JPH11224236A - Remote authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a remote authentication system capable of surely judging the identification an individual and the presence/absence of his access right and substantially improving handleability at the time of authenticating the individual by using obtained biometrics information and key inputted user identification information corresponding to the operation of a prescribed authentication information acquisition software. SOLUTION: In a Web system 1, authentication is performed by biometrics information. In this case, corresponding to an accessing user terminal 5, a data kind as access information, an authentication request part 4B operated in a Web server terminal 4 as a client of the authentication, the environment of a Web server S/W4C being an application in use and authentication history (authentication time state), an authentication information obtaining S/W for dynamically obtaining the information required for the authentication is selected. Thus, identification of an individual and the presence/absence of his access right are surely judged corresponding to the environment.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a remote authentication system, in which a single authentication server terminal collectively identifies an individual by biometrics and determines whether or not the individual has an access right to information or an application. It is about.

[0002]

2. Description of the Related Art Conventionally, in order to maintain confidentiality in an information processing system connected to a network, it is necessary to specify an individual and determine whether or not the individual is permitted or denied access. In addition, cash dispensers at banks provide authentication to access individual transaction information such as identification and balance of individuals, and authentication of individuals even when entering or leaving a highly sensitive research place or membership club. Has been implemented.

[0003] As these authentications, individual identification and qualification recognition, that is, authentication, are performed by using personal memory such as magnetic cards, IC cards, passwords and the like, which are positioned in the same manner as identification cards and the like, and by combining them. I have. However, passwords and the like may be forgotten, and magnetic cards and I
C cards and the like have problems such that authentication becomes impossible due to loss or destruction, and authentication is performed by impersonating a person other than the person due to theft or leakage of password information. In order to keep the confidentiality high by these methods, it is necessary to securely authenticate the user, but if passwords are complicated, or if one-time password (OTP) is used, it becomes difficult to memorize the passwords. However, the authentication operation itself becomes complicated. Further, when authentication by storage is performed over a wide area (used at a plurality of banks) without using a magnetic card or the like, it is necessary to centrally manage the authentication information.

[0004]

On the other hand, authentication using biometric information, which is a biological characteristic of an individual such as fingerprint information, palm print information, handwriting information, and retina information, eliminates complexity and is difficult to spoof. If authentication based on biometrics information is required in a wide area, intensive management and authentication are required for the same reasons as described above and also in terms of privacy protection. When performing authentication based on this biometrics information intensively, select an appropriate authentication method not only for each user but also for the security level (confidential level) of those requiring authentication, location, system, etc.
It is important to obtain authentication information.

[0005] Here, IETF (Internet Engineering Ta)
sk Force) RFC2138 (Remote Authentication Dial In) registered in RFC (Request For Comment)
The RADIUS server described in User Service (hereinafter referred to as RADIUS, updated in the previous RFC 2058)
Upon receiving an authentication request from the US client, the authentication process is intensively performed and the authentication result is returned.However, the authentication means and authentication information are fixedly predetermined for each user, and when biometric information is obtained, the biometric information is obtained. There has been a problem that the authentication means and the authentication information cannot be dynamically changed according to the environment.

As such a conventional example, Japanese Patent Laid-Open No.
In the case where the user host accesses the application server as in the "authentication method on a network" disclosed in Japanese Patent Application Laid-Open No. 81518/1993, the application server uses the authentication server and the authentication information fixed to the authentication server. There is an authentication method that requests authentication and receives an authentication result.

[0007] Although biometric information is effective in identifying individuals, it also poses problems of privacy protection and hygienic acquisition such as when the biometric acquisition device itself is dirty or unpleasant. is there.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and when authenticating an individual based on biometric information, it is possible to reliably identify the individual and determine whether or not the individual has access, and to improve the usability. An object of the present invention is to provide a remote authentication system and a remote authentication method that can be significantly improved.

