JP2004151977A - Biometric authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve convenience in response to businesspersons' need for effective time use, and increase sales through efficient business, by providing a biometric authentication system capable of inexpensively configuring an environment where an employee as a user can safely use server resources in the company from outside the company. <P>SOLUTION: The biometric authentication system comprises an authentication server for executing biometric authentication processing according to biometric authentication reference data stored in storing means, an entry server capable of communication with the authentication server and functioning as an entry when a user accesses a local system used, and an operating terminal capable of communication with the entry server and operated by the user. The operating terminal sends, as biometric authentication data, biometric information about the user read by biometric reading means disposed in the operating terminal, the authentication server executes the biometric authentication processing on the received biometric authentication data and sends authentication result data to the entry server, and the entry server determines a right of the operating terminal or user to access to the local system according to the authentication result data. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a computer terminal generally provided in an Internet cafe or the like, a computer terminal installed in a private house, an access by a notebook PC brought by a hot spot service provided in a hotel or the like, and the like. The present invention relates to a biometric authentication system, a terminal program, an entrance server program, an operation terminal, an authentication server, and a recording medium that authenticates an access to an in-house system based on an authentication result and authorizes access to the in-house system.
[0002]
[Prior art]
In recent years, with the development of computers, the use of computers in a network mode in which server resources are used by client terminals in a client-server system has been firmly established.
[0003]
In the use in this network form, the client terminal accessing the server is limited to a legitimate terminal, that is, security measures for preventing unauthorized access to the server are emphasized, and the user is authenticated by an ID and a password. Such an authentication system is generally used.
[0004]
Recently, an authentication system using biometric information (biometrics information) has been proposed as a method of improving the authentication level in the authentication system (see Patent Document 1).
[0005]
On the other hand, with the development of the Internet technology, it is desired that a user can easily browse the homepage and check e-mail using the Internet even on the go. In response to this, hotels and the like provide an Internet connection environment using a wireless LAN or a wired LAN, and a hotspot service that allows the user to connect to the Internet with a laptop computer brought in, and a free PC (personal computer) installed. Internet cafes and other services are available.
[0006]
As a method of improving the authentication level in such an Internet environment, an authentication system that uses authentication based on biometric information in a shopping mall on the Internet has been proposed (see Patent Document 2).
[0007]
[Patent Document 1]
JP 2001-344212 A
[Patent Document 2]
JP-A-2001-31476.
[0008]
[Problems to be solved by the invention]
However, in the former authentication system, the server itself in which resources used by the client terminal are stored executes the authentication processing. For this reason, in a distributed environment where resources are distributed and used by a plurality of servers, it is necessary to perform authentication processing when connecting to server A and perform authentication processing again when connecting to server B. It has become an unfamiliar authentication system at present.
[0009]
Further, the latter authentication system does not allow access to a server used in the company via the Internet even though there is an environment where the Internet can be connected. That is, if a server is made public on the Internet so that an in-house server can be accessed in an Internet cafe or the like, there is a threat such as unauthorized access, but this cannot be avoided. For this reason, even if an employee wants to use internal server resources when away from home, in order to realize this safely, for example, a token card whose password changes with time is distributed to each employee and a one-time password is used. Significant capital investment was required, such as certification. Further, there are problems such as troublesome input of a different password every time, and troublesome management such as dealing with loss management of a token card.
[0010]
The present invention has been made in view of the above problems, and provides a biometric authentication system capable of constructing, at a low price, an environment in which an employee who is a user can safely use server resources in a company from outside the company. In addition to improving convenience in response to the demands of the above, the purpose is to increase sales by increasing the efficiency of operations.
[0011]
[Means for Solving the Problems]
The present invention provides an authentication server that performs biometric authentication processing based on biometric authentication reference data stored in a storage unit, and an entrance (portal site or the like) for accessing a local system communicable with the authentication server and used by a user. And an operation terminal operable by a user that can communicate with the entrance server. The operation terminal reads biometric information of the user read by biometric reading means provided in the operation terminal. The authentication server executes the biometric authentication process on the biometric authentication data received by the authentication server and transmits authentication result data to the entrance server, and the entrance server executes the operation terminal based on the authentication result data. Alternatively, the biometric authentication system determines an access right of the user to the local system.
