JP2008015866A - Biometric authentication system and information processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a biometric authentication system, permitting biometric authentication of an entitled user such as a supervisor other than a registered person. <P>SOLUTION: The biometric authentication system, each of client PCs 300 includes a biological information acquisition device 302 acquiring biological information of an operator; an HDD 301 storing biological information for a person in charge assigned to each of the client PCs 300 and information on a supervisor of the person in charge; and biometric authentication software 306 performing authentication processing based on the biological information acquired by the biological information acquisition device 302 and the biological information for the person in charge stored in the HDD 301. The biometric authentication software 306 specifies, in the event of authentication failure, the client PC 300 of the supervisor of the person in charge based on the supervisor information stored in the HDD 301, and transmits the biological information acquired by the biological information acquisition device 302 to the client PC 300 of the supervisor to request authentication. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a biometric authentication system that performs authentication based on biometric information from a user of a client PC, and more particularly, to a technique in which a certain user authenticates a terminal registered in a client PC using biometric information of another user.

  In recent years, as security awareness is increasing, a technique for performing authentication using biometric information such as fingerprints, veins, and irises has become widespread.

  A typical example of logging on to a PC by biometric authentication on a local PC is to store a biometric information database (DB) in the HDD of the client PC as shown in FIG.

  At the time of activation (S1), the logon software requests biometric authentication from the authentication software (S2). The authentication software is obtained from the biometric information acquisition device (S3), collated with the information in the registered biometric information DB in the HDD (S4), and the collation result is returned to the logon software (S5). If the authentication result is OK, the logon software permits the logon (S6).

Further, as an authentication technique based on biometric information, there is one described in Japanese Patent Laid-Open No. 2003-256376 (Patent Document 1).
JP 2003-256376 A

  Authentication using biometric information is difficult to “spoof” and has high security strength. On the other hand, there is a problem in that the user who is the user of the PC cannot be authenticated when he / she is absent.

  For example, in the case of a client PC that is set to log on by biometric authentication as shown in FIG. 9, even if the person in charge who is the user of the PC is absent, even the senior manager cannot see the information of the client PC. In the case of the conventional password format, the supervisor could temporarily ask the person in charge for the password of the client PC, enter it, and obtain necessary information.

  In order to realize the above in the prior art, a method is conceivable in which the biometric information of the senior manager is registered together with the client PC of the person in charge so that the supervisor can log on. In this case, the higher the status, the more biometric information has to be registered on many PCs. The biometric information itself is very important personal information. Although it is normally encrypted and stored, registering biometric information in a plurality of client PCs increases the risk of leakage, which is a serious security problem. It is also difficult to efficiently manage information registered in a plurality of client PCs.

  Further, as described in Patent Document 1, even when an authentication process is performed by an authentication server or an application server, when the user of the client PC is absent, a proxy by biometric authentication such as an upper manager on behalf of the user is used. Authentication was not performed.

  Accordingly, an object of the present invention is to provide a biometric authentication system and an information processing apparatus that can permit biometric authentication of a user who has rights such as a superior other than a registered person.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  A biometric authentication system according to the present invention is a biometric authentication system in which a plurality of information processing devices are connected to a network, and each of the plurality of information processing devices performs biometric authentication of an operator. Biometric information acquisition means for acquiring the biometric information of the person in charge, storage means for storing the biometric information of the person in charge assigned to each of the information processing devices and the superior information of the person in charge of the person, and the biological information acquired by the biometric information acquisition means And biometric authentication means for performing authentication processing based on the biometric information of the person in charge stored in the storage means, and the biometric authentication means is based on the superior information stored in the storage means when authentication fails, The superior information processing device of the person in charge is specified, the biological information acquired by the biological information acquisition means is transmitted to the superior information processing device, and authentication is requested.

