JP2009223638A - Biometric authentication system and method for web application - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a biometric authentication system, reducing a management load of a server while protecting user privacy and ensuring the security of user authentication. <P>SOLUTION: The biometric authentication system includes: an online service server; a client terminal having a biometric information input device, a storage, and a browser having a function for operating the storage via a browser script; and a biometric authentication support server storing a plug-in to operate the biometric information input device to add a function for operating the biometric information input device to the above browser. In the biometric authentication system, the client terminal includes a means for acquiring the plug-in to operate the biometric information input device from the biometric authentication support server, and the online service server includes a means for transmitting a biometric authentication request script to the browser on receiving an access from the browser, and for executing the biometric authentication request script on the browser of the client terminal, so as to authenticate the user of the client terminal. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a biometric authentication system and method for authenticating using personal biometric information in user authentication in a Web application.

As online services such as online shopping, internet banking, and software as a service (SaaS) become more widespread, the importance of user authentication in web applications is increasing.
Therefore, in recent years, biometric authentication systems using personal biometric information such as fingerprints, faces, and finger veins have been used instead of conventional authentication using a user ID and user password (hereinafter referred to as user PW) because of their high security. The introduction has come to attract attention.
In the biometric authentication system, personal biometric information is acquired at the time of initial setting, and feature quantities are extracted from the acquired biometric information and registered. This registered information is called a biometric information template. At the time of authentication, the user is requested to input biometric information again, and the feature amount of the input biometric information is compared with the registered biometric information template to determine whether or not the user is the person.
In a system configuration of a Web application in which a client terminal and an online service server are connected via a network, when performing biometric authentication of a user who operates the client terminal, the server generally holds the user's biometric information template.
The client terminal acquires the user's biometric information at the time of authentication, extracts the feature amount, and transmits it to the server. Thereafter, the server compares the feature amount with the biometric information template and determines whether or not the user is the person.
As described above, in biometric authentication, since the physical characteristics of an individual that cannot be easily imitated by a third party are used for authentication, the security of user authentication can be improved compared to conventional authentication.

However, on the other hand, businesses that introduce biometric authentication are required to strictly manage biometric information templates. From the biometric information, for example, there is a risk that personal privacy information is extracted from the face data, such as gender and race. For this reason, a business operator who introduces biometric authentication needs to strictly manage a biometric information template from the viewpoint of protecting personal information.
Biometric information is limited to the number that an individual can have, and is information that cannot be easily changed even by the owner. For this reason, if the biometric information template is leaked from the server, the leaked template has a risk of being used for impersonation, so that it can no longer be used for authentication, which greatly affects system security.

Conventionally, the high server management cost required for protecting the privacy of users and ensuring safety has been a hindrance when biometric authentication is introduced for authentication of Web applications. Has been proposed. The prior art disclosed in Patent Document 1 creates a biometric information template by creating a filter and an inverse filter for perturbing a biometric information image at the time of initial setting, and applying the filter to the biometric information image. And at the time of authentication, an inverse filter is applied to the collation image created from the biometric information acquired from the user, and it is determined whether or not the person is the person based on the cross-correlation between the collation image after the inverse filter action and the biometric information template. Is.
According to this prior art, only the biometric information template after conversion by the filter is stored in the server, and the original biometric information of the user is concealed, so that the privacy of the user can be protected.
Even if a biometric information template is leaked from the server, it is possible to generate different biometric information templates from the same biometric information by changing the filter created at the time of initial setting. And re-registering a new template can keep the system safe. Due to the above effects, a business operator who introduces biometric authentication can reduce the management cost of the server.

By the way, in recent years, an offline extension plug-in has been proposed for a browser that is an execution environment on the client side of a Web application. Offline extension plug-ins can be used by browsers so that Web applications that could only be used while connected to the network (online) can be used even when network connection is not possible (offline). Software that adds functionality.
For example, in Patent Document 2, a local proxy and an application file storage DB are added to the browser, and an application registered in the application management DB of the server is automatically downloaded by an automatic circulation program of the local proxy and stored in the application file storage DB In addition, by specifying the proxy settings as a local proxy, a technology is disclosed that makes it possible to use a Web application in an offline state by executing an application stored in the application file storage DB from a browser. ing.

  Non-Patent Document 1 discloses a JavaScript (registered trademark) API (Application Program Interface) for realizing a local server function in a browser, a local database function (hereinafter referred to as a local DB function), and a parallel process execution function. A technique for adding and enabling a Web application to be executed offline is disclosed. Hereinafter, the technique disclosed in Non-Patent Document 1 will be described as an example of an offline extension plug-in. This background art is also described in Non-Patent Document 2.

The local server function is an extension of the browser's cache function, and is a mechanism for displaying HTML pages and executing JavaScript even when the browser is offline.
When the offline extension plug-in described in Non-Patent Document 1 is installed, a storage area for the local server is created in the storage unit of the client terminal. The offline extension plug-in intercepts the operation of the browser trying to download the web resource from the server if the web resource such as HTML page or JavaScript requested by the browser is stored in the local server. Operates to load the Web resource from.
Web resources to be stored on the local server are specified by the Web application developer by writing JavaScript code that uses the API provided by the local server function, and downloading it to the browser for execution.

The local DB function is a mechanism for adding a relational database that can be operated from JavaScript to the browser so that the data of the Web application can be updated even in an offline state.
When the offline extension plug-in described in Non-Patent Document 1 is installed, a storage area for a local DB is created in the storage unit of the client terminal. Web application developers can read and write information in the local DB by writing JavaScript code that uses the API provided by the local DB function, downloading it to the browser, and executing it.

