JP2002366526A - System, method for authenticating biometrics, and program to make computer execute the method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To intensify security by means of biometrics authentication without changing functions of an application and a network authentication server. SOLUTION: This biometrics authentication system is provided with fingerprint information databases 9A, 9B, 9C in which pieces of authentication information are preliminarily made correspond to pieces of fingerprint information, fingerprint acquiring devices 4A, 4B, 4C to acquire the fingerprint information of users, a network authentication server 6 to authenticate users of applications 2A, 2B, 2C based on the authentication information of the users and authentication proxy servers 3A, 3B, 3C to receive the authentication information from the applications 2A, 2B, 2C, to collate the acquired fingerprint information with the fingerprint information corresponding to the received authentication information and to transmit a collation result to the network authentication server 6.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a biometric authentication system for performing user authentication using biometric information on a network, a biometric authentication method, and a program for causing a computer to execute the method.

[0002]

2. Description of the Related Art As a network authentication system for authenticating a user who accesses a server from a network, a biometric for performing authentication based on physical characteristics such as a fingerprint, a palm print, and a voice print in order to enhance security. In recent years, an authentication function has been added. As a conventional network authentication system using such a biometrics authentication function, for example, a password input device disclosed in JP-A-11-53317 and a password input system disclosed in JP-A-2000-322145 are disclosed. And its method.

[0003] The password input device described in Japanese Patent Application Laid-Open No. 11-53317 changes the authentication processing unit of the application to be compatible with biometrics authentication without changing the authentication program of the network authentication server. It converts biometric information such as a fingerprint into a password and sends it to the network authentication server. The password input method described in Japanese Patent Application Laid-Open No. 2000-322145 monitors the user ID / password input screen of the application and displays the user ID / password input screen so that the application program does not need to be changed. In this case, the user is authenticated by biometrics, and if the authentication result is normal, an appropriate value is automatically input to the monitored user ID / password input screen.

[0004]

However, such a conventional biometric authentication system has the following problems. The password input device described in JP-A-11-53317 is excellent in that the processing program of the network authentication server is not changed and the conventional network authentication server can be used as it is. Since the metrics authentication function must be added,
There is a problem that the program needs to be modified.

[0005] In addition, since the network authentication system usually performs processing for coping with user authentication of various applications, the network authentication system must cope with a biometric authentication function for each application. Also, there is a problem that the development cost increases.

On the other hand, the password input method described in Japanese Patent Application Laid-Open No. 2000-322145 is excellent in that the application does not need to be modified, but the user ID / password input screen must be constantly monitored. -The interface of the password input screen must be compatible with each application.

[0007] Further, user ID and password data that are automatically input when the biometric authentication result is normal are not encrypted and flow as they are to the network. There is a risk of being intercepted and there is a problem that it is vulnerable in security.

[0008] The present invention has been made in view of the above,
Obtaining a biometrics authentication system, a biometrics authentication method, and a program for causing a computer to execute the method without changing the functions of an application and a network authentication server, and for enhancing security by adding biometrics authentication With the goal.

[0009]

In order to achieve the above object, a biometrics authentication system according to the present invention is connected to an application terminal that executes an application, and obtains a biometrics acquisition device that acquires biometrics information of a user. A biometrics authentication system that is connected to the application terminal via a network and performs biometrics authentication by a network authentication server that performs authentication of a user who executes an application based on user authentication information; Storage means for storing a biometric information database in which information and biometric information are associated with each other, and receiving authentication information from an application in place of a network authentication server; An authentication proxy server that checks the biometrics information obtained from the storage device and the biometrics information corresponding to the received authentication information, and transmits a check result to the network authentication server and / or the application. And

According to the present invention, by providing an authentication proxy server in an application terminal, an authentication proxy server is interposed between the application terminal and the network authentication server, and the authentication proxy server authenticates the application instead of the network authentication server. Since the information is received, the biometrics information acquired from the biometrics acquisition device is compared with the biometrics information corresponding to the received authentication information, the biometrics authentication is performed, and the verification result is transmitted to the network authentication server. User authentication using an existing password can be performed using biometric information, and high security can be ensured. Further, according to the present invention, since biometrics authentication is performed by the authentication proxy server interposed between the application terminal and the network authentication server, both programs of the client-side application and the server-side network authentication server can be used. No modification is required for the introduction of biometric authentication, and the introduction cost can be reduced. Further, since the same protocol as that of the conventional application and the network authentication server is also used for the authentication proxy server, the same level of security as before can be maintained on the network.

[0011] A biometrics authentication system according to the next invention is connected to an application terminal that executes an application and obtains biometrics information of a user. A biometrics acquisition device is connected to the application terminal via a network to authenticate a user. In a biometrics authentication system that performs biometrics authentication by a network authentication server that performs authentication of a user who executes an application based on information,
Provided in the application terminal, receiving authentication information from an application instead of a network authentication server, transmitting the biometric information acquired by the biometric acquisition device and the received authentication information to the biometric authentication server, the biometric authentication server And a storage means for storing a biometrics information database in which authentication information and biometrics information are previously associated with each other, and wherein the authentication proxy server transmits authentication results to the network authentication server and / or the application. The biometric information receiving the biometric information and the authentication information, collating the biometric information corresponding to the received authentication information with the received biometric information, and transmitting the verification result to the authentication proxy server. And wherein further comprising a Rikusu authentication server.