  An information processing apparatus according to the present invention is an information processing apparatus connected to a network, and includes a biological information acquisition unit that acquires biological information of an operator of the information processing apparatus, and a person in charge assigned to the information processing apparatus. Storage means for storing biometric information and superior information of the person in charge, biometric authentication means for performing authentication processing based on the biometric information acquired by the biometric information acquisition means and the biometric information of the person in charge stored in the storage means; And the biometric authentication means identifies the superior information processing apparatus in charge based on the superior information stored in the storage means when authentication fails, and acquires the anterior body information in the superior information processing apparatus. The biometric information acquired by the means is transmitted to request authentication.

  Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

  According to the present invention, even when the person in charge is absent, the person in charge's device can be used by biometric authentication by the superior without impairing the security strength of the biometric information.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

(Embodiment 1)
<Configuration of biometric authentication system>
The configuration of the biometric authentication system according to Embodiment 1 of the present invention will be described with reference to FIGS. 1 and 2. FIG. 1 is a configuration diagram showing a configuration of a biometric authentication system according to Embodiment 1 of the present invention, and FIG. 2 is a diagram showing an example of a biometric information database of the biometric authentication system according to Embodiment 1 of the present invention.

  In FIG. 1, the biometric authentication system includes a plurality of client PCs 100 that are information processing apparatuses and an authentication server 110, and the plurality of client PCs 100 and the authentication server 110 are connected via a LAN 120.

  The client PC 100 includes a hard disk (HDD) 101 as storage means, a biometric information acquisition device 102 as biometric information acquisition means, a personal identification module 103, a (network interface card) NIC 104, other CPUs, memory, and the like. An operating system (OS) 105, logon software 106, client authentication software 107 as biometric authentication means and other processing software are stored, the OS 105 is started, and various software is executed on the OS 105 to perform various processes.

  The biometric information acquisition device 102 inputs biometric information from the person in charge of the client PC 100 and outputs it to the client authentication software 107.

  The personal identification module 103 is a module for personal identification of the person in charge of the client PC 100, may use an IC card / security chip, does not have a special module, and has a LAN MAC address, An IP address may be substituted. Even when the IC card / security chip is used, the client PC 100 is identified as the client PC 100 used by a specific person in charge.

  The NIC 104 connects the client PC 100 and the LAN 120.

  The logon software 106 performs a logon process for making the client PC 100 usable by the person in charge.

  The client authentication software 107 performs authentication processing within the client PC 100.

  The authentication server 110, HDD 111, NIC 112, other CPU, memory, and the like are stored, an operating system (OS) 113, a biological information database (biological information DB) 114 and other processing software are stored in the HDD 101, the OS 114 is started, and the OS 114 Various processes are performed by executing various software on the above.

  For example, as shown in FIG. 2, the biometric information DB 114 has a plurality of biometric information cells for managing biometric information such as each person in charge, a section manager, a department manager, etc., and each biometric information cell is registered. It consists of completed biometric information, personal identification information and superior information.

  In FIG. 2, the same information as the personal identification information is used for the superior information. Thus, the individual of the manager who is the supervisor of the person in charge is identified by the superior information of each person's biological information cell. The identification information can be specified, and the proxy authentication can be performed by the biometric information of the senior manager when the person in charge is absent.

  The superior information may be information that allows the superior biological information cell to be identified by the superior information without using the same type of information as the personal identification information.

  The server authentication software 115 performs authentication processing based on personal identification information and biometric information from the client PC 100 and information in the biometric information DB 114.

  The NIC 112 connects the authentication server 110 and the LAN 120.

<Operation of biometric authentication system>
Next, the operation of the biometric authentication system according to Embodiment 1 of the present invention will be described with reference to FIG.

  First, the client PC 100 is turned on, the OS 105 is activated (S10), and when the logon software 106 is executed, the logon software 106 requests the client authentication software 107 for authentication (S11).

  The client authentication software 107 acquires biometric information from the biometric information acquisition device 102 (S12).

  Personal identification information is obtained from the personal identification module 103 (S13). The client authentication software 107 transmits personal identification information and biometric information to the authentication server 110 via the LAN 120 and requests authentication (S14). The authentication server 110 searches the biometric information DB 114 for registered biometric information to be collated based on the received personal identification information, collates with the given biometric information (S15), and returns the result to the requester (S16). ).

