JP2002189702A - Individual authentication information output device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an individual authentication information output device which enables the unified management of passwords. SOLUTION: The individual authentication information output device 290 is equipped with an input means 210 which receives an input from a user, an individual authenticating means 220 which outputs the individual recognition result of the user according to the input from the user, a specifying means 230 which specifies at least an information processing system selected by the user, and a database access means 250 which reads individual authentication information related to the individual authentication result of the individual authenticating means 220 and the specification result of the specifying means 230 according to them and outputs the read-out individual authentication information from a database 240 to the selected information processing system through a network 300.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a personal authentication information output device which can be connected to a plurality of information processing systems via a network.

[0002]

2. Description of the Related Art Conventionally, there has been known a system for performing business transactions such as purchase of goods and use of a paid information service using a mobile phone. To do business, connect your mobile phone to a network provider through a base station,
You need to connect to a business partner over a network.

In order to connect a mobile phone to a network provider, a user usually needs to enter a password into the mobile phone. Even after the mobile phone is connected to the network provider, the user is required to enter a password every time the mobile phone attempts to use services provided by the network provider (for example, reading mail or mediating a connection with a business partner). In many cases. However, it is not always possible to unify the required password into one password. This is because the number of required characters of the password may differ depending on the service provided by the network provider.

Further, in order to conduct commercial transactions with a plurality of business partners, it is usually necessary to set a different password for each business partner or for each service provided by one business partner. This is because the number of characters required for the password is often different depending on the business partner.

[0005]

As described above, when a plurality of services provided by a network provider are used or when a business transaction is performed with a plurality of business partners, the number of passwords increases, so that the user can unify the passwords. Management becomes difficult.

[0006] In order to facilitate the management of passwords, it is conceivable to reduce the number of characters in the password and make all passwords the same character string. However, if a password of about four digits is used, when a business transaction is performed in front of the public, there is a possibility that the password may be stolen by surrounding people and may be misused. Conversely, if the number of characters in the password is increased, the user cannot remember.

One of the objects of the present invention is to provide a personal authentication information output system that enables unified management of passwords without making the user aware that the types of passwords have increased even when the number of business partners has increased. It is to provide a device.

On the other hand, as a personal authentication system, a system using biometric information such as a fingerprint and an iris instead of a password (symbol code sequence) has been developed (for example, Japanese Patent Laid-Open No.
-53317). Such personal authentication methods are much more likely to be used for personal authentication when conducting commercial transactions because the probability of incorrectly authenticating a person is significantly lower than that of a password-based personal authentication method. Expected.

[0009] However, when a personal authentication method different for each business partner is used, it is necessary to construct or change a system so that a mobile phone or a business partner can support a plurality of personal authentication methods. Can be As a solution, for example, (1) a method in which a plurality of personal authentication methods are implemented in one mobile phone, (2) a method in which a user has a plurality of mobile phones (each of the plurality of mobile phones is a single mobile phone) (A personal authentication method is implemented.) (3) A method of configuring a system so that one business partner can support a plurality of personal authentication methods can be considered. However, the method (1) results in an increase in the cost of the mobile phone, the method (2) results in inconvenience to the user, and the method (3) results in an increase in the cost of the business partner. , Neither result is preferred.

One object of the present invention is to provide a personal authentication information output device capable of supporting a plurality of personal authentication systems.

[0011]

A personal authentication information output device according to the present invention is a personal authentication information output device which can be connected to a plurality of information processing systems via a network, and receives an input from a user. Receiving means, personal authentication means for outputting a personal authentication result of the user based on an input from the user, and at least an information processing system selected by the user among the plurality of information processing systems. A specifying means for specifying, a database for managing personal authentication information in association with the personal authentication result by the personal authentication means and the specification result by the specifying means, a personal authentication result by the personal authentication means and a specification result by the specifying means, The personal authentication information associated therewith is read from the database, and the read personal authentication information is read. The has a database access means for outputting the selected information processing system via the network, thereby the objective described above being achieved.

[0012] The specifying means may further specify a service selected by the user among a plurality of services provided by the information processing system selected by the user.

[0013] The personal authentication information may be any one of a password, biometric information and pseudo biometric information.

The input from the user is at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting.
It may be biometric information indicating one.

[0015] Another personal authentication information output device of the present invention is a personal authentication information output device connectable to a plurality of terminal devices and a plurality of information processing systems via a network. The apparatus has a first terminal device having first input means for receiving a first type of input from a user, and a second terminal for receiving a second type of input different from the first type from the user. And the second type of input from the user is transmitted to the personal authentication information output device via the network, respectively. The personal authentication information output device is provided, wherein the personal authentication information output device outputs a personal authentication result of the user based on one of the first type input and the second type input from the user. Means, identifying means for at least identifying the information processing system selected by the user among the plurality of information processing systems, and personal authentication in association with the personal authentication result by the personal authentication means and the identification result by the identifying means A database that manages information, based on a personal authentication result by the personal authentication unit and a specification result by the specifying unit, reading personal authentication information associated therewith from the database; Database access means for outputting the selected information processing system to the selected information processing system via the network, whereby the above object is achieved.

[0016] The specifying means may further specify a service selected by the user among a plurality of services provided by the information processing system selected by the user.

The personal authentication information may be any one of a password, biometric information and pseudo biometric information.