According to the present invention, since the biometrics authentication is performed centrally by the biometrics authentication server instead of the authentication proxy server, it is necessary to manage the registration and change of the biometrics information for each application terminal. And management costs can be reduced.

[0013] A biometrics authentication system according to the next invention is characterized in that, in the above invention, the authentication proxy server transmits the collation result only to an application.

According to the present invention, the authentication proxy server notifies only the application of the verification result by the biometrics authentication, and does not transmit the result to the network authentication server. Omit user authentication by authentication information such as password authentication performed by the network authentication server of
Server operation management costs can be reduced.

[0015] In the biometrics authentication system according to the next invention, in the above invention, the authentication proxy server determines whether or not to collate the biometrics information according to the content of the authentication information received from the application. Characterized in that:

According to the present invention, the authentication proxy server determines whether or not to check the biometrics information according to the content of the authentication information received from the application. Therefore, the authentication proxy server performs the biometrics authentication. It is possible to determine whether to perform user authentication using conventional authentication information such as a password or the like. As a result, even for a user who cannot collect biometric information, normal user authentication using authentication information such as a password can be performed. Further, since such an authentication proxy server is provided in the application terminal, the setting of whether or not to perform the biometrics authentication can be switched for each application terminal. The operation of switching the method can be realized.

[0017] A biometrics authentication method according to the next invention comprises a biometrics acquisition device connected to an application terminal that executes an application and acquires biometrics information of a user; an authentication proxy server provided in the application terminal; A biometrics authentication method that is connected to the application terminal via a network and performs biometrics authentication by a network authentication server that performs authentication of a user who executes an application based on user authentication information; Receiving authentication information from an application on behalf of an authentication server; and biometrics information obtained from the biometric obtaining apparatus and biometrics corresponding to the received authentication information. An authentication step to match the broadcast,
Transmitting a verification result to the network authentication server and / or the application.

According to the present invention, the authentication proxy server is interposed between the application terminal and the network authentication server, and the authentication proxy server receives authentication information from the application instead of the network authentication server to acquire biometrics. The biometrics information obtained from the device is compared with the biometrics information corresponding to the received authentication information to perform biometrics authentication, and the matching result is transmitted to the network authentication server. And high security can be ensured. Further, according to the present invention, since biometrics authentication is performed by the authentication proxy server interposed between the application terminal and the network authentication server, both programs of the client-side application and the server-side network authentication server can be used. No modification is required for the introduction of biometric authentication, and the introduction cost can be reduced. Further, since the same protocol as that of the conventional application and the network authentication server is also used for the authentication proxy server, the same level of security as before can be maintained on the network.

[0019] A biometrics authentication method according to the next invention comprises a biometrics acquisition device connected to an application terminal that executes an application to acquire biometrics information of a user; an authentication proxy server provided in the application terminal; A biometric authentication server that performs biometric authentication by a biometric authentication server that performs biometric authentication of a user, and a network authentication server that is connected to the application terminal via a network and that authenticates a user who executes an application based on user authentication information. In the metric authentication method, the authentication proxy server side receives authentication information from an application instead of a network authentication server; Transmitting the metric information and the received authentication information to the biometric authentication server; receiving, on the biometric authentication server side, the biometric information and the authentication information from the authentication proxy server; Matching the received biometric information with the biometric information corresponding to the authenticated authentication information, transmitting the matching result to the authentication proxy server, and, on the authentication proxy server side, comparing the matching result by the biometric authentication server with the authentication result. Transmitting to the network authentication server and / or the application.

According to the present invention, since the biometrics authentication is performed centrally by the biometrics authentication server instead of the authentication proxy server, it is necessary to manage the registration and change of the biometrics information for each application terminal. And management costs can be reduced.

[0021] A biometrics method according to the next invention is characterized in that, in the above invention, the authentication proxy server transmits the collation result only to an application.

According to the present invention, the authentication proxy server notifies only the application of the verification result by the biometrics authentication and does not transmit the result to the network authentication server, so that the user authentication by the authentication information such as the password authentication is omitted. In addition, server operation management costs can be reduced.

[0023] In the biometrics authentication method according to the next invention, in the above-mentioned invention, the authentication proxy server determines whether or not to perform verification of the biometrics information in accordance with the content of the authentication information received from the application. It is characterized by that.

According to the present invention, the authentication proxy server determines whether or not to check the biometric information according to the content of the authentication information received from the application, so that the authentication proxy server performs the biometric authentication. The user can determine whether to perform the authentication or to perform the user authentication using authentication information such as a conventional password. As a result, even for a user who cannot collect biometric information, normal user authentication using authentication information such as a password can be performed. Further, the setting of whether or not to perform biometrics authentication can be switched for each application terminal, and an operation of switching the user authentication method according to the security level required for the application terminal can be realized.

[0025] A program according to the next invention is a program for causing a computer to execute the method described in any one of the above-described inventions, and the program becomes machine-readable. One operation can be performed by a computer.

[0026]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of a biometrics authentication system, a biometrics authentication method and a program for causing a computer to execute the method according to the present invention will be described below in detail with reference to the accompanying drawings.