  The client authentication software 107 of the request source returns the result obtained from the authentication server 110 to the logon software 106 (S17), and the logon software 106 performs a logon / access permission determination process based on the result obtained from the authentication server 110. (S18).

  Here, the details of the authentication processing by the authentication server 110 in S15 will be described with reference to FIG. FIG. 3 is a flowchart showing authentication processing of the authentication server of the biometric authentication system according to Embodiment 1 of the present invention.

  First, when receiving an authentication request from the client PC 100, the authentication server 110 searches for a biometric information cell from the personal identification information given from the client PC 100 (S20). If there is no biometric information cell in S20, the authentication server NG Is returned to the client PC 100 of the authentication request source.

  If the biometric information cell is confirmed in S20, the registered biometric information of the retrieved biometric information cell is acquired (S21), and the registered biometric information of the acquired biometric information cell is compared with the biometric information given from the client PC 100. Perform (S22).

  If the result of collation in S22 is authentication OK, the authentication OK is returned to the client PC 100 as the authentication request source. As a result of the collation in S22, when authentication is NG, a biometric information cell having the same personal identification information as the superior information in the biometric information cell is searched (S23). If there is no superior information in S23, authentication NG is determined. Return to the client PC 100 of the authentication request source.

  If the superior information exists in S23, the superior information is substituted into the personal identification information, and the process returns to S20 to collate with the biological information.

  Then, S20 to S24 are repeated, and if the authentication is OK, the authentication OK is returned to the client PC 100 as the authentication request source. At the time of authentication NG, a biological cell having the same personal identification information as the superior information is searched for and collated. This verification process is repeated until the biometric information cell has no superior information or until the same biometric cell search as that of the superior information fails, and if the last verification process authenticates NG, the authentication NG is authenticated. Return to the requesting client PC 100.

  As a result, the client PC 100 can perform not only authentication by the person in charge of the client PC 100 but also proxy authentication by the superior of the person in charge of the client PC 100. Necessary information can be obtained from the client PC.

<Client PC authentication process>
Next, referring to FIG. 4, the authentication process of the client PC of the biometric authentication system according to the first embodiment of the present invention will be described. FIG. 4 is a flowchart showing authentication processing of the client PC of the biometric authentication system according to Embodiment 1 of the present invention.

  In FIG. 4, the biometric information of the person in charge of the client PC 100 is stored in the HDD 101 of the client PC 100. If the client PC 100 is not connected to a network such as the LAN 120, it is stored in the HDD 101 of the client PC 100. An example in which authentication is performed by the authentication server 110 when authentication is performed using registered biometric information and the connection is made to a network such as the LAN 120 is shown.

  First, when the client PC 100 is turned on, biometric information is acquired from the biometric information acquisition device 102 (S30).

  Then, it is determined whether or not it is connected to the LAN 120 (S31). If it is not connected to the LAN 120 in S31, the biometric information of the person in charge acquired in S30 and the biometric information of the person in charge stored in the HDD 101 of the client PC 100 are obtained. The information DB is collated (S32), and if the result of the collation in S32 is authentication OK, the person in charge is permitted to log on. If the result of collation in S32 is authentication NG, the process returns to S30, and thereafter, if not connected to the LAN 120, the processes of S30 to S33 are repeated to perform the authentication process.

  If connected to the LAN 120 in S31, personal identification information is acquired (S34), and authentication is requested from the authentication server 110 (S35). Then, the authentication server 110 performs an authentication process as shown in FIG.

  Then, it waits for the result from the authentication server 110 (S36), and if it receives a notification of authentication failure from the authentication server 110 in S36 or if it is a timeout, it returns to S30 and repeats the processing of S30 to S36.

  In S36, when the authentication OK notification is received from the authentication server 110, the person in charge is permitted to log on.

