JP2005258801A - Personal identification system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal identification system allowing improvement of authentication accuracy by an easy process. <P>SOLUTION: This personal identification system has: an authentication information generation means 1 generating authentication information on the basis of a biological characteristic of an individual or another person; and an authentication execution means 2 executing authentication of the individual by use of the authentication information and in-authentication individual characteristic information when executing the authentication. The authentication information generation means 1 includes: an individual characteristic information acquisition part 11 acquiring individual characteristic information; an another person characteristic information storage part 12 storing another person characteristic information; an authentication information learning part 13 learning the authentication information on the basis of the individual characteristic information and the another person characteristic information; and an authentication information output part 14 outputting the authentication information. The authentication execution means 2 includes: an in-authentication individual characteristic information acquisition part 21 acquiring the individual characteristic information in time of the authentication; an authentication information storage part 22 storing the authentication information; a main authentication execution part 23 executing main authentication; an additional authentication execution part 24 executing additional authentication according to an authentication result; and an authentication result output part 25 outputting a result. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a personal authentication system using a biometric feature of an individual, and in particular, not only can perform main authentication with simple processing, but also performs additional authentication when sufficient authentication accuracy cannot be obtained with main authentication. The present invention relates to a personal authentication system that improves authentication accuracy.

  An authentication system to which a storage medium such as an IC card storing personal biometric feature information such as a face, fingerprint, and iris is applied in order to determine whether or not an individual has access to a specific organization / function. Has already been put to practical use.

  In order to improve the authentication accuracy of the above authentication system, one face data that is most suitable for distinguishing from other face data is selected from a plurality of face data and stored in a storage medium. An information storage medium issuing device and issuing system to be used ”have also been proposed (see, for example, Patent Document 1).

  In the conventional apparatus according to the above proposal, optimum face data is selected by the procedure shown in FIG.

  The conventional apparatus first generates face data obtained by extracting facial features from a personal face image (step S181).

  Next, the degree of dissimilarity is calculated by comparing the face data with other person's face data registered in the database (step S182), and an evaluation value is determined based on the degree of dissimilarity (step S183).

Then, the face data having the highest evaluation value is selected as the optimum data (step S184), the optimum data is output to the IC card (step S185), and the optimum data is registered in the database (step S186).
Japanese Patent Laid-Open No. 2003-178274 ([0020] to [0023], FIG. 3)

  However, since the conventional personal authentication system authenticates an individual by a single authentication method, there is a problem that not only complicated authentication processing is required, but also the authentication accuracy depends on a threshold value.

  That is, if the threshold value is set strictly, there are many opportunities for the person not being authenticated, and if the threshold value is set sweetly, there are many chances that another person is mistakenly authenticated as the person.

  The present invention has been made to solve the conventional problems, and not only can perform main authentication with a simple process, but also performs additional authentication when sufficient authentication accuracy cannot be obtained by main authentication. It aims at providing the personal authentication system which can improve an authentication precision by this.

  The personal authentication system of the present invention includes an authentication information generating means for generating authentication information based on an individual biometric feature and another person's biometric feature, and an authentication personal feature representing an individual biometric feature at the time of personal authentication. An authentication system comprising authentication execution means for executing personal authentication using information and the authentication information, wherein the authentication information generating means acquires personal feature information representing a biological characteristic of the individual A feature information acquisition unit, an other person feature information storage unit that stores other person feature information representing a biological feature of another person, an authentication information learning unit that learns authentication information based on the personal feature information and the other person feature information, An authentication information output unit for outputting the authentication information, wherein the authentication executing means is an authentication personal feature information acquisition unit for acquiring the authentication personal feature information and an authentication information output from the authentication information output unit. Authentication information storage unit for storing the authentication information, main authentication execution for executing main authentication based on the authentication information stored in the authentication information storage unit and the personal characteristic information at the time of authentication acquired by the personal characteristic information at the time of authentication An additional authentication execution unit that performs additional authentication based on an authentication result in the main authentication execution unit, and an authentication result output unit that outputs an authentication result in the main authentication execution unit or the additional authentication execution unit It has a configuration.