Embodiment 1 FIG. 1 is a block diagram showing a configuration of the fingerprint authentication system according to the first embodiment of the present invention. The fingerprint authentication system according to the first embodiment includes applications 2A, 2B, and 2 executed by a user operation.
C, authentication proxy servers 3A, 3B, 3C, fingerprint acquisition devices 4A, 4B, 4C, and network authentication server 6.
The applications 2A, 2B, and 2C and the authentication proxy servers 3A, 3B, and 3C are configured to be executed by the application terminals 1A, 1B, and 1C, respectively. The application terminals 1A, 1B, 1C and a network authentication server 6 are connected by a network 5 such as the Internet.

The applications 2A, 2B, and 2C are programs that require authentication of the user executing the applications by the network authentication server 6, and any such application programs can be used.

The fingerprint acquisition devices 4A, 4B and 4C collect fingerprint information as biometrics information from the user at the request of the authentication proxy servers 3A, 3B and 3C, and transfer the obtained fingerprint information to the authentication proxy servers 3A, 3B and 3C. Hand over to Each fingerprint acquisition device 4A, 4B, 4C
Are directly connected to the application terminals 1A, 1B, 1C via a predetermined interface without going through a network.

The authentication proxy servers 3A, 3B, 3C
It is a server process that runs in each application terminal, and includes fingerprint information databases (fingerprint information DBs) 9A, 9B, and 9C in which user IDs and fingerprint information are associated in advance, and user databases (users) in which user IDs and passwords are associated in advance. DB) 8A, 8B, and 8C are stored in a storage medium such as a hard disk of the application terminals 1A, 1B, and 1C. Authentication proxy server 3A, 3B, 3
C obtains the fingerprint information from the fingerprint obtaining apparatuses 4A, 4B, and 4C when obtaining the authentication information such as the user ID and the password of the user from the application, and obtains the obtained fingerprint information and the fingerprint information databases 9A and 9B. , 9C
The fingerprint authentication is performed based on the fingerprint information registered in the network authentication server, and data such as the authentication result is transmitted and received between the network authentication server 6 and the applications 2A, 2B, and 2C. Note that the applications 2A, 2B,
At the time when the authentication information is passed from 2C to the authentication proxy servers 3A, 3B and 3C, the password does not have to be accurate, or only the user ID is used.
The password need not be passed to A, 3B, and 3C.

The network authentication server 6 is a conventional authentication server provided with a user management database (user management DB) 10 in which a user ID, a password, and other user information are associated in advance on a storage medium such as a hard disk. . The network authentication server 6 includes authentication proxy servers 3A, 3B, 3C in each application terminal.
Receives the user ID and the password from the user management database 10, performs normal user authentication by password verification with reference to the user management database 10, and transmits the authentication result and, if necessary, information for access control to the authentication proxy servers 3A, 3B,
Return to 3C.

Next, Embodiment 1 configured as described above
Initial setting and authentication processing performed by the fingerprint authentication system described above will be described. First, in each of the application terminals 1A, 1B, 1C, the applications 2A, 2B,
In the item of the server destination setting which is the initial setting of the 2C, the item which is usually the network authentication server is set as the destination or the storage destination of the authentication proxy servers 3A, 3B and 3C. Thereby, the applications 2A, 2B, 2C
In the user authentication, instead of connecting to the network authentication server 6, first, the authentication proxy servers 3A, 3B, 3C
Will be connected to.

After the initial setting, the user operates each application 2 at each of the application terminals 1A, 1B and 1C.
When A, 2B and 2C are executed, the application 2A,
2B, 2C, the fingerprint acquisition devices 4A, 4B, 4C, the authentication proxy servers 3A, 3B, 3C, and the network authentication server 6 execute the following authentication processing. FIG. 2 is a flowchart illustrating a procedure of an authentication process performed by the fingerprint authentication system according to the first embodiment.

The applications 2A, 2B, and 2C request the user to input a user ID and a password, which are authentication information, as usual. When the user inputs the user ID and the password, the applications 2A, 2B, and 2C enter the user ID and the password. The authentication proxy server 3A, 3
B, 3C. In the application, the input authentication information is used as is in the authentication proxy servers 3A, 3A.
To pass the password to B and 3C, the user does not need to input a password, or may input an arbitrary character string other than the actually registered password as the password.

The authentication proxy servers 3A, 3B, 3C
When the authentication information (user ID and password) is received from the applications 2A, 2B and 2C (step S20)
1) Instruct the user to acquire a fingerprint and issue an instruction to start fingerprint acquisition to the fingerprint acquisition devices 4A, 4B, and 4C (step S202). Fingerprint acquisition devices 4A, 4B, 4C
Then, in response to a request from the authentication proxy servers 3A, 3B, 3C, acquisition of fingerprint information is started, and the collected fingerprint information is returned to the authentication proxy servers 3A, 3B, 3C.

The authentication proxy servers 3A, 3B, 3C
When fingerprint information is acquired from the fingerprint acquisition devices 4A, 4B, 4C (step S203), the fingerprint information database 9A,
The fingerprint information registered corresponding to the user ID is searched from 9B and 9C (step S204).
The fingerprint information acquired from A, 4B, and 4C is collated with the fingerprint information retrieved from the fingerprint information databases 9A, 9B, and 9C (step S205). If the two fingerprint information do not match as a result of the comparison, a fingerprint authentication result indicating that the fingerprint authentication has failed is returned to the applications 2A, 2B, and 2C (step S206). If the fingerprint information matches, a password registered for the user ID is searched from the user databases 8A, 8B, 8C (step S207), and the user ID and the searched password are input to the network authentication server. 6 (step S2)
08).

