JP2005352976A - Individual authentication system and authentication method using portable terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an individual authentication system and method capable of preventing theft of authentication information and unauthorized access to a service by dispensing with storage of privacy information while eliminating possibility of forgetting of principals information or leakage at the time of information input. <P>SOLUTION: In this personal identification system performing personal identification by use of a portable terminal, the portable terminal comprises a biological information reading part 11 reading biological information of a user 11; an information conversion key information accumulation part 12 accumulating an information conversion key for converting the biological information to authentication data; an authentication data mixing part 13 generating the authentication data from the biological information and the information conversion key; and an authentication center access part 15 transmitting the authentication data to an authentication center. The authentication center includes an authentication data receiving part 211 receiving the authentication data from the portable terminal of the user, and an authentication determination part 212 determining whether the user is a regular user or not. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a personal authentication system and authentication method for performing personal authentication using a mobile terminal, and in particular, biometric information (face shape, fingerprint, eye) that is privacy information when performing authentication while using biometric information. The present invention relates to a personal authentication system and method for realizing personal authentication by operating a mobile terminal without exposing (Iris), voiceprint, etc.) to a service provider.

  Conventionally, when authenticating a person, presenting a certificate (an official document with a photo of the face), presenting personal information (information such as a password that is known only to the individual), or identifying personal information (biological information: facial shape, fingerprint, eye) (Iris), voiceprints, etc.). However, the presentation of the certificate requires manual authentication, and the presenting of the identity information has problems such as forgetting the identity information and leakage at the time of information input. In addition, when personal information is used, information leakage due to loss of mobile devices, leakage of privacy information, risk of copying information, etc. are considered, and service providers (banks, card companies, communication carriers, etc.) There was anxiety about providing privacy information to (see, for example, Patent Document 1).

In addition, there is also a method of restoring the user-specific information on the service provider side by converting and transmitting it according to a certain algorithm on the terminal side when transmitting the user-specific information to the service provider. Also, it was necessary to provide privacy information, which is personal information, to the service provider. (For example, see Patent Documents 2 and 3.)
JP 2003-216878 A Japanese Patent Application Laid-Open No. 2002-101459 JP 09-313464 A

  In order to solve the above-described conventional problems, the present invention uses personal identification information (biological information: facial shape, fingerprint, eye (iris), voiceprint, etc.) in a personal authentication system using a portable terminal. Authenticates, but does not require manual authentication, there is no anxiety such as forgetting personal information, leaks when entering information, etc., and the accumulation of privacy information is prevented, preventing theft of authentication information Another object of the present invention is to provide a personal authentication system and method capable of preventing unauthorized access to a service due to impersonation (clone or the like).

  A first invention for solving the above-described problems is an authentication center that performs identity authentication to determine whether there is a valid user, and a identity authentication system that performs identity authentication using a mobile terminal connected to the authentication center. The portable terminal includes a biometric information reading unit that reads biometric information of a user, an information conversion key information storage unit that stores an information conversion key for converting the biometric information into authentication data, and the biometric information. An authentication data mixing unit that generates authentication data from the information conversion key; and an authentication center access unit that transmits the authentication data to an authentication center. The authentication center receives authentication information from a user's mobile terminal. An authentication data receiving unit, and an authentication determination unit that determines whether the user is a legitimate user.

  According to the first aspect of the present invention, there is provided a personal authentication system using a portable terminal that can be accessed even if a third party impersonating the person tries to access the service and can prevent the loss of privacy information. it can.

  According to a second invention, in the personal authentication system using the mobile terminal according to the first invention, the information conversion key is information stored in the mobile terminal in advance or an encryption key input by a user Means for using information to change the biological information according to a certain algorithm.

  According to the second aspect of the present invention, it is possible to provide a personal authentication system using a mobile terminal that improves the security of biometric information that is privacy information.

  According to a third aspect of the present invention, in the personal authentication system using the portable terminal according to the first aspect, the portable terminal has means for deleting the authentication data after transmitting the authentication data. A personal authentication system using a personal computer.

