JP2007066330A - Authentication device and its method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication device and its method which arbitrarily change the combination of biometrics. <P>SOLUTION: An authentication system in which a sensor, a terminal and a host device are connected with one another and a plurality of biometrics are performed, based on biological information input from the sensor is characterized in that the host device has a transmitting part which transmits authentication scene information representing a state of a scene for performing the biometrics to the authentication device, and the authentication device has: a receiving part which receives the authentication scene information transmitted from the transmitting part of the host device; a storage part which stores scene specification information representing the scene for performing the biometrics and definition information representing what biometrics is performed by associating them with each other; and a determination part which refers to the scene specification information and the definition information stored in the storage part, reads the definition information associated with the scene specification information corresponding to the authentication scene information received by the receiving part and determines a kind for performing the biometrics among the plurality of biometrics according to the definition information. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an authentication apparatus and method for performing personal authentication using biometric information (biometrics) such as a face, fingerprint, voice print, iris print, and the like.

2. Description of the Related Art There are known personal authentication methods and systems that are executed using the above-described biometric information when performing personal authentication at the time of transaction settlement, such as a cash card or a credit card, or personal authentication at entry / exit in a security area.
In addition, in the personal authentication described above, it has been pointed out that even if the person is the same person, there are many variations in input data due to physical condition and the like, and sufficient accuracy cannot be obtained. There has been proposed a personal authentication method for performing personal authentication using the method (see, for example, Patent Document 1).
JP 2001-351507 A

By the way, according to the technique disclosed in Patent Document 1 described above, since a plurality of pieces of biometric information is registered in advance with respect to the person to be authenticated, when authentication is required, a plurality of pieces of biometric information that have been acquired are registered in advance. Collation with each piece of biometric information is performed, and individual verification is performed by combining the respective collation results. For this reason, a highly accurate recognition result can be obtained regardless of variations in input data.
However, it is necessary to perform each biometric authentication in a predetermined pattern in a predetermined order. For this reason, it is inefficient depending on the application. For example, whether or not biometric authentication is performed depending on time and place. It was not possible to use them with high flexibility, such as deciding whether or not to change the combination or order depending on the person to be authenticated.

  The present invention has been made in view of the above circumstances, and the combination and order of the above-described biometric authentication can be arbitrarily changed. In addition, the above-described combination includes efficient time and place factors. It is an object of the present invention to provide an authentication apparatus and method capable of performing the above.

  In order to solve the above-described problems, the present invention is an authentication system in which a sensor, a terminal device, and a host device are connected, and a plurality of biometric authentications can be performed based on biometric information input from the sensor. The higher-level device receives authentication scene information (for example, authentication location file ID, current time information, and information indicating the amount of money in the best mode for carrying out the invention) indicating the situation of the biometric authentication. The authentication device includes a receiving unit that receives the authentication scene information transmitted from the transmission unit of the host device, and scene specifying information (for example, an invention) that indicates a scene where the biometric authentication is performed. The location file, time parameter, and information indicating the amount of money in the best mode for carrying out and definition information indicating which biometric authentication is performed (for example, in the best mode for carrying out the invention) A scene corresponding to the authentication scene information received by the receiving unit by referring to the storage unit stored in association with the parameter) and the scene specifying information and definition information stored in the storage unit. It has the determination part which reads the definition information matched with information, and determines the kind which performs biometric authentication among said several biometric authentication according to the read definition information.

  Further, the present invention is an authentication device in an authentication system in which a plurality of biometric authentications based on biometric information input from a sensor and a host device are connected, and the situation of the scene where the biometric authentication is performed A receiving unit that receives authentication scene information indicating the biometric authentication, a storage unit that stores scene identification information indicating a scene where biometric authentication is performed and definition information indicating which biometric authentication is performed, and the storage The definition information associated with the scene identification information corresponding to the authentication scene information received by the receiving unit is read with reference to the scene identification information and the definition information stored in the unit, It has the determination part which determines the kind which performs biometric authentication among biometric authentication.