  With this configuration, even when authentication cannot be performed by the authentication execution unit, additional authentication is performed, so that the authentication accuracy can be improved.

  In the personal authentication system of the present invention, the authentication information learning unit learns a coefficient of an evaluation function of a support vector machine method (hereinafter referred to as SVM method) using the personal characteristic information and the other person characteristic information as learning information. And the main authentication execution unit determines whether or not to perform additional authentication based on the evaluation value and an evaluation value calculation unit that calculates an evaluation value that is a value of the evaluation function using the coefficient And a determination unit.

  With this configuration, the main authentication execution unit can execute personal authentication by simple calculation.

  In the personal authentication system of the present invention, the determination unit authenticates the individual as the principal if the evaluation value is equal to or greater than the positive predetermined value α, and authenticates the individual as not the principal if the evaluation value is −α or less. If it is less than and greater than -α, the additional authentication unit determines that additional authentication is necessary.

  With this configuration, it is possible to execute additional authentication only when −α <evaluation value <α.

  In the personal authentication system of the present invention, the authentication information learning unit specifies the personal feature information and the other person feature information corresponding to the support vector of the SVM method from the personal feature information and the other person feature information. A specific authentication information extraction unit that extracts the authentication information, the authentication information output unit outputs the authentication information and the specific authentication information, and the authentication information input unit outputs the authentication information and the specific authentication information. And the additional authentication execution unit performs additional authentication based on the specific authentication information input by the authentication information input unit and the personal characteristic information at the time of authentication input from the authentication personal characteristic information input unit. It has the structure which performs.

  With this configuration, it is possible to extract and store specific authentication information necessary for additional authentication.

  The personal authentication system of the present invention has a configuration in which the authentication information storage unit and the main authentication execution means are configured in one IC card.

  With this configuration, it is possible to prevent authentication information from leaking outside the IC card when performing main authentication.

  The personal authentication system of the present invention has a configuration in which the authentication information storage unit, the main authentication execution unit, and the additional authentication execution unit are configured in one IC card.

  With this configuration, it is possible to prevent the authentication information from leaking to the outside of the IC card when performing the main authentication and the specific authentication information during the additional authentication.

  In the present invention, by providing an additional authentication execution unit in addition to the main authentication execution unit, it is possible not only to execute the main authentication with a simple process, but also to perform additional authentication when sufficient authentication accuracy cannot be obtained by the main authentication. As a result, the authentication accuracy can be improved.

  Hereinafter, a personal authentication system according to an embodiment of the present invention will be described with reference to the drawings.

  As shown in FIG. 1, the personal authentication system according to the first embodiment of the present invention includes an authentication information generation unit 1 that generates authentication information based on a biological characteristic of an individual and a biological characteristic of another person, Authentication executing means 2 is provided for executing personal authentication using authentication personal characteristic information and authentication information representing an individual biometric characteristic when executing authentication.

  The authentication information generation means 1 includes a personal feature information acquisition unit 11 that acquires personal feature information that represents a person's biometric feature, and another person feature information storage unit 12 that stores other person feature information that represents the biometric feature of another person. , An authentication information learning unit 13 that learns authentication information based on the personal feature information and the other person feature information, and an authentication information output unit 14 that outputs the authentication information.

  The authentication execution means 2 includes an authentication personal feature information acquisition unit 21 that acquires authentication personal feature information, an authentication information storage unit 22 that stores authentication information output from the authentication information output unit 14, and an authentication information storage unit 22. Based on the authentication information stored in the authentication and the personal characteristic information at the time of authentication acquired by the personal characteristic information at the time of authentication 21, based on the authentication result in the main authentication executing part 23 An additional authentication execution unit 24 that executes additional authentication, and an authentication result output unit 25 that outputs an authentication result in the main authentication execution unit 23 or the additional authentication execution unit 24.

