JP2009175815A - Biometrics authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem that, since once an authentication system is selected, the same setting is uniformly applied to all users of this system in a biometrics system, a one-to-one authentication system used after performing principal confirmation and a one-to-N authentication system to perform authentication only by reading biological information without performing principal confirmation cannot coexist, and a general user and a system manager are both managed under the same security policy. <P>SOLUTION: When a user preliminarily registers his or her biological information, the user registers not only ID information for identifying an individual but also additional information indicating whether or not the user is a one-to-one authentication user or a one-to-N authentication user. When the user is the one-to-N candidate, the number of one-to-one candidates (X pieces) is subtracted from all the number of registration (N pieces), and N-X pieces are used as collation object master data. Also, a threshold in authentication is individually set for one-to-one candidates as the other additional information. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication method for a biometric authentication system that identifies whether or not a user is permitted from the characteristics of input biometric information, for example, when using a personal computer or entering a place with a high security level. It is.

  Biometric information used for biometric authentication includes fingerprints, voice prints, palm prints, veins, retinas, etc., but for any biometric information, data is read each time, unlike key and ID and password inputs. For this reason, data with the same accuracy is not always acquired even with the data of the person himself / herself due to deviations in the way the reading part is placed on the biometric information reading unit or the surrounding environment during reading. Therefore, biometric master data registered in advance and biometric data input at the time of authentication are compared. If the similarity is equal to or higher than a preset threshold value, the person is recognized. Make a decision to reject.

  Increasing the threshold increases the level of security, but also increases the probability of the person being rejected, making it unusable. Also, if the threshold is lowered, the person is less likely to be rejected, but the probability of accepting another person by misidentification increases. The level at which this threshold is set depends on the security policy of the system administrator, but usually the security level is maintained within the same system. Therefore, the threshold is not set for each individual, but within the same system. The user often sets the same threshold value, and the threshold value once set is not changed. As for the method of changing the threshold, a method of performing collation with a second threshold set in advance lower than the first threshold when collation fails several times with the threshold set at the beginning (see Patent Document 1) Has been proposed.

  In addition, as a biometric authentication method, a system in which a plurality of (N) pieces of biometric information master data are registered in advance, the user inputs personal identification information such as an ID number or inserts an IC card. Then, after specifying the user and specifying the master data of the corresponding biometric information, a one-to-one authentication method for collating with the biometric information input at the time of authentication, and a plurality of (N There is a one-to-N authentication method in which biometric information input at the time of authentication is sequentially verified with N pieces of master data without specifying master data to be compared with the master data of biometric information. Even in the latter case, if there is only one master data of biometric information registered in the system, one-to-one authentication is performed.

  In general, 1-to-N authentication requires fewer user operations, and if a specific method such as an IC card is selected for 1-to-1 authentication, the introduction cost and issuance / management man-hours are required. In many cases, one-to-one authentication is selected when stronger security is required or when it is linked with an employee ID card, and one-to-N authentication is selected when priority is given to convenience or cost. In any case, since the one-to-one authentication or the one-to-N authentication method to be used is fixed at the time of system setting, it is not switched once the system is introduced. An authentication method (patented by switching to 1-to-1 authentication to rescue legitimate users as a remedy when authentication fails with a strict threshold in a system that has selected 1-to-N authentication as a method for switching authentication methods (patents) Document 2) has been proposed.

JP-A-8-115422 JP 2005-293139 A

  In the currently provided biometric authentication system, once a system authentication method is selected and a threshold is set, the same security policy is uniformly applied to all users of the system. However, in the system in which 1-to-N authentication is given priority for convenience as described above, it is desirable that a general user and a system administrator have different security levels.

  In view of this, the present invention provides a method capable of selecting another authentication method for a specific user while maintaining the convenience of the entire system.

