JP2002207704A - System for authenticating individual - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system wherein precision of an individual authentication system using bio-metric information is informed objectively. SOLUTION: A collation part 2 collates the bio-metric information of a collated individual with bio-metric information for authentication preliminarily registered in a bio-metric information storage part 3 for authentication, and conducts individual authentication as to the possibility of the registered individual. A precision determining part 4 collates the bio-metric information of the collated individual respectively with specified number of the bio-metric informations for authentication out of the bio-metric informations for the authentication in the information storage part 3 and finds an another person erroneous recognition rate which is a ratio of the bio-metric informations for the authentication of the plural individuals consistent with the bio-metric information of the collated individual, and a processing result returning part 5 notifys it to a supervising system 200.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a biometric information authentication system for performing personal authentication using biometrics (biological characteristics), and more particularly to a method for determining the accuracy of the system.

[0002]

2. Description of the Related Art Conventionally, the false recognition rate (probability of recognizing a person as another person) in biometrics has been used as a measure for measuring the performance of an apparatus or system. In addition, there are two methods, namely, 1: 1 verification (Verification) and 1: N verification (Identification).

[0003] However, the false recognition rate information generally varies depending on the method of the biometric technology and the measurement environment, and is used as a standard of the technology. In 1: 1 matching, which has been conventionally used as a matching method based on biometrics, it is general that if the matching result is successful, the individual is treated as a person, and the false recognition rate information of the biometric technology is used during system operation. It was not used.

[0004]

However, the biometrics collation including the 1: 1 collation has the following problems. That is, even if the 1: 1 verification is successful, the probability of impersonating another person cannot be reduced to zero. For example, when there is a plurality of successfully matched biometrics data in the database of the system, a plurality of users who can generate the biometrics matching data use the same ID number or the same user name. This is because the system can be used by performing the 1: 1 collation. In a conventional 1: 1 collation system, it is general to permit the use of the system if the collation succeeds. Regardless of the high or low false positive rate, the right granted to the user after successful collation is the same. The risk of impersonation was not taken into account.

[0005]

The present invention employs the following structure to solve the above-mentioned problems. <Structure 1> A collating unit that collates biometric information of an individual to be verified with biometric information for authentication registered in advance to perform individual authentication as to whether or not the individual is a registered individual. The biometrics information is compared with a specific number of biometrics information for authentication among the biometrics information for authentication, and is the ratio of the biometrics information for authentication of a plurality of individuals that match the biometrics information of the checked individual. An individual authentication system, comprising: an authentication accuracy determination unit that obtains authentication accuracy of a matching unit based on a false recognition rate.

<Structure 2> In the individual authentication system according to Structure 1, based on a plurality of different types of biometric information, a collating unit for performing authentication using requested biometrics, An individual authentication system, comprising: an authentication accuracy determination unit that obtains a false recognition rate.

<Structure 3> In the individual authentication system including the sender device, the receiver device, and the certificate authority, the sender device transmits the encrypted document to the receiver device. A biometrics encryption unit that encrypts the sender's own biometrics information and attaches it to the encrypted document, and the receiver device receives the encrypted document,
A biometrics authentication request unit is provided for requesting authentication of the attached encrypted biometrics information to the certificate authority.If the biometrics information is given, the certificate authority checks the biometrics information for authentication registered in advance. In addition to providing an authentication server that performs identity verification and receives an authentication request for encrypted biometrics information, decrypts the biometrics information, performs biometrics identity authentication using the authentication server, and uses the authentication result. Is transmitted to the receiver-side device that has made the authentication request.

<Structure 4> In the individual authentication system according to Structure 3, the authentication server collates the requested biometric information with a specific number of biometric information for authentication among the biometric information for authentication. An authentication accuracy determining unit that determines the authentication accuracy of the authentication process based on the false recognition rate, which is a ratio of the biometric information for authentication of a plurality of individuals that match the biometric information requested for authentication. An individual authentication system configured to transmit the authentication accuracy determined by the determination unit to a receiver-side device that has made an authentication request.

[0009]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below in detail with reference to specific examples. In the following specific examples 1 and 2, a case of a human being will be described as an example of an individual. However, the present invention is directed to an authentication system using biometric information. Etc.) can be similarly applied.