The parallel process execution function is a mechanism for adding a function that allows a browser to execute JavaScript in the background.
Web application developers write JavaScript using the API provided by the parallel process execution function, download it to the browser and execute it, causing the browser to generate another process called worker, and let the worker JavaScript can be executed. The worker executes the specified JavaScript and returns the execution result to the calling JavaScript after the execution is completed.
Also. The parallel process execution function provides a mechanism for accessing another origin web resource from JavaScript (hereinafter referred to as cross-origin access). Here, the origin is the combined information of the protocol, domain, and port number of the URL assigned to the Web resource. For example, the origin of the JavaScript file specified by the URL “http://domainA.com:80/resource/sample.js” is “http://domainA.com:80”.

Hereinafter, cross-origin access will be described with reference to FIG.
Browsers are usually designed according to security rules called single origin policies (or called the same origin policy). For example, browser script A belonging to the origin of “http://domainA.com:80” Web resource A that belongs to the same origin can be accessed, but Web resource B that belongs to another origin “http://domainB.com:80” cannot be accessed.
However, if the parallel process execution function is used, if browser script B that belongs to the same origin as Web resource B and the function that accesses Web resource B is stored in the local server in advance, browser script A The browser script A can access the Web resource B via the browser script B by generating the worker with and causing the generated worker to execute the browser script B.

JP2007-293807 JP2001-51839 http://gears.google.com/ GoogleGears Start Guide Shunpei Shiraishi Technical Reviewer

The biometric authentication system described in Patent Document 1 has the following problems.
First, for privacy protection, it is difficult for all users to use biometric authentication because it cannot meet the needs of users who want to manage biometric information with their own hands.
Even the prior art described in Patent Document 1 does not completely eliminate the risk of leakage of user biometric information from the server. If there is a flaw in the method of generating the filter used to convert biometric information, and there is a stochastic bias in the pattern of the generated filter, or if a method for guessing the filter by a third party becomes clear Even if there is no failure on the user side, the biometric information of the user is calculated from the biometric information template stored in the server, and the privacy of the user may be infringed. Therefore, there is a possibility that a business operator who introduces biometric authentication may not use biometric authentication for a user who cannot tolerate the risk of privacy infringement due to the lack of management on the server side.

  Second, the management of the biometric information template at the server still requires a high management cost. As described above, even the conventional technique described in Patent Document 1 does not completely eliminate the risk of leakage of user biometric information from the server. If the server is attacked, a large amount of user biometric information leaks at once, which threatens the security of the system, and the operator operating biometric authentication may lose social trust. Therefore, in order to avoid such a situation, a business operator operating biometric authentication still has to manage the server at a high cost.

  In light of the above-described problems of the prior art, an object of the present invention is to provide a biometric authentication system that balances user privacy protection and user authentication safety, and reduces the server management burden.

In order to achieve the above object, the present invention according to claim 1 is directed to an online service server that provides an online service, a biometric information input device, a storage unit, and a browser having a function of operating the storage unit via a browser script. A biometric information input device operation plug-in for adding a function for operating the biometric information input device to the browser via a browser script, and a function provided by the biometric information input device operation plug-in A biometric authentication system including a biometric authentication script describing a procedure for causing a client terminal to perform biometric authentication, and a biometric authentication support server that stores a biometric authentication request script for calling the biometric authentication script,
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Means for receiving and storing the web application identifier for uniquely identifying the biometric authentication request script;
The client terminal is
Receiving from the biometric authentication support server user identification information for uniquely identifying the user by the online service server and the biometric authentication support server, the biometric information input device operation plug-in, and the biometric authentication script; Means for storing
The client terminal is
Means for activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Means for accessing address information of an online service provided by the online service server via a browser;
The online service server is
Means for receiving the access from the browser, transmitting the biometric request script to the browser, causing the biometric request script to be executed on the browser, and executing the biometric script stored in the storage unit of the client terminal;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, a callback address information acquisition request is acquired by transmitting a callback address information acquisition request to the biometric authentication support server using the user identifier as a parameter, and the callback obtained by acquiring the browser Means for connecting to address information;
The online service server is
Means for receiving an access from a browser, specifying a user based on a user identifier included in callback address information, and providing an online service.

According to a second aspect of the present invention, there is provided a client terminal comprising an online service server for providing an online service, a biometric information input device, a storage unit, and a browser having a function of operating the storage unit via a browser script. And a biometric information input device operation plug-in for adding a function for operating the biometric information input device to the browser via a browser script, and a function provided by the biometric information input device operation plug-in. A biometric authentication system configured with a biometric authentication script that describes a procedure for executing authentication and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Means for receiving and storing a unique web application identifier, a different web application key for each online service, and the biometric request script;
The client terminal is
From the biometric authentication support server, user identification information for uniquely identifying a user in the online service server and the biometric authentication support server, a user key different for each user, the biometric information input device operation plug-in, and the biometric authentication script, Means for receiving and storing in the storage unit;
The client terminal is
Means for activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Means for accessing address information of an online service provided by the online service server via a browser;
The online service server is
Web application access time is generated in response to access from a browser, and MAC application information is generated by adding MAC to the character string concatenating the web application access time and the web application identification information with the web application key. The web application information with MAC and the biometric request script are transmitted to a browser, the biometric request script is executed on the browser, and the web application information with MAC is stored in the storage unit of the client terminal as an argument. Means for executing a biometric script;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, the MAC with the user key is added to the character string obtained by concatenating the user identification information to the Web application information with MAC to generate client information with MAC, and the biometric authentication support server receives the MAC. Means for sending a callback address information acquisition request with attached client information as a parameter,
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Means for transmitting to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, a means for connecting the browser to the callback address information included in the callback information with MAC,
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. A means for verifying whether the time difference from the information generation time is within the valid time and, if within the valid time, specifying the user based on the user identifier included in the callback information with MAC and providing an online service It is characterized by providing.

