JP2008009690A - Entry management device, access management device, and entry management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an entry management device detecting that an RFID is given to another person or stolen at any time from a person with the RFID tag who is going to enter a room. <P>SOLUTION: The entry management device comprises a long-range reading part 38 reading information including ID information of an authenticated person 10 from an RFID tag part 18 for a long range; a short-range reading part 44 reading information including authentication information of the authenticated person 10 from an RFID tag part 20 for a short range; photographing parts 6, 8 acquiring authentication information of the authenticated person 10; a first determining part 50 determining whether to allow the authenticated person 10 to enter the room based on the information read by the long-range reading part 38; and a second determining part 52 determining whether the authenticated person 10 can be authenticated based on the authentication information acquired by the photographing parts 6, 8 and the authentication information of the authenticated person 10 read by the short-range reading part 44. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an entrance management apparatus for restricting the number of people who are allowed in advance to be provided in a highly secure building or room, and in particular, entrance management that performs entrance management using biometric authentication processing such as an iris. The present invention relates to a device, an entrance / exit management device, and an entrance management method.

  In recent years, as a method of personal authentication at the time of access in devices that require high security such as entry / exit management devices and information devices storing important information such as personal information, human fingerprints, irises, fundus blood vessels, facial Various authentication methods using information unique to the person to be authenticated, such as features, blood vessel patterns of hands and arms, so-called biometric information, have been put into practical use.

  Among them, the authentication method using the difference in the eyelid pattern of the iris part of the eye (hereinafter referred to as “Iris”) due to its high reliability such as high identity authentication rate and low acceptance rate of others. Has been put to practical use in devices that require particularly high security (for example, see Patent Document 1).

  Such an iris authentication method selectively encodes an iris portion from an image of the eye portion of the person to be authenticated (hereinafter, this image is referred to as an “eye image”), and uses the obtained information as authentication information. If the degree of inconsistency with information registered in advance (hereinafter referred to as “registered authentication information”) is calculated, and the degree of inconsistency is compared with a predetermined threshold value, This is a method for authenticating that a person is a person registered in advance.

  When this iris authentication method is used, authentication processing is performed on a person who tries to enter a highly secure room or building, and the person who tries to enter the room is authenticated as a pre-registered person. A technique applied to a so-called entrance / exit management device that permits entry into the room or building has been proposed.

  Recently, a technique using an RFID (Radio Frequency Identification) tag has been proposed when the iris authentication method is applied to an entrance / exit management device. The RFID tag is a minute wireless IC chip used for identifying an object, records information such as its own identification code, and transmits / receives information to / from a management system using radio waves.

For example, among a plurality of persons who are going to enter the room, the iris is authenticated for the guide, and for other guests, etc., the number of guests who are going to enter and leave the room is managed by using the RFID tag. A technique that can be grasped has been proposed (see, for example, Patent Document 2).
Japanese Patent No. 3307936 JP 2000-155863 A

  However, in the technology as described above, when a plurality of people try to enter the room, the guide can perform highly secure iris authentication, but for guests who want to enter the room with the guide, Since authentication is performed using a removable RFID tag, for example, when a guest gives or drops a RFID tag to another person at any time before or after entering the room (hereinafter, such a case) However, the problem was that it was difficult to detect.

  The present invention has been made in view of such a problem, and when a person who has an RFID tag to enter the room has given or taken away an RFID tag to another person at any point in time, It is an object of the present invention to provide an entrance management device, an entrance / exit management device, and an entrance management method capable of performing the detection.

  An entrance management apparatus according to the present invention is an entrance management apparatus for managing entrance of a person to be authenticated who wants to enter a room, a long-distance reading unit that reads out information including ID information of the subject from a long-distance ID tag, A short-distance reading unit that reads information including authentication information of the person to be authenticated from an ID tag for short distance, an authentication information acquisition unit that acquires authentication information of the person to be authenticated, and information read by the long-distance reading unit A first determination unit that determines whether or not the person to be authenticated can enter the room, authentication information acquired by the authentication information acquisition unit, and authentication information of the user to be authenticated read by the short distance reading unit And a second determination unit that determines whether or not the person to be authenticated can be authenticated, the first determination unit determines that the person to be authenticated can enter the room, and the second determination unit authenticates the person to be authenticated. Permission to enter the person to be authenticated when it is determined that the person can be authenticated It is characterized by comprising and.

  According to such a configuration, the ID information of the person to be authenticated is read from the ID tag for long distance, and the entrance determination is performed based on the ID information, and the authentication information is read from the ID tag for short distance. The person who has the RFID tag who wants to enter the room can also be detected even if the RFID tag is handed over or taken away by another person at any point in time. An entrance management device can be provided.

