal 120 that transmitted the mobile terminal registration request in S702. The admission management device 130 transmits the assigned mobile terminal ID 122 and a user information registration request to the mobile terminal 120.

In S704, the mobile terminal 120 inputs the personal information 124 and the admission area information 126 according to the operation of the touch panel 321 by the user 111, and transmits the input information to the admission management device 130.

In S705, the admission management device 130 stores the personal information 124 of the user 111 and the admission area information 126 input in S704.

Next, in the authentication system 100, biometric information 125 is registered. Registration of biometric information 125 may be performed following the process shown in FIG. 7, or may not be performed subsequent to the process shown in FIG.

FIG. 8 is a diagram illustrating an example of a configuration related to registration of biometric information 125.

In this authentication system 100, there are two methods for registering the biometric information 125 of the user 111. One is a first registration method that uses the camera 322 installed in the mobile terminal 120. The other method is a second registration method that uses a camera 220 installed in the building 110.

In the first registration method, the user 111 uses the admission management application 121 of the mobile terminal 120 to check the photographed image 801, which is an image acquired by the camera 322 mounted on the mobile terminal 120 or a processed image of the image. By doing so, biometric information 125 can be registered.

In the second registration method, when the user 111 enters the entrance authentication range 202 with the mobile terminal 120, the mobile terminal 120 transmits information indicating the location of the user 111 (mobile terminal 120) to the entrance management device. 130. Note that the information indicating the location includes location information of the mobile terminal 120, detection information indicating that the user 111 has been detected, identification information of the beacon terminal 210, and the like. At this time, the mobile terminal 120 may transmit the mobile terminal ID to the admission management device 130.

The entrance management device 130 authenticates the mobile terminal 120 using the mobile terminal ID and location information, and if the authentication is successful, transmits a photographing request to the camera 220. Upon receiving the photographing request, the camera 220 photographs the user 111, and sends the photographed image 801, which is an image acquired by the camera 220 or a processed image of the image, to the entrance management device 130 or to the entrance management device. The data is transmitted to the mobile terminal 120 without going through 130. The user 111 can register the biometric information 125 by checking the captured image 801 using the entrance management application 121 of the mobile terminal 120.

Here, the admission management device 130 may include an image selection section 810. The image selection unit 810 selects, from among the plurality of captured images 801, the captured image 801 whose feature points are equal to or greater than a specified value, or the captured image 801 with the most feature points. For example, when a plurality of photographed images 801 are sent to the admission management device 130, the admission management device 130 transmits the photographed images 801 selected by the image selection unit 810 to the mobile terminal 120.

FIG. 9 is a diagram illustrating an example of the registration process (first registration method) of biometric information 125 when using the camera 322 mounted on the mobile terminal 120.

In S901, the mobile terminal 120 photographs the user 111 in response to the user's 111 operation on the touch panel 321, and obtains an image of the user 111.

In S902, it is assumed that the user 111 has a mobile terminal 120 in which personal information 124 and admission area information 126 are registered. Note that considering the case of re-registration of the biometric information 125, it does not matter whether the biometric information 125 is registered or not.

In S903, the mobile terminal 120 calculates the position information of the mobile terminal 120 from the reception strength of the beacon signal from the beacon terminal 210, and when it is detected that the mobile terminal 120 has entered the positioning range 204 of the beacon terminal 210, The calculated position information and mobile terminal ID are transmitted to the admission management device 130. Note that the mobile terminal 120 uses the position of the user 111 (mobile terminal 120), such as information indicating that the user 111 has entered the positioning range 204 and identification information of the beacon terminal 210, instead of the position information of the mobile terminal 120. You may also send information indicating.

In S904, when the location information of the mobile terminal 120 acquired in S903 is correctly within the photographing range 205 of the camera 220, the entrance management device 130 uses the received mobile terminal ID and the location information managed by the information management unit 136. Check the ID of the mobile device you are using. Entrance management device 130 transmits the verification result to mobile terminal 120.

In S905, the mobile terminal 120 determines whether or not the verification was successful based on the verification results, and if it is determined that the verification was successful, the mobile terminal 120 informs the user 111 via the admission management application 121 that the photographed image 801 is the person in question. Please check.