According to a third aspect of the present invention, there is provided a client terminal comprising an online service server for providing an online service, a biometric information input device, a storage unit, and a browser having a function of operating the storage unit via a browser script. And a biometric information input device operation plug-in for adding a function for operating the biometric information input device to the browser via a browser script, and a function provided by the biometric information input device operation plug-in. A biometric authentication system configured with a biometric authentication script that describes a procedure for executing authentication and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
Means for transmitting to the biometric authentication support server address information of an online service provided by itself and callback address information for accepting a service request from the browser after successful biometric authentication;
The biometric authentication support server is
A web application identifier that uniquely identifies the online service, a web application key that differs for each online service, and a cross-access permission list that includes the origin information of the received online service address information is generated. And means for transmitting the biometric authentication request script to an online service server,
The client terminal is
Means for receiving and storing the user identification information, the user key, the biometric information input device operation plug-in, the biometric authentication script, and the cross access permission list from the biometric authentication support server;
The client terminal is
Means for activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Means for accessing address information of an online service provided by the online service server via a browser;
The online service server is
Web application access time is generated in response to access from a browser, and MAC application information is generated by adding MAC to the character string concatenating the web application access time and the web application identification information with the web application key. The web application information with MAC and the biometric request script are transmitted to a browser, the biometric request script is executed on the browser, and the web application information with MAC is stored in the storage unit of the client terminal as an argument. Means for executing a biometric script;
The client terminal is
Upon execution of the biometric authentication script, a biometric authentication support server is sent an update check request for a cross access permission list, and the latest cross access permission list is received from the biometric authentication support server and stored in the storage unit, and biometric authentication is performed. The origin information of the caller of the script is acquired, and it is verified whether the caller origin information is included in the cross-access permission list stored in the storage unit. The biometric information of the user is acquired by operating, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. The MAC with the user key is added to the character string concatenated with the user identification information to generate client information with MAC, and the biometric authentication support server It means for transmitting a request for call-back address information client information with MAC as a parameter,
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Means for transmitting to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, a means for connecting the browser to the callback address information included in the callback information with MAC,
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. A means for verifying whether the time difference from the information generation time is within the valid time and, if within the valid time, specifying the user based on the user identifier included in the callback information with MAC and providing an online service It is characterized by providing.

According to a fourth aspect of the present invention, there is provided a client terminal comprising an online service server for providing an online service, a biometric information input device, a storage unit, and a browser having a function of operating the storage unit via a browser script. And a biometric information input device operation plug-in for adding a function for operating the biometric information input device to the browser via a browser script, and a function provided by the biometric information input device operation plug-in. An authentication method in a biometric authentication system including a biometric authentication script that describes a procedure for executing authentication and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Receiving and storing a web application identifier for uniquely identifying the biometric authentication request script;
The client terminal is
Receiving from the biometric authentication support server user identification information for uniquely identifying the user by the online service server and the biometric authentication support server, the biometric information input device operation plug-in, and the biometric authentication script; The step of storing in
The client terminal is
Activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Accessing address information of an online service provided by the online service server via a browser;
The online service server is
Receiving the access from the browser, transmitting the biometric request script to the browser, causing the biometric request script to be executed on the browser, and executing the biometric script stored in the storage unit of the client terminal;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, a callback address information acquisition request is acquired by transmitting a callback address information acquisition request to the biometric authentication support server using the user identifier as a parameter, and the callback obtained by acquiring the browser Connecting to address information;
The online service server is
Receiving an access from a browser, specifying a user based on a user identifier included in callback address information, and providing an online service.

According to a fifth aspect of the present invention, there is provided a client terminal comprising an online service server for providing an online service, a biometric information input device, a storage unit, and a browser having a function of operating the storage unit via a browser script. And a biometric information input device operation plug-in for adding a function for operating the biometric information input device to the browser via a browser script, and a function provided by the biometric information input device operation plug-in. An authentication method in a biometric authentication system including a biometric authentication script that describes a procedure for executing authentication and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Receiving and storing a web application identifier that uniquely identifies, a web application key that is different for each online service, and the biometric request script;
The client terminal is
From the biometric authentication support server, user identification information for uniquely identifying a user in the online service server and the biometric authentication support server, a user key different for each user, the biometric information input device operation plug-in, and the biometric authentication script, And storing in the storage unit;
The client terminal is
Activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Accessing address information of an online service provided by the online service server via a browser;
The online service server is
Web application access time is generated in response to access from a browser, and MAC application information is generated by adding MAC to the character string concatenating the web application access time and the web application identification information with the web application key. The web application information with MAC and the biometric request script are transmitted to a browser, the biometric request script is executed on the browser, and the web application information with MAC is stored in the storage unit of the client terminal as an argument. Executing a biometric script;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, the MAC with the user key is added to the character string obtained by concatenating the user identification information to the Web application information with MAC to generate client information with MAC, and the biometric authentication support server receives the MAC. Sending callback address information acquisition request with attached client information as a parameter;
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Sending to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, connecting the browser to the callback address information included in the callback information with MAC, and
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. A step of verifying whether the time difference from the information generation time is within the valid time, and if it is within the valid time, specifying a user based on the user identifier included in the callback information with MAC and providing an online service It is characterized by providing.

