JP2001216270A - Authentication station, authentication system and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a highly reliable authentication system capable of individually authenticating a user connected to a network. SOLUTION: This authentication system 10 is provided with the authentication station 20 having a directory server 24 provided in a PKI authentication station and a biometrics collation server 30 capable of collating biometrics data based on the physical feature data of the user and a user terminal 60 connected with the authentication station 20 by the network 12. The biometrics data are transmitted from the user terminal 60 and the authentication station 20 collates the biometrics data transmitted from the user with the biometrics data of the user registered beforehand by the biometrics collation server 30. Thus, the authentication station 20 can check the validity of a digital certificate 66 by the directory server 24 and can authenticate the individual by collating the biometrics data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication station for authenticating a communication partner connected to a network, an authentication system including the authentication station, and an authentication method.

[0002]

2. Description of the Related Art In recent years, with the development of services using the Internet, for example, when using resources on the Internet, when contracting by e-mail, etc.
In various situations, it is important to authenticate a communication partner. Conventionally, as a system for performing such authentication, an authentication system using a so-called “public key infrastructure (PKI)” has been widely used.

The above-mentioned authentication system has the following mechanism. First, a person who wants to authenticate himself (hereinafter, referred to as “user”) sends a predetermined unencrypted sentence (hereinafter, referred to as “plain text”) to a person who wants to be authenticated (hereinafter, referred to as “authenticater”). Then, an encrypted text obtained by encrypting the plain text with its own secret key is transmitted. The authenticator who receives the set of the plaintext and the ciphertext authenticates the user by decrypting the ciphertext with the public key of the user authenticated by the certificate authority and checking the decrypted text with the plaintext. Only a user having a private key that is paired with a public key can create a ciphertext (therefore, this ciphertext is called a "digital signature"). If と matches, the user can be authenticated.

[0004]

However, in the above-mentioned authentication system, the authenticator can authenticate that he / she has a private key, but cannot authenticate the individual in a strict sense. there were. That is, even if a malicious third party who stole the secret key impersonates the user, the authenticator cannot distinguish the malicious third party from the genuine user. Conversely, a genuine user cannot prevent intentional "spoofing" of lending his or her private key to another person, and a third party who has lent his / her private key, for example, only the user who paid the predetermined fee Available services become available.

Accordingly, an object of the present invention is to solve the above-mentioned problems and to provide an authentication station capable of performing highly reliable personal authentication in authentication on a network, and an authentication system and an authentication method including the same.

[0006]

According to the present invention, there is provided a certificate authority comprising:
A certificate authority that authenticates a user connected to a network, wherein the digital certificate is a digital certificate issued to the user and a digital certificate storage unit that stores validity data indicating the validity of the digital certificate; Registration data storage means for storing biometrics data based on biological characteristics as registration data, a matching server for matching biometric data transmitted from a user with registration data stored in the registration data storage means, and a digital certificate Based on the validity data stored in the storage unit, the validity of the digital certificate of the user requesting the authentication is determined, and the user is authenticated based on the result of the validity determination and the verification result by the verification server. Authentication means.

As described above, the certificate authority according to the present invention stores a digital certificate and digital certificate storage means for storing validity data indicating the validity of the digital certificate, and stores biometrics data of the user as registration data. Registration data storage means. Then, the collation unit collates the registration data stored in the registration data storage unit with the biometric data transmitted from the user. Further, the authentication means determines whether the digital certificate has expired or has been revoked and has become invalid based on the validity data stored in the digital certificate storage means. The validity is determined, and authentication is performed together with the collation result by the collation means. In this way, in addition to the determination of the validity of the digital certificate, authentication can be performed by collating the user's biological characteristics, so that so-called "spoofing" can be prevented, and highly reliable personal authentication can be performed. It can be performed.

[0008] In the above certification authority, the collating means may collate a plurality of types of biometric data. Biometric data includes
In addition to fingerprints, faces, retinas, irises, palm prints, voice prints, and the like as physical features, there are many types of behavior attributes, such as handwriting, which do not change for many years. In the present invention, the collation means collates a plurality of types of biometric data, so that it is possible to flexibly respond to various user requests.

