JP2003044442A - Method and device for data authentication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method and a device for data authentication which enable any client to be authenticated as long as authentication data of the same kind with a read function for biological data that the client has are registered. SOLUTION: In a database authentication system having a server 10 and a plurality of clients 20 connected through a network, the server 10 has a biological authentication data registration table 31 containing biological authentication data for each user and each client 20 is provided with a cache memory 25a which stores authentication data transferred from the server 10.

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to a data authentication method and a data authentication device.

[0002]

2. Description of the Related Art In a conventional system for authenticating with a plurality of types of biodata, correspondence between a user and a client is uniquely determined. For this reason, even if authentication can be performed using a plurality of types of biodata, the user has previously determined the type of biodata for authentication.

[0003]

As a result, even if the biometric data reading means of a type other than the one set for the certification is used, the certification cannot be performed even if the certification data is registered. For this reason, there is a problem that the authentication cannot be performed by the client having only the biodata reading means other than the set type. Further, in the bio-authentication system, there is no system that simultaneously reads a plurality of types of bio-data and takes the logical condition of the verification result of each of them to perform the authentication.

The present invention has been made in view of the above problems, and any client can be authenticated if the same type of authentication data as the biodata reading function of the client is registered. It is an object of the present invention to provide a data authentication method and a data authentication device that can be used.

[0005]

(1) FIG. 1 is a block diagram showing the principle of the present invention. In the figure, 10 is a server for performing an authentication operation, and 20 is a plurality of clients connected to the server 10 via a network. In the server 10, 11 is communication means for communicating with the client 20, 30 is a database in which authentication data for each user is stored, 31 is provided in the database 30,
It is a bio-authentication data registration table in which bio-authentication data is stored. In the client 20, 21 is a communication unit that communicates with the server 10, and 25 a is the server 10.
It is a cache memory that stores the matching result from.

With this configuration, on the server 10 side,
By comparing the bio-data sent from the client 20 with the data stored in the bio-authentication data registration table 31, it is possible to collate the bio-data. Further, since the collation result is notified to the client 20 side, the result can be recognized on the client 20 side.

(2) The invention according to claim 2 is a system capable of authenticating a plurality of types of biodata,
The client 20 makes a request for the authentication data to the server 10. When the authentication data is sent from the server 10, the client 20 stores the data in the cache memory and stores the authentication data stored in the cache memory 25a. It is characterized in that it is collated with the data measured by the bio-data reader.

According to this structure, collation can be performed on the client side, and the memory capacity required on the client side can be small. (3) In the invention according to claim 3, the server 10 requests the client 20 for the biodata of the biodata reader, and the server 10 stores the sent biodata in the database 30. It is characterized in that the result is compared with the authentication data being generated and the result is notified to the client 20.

According to this structure, the server 10 collates the bio data and the authentication data as necessary,
The result can be notified to the client 20. (4) The invention according to claim 4 reads a plurality of types of biodata in a system capable of authenticating with a plurality of types of biodata, and determines the final authentication by taking a logical condition of the verification result of each of them. Is characterized by.

According to this structure, it is possible to combine a plurality of bio-authentications and set the degree of authentication depending on the application. In addition, strict personal authentication can be performed in a system for handling high-priced products on the electronic approval or the Internet that carries out high-value payment processing.

(5) According to the invention of claim 5, in a system capable of authenticating with a plurality of types of biodata, the combination information of authentication types is stored and managed in a server, and when connecting to an application, the information is read and authenticated. It is characterized by performing.

According to this structure, the versatility of the program can be ensured by presetting the mechanism for reading a plurality of multi-bio data. (6) According to the invention of claim 6, in the system capable of authenticating with plural kinds of biodata, the application side holds and manages the combination information of the kinds of authentication, and when the authentication request is made, the plural kinds of biodata information from the application side The feature is that it is transferred to a server and authentication is performed.

With this configuration, it is possible to perform authentication from the application on the client side. (7) The invention according to claim 7 is characterized in that the authentication is authentication using an individual authentication chart.

According to this structure, the server management is effective when the authentication type can be fixed according to the bio-information quality and operation of the person, and the combined information of the authentication types can be centrally managed.

(8) The invention according to claim 8 is characterized in that the detecting means is set for each client and the authenticating means is uniquely determined. With this configuration,
Since multiple authentications are not performed, by fixing the authentication means, it is possible to prevent unauthorized access from the client. In addition, a remote place or a place where communication speed is slow,
The authentication time can be shortened when the access time is long.

(9) The invention according to claim 9 is characterized in that in the system, authentication is performed by an individual authentication chart. According to this structure, by fixing the authentication means, it is possible to prevent unauthorized access from the client.

(10) According to a tenth aspect of the invention, in a system capable of authenticating with a plurality of types of biodata, the authentication accuracy or the number of matching and collating numbers of the authentication data is held as an authentication result log, and is predetermined. If there is a collation request for authentication data that is lower than the authentication accuracy, and if the authentication result is NG, an authentication data update request is issued.
The authentication data is rewritten to verification data at that time or authentication data created from the verification data.

According to this structure, it is possible to prevent erroneous recognition due to deterioration of accuracy of the authentication data due to secular change of the living body. (11) In the invention according to claim 11, in the case of registering the authentication data of the system capable of being authenticated by a plurality of types of biodata, the user requesting the registration has already registered one or more pieces of the authentication data. If the person is judged by the authentication based on the registered authentication data, the unregistered authentication data can be newly registered.