  In the authentication apparatus described above, the reception unit may include first scene information (for example, an authentication location file ID in the best mode for carrying out the invention) and a second scene as authentication scene information. Information (for example, current time information in the best mode for carrying out the invention), and among the information stored in the storage unit, the definition information is a living body used for authentication among a plurality of biometric authentications. Information indicating the type of authentication (for example, ON / OFF of time authentication in the best mode for carrying out the invention, authentication method information, authentication priority, etc.) is stored for each scene to be authenticated, and the determination unit includes: The definition information in which scene specifying information corresponding to the first scene information received by the receiving unit is set is read, and the type of biometric authentication corresponding to the received second scene information is selected from the read definition information. Searching to information, according to the type of the retrieved biometric authentication, and determines the type of performing biometric authentication.

  In the authentication apparatus described above, the first scene information and the second scene information are different information, and the place where the authentication is performed, the time when the authentication is performed, and the settlement when the authentication is established. The scene identification information and the definition information stored in the storage unit are different information, and the place for authentication, the time zone for authentication, and the range of the payment amount The determination unit determines the type of biometric authentication according to a place where authentication is performed, a time when authentication is performed, and a payment amount when payment is made when authentication is established. And

  In the authentication apparatus described above, the definition information includes information indicating the order of biometric authentication used for authentication among a plurality of biometric authentications among the information stored in the storage unit. Stored for each scene to be authenticated, the determining unit reads definition information in which scene specifying information corresponding to the first scene information received by the receiving unit is set, and the received definition information is read out Information indicating the type and order of biometric authentication corresponding to the second scene information is searched, and the type and order of biometric authentication are determined according to the type and order of biometric authentication searched. .

  The present invention is also an authentication method in an authentication system in which a sensor, a terminal device, and a host device are connected, and a plurality of biometric authentications are possible based on biometric information input from the sensor. The apparatus transmits authentication scene information indicating the situation of the scene where the biometric authentication is performed to the authentication apparatus, and the authentication apparatus receives the authentication scene information transmitted from the host apparatus and performs the biometric authentication. The scene specifying information corresponding to the received authentication scene information with reference to the scene specifying information and the definition information stored in the storage unit stored in association with the definition information indicating which biometric authentication is to be performed and the scene specifying information to be displayed The definition information associated with is read, and according to the read definition information, the type of biometric authentication among the plurality of biometric authentications is determined.

  Further, the present invention is an authentication method of an authentication apparatus in an authentication system in which a plurality of biometric authentications based on biometric information input from a sensor and a host device are connected, and performs the biometric authentication Authentication scene information indicating the situation of the scene is received from the host device, and stored in a storage unit that stores the scene identification information indicating the scene where the biometric authentication is performed and the definition information indicating which biometric authentication is performed With reference to the scene specifying information and the definition information, the definition information associated with the scene specifying information corresponding to the received authentication scene information is read, and biometric authentication is performed among the plurality of biometric authentications according to the read definition information. The type to be performed is determined.

According to the present invention, the authentication device stores each parameter for determining whether to authenticate based on a combination of authentication, authentication priority, one or both of time and place, and the authentication device itself Alternatively, by performing biometric authentication according to the stored parameters while performing communication in accordance with a request from an externally connected host device, it is possible to determine whether biometric authentication is performed according to time and place. In addition, when a plurality of biometric authentications are performed, the combination and order can be determined according to the application, so that a highly flexible authentication device can be provided. Furthermore, personal authentication can be performed more efficiently by combining factors relating to time and place with the combination of biometric authentication.
In accordance with a request from a higher-level device connected externally, for example, by executing biometric authentication according to a parameter based on registration information stored in an IC card, the higher-level device does not have registration information and security can be improved. .

FIG. 1 is a diagram illustrating an example of a configuration of an authentication system including an authentication apparatus according to the present invention. In FIG. 1, reference numeral 10 denotes an IC card as an authentication apparatus of the present invention, in which a parameter file (to be described later) is allocated and stored in addition to registered biometric information of a person to be authenticated. There are two types of IC cards 10 shown here: a contact type and a non-contact type. In the case of the contact type, the IC card 10 is inserted into the reader 11, and in the case of the non-contact type, the reader 11. It is possible to communicate with the host device 13 such as a PC simply by holding (close).
Reference numeral 12 denotes a sensor that reads the biometric information of the person to be authenticated. The biometric information read here is taken in by the host device 13 and is collated by the host device 13 itself or communicates with the IC card 10. Verification is performed by the IC card 10. The sensor 12 is assumed to be a CCD (Charge Coupled Device) camera or infrared in the case of face authentication, for example, and in the case of fingerprint authentication, the line type or the entire fingerprint that is sequentially acquired while performing line scanning of the fingerprint is at once. There are area types to be acquired. Among them, there are various methods such as a thermal type, a capacitance time type, and a pressure sensitive type.