  With the above processing, even if the client PC 100 cannot connect to the LAN 120, the person in charge of the client PC 100 can log in to the client PC 100 by biometric authentication. In addition, when a manager other than the person in charge operates the client PC 100, if the connection is made to the LAN 120, authentication is performed by the authentication server 110, and the manager in charge uses the client PC 100 on behalf of the person in charge. Is possible.

<Access from outside the corporate LAN>
Next, referring to FIG. 5, the access from outside the in-house LAN of the biometric authentication system according to the first embodiment of the present invention will be described. FIG. 5 is an explanatory diagram for explaining access from outside the in-house LAN of the biometric authentication system according to the first embodiment of the present invention.

  In FIG. 5, a plurality of client PCs 100 and an authentication server 110 are connected via a gateway (GW) 210 in the in-house LAN 200. A client PC 211 outside the in-house LAN 200 is connected to the GW 210 of the in-house LAN 200 via the Internet 212.

  Further, the authentication server 110 is connected directly under the GW 210 in the in-house LAN 200, and the GW 210 initially allows access only to the authentication server 110. After being authenticated by the authentication server 110, the GW 210 permits the client PC 211 outside the corporate LAN 200 to access the corporate LAN 200.

  Alternatively, a system in which access to the internal LAN 200 from the outside of the internal LAN 200 is not permitted and the authentication server 110 simply returns an authentication OK / authentication NG to the client PC 211 outside the internal LAN 200. In this case, only the logon permission of the client PC 211 outside the in-house LAN 200 is performed by the authentication server 110.

  Further, in the access from the client PC 211 outside the in-house LAN 200, the authentication server 110 performs the authentication process shown in FIG. 3 based on the information in the biometric information DB 114 as shown in FIG. Authentication can be performed not by the person in charge of the PC 211 but also by the biometric information of the superior.

(Embodiment 2)
<Configuration of biometric authentication system>
The configuration of the biometric authentication system according to the second embodiment of the present invention will be described with reference to FIG. FIG. 6 is a block diagram showing the configuration of the biometric authentication system according to Embodiment 2 of the present invention.

  In FIG. 6, in the biometric authentication system, a plurality of client PCs 300 are connected via a LAN 310.

  Each client PC 300 includes an HDD 301, a biometric information acquisition device 302, a NIC 303, other CPUs, a memory, and the like, and stores an OS 304, logon software 305, biometric authentication software 306 that is biometric authentication means and other processing software in the HDD 301, Various processes are performed by starting the OS 304 and executing various software on the OS 304.

  Also, a biometric information DB 307 is stored in each client PC 300. The biometric information DB 307 stores information corresponding to the biometric information cell shown in FIG. 2, and biometric information for authenticating itself (in charge). Personal identification information for identifying the person and superior information for identifying the superior are stored. Here, as a simple example, a method of registering an IP address in the HDD 301 as identification information will be described here. However, a stronger security function such as an IC card or a security chip can be used.

<Operation of biometric authentication system>
Next, the operation of the biometric authentication system according to the second embodiment of the present invention will be described with reference to FIGS. FIG. 7 is a diagram showing an example of authentication request information used in the biometric authentication system according to Embodiment 2 of the present invention.

  First, the client PC 300 is turned on, the OS 304 is activated (S40), and when the logon software 305 is executed, the logon software 305 requests the biometric authentication software 306 for authentication (S41).

  The biometric authentication software 306 acquires biometric information from the biometric information acquisition device 302 (S42).

  The biometric authentication software 306 attempts to collate the biometric information acquired in S42 with the registered biometric information stored in the HDD 301. If the result of the collation is authentication OK, the authentication result is returned to the logon software 305 (S43). The logon software 305 permits the logon (S44).

  If the result of the verification is authentication NG, the upper manager information stored in the HDD 301 is acquired (S45), and the client PC 300 of the upper manager (eg, section manager) is identified based on the acquired upper manager information. The upper client PC 300 is requested for authentication (S46).

  As data at this time, as shown in FIG. 7, request source identification information, request destination identification information, and biometric information information are transmitted, and authentication is requested by transmitting this information to the superior client PC 300.