With this configuration, when registering the second and subsequent biodata in the multi-biosystem, the biodata is registered without the need for a system administrator, so that the complexity of registration is avoided. You can

(12) The invention according to claim 12 is characterized in that, in a system capable of authenticating with a plurality of types of bio-data, a bio-collation order for performing the authentication at the time of registration of the authentication data is predetermined and registered.

According to this structure, it is possible to save the labor of selecting the bio-recognition device to be collated in the system handling the multi-bio device. Further, in a system that handles a multi-bio device, once the order of collation is set, all clients can share the same setting. Furthermore, in a system that handles multi-bio devices, it is possible to set the priority of the order of matching.

(13) According to a thirteenth aspect of the invention, in a system capable of authenticating with a plurality of types of biodata, when performing authentication at the time of logging in to an application and the system, the user ID is notified to the authentication system,
When personal authentication is requested, the bio-data registered in advance based on the user ID is read, and the bio-data read from the bio-sensor for the verification request is verified.

According to this structure, since the search time in the collation can be shortened, the bioreader retrieval efficiency and the collation efficiency can be improved in the collation in the multi-bio system.

(14) In the invention according to claim 14, when the user ID is not notified and the biodata is read from the biosensor and transmitted to the biodata collating unit, the type of the biodata concerned is previously confirmed. It is characterized by performing a collation with all registered bio data.

According to this structure, the person can be identified even when there is no user ID. (15) The invention according to claim 15 collates the registered biodata with the user ID input for the collation request and the biodata read from the biosensor in a system capable of authenticating with a plurality of biodata. In the method described above, collation is performed from registered data of the type of biodata that matched last time.

According to this structure, in the case of authentication of a combination of a plurality of types of biodata, the search time for collation can be shortened. (16) The invention according to claim 16 is a system capable of being authenticated by a plurality of types of biodata, and in a method of collating with all biodata registered in advance after reading the biodata from the biosensor. When a client requests to collate only biodata, the biodata to be collated is determined from the data obtained by adding bioreader information to the biodata sent as the collation request, and collation with specific biodata is performed. Characterize.

According to this structure, the search time in the collation can be shortened, and therefore, in the collation in the multi-bio system, the efficiency of the bioreader retrieval and the collation can be improved.

(17) According to a seventeenth aspect of the present invention, a server holding the authentication data registered by the client,
In a system including a client connected to the server via a network, the client has a data reading unit for authentication, and at a preset authentication timing, stores the authentication data input from the authentication data input unit. In the system that transfers to the authentication server, collates with the authentication data sent from the client, and sends the result to the client, once the server authenticates and determines that it is the same as the principal, the authentication data registered in the server Is sent to the client, the client holds the data, and at the time of subsequent authentication, the authentication data held by the client is compared with the input authentication data.

With this configuration, it is possible to reduce an excessive load on the authentication server and the network. (18) According to the eighteenth aspect of the invention, in a system in which a bio-authentication server and a plurality of clients are connected, when the server performs matching, the caching data based on the matching result is transferred to the client side. Characterize.

With this configuration, the result of authentication by the server can be confirmed on the client side. In this case, if authentication data of the same type as the bio-data reading function of the client is registered in the bio-authentication data registration table, the client can authenticate.

[0031]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings. FIG. 2 is a block diagram showing an embodiment of the present invention. The same thing as in Figure 1
The same reference numerals are given. The system shown in the figure shows a system in which a client 20 is connected to a server 10. Although only one client 20 is shown in the figure, a plurality of clients are actually connected.

First, the configuration on the server 10 side will be described. Reference numeral 11 is a communication unit for communicating with the client 20, 12 is a biodata collating unit for collating biodata, and 13 is a program control unit for controlling collation of the biodata collating unit 12. In the figure, the bio-data collation unit 12 is shown to be provided in N pieces up to N pieces. A database 30 includes a bio-authentication data registration table 31 and a user table 32.
The user table 32 stores the names of users.

In the bio-authentication data registration table 31,
The bio-authentication data and the registration date are stored for each user. Here, a case is shown in which N bio-authentication data are stored for the same user. As these bio-authentication data, for example, fingerprint data, voiceprint data, face outline information data, etc. are used. Both
Fingerprints, voiceprints, and face contour information serving as references are measured for each user and stored in the bio-authentication data registration table 31.

Next, the configuration on the client 20 side will be described. Reference numeral 21 is a communication means for communicating with the server 10, 22 is a biosensor driver, 23 is a biodata matching unit, 24 is a biodata conversion unit, 25 is a storage unit,
26 is a program control unit. There are N biosensor drivers 22, and for example, the reading unit of a fingerprint reading device corresponds to this. The bio-data converter 24
The feature part of the biodata is extracted. Storage unit 2
The server 5 stores various data.
Also included here is a cache memory 25a that stores the authentication data from. There are N bio-data collating units 23 as well. Reference numeral 40 is various applications.

The operation of the apparatus thus configured will be outlined. When the client 20 issues a request for authentication data to the server 10 via the communication means 21, the authentication data request is notified to the server 10 via the communication means 11. The server 10 uses the bio-authentication data registration table 3
Necessary authentication data is read out from the authentication data stored in 1 and downloaded to the cache memory 25a of the client 20.