  In the authentication method of the present invention, in addition to the ID information for identifying an individual with respect to biometric master data registered in advance, whether the user is a 1-to-N authentication target user or a 1-to-1 authentication target use Additional information indicating whether the person is a person is stored at the same time. Users who are set to use one-to-one authentication can also be given information about the personal identification method and threshold settings that are entered when one-to-one authentication is performed. Examples of means used as a method for personal identification include input of an ID and use of an IC card.

  Also, one-to-N authentication is performed in normal use. When a user subject to one-to-one authentication uses it, it can be used for one-to-one authentication by certain operations, such as simultaneous input of several types of keys. After displaying the authentication screen, the user's master data is specified by a method for personal identification, that is, by inputting an ID or inserting an IC card.

  By making it possible to set additional information in the master data as described above, it is possible to use one-to-one authentication and one-to-N authentication together in the same system. In addition, when using the system, the convenience of general users is ensured by using 1-to-N authentication. Also, by storing the authentication threshold and the data storage destination of the target user for one-to-one authentication in the master data, biometric authentication can be performed in a way that only the user himself can understand. Individual thresholds can be easily set individually. Furthermore, by storing additional information on whether each user is a 1-to-1 authentication user or a 1-to-N target user in the master data, when using 1-to-N authentication in this system, 1-to-N One-to-one authentication target users are excluded from the verification target master data, that is, only the master data of the one-to-N target users can be set as the one-to-N authentication target master data.

  Hereinafter, an embodiment of the present invention will be described with reference to FIGS.

  FIG. 1 is a block diagram showing a configuration for switching authentication methods of a biometric authentication system according to the present invention. A biometric information reading unit 1 that reads a user's biometric information, an ID information recognition unit 2 for identifying master data when the authentication method is switched to 1: 1, and an authentication method from 1: 1 authentication to 1: 1 An authentication method switching input unit 3 for switching to authentication, a 1-N authentication verification unit 4 for verifying the biometric information input from the biometric reading unit 1 and the 1-N authentication target data registered in the master data 6; The living body inputted from the living body reading unit 1 by selecting the target user data from the ID information inputted from the aforementioned ID information recognition unit 2 with the one-to-one authentication target data registered in the master data 6 It consists of a 1-to-N authentication verification unit 5 for verifying information and master data 6 for registering user biometric information.

  The biometric information corresponding to the biometric reading unit 1 includes fingerprints, voice prints, palm prints, veins, retinas, and the like. In the present invention, any biological information can be handled.

  For the authentication method switching input unit 3, an optimum method can be selected for each system to be used. For example, when biometric authentication is used for authentication when logging in to a personal computer, a 1 to N authentication start screen (described later) When a plurality of keys registered in advance in the application are simultaneously input from the keyboard with the display of FIG. 6) displayed, a one-to-one authentication start screen (FIG. 7) described later is displayed, or an IC card When the reader / writer is used as the ID information acquisition means, a one-to-one authentication screen (FIG. 6) described later is displayed when an IC card is inserted while the authentication start screen (FIG. 6) is displayed. However, a method of performing 1-to-N authentication when the [OK] button 14 on the 1-to-N authentication start screen (FIG. 6) is clicked without inserting an IC card is conceivable.

  For the ID information recognition unit 2, the most suitable method can be selected for each system to be used. For example, in the method of entering ID information by key input using a keyboard or in a system equipped with an IC card reader / writer, an IC card It is also possible to store ID information related to the biometric information in the memory and automatically read the ID information when the IC card is inserted.

  The 1-to-N authentication verification unit 4 excludes (NX) 1-to-1 authentication target users from N data in the biometric information input from the biometric reading unit 1 and the master data 6. Sequentially collate with the master data of 1 to N authentication target user to determine the existence of corresponding data. Note that a value set for the entire system is used as the threshold value of data similarity in the case of 1-to-N authentication.

  The one-to-one authentication verification unit 5 selects the corresponding master data of the user from the master data 6 from the ID information input from the ID information recognition unit 2, and inputs the master data and the biometric reading unit 1 The biometric information thus obtained is checked to determine whether or not the person is the person.

