JP2007156790A - Authentication technique for authentication using a plurality of types of biometric information - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique that can maintain sufficient authentication accuracy and shorten time for authentication in biometric authentication. <P>SOLUTION: When a user starts a transaction, biometric information reading parts acquire from the user first type matching biometric information of a small data volume and second type matching biometric information of a large data volume. A biometric information database registering in advance first type biometric information and second type biometric information about users is searched on the first type matching biometric information, and one or more candidates whose first type biometric information has a high rate of matching with the first type matching biometric information are selected from the biometric information database. The second type matching biometric information is next matched against the candidates' second type biometric information, and if it is authenticated successfully, the transaction is started. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an authentication technique using biometric information.

  When a user starts a cash transaction or facility use, a technique for authenticating that the user is a registered user by collating biometric information with a terminal or the like has become widespread. In this technique, fingerprints, veins, irises, etc. are mainly used as biological information. With this technology, the accuracy of identity authentication is very high, and it is safer and more convenient than conventional identity authentication technology using IDs (identification cards) such as cards and passbooks.

JP 11-338947 A JP 2002-14934 A

  Bank financial transaction systems and facility usage management systems using conventional biometric authentication technology provide personal information such as addresses and names, and IDs (identification cards) such as cards and passbooks. Users are searched from the database and authenticated by biometric information. The biometric information can originally identify the person by itself, and can accurately search for a user registered in the database based only on the biometric information. However, in order to maintain sufficient accuracy to accurately match biometric information (hereinafter referred to as “authentication accuracy”), it is necessary to increase the amount of biometric data, and registered users (data to be searched) In the case where the number of bioinformation increases, the processing time required to search for such biometric information also increases. Therefore, an object of the present invention is to provide a technique capable of sufficiently maintaining the authentication accuracy in biometric authentication and shortening the time required for authentication.

  In order to achieve the above object, the method of the present invention is a method for authenticating an individual using a biometric information database in which first type biometric information and second type biometric information are registered for each user. One or more candidates by obtaining the first-type verification biometric information and the second-type verification biometric information from the person and searching the biometric information database using the first-type verification biometric information Performing the first authentication to select the second type biometric information registered in the biometric information database with respect to the candidate and the second type authentication for verifying the second type verification biometric information. And determining the success or failure of authentication relating to the candidate, wherein the information amount of the first type biometric information is set smaller than the information amount of the second type biometric information.

  According to this method, since the primary authentication is performed using biometric information with a small data amount, the time required for the authentication can be shortened. Since the second authentication is performed only for the candidates selected in the first authentication, the number of verifications using biometric information with a large amount of data can be reduced and can be performed with high authentication accuracy.

  In the primary authentication, a candidate having a first matching rate of the first type biometric information and the first type biometric biometric information that is equal to or higher than a predetermined first threshold is selected, and the candidate is selected from the candidates. The step of performing the second authentication in order from the person with the highest first matching rate, and assuming that the authentication is established when the second matching rate at the time of the second authentication is equal to or higher than a predetermined second threshold value. May be provided.

  According to this method, the first authentication and the second authentication are performed based on the matching rate at the time of collation of biometric information, so that candidate selection in the first authentication is facilitated and the second authentication is performed. The authentication accuracy in authentication also increases.

  Further, when the authentication is established, a step of executing a transaction relating to the user without receiving provision of the user's identification certificate may be provided.

  According to this method, the user can start a desired transaction only by authenticating his / her own biometric information.

  The present invention can be realized in various forms. For example, a user authentication method and a user authentication system in an automatic financial transaction system using an automatic teller machine (ATM terminal) such as a bank, User authentication method and user authentication device in a facility that can be used by authenticating a pre-registered user, a computer program for realizing the function of the method or device, and a record recording the computer program It can be realized in the form of a medium, a data signal including the computer program and embodied in a carrier wave, and the like.