In this way, when the authentication data is stored in the cache memory 25a, the client 20 reads the biodata read from various bioreading devices as needed with the authentication data stored in the cache memory 25a. By comparing, the collating operation becomes possible.
According to the present invention, the client 20 side sends the required authentication data from the server 10 when necessary, so that the storage capacity can be reduced.

FIG. 3 is a diagram showing the first processing flow of the present invention, and shows the operation of the configuration shown in FIG. First, when a verification request is issued from the application 40 (S
1) The program control unit 26 is activated (S2). Each biosensor (bioreading device) is driven by the biosensor driver 22 and outputs biodata (S
3). Here, examples of the biodata include fingerprint data, voiceprint data, and the like as described above.

The bio-data converter 24 receives the bio-data and performs a process of extracting a characteristic portion (S4).
Next, the client communication means 21 checks the communication state with the server 10 (S5). If the check result is OK, the server communication means 11 checks whether or not the data from the client 20 has been received (S6). In the case of OK, the server 10 searches the database 30 and reads the bio-authentication data (S7).

Next, the biodata collating unit 12 of the server
Collates the biodata measured by the biosensor with the authentication data (S8). Next, the verification result is transmitted from the server 10 to the client 20 (S
9). Next, cache data (authentication data) is transmitted from the server 10 to the client 20 (S1).
0).

The client 20 receives the collation result (S11) and the bio cash data (S12). The bio-cache data is stored in the cache memory 25a of the storage unit 25. Next, the program control unit 26 operates and notifies the result through the application 40 (S14).

If there is no communication with the server in step S5 and no data is received in step S6, the cache data is searched (S1).
5) Then, the bio-data collation unit 23 collates the bio-data based on this cache data (S16). Then, it progresses to step S13.

FIG. 4 is a block diagram showing another embodiment of the present invention. The same parts as those in FIGS. 1 and 2 are designated by the same reference numerals. In this embodiment, the client 2
By providing a database on the 0 side, data collation can be performed without the need for a server. In the figure, 22 is a biosensor driver, 23 is a biodata collating unit, 24 is a biodata converting unit, 26 is a program control unit, 40 is an application, and 50 is a database. The database 50 includes a bio-authentication data registration table 41 and a user table 42. The configurations of the bio-authentication data registration table 41 and the user table 42 are the same as those of the bio-authentication data registration table 31 and the user table 32 in FIG.

The operation of the system thus constructed will be described with reference to FIG. FIG. 5 is a diagram showing a second processing flow of the present invention. First, the application 40 makes a collation request (S1). As a result, the program control unit 26 is activated (S2). Each biosensor (bioreading device) is driven by the biosensor driver 22 and outputs biodata (S3).

The bio-data converter 24 receives the bio-data and performs a process of extracting a characteristic part (S4).
Next, the bio-data collation unit 23 collates the bio-data measured by the bio-sensor with the authentication data (S5). Next, the collation result is determined (S6). Next, the program control unit 26 operates and notifies the result through the application 40 (S8).

FIG. 6 is an explanatory diagram of the first data flow.
In the figure, 10 is a server, and 30 is a database connected to the server 10. In the database 30,
N pieces of authentication data # 1 to #N are provided, and each of the pieces of authentication data is provided with user authentication data for each user. 20 'is a client with a plurality of bio-readers (biosensors), # 1
N readers up to #N are attached. 20
Is a client with a single-function reading function,
It is a client with a single-function reader. Reference numeral 60 denotes an authentication server program that authenticates the user using the authentication data, and is provided in the server 10 (the same applies hereinafter). The following operations are mainly performed by the authentication server program 60. N kinds of bio data are read from a plurality of clients with a bio reader 20 '. Here, when there are a plurality of users, N types of biodata are read for each user. As a result, as shown in the database 30, each authentication data is obtained for each user and stored in the database 30. Here, an authentication request is issued from the arbitrary client 20 to the server 10. In this case, since the database 30 stores a plurality of types of authentication data for each user, any client can make an authentication request. The authentication server program 60 collates the data sent from the client 20 with the corresponding authentication data. In this case, since the authentication data is stored for each user, it is necessary to input the user ID indicating which user the authentication is made. The authentication server program 60 sends the verification result to each client 20.

According to this embodiment, the server 10 can collate the bio data and the authentication data as necessary and notify the client 20 of the result. FIG. 7 is an explanatory diagram of the first processing of the present invention. The same parts as those in FIG. 2 are designated by the same reference numerals. In this embodiment, the final authentication is decided by taking the logical condition of the matching result according to the importance. For example, as shown in the figure, when the degree of importance is low, if any one of the N pieces of biodata is verified, it is determined that the authentication is OK. That is, in this case, the OR of each authentication result is taken. In such a case, for example, Windows
(Fingerprint Match) OR when simply accessing Windows, such as (registered trademark) logon
If there is even one match such as (voiceprint matching) OR (face matching), the authentication is OK.

On the other hand, if the degree of importance is high (for example, the settlement of workflow work), the condition that the collation is OK is tightened. That is, the authentication is OK when all the N pieces of bio-data are collated. Specifically, authentication is OK when all are matched such as (fingerprint match) AND (voiceprint match) AND (face shape match).