  Moreover, the structure provided with the number measurement part which counts the number of to-be-authenticated persons using the information read by the long distance reading part may be sufficient.

  According to such a configuration, since the number of persons to be authenticated can be measured, management using the number of persons can also be performed.

  Moreover, the structure provided with the position specific | specification part which specifies the position of a to-be-authenticated person using the information read by the long distance reading part may be sufficient.

  According to such a configuration, the position of the person to be authenticated can be further specified.

  Furthermore, when the authentication information of the person to be authenticated cannot be read out by the short-distance reading unit, a short-distance writing unit that writes the authentication information acquired by the authentication information acquisition unit into the short-distance ID tag is provided. The room entry permission unit may be configured to permit entry of the person to be authenticated when the second determination unit determines that the person to be authenticated can be authenticated.

  According to such a configuration, the person who has not registered the authentication information in advance can be allowed to enter the room.

  In addition, when granting room entry permission, the room entry permission unit may determine whether or not the long-distance RFID tag that has received room entry permission exists in the communication area.

  According to such a configuration, it is possible to further confirm whether or not camera photographing under the supervision of the authorized person is being performed, and security can be improved.

  The entrance / exit management device of the present invention includes the entrance management device described above, and when the person to be authenticated tries to leave the room, the authentication information acquisition unit acquires the authentication information of the person to be authenticated again, and reads the short distance. The unit reads out information including the authentication information of the person to be authenticated from the short-distance ID tag, and the second determination unit reads out the authentication information acquired again by the authentication information acquisition unit and the short-distance reading unit. Based on the authentication information of the person to be authenticated, it is determined whether or not the person to be authenticated can be authenticated, and when the second determination unit determines that the person to be authenticated can be authenticated, the person to be authenticated It is characterized in that it is provided with an exit permitting section for permitting to leave the room.

  According to such a configuration, even when the person who has not registered the authentication information in advance is permitted to enter the room, the entrance / exit management device with high security can be realized by performing the authentication process when leaving the room.

  Further, when the user is permitted to leave the room, the authentication information recorded on the short-distance RFID tag may be deleted.

  According to this, it is necessary to register authentication information again at the time of re-entry, so that re-entry by one person cannot be performed, and a highly secure entrance / exit management device can be realized.

  In addition, when leaving the room is permitted, a part of the authentication information recorded in the near-field RFID tag is duplicated and stored in the authentication information storage unit on the entrance / exit management device side as partial authentication information. The partial authentication information may be deleted from the RFID tag.

  According to such a configuration, since only the fragment information remains as the authentication information in the near-field RFID tag, this alone does not make sense as the authentication information, and the valid authentication information is deleted. Thereby, even if another person obtains authentication information without permission by any method, it becomes meaningless, and unauthorized use can be prevented.

  When re-entry permission is performed, the authentication information in the near-field RFID tag and the partial authentication information stored in the authentication information storage unit are combined and used as authentication information for identifying the person. It may be.

  According to such a configuration, it is further possible to perform authentication for identifying the person when permission to enter the room again.

  The apparatus further includes a matching determination unit that determines whether or not the authentication information in the near-field RFID tag matches the partial authentication information stored in the authentication information storage unit. When it is determined that the authentication information is present, the authentication information in the short-distance RFID tag and the partial authentication information stored in the authentication information storage unit may be combined.

  According to such a configuration, it is possible to perform authentication for identifying a person using matched authentication information, and to improve security performance.

  The partial authentication information may be deleted when a predetermined time has elapsed from the time stored in the authentication information storage unit.

  According to this, in addition, if the person is an authorized person, if he / she leaves the room temporarily and re-enters the room, he / she can re-enter the room without an attendant nearby. Since the authentication information is deleted, the authentication information cannot be matched. For this reason, it is necessary to register the authentication information again, and it is impossible to enter the room alone. As a result, it is possible to achieve both protection of the authentication information while ensuring the convenience of the attendant and the person leaving the room temporarily.

  Next, a room entry management method according to the present invention is a room entry management method for managing room entry of a person to be authenticated who wants to enter a room, wherein first information including ID information of the person to be authenticated is read from a long distance ID tag. The second step of reading the information including the authentication information of the person to be authenticated from the ID tag for short distance, the third step of acquiring the authentication information of the person to be authenticated, and the first step. Based on the information thus obtained, the fourth step for determining whether or not the person to be authenticated can enter the room, the authentication information acquired in the third step, and the person to be authenticated read in the second step Based on the authentication information, a fifth step for determining whether or not the person to be authenticated can be authenticated, a step for determining whether the person to be authenticated can enter the room in the fourth step, and a person to be authenticated in the fifth step. When it is determined that the user can be authenticated, It is characterized in that a sixth step of permitting the chamber.