[0009]

A remote authentication system according to the present invention is configured such that an authentication server, an authentication client, and a user terminal are connected to a network, respectively, and perform authentication of a user accessing the authentication client through the user terminal. In the remote authentication system, at least one or a plurality of types of biometric acquisition devices are connected to the user terminal, and the authentication server stores the user terminal and / or one or more pieces of authentication information acquisition software corresponding to the user. In response to the operation of the predetermined authentication information acquisition software corresponding to the user terminal and or the user downloaded from the authentication server at the time of authentication, the biometric information acquired by the one or more types of biometric acquisition device and Or keyed user identity It is obtained so as to use information.

[0010] Further, a remote authentication system according to the next invention comprises:
In a remote authentication system in which an authentication server and a user terminal are respectively connected to a network and which authenticates a user who accesses the user terminal, at least one or a plurality of types of biometric acquisition devices are connected to the user terminal and the authentication is performed. A server stores one or more pieces of authentication information acquisition software corresponding to the user terminal and / or the user, and downloads the user terminal and / or predetermined authentication information acquisition software corresponding to the user from the authentication server upon authentication. Depending on the operation of
The biometrics information acquired by the one or more types of biometrics acquisition devices and / or the user identification information input by a key are used.

[0011] Further, in the remote authentication system according to the next invention, the user selects which of the plurality of biometric acquisition devices connected to the user terminal is to be input as the biometric information. It is provided with authentication information acquisition software having a procedure.

[0012]

Embodiments of the present invention will be described below in detail with reference to the drawings.

Embodiment 1 FIG. FIG. 1 shows the configuration of the first embodiment when the present invention is applied to a Web system 1.
Authentication server terminal 3, authentication client terminal 4 (Web server terminal in this example), user terminal 5 on network 2
Etc. are connected. In such a Web system 1, a Web
When the server 4 is accessed by the user through the user terminal 5, the server 4 receives the personal authentication of the user from the authentication server terminal 3, and provides a service to the user based on the result.

The authentication server terminal 3 includes an authentication control unit 3A,
Authentication information database 3B and authentication information acquisition software pool (hereinafter, software is described as S / W)
3C and a computer device such as a personal computer or workstation (hereinafter referred to as CP
U, a memory, a disk, a communication control unit, etc.). The Web server terminal 4 is a computer device such as a personal computer or a workstation on which a Web server database 4A, an authentication request unit 4B, and a Web server S / W4C that requires user authentication operate.

The user terminal device 5 is a Web server terminal 4
5A that displays the information of the authentication information and the authentication information acquisition S / W
5B is a computer device such as a personal computer or a work station that operates. Further, a biometric acquisition device 6 is connected to the user terminal device 5. The biometric acquisition device 6 includes a fingerprint acquisition device 7 and a palm print acquisition device 8 that acquire fingerprints and palm print information of a human body as biometric information by image processing and the like, and a character recognition tablet that acquires handwriting information drawn by a user as biometric information. 9, a retinal information acquisition device 10 for acquiring retinal information of a human body as biometric information by a fundus scan or the like.

FIG. 2 shows a flow of an authentication process in such a Web system 1. First, the browser 5A, which is an application running on the user terminal device 5,
Web server terminal 4 in which the user is a client for authentication
The case where the information of the highly confidential Web server database 4A is accessed (SP1) will be described. The Web server S / W4C, which is an application that performs access control of highly confidential information, needs to perform user authentication in order to determine whether or not the user has an access right (SP10).

That is, the Web server S / W4C of the Web server terminal 4 has a client ID (identifier of an authentication request unit), an application ID (identifier of the Web server S / W4C which is an application requiring authentication),
Along with the access data type (the confidential level of the data accessed by the user), the authentication request unit 4B is notified that the user needs to be authenticated (SP11). Authentication request part 4
B transmits a user authentication request including the above information to the authentication server terminal 3.