The network authentication server 6 searches the user management database 10 for a registered password corresponding to the user ID (step S211), and compares the searched password with the password received from the network authentication server 6. (Step S212). The authentication result obtained by the password verification and, if necessary, information for access control are transmitted to the authentication proxy servers 3A and 3A.
Reply to B and 3C (step S213). The authentication proxy servers 3A, 3B, 3C that have received the authentication result (Step S209) notify the applications 2A, 2B, 2C of the received authentication result and information for access control (Step S210).

As described above, in the fingerprint authentication system according to the first embodiment, the authentication proxy server 3A, the authentication proxy server 3A, and the client-side application 2A, 2B, 2C are not modified at all.
By adding 3B, 3C and the fingerprint acquisition devices 4A, 4B, 4C, it is possible to perform fingerprint authentication, which is authentication of biometrics having higher security than a password, and realize reliable user authentication.

In addition, the security on the network is determined by using the existing protocols used by the applications 2A, 2B, 2C and the network authentication server 6 and the applications 2A, 2B, 2C and the authentication proxy servers 3A, 3A.
B and 3C, and between the authentication proxy servers 3A, 3B and 3C and the network authentication server 6, it is possible to maintain the same strong security as before.

Embodiment 2 In the fingerprint authentication system according to the first embodiment, the fingerprint information is collated by the authentication proxy server. However, the fingerprint authentication system according to the second embodiment includes:
The fingerprint information is collated by a fingerprint authentication server connected to the network. FIG. 3 is a block diagram showing a configuration of the fingerprint authentication system according to the second embodiment of the present invention. The fingerprint authentication system according to the second embodiment includes applications 2A, 2B, and 2C executed by a user operation.
And authentication proxy servers 303A, 303B, 303C
, A fingerprint acquisition device 4A, 4B, 4C, a network authentication server 6, and a fingerprint authentication server 307. As in the first embodiment, the applications 2A, 2B, 2C
And authentication proxy servers 303A, 303B, 303C
Are executed by the application terminals 1A, 1B, and 1C, respectively. In the fingerprint authentication system according to the second embodiment, application terminals 1A, 1B, 1C
, Network authentication server 6 and fingerprint authentication server 30
7 are connected by a network 5 such as the Internet.

In the fingerprint authentication system according to the second embodiment, the applications 2A, 2B, 2C, the application terminals 1A, 1B, 1C, the fingerprint acquisition devices 4A, 4B,
4C and the network authentication server 6 according to the first embodiment
Since the configuration is the same as that of the fingerprint authentication system, the description is omitted.

In the fingerprint authentication system according to the second embodiment, the authentication proxy servers 303A, 303B, 303C
Is a server process running in each application terminal. Authentication proxy servers 303A, 303B, 3
03C is for obtaining authentication information such as a user's user ID and password from the applications 2A, 2B and 2C, and for requesting and receiving fingerprint information acquisition from the fingerprint acquisition devices 4A, 4B and 4C. Also, authentication proxy servers 303A, 303B, 303 according to the second embodiment.
C transmits the user ID and the fingerprint information acquired from the fingerprint acquisition devices 4A, 4B, and 4C to the fingerprint authentication server 307 without performing the fingerprint authentication process, unlike the authentication proxy server in the first embodiment. Receives the result of fingerprint authentication from the network authentication server 6 and the application 2A, 2B, 2C
To be sent to.

The fingerprint authentication server 307 stores the user ID in advance.
A fingerprint information database (fingerprint information DB) 9 in which the user and the fingerprint information are associated, and a user database (user DB) 8 in which the user ID and the password are associated in advance are stored in a storage medium such as a hard disk. Fingerprint authentication server 307
Are the authentication proxy servers 303A, 303B, 303C
Receives the user ID and the fingerprint information from the user, performs fingerprint authentication based on the fingerprint information database 9, and outputs the authentication result and the password corresponding to the user ID to the authentication proxy server 30.
3A, 303B, and 303C.

Next, the second embodiment configured as described above
Authentication processing performed by the fingerprint authentication system of the first embodiment will be described. FIG. 4 is a flowchart illustrating a procedure of an authentication process performed by the fingerprint authentication system according to the second embodiment. Note that the initial settings of the applications 2A, 2B, and 2C are performed by setting the server destination setting items to the destinations or storage destinations of the authentication proxy servers 303A, 303B, and 303C, as in the first embodiment.

The applications 2A, 2B, and 2C request the user to input a user ID and a password, which are authentication information, and when the user inputs the user ID and the password, the application 2A, 2B, and 2C enter the user ID and the password. The authentication information is used as is in the authentication proxy server 303A,
Transfer to 303B and 303C. As in the first embodiment, the user does not need to input a password, or may input an arbitrary character string other than the actually registered password as the password.

The authentication proxy servers 303A, 303B,
Upon receiving the authentication information (user ID and password) from the applications 2A, 2B and 2C (step S401), the 303C issues an instruction to acquire a fingerprint to the user and starts the fingerprint acquisition to the fingerprint acquisition devices 4A, 4B and 4C. An instruction is issued (step S402). Fingerprint acquisition device 4A,
4B and 4C, the authentication proxy servers 303A and 303
B, 303C, the acquisition of fingerprint information is started, and the collected fingerprint information is transmitted to the authentication proxy servers 303A, 303C.
Return to 303B and 303C.