<< Specific Example 1 >><Configuration> FIG. 1 is a configuration diagram showing a specific example of the apparatus of the present invention. The illustrated individual authentication system 100 includes a personal computer or the like, and includes a processing request receiving unit 1, a collating unit 2, an authentication biometric information storage unit 3, an accuracy determining unit 4, and a processing result returning unit 5. The processing request receiving unit 1 is a functional unit that receives a processing request from the host system 200.
The collating unit 2 extracts the corresponding biometric information for authentication from the biometric information storage unit for authentication 3 based on the identification information of the individual to be collated included in the processing request received by the processing request accepting unit 1 and processes the biometrics of the individual to be collated. It has a function to check whether it matches the metrics information.
It has a 1 collating unit 2a and a 1: N collating unit 2b. still,
In the matching unit 2, the 1: N matching unit 2b is not a particularly essential component.

The biometrics information storage unit for authentication 3
It is composed of a non-volatile memory such as a hard disk device,
It is a database that stores biometric information for authentication of a plurality of individuals. The accuracy determining unit 4 is a functional unit that determines the accuracy of the matching unit 2, and compares the biometric information of the individual to be verified with a specific number of biometric information for authentication among the biometric information for authentication. The authentication accuracy of the matching unit 2 is obtained based on the false recognition rate, which is the ratio of the biometric information for authentication of a plurality of individuals that match the biometric information of the matching individual, and this is returned to the processing result returning unit 5
Has the function of sending to The processing result returning unit 5 is a functional unit that returns the judgment result of the accuracy judging unit 4 to the host system 200 together with the matching result of the matching unit 2 requested by the host system 200. Also, upper system 2
Reference numeral 00 denotes an apparatus that performs various services based on the processing results of the individual authentication system 100.

The above processing request receiving unit 1, collating unit 2,
The functions of the accuracy determination unit 4 and the processing result return unit 5 are realized by software corresponding to each process and hardware such as a processor and a memory for executing the software.

<Operation> The operation of the first embodiment will be described below. It is assumed that a collation request is sent from the upper system 200 to the individual authentication system 100. The types of general information included in this collation request are as follows.・ ID information for identifying the verification target person ・ Biometric verification data of the verification target person

In the individual authentication system 100, when such a collation request is received by the processing request receiving unit 1, the collating unit 2 performs 1: 1 collation. That is, the collation unit 2 determines that the transmitted I
Based on the D information, the corresponding biometric information is extracted from the biometric information storage unit for authentication 3, and the biometric information for authentication is compared with the biometric information of the person to be verified obtained by a known means, and the identity is verified. Do. Then, the matching unit 2 passes the matching result to the processing result returning unit 5, and the processing result returning unit 5 returns the matching result to the host system 200 as the matching result.

In addition, when the above-mentioned collation is performed,
In this specific example, the accuracy determination unit 4 determines the matching accuracy. The determination operation will be described below. Accuracy judgment unit 4
First, a predetermined number (assumed to be N) of authentication biometric information is extracted from the authentication biometric information storage unit 3 based on a certain rule. The certain rule is, for example, a rule for randomly extracting N persons, and is preferably an extraction rule that is not affected by registration conditions and the like as much as possible.

Then, the biometrics information for authentication of the N persons is collated with the biometrics information of the person to be collated on a one-to-one basis, and the number of matches / mismatches at that time is counted. Here, in the case where a plurality of matching identities appear, on the premise that the plurality of registrants are different persons, it means that misrecognition of another person has occurred with a registrant who should not originally match.

In the case of a system in which false recognition is frequently performed, many biometrics are included in the biometric information for authentication. When the false recognition rate is high, 1:
Even if one person can be identified by one collation, there is a high possibility that another person is impersonating using the identification ID information of the person to be collated. On the other hand, if the system is unlikely to cause misidentification, the number of accidentally matching others in the biometric information for authentication is extremely small, and the possibility of impersonation of others is expected to be very small. be able to.

As described above, the accuracy judging unit 4 calculates the false recognition rate of the individual authentication system 100 based on the number of false recognitions among the N persons. The accuracy of the false recognition rate itself can be statistically calculated from the number of extracted data and the like. The number of extracted data depends on the accuracy required by the system. Further, in calculating the false recognition rate, various methods such as a calculation using a binomial distribution curve using a Hamming distance or the like can be used.

The above-described accuracy determination processing is based on the premise that the data in the authentication biometric information storage unit 3 does not have multiple registrations of the user himself or very few. If this premise is not satisfied, correction at the time of calculating the false recognition rate is performed based on the expected multiple registration rate calculated separately. That is, if the multiple registration rate is high, a value lower than the calculated false recognition rate is calculated. , Or the like.

By using the false recognition rate information, the host system 200 not only has the collation result information, but also
It is possible to determine a service for the collated person using the false recognition rate data. The amount and quality of the service can be changed based on the value of the false recognition rate data. For example, the following service settings are possible.