  In the master data 6, biometric information of the user and information on whether the user is a 1-to-N target user or a 1-to-1 authentication user is registered in advance. In this figure, all registered users are N, of which X are registered as 1-to-1 authentication users, and the remaining (NX) users are 1-to-N authentication users. It is.

  FIG. 2 shows an example of information registered in addition to biometric information in order to use the present invention. As shown in FIG. 2, the above-mentioned master data 6 includes a user ID number, an authentication method, an ID number identification means when one-to-one authentication is selected, a similarity threshold used for determination at the time of verification, etc. Is registered together with the biological information.

  As for ID number identification means, there is no need to set a setting item when only one ID number is prepared in advance for each system. In FIG. 2, ID number identification by keyboard input and ID number identification using an IC card are used. This is a case where a system that can be used together is assumed. For users who are subject to 1-to-N authentication, there is no need to set the ID number because it is not necessary to identify the ID number during authentication. Further, in the present invention, a one-to-one authentication target user can individually set a threshold value. In addition, a password may be stored in advance in this additional information in order to permit personal authentication by entering a password as a remedy in the case where biometric information cannot be read due to injury or the like.

  FIG. 3 is a screen image when registering the additional information shown in FIG. 2 when registering biometric information. Enter the user's ID number in ID number field 7, and select either 1-to-1 authentication or 1-to-N authentication from authentication method selection pull-down 8. In this example, the threshold selection pull-down 9 and the identification method selection pull-down 10 can be selected only when one-to-one authentication is selected from the authentication method selection pull-down 8. After entering the necessary information, click the [NEXT] button 11 to start the biometric information reading screen. Click the [CLEAR] button 12 if you want to erase the entered contents, or click the [CANCEL] button 13 if you want to end the registration process before the registration is completed.

  4 and 5 are schematic flowcharts for authentication according to the present invention. FIG. 4 is a flowchart when the user performs one-to-N authentication, and FIG. 5 illustrates a flowchart after the user performs a switching operation to one-to-one authentication.

  In FIG. 4, a description will be given by taking as an example a system that switches to one-to-one authentication when an authentication switching operation is performed while the one-to-N authentication start screen (FIG. 6) is displayed. When the user performs an authentication start operation, an authentication start screen is displayed (S1). If an authentication switching operation is performed while this screen is displayed, the process proceeds to the flowchart of FIG. 5 (S2). When the switching operation is not performed and the [OK] button 14 on the 1-to-N authentication start screen (FIG. 6) is pressed, the biometric information reading screen (FIG. 8) is activated and the button is not pressed within the specified time. Displays a "timeout" error message and terminates the process (S3, S4, S8, S10). After starting the biometric information reading screen in S4, the biometric information is read for a predetermined time (S5). At this time, if the biometric information can be acquired, (N−X) pieces of data of 1 to N authentication target of the master data 6 are sequentially collated (S5). If there is corresponding data, a message “There is a collator” is displayed, and if there is corresponding data, an error message “No corresponding data” is displayed (S7, S11, S12).

  The processing flow when a switching operation to one-to-one authentication is performed in S2 will be described below. Here, the ID number input method for identifying the master data of the user will be described as an example of a system that permits two methods by key input operation and IC card insertion. When the switching operation is performed in S2, a one-to-one authentication start screen is displayed (S13). If neither the ID key input nor the IC card insertion can be confirmed within the specified time, a “timeout” error message is displayed and the process is terminated (S10). When there is an ID number key input, the master data 6 is searched to check whether the ID number is a one-to-one authentication target user (S14, S15, S16). When the IC card is inserted, the master data 6 is searched for whether the ID number read from the IC card is a one-to-one authentication target user (S17, S18, S28). As a result of the search, if the input ID number is not a one-to-one authentication target user, an error message “ID not allowed” is displayed and the process ends (S25). If there is such data, the [NEXT] button 16 on the one-to-one authentication start screen (FIG. 7) is enabled (S19). If the [NEXT] button 16 is pressed within the specified time, the biometric information reading screen (FIG. 8) is displayed (S28). If not pressed, a "timeout" error message is displayed and the process is terminated. (S10). The biometric information is read for a predetermined time while the biometric information reading screen is displayed in S28, and if biometric information can be acquired at this time, the target data searched in S15 or S17 is collated (S28, S21, S22). If the degree of similarity satisfies the threshold set in the master data additional information of FIG. 2, a “verifier” message is displayed and an “no corresponding data” error message is displayed (S23, S11, S12).