In the certificate authority, the digital certificate storage means stores the expiration date of the registration data stored in the registration data storage means, and the authentication means stores the expiration date stored in the digital certificate storage means. And determining the validity of the biometrics data of the user requesting the authentication based on Since the biometrics data is a biological characteristic of a human and changes over time, even the owner of the biometrics data stored in the registered data storage means may not be collated. This can be prevented beforehand by storing the expiration date of the biometric data.

[0010] The certificate authority further includes an issuing authority that issues a digital certificate, and the issuing authority stores the expiration date of the biometric data in the digital certificate storage means when issuing the digital certificate. It may be characterized. By including the issuing authority that issues the digital certificate, the expiration date of the biometric data can be stored together with the digital certificate.

[0011] The certification authority may further include an amount storage means for storing an authentication consideration amount, and when the authentication is performed, accumulate an authentication consideration amount determined based on the contents of the authentication in the amount storage means. Is preferred.

[0012] An authentication system according to the present invention is characterized by comprising the above certification authority, and a user terminal connected to a network and having a biometric data acquisition unit for a user to acquire biometric data. . By providing a user terminal capable of acquiring biometrics data on a network in this manner, an authentication system capable of performing personal authentication and performing highly reliable authentication can be configured.

In the above authentication system, the user terminal stores a secret key corresponding to the public key registered in the digital certificate, and the user terminal generates a digital signature using the secret key, and And the certificate authority authenticates the user with the digital signature transmitted from the user terminal. In this way, by checking the digital signature by the certificate authority, it is possible to authenticate that the user has a private key.

The authentication system may generate a digital signature using a secret key and biometrics data. If the digital signature is generated by the secret key and the biometric data in this manner, it becomes difficult for a third party other than the authentic user to generate the digital signature, and the security of the authentication system can be improved. .

Further, the authentication system may be characterized in that the user terminal encrypts the biometrics data obtained by the biometrics data obtaining means with a public key of the certificate authority and transmits the encrypted data to the certificate authority.
By encrypting the biometric data in this way, the biometric data becomes difficult to be decrypted, and the security of the authentication system can be improved.

[0016] The authentication system according to the present invention may be characterized by comprising the above-mentioned certificate authority, and an authentication request means connected to the network and requesting the certificate authority to authenticate the user. By employing such a configuration, an authentication system can be realized in which the authentication request unit can request the authentication authority to authenticate the user.

In the above-mentioned authentication system, it is preferable that the authentication request unit notifies the certificate authority of the contents of the authentication, and the certificate authority determines the authentication price based on the notified contents of the authentication.

An authentication method according to the present invention is an authentication method for authenticating a user connected to a network by a certificate authority, wherein the certificate authority issues a digital certificate to the user, the digital certificate and the digital certificate. A user registration step of storing validity data indicating the validity of the user, acquiring biometric data, which is a biometric characteristic of the user, from the user, and storing the data as registration data. The certificate authority determines the validity of the digital certificate based on the validity data, and the user obtains the biometrics data and transmits it to the certificate authority, and the certificate authority transmits the biometric data transmitted from the user. The biometrics data collation step of collating the metrics data with the registration data, and the results and Based on the comparison result of the metrics data, characterized in that it comprises an authentication step of authenticating the user.

As described above, in the authentication method according to the present invention, when the digital certificate stored at the user registration stage is issued, the digital certificate, the validity data indicating the validity of the digital certificate, and the biometrics data of the user are stored in the digital certificate. It can be used when the certificate authority authenticates the user, i.e., in the user validity determination step and the biometric matching step.
As described above, by checking both the digital certificate and the biometrics data, it is possible to perform highly reliable personal authentication that prevents so-called “spoofing”.

[0020]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of an authentication system according to the present invention will be described below in detail with reference to the drawings.
In the description of the drawings, the same elements will be denoted by the same reference symbols, without redundant description.

FIG. 1 shows an authentication system 10 according to the first embodiment.
FIG. The authentication system 10 is configured such that the biometrics authentication station 20 for performing authentication and the user terminal 60 used by a user to be authenticated use the Internet (network).
12 is connected. Further, a resource providing server 80 that provides a predetermined resource 82 is connected to the Internet 12.