The authentication proxy servers 303A, 303B,
Upon acquiring the fingerprint information from the fingerprint acquisition devices 4A, 4B, and 4C (step S403), the 303C transmits the user ID and the acquired fingerprint information to the fingerprint authentication server 307 (step S404). The fingerprint authentication server 307 sends the user I from the authentication proxy servers 303A, 303B, 303C.
Upon receiving the fingerprint information D and the fingerprint information (step S405), the fingerprint information database 9 searches the registered fingerprint information corresponding to the user ID (step S406), and obtains the fingerprint information acquired from the fingerprint acquisition devices 4A, 4B, and 4C. Is compared with the retrieved fingerprint information (step S407). If the fingerprint information does not match as a result of the comparison, the fingerprint authentication result indicating that the fingerprint authentication has failed is sent to the authentication proxy server 3.
03A, 303B, and 303C (step S4).
08). If the fingerprint information matches, the password registered corresponding to the user ID is acquired from the user database 8 (step S409), and the fingerprint authentication result indicating that the fingerprint authentication was successful and the retrieved password are obtained. Is transmitted to the authentication proxy servers 303A, 303B, 303C (step S410).

The authentication proxy servers 303A, 303B,
At 303C, upon receiving the fingerprint authentication result (and password) from the fingerprint authentication server 307 (Step S41)
1) It is determined whether the received fingerprint authentication result is “success” (step S412). Fingerprint authentication server 307
When the fingerprint authentication result indicating that the fingerprint authentication is "successful" and the password are received, the user ID and the password are transmitted to the network authentication server 6 (step S414). On the other hand, when the fingerprint authentication result indicating that the fingerprint authentication is “failure” is received, the application 2A, 2
The fingerprint authentication result is directly returned to B and 2C (step S4).
13).

When network authentication server 6 receives the fingerprint authentication result from authentication proxy servers 303A, 303B, 303C (step S415), the password registered corresponding to the user ID from user management database 10 (user management DB). Information, and the retrieved password and the authentication proxy servers 303A, 303
B, and performs user authentication by collating with the password received from 303C (step S416). The authentication result obtained by the password verification and, if necessary, information for access control are transmitted to the authentication proxy servers 303A, 303B,
Reply to 303C (step S417). Upon receiving the authentication result and the information for access control from the network authentication server 6 (step S418), the authentication proxy servers 303A, 303B, 303C copy the received authentication result and information for access control as they are to the applications 2A, 2B, Notify 2C (step S
419).

As described above, in the fingerprint authentication system of the second embodiment, the authentication is performed without any modification of the processing of the server-side network authentication server 6 and the client-side applications 2A, 2B, and 2C in the existing network authentication system. Proxy servers 303A, 303B,
By adding the fingerprint authentication device 303C, the fingerprint acquisition devices 4A, 4B, and 4C and the fingerprint authentication server 307, the user authentication can be reliably performed by the fingerprint authentication which is the authentication of biometrics having higher security than the password.

In the fingerprint authentication system according to the second embodiment, the fingerprint authentication is performed centrally by the server,
There is no need to register a fingerprint for each application terminal, which reduces management costs.

Embodiment 3 FIG. The fingerprint authentication system according to the first and second embodiments uses the user ID after the fingerprint authentication succeeds.
In the fingerprint authentication system according to the third embodiment, only the fingerprint authentication is performed, and the user authentication using the user ID and the password is omitted regardless of the authentication result. It is. FIG. 5 is a block diagram showing a configuration of the fingerprint authentication system according to the third embodiment of the present invention. The fingerprint authentication system according to the third embodiment includes an application 2A, 2B, 2C executed by a user operation and an authentication proxy server 50.
3A, 503B, 503C, and fingerprint acquisition devices 4A, 4
B, 4C, and a fingerprint authentication server 507. Like the first and second embodiments, the applications 2A, 2C
B, 2C and authentication proxy servers 503A, 503B, 5
03C are application terminals 1A, 1B,
1C. In the fingerprint authentication system according to the third embodiment, the application terminal 1
A, 1B, and 1C are connected to a fingerprint authentication server 507 via a network 5 such as the Internet, and the configuration of the fingerprint authentication system according to the first and second embodiments is different from that of the first and second embodiments in that there is no network authentication server.

In the fingerprint authentication system according to the third embodiment, the applications 2A, 2B, 2C, the application terminals 1A, 1B, 1C, and the fingerprint acquisition devices 4A, 4
B and 4C have the same configuration as that of the fingerprint authentication system according to the second embodiment, and a description thereof will be omitted.

In the fingerprint authentication system according to the third embodiment, the authentication proxy servers 503A, 503B, 503C
Is a server process that operates in each application terminal, as in the second embodiment.
Acquisition of authentication information such as a user's user ID and password from A, 2B and 2C, request and reception of fingerprint information acquisition to fingerprint acquisition devices 4A, 4B and 4C, and acquisition of user ID and fingerprint acquisition devices 4A, 4B and 4C. The fingerprint information is transmitted to the fingerprint authentication server 507. When the authentication proxy servers 503A, 503B, 503C receive the result of the fingerprint authentication from the fingerprint authentication server 507, the authentication result is returned to the applications 2A, 2B, 2C as it is regardless of whether the authentication result is successful or not.
This is different from the authentication proxy server according to the second embodiment in which when the authentication result is successful, the password is obtained and the authentication result, the user ID, and the password are transmitted to the network authentication server.