Next, embodiments of the present invention will be described in the following order based on examples.
A. Overall configuration of the device:
B. First embodiment:
C. Second embodiment:
D. Modified example

A. Overall configuration of the device:
FIG. 1 is a block diagram showing an automatic financial transaction system having an ATM terminal for performing biometric authentication as an embodiment of the present invention. In this automatic financial transaction system, an ATM terminal 100 and a computer center 120 are connected via a network 110. The ATM terminal 100 includes a fingerprint reading unit 101, a finger vein reading unit 102, a biometric information editing unit 103, an ATM control unit 104, a display unit 105, and an input unit 106. The computer center 120 includes a personal information database 121, a fingerprint information search unit 122, a finger vein information matching unit 123, and a computer center control unit 124. This automatic financial transaction system can also be realized as an automatic financial transaction apparatus having the functions of both the ATM terminal 100 and the computer center 120.

  The fingerprint reading unit 101 can acquire the image data FP of the user's fingerprint, and the finger vein reading unit 102 can acquire the image data FV of the user's finger vein. As a method for reading these biological information, a method for optically reading an image of a living body may be used, a method for reading a charge at a contact portion between a sensor and a living body using a semiconductor, or another method may be used. The target finger may be any of the five fingers, the fingerprint reading unit 101 may acquire the fingerprint of the index finger, and the finger vein reading unit 102 may acquire the finger vein of the middle finger of the same hand. Alternatively, the fingerprint reading unit 101 may simultaneously acquire the fingerprint of the index finger of one hand, and the finger vein reading unit 102 may simultaneously acquire the finger vein of the index finger of the other hand.

  The biometric information editing unit 103 performs editing processing on data that can be used for matching in the present system, such as extracting feature portions of image data acquired by the fingerprint reading unit 101 and the finger vein reading unit 102. By being processed by the biometric information editing unit 103, the fingerprint image data FP is converted into the first type verification biometric information CB1, and the finger vein image data FV is converted into the second type verification biometric information CB2. The edit processing method performed by the biometric information editing unit 103 may be a method other than extracting a feature portion. The first type collation biometric information CB1 is preferably set so that the data amount is smaller than that of the second type collation biometric information CB2. For example, the data amount of the first type verification biometric information CB1 may be set to be equal to or less than half the data amount of the second type verification biometric information CB2.

  The ATM control unit 104 includes a display unit 105 and an input unit 106, controls input / output of information related to user authentication and information related to transactions with the user, and performs information transmission processing with the outside via the network 110. Also controls. The display unit 105 and the input unit 106 may be an integrated touch panel.

  FIG. 2 is an explanatory diagram showing the contents of the personal information database 121. In the personal information database 121, the account number 21, personal ID number 22, name 23, address 24, date of birth 25, and first type biometric information BI1 are registered in the personal information database 121 when the user makes a contract. And the second type biological information BI2 are registered. The first type biometric information BI1 is biometric information obtained by the same processing as the biometric information editing unit 103 from the fingerprint image data of the user acquired at the time of contract. The second type biometric information BI2 is biometric information obtained by the same processing as the biometric information editing unit 103 from the finger vein image data of the user acquired at the time of contract. The first type biometric information BI1 and the second type biometric information BI2 are information corresponding to the first type biometric information CB1 and the second type biometric information CB2. In the personal information database 121, personal information regarding other users may be registered, or information regarding the contract contents of the users and usage history may be registered.

  The fingerprint information retrieval unit 122 retrieves the first type biometric information BI1 from the personal information database 121, performs collation with the first type biometric information CB1 provided from the ATM terminal 100, and selects a candidate. Perform next authentication. The finger vein information collation unit 123 collates the second type biometric information BI2 of the candidate selected by the fingerprint information search unit 122 with the second type biometric information CB2 provided from the ATM terminal 100, and the user Secondary authentication for determining success or failure of the authentication is performed. Note that the functions of the fingerprint information search unit 122 and the finger vein information collation unit 123 may be realized by a single collation unit.