The input from the user is at least one of a fingerprint, face, retina, iris, palm shape, voice, and handwriting.
It may be biometric information indicating one.

Another personal authentication information output device according to the present invention is a personal authentication information output device that can be connected to a plurality of terminal devices and a plurality of information processing systems via a network. The apparatus includes a first terminal device having first input means for receiving a first type of personal authentication information from a user, wherein the first type of personal authentication information is provided through the network. An information output device, wherein the personal authentication information output device manages a second type of personal authentication information different from the first type in association with the first type of personal authentication information; Reading, from the database, the second type of personal authentication information associated therewith based on the first type of personal authentication information; The personal authentication information via the network and a database access means for outputting the information processing system is selected from the plurality of information processing systems, thereby the objective described above being achieved.

The first type of personal authentication information and the second type of personal authentication information are a password,
Any of the biological information and the pseudo biological information may be used.

The biological information includes a fingerprint, face, retina, iris,
At least one of a palm shape, voice, and handwriting may be represented.

[0022] The database may be a medium removable from the personal authentication information output device.

[0023]

Embodiments of the present invention will be described below with reference to the drawings.

(Embodiment 1) FIG. 1 shows an example of the configuration of a personal authentication information output device 290 according to Embodiment 1 of the present invention.

The personal authentication information output device 290 is configured to be connectable to a plurality of information processing systems via the network 300.

In the example shown in FIG. 1, the information processing system 310 (connection destination a) and the information processing system 320 (connection destination b) are shown as connection destinations of the personal authentication information output device 290. However, the number of information processing systems connected to the personal authentication information output device 290 is not limited to two. The personal authentication information output device 290 is configured to be able to connect to an arbitrary number of information processing systems via the network 300.

The connection / disconnection between the personal authentication information output device 290 and the information processing system is performed by the network connection means 2
80. Network 300 may be any type of network (eg, the Internet).

The information processing system 310 requests the user to input a password for each service provided by the information processing system 310. In order to determine whether the password input by the user is appropriate, the information processing system 310 has a database 330 that manages the password in association with the user and the contents of the service. In the example shown in FIG.
0 manages password 1 in association with user A and service a.

For example, suppose that user A has offered use of service a to information processing system 310. Such an offer is achieved, for example, by directly or indirectly inputting information to the effect that the service a is to be used into the information processing system 310. In this case, the information processing system 310 determines whether the password input to the information processing system 310 matches the password 1 stored in the database 330. If they match, the information processing system 310 determines that the input password is appropriate, and permits the user A to use the service a. If they do not match, the information processing system 310 refuses the user A to use the service a.

Similarly, the information processing system 320 requests the user to input a password for each service provided by the information processing system 320. The configuration of the information processing system 320
Since the configuration is the same as that described above, the description is omitted here.

The personal authentication information output device 290 includes a biometric information input means 210, a personal authentication means 220, a connection destination and service specifying means 230, a database 240,
Database access means 250.

The biometric information input means 210 is used to input the biometric information of the user to the personal authentication information output device 290. Biometric information is fingerprint, face, retina, iris, palm shape,
When representing at least one of the handwritings, an image input device such as a camera or a tablet is used as the biological information input unit 210. When the biological information represents a voice, a microphone is used as the biological information input unit 210.

The personal authentication unit 220 outputs a user authentication result (personal authentication result) based on the user's biometric information input by the biometric information input unit 210.

The connection destination and service specifying means 230
The "information processing system (connection destination)" and the "service" that the user has offered use are specified. Such identification is performed, for example, by referring to information indicating the latest connection destination and information indicating the latest service held in the network connection unit 280. here,
The “information processing system (connection destination)” is an information processing system selected by the user from among a plurality of information processing systems that can be connected to the personal authentication information output device 290. “Service” is a service selected by the user from a plurality of services provided by the information processing system selected by the user. The information processing system selected by the user can be specified by, for example, a network address, a telephone number, or a connection destination name. The service selected by the user can be specified by, for example, the transaction amount or the response from the connection destination.

The database 240 stores the personal authentication means 22
The password is managed in association with the personal authentication result by the user identification information 0 and the identification result by the connection destination and service identification means 230.

The database access unit 250, based on the personal authentication result by the personal authentication unit 220 and the connection destination and the specification result by the service specifying unit 230, stores the password associated therewith into the database 24.
0, and outputs the read password to the connected information processing system via the network 300.

The operation of the personal authentication information output device 290 will be described below. Here, the user A is the information processing system 3
It is assumed that an article purchase procedure is performed using a service a (article purchase service) provided by 10.
In this case, the user A connects the personal authentication information output device 290 to the information processing system 310 (connection destination a) and determines an article to be purchased using the service a. The determination of the article to be purchased is achieved, for example, by following a hierarchical menu displayed on a screen of a display unit (not shown).

In this way, when the user selects the use of the service a of the information processing system 310, the information processing system 310 inputs a password to confirm whether the user is the user A himself or herself. To the personal authentication information output device 290.

The biometric information input means 210 requests the user to input biometric information in response to a request from the information processing system 310. For example, the biological information input unit 210
The biometric information representing the fingerprint is received from the user, and the biometric information is output to the personal authentication unit 220.

When biometric information representing a fingerprint is input by biometric information input means 210, personal authentication means 220 outputs a signal specifying the person having the fingerprint to database access means 250. For example, when it is confirmed that the user is the user A, the personal authentication unit 220 outputs a signal indicating “user A” to the database access unit 250 as a personal authentication result.