The fingerprint authentication server 507 stores a fingerprint information database 9 in which user IDs and fingerprint information are associated in advance.
(Fingerprint information DB) is stored in a storage medium such as a hard disk. The fingerprint authentication server 507 receives the user ID and the fingerprint information from the authentication proxy servers 503A, 503B, and 503C, performs fingerprint authentication based on the fingerprint information database 9, and outputs the authentication result to the authentication proxy server 503.
A, 503B and 503C. That is, in the third embodiment, the fingerprint authentication server 507
Transmits the fingerprint authentication result to the authentication proxy servers 503A and 503A.
Only the return to 03B, 503C is performed, and the acquisition of the password corresponding to the user ID and the transmission of the password to the authentication proxy servers 503A, 503B, 503C are not performed.

Next, the third embodiment configured as described above
Authentication processing performed by the fingerprint authentication system of the first embodiment will be described. FIG. 6 is a flowchart illustrating a procedure of an authentication process performed by the fingerprint authentication system according to the third embodiment. The initial settings of the applications 2A, 2B, and 2C are the same as in the first and second embodiments, except that the items of the server destination setting are set in the authentication proxy servers 503A, 503B, and 5C.
This is performed by setting the destination or storage destination of 03C.

Processing from input request of user authentication information (user ID and password) by applications 2A, 2B and 2C to transmission of fingerprint information and user ID of authentication proxy servers 503A, 503B and 503C to fingerprint authentication server 507 ( Steps S601 to S604)
Is the procedure of the authentication process in the second embodiment (step S
401 to S404), and a description thereof will be omitted.

When the fingerprint authentication server 507 receives the user ID and the fingerprint information from the authentication proxy servers 503A, 503B, and 503C (step S605), the fingerprint authentication server 507 reads the fingerprint information registered corresponding to the user ID from the fingerprint information database 9. A search is performed (step S606), and the fingerprint information acquired from the fingerprint acquisition devices 4A, 4B, and 4C is collated with the retrieved fingerprint information (step S607). As a result of the collation, when the fingerprint information matches, the fingerprint authentication result indicating that the fingerprint authentication is successful is sent to the authentication proxy server 50.
3A, 503B, and 503C (step S60).
8). If the two fingerprint information do not match, a fingerprint authentication result indicating that the fingerprint authentication has failed is sent to the authentication proxy server 5.
03A, 503B, and 503C (step S6).
09). Authentication proxy servers 503A, 503B, 50
Upon receiving the fingerprint authentication result from the fingerprint authentication server 507 (step S610), the 3C notifies the application 2A, 2B, and 2C of the authentication result as it is (step S611).

As described above, the fingerprint authentication system according to the third embodiment does not require the network authentication server 6 on the server side in the existing network authentication system, and completely modifies the authentication processing of the applications 2A, 2B, and 2C on the client side. Without any problem, the authentication proxy server 50
3A, 503B, 503C and fingerprint acquisition devices 4A, 4B,
By adding 4C and fingerprint authentication server 507,
User authentication can be reliably performed by fingerprint authentication, which is authentication of biometrics with higher security than passwords.

Further, in the fingerprint authentication system according to the third embodiment, since a network authentication server is not required, the operation management cost can be reduced.

Embodiment 4 The fingerprint authentication systems according to the first to third embodiments always perform the fingerprint authentication. However, the fingerprint authentication system according to the fourth embodiment is adapted to receive the user ID, password, time, and the like input by the user. In this case, it is determined whether or not to perform fingerprint authentication, and the fingerprint authentication is performed only when it is determined to perform fingerprint authentication.
FIG. 7 is a block diagram showing a configuration of a fingerprint authentication system according to Embodiment 4 of the present invention. The fingerprint authentication system according to the fourth embodiment includes an application 2A, 2B, 2C executed by a user operation and an authentication proxy server 7.
03A, 703B, and 703C, and fingerprint acquisition devices 4A and 4
B, 4C, and a network authentication server 6, and the application terminals 1A, 1B, 1C and the network authentication server 6 are connected by a network 5 such as the Internet, and have a system configuration similar to that of the first embodiment. I have. Further, similarly to the first embodiment, the applications 2A, 2B, 2C and the authentication proxy server 70
3A, 703B, and 703C are configured to be executed by application terminals 1A, 1B, and 1C, respectively.

In the fingerprint authentication system according to the fourth embodiment, the applications 2A, 2B, 2C, the application terminals 1A, 1B, 1C, the fingerprint acquisition devices 4A, 4
B, 4C, network authentication server 6 according to the first embodiment
Since the configuration is the same as that of the fingerprint authentication system, the description is omitted.

The authentication proxy servers 703A, 703B, 703C in the fingerprint authentication system according to the fourth embodiment
It is a server process that runs in each application terminal, and includes fingerprint information databases (fingerprint information DBs) 9A, 9B, and 9C in which user IDs and fingerprint information are associated in advance, and user databases (users) in which user IDs and passwords are associated in advance. DB) 8A, 8B, and 8C are stored in a storage medium such as a hard disk of the application terminals 1A, 1B, and 1C. Authentication proxy server 703A, 70
3B, 703C are applications 2A, 2B, 2C
When the authentication information such as the user's user ID and password is obtained from, when a fixed character string in the authentication information is set or when certain conditions such as the reception date and time are in a specific time zone are satisfied Transmits the received authentication information to the network authentication server 6 without performing fingerprint authentication. On the other hand, when the above-mentioned certain condition is not satisfied, similarly to the authentication proxy server in the first embodiment, the fingerprint information of the user is acquired and fingerprint authentication is performed, and the user ID and the password are transmitted to the network authentication server 6. To be sent. The authentication proxy servers 703A, 703B, 703C notify the authentication results received from the network authentication server 6 to the applications 2A, 2B, 2C as they are.