  When the client PC 300 in charge of the senior manager receives an authentication request from the LAN 310, the biometric authentication software 306 of the senior client PC 300 checks the registered biometric information stored in its own HDD 301 ( S47). If the result of verification is authentication OK, authentication OK is returned to the requesting client PC 300 (S48). As a result of the verification, if the authentication is NG, an authentication request is transmitted to his / her superior client PC 300. Upon receiving the authentication request from the superior client PC 300, the superior manager (for example, the manager) Authentication processing is performed in the same manner as the client PC 300. Then, if the last upper client PC 300 is also authenticated NG, the client PC 300 that is authenticated is returned to the requesting client PC 300 (S48).

  Then, the biometric authentication software 306 of the client PC 300 of the person in charge sends the authentication result from the senior client PC 300 to the logon software 305 (S49), and the logon software 305 permits the logon (S50).

<Authentication process for superior client PC>
Next, referring to FIG. 8, an authentication process of the upper client PC of the biometric authentication system according to the second embodiment of the present invention will be described. FIG. 8 is a flowchart showing an authentication process of the upper client PC of the biometric authentication system according to the second embodiment of the present invention.

  First, when receiving the authentication request from the client PC 300 of the person in charge, the superior client PC 300 collates the received biometric information with the biometric information DB 307 (S60), and if the result of the collation in S60 is authentication OK, the request is made. Authentication OK is returned to the original client PC 300.

  As a result of the collation in S60, when authentication is NG, a biometric information cell having the same personal identification information as the superior information in the biometric information DB 307 is searched (S61). If there is no superior information in S61, authentication NG is determined. Return to the client PC 300 of the authentication request source.

  If the superior information is present in S61, the superior information is substituted into the personal identification information (S62), and an authentication request is transmitted to the new client PC 300 specified in S62. , S60 to S62 are repeated to perform the authentication process.

  As described above, in the second embodiment, the information of each biological information cell of the biological information DB 114 in the authentication server 110 in the first embodiment is stored in the HDD 301 of each client PC 300 and stored in the HDD 301. Based on the superior information, it is possible to identify the superior client PC 300. Based on the superior information, the biometric information is transmitted from the client PC 300 of the person in charge to the superior client PC 300. If the authentication process is performed by the client PC 300 and the authentication is OK, the manager of the person in charge can operate the client PC 300 of the person in charge.

  As a result, if the superior client PC 300 that performs authentication is operating without using the authentication server, the supervisor of the person in charge can be authenticated by the client PC of the person in charge. In addition, the manager of the person in charge can operate the client PC 300 of the person in charge.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  The present invention relates to a biometric authentication system that performs authentication based on biometric information from a user of a client PC, and can be applied to a system in which a certain user uses a terminal registered in the client PC for other users.

It is a block diagram which shows the structure of the biometric authentication system which concerns on Embodiment 1 of this invention. It is a figure which shows an example of the biometric information database of the biometrics authentication system which concerns on Embodiment 1 of this invention. It is a flowchart which shows the authentication process of the authentication server of the biometric authentication system which concerns on Embodiment 1 of this invention. It is a flowchart which shows the authentication process of the client PC of the biometric authentication system which concerns on Embodiment 1 of this invention. It is explanatory drawing for demonstrating access from the outside of company LAN of the biometric authentication system which concerns on Embodiment 1 of this invention. It is a block diagram which shows the structure of the biometric authentication system which concerns on Embodiment 2 of this invention. It is a figure which shows an example of the authentication request information used with the biometric authentication system which concerns on Embodiment 2 of this invention. It is a flowchart which shows the authentication process of the senior client PC of the biometrics authentication system which concerns on Embodiment 2 of this invention. It is explanatory drawing for demonstrating an example of the conventional biometrics authentication.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Client PC, 101 ... HDD, 102 ... Biometric information acquisition device, 103 ... Personal identification module, 104 ... NIC, 105 ... OS, 106 ... Logon software, 107 ... Client authentication software, 110 ... Authentication server, 111 ... HDD 112 ... NIC, 113 ... OS, 114 ... biometric information DB, 115 ... server authentication software, 120 ... LAN, 200 ... in-house LAN, 210 ... GW, 211 ... client PC, 212 ... internet, 301 ... HDD, 302 ... biometric Information acquisition device, 303 ... NIC, 304 ... OS, 305 ... logon software, 306 ... biometric authentication software, 307 ... biometric information DB, 310 ... LAN.