-Change of authority given to the user (if a high-precision biometric method is adopted, higher authority is given, etc.)-Change of the range of information to be provided (high-precision biometric method is adopted) If so, provide more sensitive information, etc.)

Note that the judgment processing in the accuracy judgment section 4 is performed every time the collation is performed as described above. This has the effect that the accuracy at the time of matching can be determined accurately, but the following method may be used in addition to this.

When the system user registers the biometric information, the system also generates biometrics collation data together with the extracted biometrics registration data in the same manner as in the case of the above-described determination at the time of the collation. The false recognition rate is calculated by performing a plurality of 1: 1 matchings. In this manner, the load on the accuracy determination unit 4 is reduced as compared with the method of performing the determination each time the collation is performed, and the size of the individual authentication system 100 can be reduced.

Further, a plurality of 1: 1 verifications are performed based on sample data obtained in advance, not at the time of operation such as individual registration and verification as described above, and the false recognition rate is calculated. That is, sample data of a certain number of persons is prepared, and the accuracy of the individual authentication system 100 is measured based on the sample data. In this case, the individual authentication system 100 does not need to perform the accuracy determination, and the size of the individual authentication system 100 can be small.

<Effects> As described above, according to the first embodiment,
By performing 1: 1 matching between a plurality of data extracted from authentication biometrics information according to a certain rule and matching data, the false recognition rate information in the individual authentication system 100 is generated. It can be handled as an index relating to the risk of impersonation by another person when personal authentication is performed by 1: 1 verification. That is, an authentication system using any type of biometrics such as an iris and a fingerprint can obtain the objective accuracy of the type. Therefore, when there are authentication systems of different biometrics systems, the authentication accuracy of each of these systems can be obtained.

As a result, it becomes possible for the operator of the individual authentication system 100 based on biometrics to change the quality and quantity of service to the user. As a result, it becomes possible for the system operator to reduce the damage of impersonation.

<< Specific Example 2 >> In the specific example 2, in an individual authentication system using a plurality of types of biometric information, the accuracy of the authenticated method is determined.

<Structure> FIG. 2 is a diagram showing the structure of the second embodiment. The illustrated individual authentication system 100a includes a personal computer or the like, and includes a processing request receiving unit 1, a processing result returning unit 5, a collating unit 6, an authentication biometric information storage unit 7, and an accuracy determining unit 8. Here, the processing request receiving unit 1
The basic configuration of the processing result returning unit 5 is the same as that of the first embodiment, and the description thereof is omitted.

The collating unit 6 includes a plurality of collating units 6-1 and 6-
2,..., 6-n, each of which is a functional unit that performs different types of biometrics collation using the authentication biometric information storage units 7-1, 7-2,. Here, each method is a method of performing matching based on, for example, information about a fingerprint, biometric information such as a voiceprint, a facial feature, or an iris. still,
These matching units 6-1, 6-2,..., 6-n
Has a 1: 1 collating unit and a 1: N collating unit as in
Its illustration is omitted. Note that also in the specific example 2, the 1: N collation unit is not particularly essential.

The authentication biometric information storage unit 7
These are databases storing authentication biometrics information of different types such as fingerprints, voiceprints, facial features, or irises, and the respective biometrics information is stored in authentication biometrics information storage units 7-1, 7-2,.
7-n.

As in the first embodiment, the accuracy determining unit 8 includes authentication biometric information storage units 7-1, 7-2,.
This is a functional unit that performs 1: 1 collation using information of −n to determine the accuracy of each method.

The collating unit 6 and the accuracy judging unit 8
Also, the function is realized by software corresponding to each process and hardware such as a processor and a memory for executing the software.

<Operation> The operation of the embodiment 2 will be described below. Note that the basic collation operation and the accuracy determination operation are the same as those in the first embodiment, and therefore, the description will focus on the differences from the first embodiment.

It is assumed that a collation request is sent from the host system 200 to the individual authentication system 100a. The types of general information included in this collation request are as follows.・ ID information for identifying the verification target person ・ Biometrics verification data of the verification target person ・ ID for identifying the biometric technology used

In the individual authentication system 100a, when such a collation request is received by the processing request receiving unit 1, the collating unit 2 performs 1: 1 collation. Here, the matching unit 6-i (i = 1 to 1) corresponding to the received biometrics technology identification ID.
n) is selected. Then, the selected collating unit 6-i uses the authentication biometric information storage unit 7-i that matches its own biometric system, and uses the authentication biometric information storage unit 7-i.
The collating operation is performed in the same manner as. In addition, when the above-described collation is performed, also in this specific example, the accuracy determination unit 8 determines the collation accuracy of the biometric method, and passes the determination result to the processing result return unit 5.