  According to the third aspect of the present invention, since there is no biometric information for generating authentication data in the mobile terminal, it is possible to provide a personal authentication system using the mobile terminal that prevents information leakage due to loss of the terminal and leakage of privacy information.

  According to a fourth aspect of the present invention, in the personal authentication system using the portable terminal according to the first aspect, the portable terminal reproduces the authentication data every time the service is accessed when generating the authentication information to be transmitted to the authentication center. Has means to achieve.

  According to the fourth aspect of the invention, since the biometric information that is privacy information is not stored in the terminal, a personal authentication system using a portable terminal that prevents the leakage of privacy information can be provided.

  According to a fifth aspect of the present invention, there is provided a personal authentication method that requires personal authentication prior to the provision of a service, the step of reading a user's biometric information each time service access is performed on the mobile terminal side, and the biometric information and the information conversion Changing the key information according to a certain algorithm to generate authentication data; reading information identifying the subscriber; and deleting the authentication data after transmitting the authentication data to the authentication center; When an authentication request sent from the mobile terminal side at the authentication center and an authentication request based on the terminal / user information is received, a step of reading and inputting the terminal information from the terminal / user information storage unit, and an authentication information from the authentication information storage unit Based on the step of reading and inputting, authentication data from the mobile terminal side, terminal information and authentication information on the authentication center side. Result of determining the authentication Te, an authentication completion signal if successful, and a step of notifying an authentication rejection signal if unsuccessful the mobile terminal.

  According to the fifth aspect of the present invention, it is possible to provide a personal authentication method in which a third person who has impersonated himself / herself cannot access the service and can prevent the loss of privacy information.

  As described above, according to the present invention, personal authentication using a mobile terminal can be realized without exposing biometric information, which is privacy information, to an authentication center.

  In addition, since the authentication information is not stored in the mobile terminal itself, even if the mobile terminal is in the hands of a third party due to loss of the mobile terminal, the terminal is not input unless biometric information for identifying the person is input. Can not be used illegally, so that unauthorized use due to impersonation of a third party can be prevented. In addition, even when a clone terminal is created by illegally copying information stored in the portable terminal, similarly to the above, unauthorized use due to impersonation by a third party can be prevented.

  Furthermore, since the user can be authenticated by the information conversion key and the biometric information without depending on the terminal, the user's own portable terminal cannot be used for some reason (eg, the battery is dead). Even in such a state, by inputting the information conversion key and its own biometric information into the portable terminal having the same function, the personal authentication can be performed and the service can be enjoyed.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  In addition, in order to make an understanding easy through the whole figure, the same code | symbol shall be attached | subjected and shown to the same location.

  FIG. 1 is an overall configuration diagram of a personal authentication system using a mobile terminal according to the first embodiment of the present invention. The authentication center 2 is connected to the portable terminals 1A and 1B by radio (or wired). Reference numerals 1A and 1B denote mobile terminals A and B, respectively, and the user performs an operation for authenticating the user using the mobile terminal 1A or 1B. An authentication center 2 includes a certificate authority 21 and an authentication database 22. The authentication database 22 is a database that stores authentication information registered corresponding to mobile terminal information.

  In FIG. 1, when a user operates the mobile terminal 1A or the mobile terminal 1B to input his / her own biometric information, the input biometric information and the mobile terminals 1A and 1B are stored in the mobile terminals 1A and 1B. Authentication information derived from the third conversion key possessed by a certain algorithm is transmitted to the authentication center 2. The authentication center 2 uses the authentication database 22 provided in the authentication center 2 based on the authentication information notified from the mobile terminals 1A and 1B to determine whether the person is an authorized user. Provide services that require personal authentication.