  As shown in FIG. 2, the authentication information generation device 50 functioning as the authentication information generation means 1 includes an imaging device 51 that captures a face image of the user U when creating authentication information, and an other person feature information server that accumulates other person's feature information. 52, a processing device 6 that generates authentication information and specific authentication information based on the face image of the user U and other person characteristic information, a communication network 53 that connects the processing device 6 and the other person characteristic information server 52, and the processing device 6 And an information input / output device 54 that outputs the authentication information calculated by.

  As shown in FIG. 3, the processing device 6 includes a bus 61, a CPU 61, a memory 62, an image input I / F (interface) 63, an information input / output I / F 64, a communication I / F 65, and peripheral devices. The I / F 66 is connected.

  An imaging device 51 is connected to the image input I / F 63, and a communication network 53 is connected to the communication I / F 65. An information input / output device 54 is connected to the information input / output I / F 64, and a display device 67, a keyboard 68, and a mouse 69 as a pointing device are connected to the peripheral device I / F 66.

  As shown in FIG. 2, the IC card 7 in which the authentication information generated by the processing device 6 and the specific authentication information are written has a configuration in which an information input / output unit 71, a CPU 72, and a memory 73 are connected to a bus 70. Have.

  As shown in FIG. 4, the authentication execution device 80 that functions as the authentication execution unit 2 includes an imaging device 81 that captures the face image of the user U, a processing device 9 that processes the face image of the user U, and authentication. An authentication result output device 82 for outputting a result, an information input / output device 83 for connecting the processing device 9 and the IC card 7, and the IC card 7 are included.

  As illustrated in FIG. 5, the processing device 9 includes a bus 91, a CPU 91, a memory 92, an image input I / F (interface) 93, an information input / output I / F 94, an output I / F 95, and peripheral devices. The I / F 96 is connected.

  An imaging device 81 is connected to the image input I / F 93, and an authentication result output device 82 is connected to the output I / F 95. An information input / output device 83 is connected to the information input / output I / F 94, and a display device 97, a keyboard 98, and a mouse 99 as a pointing device are connected to the peripheral device I / F 96.

  The processing devices 6 and 9, the imaging devices 51 and 81, the information input / output devices 54 and 83, the display devices 67 and 97, the keyboards 68 and 98, and the mice 69 and 99 are the same hardware, and authentication information is used. The generation device 50 and the authentication execution device 80 may be configured as a single device.

  Next, the operation of the personal authentication system according to the present invention will be described by dividing it into an authentication information generation stage and a personal authentication execution stage.

  When the user U is positioned in front of the imaging device 51, the CPU 61 of the processing device 6 included in the authentication information generation device 50 reads the program stored in the memory 62 and starts the authentication information generation processing according to the flowchart of FIG. To do.

  The CPU 61 first executes personal characteristic information acquisition processing (step S31), and then executes other person characteristic information acquisition processing (step S32). Further, the CPU 61 executes an authentication information learning process (step S33) and finally executes an authentication information output process (step S34). Details of each process will be described below.

  FIG. 7 is a detailed flowchart of personal information acquisition processing. The CPU 61 stores a predetermined number (one or a plurality) of face images of the user U captured by the imaging device 51 via the image input I / F 63. 62 (step S311). Next, the CPU 61 executes preprocessing for normalizing the posture, size, brightness, and the like of the face image (step S312). Then, the CPU 61 counts the normalized face images for each facial expression (step S313), and determines whether the required number of facial images for each facial expression exists (step S314). If the required number of face images does not exist, the CPU 61 synthesizes the required number of facial expression images using the existing user U face images (step S315).

  The face image synthesis is described in a well-known method such as “Synthesis of Novel Views from a single Face” (T. Vetter, International Journal of Computer Vision Vol. 28, 1988, pp. 103-116). It is possible to apply the method.