  According to such a method, the ID information of the person to be authenticated is read from the ID tag for long distance, and the entrance determination is performed based on the ID information, and the authentication information is read from the ID tag for short distance. The person who has the RFID tag who wants to enter the room can also be detected even if the RFID tag is handed over or taken away by another person at any point in time. Provide entrance management methods.

  In addition, in the sixth step, when granting the room entry permission, it may be determined whether or not the long-distance RFID tag that has received the room entry permission exists in the communication area.

  According to this, it is possible to confirm whether or not camera photographing under the monitoring of the authorized person is being performed, and security can be improved.

  As described above, according to the present invention, when a person who has an RFID tag trying to enter the room is given or taken away by another person at some point, the detection is performed. It is possible to provide an entrance management apparatus, an entrance / exit management apparatus, and an entrance management method that can be used.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(Embodiment)
First, the structure of the authentication apparatus 2 and the entrance / exit management apparatus 4 using the same in embodiment of this invention is demonstrated. FIG. 1 is a diagram for explaining the functions of an authentication device 2 and an entrance / exit management device 4 using the same in an embodiment of the present invention.

  As shown in FIG. 1, the entrance / exit management device 4 is attached in the vicinity of the door 16, and is provided at the photographing unit 6 provided at the outside of the door 16 that is an authentication information acquisition unit and can be tilted at least. The authentication device 2 having the photographing unit 8 and the door opening / closing unit 14 that opens and closes the door 16 by the output from the authentication device 2 are provided.

  As will be described later, the authentication device 2 stores the iris authentication information created by using the images of the eyes for a plurality of authenticated persons 10 and the IC card 12 held by each authenticated person 10. Based on the information, it is determined whether or not the person to be authenticated 10 can enter or leave the room, and the result is transmitted to the door opening / closing unit 14, and the door opening / closing unit 14 opens and closes the door 16 based on the result.

  Here, as shown in FIG. 2, the IC card 12 includes a long-distance RFID tag unit 18 and a short-distance RFID tag unit 20.

  For example, an RFID tag using a short wave band (13.56 MHz) can be used as the RFID tag unit 20 for short distance, and for example, an RFID tag unit 18 for long distance can be used in the UHF band (950 MHz). An RFID tag can be used. When the RFID tag unit 20 for short distance is used, information can be read and written within a range of about 1 m from the reader / writer. When the RFID tag unit 18 for long distance is used, the reader / writer It is assumed that the information can be read and written within a range of about 5 m from.

  As shown in FIG. 2, the IC card 12 includes a long-distance antenna unit 28, a storage unit 22 that stores information, a transmission unit 24 that transmits information stored in the storage unit 22 through the antenna unit 28, and an antenna. A long-distance RFID tag unit 18 having a receiving unit 26 for storing information received from the unit 28 in the storage unit 22, a short-distance antenna unit 36, a storage unit 30 for storing information, and a storage unit 30. A short-distance RFID tag unit 20 having a transmission unit 32 that transmits stored information through the antenna unit 36 and a reception unit 34 that stores information received from the antenna unit 36 in the storage unit 30 is provided.

  The storage unit 22 of the long-distance RFID tag unit 18 includes the ID number of the person to be authenticated 10, the number of the room (or entrance / exit management device) that can be entered, the tilt angle in the photographing units 6 and 8, and the lens aperture. In addition, information such as shutter speed, camera signal gain, zoom, and other optimal shooting conditions (the information is collectively referred to as “long-distance information”) is stored. By storing the shooting conditions, the authentication work of the person to be authenticated 10 can be efficiently performed.

  Further, the storage unit 30 of the near-field RFID tag unit 20 includes the ID number of the person to be authenticated 10, registration authentication information of the person to be authenticated 10, the tilt angle, the lens aperture, and the shutter speed of the photographing units 6 and 8. In addition, information such as camera signal gain, optimum shooting conditions such as zoom, etc. (these information are collectively referred to as “short distance information”) is stored.

  Here, the configuration of the authentication device 2 will be described in detail. FIG. 3 is a block diagram showing the configuration of the authentication device 2 according to the embodiment of the present invention.