[0012]
The biometric authentication process includes a voice authentication such as a fingerprint authentication for authenticating using a fingerprint as biometric information or a vocal cord authentication for authenticating using a vocal cord as biometric information.
[0013]
The biometric authentication data includes transmitting from the operation terminal to the entrance server and transferring the entrance server to the authentication server, or transmitting the biometric authentication data directly from the operation terminal to the authentication server.
[0014]
Thereby, the biometric information of the user can be read by the biometric reading means, the user can be authenticated based on the biometric information and access to the local system can be permitted, and a plurality of resources such as a server in the local system can be used. It can be used safely from remote locations. By using the biometric information, for example, when a notebook PC is used as the operation terminal, even if the notebook PC is lost, the biometric information can only be used by the person himself / herself, so that the biometric information can be used safely.
In particular, in the case of using a fingerprint, there is an advantage that there is no need to make a voice as in the case of voice and that the fingerprint can be easily used even in a quiet place.
[0015]
As a preferred embodiment, the operation terminal can execute the encryption processing of the biometric authentication data, and the authentication server can execute the decryption processing of the encrypted biometric authentication data.
[0016]
Thus, when the biometric data required for authentication is eavesdropped on a communication path such as the Internet, the original biometric data cannot be decrypted, thereby preventing unauthorized use of the biometric data.
[0017]
Further, the present invention defines a biometric information reading process for reading biometric information of a user and a transmitting process for transmitting the read biometric information as biometric data to be installed in the operation terminal used in the biometric authentication system. Terminal program.
[0018]
This makes it possible to install the terminal program on a general computer such as a PC or a workstation and use it for a biometric authentication system.
[0019]
Further, the present invention can be an operation terminal in which the terminal program is installed.
This makes it possible to use the biometric authentication system with the operation terminal.
[0020]
Also, the present invention provides an access right determination for determining an access right to the operation system or the user to the local system based on received authentication result data to be installed in the entrance server used in the biometric authentication system. It can be an entrance server program that defines the processing.
[0021]
As a result, it becomes possible to install the entrance server program on a computer such as a general PC or workstation and use it for a biometric authentication system.
[0022]
Further, the present invention can be an entrance server in which the entrance server program is installed.
This makes it possible to use a biometric authentication system at the entrance server.
[0023]
Further, the present invention provides a biometric authentication process for authenticating received biometric authentication data based on biometric authentication reference data to be installed on the authentication server used in the biometric authentication system, and a result of the biometric authentication process as an authentication result. An authentication server program that defines a result transmission process of transmitting data can be provided.
[0024]
As a result, it becomes possible to install the entrance server program on a computer such as a general PC or workstation and use it for a biometric authentication system.
[0025]
Further, the present invention can be an authentication server in which an authentication server program is installed.
This makes it possible for the biometric authentication system to execute the biometric authentication process by the authentication server.
[0026]
In addition, the present invention can be a recording medium storing any one of the programs.
Accordingly, the operation terminal, the entrance server, and the authentication server used in the biometric authentication system can be spread by placing the program on a distribution channel using a recording medium storing the program.
[0027]
【The invention's effect】
According to the present invention, resources such as business information, business information, sales information, and customer information are distributed to a plurality of servers in a local system such as a business system used in a company, a sales system, an estimation system, and a production system. Even if an employee wants to use the above resources from outside the company, it is safe to authenticate the employee or the operating terminal used by the employee without changing the system configuration in the existing company almost. And the availability of the local system can be improved by effectively utilizing the resources.
[0028]
BEST MODE FOR CARRYING OUT THE INVENTION
An embodiment of the present invention will be described below with reference to the drawings.
First, the system configuration of the fingerprint authentication system 1 will be described with reference to the system configuration diagram shown in FIG.
[0029]
The fingerprint authentication system 1 comprises main components of a web server 11 and a client terminal 51 connected to the Internet 2 and an authentication server 21 connected to the web server 11 by a dedicated line.