  FIG. 2 is a functional configuration diagram of a mobile terminal as a personal authentication system according to the second embodiment of the present invention. 11 is a biometric information reading unit for reading the user's biometric information, 12 is an information conversion key information accumulating unit for converting the user's biometric information into authentication data, and 13 is a predetermined algorithm for the user's biometric information and information conversion key information. An authentication data mixing unit that generates authentication data by using the authentication data, 14 is authentication information data generated by the authentication data mixing unit 13, and 15 is an authentication center access unit that transmits authentication information to the authentication center 2.

  In FIG. 2, the user's biometric information (face shape, fingerprint, eye (iris) voiceprint, etc.), which is privacy information, is stored in the biometric information reading unit 11 built in the portable terminals 1A and 1B (or in an adapter format) As described above, it is intermediate information for generating authentication data by scrambled according to a certain algorithm in the information conversion key information every time the service is accessed as described above, and generated by the authentication data mixing unit 13 After the authentication data is transmitted to the authentication center 2 by the authentication center access unit 15, the authentication data is completely deleted by the authentication center access unit 15. Even if it reaches the hand, the mobile terminal cannot be illegally used.

  FIG. 3 is a functional configuration diagram of an authentication center as a personal authentication system according to the third embodiment of the present invention. 211 is an authentication data receiving unit that receives authentication information from the user's portable terminal, and 212 is an authentication determining unit that determines whether or not the user is a legitimate user. The authentication data receiving unit 211 and the authentication determining unit 212 can 21 is constituted. Reference numeral 221 denotes a terminal / user information storage unit for identifying a user, and 222 denotes an authentication information storage unit used for user authentication. The authentication database 22 is created by the terminal / user information storage unit 221 and the authentication information storage unit 222. Constitute.

  In FIG. 3, the authentication center reads out the authentication information based on the terminal information, restores the authentication data transmitted from the terminal, matches the authentication information itself transmitted from the terminal, and provides the service. Whether access is possible is determined.

  That is, the conversion key and biometric information of the corresponding user are not stored in the authentication center 2. Therefore, it is not necessary to disclose the biometric information (face shape, fingerprint, eye (iris), voiceprint, etc.) that is the user's privacy information to the authentication center 2 (service provider). Further, since the conversion key is not stored, it is impossible to derive biometric information that is the user's privacy information from the authentication information transmitted by the user.

  For communication on the terminal side and the authentication center side, the means for changing the communication contents each time is used on the terminal side by using the encryption key change procedure by transmitting and receiving the encryption key at every communication. When the biometric information is scrambled and transmitted to the authentication center according to a certain algorithm in the terminal information (terminal ID, etc.), the encryption key agreed between the communication terminal and the authentication center is used. Furthermore, security can be improved by encryption.

  FIG. 4 is an operation sequence diagram of the personal authentication method according to the fourth embodiment of the present invention. Hereinafter, the personal authentication operation will be described along the reference numerals in FIG.

  S1. Use of a service that requires personal authentication prior to the provision of a certain service is started by the user's operation of the mobile terminal.

  S2. The user's biometric information (face shape, fingerprint, eye (iris), voiceprint, etc.) input is read.

  S3. Information conversion key information is extracted from the information conversion key information storage unit 12 and input.

  S4. Authentication data is generated from the user's biometric information and the information conversion key.

  S5. Terminal / user information stored in advance in the portable terminal is extracted from the terminal / user information storage unit 16 and input. Although this terminal / user information storage unit 16 does not exist in FIG. 2, when the user's own terminal cannot be used (battery exhaustion / failure, etc.), the other person's portable terminal is borrowed and the terminal It is also assumed that information is used by inputting information (in this case, information for identifying a subscriber), and terminal information is not stored in the mobile terminal in advance.

  S6. When the main server receives the authentication request based on the authentication data and the terminal / user information from the portable terminal, the terminal information is taken out from the terminal / user information storage unit 221 on the main server side and inputted.

  S7. Authentication information is extracted from the authentication information storage unit 222 and input.