The connection destination and service specifying means 230
In response to a request from the information processing system 310, the information processing system selected by the user and the service selected by the user are specified. For example, the information processing system selected by the user is the information processing system 310
If the service selected by the user is service a, the connection destination and service specifying means 230 outputs a signal indicating “connection destination a” and “service a”. Is output to the database access means 250 as a specified result.

The database access means 250 receives a signal indicating "user A" from the personal authentication means 220, receives signals indicating "connection destination a" and "service a" from the connection destination and service specifying means 230, and A, the password associated with “connection destination a” and “service a” (“password 1” in the example shown in FIG. 1) is read from the database 240. The password read from the database 240 is transmitted to the information processing system 310 of the connection destination via the network connection means 280 and the network 300.

As described above, the personal authentication information output device 290
According to this, a password corresponding to the information processing system selected by the user as the connection destination and the service selected by the user is output. This allows the user to
There is no need to be aware of whether different passwords are set depending on the connection destination and service. Even if the number of connection destinations and the types of services increase, it is sufficient for the user to input the same biometric information to the biometric information input means 210. As a result, even when the number of connection destinations and the types of services increase, it becomes possible to perform centralized management of passwords without making the user aware that the types of passwords have increased.

Further, according to the personal authentication information output device 290, personal authentication can be performed on the personal authentication information output device 290 side without depending on the personal authentication method of the information processing system of the connection destination. As a result, even when the information processing system at the connection destination continues to use the conventional personal authentication method (for example, a personal authentication method based on a password), highly reliable personal authentication can be performed without altering the information processing system at the connection destination. It becomes possible to introduce a method.

In this embodiment, the personal authentication means 2
The example in which the information input to 20 is the biological information has been described.
One of the advantages of using biometric information for personal authentication is that the reliability of personal authentication is higher than when a password (symbol code string) is used. Therefore, it can be said that the use of biometric information for personal authentication is suitable for performing a large-scale commercial transaction. Another advantage of using biometric information for personal authentication is that there is less risk of stealing or misuse than using a password (symbol code string). Therefore, it can be said that using biometric information for personal authentication is suitable for conducting business transactions in front of the public.

However, the information input to personal authentication means 220 is not limited to biological information. The information input to the personal authentication unit 220 can be any information that can authenticate an individual. For example, in place of biometric information, a password (symbol code string) is stored in the personal authentication unit 220.
Can also be entered. Biological information input means 210
Alternatively, any type of input means for receiving input from a user may be used.

In the present embodiment, the connection destination and service specifying means 230 are connected to the personal authentication information output device 290.
Identify both the information processing system selected by the user from among the plurality of information processing systems that can be connected to and the service selected by the user from the plurality of services provided by the information processing system selected by the user An example of doing this has been described. However, the present invention is not limited to this. For example, in one information processing system, if the same password is set regardless of the service provided by the information processing system, the connection destination and service specifying means 230 sends the personal authentication information output device 290 Only the information processing system selected by the user from the plurality of connectable information processing systems may be specified. As described above, the connection destination and service specifying unit 230 can function as a unit that specifies at least the information processing system selected by the user among the plurality of information processing systems that can be connected to the personal authentication information output device 290.

In this embodiment, an example has been described in which the information read from database 240 by database access means 250 is a password (symbol code string). However, the present invention is not limited to this. The database 24 by the database access means 250
The information read from 0 can be any type of personal authentication information that can authenticate an individual. The personal authentication information may be, for example, biometric information (code sequence) obtained as an output of the biometric information input unit 210 or pseudo biometric information (code sequence) having the same format as the biometric information. . Here, the pseudo biological information refers to information artificially generated to resemble the biological information.

The personal authentication information output device 290 may be operating at all times, but may be activated only when a request for personal identification is made from the information processing system of the connection destination. The activation unit 260 plays a role of activating the personal authentication information output device 290 as needed. Thus, the power consumed by personal authentication information output device 290 is reduced.

The connection destination and service specifying means 23
0 may obtain information for specifying a connection destination and a service from a database (for example, an address book) other than the network connection unit 280.

Further, at least one of the information held in the database 240, the information input to the database 240, and the information output from the database 240 may be encrypted.

(Embodiment 2) FIG. 2 shows an example of the configuration of a personal authentication information output device 400 according to Embodiment 2 of the present invention.

The personal authentication information output device 400 is connected to the information processing system 310 (connection destination a) and the information processing system 320 via the network 300 as in the first embodiment.
(Connection destination b).

Further, the personal authentication information output device 400
It is configured to be able to connect to a plurality of terminal devices via the network 300.

In the example shown in FIG. 2, a terminal device 420 (user terminal A) is shown as an example of a terminal device having a function of inputting biometric information representing an iris, and biometric information representing a fingerprint is input. A terminal device 425 (user terminal B) is shown as an example of a terminal device having a function.

The terminal device 420 includes an iris pattern input unit 430 for inputting an iris pattern of the user, an encryption / decryption unit 440 for encrypting the iris pattern, and the encrypted iris pattern via the network 300. Network connection means 450 for transmitting to the personal authentication information output device 400. Here, the iris pattern refers to biological information (code sequence) representing the iris of the user.