According to a sixth aspect of the present invention, there is provided a client terminal comprising an online service server for providing an online service, a biometric information input device, a storage unit, and a browser having a function of operating the storage unit via a browser script. And a biometric information input device operation plug-in for adding a function for operating the biometric information input device to the browser via a browser script, and a function provided by the biometric information input device operation plug-in. An authentication method in a biometric authentication system including a biometric authentication script that describes a procedure for executing authentication and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
Transmitting to the biometric authentication support server address information of an online service provided by itself and callback address information for accepting a service request from the browser after successful biometric authentication;
The biometric authentication support server is
Generate a web application identifier that uniquely identifies the online service, a web application key that differs for each online service, and a cross-access permission list that contains the origin information of the received online service address information. Transmitting the biometric authentication request script to an online service server;
The client terminal is
Receiving and storing the user identification information, the user key, the biometric information input device operation plug-in, the biometric authentication script, and the cross access permission list from the biometric authentication support server;
The client terminal is
Activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Accessing address information of an online service provided by the online service server via a browser;
The online service server is
Web application access time is generated in response to access from a browser, and MAC application information is generated by adding MAC to the character string concatenating the web application access time and the web application identification information with the web application key. The web application information with MAC and the biometric request script are transmitted to a browser, the biometric request script is executed on the browser, and the web application information with MAC is stored in the storage unit of the client terminal as an argument. Executing a biometric script;
The client terminal is
Upon execution of the biometric authentication script, a biometric authentication support server is sent an update check request for a cross access permission list, and the latest cross access permission list is received from the biometric authentication support server and stored in the storage unit, and biometric authentication is performed. The origin information of the caller of the script is acquired, and it is verified whether the caller origin information is included in the cross-access permission list stored in the storage unit. The biometric information of the user is acquired by operating, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. The MAC with the user key is added to the character string concatenated with the user identification information to generate client information with MAC, and the biometric authentication support server Sending a request for call-back address information client information with MAC as a parameter,
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Sending to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, connecting the browser to the callback address information included in the callback information with MAC, and
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. A step of verifying whether the time difference from the information generation time is within the valid time, and if it is within the valid time, specifying a user based on the user identifier included in the callback information with MAC and providing an online service It is characterized by providing.

According to the present invention, a user who uses an online service can use biometric authentication while managing himself / herself without entrusting management of biometric information, which is privacy information, to a provider providing the online service.
Accordingly, a business operator who introduces biometric authentication can expect more users to use biometric authentication.
In addition, since the provider providing the online service does not have to manage the user's biometric information template on the server side, the management cost of the server can be greatly reduced. The risk of leaking biometric information can be avoided.
With the above effects, it is possible to realize a biometric authentication system that balances user privacy protection and user authentication safety and reduces the management burden of the server.

Hereinafter, an embodiment for carrying out the present invention will be specifically described with reference to the drawings.
In the present embodiment, a mode in which a biometric authentication system is realized by adding a biometric information input device operation plug-in to a browser in which an offline extension plug-in has already been installed will be described.
FIG. 1 is a system configuration diagram showing an embodiment of a biometric authentication system according to the present invention.
The biometric authentication system of the present invention has a configuration in which a client terminal 101, a biometric authentication support server 104, and an online service server 105 are connected by a network 103 such as the Internet. Furthermore, a biometric information input device 102 is connected to the client terminal 101.
The client terminal 101 is a terminal operated by a user who receives a web application service, and stores at least a browser 106 in which an offline extension plug-in 107 and a biometric information input device operation plug-in 108 are installed, and a biometric authentication script 110. The storage unit 109 is provided.

The biometric information input device 102 is a biometric information input device such as a fingerprint, an iris, and a vein pattern connected to a client terminal.
The biometric authentication support server 104 is a server that provides programs and data necessary for authentication to the client terminal 101 and the online service server 105.
The biometric authentication support server 104 issues at least the biometric information input device operation plug-in 108 and the biometric authentication script 110 to the client terminal 101 and the biometric authentication request script to the online service server 105 in the initial setting process of the present authentication system described later. 112 is issued.
The online service server 105 is a server that provides an online service to the user via the browser 106, and includes at least a web application program 111 including a biometric authentication request script 112.
Next, detailed configurations of the client terminal 101, the biometric authentication support server 104, and the online service server 105 will be described with reference to FIGS.
FIG. 2 is a functional block diagram showing the configuration of the client terminal 101.
The client terminal 101 has a configuration in which a CPU 201, a memory 202, a storage unit 204, an input device such as a keyboard (not shown), and an output device such as a display are connected via a bus 203.
A browser 205 is loaded into the memory 202 and executed. The browser 205 includes an offline extension plug-in 208 and a biometric information input device operation plug-in 209, and displays the HTML page 206 transmitted from the online service server on the output device. In the storage unit 204, the local server 214 and the local DB 217 are created by the function of the offline extension plug-in.
The HTML page 206 is information returned to the browser as an execution result by the Web application program 111 executed on the online service server 105 in response to a request from the browser.
The biometric authentication request script 207 is a browser script called from the HTML page 206. The browser script is a program executed on the browser, for example, JavaScript.

The biometric authentication request script 207 is downloaded from the biometric authentication support server 104 and embedded in the Web application program 111 by the administrator of the online service server in an initial setting process of the online service server 105 described later. When the web application program is executed without biometric authentication being completed, an HTML page 206 including a biometric authentication request script 207 is returned from the online service server 105 to the browser.
The offline extension plug-in 208 is a program that adds a local server function, a local DB function, and a parallel process execution function to the browser.
The biometric information input device operation plug-in 209 is a program that provides a browser script API (Application Program Interface) for operating the biometric information input device 102 to the browser. In this embodiment, the biometric information input device operation plug-in provides an API for enabling the built-in biometric information registration program 212 and the callback information acquisition program 213 to be called from a browser script. Furthermore, the user ID hash 210 and the user key 211 are held.

The user ID hash 210 is information generated by the biometric authentication support server 104 and issued to the user, and is an identifier for uniquely identifying the user in the biometric authentication support server 104 and the online service server 105.
The user key 211 is information generated by the biometric authentication support server 104 and issued to the client terminal in an initial setting process of the client terminal to be described later, and is given a MAC (Message Authentication Code) between the client terminal and the biometric authentication support server. And key information used for authentication.
The biometric script 215 is a browser script called from the biometric request script 207. The biometric authentication script 215 is downloaded from the biometric authentication support server 104 and stored in the local server 214 by an initial setting process of the client terminal described later. The biometric authentication script is a browser script that uses an API provided by the biometric information input device operation plug-in 209, and calls the biometric information registration program 212 and the callback information acquisition program 213.
The cross access permission list 216 is a list of caller origins that permit the execution of the biometric script 215.