FIG. 8 is a diagram showing a third processing flow of the present invention. First, the operation when the degree of importance is small will be described. In this case, first, the first authentication is requested (S
1). As a result, the first authentication is started (S2). If the authentication is OK, it is immediately determined that the person is the person (S3). If the authentication is NG, the process returns to step S1 to start the process of requesting the authentication of the next authentication data. If all the authentications are NG, or if the authentications are cancelled, it is determined to be another person (S4).

Next, the operation when the importance is the highest will be described. First, a first authentication request is made (S10),
First authentication is started (S11). If the authentication is OK, a second authentication request is made (S12). Then, the second authentication is started (S13). If this authentication is OK, a third authentication request is issued. The above processing is performed up to the Nth authentication. That is, the Nth authentication request is made (S1
4) Then, the Nth authentication is started (S15). And the Nth
If the result of authentication is OK, it is determined that the person is the person (S1).
6). Here, in step S15, the fact that the Nth authentication is OK means that all the authentications from the 1st to the Nth are OK. In the above process, if the authentication is NG, the process returns to step S10 and authentication is performed again from the beginning. If the authentication is canceled in each of the authentication steps, it is determined to be another person (S1).
7).

According to this embodiment, a plurality of bio-authentications can be combined and the degree of authentication can be set according to the application. In addition, strict personal authentication can be performed in a system for handling high-priced products on the electronic approval or the Internet that carries out high-value payment processing.

Next, an authentication method using the authentication type combination information will be described. The combination of authentication types is
It can have both server side and client side. FIG. 9 is a diagram showing a fourth processing flow of the present invention. As the system, FIG. 2 is used. When a collation request is issued from the application 40 (S1), the control is performed by the program control unit 2
The process moves to 6 (S2). Next, the authentication bio or the number of authentication requests is determined (S3). Next, the biosensor is searched for what kind of biosensor is provided (S4).

When the biosensor is provided, the biosensor to be used is determined (S5). When the biosensor is determined, the biosensor driver measures biodata (S6). Then, the bio data is read (S7). The biodata conversion unit 24 performs biodata conversion on the read biodata to extract a characteristic portion (S8). Next, the read bio data is collated with the authentication data stored in the database (S9).

Next, the collation result is judged (S1).
0). When the collation result is determined, the control is transferred to the program control unit 26 (S11), and the application 4
The result is notified through 0 (S12). If the biosensor cannot be searched in step S4, control is passed to the program control unit 26 (S13). Then, the result is notified through the application 40 (S14).

FIG. 10 is a diagram showing a configuration example of an application information table in the case where the server side has the authentication type combination information. As shown in the figure, bio-authentication data is stored for each application name. For example, bio-authentication data 1 in application 1
In, the bio-authentication data is bio # 1 data.

FIG. 11 is a diagram showing the combination information of the authentication types held by the application when the application side has the combination information of the authentication types. Figure 1
2 is an explanatory diagram of the flow of the second data. The same parts as those in FIG. 6 are designated by the same reference numerals. In the figure, 33a is an application information table shown in FIG. The setting information of the application and the biometric authentication is set by the setting client 20 in the application information table 33.
Register with. The application information table 33
Can set multiple bio data. For example, bio 1 + bio 2 etc. The user makes an authentication request through the application 1. The application and bio-related information is registered in the application information table 33 from the application 1 or N. Return the application and bio related information to the application 1. Application 1 returns bio 1 authentication.

After that, the read bio-data is sent to the bio-authentication server 10 for verification. FIG. 13 is a diagram showing a processing flow of a series of authentications, showing an operation on the client side. When an authentication request is made (S1), biodata is read and an authentication means is determined (S2). Next, when the first authentication request is made (S3), the first authentication is started (S4). Then, the following processing is sequentially repeated. Then, a request for authentication is made (S5), biodata is read, and an authentication means is determined (S5).
6). Then, the Nth authentication request is made (S7), and the Nth authentication request is made.
Authentication is started (S8). Then, if the authentication is OK, it is determined that the person is the person (S9).

Here, if the first authentication is NG in step S4, it is checked whether or not to perform authentication again (S).
10). To authenticate again, return to step S1,
If the user is not authenticated, it is determined to be another person (S11). In the case of step S12 as well, it is checked whether or not to authenticate again (S12). If the authentication is performed, the process returns to step S1. If the authentication is not performed, it is determined to be another person (S13). here,
If the authentication is canceled at the start of each authentication, it is determined that the user is another person (S14), and the process ends. According to this embodiment, the versatility of the program can be ensured by setting the mechanism for calling a plurality of multi-bios in advance. Server management is effective when the authentication document can be fixed according to the quality and operation of the bio-information of the person, and it is possible to centrally manage the combination information of the authentication types. Further, the application side management can be individually adjusted according to the required security strength.

FIG. 14 is a diagram showing the processing flow of the individual authentication chart, showing the operation on the client side. In this processing flow, the system shown in FIG. 12 is used to perform authentication using the individual authentication chart. First, when a request for authentication is made (S1), biodata is read and an authentication means is determined (S2). Next, a first authentication request is made (S3). Then, the first authentication is started (S4). If the first authentication is OK, proceed to the next.