[0030]
The WEB server 11 is connected to a LAN of an in-house system built in the company, and the in-house system includes various servers storing a core database and a business database. Is connected to an employee terminal (comprising a PC, not shown) used by the employee.
[0031]
Also, in the figure, the WEB server 11, the authentication server 21, and the client terminal 51 are illustrated one by one, but a plurality of the WEB servers 11 and the client terminals 51 can be connected. Also in this case, the added WEB server 11 secures a connection to the Internet 2 and a dedicated line connection to the authentication server 21, and the added client terminal 51 may connect to the Internet 2. As a result, one authentication server 21 is managed by a certificate authority, and the fingerprint authentication system 1 can be provided to a plurality of companies. In a company, there is no need to manage the reference fingerprint data in the authentication server 21, and the fingerprint authentication system 1 can be easily used.
[0032]
Necessary programs and data such as a registration information database 22 and an authentication server fingerprint authentication program 25 are already installed in the authentication server 21 using an installation CD-ROM 24 for the authentication server. Execute In addition, since the authentication server 21 is managed by a certificate authority, the developed programs and data are copied from a recording medium such as a MO (Magneto Optical disk) instead of a CD-ROM, and the environment is manually set. It doesn't matter.
[0033]
The authentication server 21 executes a fingerprint authentication process (described later) in response to an authentication request from the WEB server 11, and returns an authentication result. The authentication server 21 includes a registration information database 22 and stores reference fingerprint data as a reference for performing fingerprint authentication of a user.
[0034]
Here, the registration information database 22 will be described. The registration information database 22 stores a registration fingerprint table 23 shown in the table structure explanatory diagram of FIG.
[0035]
The registered fingerprint table 23 stores fields such as a unique ID, a user ID, a name, a name kana, a postal code, an address, a telephone number, an E-mail, reference fingerprint data, and a registration date which are numbered for each data registration. Have.
[0036]
The reference fingerprint data includes characteristic information such as the direction of the fingerprint existing in the user's fingerprint, and is configured by feature points obtained by extracting the information.
[0037]
By registering the personal information of the user in this way, for example, if the registered fingerprint of the right thumb becomes unusable due to injury, etc., the fingerprint to be authenticated is changed to the left thumb or the right finger. You can identify yourself.
[0038]
The authentication server 21 stores a secret key so that the client terminal 51 can decrypt the encrypted data. The public key corresponding to this secret key is sent to the client terminal 51 in advance by a secure method such as registered mail.
[0039]
The client terminal 51 is a PC provided in an Internet cafe, and has a fingerprint reader 52 connected by USB. The fingerprint reading device 52 is a scanner that reads a fingerprint, and includes a reading unit 52a that performs scanning. The fingerprint reading device 52 presses a finger such as a thumb on a user to read the fingerprint.
In this way, the authentication server 21 stores and strictly manages the registered fingerprint table 23 necessary for fingerprint authentication.
[0040]
Necessary programs and data are already installed in the WEB server 11 and the client terminal 51 by using installation CD-ROMs 72 and 74 shown in a schematic perspective view of the fingerprint authentication software package 70 in FIG. Various processes are executed in accordance with.
[0041]
The fingerprint authentication software package 70 includes a technical manual 71 for the administrator of the web server 11 and an installation CD-ROM 72 for the web server, a user manual 73 for the user of the client terminal 51 and an installation CD-ROM 74 for the client, The user registration card 75 is enclosed in a package case 76.
[0042]
The installation CD-ROM 72 for the web server stores a server installation program, and installs necessary programs and data such as the access right database 12 and the web server fingerprint authentication program 15 on the hard disk of the web server 11. I do.
[0043]
The WEB server 11 has a firewall function, inquires of the user accessing from the Internet 2 to the authentication server 21, and gives an appropriate access right only to a legitimate user to access an in-house system. To give permission. The access right is granted with reference to the access right database 12 provided in the WEB server 11.
[0044]
Here, the access right database 12 will be described. The access right database 12 stores an access right table 13 shown in the table structure explanatory diagram of FIG.