FIG. 3 is a functional block diagram showing the configuration of the biometric authentication support server 104.
The biometric authentication support server 104 has a configuration in which a CPU 301, a memory 302, a storage unit 304, an input device such as a keyboard (not shown), and an output device such as a display are connected via a bus 303.
The storage unit 304 includes a biometric script 305, a biometric request script 306, a callback information providing Web service 307, a cross access permission list 308, a client version management file 309, a Web application information management table 310, and a user information management table 311. Remembered. The callback information providing Web service 307 is appropriately loaded into the memory 302 and executed.
The biometric authentication script 305, the biometric authentication request script 306, and the cross-access permission list 308 in this drawing are the same as the biometric authentication script 215, the biometric authentication request script 207, and the cross-access permission list 216 in FIG.

The callback information providing Web service 307 is a Web service program that is called from the callback information acquisition program 213.
The client version management file 309 is a file that stores the version number of the cross access permission list 308 stored in the biometric authentication support server. This is a file used for updating the cache of the local server 214.
The web application information management table 310 is a table that stores different setting information for each web application.
The user information management table 311 is a table that stores different setting information for each user.

FIG. 4 is a functional block diagram showing the configuration of the online service server 105.
The online service server 105 has a configuration in which a CPU 401, a memory 402, a storage unit 404, an input device such as a keyboard (not shown), and an output device such as a display are connected via a bus 403.
The storage unit 404 stores a Web application program 405 including a biometric authentication request script 406, a Web application ID 407, and a Web application key 408.
Note that the biometric authentication request script 406 in this figure is the same as the biometric authentication request script 207 in FIG. 2 and the biometric authentication request script 306 in FIG.
The web application ID 407 is information generated by the biometric authentication support server 104 and issued to the online service server in the initial setting process of the online service server to be described later. In order to uniquely identify the web application in the biometric authentication support server. Identifier.
The web application key 408 is information generated by the biometric authentication support server 104 and issued to the online service server in the initial setting process of the online service server, which will be described later. This is key information used for authentication.

Next, a configuration example of a table used in the authentication system will be described.
FIG. 5 is a diagram illustrating a configuration example of the Web application information management table 310.
In FIG. 5, the web application ID 501 and the web application key 502 are the same as the web application ID 407 and the web application key 408 described in FIG.
The web application URL 503 is a URL of a web application that performs user authentication in the biometric authentication system. For example, the URL of the top page of the web application.
The callback URL 504 is a URL of a Web application that accepts access from a browser after successful user authentication in the biometric authentication system.

FIG. 6 is a diagram illustrating a configuration example of the user information management table 311.
In FIG. 6, a user key 603 and a user ID hash 604 are the same as the user key 211 and the user ID hash 210 described in FIG.
The user PW 602 is a password used for authenticating the user in the initial setting process of the client terminal 101 in the authentication system described later.
Hereinafter, the operation of the system will be described.
However, the user of the client terminal 101 using the biometric authentication system has already registered the user in the biometric authentication support server 104 and has been issued a user ID and a user PW, and has been registered in the user information management table 310. It is assumed that the user ID 601 and the user PW 602 of the user are stored.
Further, the administrator who manages the online service server 105 has already registered the administrator in the biometric authentication support server 104 in advance and has received an initial setting administrator ID and administrator PW. It is assumed that a manager ID and a manager PW of a registered manager are stored in a table (not shown).
Furthermore, it is assumed that the offline extension plug-in 208 is installed in the client terminal 101 in advance, and a local server and a local DB are created in the storage unit 204.

First, the flow of the initial setting process in the biometric authentication system will be described with reference to FIGS.
FIG. 7 is a flowchart showing the initial setting process of the online service server 105.
In the initial setting process of the online service server 105, the administrator of the online service server 105 registers the web application URL 503 and the callback URL 504 of the web application managed by the administrator of the biometric authentication support server 104, from the biometric authentication support server 104. This is a process for receiving issuance of a web application ID 407 and a web application key 408.
The administrator of the online service server 105 first accesses the administrator page of the biometric authentication support server 104 and logs in using the administrator ID and the administrator PW. Thereafter, the web application URL and callback URL of the web application to be authenticated by the biometric authentication system are transmitted to the biometric authentication support server 104 (step 701).

When receiving the web application URL and the callback URL, the biometric authentication support server 104 generates a web application ID and a web application key (step 702).
The web application ID and web application key generated in step 702 and the web application URL and callback URL acquired in step 701 are stored in the web application information management table 310 (step 703).
The biometric authentication support server 104 adds the origin of the web application URL to the cross access permission list 308, and further updates the version number of the client version management file 309 (step 704).
The biometric authentication request script 306 is acquired from the storage unit 304, and the biometric authentication request script 306 and the web application ID and web application key generated in step 702 are transmitted to the online service server 105 (step 705).

Upon receiving the web application ID, the web application key, and the biometric authentication request script 306, the online service server 105 stores the received web application ID and web application key in the storage unit 404.
In addition, the administrator of the online service server 105 sets the Web application program so that an HTML page including a biometric authentication request script is returned to the browser when a user who has not been authenticated executes the Web application program 405. The received biometric authentication request script is incorporated (step 706).
The above is the initial setting process of the online service server 105.

FIG. 8 is a flowchart showing the initial setting process of the client terminal 101.
In the initial setting process of the client terminal 101, a user who receives a web application service downloads the biometric information input device operation plug-in 209 in which the user ID hash 210 and the user key 211 are incorporated from the biometric authentication support server 104. The biometric information template 218 is generated and stored in the local DB 217.
The user accesses the user management screen on the biometric authentication support server from the browser, and inputs and transmits the user ID and the user PW (step 801).
The biometric authentication support server 104 authenticates the user by comparing the received set of user ID and user PW with the set of user ID 601 and user PW 602 stored in the user information management table 310. When the authentication is successful, a random user key 603 and a user ID hash 604 that is a result of executing a hash function with the user ID as an argument are generated, and the generated user key and user ID hash are received by the received user. The information is stored in the user information management table 310 in association with the set of ID and user PW (step 802).