If the authentication is NG in step S4, it is checked whether or not to perform authentication again (S5).
To authenticate again, the process returns to step S1 and the authentication request is made again. If authentication is not performed again, it is determined that the user is another person (S6). Such a sequence is repeated by the number of authentication means. Then, each time, the processing of steps S5 and S6 when the authentication is NG is repeated.

If the first authentication is OK, an authentication request is made (S7). Then, the bio data is read and the authentication means is determined (S8). Then, the Nth authentication request is made (S9), and the Nth authentication is started (S1).
0). If the Nth authentication result is OK, it is determined that the person is the person (S11). If the authentication result is NG, it is checked whether to authenticate again (S13). To authenticate again, the process returns to step S7 and the authentication request is made again. If authentication is not performed again, it is determined that the user is another person (S14). In addition, in the case of canceling by authentication, it is determined that the person is another person (S12). The data flow explanatory diagram (third data flow explanatory diagram) in this embodiment is the same as the second data flow explanatory diagram shown in FIG.

According to this embodiment, it is effective when the authentication type can be fixed according to the bio-information quality and operation of the person, and it is possible to centrally manage the combination information of the authentication types. Also, application side management is
Individual adjustment is possible according to the required security strength.

Next, the next embodiment will be described. In the following embodiments, the detection means is determined for each client, only one detection means is provided for each client, and the authentication time is fixed to prevent unauthorized access from the client side and to perform authentication. It is designed to shorten the time.

FIG. 15 is a diagram showing an example of the structure of a client information table used in this embodiment. The type that can be authenticated is fixed for each client. For example,
In the case of the biometrics authentication data 1, only the bios # 1 data can be authenticated by the client 1.

FIG. 16 is an explanatory diagram of the fourth data flow. The setting information of the client and biometrics is registered in the client information table 34 from the setting client 20. Here, a plurality of bio data can be set in the client information table 34. For example, bio 1 + bio 2 etc. The user makes an authentication request through the application 1. The related information of the client and the bio is acquired from the application 1 or N to the client information table 34. Returns the client and bio related information to the application 1. Application 1 returns bio 1 authentication.

After that, the read bio data is sent to the bio authentication server 10 for verification. According to this embodiment, by fixing the authentication means, it is possible to prevent unauthorized access from the client. Further, it is possible to shorten the authentication time when the access time is long, such as a remote place or a place where the communication speed is slow.

FIG. 17 is an explanatory diagram of the fifth data flow. In this embodiment, the individual authentication chart is used for authentication. The same parts as those in FIG. 16 are designated by the same reference numerals. The setting information of the client and biometrics is registered in the client information table 34 from the setting client 20. A plurality of bio data can be set in the client information table 34. For example, bio 1 + bio 2
etc. The user makes an authentication request through the application 1. The information related to the client and the bio is acquired from the application 1 or N to the client information table 34. Return the information related to the client and the bio to the application 1. Application 1 returns bio 1 authentication.

After that, the read bio-data is sent to the bio-authentication server for verification. According to this embodiment, by fixing the authentication means, it is possible to prevent unauthorized access from the client.

Next, a case will be described in which the recognition rate at the time of data matching is provided with authentication accuracy. FIG. 18 is a diagram showing an example of the configuration of a biometrics data registration table. In this table, the authentication rate is changed for each biodata. FIG. 19 is a diagram showing a configuration example of the biometrics authentication user information table. This table is provided with the biometric authentication accuracy corresponding to each user. For example, when the user ID is 1, the authentication accuracy of bio # 1 authentication data is set to 70%, and the authentication accuracy of bio # N authentication data is set to 85%. Here, the bio-authentication data registration table is 35 and the bio-authentication user information table is 36. These tables are provided on the database 30 side of the server 10. Alternatively, it may be provided on each client side.

FIG. 20 is an explanatory diagram of the sixth data flow. An authentication accuracy log 37 stores the authentication accuracy at the time of verification. The setting client 20 defines authentication data regarding each biodata. Each client issues a collation request in ID units. The collation result is determined and compared with the authentication data defined by the server 10. At that time, the authentication accuracy is stored in correspondence with the authentication data. In this case, the method of obtaining the authentication accuracy at the time of matching is as follows. That is, 100 A / B, where A is the number of matching authentication data and B is the number of authentication at the time of matching
Calculate with (%). The authentication accuracy thus obtained is stored in the authentication accuracy log 37. The authentication data is transmitted to the client 20 together with the authentication result. At the next collation request, the authentication accuracy log is read from the bio-authentication server 10, and if the predetermined authentication accuracy is not retained, the authentication request client 20 is notified of an authentication data update request or an unusable notification.

According to this embodiment, it is possible to prevent erroneous recognition due to deterioration in accuracy of authentication data due to aging of a living body. FIG. 21 is an explanatory diagram of the seventh data flow. User 1 from setting client 20 to server 1
The operation when accessing 0 is shown. User 1 makes a registration request with the bio 1 data. The authentication server program 60 verifies the bio 1 data of the user 1. In this case, the system administrator will be present to verify the first biodata. The verification result is returned from the authentication server program 60 to the client 20. When authenticated, the biodata N registration permission is given and the biodata N of the user 1 is registered in the database 30. If not authenticated, the bio N data cannot be registered for the user 1.

According to this embodiment, when the second and subsequent biodata items are registered in the multi-biosystem, the biodata items are registered without the need for a system administrator, which complicates registration. Can be avoided.