FIG. 2 is a block diagram showing a hardware configuration of the IC card 10 shown in FIG. The IC card 10 is composed of a ROM 2, a RAM 3, and an EEPROM 4 with the CPU 1 as a core. Here, the EEPROM 4 is a rewritable nonvolatile memory, in which biometric information for authentication or a parameter file described later is stored. The ROM 2 is a memory that stores a program that defines the operation of the IC card 10. Note that a program that defines the operation of the IC card 10 may be stored in the EEPROM 4. The RAM 3 is a working memory that temporarily stores data.
The CPU 1 controls the operation of the IC card 10 using the RAM 3 based on a program stored in the ROM 2 or the EEPROM 4. Here, the CPU 1 mainly performs parameter registration, authentication operation, and communication with the host device 13. .

As will be described later, means for storing parameters in which the combination of biometric authentication of the present invention is defined, means for storing parameters in which the priority of each combination in the combination is defined, and time for performing biometric authentication Means for storing parameters in which information for determining whether or not to perform biometric authentication is determined by one or both of the location and the location, and means for executing biometric authentication consisting of the above combinations according to each stored parameter Each is performed by the CPU 1 using the RAM 3 and sequentially executing a program stored in the ROM 2 or the EEPROM 4. Similarly, the CPU 1 uses the RAM 3 and the ROM 2 to execute biometric authentication consisting of the above-described combinations by referring to the parameter file in which each parameter is stored in accordance with a request from the host device 13 connected externally. Alternatively, it is performed by sequentially executing a program stored in the EEPROM 4.
Further, in FIG. 2, Vcc is a power supply, GND is ground, RST is reset, I / O is communication (input / output), and CLK is a terminal related to a clock. Further, a coprocessor (not shown) for assisting the operation of the CPU 1 may be incorporated, and in this case, a high-level authentication operation using data encryption, decryption, compression, decompression, or the like becomes possible.

FIG. 3 is a diagram showing an example of the data structure of the parameter file stored in the IC card. As shown in FIG. 3, it is possible to define a combination of a plurality of types of parameters according to the scene where biometric authentication is performed. Here, they are stored and managed in place units (place 1 file, place 2 file,..., Place n file). Further, each file is assigned and stored with fields relating to ON / OFF of time authentication, authentication method information, and authentication priority.
For time authentication, for example, authentication ON / OFF can be set in units of 15 minutes, and the authentication method information is the type of biometric authentication (fingerprint, voiceprint, iris, face, vein, DNA, retina, etc.) The authentication priority is set to the order of authentication.

FIGS. 4 and 5 are diagrams for explaining the operation of the embodiment of the present invention shown in FIGS. 1 to 3, and show the communication protocol between the host device and the IC card, and the operation flowchart of the IC card, respectively. .
Hereinafter, the operation of the embodiment of the present invention shown in FIGS. 1 to 3 will be described in detail with reference to FIGS. 4 and 5.

  First, the host device 13 transmits an authentication method information request (here, simple authentication and normal authentication) to the IC card 10 (S41). Upon receiving this, the IC card 10 checks its authentication method information (S52). If it is simple authentication, the default pattern (here, face and fingerprint) stored in a specific area in the IC card 10 is obtained. And the priority is set to face-fingerprint order) (S53), and the authentication process is executed (S64). Here, the authentication processing may be performed by the IC card 10 by itself according to a built-in program, or may be performed by the host device 13 by communicating with the host device 13 and transmitting a default pattern and registration authentication information.