Next, each element will be described in order. First, the biometrics certification authority 20 checks the digital certificate 6
Directory server 2 having an issuing authority 22 for issuing a digital certificate 6 and a digital certificate database (hereinafter referred to as “digital certificate DB”) 26 as a digital certificate storage unit.
4, a biometrics collation server 30 for collating biometrics data, a controller 28 as an authentication means for authenticating a user based on the validity of the digital certificate and the collation result of the biometrics collation server 30,
A billing database (hereinafter, referred to as a "billing DB") 3 which is an amount storing means in which the authentication consideration is stored as billing information.
And a billing server 34 having the same. The biometrics collation server 30 and the billing server 34 are connected to the controller 28.

The biometrics collation server 30 includes a biometrics database (hereinafter referred to as a “biometrics DB”) 32 as a registered data storage unit in which biometrics data of each user registered in advance is stored, and a biometrics DB 32 And a collation module 40 for collating the biometric data stored in the user terminal with the biometric data transmitted from the user terminal 60. The matching module 40 exists for each type of biometric data, and includes a fingerprint matching module 41 for matching fingerprint data, a voiceprint matching module 42 for matching voiceprint data, a handwriting matching module 43 for matching handwriting data, and the like. Thereby, the biometrics collation server 30 can collate a plurality of types of biometrics data. Although the above-described three matching modules 40 are illustrated in FIG. 1, these are merely examples, and may include a matching module that matches biometric data such as an iris and a face. .

In the digital certificate DB 26, a certificate revocation list (Certificate Revocation) is stored as validity data indicating the validity of the digital certificate 66 in addition to the digital certificate 66.
List, hereinafter referred to as “CRL”).
Then, the directory server 24 includes a controller 28
The CRL can be obtained in response to a request from the CRL.

The accounting server 34 has a function of accumulating the authentication consideration determined by the contents of the authentication in the accounting DB 36 as accounting information every time the authentication is performed.

The issuing authority 22 has a function of issuing a digital certificate 66 and storing information of the issued digital certificate 66 in the digital certificate DB 26 of the directory server 24.

Next, the user terminal 60 will be described.
The user terminal 60 is configured such that a file 64 storing a digital certificate 66 and a secret key 68 and a biometrics data acquisition device 70 for acquiring biometrics data are connected to a data transmission / reception module 62. As a result, the user terminal 60 transmits the information such as the digital certificate 66 and the biometrics data.
Biometrics certification authority 2 through Internet 12
0 can be transmitted and received.

The resource providing server 80 transmits the resource 82 to be provided to the user and the biometrics certification authority 20 to authenticate the user accessing the resource 82.
And an authentication request module 84 which is an authentication request means for requesting the user. Here, the authentication request module 8
Reference numeral 4 denotes not only a request for authentication to the biometrics certification authority 20 but also the contents of the authentication to the biometrics certification authority 2.
It has the function of notifying 0.

Next, the operation of the authentication system 10 of the present embodiment will be described, and an embodiment of the authentication method according to the present invention will be described. First, an outline of the operation of the authentication system 10 will be described with reference to FIG. The user accesses the resource providing server 80 connected to the Internet 12 (see FIG. 1) from the user terminal 60 (S1). The resource providing server 80 operates the authentication request module 84 and transmits an authentication request to the biometrics authentication station 20 to authenticate the accessing user (S2). At this time, the resource providing server 80
You can set the level of authentication reliability.
That is, the resource providing server 80 can request highly reliable authentication if the provided resource 82 is highly confidential. For example, it may be required to authenticate a user with a plurality of biometric data. Subsequently, authentication work (S3) is performed between the biometrics authentication station 20 that has received the authentication request and the user terminal 60, and the authentication result is transmitted to the resource providing server 80 (S4). Then, a billing process is performed between the resource providing server 80 and the biometrics certification authority 20 for the authentication performed by the biometrics certification authority 20 (S
5).

Next, the authentication operation (S3) performed between the biometrics authentication station 20 and the user terminal 60 will be described with reference to the flowchart shown in FIG.