In the next embodiment, the user does not have to select the type of biodata at the time of matching. For this purpose, a bio-authentication user collation order table as shown in FIG. 22 is used. In this table,
The collation order is determined for each user ID. For example,
In the case of the user 1, the verification using the biodata 1 is performed first, and then the verification using the biodata 2 is performed. Finally, the collation using the bio data N is performed. In the case of the user 2, the biometric data 2 is collated first, the biometric data 4 is collated secondly, and the biometric data 1 is collated last.

FIG. 23 is an explanatory diagram of the eighth data flow. In the figure, 38 is the above-mentioned bio-authentication user collation order table, which is provided in the database 30. When registering biodata, the order of biodata to be collated is defined for each user ID. The client 20 makes a verification request. The authentication server program 60 sends the sent user I
Based on D, the collation order of the multi-bio is determined from the collation order table 38 (-1) and returned to the client 20 side (-2). The client 20 searches the biosensor in the client 20 according to the collation order, reads biodata, and makes a collation request. The server 10 side collates the sent bio data, and notifies the collation result to the client 20.

According to this embodiment, it is possible to save the labor of selecting the bio-recognition device to be collated in the system handling the multi-bio device. Also, in a system that handles multi-bio devices, once you set the collation order,
All clients can share the same settings. Furthermore, in a system that handles multi-bio devices, it is possible to set the priority of the order of matching.

The next embodiment will be described. The matching method described above is called 1: 1 matching. That is, it is a collation method in which after inputting a user ID, the user ID is collated with registered biodata to confirm the identity of the ID.

On the other hand, the 1: N collation is a collation method that collates the biodata requested to collate with all the registered biodata and identifies the person from the biodata (biodata). The one that identifies the person only).

FIG. 24 is a diagram showing an example of the authentication screen. There is a portion for inputting a user name (user ID field), and an authentication button, a cancel button, an end button, etc. are provided. User ID in case of 1: 1 collation above
It is necessary to enter the user ID in the field. Figure 25
FIG. 7 is an explanatory diagram of incorporation into a system login. Log in by writing the user ID in the user ID field.

FIG. 26 is a flow chart showing the operation of the collation processing. As the system, FIG. 2 is used. First,
Request authentication from the application 40 (S
1). As a result, control is transferred to the program control unit 26.
The client 20 reads biodata (S3). Next, the client 20 determines whether the ID has been input (S4).

When the ID is input, the server 10 searches biodata registered in advance based on the ID (S5). Then, the read bio data is collated with the registered bio data searched in step S5 (S6). Next, the collation result is determined (S
7). Then, the collation result is returned to the request application 40 (S8).

If the ID is not input in step S4, the ID cannot be specified. Therefore, all the bio-data registered in advance and the bio-data read in step S3 are collated (S9), and step S
7 (1: N verification).

In the above-mentioned flowchart, the configuration shown in FIG. 2 has been described, but the present invention is not limited to this, and the configuration shown in FIG. 4 can also be applied.
In this case, the database 50 is provided on the client 20 side.
Is provided, all the sequences shown in FIG. 26 can be performed on the client 0 side.

According to this embodiment, since the search time in the collation can be shortened, in the collation in the multi-bio system, the efficiency of the bioreader retrieval and the collation can be improved.

Further, if the user ID is not notified, by collating with all the bio-data registered in advance, the person can be identified even when there is no user ID.

In the next embodiment, the collation is performed based on the registered data of the type of biodata that matched last time. A bio-authentication log data table 39 as shown in FIG. 27 is used to view the previous verification history. This table stores bio-authentication data, operation date, operation type, and result for each user ID. By referring to the bio-authentication log data table 39, the authentication data when the verification result is OK is used.

FIG. 28 is an explanatory diagram of the ninth data flow. In the figure, 39 is a bio-authentication log data table, which is provided in the database 30. The user 1 makes an inquiry request to the authentication server program 60. The authentication server program 60 searches the bio-authentication log data table 39 and acquires the bio-authentication type information of the previously matched user 1. The authentication server program 60 collates with the bio data N. The collation result is notified to the client 20.

According to this embodiment, in the case of the authentication of a combination of a plurality of types of biodata, the search time for collation can be shortened. In the following embodiment, when the client makes a collation request to the server,
In addition to the biodata, the bioreader information is also transferred together. FIG. 29 is an explanatory diagram of the tenth data flow. In the figure, reference numeral 70 denotes a reader information data table, which stores biodata corresponding to each reader. When reading the bio-data, the bio-reading device information is also read and a verification request is made to the authentication server program 60. The server 10 uses the reading device information data table 70.
The read bio-data is determined with reference to, and the bio-authentication type data is returned to the authentication server program 60. Based on the returned information, the verification data is compared with the measured bio data. The matching result is notified to the client 20.

According to this embodiment, since the retrieval time in the collation can be shortened, in the collation in the multi-bio system, the bioreader retrieval efficiency and the collation efficiency can be improved.

The next embodiment will be described. In this embodiment, the authentication data originally held on the server side is transferred to the client side, and the authentication data is held on the client side so that only the client can collate the data. It was done.