[0045]
The access right table 13 includes a unique ID numbered for each access right setting, a user ID used by the user at the time of authentication, a class indicating a resource to which access is permitted, and an access for storing access right setting contents. It consists of four fields (items) of rights.
[0046]
For example, in the case of Mr. t_yamada, access to all resources of the in-house system is basically inaccessible (default setting), and individual business services are readable and writable for the business database and only referable to the core database. Access rights are set.
[0047]
As a result, an appropriate access right can be given to the user (user) authenticated by the fingerprint authentication, and the necessary and sufficient use of the in-house system can be permitted.
[0048]
The client installation CD-ROM 74 (FIG. 3) stores a client installation program, and installs necessary programs and data such as the client fingerprint authentication program 55 on the hard disk of the client terminal 51.
[0049]
As a result, the client terminal 51 receives fingerprint authentication, accesses the in-house system via the Internet 2, and can execute business processes such as business reports and transaction data confirmation from outside the company.
[0050]
The client terminal 51 stores a public key distributed from the authentication server 21. This makes it possible to encrypt the data to be transmitted.
[0051]
The WEB server 11, the authentication server 21, and the client terminal 51 are a control unit including a control device including a CPU, a ROM, and a RAM, a storage unit including a hard disk, a communication unit including a LAN board, a mouse and a keyboard. It is composed of a PC having input means, a display means comprising a CRT display, and a recording medium reading means comprising a CD-ROM drive. The above-mentioned program and database are stored in respective hard disks.
[0052]
With the above configuration, a user (employee) inputs a fingerprint on the reading unit 52a of the client terminal 51, receives fingerprint authentication on the authentication server 21, is granted access right on the WEB server 11, and enters the in-house system. It becomes possible to access. This allows the client terminal 51 to access the in-house system via the Internet 2 and execute business processes such as business reports and transaction data confirmation from outside the company.
[0053]
Next, the module configuration used by each program (15, 25, 55) will be described with reference to the module configuration diagram shown in FIG.
The WEB server 11 includes a business module, a business API (Application Program Interface), a coordination API, and communication middleware as modules used by the WEB server fingerprint authentication program 15.
[0054]
The authentication server 21 has a fingerprint authentication API, a coordination API, and communication middleware as modules used by the authentication server fingerprint authentication program 25.
[0055]
The client terminal 51 includes communication middleware, a business API, a coordination API, a fingerprint authentication API, and a fingerprint reading device as modules used by the client fingerprint authentication program 55.
With the above configuration, each program can efficiently execute various processes by using the modules (including the API, the middleware, and the device).
[0056]
Next, along with the processing flow diagram shown in FIG. 6, fingerprint authentication is executed using the client terminal 51, and the access right is granted, so that the resources of the in-house system can be used. Will be described below.
[0057]
When the user operates the client terminal 51 to activate the client fingerprint authentication program 55, the control device of the client terminal 51 accesses the WEB server 11 (step n1).
[0058]
The control device of the WEB server 11 activates the WEB server fingerprint authentication program 15 and requests the client terminal 51 that has accessed to transmit a user ID and fingerprint data as authentication data (step n2).
[0059]
The control device of the client terminal 51 executes an authentication data acquisition process to input a user ID and a fingerprint (step n3). In the authentication data acquisition processing, the user inputs a user ID with a keyboard as shown in FIG. 7A of the screen image explanatory view of FIG. 7, and a request is made on the screen as shown in FIG. Then, the user inputs a fingerprint using the reading unit 52a (FIG. 1).
[0060]
The fingerprint input at this time is converted into input fingerprint data (fingerprint information) in which the control device of the client terminal 51 captures characteristic information in the fingerprint and extracts characteristic points to be determined from the direction and the like.
[0061]
The control device of the client terminal 51 encrypts the authentication data composed of the acquired user ID and the input fingerprint data with the public key of the authentication server 21 (step n4), and transmits the encrypted data to the WEB server 11. A transmission process is performed (step n5). Note that a method such as a RSA (Rivest Shamir Adleman) method, an elliptic curve encryption method, or an ElGamal encryption method can be used for encryption, and another method may be used.