For example, the mobile terminal 120 analyzes the image of the user 111 taken in S901, extracts and shapes the person in the image, and processes the image into the photographed image 801. If there are multiple captured images 801, the mobile terminal 120 selects one in response to the operation of the touch panel 321 by the user 111. The mobile terminal 120 extracts the biometric information 125 from the captured image 801, encrypts it, and stores it.

Then, the mobile terminal 120 transmits information indicating that the identity verification of the captured image 801 has been completed to the admission management device 130.

In S906, the admission management device 130 confirms that the identity verification of the photographed image 801 has been completed, and completes the registration of the user information 123 of the user 111.

FIG. 10 is a diagram illustrating an example of the registration process (second registration method) of biometric information 125 when using the camera 220 provided in the building 110.

In S1001, it is assumed that the user 111 has a mobile terminal 120 in which personal information 124 and admission area information 126 are registered. Note that considering the case of re-registration of the biometric information 125, it does not matter whether the biometric information 125 is registered or not.

In S1002, the mobile terminal 120 calculates the position information of the mobile terminal 120 from the reception strength of the beacon signal from the beacon terminal 210, and when it is detected that the mobile terminal 120 has entered the positioning range 204 of the beacon terminal 210, The calculated position information and mobile terminal ID are transmitted to the admission management device 130.

In S1003, when the location information of the mobile terminal 120 acquired in S1002 is correctly within the photographing range 205 of the camera 220, the entrance management device 130 uses the received mobile terminal ID and the location information managed by the information management unit 136. Check the ID of the mobile device you are using. Entrance management device 130 transmits the verification result to mobile terminal 120.

In S1004, the mobile terminal 120 determines whether or not the verification was successful based on the verification results, and if it is determined that the verification was successful, transmits a biometric information registration request to the admission management device 130 via the admission management application 121. . When the user 111 registers the biometric information 125 in the mobile terminal 120, the user 111 operates the touch panel 321 to instruct a biometric information registration request from the biometric information registration screen within the admission management application 121.

In S1005, the entrance management device 130 transmits a photographing request to the camera 220 in accordance with the biometric information registration request transmitted in S1004.

In S1006, the camera 220 photographs the user 111, acquires an image of the user 111, and transmits the acquired image to the admission management device 130.

In S1007, the admission management device 130 transmits the captured image 801 to the mobile terminal 120. For example, the entrance management device 130 analyzes the image of the user 111 taken in S1006, extracts and shapes the person in the image, processes it into a photographed image 801, and sends the photographed image 801 to the mobile terminal 120. .

In S1008, the mobile terminal 120 confirms with the user 111 via the admission management application 121 that the photographed image 801 is the user's identity.

For example, if there are multiple captured images 801, the mobile terminal 120 selects one in response to the operation of the touch panel 321 by the user 111. The mobile terminal 120 extracts the biometric information 125 from the captured image 801, encrypts it, and stores it.

Then, the mobile terminal 120 transmits information indicating that the identity verification of the captured image 801 has been completed to the admission management device 130.

In S1009, the admission management device 130 confirms that the identity verification of the photographed image 801 has been completed, and completes the registration of the user information 123 of the user 111.

Note that, as shown in FIG. 2, when there are a plurality of door devices 113, one door device 113 may be temporarily used only for registration when biometric information 125 is registered. According to this configuration, the user 111 can efficiently register the biometric information 125.

FIG. 11 is a diagram illustrating an example of an authentication process performed when entering the admission management area 201 in the authentication system 100.

In S1101, when the user 111 carrying the mobile terminal 120 approaches the beacon terminal 210, the mobile terminal 120 calculates the position information of the mobile terminal 120 from the reception strength of the beacon signal from the beacon terminal 210, and When it is detected that the beacon terminal 210 has entered the positioning range 204 of the beacon terminal 210, the calculated position information and the mobile terminal ID are transmitted to the entrance management device 130.

In S1102, admission management device 130 receives the location information and mobile terminal ID transmitted from mobile terminal 120 in S1101.

In S1103, when the location information of the mobile terminal 120 received in S1102 is correctly within the shooting range 205 of the camera 220, the entrance management device 130 uses the received mobile terminal ID and the location information managed by the information management unit 136. Verify with the mobile terminal ID.