FIG. 30 is an explanatory diagram of the eleventh data flow. In this embodiment, a storage device 80 is provided on the client 20 side, and the bio data from the database 30 is stored in this storage device together with the date data. The client 20 makes a verification request using the biodata 1. The verification result on the server 10 side is notified to the client 20 side. The authentication server 10 compares the server date data with the client date data. When the date data on the server 10 is newer than the date data on the client 20 side, the bio data of the verification requesting user is downloaded (cached) to the client 20. If they are the same, do not download.

According to this embodiment, it is possible to reduce an excessive load on the authentication server and the network.

[0091]

As described above, according to the present invention, the following effects can be obtained. (1) According to the invention described in claim 1, the biometric data sent from the client can be compared on the server side with the data stored in the biometric authentication data registration table. Further, since the collation result is notified to the client side, the result can be recognized on the client side.

(2) According to the invention described in claim 2, collation can be performed on the client side, and the memory capacity required on the client side can be small. (3) According to the invention described in claim 3, the server can collate the biodata and the authentication data as necessary, and notify the client of the result.

(4) According to the invention described in claim 4, it is possible to set a high or low degree of authentication according to the use by combining a plurality of bio-authentications. In addition, strict personal authentication can be performed in a system for handling high-priced products on the electronic approval or the Internet that carries out high-value payment processing.

(5) According to the fifth aspect of the invention, the versatility of the program can be ensured by presetting the mechanism for reading a plurality of multi-biodata. (6) According to the invention described in claim 6, it is possible to perform authentication from the application on the client side.

(7) According to the invention of claim 7, the server management is effective when the authentication type can be fixed according to the bio-information quality and operation of the person, and the combined information of the authentication types can be centrally managed. Can be

(8) According to the invention described in claim 8, since a plurality of authentications are not performed, it is possible to prevent unauthorized access from the client by fixing the authentication means. Further, it is possible to shorten the authentication time when the access time is long, such as a remote place or a place where the communication speed is slow.

(9) According to the invention described in claim 9, by fixing the authentication means, it is possible to prevent unauthorized access from the client. (10) According to the tenth aspect of the present invention, it is possible to prevent erroneous recognition due to deterioration in accuracy of authentication data due to secular change of a living body.

(11) According to the invention of claim 11,
In the multi-bio system, when registering the second and subsequent bio data, the bio data is registered without the need for a system administrator, so that the complexity of registration can be avoided.

(12) According to the invention of claim 12,
In a system that handles multi-bio devices, it is possible to save the trouble of selecting a bio-recognition device to be collated. Further, in a system that handles a multi-bio device, once the order of collation is set, all clients can share the same setting. Furthermore, in a system that handles multi-bio devices,
You can set the priority of the matching order.

(13) According to the invention of claim 13,
Since the search time in the matching can be shortened, the efficiency of the bio-reading device search and the matching can be improved in the matching in the multi-bio system.

(14) According to the invention of claim 14,
The person can be identified even when there is no user ID. (15) According to the fifteenth aspect of the present invention, in the case of authentication of a combination using a plurality of types of biodata, it is possible to shorten the search time in collation.

(16) According to the invention of claim 16,
Since the search time in the matching can be shortened, the efficiency of the bio-reading device search and the matching can be improved in the matching in the multi-bio system.

(17) According to the invention of claim 17,
It is possible to reduce an excessive load on the authentication server and the network. (18) According to the eighteenth aspect of the invention, the result of authentication by the server can be confirmed on the client side.
In this case, in the bio-authentication data registration table,
If the same type of authentication data as the biodata reading function of the client is registered, the client can authenticate.

As described above, according to the present invention, any client can be authenticated if authentication data of the same type as the biodata reading function of the client is registered. And a data authentication device can be provided.

[Brief description of drawings]

FIG. 1 is a principle block diagram of the present invention.

FIG. 2 is a block diagram showing an embodiment of the present invention.

FIG. 3 is a diagram showing a first processing flow of the present invention.

FIG. 4 is a block diagram showing another embodiment of the present invention.

FIG. 5 is a diagram showing a second processing flow of the present invention.

FIG. 6 is an explanatory diagram of a first data flow.

FIG. 7 is an explanatory diagram of the first processing of the present invention.

FIG. 8 is a diagram showing a third processing flow of the present invention.

FIG. 9 is a diagram showing a fourth processing flow of the present invention.

FIG. 10 is a diagram showing a configuration example of an application information table.

FIG. 11 is a diagram showing authentication type combination information held by an application.

FIG. 12 is an explanatory diagram of a second data flow.

FIG. 13 is a diagram showing a processing flow of a series of authentications.

FIG. 14 is a diagram showing a processing flow of an individual authentication chart.

FIG. 15 is a diagram showing a configuration example of a client information table.

FIG. 16 is an explanatory diagram of a fourth data flow.

FIG. 17 is an explanatory diagram of a fifth data flow.

FIG. 18 is a diagram showing a configuration example of a bio-authentication data registration table.

FIG. 19 is a diagram showing a configuration example of a bio-authentication user information table.

FIG. 20 is an explanatory diagram of a sixth data flow.

FIG. 21 is an explanatory diagram of the seventh data flow.

FIG. 22 is a diagram showing a configuration example of a bio-authentication user collation order table.

FIG. 23 is an explanatory diagram of an eighth data flow.

FIG. 24 is a diagram showing an example of an authentication screen.

FIG. 25 is an explanatory diagram of incorporation into a system login.

FIG. 26 is a flowchart showing the operation of the matching process.