[0062]
The control device of the WEB server 11 transfers the received encrypted data to the authentication server 21 and executes an authentication request (Step n6).
The control device of the authentication server 21 decrypts the received encrypted data with the secret key managed by itself, acquires the authentication data (step n7), and executes the fingerprint authentication process (step n8).
[0063]
Here, the details of the fingerprint authentication processing will be described with reference to the processing flowchart of FIG. 8 showing the operation of the control device of the authentication server 21.
The control device of the authentication server 21 accesses the registered fingerprint table 23 (FIG. 2) of the registered information database 22 and searches for a record (data) having a matching user ID (step s1).
[0064]
If there is a matching record (step s2), the reference fingerprint data stored in the registration information database 22 is compared with the input fingerprint data acquired from the client terminal 51 at each feature point (step s3).
[0065]
As a result of the comparison, if the error is within a small error that can be recognized as the person (step s4), the authentication OK is set in the authentication result data returned to the WEB server 11 (step s5).
[0066]
If a matching user ID cannot be found in step s2, or if it is determined in step s4 that the user is not the user, authentication failure is set in the authentication result data returned to the WEB server 11 (step s6).
[0067]
When the above fingerprint authentication processing is completed, returning to FIG. 6, the control device of the authentication server 21 executes the result transmission processing of returning the authentication result data in which the authentication is OK or not, to the WEB server 11 (step n9). .
[0068]
The control device of the WEB server 11 executes an access right determination process for setting an access right according to the received authentication result data, and passes the process to the client terminal 51 (step n10). Specifically, for example, if the authentication is OK and the user ID is t_yamada, a record in which the user ID is t_yamada is searched from the access right table 13 (in this case, a unique ID = 0001 to 0003). According to the access right stored in the record, the access right is set in order from the top (in ascending order of unique ID), and access from the client terminal 51 to the in-house system is partially permitted.
[0069]
If the authentication is OK, the control device of the client terminal 51 displays the access permission screen shown in FIG. 7C on the CRT display, and allows the user to press the OK button to execute the business process using the resources of the in-house system. Execute (step n11).
[0070]
With the above operation, the user can access the in-house system by receiving the fingerprint authentication from the Internet cafe and execute the business process. In the WEB server 11, a user who has been securely authenticated by the authentication server 21 for a user (a user having a legitimate authority, a third party trying to gain unauthorized access, or the like) via the Internet 2 (ie, Only authorized users) can be allowed to access the in-house system.
[0071]
As a result, it is possible to use the in-house system outside the company while ensuring security, and it is possible to improve the availability of the in-house system. Particularly in a company that employs multiple teleworkers, even when designing large-scale programs or systems that require development by a large number of people, teleworkers can keep their internal And can safely execute projects. In this way, there is no need to spend extra time and money to build extranets and satellite offices for co-development at remote locations, and to provide a co-development environment at multiple locations inexpensively. it can.
[0072]
Further, since the WEB server 11 relays the encrypted data to be transmitted from the client terminal 51 to the authentication server 21, the client terminal 51 only needs to communicate with the WEB server 11 alone, and the network connection can be performed simply and efficiently. .
[0073]
Furthermore, by performing a fingerprint data comparison process after searching for a record with a matching user ID in the fingerprint authentication process, it is possible to perform a single comparison of fingerprint data having a large data volume to be compared. . Thus, comparison and authentication can be performed at a much higher speed than comparing fingerprint data in order.
[0074]
In addition, since the public key cryptosystem is used, if the authentication server 21 manages one secret key, the same public key can be sent to a plurality of companies each having the web server 11 installed. Well, key management becomes easy.
[0075]
In the fingerprint authentication processing, the authentication is performed by the above-described feature point extraction method. However, a pattern matching method in which a fingerprint is captured as an image, and the images are overlapped with each other for collation, may be adopted.
[0076]
Further, the access right database 12 may be provided in a database server separate from the WEB server 11, and the database server and the WEB server 11 may communicate with each other to set the access right.