  S8. As a result of determining the personal authentication based on the authentication data from the mobile terminal side and the terminal information and authentication information on the main server side, if the personal authentication is successful, an authentication completion signal is notified to the mobile terminal, and the personal authentication is unsuccessful. If it is, an authentication rejection signal is notified to the portable terminal.

  S9. After receiving the authentication completion signal or the authentication rejection signal from the main server at the portable terminal, the authentication information is deleted.

  S10. After deleting the authentication information on the mobile terminal side, the registration process on the mobile terminal side ends.

  S11. If the personal authentication is successful on the main server side, the registration process on the main server side ends.

  In the mobile terminal, information preset by the user and terminal information are stored as information conversion keys. The authentication information to be transmitted to the information center is not stored in the portable terminal because it is generated using the information conversion key information and the biometric information every time an authentication request is made.

  FIG. 5 is a diagram showing an example of information registered in the database of the personal authentication system according to the present invention, where (a) shows the contents of the database of the portable terminal and (b) shows the contents of the database of the authentication center.

(A) Database of mobile terminal In the mobile terminal, terminal / user information “1234” for identifying the mobile terminal (user) and authentication information “001” for the terminal / user are stored.

(B) Authentication Center Database Only the authentication information “ABCDEFGH” corresponding to the terminal / user information “1234” is managed in the information center, and the biometric information which is privacy information of each user is not stored and managed. Also, the information conversion key information set by the user is not stored and managed.

  The following additional notes are disclosed with respect to the embodiment of the present invention described above.

  (Supplementary Note 1) An authentication center that performs personal authentication to determine whether there is a valid user, and a personal authentication system that performs personal authentication using a mobile terminal connected to the authentication center, and is used for the mobile terminal Authentication data from a biometric information reading unit that reads biometric information of a person, an information conversion key information storage unit that stores an information conversion key for converting the biometric information into authentication data, and the biometric information and the information conversion key. An authentication data mixing unit to be generated; and an authentication center access unit that transmits the authentication data to an authentication center. The authentication center includes an authentication data receiving unit that receives authentication information from a user's mobile terminal; and a user A personal authentication system using a portable terminal, comprising: an authentication determination unit that determines whether or not the user is a legitimate user.

  (Additional remark 2) In the personal authentication system using the portable terminal of Additional remark 1, the said biometric information is at least one of a face shape, a fingerprint, an iris, and a voiceprint, The personal authentication using a portable terminal characterized by the above-mentioned system.

  (Supplementary Note 3) In the personal authentication system using the portable terminal described in Supplementary Note 1, the information conversion key uses information stored in advance in the portable terminal or key information for encryption input by a user. And a means for changing the biometric information in accordance with a predetermined algorithm.

  (Additional remark 4) In the personal authentication system using the portable terminal of Additional remark 1, the said portable terminal has a means to delete this authentication data after the said authentication data transmission, The person using the portable terminal characterized by the above-mentioned Authentication system.

  (Additional remark 5) In the personal authentication system using the portable terminal of Additional remark 1, when the said portable terminal produces | generates the authentication data transmitted to the said authentication center, the means to regenerate the authentication data at every service access A personal authentication system using a mobile terminal characterized by comprising:

  (Additional remark 6) In the personal authentication system using the portable terminal of Additional remark 1, it has a means to produce | generate authentication data with the said information conversion key input in portable terminals other than the portable terminal which the said user owns The personal authentication system using the portable terminal characterized by this.

  (Supplementary note 7) In a personal authentication system comprising an authentication center that performs personal authentication and determines whether there is a valid user, and a mobile terminal connected to the authentication center, a service is provided when a new service is subscribed to the mobile terminal. A personal authentication system using a portable terminal, wherein third authentication data other than biometric information is registered in an authentication center as authentication information requiring personal authentication prior to the authentication.