First, upon receiving the authentication request from the resource providing server 80, the biometrics certification authority 20 requests a digital signature from the controller 28 to the user terminal 60 (S10). At this time, the data transmitted as the digital signature request includes, as shown in FIG.
A user ID, which is information unique to a user such as a company, a serial number of the digital certificate 66, and authentication information.
Here, the authentication information is information indicating the type of biometrics data registered in the biometrics DB 32. The user terminal 60 receives the digital signature request (S
12), a digital signature is generated according to this request (S14). Specifically, the user inputs the password of the private key 68, and the digital certificate 66
To generate a digital signature (S14). The user terminal 60 transmits the digital signature and the digital certificate 66
Is transmitted to the biometrics certification authority 20 (S1).
6).

The controller 28 of the biometrics certification authority 20 receives the digital signature transmitted from the user terminal 60 (S18) and checks the digital signature (S2).
0). That is, the controller 28 decrypts the digital signature transmitted from the user terminal 60 with the user's public key, and transmits the digital certificate 66 transmitted together with the digital signature.
Compare with As a result, if they match, it is authenticated that the owner of the secret key is operating the user terminal 60.

Next, the controller 28 sends a CRL request to the directory server 24 (S22). When the directory server 24 receives the CRL request (S24),
The CRL of the user is acquired from the digital certificate DB 26 (S26) and transmitted to the controller 28 (S2).
8).

The controller 28 is the directory server 2
4 (S30), and receives the digital certificate 66
The validity of the digital certificate 66, such as whether or not has expired or expired, is determined (S32). Also,
In the present embodiment, information about the expiration date of the biometric data is stored in the CRL. The controller 28 determines whether the expiration date of the biometric data has expired with reference to the CRL (S3).
2) If the biometric data is valid,
A biometrics data request is transmitted to the user terminal 60 (S34).

FIG. 5 is a diagram showing data transmitted as a biometric data request. The biometrics data request includes a user ID, which is user-specific information, an authentication form indicating whether biometrics authentication is necessary, an authentication condition indicating biometrics authentication conditions, authentication information indicating a type of biometrics authentication, and authentication. It contains each piece of information on the bio-authentication connection device that indicates the connection device necessary for the device.
By including the information of the authentication form in this way, the biometrics certification authority 20 does not always perform the biometrics authentication, but can select a simple authentication in which the biometrics authentication is omitted in some cases. Further, the authentication condition indicates a condition that the authentication is successful as a result of collating the biometric data indicated by the authentication information.
That is, when the authentication condition is “AND”, the authentication is OK only when all the biometric data such as the fingerprint, voiceprint, and handwriting indicated by the authentication information have been authenticated. Conversely, when the authentication condition is “OR”, if any one of the biometrics data indicated by the authentication condition is authenticated, the authentication is OK. Therefore, if the authentication condition is "A
ND ", the user must enter all biometric data indicated in the credentials,
Conversely, if the authentication information is “OR”, any of the biometric data indicated in the authentication information may be input. Since the biometric data request includes the information on the authentication condition, the biometrics certification authority 20 can easily set the level related to the reliability of the authentication.

The user terminal 60 receives the biometric data request from the biometrics certification authority 20 (S
36) prompting the user to input the biometric data indicated by the authentication information of the biometric data request. Then, the user terminal 60 acquires the user's biometrics data by the biometrics data acquiring device 70 (S38). Subsequently, the user terminal 60 transmits the obtained biometrics data to the controller 28 (S40).

When the controller 28 receives the biometrics data from the user terminal 60 (S42), the controller 28 checks the biometrics data based on the type of the received biometrics data. (S4
4). Upon receiving the biometric data from the controller 28 (S46), the matching module 40 of the biometric matching server 30 receives the biometric data from the biometric DB 32.
To retrieve the biometric data of the user. Then, the collation module 40 collates the searched biometrics data with the received biometrics data (S48), and transmits the collation result to the controller 28 (S50).

The controller 28 receives the verification result from the biometric verification server 30 (S52), and transmits the authentication result to the user terminal 60 based on the validity of the digital certificate 66 and the verification result of the biometric data (S52). S54). The user terminal 60 receives the authentication result from the biometrics authentication station 20 (S56), and the authentication work (S3) is completed. In addition, as shown in FIG. 2, the biometrics certification authority 20 also transmits the certification result to the resource providing server 80 (S4).