[0077]
Further, the registration information database 22 may be provided in a database server separate from the authentication server 21, and the database server and the authentication server 21 may communicate with each other to perform fingerprint authentication processing.
[0078]
Further, the reference fingerprint data used as the biometric authentication reference data may be constituted by reference voice data for performing authentication by voice such as a voiceprint of the user. In this case, it is preferable to provide a voice acquisition unit such as a microphone in place of the reading unit 52a used as the biometric reading unit, and use the input voice data instead of the input fingerprint data read in the above-described biometric information reading process.
[0079]
Further, the authentication server 21 and the WEB server 11 used as the entrance server can be configured by other computers such as a workstation.
[0080]
In addition, the client terminal 51 used as the operation terminal can be configured by a desktop computer such as a PC or a workstation, or a portable information terminal such as a notebook PC or a PDA (Personal Digital Assistance).
[0081]
The in-house system used as a local system can be used as long as it is a networked facility system such as a production system or a sales system.
[0082]
Further, the function as an entrance executed by the WEB server 11 may be merely requesting the authentication data in the step n2 (FIG. 6), and also opening a home page as a portal site and providing a user on the home page. You may comprise so that it may be operated.
[0083]
In addition, the encryption in step n4 (FIG. 6) and the decryption in step n7 are not performed by the public key cryptosystem, but by DES (Data Encryption Standard), FEAL (Fast data Enforcement ALgorithm), MISTY (misty), or IDEA ( A common key cryptosystem such as International Data Encryption Algorithm may be used.
[0084]
The authentication result data may be configured to be encrypted by the authentication server 21 and transmitted to the WEB server 11 and decrypted by the WEB server 11. In this case, a public key cryptosystem or a common key cryptosystem may be used.
[0085]
In addition, the setting of the access right may be simply set as to whether to permit access to the in-house system, or a more detailed and detailed access right may be set.
[0086]
The authentication server installation CD-ROM 24, the WEB server installation CD-ROM 72, and the client installation CD-ROM 74 used as recording media may use other storage media such as an MO and a flexible disk.
[0087]
When the WEB server requests the client terminal 51 for the authentication data in the step n2, it may be set so that the reception time and the temporary ID are transmitted to the client terminal 51 and the authentication server 21. In this case, in the client terminal 51, when performing the encryption in the step n4, the setting is made so that the temporary ID and the reception time are encrypted together.
[0088]
When this is decrypted by the authentication server 21, it can be confirmed that the authentication data is the authentication data transmitted from the client terminal 51 that has requested the authentication data from the WEB server 11 based on the temporary ID and the reception time.
[0089]
When returning the authentication result in step n9, the authentication server 21 discards the temporary ID and the reception time. Also, if the authentication data having the same temporary ID and the same reception time is not received even after a certain period of time (for example, 10 minutes) has elapsed, the temporary ID and the reception time are discarded.
[0090]
As a result, it is possible to prevent the encrypted data from being eavesdropped on the communication path, and preventing the encrypted data from being used by a third party as it is and succeeding in unauthorized access to the in-house system. That is, the expiration date of the temporary ID and the reception time is limited to a fixed time (for example, 10 minutes), and even if an attempt is made to illegally use the encrypted data obtained by encrypting the expired temporary ID and the reception time, the authentication server 21 excludes the data. Can be. With this setting, a more secure authentication system 1 can be provided.
[0091]
Further, the client fingerprint authentication program 55 may be sold as a license, and the number of client terminals 51 or the number of user IDs that can be registered simultaneously by the WEB server fingerprint authentication program 15 may be limited. As a result, software sales can be carried out on a user (employee) basis.
[0092]
Further, the authentication server 21 may be connected to the Internet 2 and the dedicated line connection between the WEB server 11 and the authentication server 21 may be omitted. In this case, security measures such as installing the authentication server 21 inside the firewall are taken to prevent fingerprint data from being leaked due to unauthorized access to the registration information database 22.
Thereby, the cost of the dedicated line connection can be reduced, and the fingerprint authentication system 1 can be used at lower cost.