  In the above description, the face image of the user U is picked up by the imaging device 51, but the face image of the user U may be taken into the memory 62 by other methods. For example, the face photograph of the user U brought by the user U may be directly read, or when the face image of the user U is stored in another database, it may be read. Depending on the size and clarity of the user U's face image, it is desirable to prepare several thousand images.

  When the necessary number of face images of the user U are prepared, the CPU 61 generates a personal feature vector Xui from the face images (step S316).

  Although the method for generating the feature vector from the face image is not particularly limited, as shown in FIG. 8, the face image is decomposed into 5 × 5 regions, and the brightness values of the regions are arranged in the order of arrows, so that the individual feature vector Xui (1 ≦ i ≦ I).

  The CPU 61 transmits the face image (or feature vector) of the user U to the stranger feature server 52 and ends the personal feature information acquisition process in order to use it for generating authentication information of other users.

  In the other person feature information acquisition process, as shown in FIG. 9, the CPU 61 reads the necessary number (for example, thousands) of the other person feature vectors Xoj (1 ≦ j ≦ J) from the other person feature information server 52 via the communication network 53 ( Step S321).

  In the authentication information learning process, as shown in FIG. 10, the CPU 61 determines the coefficients W and b of the evaluation function H of the SVM method represented by [Equation 1] (step S331).

  In the SVM method, the coefficients W and b of the boundary line H = 0 are determined so that the Euclidean distance from the individual feature vector Xui and the other person feature vector Xoj becomes the maximum.

  As shown in FIG. 11, the individual feature vector Xui is basically in the region of H> 0, and the other person feature vector Xoj is in principle in the region of H <0.

  Therefore, the personal feature vector Xui existing in the region of H ≧ α (others, α> 0) and the other person feature vector Xoj existing in the region of H ≦ −α are learned by the coefficients W and b where H = 0. The personal feature vector Xui and the other-person feature vector Xoj existing in the region of −α <H <α have a great influence on the learning of the coefficients W and b.

  Therefore, the CPU 61 extracts the personal feature vector Xui and the other person feature vector Xoj existing in the region of −α <H <α as specific authentication information (= support vector) Xs (step S332).

  In the authentication information output process, as shown in FIG. 12, the CPU 61 writes the coefficients W and b into the memory 73 of the IC card 7 inserted into the information input / output device 54 (step S341), and then the specific authentication information Xs. Writing is performed (step S342).

  Through the above processing, the user U obtains the IC card 7 in which the authentication information is written.

  Next, the operation in the personal authentication execution stage will be described.

  When the user U inserts the IC card 7 in which the authentication information is written into the information input / output device 83 of the authentication execution device 80 in a place where authentication is required, such as an airport immigration window, The processing device 9 starts the personal authentication process according to the flowchart of FIG.

  The CPU 91 of the processing device 9 first executes the personal characteristic information acquisition process at the time of authentication (step S41), and then executes the main authentication process (step S42). Next, the CPU 91 determines whether or not additional authentication is necessary (step S43), and executes additional authentication processing as necessary (step S44). Finally, the CPU 91 outputs an authentication result (step S45). Details of each process will be described below.

  FIG. 14 is a flowchart of the personal characteristic information acquisition process at the time of authentication. The CPU 91 captures the face image of the user U using the imaging device 81 (step S411), and normalizes the posture, size, brightness, and the like. Is executed (step S412), and an authentication personal feature vector Xr is generated (step S413).

  FIG. 15 is a flowchart of the main authentication process. The personal authentication process is executed in the IC card 7 in order to prevent leakage of authentication information to the outside.

  The CPU 72 in the IC card 7 reads the authentication personal feature vector Xr generated by the processing device 9 via the information input / output device 83 and the information input / output unit 71, and is stored in the memory 73 in the IC card 7. The value of the evaluation function H is calculated using the coefficients W and b, which are authentication information (step S421), and is output to the processing device 9.