FIG. 27 is a diagram showing a configuration example of a bio-authentication log data table.

FIG. 28 is an explanatory diagram of the ninth data flow.

FIG. 29 is an explanatory diagram of the flow of the tenth data.

FIG. 30 is an explanatory diagram of the eleventh data flow.

[Explanation of symbols]

10 servers 11 Communication means 20 clients 21 Communication means 25a cache memory 30 databases 31 Bio-authentication data registration table

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Hideo Yamamoto             6-26-1, Minamioi, Shinagawa-ku, Tokyo Fuji             Totsu Support and Service Co., Ltd. (72) Inventor Mitsuhiro Nomura             6-26-1, Minamioi, Shinagawa-ku, Tokyo Fuji             Totsu Support and Service Co., Ltd. (72) Inventor Masahiro Kitazawa             6-26-1, Minamioi, Shinagawa-ku, Tokyo Fuji             Totsu Support and Service Co., Ltd. F-term (reference) 5B085 AE02 AE06 AE23 AE25                 5J104 AA07 KA01 KA16 PA07

Claims (18)

[Claims] 1. A database authentication system in which a server and a plurality of clients are connected via a network, wherein the server comprises a bio-authentication data registration table for storing bio-authentication data for each user, and the client includes , A data authentication device comprising a cache memory for storing authentication data transferred from a server. 2. In a system capable of authenticating a plurality of types of biodata, the client requests the server for the authentication data, and when the authentication data is sent from the server side, the data is stored in a cache memory. 2. The data authentication device according to claim 1, wherein the data is stored and collated with the data measured by the biodata reading device based on the authentication data stored in the cache memory. 3. The server requests the client for the biodata of the biodata reader, and the server compares the sent biodata with the authentication data stored in the database and outputs the result. The data authentication device according to claim 1, wherein the data authentication device is notified to the client. 4. A system capable of authenticating with a plurality of types of biodata, wherein a plurality of types of biodata are read, and the final authentication is determined by taking the logical condition of the verification result of each of them. Method. 5. A system capable of authenticating with a plurality of types of bio-data, storing and managing combination information of authentication types in a server, and reading the information when connecting to an application for authentication. Method. 6. In a system capable of authenticating with a plurality of types of biodata, the application side holds and manages the authentication type combination information, and at the time of an authentication request, the application side transfers the authentication type combination information to the server for authentication. A data authentication method characterized by performing. 7. The data authentication method according to claim 5, wherein the authentication is based on an individual authentication chart. 8. A data authentication method, characterized in that detection means is set for each client and the authentication means is uniquely determined. 9. The data authentication method according to claim 8, wherein the system is authenticated by an individual authentication chart. 10. In a system capable of authenticating with a plurality of types of biodata, the authentication accuracy log holds the authentication accuracy or the number of matches and verifications of the authentication data, and regarding the authentication data below a predetermined authentication accuracy,
If there is a verification request and the authentication result is NG,
A data authentication method characterized by making a request for updating the authentication data and rewriting the authentication data to the verification data at that time or the authentication data created from the verification data. 11. When registering the authentication data of a system capable of being authenticated by a plurality of types of biodata, the user requesting the registration has already registered the authentication data 1
A data authentication method, characterized in that if the number of the authentication data is equal to or more than one, and if it is determined that the user is the authentic person by the authentication based on the registered authentication data, the unregistered authentication data can be newly registered. 12. A data authentication method, characterized in that in a system capable of authenticating with a plurality of types of bio data, a bio collation order for performing authentication at the time of registration of authentication data is predetermined and registered. 13. In a system capable of authenticating with a plurality of types of biodata, the user ID is notified to the authentication system when the application and the authentication at the time of logging in to the system are performed, and the user ID is requested when the personal authentication is requested. A data authentication method, characterized in that biodata registered in advance based on the above is read and the biodata read from the biosensor for a verification request is verified. 14. When the user ID is not notified and the biodata is read from the biosensor and transmitted to the biodata collating unit, all the biodata registered in advance for the corresponding biodata type. 14. The data authentication method according to claim 13, wherein the verification is performed. 15. In a system capable of authenticating with a plurality of bio data, a method of collating registered bio data with a user ID input for a collation request and bio data read from a biosensor, the method is the same as the previous method. A data authentication method, characterized in that verification is performed from registered data of the type of biodata that has been obtained. 16. A method capable of authenticating with a plurality of types of biodata, in which a biodata is read from a biosensor and then collated with all biodata registered in advance. If there is only a verification request, the biometric data to be verified is determined from the data obtained by adding the bioreader information to the biodata sent as the verification request, and the biometric data is verified with the specific biodata. . 17. In a system comprising a server holding authentication data registered by a client and a client connected to the server via a network, the client has data reading means for authentication and is preset. In the system that transfers the authentication data input from the authentication data input means to the authentication server at the timing of the authentication performed, collates the authentication data with the authentication data sent from the client, and sends the result to the client once in the server. If you authenticate and judge that it is the same as the principal, you send the authentication data registered in the server to the client, the client retains the data, and at the time of subsequent authentication, the authentication data held by the client and the input authentication data A data recognition device characterized by being compared. 18. In a system in which a bio-authentication server and a plurality of clients are connected, when the server performs collation, caching data based on the collation result is transferred to the client side. .