  On the other hand, in the case of normal authentication, the IC card 10 operates according to authentication method information transmitted from the higher-level device 13. For this reason, the host device 13 first transmits the authentication location file ID (S41), and the IC card 10 that has received this (S54) reads the location file corresponding to the location ID from the storage area (S55) for confirmation. The authentication location file ID is transmitted to (S43 in FIG. 4, S56 in FIG. 5). As a result, the host device 13 knows that the IC card 10 has received the location ID normally. As shown in FIG. 3, each location file stores parameters for each location, time, and authentication method.

  Subsequently, the host device 13 transmits the current time information to the IC card 10 (S44), and the IC card 10 receives this (S57). Then, the IC card 10 checks the time parameter with reference to the corresponding location file (1 to n), and if it is ON (S58), the IC card 10 confirms and transmits the current time information to the host device 13 (S58). S45 in FIG. 4 and S59 in FIG. 5). The host device 13 that has received this further transmits authentication method information and authentication priority information request (here, authentication by fingerprint and iris, authentication in the order of fingerprint-iris) to the IC card 10 (S46, S48).

The IC card 10 that has received these (S60, S62) transmits authentication method information and authentication priority information for confirmation of reception to the higher level device 13 (S47, S49 in FIG. 4, S61 in FIG. S63) An authentication process according to the request is executed (S64). That is, parameters such as a combination of biometric authentication (fingerprints and iris prints) and authentication in order of priority of fingerprints and iris prints are exchanged between the IC card 10 and the host device 13, and accordingly, Authentication processing is executed.
Note that the authentication processing may be performed by the IC card 10 itself or by the host device 13 as in the case of authentication according to the default pattern.

In FIG. 5, the authentication is terminated when the location file ID requested by the host device 13 does not exist in the IC card 10 in the determination process of S55 or when the time information is OFF. The “authentication process according to the default pattern” of the processes of S53 and S54 may be executed.
The present invention assumes a computer such as a portable terminal in addition to the IC card 10 as an authentication device, personal authentication, passport, driver's license at the time of transaction settlement using a cash card, credit card, debit card, etc. It can be applied to use for personal authentication such as certificate and seal certification.

In the embodiment described above, the parameter file data structure has been described with respect to the case where the time parameter is set for each location. However, other combinations may be applied depending on the scene where biometric authentication is performed. Good.
For example, when a payment is made using a credit card, a combination of authentication methods may be set according to the amount of payment in place units (for example, store units). Specifically, it is possible to perform only fingerprint authentication when the amount is from ΔΔ yen to xx yen, and perform face authentication after fingerprint authentication is performed from xx yen or more to XX yen. As a result, a plurality of authentication methods can be combined as the amount increases, and security corresponding to the amount can be ensured.
Further, as a combination of parameters, a time zone may be used as one unit and may be combined with a parameter indicating a payment amount range.
The combination of these parameters can also be determined by application software that performs authentication.

  In the embodiment described above, whether authentication is simple authentication or normal authentication is checked as the authentication method information (step S52 in FIG. 5), but is randomly determined at that time without checking. It may be.

As described above, according to the present invention, the authentication device stores each parameter for determining whether to authenticate based on a combination of biometric authentication, authentication priority, and / or time and place. By performing biometric authentication according to the stored parameters while performing communication in accordance with a request from the authentication device itself or an externally connected higher-level device, the presence or absence of biometric authentication is determined according to time and place. In addition, when performing a plurality of biometric authentications, the combination and order can be determined according to the application, so that a highly flexible authentication device can be provided. Furthermore, personal authentication can be performed more efficiently by combining factors relating to time and place with the combination of biometric authentication.
In accordance with a request from a higher-level device connected externally, for example, by executing biometric authentication according to a parameter based on registration information stored in an IC card, the higher-level device does not have registration information and security can be improved. .

It is a figure which shows an example of a structure of the authentication system containing the authentication apparatus of this invention. It is a block diagram which shows the hardware constitutions of IC card 10 shown in FIG. It is a figure which shows an example of the data structure of the parameter file memorize | stored in IC card. A communication protocol for explaining the operation of the embodiment of the present invention. It is the flowchart quoted in order to demonstrate operation | movement of embodiment of this invention.