  As shown in FIG. 3, the authentication device 2 uses the long-distance reading unit 38 that reads information from the long-distance RFID tag unit 18 of the IC card 12, and the ID number from the information read by the long-distance reading unit 38. From the information read by the ID detection unit 40 and the long distance reading unit 38 for detecting information related to the number of persons to be authenticated 10 and the information read by the long distance reading unit 38, From the position identification unit 64 that identifies the position of the person to be authenticated 10, the short distance reading unit 44 that reads information from the RFID tag unit 20 for short distance of the IC card 12, and various information from the information read by the short distance reading unit 44 The short distance information detecting unit 46 for detecting the short distance information, the ID information detected by the ID detecting unit 40, the information on the number of persons to be authenticated 10 measured by the number counting unit 42, and the position specifying unit 64 are specified. Certified Among the short-distance information detected by the first determination unit 50 and the short-distance information detection unit 46 for performing a first determination as to whether or not the person to be authenticated 10 described later can enter the room, based on the information regarding the position of the ten. Authentication processing unit 56 that performs iris authentication processing using authentication information, partial authentication information extraction unit 55 that extracts a part of authentication information (hereinafter referred to as “partial authentication information”), and authentication information that stores partial authentication information Storage unit 57, match determination unit 59 for determining the match between authentication information acquired from short-range RFID tag unit 20 and partial authentication information, authentication information acquired from short-range RFID tag unit 20 and partial authentication Based on the result of the authentication processing performed by the authentication processing unit 61 and the authentication processing unit 56 that combine the information, the second determination unit 52 performs the second determination as to whether or not the person to be authenticated 10 can enter the room. , First determination unit 50 and Based on the determination results of the second determination unit 52, the person to be authenticated 10 is permitted to enter the room, and the result is output to the door opening / closing unit 14, and the eye image of the person to be authenticated 10 is captured. Camera control unit 58 for controlling shooting conditions such as the tilt angle of the shooting units 6 and 8 based on information about shooting conditions among the short distance information detected by the short distance information detection unit 46, The signal processing unit 60 that performs signal processing on the eye images captured by the imaging units 6 and 8 and sends them to the authentication processing unit 56, and the determinations of the first determination unit 50, the second determination unit 52, and the room entry permission unit 54, respectively. A warning unit 62 that generates a warning to the person to be authenticated 10 according to the result is provided.

  Here, the functions of the long-distance reading unit 38, the short-distance reading unit 44, and the short-distance writing unit 49 can be realized by using functions used in a known IC card reader or writer. Here, the short distance writing unit 49 writes information into the RFID tag unit 20 for short distance.

  The functions of the authentication processing unit 56 and the authentication information creation unit 48 can be realized using a known iris authentication method, for example, the method described in Patent Document 1. Here, the authentication information creation unit 48 creates authentication information of the person to be authenticated 10.

  The authentication information storage unit 57 uses a rewritable storage device such as a random access memory (RAM) or a hard disk drive (HDD).

  As the function of the warning unit 62, for example, a known means that can issue a warning to the person to be authenticated 10 such as a speaker or a display means can be used.

  Partial authentication information extraction unit 55, consistency determination unit 59, authentication information synthesis unit 61, ID detection unit 40, number of people measurement unit 42, position specification unit 64, first determination unit 50, second determination unit 52, room entry permission unit 54 and the short distance information detection unit 46 may be realized by hardware such as a dedicated circuit, or each function is described by software, and is realized by software being executed by a computer. Also good.

  As an example of the photographing units 6 and 8, a monochrome camera or a color camera using a CCD or CMOS as an image sensor can be used. As a lens system attached to the photographing units 6 and 8, it is desirable to mount a telephoto lens capable of enlarging and photographing the eye area of the person 10 to be authenticated.

  In addition, the long-distance reading unit 38 is not necessarily arranged in the same casing as the authentication device 2 when it is arranged at a position where information is most easily received from the long-distance RFID tag unit 18. For example, the photographing unit 6, the photographing unit 8, the short distance reading unit 44, and the short distance writing unit 49 are installed at a height used by the person to be authenticated 10, and the long distance reading unit 38 is an upper part of a door, a ceiling, or the like. The authentication device 2 may be arranged in a separate position, and the authentication device 2 may be a separate housing in appearance.

  Next, operation | movement of the entrance / exit management apparatus 4 in embodiment of this invention is demonstrated. FIG. 4 is a diagram for explaining the operation at the time of entrance management of the entrance / exit management device 4 in the embodiment of the present invention, and FIG. 5 is the exit management of the entrance / exit management device 4 in the embodiment of the present invention. It is a figure for demonstrating operation | movement at the time.

  First, the operation at the time of entrance management of the entrance / exit management device 4 will be described with reference to FIG. As shown in FIG. 4, first, the long-distance reading unit 38 of the authentication device 2 of the entrance / exit management device 4 is stored in the storage unit 22 of the long-distance RFID tag unit 18 of the IC card 12 of the person to be authenticated 10. Information such as ID information of the person to be authenticated 10, preferable photographing conditions, and information indicating a room that can be entered is read from the long-distance information thus obtained (S 2).