Next, the biometric authentication support server 104 generates a biometric information input device operation plug-in incorporating the user ID hash and the user key. This process is performed, for example, by a method in which the user ID hash and the user key are written in the plug-in source code and compiled to generate a byte code of the biometric information input device operation plug-in (step 803).
The biometric authentication script 305 and the cross access permission list 308 are acquired from the storage unit 304, and the biometric authentication script 305, the cross access permission list 308, and the biometric information input device operation plug-in generated in step 803 are transmitted to the client terminal 101. (Step 804).
Upon receiving the biometric script 305, the cross access permission list 308, and the biometric information input device operation plug-in, the client terminal 101 stores the biometric script 305 and the cross access permission list 308 in the local server 214. Then, the user installs the received biometric authentication input device operation plug-in into the client terminal 101 (step 805).

The biometric authentication input device operation plug-in executes the biometric information registration program 212 immediately after the installation is completed. The biometric information registration program 212 activates the biometric information input device 102 and requests the user to input biometric information. Then, a feature quantity is extracted from the inputted biometric information, and the biometric information template is generated by encrypting the feature quantity with the user key 211 and stored in the local DB 217 (step 806).
The above is the initial setting process of the client terminal.

Next, a flow of user authentication processing in the biometric authentication system will be described.
FIG. 9 is a flowchart showing processing of the entire authentication system. Steps 905 to 907 are operations of the biometric authentication request script 207.
The user operates the browser 205 to access the web application URL and calls the web application program 405 (step 901).
The online service server 105 first checks whether the user who has been accessed using the browser cookie or the like has been authenticated. If the user has been authenticated, the user is identified by the session information of the cookie, and the service is immediately provided to the user. If it has not been authenticated yet, the current time is acquired (hereinafter, the acquired time is indicated as the web application access time), and the process proceeds to step 903 (step 902).

Next, the web application ID 407 and the web application key 408 are acquired from the storage unit 404, and a character string obtained by concatenating the web application access time generated in step 902 and the web application ID is generated. A MAC with a web application key is further added to the concatenated character string to generate web application information with MAC (step 903).
The HTML page incorporating the biometric authentication request script and the Web application information with MAC 306 generated in step 903 are transmitted to the client terminal 101 (step 904).
When the browser receives the HTML page 206 in which the biometric authentication request script 207 is incorporated and the Web application information with MAC, the browser displays the HTML page on the output device of the client terminal 101. Simultaneously with the output, the HTML page 206 executes the biometric authentication request script 207 with the Web application information with MAC as an argument (step 905).

The biometric request script 207 calls the biometric script by cross-origin access using the parallel process execution function of the offline extension plug-in 208. In other words, the biometric authentication request script 207 generates a new worker, and executes the biometric authentication script 215 in the local server with the Web application information with MAC as an argument. Here, the biometric authentication script described in detail in FIG. 10 later accesses the biometric authentication support server 104 and receives callback information with MAC from the biometric authentication support server 104. Then, the biometric authentication request script acquires callback information with MAC as a return value of the biometric authentication script (step 906).
Note that the callback information with MAC is information generated by the processing of FIG. 11 described later, and is a character string obtained by concatenating the callback URL 504, the user ID hash 604, and the callback information generation time, with the Web application key 502 It is a character string with MAC added.
The biometric authentication request script redirects the browser to the callback URL included in the callback information with MAC acquired in step 906. Thereby, the callback information with MAC is transmitted to the online service server 105 (step 907).

When the online service server 105 receives the callback information with MAC, the online service server 105 acquires the web application key 408 from the storage unit 404 and performs MAC authentication of the callback information with MAC using the web application key 408. If the MAC authentication is successful, the process proceeds to step 909. If the MAC authentication fails, the browser is notified that the user authentication has failed, and the processing is immediately interrupted and terminated (step 908).
Next, the current time is acquired, and the time difference between the current time and the callback information generation time included in the callback information with MAC is calculated. Then, it is checked whether or not the calculated time difference is less than the preset valid time of the callback URL. If it is less than the valid time, the process proceeds to step 910. If it is longer than the valid time, the browser is notified that the user authentication has failed, and the processing is immediately interrupted and terminated (step 909).
Based on the user ID hash information included in the callback information with MAC, the user is identified and the Web application service is provided. In addition, a cookie with an expiration date indicating that the user authentication has been successful is issued to the browser (step 910).

Next, details of the program will be described with reference to the drawings.
First, details of the operation of the biometric authentication script 215 will be described with reference to FIG.
After being called from the biometric authentication request script 207 by using the Web application information with MAC as an argument in step 906 in FIG. Thereafter, a callback information acquisition program 213 built in the biological information input device operation plug-in 209 is executed.
First, the URL of the client version management file is designated, and a version number acquisition request is transmitted to the biometric authentication support server 104 (step 1001).
The biometric authentication support server 104 transmits the version number of the cross access permission list 308 described in the client version management file 309 to the client terminal 101 (step 1002).

The client terminal 101 compares the received version number with the version number of the cross access permission list 216 stored in the local server 214. If the version numbers match, the process immediately proceeds to step 1004. If the version numbers are different, an acquisition request for the cross access permission list 308 is transmitted to the biometric authentication support server 104, and the latest cross access permission list is downloaded and stored in the local server (step 1003).
Thereafter, the worker generation origin is acquired using an API provided by the parallel process execution function, and it is checked whether or not the acquired worker generation origin is included in the cross-access permission list 216 in the local server.
If the worker origin is included in the cross access permission list 216, the process proceeds to step 1005. If not included, the browser notifies the browser that the authentication has failed and ends (step 1004).