Explanation of symbols

  1 ... CPU, 2 ... ROM, 3 ... RAM, 4 ... EEPROM, 10 ... IC card, 11 ... reading device, 12 ... sensor, 13 ... high-level device

Claims (7)

An authentication system in which a sensor, a terminal device, and a host device are connected, and a plurality of biometric authentications are possible based on biometric information input from the sensor,
The host device is
A transmission unit for transmitting authentication scene information indicating the situation of the biometric authentication to the authentication device;
The authentication device
A receiving unit for receiving authentication scene information transmitted from the transmitting unit of the host device;
A storage unit for storing the scene identification information indicating the scene where the biometric authentication is performed and the definition information indicating which biometric authentication is performed;
With reference to the scene specifying information and definition information stored in the storage unit, the definition information associated with the scene specifying information corresponding to the authentication scene information received by the receiving unit is read, according to the read definition information, An authentication system comprising: a determination unit that determines a type of biometric authentication among a plurality of biometric authentications. An authentication device in an authentication system in which an authentication device that performs a plurality of biometric authentications based on biometric information input from a sensor and a host device are connected,
A receiving unit for receiving authentication scene information indicating the situation of the scene for performing the biometric authentication from the host device;
A storage unit for storing the scene identification information indicating the scene where the biometric authentication is performed and the definition information indicating which biometric authentication is performed;
With reference to the scene specifying information and definition information stored in the storage unit, the definition information associated with the scene specifying information corresponding to the authentication scene information received by the receiving unit is read, according to the read definition information, An authentication apparatus comprising: a determination unit that determines a type of biometric authentication among a plurality of biometric authentications. The receiving unit receives first scene information and second scene information as authentication scene information;
Among the information stored in the storage unit, the definition information stores information indicating the type of biometric authentication used for authentication among a plurality of biometric authentications for each scene to be authenticated,
The determination unit reads definition information in which scene specifying information corresponding to the first scene information received by the reception unit is set, and among the read definition information, a living body corresponding to the received second scene information The authentication apparatus according to claim 2, wherein information indicating the type of authentication is searched, and the type of biometric authentication is determined according to the searched type of biometric authentication. The first scene information and the second scene information are different information and are any one of a place where authentication is performed, a time when authentication is performed, and a settlement amount when settlement is performed when authentication is established,
The scene specifying information and the definition information stored in the storage unit are different information, and include information indicating any of a place where authentication is performed, a time zone where authentication is performed, and a payment amount range,
The authentication apparatus according to claim 3, wherein the determination unit determines a type of biometric authentication according to a place where authentication is performed, a time when authentication is performed, and a settlement amount for performing settlement when authentication is established. Of the information stored in the storage unit, the definition information stores information indicating the order of biometric authentication used for authentication among a plurality of biometric authentications for each scene to be authenticated,
The determination unit reads definition information in which scene specifying information corresponding to the first scene information received by the reception unit is set, and among the read definition information, a living body corresponding to the received second scene information The information indicating the type of authentication and its order is searched, and the type and order of biometric authentication are determined according to the type and order of the searched biometric authentication. The authentication device described in 1. An authentication method in an authentication system in which a sensor, a terminal device, and a host device are connected, and a plurality of biometric authentications are possible based on biometric information input from the sensor,
The host device is
Sending authentication scene information indicating the situation of the biometric authentication to the authentication device,
The authentication device
Receiving authentication scene information transmitted from the host device;
Referring to the scene identification information and definition information stored in the storage unit stored in association with the scene identification information indicating the scene where the biometric authentication is performed and the definition information indicating which biometric authentication is performed, the received authentication scene An authentication method characterized by reading definition information associated with scene specifying information corresponding to information, and determining a type of biometric authentication among the plurality of biometric authentications according to the read definition information. An authentication method of an authentication device in an authentication system in which a plurality of biometric authentications based on biometric information input from a sensor and a host device are connected,
Receiving authentication scene information indicating the situation of the scene for performing the biometric authentication from the host device,
Referring to the scene identification information and definition information stored in the storage unit stored in association with the scene identification information indicating the scene where the biometric authentication is performed and the definition information indicating which biometric authentication is performed, the received authentication scene An authentication method characterized by reading definition information associated with scene specifying information corresponding to information, and determining a type of biometric authentication among the plurality of biometric authentications according to the read definition information.

Images