  The processing device 9 determines the value of the evaluation function (step S43). If -α <H <α, the processing device 9 executes additional authentication processing (step S44).

  The additional authentication process is executed based on the individual feature vector Xr at the time of authentication and the specific authentication information (= support vector) Xs stored in the memory 73 of the IC card 7, but the specific authentication method is particularly defined. First, a known authentication method can be applied.

  Further, the execution place of the additional authentication process is not particularly defined. If the processing capacity of the CPU 72 of the IC card 7 is sufficient, the entire process of the additional authentication is performed from the viewpoint of preventing leakage of the specific authentication information to the outside. It is desirable to execute on the card 7.

  If the processing capacity of the CPU 72 of the IC card 7 is not sufficient, part or all of the additional authentication processing may be executed by the processing device 9.

  FIG. 16 is a flowchart of additional authentication processing, in which the CPU 72 (or 91) sets a parameter p indicating whether additional authentication has been performed correctly to an initial value “0” (step S440), and then specifies specific authentication information. A parameter k indicating Xsk is set to an initial value “1” (step S441).

  Next, the CPU 72 (or 91) performs additional authentication (step S442) based on the individual feature vector Xr during authentication and one specific authentication information Xsk, and determines whether or not the additional authentication result matches the main authentication result. Determination is made (step S443).

  That is, when the specific authentication information Xsk is an individual feature vector and authenticated as “person” in the additional authentication, and the specific authentication information Xsk is an other person feature vector and is authenticated as “not the person” in the additional authentication. Sometimes it is determined that the additional authentication result matches the main authentication result.

  On the other hand, when the specific authentication information Xsk is a stranger feature vector and is authenticated as “person” in the additional authentication, and the specific authentication information Xsk is a personal feature vector and is authenticated as “not the person” in the additional authentication. It is determined that the additional authentication result and the main authentication result do not match.

  If the CPU 72 (or 91) determines in step S443 that the additional authentication result matches the main authentication result, the CPU 72 (or 91) increments the parameter p (step S444) and proceeds to step S445. Conversely, when the CPU 72 (or 91) determines in step S443 that the additional authentication result and the main authentication result do not match, the process proceeds directly to step S445.

  Next, the CPU 72 (or 91) determines whether or not the additional authentication has been completed for all the specific authentication information Xs (step S445), and when negative determination is made, the parameter k is incremented (step S446), and steps S442 to S442 are performed. The processing up to step S445 is repeated.

  When an affirmative determination is made in step S445, the CPU 72 (or 91) determines whether or not the number p in which the additional authentication result matches the main authentication result is greater than or equal to a predetermined threshold value P (step S447).

  Then, the CPU 72 (or 91) sets the additional authentication evaluation value G to “1” when an affirmative determination is made in step S447, and sets the additional authentication evaluation value G to “−1” when a negative determination is made.

  FIG. 17 is a flowchart of the authentication result output process, and the CPU 91 of the processing device 9 determines the value of the evaluation function H calculated in the authentication process (step S451).

  If H ≧ α, the personal feature vector Xr at the time of authentication exists in the region of the personal feature vector sufficiently away from the boundary line H = 0 of the SVM method, and thus a signal indicating that the user U is authenticated as the user is generated. Output (step S453).

  On the other hand, if H ≦ −α, the personal feature vector Xr at the time of authentication is sufficiently far from the boundary line H = 0 of the SVM method and exists in the area of the other person's feature vector, so that the user U is not authenticated as the user. The signal to represent is output (step S454).

  Furthermore, if -α <H <α, the value of the additional authentication evaluation function described above is determined (step S452), assuming that the accuracy by the SVM method cannot ensure sufficient accuracy.

  If G> 0, the process proceeds to step S453, and if G <0, the process proceeds to step S454.