  Next, the ID detection unit 40 detects ID information in the long-distance information, the number-of-persons measurement unit 42 measures the number of persons to be authenticated 10 detected by the ID detection unit 40, and the position specification unit 64 Then, the position of each person to be authenticated 10 is specified (S4). In this way, the number of people entering the room can be managed by automatically measuring the number of people entering the room in the number of persons counting section 42.

  Next, the 1st determination part 50 determines whether the to-be-authenticated person 10 can enter a room from ID information and the information which shows the room which can be entered (S6).

  If it is determined in step S6 that the person to be authenticated 10 is a person who can enter the room (S8), the process proceeds to step S12. On the other hand, if it is determined that the person to be authenticated cannot enter the room ( S8) A warning such as “You cannot enter the room” is issued to the person 10 who cannot enter the room (S10).

  In step S <b> 12, the short distance reading unit 44 reads the short distance information stored in the storage unit 30 of the RFID tag unit 20 for short distance of the IC card 12. Moreover, the short distance information detection part 46 reads ID information and iris authentication information from short distance information (S12). The ID information is sent to the room entry permission unit 54, and the iris authentication information is sent to the authentication processing unit 56.

  At this time, the short distance information detecting unit 46 determines whether or not the iris authentication information is included in the read short distance information (S14). If included, the process proceeds to step S19, which will be described later. In this way, an eye image of the person to be authenticated 10 is taken.

  When the iris information is not included, the camera control unit 58 is instructed to take an eye image of the person to be authenticated 10 and newly register it in the near-field RFID tag (S16).

  The eye image of the person to be authenticated 10 photographed in step S <b> 16 is subjected to signal processing by the signal processing unit 60 and sent to the authentication processing unit 56. Then, iris authentication information is created from the eye image in the authentication information creating unit 48 and stored in the storage unit 30 of the short-distance RFID tag unit 20 of the IC card 12 by the short-range writing unit 49. (S18). The stored iris authentication information is used for authentication when leaving the room. Then, step S28 is executed. At this time, information such as the tilt angle of the photographing unit 6 is also recorded in the near-field RFID tag unit 20.

  In addition, at the time of entrance registration, whether or not a long-distance RFID tag (for example, an RFID tag held by an attendant) that has already been authorized and has been verified is within the communication area of the entrance / exit management device 4. It is possible to increase security because it is checked whether the camera is being photographed by the authorized person.

  In addition, when registering a room, it is determined whether or not a long-distance RFID tag held by a visitor or the like is within the communication area of an entrance / exit management device installed in an allowed area. Also good. In other words, security can be enhanced by preventing the IC card 12 from being used outside the area where entry is permitted.

  If the authentication information is stored in the IC card 12, the camera control unit 58 captures the eye image of the person to be authenticated 10 by the imaging unit 6 (S19). When photographing an eye image, the camera control unit 58 can quickly shoot an eye image by adjusting the tilt angle of the photographing unit 6 in accordance with a preferable photographing condition read in advance from the IC card 12. .

  Then, the authentication processing unit 56 compares the authentication information stored in the IC card 12 with the authentication information acquired from the person to be authenticated 10 to perform iris authentication processing, and the result is the second determination. It is sent to the unit 52 (S20).

  In the second determination unit 52, when the authentication result in the authentication processing unit 56 is an authentication result indicating that the person is registered in advance (S24), the door opening / closing unit 14 is instructed to open the door 16. (S28).

  On the other hand, when the authentication result in the authentication processing unit 56 is an authentication result indicating that the person is not registered in advance (S24), the warning unit 62 generates a warning without opening the door 16 (S26).

  As described above, if the operation at the time of entrance management is performed, for those who have authentication information stored in the IC card 12 in advance, the authentication information is compared with the authentication information acquired from the person, so that the iris authentication is performed. When the authentication information is not stored in the IC card 12, the authentication information of the person to be authenticated 10 is stored in the IC card 12 and the door 16 is opened. Processing can be performed quickly.

  Next, the operation at the time of exit management of the entrance / exit management device 4 will be described with reference to FIG. As shown in FIG. 5, first, the long-distance reading unit 38 of the authentication device 2 of the entrance / exit management device 4 is stored in the storage unit 22 of the long-distance RFID tag unit 18 of the IC card 12 of the person to be authenticated 10. The information such as the ID information of the person to be authenticated 10 is read from the long distance information thus obtained (S102).

  Next, the room entry permission unit 54 determines whether or not the person to be authenticated 10 is the person who created the authentication information when entering the room (S104).