   (Additional remark 8) In the personal authentication method which requires personal authentication prior to the provision of a certain service, the step of reading the biometric information of the user every time the mobile terminal side accesses the service, and the biometric information and the information conversion key information Generating authentication data by changing according to a predetermined algorithm, reading information for identifying a subscriber, and deleting the authentication data after transmitting the authentication data to the authentication center. Receiving an authentication request based on authentication data and terminal / user information sent from the mobile terminal side, reading and inputting terminal information from the terminal / user information storage unit, and reading authentication information from the authentication information storage unit Based on the input step, authentication data from the mobile terminal side, terminal information and authentication information on the authentication center side Result of determining the human authentication, the authentication completion signal if successful, authentication method characterized by comprising the step of informing an authentication rejection signal to the mobile terminal if unsuccessful.

  The present invention is used in a service providing system that requires user authentication prior to the provision of a certain service, and in particular, the user can realize user authentication from a mobile terminal with peace of mind.

It is a whole block diagram of the personal authentication system using the portable terminal which concerns on the 1st Embodiment of this invention. It is a functional block diagram of the portable terminal as a personal authentication system which concerns on the 2nd Embodiment of this invention. It is a function block diagram of the authentication center as a personal authentication system which concerns on the 3rd Embodiment of this invention. It is an operation | movement sequence diagram of the identification method which concerns on the 4th Embodiment of this invention. It is a figure which shows an example of the information registered into the database of the personal authentication system by this invention.

Explanation of symbols

1A Mobile terminal A
1B Mobile terminal B
2 Authentication Center 11 Biometric Information Reading Unit 12 Information Conversion Key Information Storage Unit 13 Authentication Data Mixing Unit 14 Authentication Information Data 15 Authentication Center Access Unit
16 Terminal / User Information Storage Unit 21 Authentication Authority 22 Authentication Database 211 Authentication Data Receiving Unit 212 Authentication Determination Unit 221 Terminal / User Information Storage Unit 222 Authentication Information Storage Unit

Claims (5)

An authentication center that performs identity authentication to determine whether there is a legitimate user, and a identity authentication system that performs identity authentication using a mobile terminal connected to the authentication center,
In the portable terminal, a biometric information reading unit that reads biometric information of a user, an information conversion key information storage unit that stores an information conversion key for converting the biometric information into authentication data, the biometric information and the information conversion An authentication data mixing unit that generates authentication data from the key, and an authentication center access unit that transmits the authentication data to the authentication center.
The authentication center includes an authentication data receiving unit that receives authentication information from a user's mobile terminal, and an authentication determination unit that determines whether or not the user is an authorized user. A personal authentication system. In the personal authentication system using the mobile terminal according to claim 1,
The information conversion key includes means for changing the biometric information according to a predetermined algorithm using information stored in advance in the portable terminal or key information for encryption input by a user. A personal authentication system using a portable terminal. In the personal authentication system using the mobile terminal according to claim 1,
The personal authentication system using a mobile terminal, characterized in that the mobile terminal has means for deleting the authentication data after transmitting the authentication data. In the personal authentication system using the mobile terminal according to claim 1,
The personal authentication system using a mobile terminal, characterized in that the mobile terminal has means for regenerating authentication data every time a service access occurs when generating authentication information to be transmitted to the authentication center. In a personal authentication method that requires personal authentication prior to the provision of a service,
A step of reading a user's biometric information each time a service is accessed on the portable terminal side, a step of generating authentication data by changing the biometric information and the information conversion key information according to a predetermined algorithm, and identifying a subscriber Reading information, and deleting the authentication data after transmitting the authentication data to an authentication center,
When receiving an authentication request based on authentication data and terminal / user information sent from the mobile terminal side at the authentication center, reading and inputting the terminal information from the terminal / user information storage unit; and receiving authentication information from the authentication information storage unit As a result of determining the identity authentication based on the step of reading and inputting, the authentication data from the mobile terminal side, the terminal information and authentication information on the authentication center side, if the authentication is successful, the authentication completion signal is obtained, and if the authentication is unsuccessful, the authentication is completed. And a step of informing the portable terminal of the rejection signal.

Images