When the biometric script is executed according to the present embodiment, the worker origin of generation is the origin of the biometric request script 207, that is, the origin of the web application URL of the web application that the user is trying to use. Since the origin of the web application URL is added to the cross access permission list in step 704 when the online service server is correctly initialized, the origin of the worker is included in the cross access permission list.
Next, the callback information acquisition program 213 is executed using the Web application information with MAC as an argument via the API provided by the biometric information input device operation plug-in. Then, the callback information with MAC is acquired as an execution result (step 1005).
Next, the callback information with MAC acquired in step 1005 is returned to the caller biometric authentication request script, and the execution is terminated (step 1006).

Next, details of operations of the callback information acquisition program 213 and the callback information providing Web service 307 will be described with reference to FIG.
The callback information acquisition program 213 activates the biometric authentication input device 102 and requests the user to input biometric information. Then, the user authentication is performed by comparing the feature amount extracted from the input biometric information with the result of decrypting the biometric information template 218 with the user key 211.
If the user authentication is successful, the process proceeds to step 1102. If the authentication fails, the user is notified that the user authentication has failed, and the process is immediately interrupted and terminated (step 1101).
A character string is generated by concatenating the user ID hash 210 to the Web application information with MAC acquired by the argument. A MAC is further added to the concatenated character string with the user key 211 to generate client information with MAC (step 1102).
The callback information providing Web service 307 on the biometric authentication support server is called using the MAC-added client information generated in step 1102 as an argument (step 1103).
When receiving the client information with MAC, the callback information providing Web service performs MAC authentication using the user key 603 and MAC authentication using the Web application key 502. If both MAC authentications are successful, the process proceeds to step 1105.
If any of the MAC authentications fails, the browser notifies the browser that the user authentication has failed, immediately interrupts the processing, and ends (step 1104).

Details of the MAC authentication process in this step will be described below.
First, a user ID hash included in the received client information with MAC is acquired, and a user key 603 stored in association with the user ID hash is acquired from the user information management table 311. Then, MAC authentication of the client information with MAC is performed using the acquired user key.
Next, MAC authentication of the Web application information with MAC included in the client information with MAC is performed. The Web application ID included in the Web application information with MAC is acquired, and the Web application key 502 stored in association with the Web application ID is acquired from the Web application information management table 310. Then, MAC authentication of the Web application information with MAC is performed using the acquired Web application key.
The current time (hereinafter, the time acquired here is referred to as callback information generation time) is acquired, and the time difference between the callback information generation time and the web application access time included in the Web application information with MAC is calculated. Then, it is checked whether the calculated time difference is less than the preset valid time of the Web application information with MAC.
If it is less than the valid time, the process proceeds to step 1106. If it is longer than the valid time, the browser is notified that the user authentication has failed, and the processing is immediately interrupted and terminated (step 1105).

Thereafter, the Web application ID included in the received client information with MAC is acquired, and the Web application key 502 and the callback URL 504 stored in association with the Web application ID are acquired from the Web application information management table 310. Then, a character string is generated by concatenating the callback URL, the user ID hash 604 acquired in step 1104, and the callback information generation time acquired in step 1105. Is added to generate callback information with MAC (step 1106).
Here, the format of the callback information with MAC is a format in which a user ID hash, callback information generation time, and MAC are passed as URL parameters to the callback URL (for example, “https://service1.com/callback ? usr = 8c8cf9ad3b77f23bba308ab61193 & time = 20070101136756 & sign = 732ab8fa38272a6b77f23bf23bba30b3 ”).
The callback information with MAC generated in step 1106 is transmitted to the client terminal (step 1107).
The callback information acquisition program 213 returns the received callback information with MAC as a return value to the caller's biometric authentication script 207, and ends the execution (step 1108).

The embodiment of the biometric authentication system of the present invention has been described above.
In the embodiment of the present invention, the browser is installed with the offline extension plug-in and the biometric authentication input device operation plug-in. However, if the same function is realized, this is one. It may be a plug-in.
For example, a form in which a plug-in in which a function for operating the biometric information input device is added to an existing offline extension plug-in is created, and the plug-in is distributed to the user's client terminal.

  In the embodiment of the present invention, the biometric information template 218 is stored in the local DB 217. However, it may be stored in the storage unit of the client terminal. In this case, the biometric information input device operation plug-in has a function of operating the storage unit of the client terminal, and in step 806 and step 1101, the biometric information template is read and written from the storage unit using the function.

  Further, in the embodiment of the present invention, the user ID hash 210 and the user key 211 are incorporated into the biometric information input device operation plug-in by the server in step 803, but this is stored in the storage unit of the client terminal. It is good also as a form. In this case, the biometric information input device operation plug-in has the function of operating the storage unit of the client terminal and the function of obtaining the hash value of the user ID with the same hash function used by the biometric authentication support server. Instead of incorporating the user ID hash and user key into the plug-in in step 803, the user key is transmitted to the client terminal in step 804. In step 806, the biometric information registration program sends the user ID and the user key received together with the biometric information to the user. It is assumed that the input user key and the user ID hash calculated from the input user ID are stored in the storage unit of the client terminal. In step 1102, the biometric information input device operation plug-in reads the user ID hash and the user key from the storage unit of the client terminal.

1 is a system configuration diagram showing an embodiment of a biometric authentication system according to the present invention. It is a functional block diagram which shows the internal structure of a client terminal. It is a functional block diagram which shows the internal structure of a biometric authentication assistance server. It is a functional block diagram which shows the internal structure of an online service server. It is a figure which shows the data structural example of a web application information management table. It is a figure which shows the data structural example of a user information management table. It is a flowchart which shows the initial setting process of an online service server. It is a flowchart which shows the initial setting process of a client terminal. It is a flowchart which shows the process of the whole authentication system including operation | movement of a biometrics authentication request script. It is a flowchart which shows the process of a biometrics script. It is a flowchart which shows operation | movement of a callback information acquisition program and callback information provision Web service. It is a conceptual diagram which shows the operation | movement of cross origin access.