Next, the accounting process (S5) performed after the authentication operation (S3) between the biometrics authentication station 20 and the resource providing server 80 will be described with reference to the flowchart shown in FIG. Authentication work (S3)
Is completed, as described above, the biometrics certification authority 2
0, the authentication result is transmitted to the resource providing server 80 (S4), that is, the controller 28 of the biometrics certification authority 20 transmits the authentication result to the resource providing server 80 (S60), and the resource providing server 80 receives the authentication result. (S62).

After transmitting the authentication result (S4), the biometrics authentication server 20 transmits to the resource providing server 80 a billing attribute request for inquiring about the presence or absence of billing and the billing amount (S64). The resource providing server 80 receives the charging attribute request from the biometrics certification authority 20 (S
66), the authentication request module 84 is operated, and the accounting attribute determined based on the resource 82 and the like provided to the authenticated user is transmitted to the biometrics authentication station 20 (S68). At this time, the data transmitted as the charging attribute from the resource providing server 80 to the biometrics certification authority 20 includes the user ID, the application attribute, and the charging attribute information as shown in FIG.

The application attribute is an individual attribute of the provided application. By managing this as a history, the application to be charged can be specified. The charging attribute information is information relating to charging. Hereinafter, the relationship between the charging attribute information and the resource 82 to be provided will be described using a specific example.
Here, the resources 82 provided by the resource providing server 80 include a balance inquiry by Internet banking,
It is assumed that it is a procedure such as transfer. For example, if the service provided to the user is a transfer of 1 million yen or less, the charging attribute information is "no charge", and if the service is a high-value transfer of 1 million yen or more, the charging attribute information is "charged". , And transmits the charging attribute to the biometrics certification authority 20. The biometrics certification authority 20 charges the resource providing server 80 based on this accounting attribute information, so that the biometrics certification authority 20 can guarantee the reliability of the authentication within a certain range. Reliability can be improved. The billing attribute information is not limited to “with billing” and “without billing”, but may be information in which the billing amount is changed stepwise according to the type of the resource 82 provided by the resource providing server 80.

When the controller 28 of the biometrics certification authority 20 receives the charging attribute from the resource providing server 80 (S 70), the controller 28 transmits the received charging attribute to the charging server 34.
(S72). The charging server 34 receives the charging attribute from the controller 28 (S74), and performs a process of registering the received charging attribute in the charging DB 36 (S76).
Then, the accounting server 34 transmits the registration processing end to the controller 28 (S78), and the controller 28 receives the registration processing end from the accounting server 34 (S80). Subsequently, the controller 28 transmits a registration processing end to the resource providing server 80 (S82), and the resource providing server 8
0 receives this (S84), and the accounting process (S5) is completed.

Next, the digital certificate 6 issued by the issuing authority 22
6 and the accompanying Biometrics Certification Authority 20
Will be described with reference to the flowchart shown in FIG.

First, the user checks the biometrics certification authority 2
Application for user registration is made for 0 (S10)
0). The biometrics certification authority 20 accepts the application (S102) and performs business procedures such as confirming the identity of the user and inputting data to the PC (S104). When the paperwork is completed, the issuing authority 22 issues the digital certificate 6 of the user.
6 is issued (S106), and the digital certificate 66 is stored in the digital certificate DB 26. At this time, issuing authority 2
2 stores the expiration date of the biometric data in the digital certificate DB 26. Then, the biometrics certification authority 20 secures an area for storing the biometrics data for authenticating the user in the biometrics DB 32 (S108). Subsequently, the biometrics certification authority 20 transmits the issued digital certificate 66 to the user (S110), and the user receives the digital certificate 66 (S112). Subsequently, the user validates the received digital certificate 66 by, for example, inputting a disposable ID separately sent from the biometrics certification authority 20 (S114). Then, the user transmits to the biometrics certification authority 20 that the validation of the digital certificate 66 has been completed (S116).

Upon receiving from the user a notification that the digital certificate 66 has been validated (S118), the biometrics certification authority 20 sets this in the digital certificate DB 26, and subsequently provides the user with the biometrics certificate. Request data (S120). Upon receiving a request for biometrics data from the biometrics certification authority 20 (S122), the user inputs the biometrics data to the user terminal 60 (S124). Then, the user transmits the biometrics data input from the user terminal 60 to the biometrics certification authority 20 (S126). Then, the biometrics certification authority 20 receives the biometrics data from the user (S128), stores the received biometrics data in the biometrics DB 32 (S130), and transmits the storage completion to the user (S13).
2). When the user receives the storage completion from the biometrics certification authority 20 (S134), the issuance of the digital certificate 66 is completed.