  The computer center control unit 124 controls authentication processing in the computer center 120. Further, the computer center control unit 124 can be configured to have a function of performing transaction settlement according to the transaction content set by the user using the ATM terminal 100.

B. First embodiment:
FIG. 3 is a flowchart showing the processing of the ATM terminal 100 in the first embodiment, and FIG. 4 is a display example of a message for the user displayed on the display unit 105 of the ATM terminal 100. When the user intends to start an automatic financial transaction using the ATM terminal 100, the user follows his / her instructions in the display example D1 (FIG. 4) displayed on the display unit 105 with his / her finger and the fingerprint reading unit 101 which is a collation unit. It is placed on the vein reading unit 102. When the ATM terminal 100 senses it, it acquires the fingerprint image data FP of the user and the finger vein image data FV, and the biometric information editing unit 103 performs the first type verification biometric information CB1 and the second type verification biometric information. CB2 is generated (S301).

  The first type verification biometric information CB1 and the second type verification biometric information CB2 are transmitted to the computer center 120 through the network 110 by the ATM control unit 104 (S302). Further, the ATM control unit 104 displays a display example D2 (FIG. 4) on the display unit 105. Step S303 is a process performed in the computer center 120, and the process performed in the computer center 120 will be described below.

  FIG. 5 is a flowchart showing processing of the computer center 120 in the first embodiment. When the computer center control unit 124 receives provision of the first type verification biometric information CB1 and the second type verification biometric information CB2 from the ATM terminal 100, the computer center control unit 124 sets the first type verification biometric information CB1 in the fingerprint information search unit 122. Then, the second type verification biometric information CB2 is set in the finger vein information verification unit 123 (S501).

  When the first type verification biometric information CB1 is set, the fingerprint information search unit 122 sets the first type biometric information BI1 and the first type verification biometrics for all users registered in the personal information database 121. Collation with the information CB1 is started (S502). The fingerprint information search unit 122 first registers the matching rate at the time of collation with the user as a temporary candidate after completing the collation of the first person. When the matching rate at the time of matching is higher than the matching rate of the temporary candidate, the matching rate is registered as a new temporary candidate. When the collation for all the users is completed, only one temporary candidate finally registered is selected as the candidate with the highest matching rate (S503). The processing from step S502 to step S503 is primary authentication. If even one person whose matching rate is higher than a predetermined value N1 (for example, 90%) is found, the user may be selected as a candidate and the search may be terminated.

  In step S504, if the candidate matching rate is lower than the predetermined value N1, it is determined that there is no relevant candidate in the first authentication, and the result of “no relevant candidate” is transmitted to the ATM terminal 100 (S506).

  Next, the computer center control unit 124 sets the second-type biometric information BI2 of the candidate from the personal information database 121 to the finger vein information matching unit 123. The finger vein information collating unit 123 collates the second type biometric information BI2 and the second type biometric information CB2 (S505; secondary authentication), and the matching rate at that time is a predetermined value N2 (for example, 95%). If it is lower, it is determined that authentication is not established, and if it is higher, it is determined that authentication is established. The predetermined value N2 at this time may be arbitrarily set in advance by the administrator. However, the predetermined value N2 is preferably set to a value that can ensure high authentication accuracy (for example, another person acceptance rate 0.001%, identity rejection rate 0.01%).

  The computer center control unit 124 transmits this authentication result to the ATM terminal 100 (S506). The processing up to this point is the processing performed at the computer center 120, and the processing that is subsequently performed at the ATM terminal 100 will be described.

  The ATM control unit 104 receives the authentication result from the computer center 120 (S304 in FIG. 3). If the user is not authenticated in step S305, the ATM control unit 104 displays the display example D4 (FIG. 4) on the display unit 105 (S307), and the transaction is not started. On the other hand, if the user is authenticated in step S305, the ATM control unit 104 displays the display example D3 (FIG. 4) on the display unit 105, and according to the transaction content set by the user using the input unit 106. A transaction is started (S306). The contents of the transaction at this time are transmitted to the computer center 120, and the transaction settlement is performed by the computer center control unit 124.

  According to the first embodiment, since the first authentication for collating with the user registered in the personal information database 121 is performed using the first type biometric information BI1 with a small amount of data, the collation time is set. Can be shortened. Further, since the second authentication performed on one candidate selected in the first authentication is performed using the second type biometric information BI2 having a large data amount, the authentication accuracy is increased. Therefore, the user can safely start a transaction without using an ID (identification card) such as a passbook or a card for identifying an individual.

C. Second embodiment:
The processing procedure of the ATM terminal 100 in the second embodiment is the same as that in the first embodiment, and the detailed procedure in step S303 is only different from that in the first embodiment.

  FIG. 6 is a flowchart showing the detailed procedure of step 303 in the second embodiment. The process in step S601 is the same as the process in step S501 (FIG. 5) in the first embodiment.

  When the first type verification biometric information CB1 is set, the fingerprint information search unit 122 searches the first type biometric information BI1 for each user registered in the personal information database 121, and performs first type verification. Collation with the biological information CB1 is started. The fingerprint information search unit 122 selects all customers whose matching rate at the time of matching is higher than a predetermined value N1 as candidates (S602: primary authentication). In this case, a plurality of candidates may be used.

  In step S603, if there are one or more candidates in step S602, the computer center control unit 124 proceeds to the processing of step S604. If there is no candidate, the computer center control unit 124 gives the result of “no candidate” to the ATM terminal 100. Transmit (S607).

  The computer center control unit 124 sets the second-type biometric information BI2 of each candidate in the finger vein information matching unit 123 one by one in descending order of the matching rate at the time of primary authentication (S604). The finger vein information collating unit 123 collates with the second type biometric information CB2 each time the second type biometric information BI2 of each candidate is set, and registers the matching rate at that time (S605).

  In step S606, if all the candidates have been verified, the computer center control unit 124 determines that the authentication has been established for the candidate whose matching rate is higher than the predetermined value N2 and has the highest matching rate ( Second authentication). On the other hand, if there is no applicable candidate, the result of “no applicable candidate” is transmitted to the ATM terminal 100 (S607). If all the candidates have not been collated, the processes from step S604 to step S606 are repeated until all candidates have been collated.

  According to the second embodiment, since the second authentication is performed for a plurality of candidates selected in the first authentication, the authentication accuracy is higher than that in the first embodiment in which the second authentication is performed for each candidate. Get higher.

D. Variation:
The present invention is not limited to the above-described examples and embodiments, and can be implemented in various modes without departing from the gist thereof. For example, the following modifications are possible.

D1. Modification 1:
As biometric information used for authentication, various information other than the above-described embodiments can be used. For example, the biometric information to be subjected to secondary authentication may be palm veins instead of finger veins, or may be a combination of face authentication for primary authentication and iris authentication for secondary authentication. Moreover, it is preferable to use 2 or more types of biological information. Furthermore, the biometric information used for the second authentication is preferably biometric information of a body part with a high authentication rate. Also, a plurality of types of biometric information may be registered in advance, and the user may be able to select the type of biometric information used for collation when collating.

D2. Modification 2:
In the above embodiment, instead of acquiring the two pieces of biometric information CB1 and CB2 almost simultaneously, after obtaining the first type verification biometric information CB1, the second type is selected when the candidate is selected in the first authentication. The verification biometric information CB2 may be acquired and the second authentication may be performed. In this case, if a candidate is not selected in the primary authentication, the authentication process may be stopped without acquiring the second type verification biometric information CB2.

D3. Modification 3:
In the above embodiment, a part of the configuration realized by hardware may be replaced by software, and conversely, a part of the configuration realized by software may be replaced by hardware. For example, the processing performed by each unit of the computer center 120 may be realized by application software on a server computer.

D4. Modification 4:
In the above embodiment, the automatic financial transaction system realized by using the ATM terminal 100 as a terminal replaces the ATM terminal 100 with a terminal used for facility use management of a user in the facility, and identifies an individual ( It may be a facility management system that does not require an identification card. The facility in this case may be a facility that can be used by a user registering in advance, such as a hotel.

The block diagram which shows the structure of an automatic financial transaction system as one Example of this invention. Explanatory drawing which shows the data content registered into the personal information database 121. FIG. The flowchart which shows the process sequence of the ATM terminal 100 in 1st Example and 2nd Example. FIG. 7 is an explanatory diagram illustrating an example of a display screen of the display unit 105. The flowchart which shows the process sequence of the computer center 120 in 1st Example. The flowchart which shows the process sequence of the computer center 120 in 2nd Example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... ATM terminal 101 ... Fingerprint reading part 102 ... Finger vein reading part 103 ... Biometric information editing part 104 ... ATM control part 105 ... Display part 106 ... Input part 110 ... Network 120 ... Computer center 121 ... Personal information database 122 ... Fingerprint information Search unit 123 ... finger vein information collation unit 124 ... computer center control unit 21 ... account number 22 ... personal ID number 23 ... name 24 ... address 25 ... date of birth BI1 ... first type biometric information BI2 ... second type biometric information D1 ... Display example 1
D2 ... Display example 2
D3 ... Display example 3
D4 ... Display example 4

Claims (6)

A method for authenticating an individual using a biometric information database in which first type biometric information and second type biometric information are registered for each user,
Obtaining biometric information for type 1 verification and biometric information for type 2 verification from a user;
Performing a first authentication for selecting one or more candidates by searching the biometric information database using the first type collation biometric information;
Determining the success or failure of authentication regarding the candidate by secondary authentication for verifying the second type biometric information registered in the biometric information database with respect to the candidate and the second type verification biometric information; When,
With
The information amount of the first type biological information is set to be smaller than the information amount of the second type biological information. The method of claim 1, comprising:
In the first authentication, a candidate whose first matching rate between the first type biometric information and the first type biometric information is equal to or higher than a predetermined first threshold is selected.
The second authentication is performed in order from the candidate with the first highest matching rate among the candidates, and authentication is performed when the second matching rate at the time of the second authentication is equal to or higher than a predetermined second threshold. Is considered to be established. The method according to claim 1 or 2, further comprising:
A method comprising a step of executing a transaction relating to the user without receiving provision of the user's identification certificate when the authentication is established. A system for authenticating an individual using biometric information,
A biometric information database unit in which the first type biometric information and the second type biometric information are registered for each user;
A biometric information reading unit that obtains biometric information for type 1 verification and biometric information for type 2 verification from a user;
The first authentication for selecting one or more candidates is performed by searching the biometric information database using the first type verification biometric information, and the candidates are registered in the biometric information database. A biometric information matching unit that determines success or failure of authentication related to the candidate by secondary authentication for matching second type biometric information and the second type biometric biometric information;
A biological information editing unit having a function of setting the information amount of the first type biological information smaller than the information amount of the second type biological information;
A system comprising: The system according to claim 4, wherein
In the first authentication, the biometric information matching unit selects a candidate whose first matching rate between the first type biometric information and the first type biometric information is greater than or equal to a predetermined first threshold. The second authentication is performed in descending order of the candidates from the candidates with the first matching rate, and the second matching rate at the time of the second authentication is equal to or higher than a predetermined second threshold. A system that has the function to be considered authenticated. 6. The system according to claim 4 or 5, further comprising:
A system including a transaction settlement unit that executes a transaction related to the user without receiving provision of an identification certificate by the user when the authentication is established.

Images