Next, an authentication process performed by the fingerprint authentication system according to the fourth embodiment configured as described above will be described. FIG. 8 is a flowchart illustrating a procedure of an authentication process performed by the fingerprint authentication system according to the fourth embodiment. Note that the initial setting of the applications 2A, 2B, and 2C is similar to that of the first embodiment except that the items of the server destination setting are set to the authentication proxy servers 703A, 703B, and 703C.
This is done by setting the destination or storage destination.

The applications 2A, 2B, and 2C request the user to input a user ID and a password, which are authentication information, as usual. When the user inputs the user ID and the password, the application 2A, 2B, and 2C input the user ID and the password. The authentication information is used as is in the authentication proxy server 703A,
Transfer to 703B and 703C. As in the first embodiment, the user does not need to input a password, or may input an arbitrary character string other than the actually registered password as the password.

The authentication proxy servers 703A, 703B,
Upon receiving the authentication information (user ID and password) from the applications 2A, 2B, and 2C (step S801), the 703C determines whether a specific character string is set in the received authentication information, or determines whether the reception time is a specific time. It is determined whether it belongs to the band (step S802). Then, when these conditions are satisfied, the received authentication information is transmitted to the network authentication server 6 as it is (step S812), and the fingerprint authentication process is not performed. In this case, the applications 2A, 2B, and 2C use the network authentication server 6 to perform user authentication based on conventional authentication information such as a user ID and a password (steps S813 to S815).

On the other hand, when the above condition is not satisfied, the fingerprint authentication processing is started. Subsequent fingerprint authentication processing (steps S803 to S811) is described in the first embodiment.
Of the fingerprint authentication process in the fingerprint authentication system (Fig. 2)
Steps S202 to S210) are not described here.

As described above, in the fingerprint authentication system according to the fourth embodiment, by selecting whether to perform fingerprint authentication with the authentication proxy server or to perform authentication with a conventional password, a user who cannot collect fingerprint information is selected. Can also be handled with a password. In the fingerprint authentication system according to the fourth embodiment, the necessity of the security of the application terminal is improved without changing both the application and the network authentication system by changing the setting of whether or not to perform fingerprint authentication for each application terminal. Can switch user authentication.

In the fingerprint authentication systems of the first to fourth embodiments, authentication is performed using fingerprint information as biometric information. In addition, physical characteristics such as palm print, voice print, and retinal pattern, and handwriting Authentication may be performed by using information such as a key type and a habit at the time of key type as biometric information.

[0070]

As described above, according to the present invention, user authentication using an existing password can be performed using biometric information, and an effect that high security can be ensured can be achieved. Further, neither the application program on the client side nor the program on the network authentication server on the server side requires any modification for introducing biometrics authentication, and the introduction cost can be reduced. Furthermore, there is an effect that the same level of security can be maintained on the network as before.

According to the next invention, the biometrics authentication is performed centrally by the biometrics authentication server,
There is no need to manage the registration and change of biometrics information for each application terminal, and the management cost can be reduced.

According to the next invention, user authentication based on authentication information such as password authentication performed by a conventional network authentication server can be omitted, and the operation management cost of the server can be reduced.

According to the next invention, even for a user who cannot collect biometric information, it is possible to perform normal user authentication using authentication information such as a password. Also, there is an effect that the operation of switching the user authentication method can be performed depending on the security level required for the application terminal.

According to the next invention, user authentication using an existing password can be performed using biometric information, and an effect that high security can be ensured can be achieved. Further, neither the application program on the client side nor the program on the network authentication server on the server side requires any modification for introducing biometrics authentication, and the introduction cost can be reduced. Furthermore, there is an effect that the same level of security can be maintained on the network as before.

According to the next invention, the biometrics authentication is performed centrally by the biometrics authentication server,
There is no need to manage the registration and change of biometrics information for each application terminal, and the management cost can be reduced.

According to the next invention, user authentication based on authentication information such as password authentication performed by a conventional network authentication server is omitted, and the operation management cost of the server can be reduced.

According to the next invention, even for a user who cannot collect biometric information, it is possible to perform normal user authentication using authentication information such as a password. Also, there is an effect that the operation of switching the user authentication method can be performed depending on the security level required for the application terminal.

According to the next invention, a program for causing a computer to execute the method according to any one of the above-described inventions becomes machine-readable, whereby
An effect is obtained that any one of the above-described operations can be executed by a computer.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a fingerprint authentication system according to a first embodiment of the present invention.

FIG. 2 is a flowchart of a fingerprint authentication processing procedure by the fingerprint authentication system according to the first embodiment shown in FIG. 1;

FIG. 3 is a block diagram illustrating a configuration of a fingerprint authentication system according to a second embodiment of the present invention;

FIG. 4 is a flowchart of a fingerprint authentication processing procedure by the fingerprint authentication system shown in FIG. 3;

FIG. 5 is a block diagram showing a configuration of a fingerprint authentication system according to Embodiment 3 of the present invention.