[0093]
In correspondence between the configuration of the present invention and the above embodiment,
The biometric authentication system of the present invention corresponds to the fingerprint authentication system 1 of the embodiment,
Similarly,
The entrance server corresponds to the WEB server 11,
The entrance server program corresponds to the WEB server fingerprint authentication program 15, the authentication server corresponds to the authentication server 21,
The storage means corresponds to the hard disk of the authentication server 21,
The authentication server program corresponds to the authentication server fingerprint authentication program 25,
The operation terminal corresponds to the client terminal 51,
The biometric reader corresponds to the fingerprint reader 52,
The terminal program corresponds to the client fingerprint authentication program 55,
The recording media correspond to the installation CD-ROM 24 for the authentication server, the installation CD-ROM 72 for the WEB server, and the installation CD-ROM 74 for the client.
The biological information reading process corresponds to step n3,
The encryption process corresponds to step n4,
The transmission process corresponds to step n5,
The authentication request processing corresponds to step n6,
The decoding process corresponds to step n7,
The access right determination process corresponds to step n10,
The result transmission process corresponds to step n9,
The biometric authentication process corresponds to the fingerprint authentication process (steps s1 to s6),
The local system corresponds to the in-house system,
Biometric data corresponds to the input fingerprint data,
The biometric reference data corresponds to the reference fingerprint data,
The present invention is not limited to the configuration of the above-described embodiment, but can obtain many embodiments.
[Brief description of the drawings]
FIG. 1 is a system configuration diagram of a fingerprint authentication system.
FIG. 2 is an explanatory diagram of a table structure of a registered fingerprint table.
FIG. 3 is a schematic perspective view of a fingerprint authentication software package.
FIG. 4 is an explanatory diagram of a table structure of an access right table.
FIG. 5 is an explanatory diagram of a configuration of a module used by each program.
FIG. 6 is a processing flowchart of a resource use availability determination process.
FIG. 7 is an explanatory diagram of a screen image of a CRT display of the client terminal.
FIG. 8 is a processing flowchart of fingerprint authentication processing.
[Explanation of symbols]
1. Fingerprint authentication system
11 WEB server
15. Fingerprint authentication program for WEB server
21 ... Authentication server
24: Authentication server installation CD-ROM
25: Fingerprint authentication program for authentication server 25
51 ... Client terminal
52 ... Fingerprint reader
55… Fingerprint authentication program for client
72 ... Installation CD-ROM for WEB server
74: Client installation CD-ROM

Claims (9)

An authentication server that performs biometric authentication processing based on the biometric authentication reference data stored in the storage unit,
An entrance server capable of communicating with the authentication server and functioning as an entrance when accessing a local system used by a user;
An operation terminal communicable with the entrance server and operated by a user;
The operation terminal transmits biometric information of a user read by biometric reading means provided in the operation terminal as biometric authentication data,
Transmitting the authentication result data to the entrance server by executing the biometric authentication process on the biometric authentication data received by the authentication server,
A biometric authentication system in which the entrance server determines an access right to the operation terminal or the user to the local system based on the authentication result data. The operation terminal executes an encryption process of the biometric authentication data,
The biometric authentication system according to claim 1, wherein the authentication server executes a process of decrypting the encrypted biometric authentication data. It is a program installed in the operation terminal used in the biometric authentication system according to claim 1 or 2,
A biological information reading process for reading the biological information of the user;
A terminal program defining transmission processing for transmitting the read biometric information as biometric authentication data. An operation terminal on which the terminal program according to claim 3 is installed. A program installed in the entrance server used in the biometric authentication system according to claim 1 or 2,
An entry server program defining an access right determination process for determining an access right to the operation terminal or the user to the local system based on the received authentication result data. An entrance server in which the entrance server program according to claim 5 is installed. Installation on the authentication server used in the biometric authentication system according to claim 1 or 2,
Biometric authentication processing for authenticating the received biometric data based on the biometric reference data,
An authentication server program defining a result transmission process of transmitting a result of the biometric authentication process as authentication result data. An authentication server on which the authentication server program according to claim 7 is installed. A recording medium storing any one of the programs according to claim 3.

Images