<Effects> As described above, according to the specific example 2, in the individual authentication system in which a plurality of biometric methods are arranged in parallel, the matching accuracy of each biometric method is determined. Even a biometrics authentication system that handles biometrics technology in parallel can determine the respective authentication accuracy.

As a result, on the host system 200 side,
For example, it is possible to change the quality and quantity of the service for the user depending on the difference in the biometrics method. For example, it is possible to change the quality and quantity of service for a user when using a biometric technology with a high false recognition rate and when using a biometric technology with a low false recognition rate.

<< Example 3 >> Example 3 is an example in which a biometrics technology is applied in a certificate authority.

<Structure> FIG. 3 is a diagram showing the structure of the third embodiment. The illustrated system includes a sender device 10, a receiver device 20, and a certificate authority (CA) 30. Sender device 10
Is a device used by the user A, encrypts the document data 41 by using the secret key 42 of the user A, transmits the encrypted document data 43 to the receiver device 20, and Of the biometrics data 44 of the certificate authority 3
And the document encrypted data 4 as bio-encrypted data (encrypted biometrics information)
3 is provided with a biometrics encryption unit 11 to be attached to 3.

The receiver device 20 is a device used by the user B. The receiver device 20 decrypts the document encrypted data 43 sent from the sender device 10 using the public key 47 of the user A, and performs document encryption. The biometrics authentication request unit 21 is provided for requesting the certification authority 30 to authenticate the bio-encrypted data 46 attached to the encrypted data 43. 48 is the identification ID of the user A, and 49 is the decrypted document data.

The certificate authority 30 manages the public key 47 of the user A and the public key 50 of the user B, and authenticates the user using the personal identification ID information and the biometric data of the user. The institution is provided with a biometrics authentication server 31. The biometrics authentication server 31 has the same configuration as the individual authentication system 100 in the first embodiment and the individual authentication system 100a in the second embodiment, and includes biometric information for authentication of each user registered in advance, and When the user's biometrics information is given, it has a function of performing 1: 1 matching with authentication biometrics information to confirm the identity of the user.

The biometrics authentication server 31
Performs 1: 1 comparison between the requested biometric information and a specific number of biometric information for authentication among the pre-registered biometric information for each user, and as a result, And an authentication accuracy determination unit 31a for obtaining the authentication accuracy of the authentication process based on the false recognition rate, which is the ratio of the biometric information for authentication of a plurality of individuals matching the biometric information.

Reference numeral 51 denotes a secret key of the certificate authority 30, and reference numeral 52 denotes user information of each user.

<Operation> The operation of the third embodiment will be described below. First, the sender device 10 converts the document data 41 into document encrypted data 43 using the secret key 42 of the user A. It is assumed that the secret key 42 has been received from the certificate authority 30 in advance. Normally, this document encrypted data 43
Is transmitted to the recipient-side device 20 and decrypted by the recipient-side device 20 using the public key 47 of the user A, thereby ensuring that the document data 41 is transmitted from the user A. Such identity verification is effective only on the premise that the private key is owned by the principal, and further ensures that the person using the private key is the user A himself / herself. Therefore, in this specific example, biometrics is used.

That is, in this specific example, the biometrics data 44 of the user A is prepared in the sender's device 10, and the biometrics data is encrypted by the biometrics encryption unit 11 using, for example, the public key 45 of the certificate authority 30. The bio-encrypted data 46 of the user A created in this way is sent to the user B together with the document encrypted data 43 (indicated by in the figure).

In the receiver device 20 (user B), the user A encrypted with the encrypted data 43 and 46 is encrypted.
Receiving the identification ID information 48. As a result, the biometrics authentication request unit 21 of the receiver-side device 20 requests the authentication authority 30 to perform an authentication request for identification (shown in the figure)
Send That is, this authentication request includes the encrypted identification ID 48 of the user A and the encrypted biometric data 46.

Upon receiving the authentication request from the receiver device 20, the certificate authority 30 decrypts the identification ID 48 of the user A and the bio-encrypted data 46 by using the secret key 51 of the certificate authority 30. The user information 52 is sent to the biometrics authentication server 31. Upon receiving the user information 52, the biometrics authentication server 31 performs identity verification by performing 1: 1 verification using authentication biometrics information registered in advance in the biometrics authentication server 31. The certification authority 30 sends the collation result to the receiver device 20 (indicated by in the figure). In this way, the receiver-side device 20 can confirm whether the person who sent the document is the person himself or herself using the biometric information. Then, the receiver-side device 20 decrypts the document encrypted data 43 using the public key 47 of the user A, and obtains document data 49 (indicated by in the figure).