  FIG. 6 shows an authentication start screen for 1: N authentication. If an authentication switching operation is performed while this screen is displayed, the one-to-one authentication start screen shown in FIG. 7 is displayed. If the [OK] button 14 is pressed, one-to-N authentication is performed. Therefore, a biometric information reading screen (FIG. 8) is displayed.

  FIG. 7 shows an authentication start screen for one-to-one authentication including an ID number input field 15, a [NEXT] button 16, and a [CANCEL] button 17. When the ID number read from the IC card inserted or inserted into the key is input to the ID number column 15, the [NEXT] button 16 can be pressed (referred to as an enable state). When the [NEXT] button 16 in the enabled state is pressed, a biometric information reading screen (FIG. 8) is displayed for one-to-one authentication. When the [CANCEL] button 17 is pressed, the screen returns to the authentication start screen (FIG. 6) for 1-to-N authentication.

The block diagram of authentication switching of the biometric authentication system according to the present invention. An example of the additional information of the master data which the user registers by this invention. The screen image at the time of master data registration by this invention. The flowchart (1) at the time of the authentication by this invention. The flowchart (2) at the time of authentication by this invention. Screen image of 1 to N authentication start according to the present invention. The one-to-one authentication start screen image according to the present invention. The screen image in reading biometric information at the time of authentication by this invention.

Explanation of symbols

  1 ... Biometric reading unit, 2 ... ID information recognition unit, 3 ... Authentication method switching input unit, 4 ... 1 to 1 authentication verification unit, 5 ... 1 to N authentication verification unit, 6 ... Master data, 7 ... ID number field, 8 ... Authentication method selection pull-down, 9 ... Threshold selection pull-down, 10 ... Identification method selection pull-down, 11 ... Registration screen [NEXT] button, 12 ... Registration screen [CLEAR] button, 13 ... Registration screen [CANCEL] button, 14 ... 1 [OK] button for N authentication start screen, 15 ... 1 to 1 authentication start screen [ID number] input field, 16 ... 1 to 1 authentication screen [NEXT] button, 17 ... 1 to 1 authentication screen [CANEL] button, 18 … Biometric information reading screen [CANCEL] button.

Claims (3)

  In a biometric authentication system in which biometric information data of a plurality of persons is registered as master data in the same system, a pair for collating with input biometric information after specifying master data to be collated in advance when a user authenticates A biometric authentication system that can be used by switching between an authentication method and a 1-to-N authentication method that does not specify master data to be collated and collates sequentially with biometric information that is input.   In the biometric authentication system described above, when registering biometric information as master data, the biometric information and an identification ID for identifying the user are registered, but when the input data and the master data are further verified, the user himself / herself is registered. Similarity level for judging that there is, authentication method information indicating whether the user uses one-to-one authentication or one-to-N authentication, and the above-mentioned user uses Master data that stores identification information for storing the person identification method when the one-to-one authentication is selected as the authentication method to be performed, for example, identification information such as whether to insert an IC card or input an identification ID as additional information .   In the biometric authentication system described in claim 1, by using a master database in which the one-to-N authentication of claim 2 is stored together with additional information such as the above-described authentication method, the target user of the one-to-N authentication The master data for collation when using this system is the master data excluding the master data of the user who selected 1-to-1 authentication in the master data of claim 2 from all the master data, that is, 1-to-N authentication target A biometric authentication method that only users can set as master data to be verified.

Images