In S1104, if the admission management device 130 determines that there is a mobile terminal ID that matches the mobile terminal ID received in S1102 among the mobile terminal IDs managed by the information management unit 136, the entrance management device 130 displays the camera 220 and the mobile terminal. A biological information transmission request is sent to 120.

In S1105, the mobile terminal 120 transmits the biometric information 125 to the admission management device 130. For example, the mobile terminal 120 decrypts the stored encrypted biometric information 337 into biometric information 125 and transmits it to the admission management device 130.

In S1106, the camera 220 photographs the user 111 and transmits the image of the user 111 to the admission management device 130.

In S1107, the entrance management device 130 analyzes the image acquired by the camera 220 and extracts the biometric information 115.

In S1108, the biometric information 125 transmitted in S1105 is compared with the biometric information 115 extracted in S1107, and the user 111 is authenticated.

In S1109, if the entrance management device 130 determines that the user 111 has been successfully authenticated, it transmits control information to the door device 113 to unlock the electronic lock of the door device 113.

According to this embodiment, highly secure authentication can be achieved.

(2) Additional notes The above-described embodiment includes, for example, the following content.

In the above-described embodiments, a case has been described in which the present invention is applied to an authentication system, but the present invention is not limited to this, and can be widely applied to various other systems, devices, methods, and programs. can.

Further, in the above embodiment, in S902, S1002, and S1101, a case has been described in which the mobile terminal 120 transmits position information to the admission management device 130, but the present invention is not limited to this. For example, the mobile terminal 120 may transmit the received strength of the beacon signal to the admission management device 130, and the admission management device 130 may calculate the position information of the mobile terminal 120 from the received strength of the beacon signal.

Further, in the above embodiment, in S902, S1002, and S1101, a case has been described in which the mobile terminal 120 transmits position information to the admission management device 130, but the present invention is not limited to this. For example, beacon terminal 210 may be a computer, and beacon terminal 210 may acquire position information of mobile terminal 120 and transmit it to admission management device 130.

Further, in the above-described embodiment, a case has been described in which the authentication system 100 registers the biometric information 125 after registering the personal information 124 and the admission area information 126, but the present invention is not limited to this. For example, the authentication system 100 may register the biometric information 125 and then the personal information 124 and the admission area information 126.

Further, in the above-described embodiment, a case has been described in which the authentication system 100 performs the processes of S902 to S904, but the present invention is not limited to this. For example, the authentication system 100 does not need to perform the processes of S902 to S904.

Furthermore, in the embodiments described above, the configuration of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table. You can.

In addition, in the above explanation, information such as programs, tables, files, etc. that realize each function is stored in memory, storage devices such as hard disks, SSDs (Solid State Drives), or records such as IC cards, SD cards, DVDs, etc. Can be placed on medium.

The embodiment described above has, for example, the following characteristic configuration.

Biometric information (e.g., image, facial image, fingerprint information, finger vein information) acquired by a biometric information acquisition device (e.g., biometric information acquisition device 114) provided at the entrance of a predetermined area (e.g., entrance management area 201) An authentication system (e.g., authentication system 100) that authenticates users of the predetermined area using information) uses a position detection device (e.g., position detection device 112) provided at the entrance to locate a user at a specific location. An acquisition unit (for example, an acquisition unit 133, a circuit, an admission management device 130, an admission management device 130 a computer capable of communicating with the user), and a verification unit (for example, verification unit 134, circuit , an admission management device 130, and a computer capable of communicating with the admission management device 130).

In the above configuration, biometric information acquired from a user at a specific location is compared with biometric information acquired from a mobile terminal of the user at a specific location. In this way, since authentication is performed using the user's physical location information and the user's biometric information, the security is greater than when authentication is performed using only biometric information or only a mobile terminal. can be increased. Furthermore, since the authentication does not require the user to operate the mobile terminal, such as holding the mobile terminal over a reading device or inputting a password, security can be further enhanced.

The biological information acquisition device is a camera (for example, camera 220), and the position detection device is a beacon terminal (for example, beacon terminal 210), and is within the photographing range of the camera (for example, photographing range 205). , and when the mobile terminal is in an authentication range (for example, authentication range, entrance authentication range 202) within a range (for example, positioning range 204) where the reception strength of the signal transmitted by the beacon terminal is equal to or higher than a threshold value, The acquisition unit includes an instruction unit (for example, an instruction unit 132, a circuit, an admission control device 130, and a computer capable of communicating with the admission control device 130) that instructs the camera to take a photograph, and the acquisition unit is configured to receive instructions from the instruction unit. Based on the image of the user acquired by the camera, the biometric information of the user is acquired (for example, see FIG. 11).