The authentication control unit 3A of the authentication server terminal 3 that has received the user authentication request selects the authentication information acquisition S / W11 from the authentication client ID, application ID, and access data type (SP20). Authentication information acquisition S
For / W11, the authentication information to be obtained is determined.
There is also an authentication information acquisition S / W 11 for acquiring a plurality of pieces of authentication information. The authentication control unit 3A selects the selected authentication information acquisition S / W11.
Is transferred to the Web server terminal 4 which is a client for authentication (SP21).

The authentication request unit 4B of the Web server terminal 4
Authentication information acquisition S / transferred to Web server S / W4C
W11 is delivered, the user instructs acquisition of the authentication information, and the authentication information acquisition S / W11 is transferred from the Web server S / W4C to the user terminal 5 according to the instruction (SP1).
2).

The browser 5A of the user terminal 5 receives the transferred authentication information acquisition S / W11, and operates the authentication information acquisition S / W11 as the authentication information S / W5B (SP2). The authentication information S / W is voluntarily stored in the user ID
(Name, company, employee number, affiliation, address, telephone, etc., and ID assigned to each individual in the system), biometric information such as fingerprint information, palm print information, handwriting information, retina information, and password And authentication information usually used in a conventional computer system, such as a password and a one-time password. At this time, it may operate in cooperation with another S / W such as a driver that acquires authentication information. The authentication information acquisition S / W 5B transfers the acquired user ID and authentication information to the Web server terminal via the browser 5A (SP
3).

The authentication request unit 4B of the Web server terminal 4
The user ID and the authentication information obtained from the user are transferred to the authentication server terminal 3 via the web server S / W4C (S
P13). The authentication control unit 3A of the authentication server terminal 3 performs user authentication based on the transferred user ID and authentication information (SP22). At this time, the authentication information such as the biometric information transferred is compared with the personal information originally stored in the authentication information database 3B of the authentication server terminal 3. If it is determined that all the transferred authentication information is authenticated, the result is used as the authentication client Web.
Notify the server terminal. Also, if at least one collation result is incorrect, it is determined that the user is not the user, and this is notified (SP
23).

The authentication request unit 4B of the Web server terminal 4, which is the client of the authentication that has received the authentication result, notifies the Web server S / W4C of the authentication result. The Web server S / W4C sends the Web request to the user based on the authentication result.
It is determined whether access to the highly sensitive information in the server database is permitted or not permitted (SP14). For example, an operation for user access such as displaying the confidential information is performed.

The user terminal 5 (authentication information acquisition S / W5)
B), the encryption between the Web server terminal 4 and the Web server terminal 4 and the authentication server terminal 3 (authentication control unit 3A) makes it possible to conceal the authentication information and reduce the threat of impersonation. Even if encryption is performed not between individual terminals but between the user terminal 5 (authentication information acquisition S / W 5B) and the authentication server terminal 3 (authentication control unit 3A), the threat of impersonation can be similarly reduced.

Embodiment 1 FIG. Here, a simple example of the database structure and the selection processing of the authentication information acquisition S / W 5B will be described with reference to FIGS. The authentication information database 3B of FIG. 3 stores items of a user ID, a user level, and authentication information as information for each individual user. The user ID is a name, a company, an employee number, an affiliation, an address, a telephone, or the like, or an ID assigned to each individual in the system.
The user level is an access level to confidential information, and the authentication information is fingerprint information, handwriting information, biometric information such as retinal information, password information, one-time password information, and the like as authentication information of a collation source.

The authentication information acquisition S / W pool 3C of FIG. 4 includes an authentication information acquisition S / W11 for acquiring both fingerprint information and retinal information, an authentication information acquisition S / W11 for acquiring two fingerprint information, An authentication information acquisition S / W 11 for acquiring fingerprint information and handwriting information is stored. In the authentication information acquisition S / W pool 3C, selectable authentication information acquisition S / W11 corresponding to the confidential level and the data type are shown.