Next, the effects of the biometrics authentication station 20 and the authentication system 10 of the present embodiment and the authentication method using the same will be described.

The biometrics certification authority 20 of this embodiment
Has a digital certificate 66, a digital certificate DB 26 storing the digital certificate 66, and a biometric DB 32 storing biometric data. Accordingly, the biometrics certification authority 20 determines the validity of the digital certificate 66 and,
By collating the biometrics data input from 0, the personal authentication of the user can be performed and the reliability of the authentication can be improved.

The biometrics certification authority 20 of the present embodiment stores the digital certificate 6 in the digital certificate DB 26.
The expiration date of the biometric data is stored together with the validity data of No. 6. Thereby, the biometrics certification authority 20 can check the expiration date of the biometrics data, and take measures such as registering new biometrics data before the biometrics data changes over time and cannot be verified. Can be.

Further, the biometrics certification authority 20 of the present embodiment includes the digital certificate 66 issuing authority 22 in the biometrics certification authority 20. Thereby, information about the biometrics data can be stored in the digital certificate DB 26 when the digital certificate 66 is issued. Further, the digital certificate and the biometrics data can be managed collectively.

The biometrics certification authority 20 as described above
The authentication system 10 of the present embodiment and the authentication method using the authentication system 10 can perform personal authentication of a user connected to the Internet 12, and can improve the reliability of authentication.

Next, a second embodiment of the present invention will be described. The authentication system of the second embodiment has the same basic system configuration as the authentication system 10 of the first embodiment, but differs in the operation in the authentication work between the biometric authentication station 20 and the user terminal 60. . In particular,
The authentication system of the second embodiment is different in that biometrics data is used as the password of the secret key 68. Hereinafter, the authentication operation of the authentication system of the second embodiment will be described with reference to the flowchart shown in FIG.

First, a digital signature request is transmitted from the controller 28 of the biometrics certification authority 20 to the user terminal 60 (S150). Upon receiving the digital signature request from the biometrics certification authority 20 (S152), the user terminal 60 urges the user to input the password of the private key 68, that is, the biometrics data in the present embodiment, in order to generate a digital signature. The user inputs biometrics data (S154). The user terminal 60
The biometrics data is transmitted to the biometrics certification authority 20 in order to check whether the input biometrics data is valid (S156). The controller 28 of the biometrics certification authority 20 receives the biometrics data from the user terminal 60 (S15).
8) Then, the received biometrics data is transmitted to the biometrics collation server 30 (S160). The biometric matching server 30 receives the biometric data from the controller 28 (S162), checks the received biometric data (S164), and transmits the matching result to the controller 28 (S166).

The controller 28 receives the collation result from the biometric collation server 30 (S168).
The collation result is transmitted to the user terminal 60 (S170). The user terminal 60 receives the verification result from the biometrics certification authority 20 (S172), and if the verification result is OK, the secret key 68 operates to generate a digital signature (S174). Then, the user terminal 60 transmits the generated digital signature from the user terminal 60 to the controller 28 (S176). The controller 28 receives the digital signature from the user terminal 60 (S178), checks the received digital signature (S180), and requests the directory server 24 for a CRL (S182). The directory server 24 sends the CRL
Upon receiving the request (S184), the digital certificate DB2
6 (S186), and transmits it to the controller 28 (S188). Controller 28
Receives the CRL from the directory server (S19).
0), the validity of the digital certificate 66 is determined based on the CRL (S192), and the result is transmitted to the user terminal 60 as an authentication result (S194). User terminal 60
However, the authentication result is received from the biometrics authentication authority 20 (S196), and the authentication work is completed.

The authentication system of the second embodiment has the effect of improving the reliability of authentication as in the authentication system 10 of the first embodiment, and also has the following effects. That is, in the authentication system of the second embodiment, since the biometrics data is used in place of the password of the secret key 68, a third party other than the genuine user can create a digital signature using the secret key. Therefore, the security of the authentication system can be improved. In addition, the user does not have to enter both the biometrics data and the password, and there is no danger of forgetting or stolen the password.