  If the person to be authenticated 10 is the person who created the authentication information at the time of entering the room (S106), the process proceeds to step S110. If not (S106), the room entry permitting unit 54 determines whether the person to be authenticated 10 From the ID information, it is determined whether or not the person has entered the room (S108). If the person has entered the room (a person registered in advance, such as an attendant), the process proceeds to step S120. Otherwise, a warning is generated in the warning unit 62 (S122, S124).

  If it is determined in step S106 that the person to be authenticated 10 is the person who has stored the authentication information at the time of entering the room, the room entry permitting unit 54 instructs the camera control unit 58 to authenticate the person to be authenticated by the photographing unit 8. Ten eye images are taken (S110).

  Further, the authentication information of the person to be authenticated 10 stored in the IC card 12 is read out by the short distance reading unit 44 and sent to the authentication processing unit 56 (S111).

  The photographed eye image is sent from the photographing unit 8 via the signal processing unit 60 to the authentication processing unit 56 and created from the authentication information acquired at the time of entering the room and the eye image photographed by the photographing unit 8. The authentication information is compared and authentication processing is performed (S112). The result is sent to the second determination unit 52, and when the second determination unit 52 determines that the person to be authenticated 10 is the same person as when entering the room (S114), the process proceeds to step S118. On the other hand, if it is determined that this is not the case (S114), a warning is generated in the warning unit 62 and the door 16 cannot be opened (S116).

  In step S118, the room entry permission unit 54 instructs the short distance writing unit 49 to delete the authentication information stored in the IC card 12 (S118), and causes the door opening / closing unit 14 to open the door 16 (S120).

  As a result, once the person leaves the room, the authentication information is completely erased from the IC card 12. Therefore, when entering the room again, new registration of authentication information is required. For this reason, when entering the room, the long-distance RFID tag (for example, the RFID tag held by the attendant) that has already been authorized and has been verified is placed in the communication area of the entrance / exit management device 4. It is possible to check again whether the camera is being photographed by the authorized person or not, and thus security can be improved.

  Next, a description will be given of a method for managing authentication information in the room entry / exit management device 4 in consideration of temporary exit. Temporary leaving means that a person who leaves the room re-enters within a relatively short time.

  As an example of a method for managing authentication information in consideration of temporary exit, the entrance / exit management device 4 includes, among the authentication information recorded in the storage unit 30 in the IC card 12 by the partial authentication information extraction unit 55 when leaving the room. Partial authentication information is extracted, copied and stored in the authentication information storage unit 57 on the entrance / exit management device 4 side.

  After storing the partial authentication information, the entrance / exit management device 4 deletes the same information as the partial authentication information from the authentication information stored in the storage unit 30 in the IC card 12 by the short distance writing unit 49. As a result, the partial authentication information is deleted from the storage unit 30 and fragment information (hereinafter referred to as “fragment authentication information”) remains as authentication information.

  As described above, since only the fragment authentication information remains in the storage unit 30 of the short-distance RFID tag unit 20 built in the IC card 12, this alone does not make sense as the authentication information. Further, the partial authentication information stored in 57 in the authentication information storage unit of the entrance / exit management device 4 is also fragment information, so this alone does not make sense. That is, valid authentication information is erased from the IC card 12 when leaving the room, and is not left in the entry / exit management device 4. Thereby, even if the authentication information is acquired without permission from the IC card 12 or the entrance / exit management device 4 by any method, the authentication information itself is meaningless fragment information, and thus unauthorized use by a third party can be prevented. it can.

  Next, a case where re-entry is performed using the IC card 12 permitted to leave will be described.

  When the person to be authenticated 10 re-enters the room using the IC card 12, the entrance / exit management device 4 uses the short distance reading unit 44 shown in FIG. The authentication information stored in 2) is read out, and it is determined whether the piece of authentication information is fragment authentication information that is missing or is not missing. When the authentication information has no omission, the entrance / exit management device 4 proceeds with the same processing as in normal entrance.

  On the other hand, if the fragment authentication information is missing a part of the authentication information, the entrance / exit management device 4 determines that the person to be authenticated 10 is a temporary exit person, and the consistency determination unit 59 determines the authentication information storage unit. It is determined whether or not the partial authentication information stored in 57 matches the fragment authentication information acquired from the IC card 12.

  Here, when the partial authentication information and the fragment authentication information do not match, the entrance / exit management device 4 sends a message such as “re-registration of authentication information is necessary” to the person to be authenticated 10. (Not shown) etc. In addition, you may make it alert | report by a display apparatus.

  On the other hand, if the partial authentication information and the fragment authentication information match, the authentication information combining unit 61 combines the fragment authentication information and the partial authentication information and restores the original authentication information. Then, the entrance / exit management device 4 uses the authentication processing unit 56 to compare and collate the restored authentication information with the authentication information created from the iris information photographed by the photographing unit 6 when entering the room.