As a description of the selection mechanism of the authentication information acquisition S / W 11 of the authentication server terminal 3 in the first embodiment, a case where a user first accesses information of the Web server database 4 C of data type = 17 will be described. I do. At this time, the authentication client ID corresponding to the identifier of the authentication request unit 4B
= 15 and the application ID = 25 corresponding to the identifier of the Web server S / W4C. Web server S / W
4C, when an access occurs to data type = 17, authentication request unit 4
Notify B that user authentication is required. The authentication request unit 4B sends the above information and data type to the authentication server terminal 3.
17, Authentication client ID = 15, Application ID
Send a user authentication request containing = 25. Then, the authentication server terminal 3 receives an authentication request including these pieces of information.

The authentication control unit 3A of the authentication server terminal 3 determines that the data requested from the data base of the authentication information acquisition S / W pool 3C in FIG. As described above, the selectable candidates of the authentication information acquisition S / W 11 of level 2 or higher are known.

Embodiment 2 FIG. Another example of a part of the authentication information database will be described with reference to FIGS. Here, selectable authentication information acquisition S / W 11 for each authentication client ID and each application ID
It is shown. Authentication control unit 3A of authentication server terminal 3
Knows the authentication information acquisition S / W11 candidates that can be selected from the authentication client ID and the application ID from these information. Therefore, A, B, C, D, E, and F are candidates according to the data type, C, D, and E are candidates according to the authentication client ID, and A, D, E, and F are candidates according to the application ID. , And finally either D or E is selected.

The authentication server terminal 3 selects the S / W from the candidates for the selectable authentication information acquisition S / W at random, or selects a fixed S / W, or selects them sequentially. As in this example, the data type as the access information, the authentication request unit 4B operating on the device as the authentication client, and the We
b Authentication means and authentication information can be flexibly selected according to the environment of the server S / W4C or the like, and the identification of an individual and the presence or absence of the individual's access right can be reliably determined according to the environment.

Embodiment 3 FIG. In the next example, the user ID
Is included in the authentication request, and the authentication information database of FIG. 3 is set in detail as shown in FIG. FIG. 8 shows the flow of this processing in which the same reference numerals are given to the parts corresponding to those in FIG. First, the Web server terminal 4 acquires a user ID (name, company, employee number, affiliation, address, telephone, or an ID assigned to each individual in a telephone or a system), and acquires the acquired user ID and client ID (authentication request). Part 4B
), An application ID (identifier of the Web server S / W4C that is an application requiring authentication), an access data type (a confidential level of data accessed by the user), and a request for authentication of the user to the authentication request unit 4B. I do.

The authentication information database 3B shown in FIG. 7 stores the type of user (data administrator or general user, etc.), the authentication client ID that can be used, the application ID that can be used, and the application that is passed to the application when the user is authenticated. As control information and a verification log, information for each individual user such as the selection status of the authentication information acquisition S / W up to the past specified number of authentications, the verification rate, the total number of authentications, and the selection criteria are added to the authentication information database of FIG. I have.

If the user ID is included in the authentication request, the user ID is selected according to the selection criteria of the corresponding user in FIG.
As a specific example, when the user ID = 1, the data type = 17, the authentication client ID = 15, and the application ID = 25 in the same manner as in the previous example, the authentication requesting unit 4B sends the information to the authentication server terminal 3 as the above information. A user authentication request including a user ID = 1, a data type = 17, an authentication client ID = 15, and an application ID = 25 is transmitted.

Then, the authentication server terminal 3 receives an authentication request including these pieces of information. As described above, A, B, C, D, E, and F are candidates according to the data type, C, D, and E are candidates according to the authentication client ID, and A, D, E, and F are candidates according to the application ID. Become
Finally, either D or E is selected. Also, since the user ID is 1, the authentication control unit 3A performs the selection based on the total number of times of authentication. The first of the total number of authentications is D, 2
The third time is selected such as E for the third time, D for the fourth time, and so on. Here, since the total number of authentications for the user ID = 1 is 20, and this is the 21st authentication, D of the authentication information acquisition S / W11 is selected.