Although the embodiments of the present invention have been described in detail above, the present invention is not limited to the above embodiments.

In the above embodiment, a resource providing terminal 80 that provides a predetermined resource 82 on the Internet 12
And the case where the biometrics authentication station 20 performs authentication in response to a request from the resource providing server 80 has been described, but the authentication system according to the present invention is not limited to the above embodiment. For example, it may be used when an Internet provider authenticates a user who logs on to the Internet.

In the above embodiment, the biometrics data may be encrypted with a public key published by the biometrics certification authority 20 and transmitted. As a result, the risk of eavesdropping and decoding of the biometrics data can be reduced, and the security of the authentication system can be increased.

[0058]

According to the present invention, the certificate authority has a digital certificate and a digital certificate storing means for storing the digital certificate, and a registration data storing means for storing the biometric data. With this, the certificate authority can check the validity of the digital certificate, check the biometric data transmitted from the user with the registered biometric data, and perform personal authentication of the user connected to the network. And the reliability of the authentication can be improved.

The expiration date of the biometric data is stored in the digital certificate storage means. As a result, it is possible to avoid an inconvenience that a legitimate user cannot perform collation due to aging of biometrics data.

The certificate authority of the present embodiment has an issuing authority that issues digital certificates. Thus, the digital certificate and the biometrics data can be managed collectively from the time of issuance of the digital certificate.

Further, since the certificate authority has the money amount storage means, it is possible to manage the price generated at the time of authentication.

The authentication system and the authentication method using the above-mentioned certificate authority according to the present invention have the above-mentioned certificate authority, so that personal authentication of a user connected to the network can be performed, and the reliability of the authentication can be improved. Can be increased.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a system configuration diagram of an authentication system according to a first embodiment.

FIG. 2 is a diagram schematically illustrating an operation of the authentication system of the first embodiment.

FIG. 3 is a flowchart illustrating an authentication operation of the authentication system according to the first embodiment.

FIG. 4 is a diagram showing data transmitted as a digital signature request.

FIG. 5 is a diagram showing data transmitted as a biometric data request.

FIG. 6 is a flowchart showing a charging procedure in the authentication system of the first embodiment.

FIG. 7 is a diagram showing data transmitted as a charging attribute.

FIG. 8 is a flowchart showing issuance of a digital certificate in the authentication system of the first embodiment.

FIG. 9 is a flowchart illustrating an authentication operation of the authentication system according to the second embodiment.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 10 ... Authentication system, 12 ... Internet, 20 ... Biometrics certification authority, 22 ... Issuing authority, 24 ... Directory server, 26 ... Digital certificate database, 28
... controller, 30 ... biometrics collation server,
32: biometrics database, 34: accounting server, 36: accounting database, 40: matching module,
41: Fingerprint collation module, 42: Voiceprint collation module, 43: Handwriting collation module, 60: User terminal, 6
2: Data transmission / reception module, 64: File, 66:
Digital certificate, 68 private key, 70 biometric data acquisition device, 80 resource providing server, 8
2. Resource, 84: Authentication request module.

Continued on the front page F-term (reference) 5B043 AA09 BA01 CA09 FA02 GA01 5B085 AE23 AE25 5J104 AA07 KA01 KA05 KA16 MA02 NA02

Claims (20)

[Claims] 1. A certificate authority for authenticating a user connected to a network, wherein the digital certificate stores a digital certificate issued to the user and validity data indicating validity of the digital certificate. Writing data storage means, registration data storage means for storing biometrics data based on the biological characteristics of the user as registration data, biometrics data transmitted from the user and the registration data stored in the registration data storage means And a collation server that verifies the validity of the digital certificate of the user who requests authentication based on the validity data stored in the digital certificate storage means, Authentication means for authenticating the user based on a result and a collation result by the collation server. Certificate authority that characterized. 2. The certificate authority according to claim 1, wherein the matching unit matches a plurality of types of biometrics data. 3. The digital certificate storage unit stores an expiration date of the registration data stored in the registration data storage unit, and the authentication unit stores the validity period stored in the digital certificate storage unit. The certification authority according to claim 1, wherein the validity of the biometric data of the user who requests authentication is determined based on a time limit. 4. An issuing authority that issues the digital certificate, wherein the issuing authority stores the expiration date of the biometric data in the digital certificate storage unit when issuing the digital certificate. 4. The method according to claim 3, wherein
Certificate authority described in. 5. An authentication system according to claim 1, further comprising an amount storage unit for storing an authentication consideration amount, wherein when the authentication is performed, the authentication consideration amount determined based on the contents of the authentication is stored in the amount storage means. The certificate authority according to claim 1. 6. A certification authority according to claim 1, further comprising: a user terminal connected to the network, the user terminal having a biometric data acquisition unit for acquiring the biometric data by the user. Characteristic authentication system. 7. A secret key corresponding to a public key registered in the digital certificate is stored in the user terminal, and the user terminal generates a digital signature using the secret key and generates a digital signature. The authentication system according to claim 6, wherein the certificate authority authenticates the user based on the digital signature transmitted from the user terminal. 8. A secret key corresponding to a public key registered in the digital certificate is stored in the user terminal, and the user terminal performs a digital signature using the secret key and the biometrics data. 7. The authentication system according to claim 6, wherein the certificate is generated and transmitted to the certificate authority, and the certificate authority authenticates the user with the digital signature transmitted from the user terminal. 9. The user terminal according to claim 7, wherein the user terminal encrypts the biometrics data obtained by the biometrics data obtaining unit using a public key of the certificate authority, and transmits the encrypted data to the certificate authority. Authentication system. 10. An authentication system comprising: the certificate authority according to claim 1; and an authentication request unit connected to the network and requesting the user to authenticate the user to the certificate authority. 11. An authentication requesting means, which is connected to the network and requests the authentication of the user from the authentication authority according to claim 5, and notifies the authentication authority of the contents of the authentication. And an authentication system, wherein the authentication authority determines the authentication consideration based on the notified authentication content. 12. An authentication method for authenticating a user connected to a network by a certificate authority, the certificate authority issuing a digital certificate to the user, and validating the digital certificate and the digital certificate. A user registration step of storing validity data indicating the validity of the user, acquiring biometric data that is a biological characteristic of the user from the user, and storing the data as registration data; and Transmitting, the certification authority determines the validity of the digital certificate based on the validity data user validity determination step, the user acquires biometrics data and transmits to the certification authority, The certification authority checks the biometric data transmitted from the user and the registered data. An authentication method, comprising: a matching step; and an authentication step of authenticating the user based on a result of the validity determination of the digital certificate and a result of matching the biometrics data. 13. In the user registration step, a plurality of types of biometrics data are obtained from the user and stored as registration data, and the biometrics data collation step includes a plurality of types of biometrics data transmitted from the user. 13. The authentication method according to claim 12, wherein each of the metrics data is compared with the registration data. 14. The user registration step further stores an expiration date of the registration data. In the biometric data collation step, the certificate authority validates the biometric data acquired from the user based on the expiration date. 13. The authentication method according to claim 12, further comprising determining sex. 15. The method according to claim 12, further comprising the step of storing an authentication fee stored based on the authentication content when the certificate authority performs the authentication.
Authentication method described in. 16. In the user validity determining step,
The user further generates and transmits a digital signature with a private key corresponding to a public key registered in the digital certificate, and the certificate authority authenticates the user with the digital signature transmitted from the user. 13. The authentication method according to claim 12, wherein: 17. The method according to claim 17, wherein in the user validity determining step,
The user further generates and transmits a digital signature using a private key corresponding to a public key registered in the digital certificate and biometrics data, and the certificate authority notifies the user based on the digital signature transmitted from the user. The authentication method according to claim 12, wherein the authentication is performed. 18. The authentication according to claim 12, wherein in the biometrics data collating step, the user encrypts the obtained biometrics data with a public key of the certificate authority and transmits the encrypted biometric data to the certificate authority. Method. 19. The authentication according to claim 12, further comprising an authentication requesting step in which a resource provider providing a predetermined resource on a network requests the certificate authority to authenticate the user. Method. 20. An authentication requesting step in which a resource provider providing a predetermined resource on a network requests the certificate authority to authenticate the user and notifies the certificate authority of the content of the authentication. The authentication method according to claim 15, wherein in the authentication consideration storing step, the authentication consideration is determined based on the content of the notified notification.