In the above configuration, authentication is performed when the mobile terminal is within the shooting range of the camera and within the range where the reception strength of the signal transmitted by the beacon terminal is greater than or equal to the threshold, thereby providing stronger security. It can be realized.

Note that the instruction section may be provided in the camera. In this case, the camera performs photography when the mobile terminal is within the photographing range of the camera and within a range where the reception strength of the signal transmitted by the beacon terminal is equal to or higher than a threshold value.

The mobile terminal includes a camera (for example, camera 322), and in response to an operation by the user, acquires and stores biometric information of the user from an image of the user taken with the camera of the mobile terminal. (For example, see FIG. 9).

With the above configuration, for example, a user can easily register biometric information using a mobile terminal.

The instruction unit includes a communication unit (for example, a communication unit 131, a circuit, an admission control device 130, a computer capable of communicating with the admission control device 130, and a camera 220) that transmits images acquired by the camera to the mobile terminal. , when the mobile terminal is within the authentication range and a biometric information registration request (for example, a biometric information registration request) is received from the mobile terminal, the camera is instructed to take a photograph, and the communication unit, based on the instruction, The image acquired by the camera is transmitted to the mobile terminal, and the mobile terminal stores the biometric information of the image transmitted by the communication unit (for example, see FIG. 10).

In the above configuration, the biometric information of images captured by the installed camera is stored in the mobile terminal, and the biometric information of images captured by the same camera is compared, allowing for more accurate authentication. be able to.

The biometric information of the image may be information extracted by the mobile terminal or may be information acquired by the acquisition unit. When the information is acquired by the acquisition unit, the biometric information is acquired from the same image using the same method, so that authentication can be performed with higher accuracy.

The number of images acquired by the camera may be one or multiple. If a plurality of images are acquired by the camera, the mobile terminal selects one image according to the user's operation and stores the biometric information of the selected image. Furthermore, the authentication system may include an image selection unit that selects an image with feature points equal to or greater than a predetermined value or an image with the largest number of feature points. For example, when a plurality of images are acquired by the camera, the transmitter transmits the image selected by the image selector.

Note that the communication section may be provided in the camera. In this case, the camera photographs the user and transmits the user's image to the mobile terminal 120.

Furthermore, the above-described configurations may be modified, rearranged, combined, or omitted as appropriate without exceeding the gist of the present invention.

Items included in a list in the format "at least one of A, B, and C" are (A), (B), (C), (A and B), (A and C), (B and C) or (A, B, and C). Similarly, items listed in the format "at least one of A, B, or C" are (A), (B), (C), (A and B), (A and C), It can mean (B and C) or (A, B, and C).

100... Authentication system, 112... Position detection device, 114... Biometric information acquisition device, 120... Mobile terminal, 133... Acquisition unit, 134... Verification unit.

Claims (1)

An authentication system that authenticates users of a predetermined area using biometric information acquired by a camera provided at the entrance of the predetermined area,
When the mobile terminal of the user is within the photographing range of the camera and within the authentication range where the reception strength of the signal transmitted by the beacon terminal provided at the entrance is equal to or higher than the threshold, an instruction section that instructs the camera to shoot;
an acquisition unit that acquires biometric information of the user from an image of the user acquired by the camera based on an instruction from the instruction unit ;
a verification unit that collates the biometric information acquired by the acquisition unit and the user's biometric information stored in the user's mobile terminal;
an image selection unit that selects an image from a plurality of images acquired by the camera;
a communication unit that transmits an image acquired by the camera to the mobile terminal;
Equipped with
When the mobile terminal is within the authentication range and a biometric information registration request is received from the mobile terminal,
the instruction unit instructs the camera to shoot;
When a plurality of images are acquired by the camera based on the instruction, the image selection unit selects an image with feature points equal to or greater than a predetermined value, or an image with the largest number of feature points, from among the plurality of images. and the communication unit transmits the image selected by the image selection unit to the mobile terminal,
The mobile terminal stores biometric information of the image transmitted by the communication unit.
Authentication system.

Images