Another Embodiment Also, as shown in FIG. 7, if the authentication information database 3B specifies an authentication client ID that can be used for each user and an application ID that can be used, if the specified authentication client or application is used, the user is Access control such as sending an authentication information acquisition S / W 11 can be realized. Here, since there are 15 available client IDs and 25 available application IDs, transmission of the authentication information acquisition S / W 11 is permitted.

Also, it is possible to determine whether or not the authentication information acquisition S / W 11 can be sent based on the user type shown in FIG. Furthermore, if the confidential level is assigned to the authentication client or application in the same manner as the user, when the authentication information acquisition S / W 11 is selected, the authentication server terminal 3 acquires the authentication information from the level of the authentication client, the level of the application, and the level of the access data type. S / W11 can be selected. That is, for example, control can be performed to select from among the three or more authentication information acquisition S / W11 of the highest level.

The transmission of the authentication information acquisition S / W 11 is the same as described above, except that only the authentication information is transferred because the user ID has already been acquired. Also,
Key- control information of the application transferred to the application when the user is authenticated in FIG.
1 can be used by the Web server terminal 4 to realize various access controls.

Further, in the above description, the selection criterion is an example of the collation rate shown in FIG. 7. In the above description, the selection criterion is the total number of authentications. Among the information acquisition S / Ws 11, the one with the highest past collation evaluation is searched from the collation log of the user, and selected. Here, since the collation evaluation of the previous E is the highest, E
Is selected.

There is also an example in which the authentication acquisition S / W transfer from the authentication server terminal 3 to the authentication client is omitted. In the case of the Web system 1 described above, the authentication information acquisition S / W is performed by the Web server terminal 4 which is an authentication client.
Is fixedly determined, the Web server terminal 4 of the authentication client previously obtains the authentication information acquisition S / W11, and the authentication information acquisition S / W11 is transmitted from the authentication server terminal 3 to the Web server of the authentication client. Terminal 4
To the user terminal 5 without transferring the authentication information acquisition S / W.

As described above, in the Web system 1, when performing authentication based on biometrics information, the user who accesses the system, the data type as the access information, and the Web server terminal 4 as the authentication client operate. Authentication information acquisition S / W11 that dynamically acquires information necessary for authentication in accordance with the environment of the authentication request unit 4B performing the authentication, the Web server S / W4C or the like, and the authentication history (state at the time of authentication). By selecting, the identification of an individual and the presence or absence of the individual's access right can be reliably determined according to the environment.

Embodiment 2 In the second embodiment, the first embodiment is simplified. In FIG. 9 in which the same reference numerals are given to the parts corresponding to FIG. 1, the user terminal for acquiring biometrics information and the terminal of the authentication client are the same. As an example of an application requiring authentication, there is a database search application 5E for performing a database search, a local database 5C used by the database search application 5E, an authentication request unit 5D,
It is a computer device such as a personal computer or a workstation on which a database search application 5E that requires user authentication and an authentication information acquisition S / W 11 operate. The biometric acquisition device 6 is a user terminal 5
The authentication server terminal 3 has a configuration exactly the same as that of the above-described first embodiment.

FIG. 10 is basically the same as the above-described first embodiment, and has the same reference numerals in FIG.
In the database search application 5E,
When accessing the confidential information of the local database 5C (SP5), first, a user ID (name, company, employee number, affiliation, address, telephone, etc., or an ID assigned to each individual in the system) is acquired (SP6). ), The acquired user ID, the client ID (identifier of the authentication request unit 5D),
A request for authentication of the user is made to the authentication request unit 5D together with the application ID (identifier of the database search application 5E which is an application requiring authentication) and the access data type (the confidential level of the data accessed by the user) (SP7). .