Claims (10)

A plurality of information processing devices are connected to a network, and each of the plurality of information processing devices is a biometric authentication system that performs biometric authentication of an operator,
Each of the information processing devices
Biometric information acquisition means for acquiring biometric information of the operator;
Storage means for storing biometric information of a person in charge assigned to each of the information processing devices and superior information of the person in charge;
Biometric authentication means for performing an authentication process based on the biometric information acquired by the biometric information acquisition means and the biometric information of the person in charge stored in the storage means,
The biometric authentication unit specifies an upper information processing device of the person in charge based on the upper information stored in the storage unit when authentication fails, and the biometric information is stored in the upper information processing device. A biometric authentication system that transmits biometric information acquired by an acquisition means and requests authentication. The biometric authentication system according to claim 1,
When transmitting the biometric information acquired by the biometric information acquisition unit to the upper information processing apparatus, the biometric authentication unit identifies request source identification information for identifying a request source and a request destination in the biometric information. A biometric authentication system, wherein request destination identification information is added and transmitted. The biometric authentication system according to claim 2, wherein
The biometric authentication unit of the superior information processing apparatus performs an authentication process based on the biometric information received from the information processing apparatus of the person in charge and the biometric information of the person in charge stored in the storage unit, and the authentication result Is transmitted to the information processing apparatus of the person in charge. The biometric authentication system according to claim 3, wherein
The biometric authentication unit of the upper information processing device identifies another upper information processing device based on the upper information stored in the storage unit when authentication fails, and A biometric authentication system, wherein the biometric information acquired by the biometric information acquisition means is transmitted to an information processing apparatus, and authentication is requested. The biometric authentication system according to claim 4, wherein
The biometric authentication unit of the superior information processing device transmits the biometric information acquired by the biometric information acquisition unit to the another superior information processing device, and the request destination added to the biometric information A biometric authentication system, wherein the information of the other information processing apparatus of the superior information is substituted for identification information and transmitted. The biometric authentication system according to claim 1,
The biometric authentication system, wherein the superior information is an IP address or a MAC address of the superior information processing apparatus. The biometric authentication system according to claim 2, wherein
The biometric authentication system, wherein the request source identification information and the request destination identification information are an IP address or a MAC address of the information processing apparatus. An information processing apparatus connected to a network,
Biological information acquisition means for acquiring biological information of an operator of the information processing apparatus;
Storage means for storing biometric information of the person in charge assigned to the information processing device and superior information of the person in charge;
A biometric authentication unit that performs an authentication process based on the biometric information acquired by the biometric information acquisition unit and the biometric information of the person in charge stored in the storage unit;
The biometric authentication unit identifies an upper information processing device of the person in charge based on the upper information stored in the storage unit when authentication fails, and the biometric information is stored in the upper information processing device. An information processing apparatus that transmits biometric information acquired by an acquisition means and requests authentication. The information processing apparatus according to claim 8.
When transmitting the biometric information acquired by the biometric information acquisition unit to the upper information processing apparatus, the biometric authentication unit identifies request source identification information for identifying a request source and a request destination in the biometric information. An information processing apparatus, wherein request destination identification information is added and transmitted. The information processing apparatus according to claim 9.
When the biometric authentication unit is requested to authenticate biometric information from another information processing apparatus, the biometric authentication unit performs an authentication process based on the received biometric information and the biometric information of the person in charge stored in the storage unit, and the authentication result Is transmitted to the another information processing apparatus.

Images