  Thereafter, as in the case of normal room entry, in the second determination unit 52, when the authentication result in the authentication processing unit 56 is an authentication result indicating that the person has been registered in advance, the entrance / exit management device 4 The door opening / closing part 14 is instructed to open the door 16. On the other hand, when the authentication result in the authentication processing unit 56 is an authentication result indicating that the person is not registered in advance, the entrance / exit management device 4 causes the warning unit 62 to generate a warning without opening the door 16.

  Further, the entrance / exit management device 4 manages the time with a known clock (not shown), and when a predetermined time has elapsed from the time when the partial authentication information is stored in the authentication information storage unit 57, the authentication information storage unit The partial authentication information is automatically deleted from 57. In this way, if you are an authorized person, if you leave the room temporarily and re-enter the room, you can re-enter the room without an attendant nearby. Since it is deleted, the person to be authenticated 10 cannot match the authentication information. For this reason, the person to be authenticated 10 needs to re-register authentication information and cannot re-enter the room alone. As a result, it is possible to achieve both protection of the authentication information while ensuring the convenience of the attendant and the person leaving the room temporarily.

  Although the partial authentication information is stored in the authentication information storage unit 57 on the entrance / exit management device 4 side, it may be stored on a server (not shown) connected to the outside of the entrance / exit management device 4. . Similarly, the fragment authentication information and the partial authentication information can be managed separately, and it is possible to achieve both protection of the authentication information while ensuring the convenience of the temporarily leaving the room.

  As the authentication information separation method, the authentication information is separated between the IC card 12 and the entry / exit management device 4, so that data such as a hash and a checksum are also entered / exit management device to ensure the integrity at the time of synthesis. You may memorize | store in 4 side.

  Further, each piece of separated information may be stored after being subjected to encryption processing to improve the safety of the information.

  In addition, the exit time is stored on both the IC card 12 side and the entrance / exit management device 4 side, and whether or not the exit times match is added to the matching condition, so that the fragment authentication information and the partial authentication information are When synthesizing, the standard of the matching requirement may be tightened to improve the security performance.

  Further, the partial authentication information extraction unit 55 may extract the partial authentication information from the authentication information with a random code position and code size, and copy it. Thereby, it becomes more difficult for the third party to match the fragment authentication information and the partial authentication information, and the security performance can be improved.

  Alternatively, the authentication information may be encrypted and copied entirely on the server connected to the entrance / exit management device 4. At this time, the decryption key may be recorded on the IC card 12 side.

  As described above, according to the authentication device 2 and the entrance / exit management device 4 using the authentication device according to the present embodiment, when leaving the room, the person who performed the iris authentication process at the time of entering the room (a person who has been registered in advance, such as an attendant) On the other hand, it is possible to leave the room only by confirming the ID information and perform the process quickly, and for those who have not performed the iris authentication process when entering the room (for example, visitors) Since authentication processing is performed using authentication information, it is excellent in security and can be made difficult to replace.

  In the authentication device according to the embodiment of the present invention, the example using the iris authentication method has been described as the method used for the authentication process, but the present invention is not limited to this method. Needless to say, the present invention can also be applied to an authentication method using an image obtained by photographing a subject, for example, retina authentication or face authentication.

  As described above, according to the present invention, when a person who has an RFID tag trying to enter the room is given or taken away by another person at some point, the detection is performed. Because it has an excellent effect that it can be used, it should be installed in a highly secure building or room, etc., using an entrance management device that restricts entrance to authorized persons, especially biometric authentication processing such as iris It is useful as an entrance management device, an entrance / exit management device, and an entrance management method for performing entrance management.

The figure for demonstrating the function of the authentication apparatus in embodiment of this invention, and an entrance / exit management apparatus using the same The figure which shows the example of a structure of the IC card Block diagram showing the configuration of the authentication device The figure for demonstrating the operation | movement at the time of entrance management of the entrance / exit management apparatus The figure for demonstrating the operation | movement at the time of exit management of the entrance / exit management apparatus

Explanation of symbols

DESCRIPTION OF SYMBOLS 2 Authentication apparatus 4 Entrance / exit management apparatus 6,8 Image pick-up part 10 Authentication person 12 IC card 14 Door opening / closing part 16 Door 18 RFID tag part for long distances 20 RFID tag part 22 for short distances 22, 30 Memory | storage parts 24,32 Transmission unit 26, 34 Reception unit 28, 36 Antenna unit 38 Long-distance reading unit 40 ID detection unit 42 Number-of-people measurement unit 44 Short-distance reading unit 46 Short-distance information detection unit 48 Authentication information creation unit 49 Short-distance writing unit 50 First Determination unit 52 second determination unit 54 entrance permission unit 55 partial authentication information extraction unit 56 authentication processing unit 57 authentication information storage unit 58 camera control unit 59 matching determination unit 60 signal processing unit 61 authentication information combining unit 62 warning unit 64 position Specific part