The operation of the authentication server terminal 3 is the same as that of the first embodiment, and the authentication request unit 5D of the user terminal 5, which is the client of the authentication that has executed the authentication processing and received the authentication result,
The authentication result is stored in the database search application 5E
Notify. Based on the authentication result, the database search application 5E determines whether to permit the user to access highly confidential information in the local database 5C (SP8). For example, an operation for user access such as displaying the confidential information is performed. According to such a configuration, in the configuration in which the user terminal 5 issues an authentication request, the same effect as in the first embodiment described above can be obtained.

Embodiment 3 In the third embodiment, in FIG. 11, in which parts corresponding to those in FIGS. 2 and 8 are denoted by the same reference numerals, the authentication information acquisition S / S transferred from the authentication server 3 is performed.
If the personal authentication information specified by W11 does not match the user's intention, the procedure (SP2B, SP12A) in which the user rejects the corresponding authentication information acquisition S / W is shown. The authentication server terminal 3 whose acquisition has been rejected reselects another authentication information acquisition S / W (SP20A). However, this is the case where there is another authentication information acquisition S / W that can be reselected as described above with reference to FIG.

When using biometrics as personal authentication information, it is necessary for the user to be able to refuse if the specified biometrics acquisition device 6 is filthy or uncomfortable. Although biometrics are effective in identifying individuals, privacy issues and hygiene issues, as discussed above, require opportunities for users to reject or change.

Also, when the biometrics acquisition device 6 cannot be trusted in terms of security, even if it is complicated other than the biometrics information, the one-time password (OT)
There is a desire to specify an alternative means such as P), and the identification of an individual can be performed by dynamically selecting an authentication information acquisition S / W that acquires information necessary for authentication even if the user intends to reject or change. And the effect that the presence or absence of the individual's access right can be reliably determined according to the environment.

Embodiment 4 FIG. As means for obtaining the same effect as in the third embodiment, the authentication information acquisition S in the first and second embodiments is used.
/ W itself includes a mechanism for selecting acquired authentication information. In the example of the first embodiment, as the selectable authentication information acquisition S / W, there can be selected one that performs authentication with the fingerprint of D and handwriting information, and one that performs authentication only with the fingerprint of E. At this time, the authentication server obtains the authentication information acquisition S having both the authentication information acquisition functions of D and E.
/ W is transferred.

The configuration and operation procedure of the Web system 1 itself are the same as in the first and second embodiments. FIG. 12 shows a screen image of the authentication information acquisition S / W on the user side. The user selects either one of D / E and obtains the authentication means and his / her own authentication information. Screen selection buttons 12A, 1
When any of 2B is selected, the authentication information acquisition S / W operates to acquire the actually selected authentication information. The authentication server terminal 3 can determine whether authentication is possible based on the type of the transmitted authentication information and the set of the transmitted information, and can obtain the same effect as in the third embodiment.

Embodiment 5 FIG. In the first to fourth embodiments, the authentication information to be acquired is determined by the authentication information acquisition S / W. However, the authentication information to be acquired is only displayed on the screen instead of the authentication information acquisition S / W. Is also good. For example, when the number of times of authentication of the detailed database in the first embodiment is reached, the screen is displayed so as to send fingerprint information and handwriting information.
Thus, the user operates software or the like that voluntarily acquires authentication information in accordance with the displayed content, and sends the acquired authentication information to the authentication server terminal 3.

Also, the display may be such that predetermined authentication information is transmitted, not specifically shown on the display. In this case, the user obtains all the authentication information notified in advance by the administrator or the like to the user separately in advance by the user's memory by operating software or the like that voluntarily obtains the authentication information. Send authentication information to the authentication server. In this way, the same effect as in the first embodiment can be realized. However, when sending predetermined authentication information, which is not specifically shown on the display, the acquisition means is treated like a password. , Security can be further improved.

In the first to fourth embodiments,
The case where personal authentication of a user is performed in the Web server terminal 4 has been described. However, the present invention is not limited to this. For example, a control device that requires personal authentication of a user, such as an entrance / exit terminal device connected to a network. Generally widely applicable.