The terminal device 425 includes a fingerprint pattern input unit 435 for inputting a user's fingerprint pattern, an encryption / decryption unit 445 for encrypting the fingerprint pattern, and a device for transmitting the encrypted fingerprint pattern via the network 300. Network connection means 455 for transmitting to the personal authentication information output device 400. Here, the fingerprint pattern refers to biometric information (code sequence) representing a user's fingerprint.

The personal authentication information output device 400 includes a fingerprint / iris corresponding personal authentication unit 480, a connection destination and service specifying unit 230, a database 240, and a database access unit 250.

The fingerprint / iris correspondence personal authentication means 480 has a function of outputting a personal authentication result based on a fingerprint pattern,
A function of outputting a personal authentication result based on the iris pattern.

In FIG. 2, the same components as those shown in FIG. 1 are denoted by the same reference numerals, and detailed description thereof will be omitted.

Hereinafter, the operation of the personal authentication information output device 400 will be described. Here, it is assumed that the user A who operates the terminal device 420 performs an article purchase procedure using the service a (article purchase service) provided by the information processing system 310. In this case, the user A connects the terminal device 420 to the information processing system 310 (connection destination a) and determines an article to be purchased using the service a. The determination of the article to be purchased is achieved, for example, by following a hierarchical menu displayed on a screen of a display unit (not shown) of the terminal device 420.

In this way, the user can use the terminal device 420
When the user selects the use of the service a of the information processing system 310 by using the information processing system 310, the information processing system 310 requests the terminal device 420 to input personal authentication information in order to confirm whether the user is the user A or not. I do.

The iris pattern input means 430 requests the user to input an iris pattern in response to a request from the information processing system 310. Iris pattern input means 430
The iris pattern input by the above is encrypted by the encryption / decryption means 440, and the encrypted iris pattern is transmitted to the personal authentication information output device 400 by the network connection means 450.

The decryption means 470 receives the encrypted iris pattern transmitted by the network connection means 450 from the network connection means 460, and generates an iris pattern by decrypting the encrypted iris pattern. The generated iris pattern is output to the fingerprint / iris corresponding personal authentication unit 480.

Upon receiving the iris pattern from decoding means 470, fingerprint / iris corresponding personal authentication means 480 executes personal authentication processing based on the iris pattern, and outputs a signal specifying a person having the iris pattern to a database. Output to access means 250. For example, when it is confirmed that the user is the user A, the fingerprint / iris corresponding personal authentication unit 480 outputs a signal indicating “user A” as the personal authentication result to the database access unit 250.
Output to

Connection destination and service specifying means 230, database 240 and database access means 25
The operation of 0 is the same as the operation described in the first embodiment.

The database access means 250 reads the password (“password 1” in the example shown in FIG. 2) associated with “user A”, “connection destination a”, and “service a” from the database 240 and reads out the password. The encrypted password is output to the encryption unit 520.

The encryption means 520 encrypts the password and transmits the encrypted password to the network connection means 4.
Output to 60.

The network connection means 460 transmits the encrypted password to the terminal device 420 via the network 300.

The encryption / decryption means 44 of the terminal device 420
0 generates a password by decrypting the encrypted password. The generated password is
The information is transmitted to the information processing system 310 of the connection destination.

Similarly, when the user selects the use of the service a of the information processing system 310 using the terminal device 425, the information processing system 310 confirms whether or not the user is the user A himself / herself. Request the terminal device 425 to input personal authentication information.

The fingerprint pattern input means 435 requests the user to input a fingerprint pattern in response to a request from the information processing system 310. Fingerprint pattern input means 435
The fingerprint pattern input by the user is encrypted by the encryption / decryption unit 445, and the encrypted fingerprint pattern is transmitted to the personal authentication information output device 400 by the network connection unit 455.

The decryption means 470 receives the encrypted fingerprint pattern transmitted by the network connection means 455 from the network connection means 460, and generates a fingerprint pattern by decrypting the encrypted fingerprint pattern. The generated fingerprint pattern is output to the fingerprint / iris corresponding personal authentication unit 480.

When the fingerprint / iris-compatible personal authentication unit 480 receives the fingerprint pattern from the decryption unit 470, it executes a personal authentication process based on the fingerprint pattern, and outputs a signal for specifying a person having the fingerprint pattern to a database. Output to access means 250. For example, when it is confirmed that the user is the user A, the fingerprint / iris corresponding personal authentication unit 480 outputs a signal indicating “user A” as the personal authentication result to the database access unit 250.
Output to

Connection destination and service specifying means 230, database 240, database access means 250,
The operations of the encryption unit 520 and the network connection unit 460 are the same as the operations described above.

As described above, the personal authentication information output device 400
According to this, a password corresponding to the information processing system selected by the user as the connection destination and the service selected by the user is output. This allows the user to
There is no need to be aware of whether different passwords are set depending on the connection destination and service. Even when the number of connection destinations and the types of services increase, the user only needs to input the same biometric information to the terminal device. As a result, even when the number of connection destinations and the types of services increase, it becomes possible to perform centralized management of passwords without making the user aware that the types of passwords have increased.

Further, according to the personal authentication information output device 400, the personal authentication information output device 400 can perform personal authentication without depending on the personal authentication method of the information processing system of the connection destination. As a result, even when the information processing system at the connection destination continues to use the conventional personal authentication method (for example, a personal authentication method based on a password), highly reliable personal authentication can be performed without altering the information processing system at the connection destination. It becomes possible to introduce a method.

Further, according to the personal authentication information output device 400, there is provided a personal authentication means 480 capable of handling both a fingerprint pattern and an iris pattern. This makes it possible to support both a personal authentication method based on a fingerprint pattern and a personal authentication method based on an iris pattern. By enabling multiple personal authentication methods in this way,
The user can select a personal authentication method that is convenient for the user. For example, in the case where the user is often erroneously authenticated that he is not the person in spite of his / her identity, the user can select a personal authentication method suitable for himself / herself. In addition, even when the user is not suitable for a certain personal authentication method due to physical handicap, the user can use another personal authentication method instead (for example, a fingerprint cannot be used due to lack of a finger). People with disabilities use personal authentication methods based on iris patterns.)

In this embodiment, the personal authentication means 4
The example in which the information input to 80 is a fingerprint pattern or an iris pattern has been described. However, the present invention is not limited to this. When the personal authentication unit 480 has a function of outputting a personal authentication result based on N different types of patterns, the N different types of patterns may be input to the personal authentication unit 480. Here, N is an arbitrary integer of 2 or more. Each of the N different types of patterns can be any pattern that can authenticate an individual. Each of the N different types of patterns may or may not be biological information. For example, when the personal authentication unit 480 has a function of outputting a personal authentication result based on a password (symbol code string), the password (symbol code string) may be input to the personal authentication unit 480. Biometric information includes fingerprint, face, retina, iris, palm shape,
Information representing at least one of speech and handwriting may be used.

The personal authentication information output device 400 may be operated by an information distribution service provider (operator) or may be operated by the user himself.

In the present embodiment, terminal device 420
Pattern transmitted from the personal authentication information output device 400 to the personal authentication information output device 4
The example has been described in which the fingerprint pattern transmitted at 00 is encrypted and the password transmitted from the personal authentication information output device 400 to the information processing system of the connection destination is encrypted. However, these pieces of information need not necessarily be encrypted. If such information is transmitted without encryption, no encryption means or decryption means is required.

FIG. 3 shows another example of the configuration of the terminal device 420.

The terminal device 420 shown in FIG. 3 further includes an IC card reader 530. User is IC
When the card is inserted into the IC card reader 530, the authentication information stored in the IC card is transmitted to the personal authentication information output device 400 together with the iris pattern.

The fingerprint / iris corresponding personal authentication means 480 executes personal authentication processing based on the iris pattern and the authentication information stored in the IC card. Thus, by combining personal authentication based on biometric information with personal authentication based on information other than biometric information, it is possible to further improve the reliability of personal authentication.

The personal authentication based on the authentication information stored in the IC card is not necessarily required to be performed by the personal authentication information output device 400.
It does not need to be done within. The personal authentication may be performed in another device (operated by another business operator) connected to the network 300.

FIG. 4 shows another configuration example of the terminal device 420.

The terminal device 420 shown in FIG. 4 further includes a user ID input unit 540. The user ID input unit 540 allows the user to input the user ID to the terminal device 420.
Used to enter into. As the user ID, for example, a user name or a nickname of the user is used. The user ID is transmitted to the personal authentication information output device 400 together with the iris pattern.

The fingerprint / iris corresponding personal authentication means 480 recognizes that the iris pattern transmitted from the terminal device 420 is
The personal authentication process is executed by determining whether or not the pattern matches the iris pattern corresponding to the user ID transmitted from the user ID 20. This eliminates the need for the fingerprint / iris-compatible personal authentication unit 480 to sequentially check which of the users in the database the iris pattern transmitted from the terminal device 420 corresponds to. As a result, the time required for the personal authentication process in the fingerprint / iris corresponding personal authentication unit 480 can be significantly reduced.

The user ID may be input to the terminal device 420 by using the keyboard of the terminal device 420. The voice input from the microphone may be converted to a user ID by using a voice recognition unit.

Further, the ID unique to the terminal device is replaced with the user ID.
Or user-specific information such as a user name,
The combination of the terminal device and the unique ID
D may be used. As the ID unique to the terminal device, for example, a telephone number (when the terminal device is a mobile phone) or an IP
The address can be used.

FIG. 5 shows another configuration example of the terminal device 420. The configuration of the terminal device 420 shown in FIG. 5 is effective when the number of persons who can use the terminal device 420 is limited.

The terminal device 420 shown in FIG. 5 further includes a candidate list storage unit 550. The candidate list storage unit 550 stores a list of user IDs (candidate lists) of persons who can use the terminal device 420. The candidate list is created in advance by the owner of the terminal device 420. The candidate list is transmitted to the personal authentication information output device 400 together with the iris pattern.

The fingerprint / iris-compatible personal authentication unit 480 recognizes that the iris pattern transmitted from the terminal device 420 is
The personal authentication processing is executed by determining whether or not the iris pattern matches the iris pattern corresponding to the user ID in the candidate list transmitted from 20. This eliminates the need for the fingerprint / iris-compatible personal authentication unit 480 to sequentially check which of the users in the database the iris pattern transmitted from the terminal device 420 corresponds to. As a result, the time required for the personal authentication process in the fingerprint / iris corresponding personal authentication unit 480 can be significantly reduced.

The configuration of the terminal device 425 may be changed so that the terminal device 425 has the configuration shown in any of FIGS.

(Embodiment 3) FIG. 6 shows an example of the configuration of a personal authentication information output device 600 according to Embodiment 3 of the present invention.

The personal authentication information output device 600 can be connected to a plurality of information processing systems including an information processing system 750 (connection destination c) and an information processing system 770 (connection destination d) via the network 300. It is configured as follows.

The information processing system 750 requests a user to input a fingerprint pattern. In order to determine whether the fingerprint pattern input by the user is appropriate, the information processing system 750 has a database 760 for managing the fingerprint pattern in association with the user. FIG.
, The database 760 manages the fingerprint pattern A in association with the user A.

[0098] For example, when the user A
Assume that you have offered to use 0. Such an offer,
For example, this is achieved by directly or indirectly inputting information to the effect that the information processing system 750 is desired to be used to the information processing system 750. In this case, the information processing system 750 determines whether the fingerprint pattern input to the information processing system 750 matches the fingerprint pattern stored in the database 760. If they match, the information processing system 750 determines that the input fingerprint pattern is appropriate, and permits the user A to use the information processing system 750. If they do not match, the information processing system 750 refuses the user A to use the information processing system 750.

Similarly, the information processing system 770 requests the user to input a fingerprint pattern. The configuration of the information processing system 770 is the same as the configuration of the information processing system 750, and a description thereof will not be repeated.

Further, the personal authentication information output device 600 includes:
It is configured to be able to connect to a plurality of terminal devices including the terminal device 420 via the network 300.

The personal authentication information output device 600 includes an iris pattern analysis unit 680, a database 700, and a database access unit 710.

In FIG. 6, the same components as those shown in FIG. 2 are denoted by the same reference numerals, and detailed description thereof will be omitted.

The operation of personal authentication information output device 600 will be described below. Here, it is assumed that the user A who operates the terminal device 420 performs an article purchase procedure using the article purchase service provided by the information processing system 750. In this case, the user A connects the terminal device 420 to the information processing system 750 (connection destination c) and determines an article to be purchased using the article purchase service. The determination of the article to be purchased is achieved, for example, by following a hierarchical menu displayed on a screen of a display unit (not shown) of the terminal device 420.

[0104] In this way, the user can use the terminal device 420.
When the use of the information processing system 750 is selected by using the
The terminal device 420 is requested to input personal authentication information to confirm whether or not the user is the user.

The iris pattern input means 430 requests the user to input an iris pattern (image data) in response to a request from the information processing system 750. The iris pattern input by the iris pattern input unit 430 is encrypted by the encryption / decryption unit 440, and the encrypted iris pattern is transmitted to the personal authentication information output device 600 by the network connection unit 450.

The decryption means 470 receives the encrypted iris pattern transmitted by the network connection means 450 from the network connection means 460, and generates an iris pattern by decrypting the encrypted iris pattern. The generated iris pattern is output to iris pattern analysis means 680.

The iris pattern analysis means 680 analyzes the iris pattern (image data) and outputs an iris pattern (bit string of “0” or “1”) as the analysis result.

The database 700 stores an iris pattern ("
The pseudo fingerprint pattern (bit string of “0” or “1”) is managed in association with the bit string of “0” or “1”.
Here, the pseudo fingerprint pattern is a fingerprint pattern (“0”).
Or a pattern having the same format as the “1” bit string).

The database access unit 710 outputs the iris pattern (bit string of “0” or “1”) output from the iris pattern analysis unit 680 as an analysis result and the iris pattern (“0”) stored in the database 700.
(Or a bit string of “1”). Only when they match, the database access unit 710 reads the pseudo fingerprint pattern corresponding to the iris pattern from the database 700, and
20.

The encryption unit 520 encrypts the pseudo fingerprint pattern and outputs the encrypted pseudo fingerprint pattern to the network connection unit 460.

Network connection means 460 transmits the encrypted pseudo fingerprint pattern to terminal device 420 via network 300.

The encryption / decryption means 44 of the terminal device 420
0 generates a pseudo fingerprint pattern by decrypting the encrypted pseudo fingerprint pattern. The generated pseudo fingerprint pattern is transmitted to the information processing system 750 of the connection destination.

As described above, the personal authentication information output device 600
Is the first type of personal authentication information entered (eg,
A function of converting an iris pattern) into a second type of personal authentication information (for example, a pseudo fingerprint pattern) different from the first type, and outputting the second type of personal authentication information to a connected information processing system. Have. Thereby, the second
It is possible to provide a user interface that employs a personal authentication method based on the first type of personal authentication information for an information processing system that employs a personal authentication method based on the personal authentication information of the first type. As a result, the user can select a personal authentication method that is convenient for the user. For example, a physically handicapped person who cannot use a fingerprint due to a missing finger is required to input an iris pattern, and the iris pattern is converted into a pseudo fingerprint pattern (a pseudo same pattern as a fingerprint), thereby obtaining a fingerprint based on the fingerprint pattern. It becomes possible to use an information processing system employing a personal authentication method.

Also, since the personal authentication information output device 600 converts the personal authentication information, there is no need for one terminal device to implement a plurality of personal authentication methods, and there is no need for the user to have a plurality of terminal devices. It is not necessary to change the configuration of the information processing system 750.

The first type of personal authentication information and the second type of personal authentication information can be any type of personal authentication information capable of authenticating an individual. For example, the first type of personal authentication information and the second type of personal authentication information described above are respectively
It may be biometric information (code sequence), pseudo biometric information (code sequence), or password (symbol code sequence). Biometric information includes fingerprints, faces, retina,
The information may be information representing at least one of an iris, a palm shape, a voice, and a handwriting.

In the terminal device 420, instead of the iris pattern input means 430, a biological information input for inputting biological information other than the iris pattern (for example, biological information representing a fingerprint, face, retina, palm shape, voice, handwriting, etc.). Means may be provided, and in the personal authentication information output device 600, instead of the iris pattern analyzing means 680, an analyzing means corresponding to the biological information input means may be provided.

Instead of the pseudo fingerprint pattern, pseudo biological information other than the pseudo fingerprint pattern (for example, face, retina, iris,
Pseudo biological information representing palm shape, voice, handwriting, etc.) may be stored in the database 700. A password or biometric information may be stored in the database 700 instead of the pseudo biometric information.

Further, by associating a plurality of biometric information (or pseudo biometric information) with one user in the database 700, the personal authentication information can be adapted to various information processing systems with one biometric feature. Output device 6
00 may be configured.

In the present embodiment, terminal device 420
The iris pattern transmitted from the personal authentication information output device 600 to the personal authentication information output device 600 is encrypted.
An example has been described in which the pseudo fingerprint pattern transmitted from to the connected information processing system is encrypted. However, these pieces of information need not necessarily be encrypted. If such information is transmitted without encryption, no encryption means or decryption means is required.

Further, at least one of the information held in the database 700, the information input to the database 700, and the information output from the database 700 may be encrypted.

In the present embodiment, the database 7
00, no pseudo fingerprint pattern is defined in association with the connection destination and the contents of the service.
In the same manner as described in the second embodiment, the pseudo fingerprint pattern may be defined in association with the connection destination and the contents of the service.

FIG. 7 shows another configuration example of the personal authentication information output device 600.

In FIG. 7, the same components as those shown in FIG. 6 are denoted by the same reference numerals, and detailed description thereof will be omitted.

The iris pattern analysis means 800 receives the iris pattern from the decoding means 470 and analyzes the iris pattern to obtain information indicating candidate users and information indicating certainty indicating the certainty of each user. Is output to the biological information processing means 810 as an iris pattern analysis result. For example, the degree of certainty that the user is the user A is 0.9,
The degree of certainty that the user is the user B is 0, and the user is the user C
Is 0.1, the iris pattern analysis unit 800 sets the information indicating the user candidate (user A, user C) and the certainty (0.9, 0.1). Is output to the biological information processing means 810.

The biometric information processing means 810 processes the pseudo biometric information output from the database access means 710 using the information indicating the degree of certainty output from the iris pattern analysis means 800. For example, the biological information processing means 81
No. 0 generates a new pseudo fingerprint pattern by combining a pattern corresponding to 90% of the pseudo fingerprint pattern of the user A and a pattern corresponding to 10% of the pseudo fingerprint pattern of the user C. The pseudo biological information processed by the biological information processing means 810 in this way is output to the encryption means 520.

Unlike the password, the biometric information changes every time the biometric information is acquired. For example, each time a fingerprint pattern is acquired by the sensor, the fingerprint pattern changes. As described with reference to FIG. 7, by processing the pseudo fingerprint pattern according to the analysis result of the biometric information, it is possible to simulate a change in the fingerprint pattern. As a result, a more natural fingerprint pattern can be input to the information processing system.

FIG. 8 shows another example of the configuration of the personal authentication information output device 600.

The personal authentication information output device 600 is configured so that an IC card 830 can be inserted. IC card 83
In 0, an iris pattern (bit string of “0” or “1”) and a fingerprint pattern (bit string of “0” or “1”)
Are stored in pairs. When the IC card 830 is inserted into the personal authentication information output device 600, the IC card data access unit 820 makes the iris pattern analysis unit 6
Iris pattern ("") which is output from 80 as an analysis result
It is determined whether the iris pattern (bit string of “0” or “1”) stored in the IC card 830 matches the iris pattern (bit string of “0” or “1”). The card data access means 820
The fingerprint pattern corresponding to the iris pattern is stored in the IC card 83
0 and output to the encryption means 520.

As described above, by configuring the database with a removable medium such as an IC card or a memory,
It is possible to configure a personal authentication information output device that can be used by many users.

[0130]

According to the present invention, personal authentication information (for example, a password) corresponding to at least the information processing system selected by the user as the connection destination is output. Thus, the user does not need to be conscious of whether different personal authentication information (for example, a password) is set according to the information processing system of the connection destination. Even when the number of information processing systems to be connected increases, the user need only input the same input to the input means. As a result, even if the number of information processing systems to be connected to increases, the user can unify the personal authentication information (for example, password) without making the user aware that the type of personal authentication information (for example, password) has increased. Management can be performed.

Further, according to the present invention, personal authentication can be performed on the personal authentication information output device side without depending on the personal authentication method of the information processing system of the connection destination. As a result, even when the information processing system at the connection destination continues to use the conventional personal authentication method (for example, a personal authentication method based on a password), highly reliable personal authentication can be performed without altering the information processing system at the connection destination. It becomes possible to introduce a method.

Further, according to the present invention, both the first type of input (eg, fingerprint pattern) from the user and the second type of input (eg, iris pattern) from the user can be handled. Individual authentication means is provided. Thereby, the personal authentication method based on the first type of input and the second
Of the personal authentication method based on the input of this type. As described above, by supporting a plurality of personal authentication methods, the user can select a personal authentication method that is convenient for the user.

Further, according to the present invention, the first input
Is converted into a second type of personal authentication information (for example, a pseudo fingerprint pattern) different from the first type, and the second type of personal authentication information is Is output to the information processing system. This makes it possible to provide a user interface that employs a personal authentication method based on the first type of personal authentication information for an information processing system that employs a personal authentication method based on the second type of personal authentication information. become.
As a result, the user can select a personal authentication method that is convenient for the user.

[Brief description of the drawings]

FIG. 1 is a diagram showing an example of a configuration of a personal authentication information output device 290 according to Embodiment 1 of the present invention.

FIG. 2 is a diagram showing an example of a configuration of a personal authentication information output device 400 according to a second embodiment of the present invention.

FIG. 3 is a diagram showing another configuration example of the terminal device 420.

FIG. 4 is a diagram showing another configuration example of the terminal device 420.

FIG. 5 is a diagram showing another configuration example of the terminal device 420.

FIG. 6 is a diagram showing an example of a configuration of a personal authentication information output device 600 according to Embodiment 3 of the present invention.

FIG. 7 is a diagram showing another configuration example of the personal authentication information output device 600.

FIG. 8 is a diagram showing another configuration example of the personal authentication information output device 600.

[Explanation of symbols]

 210 Biometric information input means 220 Personal authentication means 230 Connection destination and service specifying means 240 Database 250 Database access means 290 Personal authentication information output device

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 9/00 673E 673D (72) Inventor Shin Yamada 1006 Kazuma Kadoma, Kadoma City, Osaka Matsushita Electric Industrial Co., Ltd. F term (reference) 5B085 AA08 AE03 AE25 AE26 AE27 5J104 AA07 EA03 KA01 KA16 KA17 KA18 KA19 NA05 NA36 NA38

Claims (12)

[Claims] 1. A personal authentication information output device connectable to a plurality of information processing systems via a network, comprising: input means for receiving an input from a user; Personal authentication means for outputting a personal authentication result of the user; identifying means for at least specifying an information processing system selected by the user among the plurality of information processing systems; and a personal authentication result by the personal authentication means. And a database that manages personal authentication information in association with the identification result by the identification unit, based on the personal authentication result by the personal identification unit and the identification result by the identification unit, Reading the personal authentication information from the database, and reading the read personal authentication information through the network. Personal authentication information output apparatus that includes a database access means for outputting to the processing system. 2. The individual according to claim 1, wherein the specifying unit further specifies a service selected by the user among a plurality of services provided by the information processing system selected by the user. Authentication information output device. 3. The personal authentication information output device according to claim 1, wherein the personal authentication information is one of a password, biometric information, and pseudo biometric information. 4. An input from the user is at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting.
2. The personal authentication information output device according to claim 1, wherein the personal authentication information output device is biometric information representing one of the following. 5. A personal authentication information output device connectable to a plurality of terminal devices and a plurality of information processing systems via a network, wherein the plurality of terminal devices are of a first type from a user. A first terminal device having first input means for receiving the input of
A second terminal device having second input means for receiving a second type of input different from the first type from the user; and a second type of input from the user and the second type of input. A second type of input is provided to the personal authentication information output device via the network, respectively, wherein the personal authentication information output device includes the first type of input from the user and the second type of input. A personal authentication unit that outputs a personal authentication result of the user based on one of the type inputs; and a specifying unit that specifies at least an information processing system selected by the user among the plurality of information processing systems. A database for managing personal authentication information in association with a personal authentication result by the personal authentication unit and a specification result by the specifying unit; Based on the authentication result and the identification result by the identification unit, read out personal authentication information associated therewith from the database, and read the read out personal authentication information via the network to the selected information processing system. Personal authentication information output device, comprising: a database access unit for outputting to a personal authentication information. 6. The individual according to claim 5, wherein the specifying unit further specifies a service selected by the user among a plurality of services provided by the information processing system selected by the user. Authentication information output device. 7. The personal authentication information output device according to claim 5, wherein the personal authentication information is one of a password, biometric information, and pseudo biometric information. 8. The input from the user includes at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting.
6. The personal authentication information output device according to claim 5, wherein the personal authentication information output device is biometric information representing one of the following. 9. A personal authentication information output device connectable to a plurality of terminal devices and a plurality of information processing systems via a network, wherein the plurality of terminal devices are of a first type of personal authentication. A first terminal device having first input means for receiving information from a user, wherein the first type of personal authentication information is provided to the personal authentication information output device via the network; The information output device is configured to associate the first type of personal authentication information with the first type of personal authentication information.
A database for managing a second type of personal authentication information different from the first type of personal authentication information, and reading the second type of personal authentication information associated therewith based on the first type of personal authentication information from the database Database access means for outputting the read second type of personal authentication information to an information processing system selected from the plurality of information processing systems via the network. apparatus. 10. The personal authentication information according to claim 9, wherein the first type of personal authentication information and the second type of personal authentication information are each one of a password, biometric information, and pseudo biometric information. Output device. 11. The personal authentication information output device according to claim 10, wherein the biological information represents at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting. 12. The personal authentication information output device according to claim 9, wherein the database is a medium detachable from the personal authentication information output device.