Claims (13)

An entry management device that manages entry of a person to be authenticated who wants to enter a room,
A long-distance reading unit that reads information including ID information of the person to be authenticated from an RFID tag for long-distance;
A short distance reading unit that reads information including authentication information of the person to be authenticated from an RFID tag for short distance;
An authentication information acquisition unit for acquiring authentication information of the person to be authenticated;
A first determination unit that determines whether or not the person to be authenticated can enter the room based on the information read by the long-distance reading unit;
Determining whether or not the person to be authenticated can be authenticated based on the authentication information acquired by the authentication information acquisition unit and the authentication information of the person to be authenticated read by the short-range reading unit; A determination unit of
When the first determination unit determines that the authenticated person can enter the room and the second determining unit determines that the authenticated person can be authenticated, the entry of the authenticated person is performed. An entrance management device including an entrance permitting unit to permit. The room entry management device according to claim 1, further comprising: a person counting unit that counts the number of persons to be authenticated using information read by the long distance reading unit. The room entry management device according to claim 1, further comprising a position specifying unit that specifies the position of the person to be authenticated using information read by the long distance reading unit. If the authentication information of the person to be authenticated cannot be read by the short distance reading unit, the short distance writing unit that writes the authentication information acquired by the authentication information acquisition unit to the RFID tag for short distance With
The said room entrance permission part permits the said person to be authenticated to enter when the said 2nd determination part determines with the said to-be-authenticated person being authenticable. The room entry management device according to any one of 3 to 3. The said room permission part determines whether the said long distance RFID tag which received room permission exists in a communication area, when giving a room permission. Entrance management device. When the person to be authenticated is about to leave the room, the authentication information acquisition unit acquires the authentication information of the person to be authenticated again, and the short distance reading unit reads the person to be authenticated from the RFID tag for short distance. Read information including authentication information
The second determination unit authenticates the authenticated person based on the authentication information acquired again by the authentication information acquiring unit and the authentication information of the authenticated person read by the short distance reading unit. Determine whether it is possible,
5. The exit determination unit according to claim 4, further comprising: an exit permitting unit that permits the to-be-authenticated person to leave when the second determination unit determines that the to-be-authenticated person can be authenticated. 5. An entrance / exit management device including the entrance management device according to 5. The entry / exit management device according to claim 6, wherein when leaving the room is permitted, the authentication information recorded on the short-distance RFID tag is erased. When leaving is permitted, a part of the authentication information recorded on the near-field RFID tag is copied and stored in the authentication information storage unit on the entrance / exit management device side as partial authentication information, 7. The entrance / exit management device according to claim 6, wherein the partial authentication information is erased from the RFID tag. When re-entry permission is performed, the authentication information in the near-field RFID tag and the partial authentication information stored in the authentication information storage unit are combined and used as authentication information for identifying the person. The entrance / exit management device according to claim 8. A matching determination unit that determines whether or not the authentication information in the near-field RFID tag matches the partial authentication information stored in the authentication information storage unit;
When it is determined that the matching determination unit is matched, the authentication information in the near-field RFID tag and the partial authentication information stored in the authentication information storage unit are combined. The entrance / exit management device according to claim 8. The entrance / exit according to any one of claims 8 to 10, wherein the partial authentication information is deleted when a predetermined time has elapsed from the time stored in the authentication information storage unit. Management device. An entry management method for managing entry of a person to be authenticated who wants to enter a room,
A first step of reading out information including ID information of the person to be authenticated from an RFID tag for long distance;
A second step of reading out information including the authentication information of the person to be authenticated from an RFID tag for short distance;
A third step of acquiring authentication information of the person to be authenticated;
A fourth step of determining whether or not the person to be authenticated can enter the room based on the information read in the first step;
A fifth determination is made as to whether or not the person to be authenticated can be authenticated based on the authentication information acquired in the third step and the authentication information of the person to be authenticated read in the second step. And the steps
When it is determined in the fourth step that the person to be authenticated can enter the room, and when it is determined in the fifth step that the person to be authenticated can be authenticated, the person to be authenticated is allowed to enter the room. A room entry management method comprising a sixth step. 13. In the sixth step, when granting a room entry permission, it is determined whether or not the long-distance RFID tag that has received the room entry permission exists in a communication area. Entrance management method.

Images