[0051]

As described above, according to the present invention, when performing authentication using biometric information, the authentication server can freely exchange the biometric acquisition device with the authentication information in accordance with the user's environment for acquiring biometric information. Thus, it is possible to realize a remote authentication system that can select and acquire a user, and thus can reliably identify a user and determine whether the user has an access right.

When the user is not satisfied with the acquisition of the specified authentication information, the user can change or reject the authentication information to be obtained. Even if the device that acquires the information is unreliable, it is possible to reliably identify the user and determine whether or not the user has the access right by the alternative means.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a first embodiment of a Web system to which a remote authentication system according to the present invention is applied.

FIG. 2 is a timing chart for explaining an authentication process in the Web system of FIG. 1;

FIG. 3 is a table provided for explaining a first embodiment of an authentication information database in the authentication server terminal of FIG. 1;

FIG. 4 is a table provided for explaining a first embodiment of an authentication information database in the authentication server terminal of FIG. 1;

FIG. 5 is a table provided for describing an authentication information database in the authentication server terminal of FIG. 1 according to a second embodiment.

FIG. 6 is a table provided for explanation of a second embodiment of the authentication information database in the authentication server terminal of FIG. 1;

FIG. 7 is a table provided for explanation of a third embodiment of the authentication information database in the authentication server terminal of FIG. 1;

FIG. 8 is a timing chart for explaining an authentication process according to a third embodiment in the Web system of FIG. 1;

FIG. 9 is a block diagram showing a configuration of a second embodiment of the Web system to which the remote authentication system according to the present invention is applied.

FIG. 10 is a timing chart for explaining an authentication process in the Web system of FIG. 9;

FIG. 11 is a timing chart for explaining a case where rejection has occurred as a third embodiment of the authentication processing in the Web system in FIG. 1;

FIG. 12 is a schematic diagram illustrating a display screen of an authentication information acquisition S / W as a fourth embodiment of the Web system in FIG. 1;

[Explanation of symbols]

 Reference Signs List 1 Web system 2 Network 3 Authentication server terminal 3A Authentication control unit 3B Authentication information database 3C Authentication information acquisition software pool 4 Web server terminal 4A Web server database 4B Authentication request unit 4C Web server software 5 User terminal 5A Browser 5B Authentication information acquisition software operation Reference Signs List 6 Biometrics acquisition device 7 Fingerprint acquisition device 8 Palm print acquisition device 9 Character recognition tablet 10 Retina information acquisition device 11 Authentication information acquisition software

Continued on the front page (72) Inventor Yoshimasa Baba 2-3-2 Marunouchi, Chiyoda-ku, Tokyo Mitsubishi Electric Corporation

Claims (3)

[Claims] 1. A remote authentication system in which an authentication server, an authentication client, and a user terminal are respectively connected to a network and authenticates a user who accesses the authentication client through the user terminal. A plurality of types of biometric acquisition devices are connected, the authentication server stores the user terminal and / or one or more pieces of authentication information acquisition software corresponding to the user, and the user terminal downloaded from the authentication server upon authentication. And / or in accordance with the operation of the predetermined authentication information acquisition software corresponding to the user, the biometric information acquired by the one or more types of biometric acquisition devices and / or the user identification information input by key are used. Remote authentication system Stem. 2. A remote authentication system in which an authentication server and a user terminal are respectively connected to a network and authenticates a user who accesses the user terminal, wherein the user terminal includes at least one or a plurality of types of biometric acquisition devices. Connected, the authentication server stores one or a plurality of pieces of authentication information acquisition software corresponding to the user terminal and / or the user, and downloads the authentication information from the authentication server at the time of authentication. A remote authentication system characterized by using the biometric information acquired by the one or more types of biometric acquisition devices and / or the user identification information entered by a key in accordance with the operation of the authentication information acquisition software. . 3. An authentication information acquisition software having a procedure for the user to select which of the plurality of biometric acquisition devices connected to the user terminal is to be used to input the biometric information as the biometric information. The remote authentication system according to claim 1 or 2, wherein: