JP2007219731A - Method and apparatus for personal authentication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To achieve biometric authentication without reducing security even if biological information obtained from a person to be authenticated is low in reproducibility. <P>SOLUTION: When the biological information of a person to be authenticated is obtained, the biological information is collated with the biological information of all registrants previously registered and the highest matching rate is calculated. When the highest matching rate is equal to or greater than a first authentication threshold value, the person is authenticated as a registrant. When the highest matching rate is less than the first authentication threshold value, authentication information other than the biological information is obtained from the person so as to determine whether or not the authentication information exists in the authentication information of all the registrants previously registered. When the authentication information is determined to exist, a determination is made as to whether or not the highest matching rate is equal to or greater than a second threshold value lower than the first authentication threshold value; if the highest matching rate is determined to be equal to or greater than the second authentication threshold value, the person is authenticated as a registrant. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a personal authentication method and a personal authentication device using biometric information.

  In recent years, biometric authentication (biometric authentication) has come to be used as a method of personal authentication. Biometric authentication captures biometric information such as fingerprints, palm prints, handprints, veins on the back of hands, irises, faces, voices, and other physical features such as handwriting, keystrokes, etc. This is a method in which the identity is verified by collating with the biometric information of the registrant, and the person to be authenticated is authenticated with the registrant only when it is determined that they match. In the case of this biometric authentication, authentication is based on information on a part of the person's body or behavioral characteristics, and thus there is an advantage that the person is not forgotten and is less likely to be used by others. .

  However, since the reproducibility of the captured biometric information is not necessarily 100%, the person to be authenticated may be misrecognized as being another person even if the person is the registrant. In such a case, conventionally, there is no choice but to read biometric information until authentication is obtained or obtain authentication by a personal authentication method other than biometric authentication, for example, password authentication.

Incidentally, a technique for performing password authentication in addition to biometric authentication in order to increase the security of personal authentication is already known (see, for example, Patent Document 1). However, even in this method, since the determination level of biometric authentication is constant, the reproducibility of the captured biometric information is low, and thus it cannot be avoided if erroneous recognition occurs.
JP 2001-344605 A

  As described above, in the conventional technology, since the reproducibility of the biometric information captured from the person to be authenticated is low, even if the person is an authorized person but is not authenticated as a registrant, authentication is obtained by a method other than biometric authentication. There was only. Such a problem can be solved by lowering the threshold value of biometric authentication, but in such a case, it cannot be implemented because security is lowered.

  The present invention has been made based on such circumstances. The purpose of the present invention is to obtain biometric authentication without sacrificing security even when the reproducibility of biometric information captured from the person to be authenticated is low. It is an object of the present invention to provide a biometric authentication method and biometric authentication apparatus that can be used.

  The biometric authentication method of the present invention includes a registration step, a capture step, a verification step, a first biometric information determination step, a first authentication step, an authentication information determination step, a second biometric information determination step, and a second authentication step. Consists of. The registration step registers the registrant's biometric information and authentication information other than the biometric information in the storage unit. In the capturing step, the biometric information of the person to be authenticated is captured. In the collation step, the biometric information of the person to be authenticated captured in the capture step is collated with the biometric information of all registrants registered in the storage unit to obtain the maximum matching rate. In the first biometric information determination step, it is determined whether or not the maximum matching rate obtained in the collation step is equal to or greater than a preset first authentication threshold value. In the first authentication step, when it is determined in the first biometric information determination step that the maximum matching rate is equal to or higher than the first authentication threshold, the person to be authenticated is authenticated as a registrant. The authentication information determination step obtains authentication information other than the biometric information from the person to be authenticated when the first biometric information determination step determines that the maximum matching rate is less than the first authentication threshold, It is determined whether the information exists in the authentication information of all registrants stored by the storage means. In the second biometric information determination step, when it is determined in the authentication information determination step that authentication information exists, the maximum matching rate obtained in the collation step is equal to or higher than a second threshold value lower than the first authentication threshold value. It is determined whether or not. In the second authentication step, when it is determined in the second biometric information determination step that the maximum matching rate is equal to or higher than the second authentication threshold, the person to be authenticated is authenticated as a registrant.

  The personal authentication device of the present invention comprises storage means, biometric information fetching means, biometric matching means, first biometric information determination means, authentication information determination means, second biometric information determination means, and authentication means. . The storage means stores in advance the biometric information of the registrant and authentication information other than the biometric information. The biometric information fetching unit fetches the biometric information of the person to be authenticated. The biometric collating unit collates the biometric information of the person to be authenticated captured by the biometric information capturing unit with the biometric information of all registrants stored in the storage unit to obtain the maximum matching rate. The first biometric information determination unit determines whether or not the maximum matching rate obtained by the biometric matching unit is equal to or greater than a first authentication threshold value set in advance. The authentication information determination means acquires authentication information other than the biometric information from the person to be authenticated only when the first biometric information determination means determines that the maximum matching rate is less than the first authentication threshold, It is determined whether or not the authentication information exists in the authentication information of all registrants stored by the storage means. The second biometric information determining means is a second biometric information matching means in which the maximum matching rate obtained by the biometric matching means is lower than the first authentication threshold on condition that the authentication information determining means determines that authentication information exists. It is determined whether or not the authentication threshold is exceeded. The authenticating means authenticates the second coincidence when the maximum coincidence rate is determined to be greater than or equal to the first authentication threshold by the first biometric information judging means, or when the second biometric information judging means performs the second authentication. If it is determined that the threshold is greater than or equal to the threshold, the person to be authenticated is authenticated as a registrant.

  According to the present invention in which such measures are taken, it is possible to provide a biometric authentication method and a biometric authentication apparatus capable of obtaining biometric authentication without impairing security even when the reproducibility of biometric information captured from the person to be authenticated is low. .

The best mode for carrying out the present invention will be described below with reference to the drawings.
In this embodiment, fingerprint authentication is used as a biometric authentication method, and password authentication is used as an authentication method other than biometric authentication.

  FIG. 1 is a functional block diagram of a personal authentication device 10 in the present embodiment. The personal authentication device 10 includes a fingerprint reading unit 11, an ID / password input unit 12, an authentication information storage unit 13, a feature extraction unit 14, a fingerprint verification unit 15, a password verification unit 16, a display unit 17, a verification determination unit 18, and a control device. 20 and an interface unit 19.

  The fingerprint reading unit 11 captures the fingerprint surface of the finger pressed by the person to be authenticated, processes the image data, and reads the fingerprint data. Here, the fingerprint reading unit 11 functions as a biometric information fetching unit that fetches the biometric information of the person to be authenticated.

  The ID / password input unit 12 is used to input a user ID unique to a registrant assigned to all registrants registered in advance and a password that only the registrant can know. An input device such as a scanner or a card reader is used.

  As shown in FIG. 2, the authentication information storage unit 13 stores a pair of user IDs and passwords of all registrants and fingerprint feature data of the registrants. Each time a new registrant is created, the user ID and password of the registrant and fingerprint registration data are registered in the authentication information storage unit 13 by an operation input means (not shown) (registration step). Here, the authentication information storage unit 13 functions as storage means for storing the biometric information of the registrant and authentication information other than the biometric information in advance.

  The feature extraction unit 14 extracts a feature portion from the fingerprint read by the fingerprint reading unit 11 and creates fingerprint feature data.

  The fingerprint collation unit 15 sequentially collates the fingerprint feature data created by the feature extraction unit 14 with the fingerprint feature data of all registrants stored in the authentication information storage unit 13 to obtain the maximum matching rate. is there. Here, the fingerprint verification unit 15 includes the biometric information of the person to be authenticated captured by the biometric information capturing unit (fingerprint reading unit 11) and the biometric information of all registrants stored by the storage unit (authentication information storage unit 13). A biometric collating unit that collates information and obtains the maximum matching rate is configured.

  The password verification unit 16 verifies the password input via the ID / password input unit 12 and the password stored in the authentication information storage unit 13 corresponding to the user ID input together with the password. It is.

  The display unit 17 displays various messages for the person to be authenticated, and constitutes notification means.

  The collation determination unit 18 executes the process of the procedure shown in the flowchart of FIG. First, as ST (step) 1, a biometric information acquisition request to the person to be authenticated, that is, a message requesting reading of a fingerprint (for example, “please read the fingerprint”) is displayed on the display unit 17. In this state, it waits for fingerprint feature data collation by the fingerprint collation unit 15 as ST2.

  Here, when the person to be authenticated presses his / her finger against the fingerprint reading unit 11, the fingerprint reading unit 11 captures the fingerprint surface of the finger, processes the image data, and reads the fingerprint data (first data). Capture step). When the fingerprint data is read, the feature extraction unit 14 extracts a feature portion from the fingerprint data and creates fingerprint feature data. When the fingerprint feature data is created, the fingerprint collation unit 15 sequentially collates the fingerprint feature data with the fingerprint feature data of all the registrants stored in the authentication information storage unit 13, and each time, the matching rate Is calculated. If the maximum matching rate is obtained (first collation step), the user ID data corresponding to the fingerprint feature data that has obtained the maximum matching rate is read from the authentication information storage unit 13, and the value of the maximum matching rate is obtained. At the same time, the verification determination unit 18 is notified.

  Therefore, when the maximum matching rate is notified from the fingerprint collation unit 15 together with the user ID, the collation determination unit 18 recognizes that there is a fingerprint collation. Then, it is determined whether or not the maximum matching rate notified from the fingerprint collation unit 15 in ST3 is 90% or more preset as the first authentication threshold (first biometric information determination step: first Biological information determination means).

  Here, when the maximum matching rate is 90% or more, the person to be authenticated who has read the fingerprint is authenticated as a registrant identified by the user ID notified together with the maximum matching rate. (First authentication step: authentication means). Then, the process proceeds to ST10 described later.

  On the other hand, if the maximum matching rate is less than 90%, a request for acquiring authentication information other than biometric information, that is, a message requesting input of a user ID and a password (for example, “input user ID and password”). Please display ") on the display unit 17. In this state, it waits for password verification by the password verification unit 16 as ST5.

  When the person to be authenticated operates the ID / password input unit 12 and inputs his / her user ID and password, the password verification unit 16 stores the authentication information in the authentication information storage unit 13 corresponding to the input user ID. The entered password is read, and the entered password is verified to determine whether or not they match. Then, the determination result is notified to the collation determination unit 18.

  Accordingly, upon receiving the password verification result from the password verification unit 16, the verification determination unit 18 determines that there is a password verification, and determines whether the password verification result matches or does not match as ST6 (authentication information determination step: authentication) Information determination means). Here, if the password verification results do not match, it is determined that the person to be authenticated cannot be authenticated. Then, the process proceeds to ST12, and a message indicating that authentication is impossible (for example, “authentication NG”) is displayed on the display unit 17.

  On the other hand, if the password verification results match, in ST7, a message for requesting the person to be authenticated to reacquire biometric information, that is, a request to read the fingerprint again (for example, “Reprint fingerprint again”). Please display ") on the display unit 17. In this state, it waits for fingerprint feature data collation by the fingerprint collation unit 15 as ST8.

  Here, when the person to be authenticated presses his / her finger against the fingerprint reading unit 11 again, the fingerprint reading unit 11 captures the fingerprint surface of the finger, processes the image data, and reads the fingerprint data (second). Capture step). When the fingerprint data is read, the feature extraction unit 14 extracts a feature portion from the fingerprint data and creates fingerprint feature data. When the fingerprint feature data is created, the fingerprint collation unit 15 sequentially collates the fingerprint feature data with the fingerprint feature data of all the registrants stored in the authentication information storage unit 13, and each time, the matching rate Is calculated. When the maximum matching rate is obtained (second matching step), the user ID data corresponding to the fingerprint feature data from which the maximum matching rate is obtained is read from the authentication information storage unit 13, and the maximum matching rate The verification determination unit 18 is notified together with the value.

  Therefore, when the maximum matching rate is notified from the fingerprint collation unit 15 together with the user ID, the collation determination unit 18 recognizes that there is a fingerprint collation. Then, in ST9, it is determined whether or not the maximum matching rate received from the fingerprint collation unit 15 is 80% or more, which is a second authentication threshold value lower than 90% set in advance as the first authentication threshold value. Judgment (second biological information determination step: second biological information determination means).

  Here, when the maximum matching rate is 80% or more, the person to be authenticated who has read the fingerprint is authenticated as a registrant identified by the user ID notified together with the maximum matching rate. (Second authentication step: authentication means). Then, the user ID authenticated as a registrant in ST10 is output to the control device 20 connected to the interface unit 19. In ST11, a message indicating that authentication is possible (for example, “authentication OK”) is displayed on the display unit 17.

  On the other hand, when the maximum coincidence rate is less than 80%, it is determined that authentication of the person to be authenticated is impossible. Then, the process proceeds to ST12, and a message indicating that authentication is impossible (for example, “authentication NG”) is displayed on the display unit 17.

  If a message indicating that authentication is possible or not is displayed on the display unit 17, the collation determination unit 18 waits for a certain period of time necessary for confirmation of the message to elapse as ST13. If a predetermined time has elapsed, the process returns to ST1, and a message requesting reading of the fingerprint is displayed on the display unit 17.

  In the personal authentication device 10 of this embodiment configured as described above, fingerprint feature data that is biometric information of all registrants registered in advance as a user of the control device 20 and a password that is authentication information other than biometric information. Is stored and held in the authentication information storage unit 13 in association with a unique user ID for identifying each registrant.

  Thus, the person to be authenticated who requests access to the control device 20 presses his / her finger against the fingerprint reading unit 11. Then, the fingerprint is read and feature data of the fingerprint is generated. Then, the fingerprint feature data of the person to be authenticated and the fingerprint feature data of all registrants registered in the authentication information storage unit 13 are collated to obtain the maximum matching rate. As a result, when the maximum matching rate is 90% or more which is the first authentication threshold, the person to be authenticated is authenticated as a registrant. The user ID stored in the authentication information storage unit 13 corresponding to the fingerprint feature data in the authentication information storage unit 13 having the highest matching rate with the fingerprint feature data of the person to be authenticated is the interface unit 19. Is output to the control device 20. Thereby, access to the control apparatus 20 by a to-be-authenticated person is permitted.

  On the other hand, if the maximum matching rate is less than 90%, a message requesting input of the user ID and password is displayed on the display unit 17. As a result, the person to be authenticated inputs his / her user ID and password via the ID / password input unit 12. If it does so, it will be collated whether this input password corresponds with the password memorize | stored and held in the authentication information memory | storage part 13 corresponding to the user ID input with the said password. As a result, if both passwords match, a message requesting the fingerprint to be read again is displayed on the display unit 17.

  The person to be authenticated presses the finger against the fingerprint reading unit 11 again. Then, the fingerprint is read again, and characteristic data of the fingerprint is generated. Then, the fingerprint feature data of the person to be authenticated and the fingerprint feature data of all registrants registered in the authentication information storage unit 13 are collated to obtain the maximum matching rate. As a result, when the maximum matching rate is 80% or more, which is a second threshold value lower than the first authentication threshold value, the person to be authenticated is authenticated as a registrant. The user ID stored in the authentication information storage unit 13 corresponding to the fingerprint feature data in the authentication information storage unit 13 having the highest matching rate with the fingerprint feature data of the person to be authenticated is the interface unit 19. Is output to the control device 20. Thereby, access to the control apparatus 20 by a to-be-authenticated person is permitted.

  If the password authentication does not match, or if the maximum matching rate is less than 80% in the second fingerprint authentication, authentication is impossible. In this case, access to the control device 20 by the person to be authenticated is not permitted.

  As described above, according to the present embodiment, the reproducibility of the fingerprint data captured from the person to be authenticated is low, and the maximum matching rate in the first fingerprint authentication is less than 90% that can ensure sufficient security. However, password authentication is performed on the person to be authenticated, and when the password authentication is obtained, the second fingerprint authentication is performed, and if the maximum matching rate is 80% or more, the authentication is obtained. Therefore, even if the threshold value for fingerprint authentication is lowered from 90% to 80%, personal authentication using a password is obtained, so that fingerprint authentication can be obtained without impairing security.

  The present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage.

  FIG. 4 is a flowchart showing another embodiment of the process executed by the collation determining unit 18. Note that the same processing steps as those shown in the flowchart of FIG. 3 are denoted by the same reference numerals, and detailed description thereof is omitted. That is, in this other embodiment, when the maximum matching rate received from the fingerprint collation unit 15 in ST3 is less than 90% preset as the first authentication threshold, ST21 Add a process to store the maximum match rate value. Then, when the password verification result matches in ST6 and password authentication is obtained, in the previous embodiment, it is determined whether or not the maximum matching rate of the fingerprint data read again in ST9 is 80% or more. In this other embodiment, it is determined whether or not the maximum matching rate stored in the processing of ST21 is 80% or more. By doing so, it is not necessary to read the fingerprint of the person to be authenticated again, so that the processing procedure can be simplified and the processing speed can be improved.

  In each of the above embodiments, the first threshold value for the maximum matching rate is 90% and the second threshold value is 80%. However, the threshold value is not limited to this. There is no end.

  In each of the above embodiments, the biometric information is fingerprint data. However, the biometric information is not limited to fingerprints, and physical features such as palm prints, handprints, veins on the back of hands, irises, faces, voices, and handwriting. , Physical characteristics such as keystrokes. Further, authentication information other than biometric information is not limited to a password set and registered in advance for each registrant. For example, a common code that is regularly changed using a date or the like as a parameter is input instead of a password. Thus, authentication may be obtained.

Moreover, in each said embodiment, although the alerting | reporting means was used as the display means on the display part 17, a alerting | reporting means is not limited to this, For example, it is comprised so that it may alert | report to a to-be-authenticated person by an audio | voice. May be.
In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, the constituent elements over different embodiments may be combined.

The functional block diagram of the personal authentication apparatus which is one embodiment of this invention. The schematic diagram which shows an example of the data structure memorize | stored in the authentication information storage part shown by FIG. 2 is a flowchart showing one main processing procedure of a collation determination unit shown in FIG. 1. The flowchart which shows the other process sequence of the collation determination part shown by FIG.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Personal authentication apparatus, 11 ... Fingerprint reading part, 12 ... ID / password input part, 13 ... Authentication information storage part, 14 ... Feature extraction part, 15 ... Fingerprint collation part, 16 ... Password collation part, 17 ... Display part, 18 ... collation determination unit, 19 ... interface unit, 20 ... control device.

Claims (4)

A registration step of registering the biometric information of the registrant and authentication information other than the biometric information in the storage unit;
A capture step for capturing the biometric information of the person to be authenticated
A collation step for collating the biometric information of the person to be authenticated and the biometric information of all the registrants registered in the storage unit to obtain the maximum matching rate;
A first biometric information determination step for determining whether or not the maximum matching rate obtained by the collation step is equal to or greater than a first authentication threshold value set in advance;
A first authentication step for authenticating that the person to be authenticated is a registrant if the maximum matching rate is determined to be greater than or equal to the first authentication threshold in the first biometric information determination step;
If it is determined in the first biometric information determination step that the maximum matching rate is less than the first authentication threshold, authentication information other than the biometric information is acquired from the person to be authenticated, and the authentication information is stored in the memory An authentication information determination step for determining whether or not the authentication information exists in all the registrant authentication information stored by the means;
If it is determined in this authentication information determination step that authentication information exists, it is determined whether or not the maximum matching rate obtained in the collation step is equal to or higher than a second threshold value lower than the first authentication threshold value. A second biological information determination step for determining;
A second authentication step for authenticating that the person to be authenticated is a registrant when it is determined in the second biometric information determination step that the maximum matching rate is equal to or greater than a second authentication threshold;
A personal authentication method characterized by comprising: A registration step of registering the biometric information of the registrant and authentication information other than the biometric information in the storage unit;
A first capturing step for capturing biometric information of the person to be authenticated;
A first collation step for obtaining a maximum matching rate by collating the biometric information of the person to be authenticated captured in the first capture step with the biometric information of all registrants registered in the storage unit;
A first biometric information determination step for determining whether or not the maximum matching rate obtained in the first collation step is equal to or greater than a first authentication threshold value set in advance;
A first authentication step for authenticating that the person to be authenticated is a registrant if the maximum matching rate is determined to be greater than or equal to the first authentication threshold in the first biometric information determination step;
If it is determined in the first biometric information determination step that the maximum matching rate is less than the first authentication threshold, authentication information other than the biometric information is acquired from the person to be authenticated, and the authentication information is stored in the memory An authentication information determination step for determining whether or not the authentication information exists in all the registrant authentication information stored by the means;
When it is determined that the authentication information is present in the authentication information determination step, a second acquisition step of acquiring again the biometric information of the person to be authenticated;
A second collation step of collating the biometric information of the person to be authenticated captured in the second capture step with the biometric information of all registrants registered in the storage unit to obtain a maximum matching rate;
A second biometric information determination step for determining whether or not the maximum matching rate obtained by the second collation step is equal to or higher than a second threshold value lower than the first authentication threshold value;
A second authentication step for authenticating that the person to be authenticated is a registrant when it is determined in the second biometric information determination step that the maximum matching rate is equal to or greater than a second authentication threshold;
A personal authentication method characterized by comprising: Storage means for storing biometric information of the registrant and authentication information other than the biometric information in advance;
Biometric information capturing means for capturing biometric information of the person to be authenticated;
A biometric matching unit that compares the biometric information of the person to be authenticated captured by the biometric information capturing unit with the biometric information of all registrants stored in the storage unit to obtain a maximum matching rate;
First biometric information determining means for determining whether or not the maximum matching rate obtained by the biometric matching means is greater than or equal to a first authentication threshold value set in advance;
Authentication information other than biometric information is acquired from the person to be authenticated only when the first biometric information determination means determines that the maximum matching rate is less than the first authentication threshold, and the authentication information is Authentication information determination means for determining whether or not the authentication information exists in all the registrant authentication information stored in the storage means;
The maximum matching rate obtained by the biometric matching unit on condition that the authentication information is determined to be present by the authentication information determination unit is equal to or higher than a second authentication threshold value lower than the first authentication threshold value. Second biological information determination means for determining whether there is,
When the first biometric information determination unit determines that the maximum match rate is equal to or higher than the first authentication threshold value, or the second biometric information determination unit sets the maximum match rate to the second authentication threshold value. An authentication means for authenticating that the person to be authenticated is a registrant when it is determined that
A personal authentication device comprising: Further comprising a notification means,
When the first biometric information determining means determines that the maximum matching rate is less than the first authentication threshold, the notifying means sends an acquisition request for authentication information other than biometric information to the person to be authenticated. The biometric information reacquisition request is notified to the person to be authenticated through the notification means when the authentication information determination means determines that the authentication information exists. 3. The personal authentication device according to 3.

Images