  As described above, according to the personal authentication system of the present invention, an authentication execution unit that performs authentication by the SVM method and an additional authentication unit that performs additional authentication are provided, so that even if the authentication cannot be performed by the SVM method, it is added. Since the authentication is executed, it is possible to improve the authentication accuracy.

  As described above, the personal authentication system according to the present invention can not only perform the main authentication with a simple process, but also improve the authentication accuracy by performing additional authentication when the main authentication fails to obtain sufficient authentication accuracy. It is effective as an authentication device.

Configuration diagram of personal authentication system of the present invention Configuration diagram of authentication information generator Configuration diagram of processing equipment Configuration diagram of authentication execution device Configuration diagram of processing equipment Flow chart of authentication information generation process Flow chart of personal characteristic information acquisition processing How to create a personal feature vector Flow chart of other person characteristic information acquisition processing Flowchart of authentication information learning process Illustration of the SVM method Flow chart of authentication information output process Authentication execution process flowchart Flow chart of personal characteristic information acquisition processing at the time of authentication Main authentication process flowchart Additional authentication process flowchart Authentication result output process flowchart Flowchart of optimal face data selection processing in conventional authentication device

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Authentication information production | generation means 11 Personal characteristic information acquisition part 12 Other person characteristic information storage part 13 Authentication information learning part 14 Authentication information output part 2 Authentication execution means 21 Authentication personal characteristic information acquisition part 22 Authentication information storage part 23 Main authentication execution part 24 Additional authentication execution unit 25 Authentication result output unit

Claims (6)

Using authentication information generating means for generating authentication information based on a biometric feature of an individual and a biometric feature of another person, and using the personal feature information at the time of authentication representing the biometric feature of the individual at the time of personal authentication and the authentication information An authentication system comprising authentication execution means for executing personal authentication,
The authentication information generating means includes a personal feature information acquisition unit that acquires personal feature information representing a biological feature of an individual, an other person feature information storage unit that stores other person feature information representing a biological feature of another person, An authentication information learning unit that learns authentication information based on personal feature information and the other person feature information; and an authentication information output unit that outputs the authentication information;
The authentication execution means includes an authentication personal feature information acquisition unit that acquires the authentication personal feature information, an authentication information storage unit that stores authentication information output from the authentication information output unit, and an authentication information storage unit. A main authentication execution unit that performs main authentication based on the stored authentication information and the authentication personal characteristic information acquired by the authentication personal characteristic information acquisition unit, and an addition based on the authentication result in the main authentication execution unit And an authentication result output unit that outputs an authentication result in the main authentication execution unit or the additional authentication execution unit. The authentication information learning unit learns a coefficient of an evaluation function of a support vector machine method using the personal characteristic information and the other person characteristic information as learning information,
The main authentication execution unit calculates an evaluation value that is a value of the evaluation function using the coefficient; and
The authentication system according to claim 1, further comprising: a determination unit that determines whether to perform additional authentication based on the evaluation value. The determination unit authenticates the individual as the principal if the evaluation value is a positive predetermined value α or more, and authenticates the individual as not the principal if the evaluation value is −α or less, and is less than α and greater than −α. The authentication system according to claim 2, wherein the additional authentication unit determines that additional authentication is necessary in some cases. A specification in which the authentication information learning unit extracts the personal feature information and the other person feature information corresponding to the support vector of the support vector machine method from the personal feature information and the other person feature information as specific authentication information. An authentication information extraction unit,
The authentication information output unit outputs the authentication information and the specific authentication information;
The authentication information input unit inputs the authentication information and the specific authentication information;
The additional authentication execution unit executes additional authentication based on the specific authentication information input by the authentication information input unit and the authentication personal feature information input from the authentication personal feature information input unit. The authentication system according to claim 3. The authentication system according to any one of claims 1 to 4, wherein the authentication information storage unit and the main authentication execution unit are configured in one IC card. The authentication system according to any one of claims 1 to 4, wherein the authentication information storage unit, the main authentication execution unit, and the additional authentication execution unit are configured in one IC card.

Images