However, as described in the specific example 1, there is a variation in the accuracy of the biometrics collation, and the fact that the 1: 1 collation is successful means that the identity of the individual is 100% confirmed. Not be. In such a case, the authentication accuracy determination unit 31a measures the false recognition rate in the same manner as in the first and second examples, and the biometrics authentication server 31 outputs the false recognition rate to the authentication station 30 including the false recognition rate. As a result, the certificate authority 30 also sends the information on the false recognition rate to the recipient device 20.

The PKI (Public Key I) including the certificate authority 30
nfrastructure) provides various services to users based on personal authentication. Therefore, such false positive rate information can be provided to the user as one of the services. For example, in the exchange of money on the Internet such as electronic commerce, the following various services can be provided for each customer based on the false positive rate information of the biometric method used by the user.

-Change of transaction limit (if the high-precision biometric method is used, raise the transaction limit, etc.)-Change of the product to be handled for each customer (using the high-precision biometric method) If there is, prioritize the allocation of limited quantity products, etc.)-Change the range of information provided (if a highly accurate biometrics method is used, provide more sensitive information, etc.)

<Effects> According to the specific example 3 as described above,
In the certification authority 30, the personal authentication is performed using the biometric information, and the false recognition rate based on the biometric information is measured and notified together with the authentication result. You can know the accuracy of the authentication.

As a result, for example, PKI using a certificate authority
In an environment where biometrics technology is combined with the environment, it is possible to judge the misperception rate of other persons as the degree of risk of impersonation of the person and change the service given to the individual. This can be expected to reduce the risk of providing services to unauthorized users on the service provider side, and provide services with higher value than before to users with low risk of impersonation. Therefore, the convenience for the service user can be improved.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a specific example 1 of an individual authentication system of the present invention.

FIG. 2 is a configuration diagram of a specific example 2 of the individual authentication system of the present invention.

FIG. 3 is a configuration diagram of a specific example 3 of the individual authentication system of the present invention.

[Explanation of symbols]

 2, 6 collating unit 3, 7 authentication biometric information storage unit 4, 8 accuracy determination unit 10 sender side device 11 biometrics encryption unit 20 receiver side device 21 biometrics authentication request unit 30 certificate authority 31 biometrics authentication Server 31a Authentication accuracy determination unit

Claims (4)

[Claims] 1. Biometric information of an individual to be verified,
A matching unit that performs individual authentication as to whether or not the individual is a registered individual by comparing the biometrics information for authentication registered in advance, biometrics information of the individual to be verified, and biometrics information for authentication. The specific number of biometric information for authentication is compared with each other, and the matching unit of the matching unit is based on the false recognition rate which is a ratio of the biometric information for authentication of a plurality of individuals that match the biometric information of the individual to be verified. An individual authentication system comprising: an authentication accuracy determination unit for obtaining authentication accuracy. 2. The individual authentication system according to claim 1, wherein a plurality of different types of biometric information are used,
An individual authentication system, comprising: a verification unit that performs authentication based on requested biometrics; and an authentication accuracy determination unit that obtains a false recognition rate of the authenticated system. 3. An individual authentication system including a sender device, a receiver device, and a certificate authority, wherein the sender device transmits an encrypted document to the receiver device. Further comprising a biometrics encryption unit for encrypting the sender's own biometrics information and attaching it to the encrypted document, wherein the receiver-side device, when receiving the encrypted document, the attached encryption A biometrics authentication requesting unit for making a request for authentication of biometrics information to the certificate authority, wherein, when the biometrics information is given, the certificate authority checks the identity by comparing it with biometrics information for authentication registered in advance. When an authentication server for performing the authentication is provided, and when an authentication request for the encrypted biometric information is received, the biometric information is decrypted and the biometric information is decrypted. An individual authentication system configured to perform personal authentication of Trix using the authentication server, and to transmit the authentication result to the receiver-side device that has issued the authentication request. 4. The individual authentication system according to claim 3, wherein the authentication server collates the requested biometrics information with a specific number of biometrics information for authentication among the biometrics information for authentication, An authentication accuracy determination unit that determines the authentication accuracy of the authentication process based on the false recognition rate, which is the ratio of the biometric information for authentication of a plurality of individuals that match the biometric information requested for authentication, An individual authentication system configured to transmit the authentication accuracy determined by an accuracy determination unit to a receiver-side device that has issued the authentication request.