FIG. 6 is a flowchart of a fingerprint authentication processing procedure by the fingerprint authentication system shown in FIG. 5;

FIG. 7 is a block diagram showing a configuration of a fingerprint authentication system according to a fourth embodiment of the present invention.

FIG. 8 is a flowchart of a fingerprint authentication processing procedure by the fingerprint authentication system according to the fourth embodiment shown in FIG. 7;

[Explanation of symbols]

1A, 1B, 1C Application terminal, 2A, 2
B, 2C application, 3A, 3B, 3C authentication proxy server, 4A, 4B, 4C fingerprint acquisition device, 5
Network, 6 network authentication server, 7 fingerprint authentication server, 8 user database, 8A, 8B, 8
C user database, 9 fingerprint information database,
9A, 9B, 9C Fingerprint information database, 10 user management database, 303A, 303B, 303C
Authentication proxy server, 307 Fingerprint authentication server, 503
A, 503B, 503C Authentication proxy server, 507
Fingerprint authentication server, 703A, 703B, 703C Authentication proxy server.

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Naoyoshi Okazaki 2-3-2 Marunouchi, Chiyoda-ku, Tokyo Mitsui Electric Co., Ltd. (72) Inventor Hiroshi Nakamura 2-3-2 Marunouchi, Chiyoda-ku, Tokyo Mitsubishi Electric Corporation (72) Inventor Teruko Fujii 2-3-2 Marunouchi, Chiyoda-ku, Tokyo Mitsubishi Electric Corporation F-term (reference) 5B085 AA08 AE25 BA07 BG07 5J104 AA07 KA01 KA16 MA04 PA07

Claims (9)

[Claims] 1. A biometrics acquisition device that is connected to an application terminal that executes an application and acquires biometrics information of a user, and a user that is connected to the application terminal via a network and executes the application based on user authentication information. A biometrics authentication system that performs biometrics authentication with a network authentication server that performs authentication of the biometrics authentication system, comprising: a storage unit that is provided in the application terminal and stores a biometrics information database in which authentication information and biometrics information are associated in advance. Receiving authentication information from an application in place of the network authentication server, and obtaining biometric information corresponding to the biometric information acquired from the biometric acquisition device and the received authentication information. Collating the scan information, biometric authentication system characterized by comprising an authentication proxy server that sends the verification result to the authentication server and / or the application. 2. A biometrics acquisition device connected to an application terminal executing an application and acquiring biometrics information of a user, and a user connected to the application terminal via a network and executing the application based on user authentication information. A biometrics authentication system that performs biometrics authentication with a network authentication server that performs authentication of the biometrics. The biometrics authentication system is provided in the application terminal, receives authentication information from an application instead of the network authentication server, and obtains the biometrics acquired by the biometrics acquisition device. Information and the received authentication information to a biometrics authentication server, and a verification result by the biometrics authentication server is sent to the network authentication server and / or the application. An authentication proxy server for transmitting the authentication information and the biometrics information to the biometrics information database in advance, and receiving and receiving the biometrics information and the authentication information from the authentication proxy server. And a biometrics authentication server for comparing the biometrics information corresponding to the authentication information and the received biometrics information, and transmitting a matching result to an authentication proxy server. 3. The biometrics authentication system according to claim 1, wherein the authentication proxy server transmits the comparison result only to an application. 4. The authentication proxy server according to claim 1, wherein the authentication proxy server determines whether or not to perform verification of the biometric information according to the content of the authentication information received from the application. The biometric authentication system described in any one of the above. 5. A biometrics acquisition device that is connected to an application terminal that executes an application and acquires biometrics information of a user, an authentication proxy server provided in the application terminal, and a network that is connected to the application terminal via a network. A biometrics authentication method for performing biometrics authentication by a network authentication server that authenticates a user who executes an application based on user authentication information, wherein the authentication proxy server side uses authentication information from an application instead of a network authentication server. Receiving the biometrics information acquired from the biometrics acquisition device and the biometrics information corresponding to the received authentication information. Biometric authentication method comprising: the step of transmitting to the network authentication server and / or the application, the. 6. A biometrics acquisition device that is connected to an application terminal that executes an application and acquires biometrics information of a user, an authentication proxy server provided in the application terminal, and a biometrics that performs biometrics authentication of the user. A biometrics authentication method for performing biometrics authentication by an authentication server and a network authentication server connected to the application terminal via a network and authenticating a user who executes an application based on user authentication information, wherein the authentication proxy server Receiving the authentication information from the application instead of the network authentication server; and transmitting the biometric information acquired by the biometric acquisition device and the received authentication information. Transmitting to the metric authentication server, the biometric authentication server side receiving biometric information and authentication information from the authentication proxy server; and biometric information corresponding to the received authentication information. Collating the received biometrics information; transmitting the collation result to an authentication proxy server; and transmitting the collation result by the biometrics authentication server to the network authentication server and / or the application on the authentication proxy server side. Performing a biometric authentication method. 7. The biometric authentication method according to claim 5, wherein the authentication proxy server transmits the collation result only to an application. 8. A method according to claim 5, wherein the authentication proxy server determines whether or not to check biometrics information in accordance with the content of the authentication information received from the application. The biometrics authentication method described in any one of the above. 9. A program for causing a computer to execute the biometrics authentication method according to claim 5.