Explanation of symbols

101 Client terminal 102 Biometric information input device 104 Biometric authentication support server 105 Online service server 205 Browser 207 Biometric authentication request script 208 Offline extension plug-in 209 Biometric information input device operation plug-in 215 Biometric authentication script 218 Biometric information template

Claims (6)

A client terminal comprising an online service server for providing an online service; a biometric information input device; a storage unit; and a browser having a function of operating the storage unit via a browser script; and biometric information via the browser script to the browser A biometric authentication device plug-in for adding a function for operating the input device, and a biometric authentication procedure for causing the client terminal to perform biometric authentication using the function provided by the biometric information input device operation plug-in A biometric authentication system including a script and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script;
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Means for receiving and storing the web application identifier for uniquely identifying the biometric authentication request script;
The client terminal is
Receiving from the biometric authentication support server user identification information for uniquely identifying the user by the online service server and the biometric authentication support server, the biometric information input device operation plug-in, and the biometric authentication script; Means for storing
The client terminal is
Means for activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Means for accessing address information of an online service provided by the online service server via a browser;
The online service server is
Means for receiving the access from the browser, transmitting the biometric request script to the browser, causing the biometric request script to be executed on the browser, and executing the biometric script stored in the storage unit of the client terminal;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, a callback address information acquisition request is acquired by transmitting a callback address information acquisition request to the biometric authentication support server using the user identifier as a parameter, and the callback obtained by acquiring the browser Means for connecting to address information;
The online service server is
A biometric authentication system comprising: means for receiving an access from a browser, specifying a user based on a user identifier included in callback address information, and providing an online service. A client terminal comprising an online service server for providing an online service; a biometric information input device; a storage unit; and a browser having a function of operating the storage unit via a browser script; and biometric information via the browser script to the browser A biometric authentication device plug-in for adding a function for operating the input device, and a biometric authentication procedure for causing the client terminal to perform biometric authentication using the function provided by the biometric information input device operation plug-in A biometric authentication system including a script and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script;
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Means for receiving and storing a unique web application identifier, a different web application key for each online service, and the biometric request script;
The client terminal is
From the biometric authentication support server, user identification information for uniquely identifying a user in the online service server and the biometric authentication support server, a user key different for each user, the biometric information input device operation plug-in, and the biometric authentication script, Means for receiving and storing in the storage unit;
The client terminal is
Means for activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Means for accessing address information of an online service provided by the online service server via a browser;
The online service server is
Web application access time is generated in response to access from a browser, and MAC application information is generated by adding MAC to the character string concatenating the web application access time and the web application identification information with the web application key. The web application information with MAC and the biometric request script are transmitted to a browser, the biometric request script is executed on the browser, and the web application information with MAC is stored in the storage unit of the client terminal as an argument. Means for executing a biometric script;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, the MAC with the user key is added to the character string obtained by concatenating the user identification information to the Web application information with MAC to generate client information with MAC, and the biometric authentication support server receives the MAC. Means for sending a callback address information acquisition request with attached client information as a parameter,
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Means for transmitting to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, a means for connecting the browser to the callback address information included in the callback information with MAC,
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. Means for verifying whether the time difference from the information generation time is within the valid time and, if it is within the valid time, specifying the user based on the user identifier included in the callback information with MAC and providing an online service And a biometric authentication system. A client terminal comprising an online service server for providing an online service; a biometric information input device; a storage unit; and a browser having a function of operating the storage unit via a browser script; and biometric information via the browser script to the browser A biometric authentication device plug-in for adding a function for operating the input device, and a biometric authentication procedure for causing the client terminal to perform biometric authentication using the function provided by the biometric information input device operation plug-in A biometric authentication system including a script and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script;
The online service server is
Means for transmitting to the biometric authentication support server address information of an online service provided by itself and callback address information for accepting a service request from the browser after successful biometric authentication;
The biometric authentication support server is
A web application identifier that uniquely identifies the online service, a web application key that differs for each online service, and a cross-access permission list that includes the origin information of the received online service address information is generated. And means for transmitting the biometric authentication request script to an online service server,
The client terminal is
Means for receiving and storing the user identification information, the user key, the biometric information input device operation plug-in, the biometric authentication script, and the cross access permission list from the biometric authentication support server;
The client terminal is
Means for activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Means for accessing address information of an online service provided by the online service server via a browser;
The online service server is
Generate web application access time in response to access from the browser,
A web application information with MAC is generated by adding a MAC with the web application key to a character string obtained by concatenating the web application access time and the web application identification information, and the web application information with MAC and the biometric authentication request script are browserd Means for executing the biometric authentication script on the browser, executing the biometric authentication script stored in the storage unit of the client terminal with the MAC-applied web application information as an argument,
The client terminal is
Upon execution of the biometric authentication script, a biometric authentication support server is sent an update check request for a cross access permission list, and the latest cross access permission list is received from the biometric authentication support server and stored in the storage unit, and biometric authentication is performed. The origin information of the caller of the script is acquired, and it is verified whether the caller origin information is included in the cross-access permission list stored in the storage unit. The biometric information of the user is acquired by operating, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. The MAC with the user key is added to the character string concatenated with the user identification information to generate client information with MAC, and the biometric authentication support server It means for transmitting a request for call-back address information client information with MAC as a parameter,
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Means for transmitting to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, a means for connecting the browser to the callback address information included in the callback information with MAC,
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. Means for verifying whether the time difference from the information generation time is within the valid time and, if it is within the valid time, specifying the user based on the user identifier included in the callback information with MAC and providing an online service And a biometric authentication system. A client terminal comprising an online service server for providing an online service; a biometric information input device; a storage unit; and a browser having a function of operating the storage unit via a browser script; and biometric information via the browser script to the browser A biometric information input device operation plug-in for adding a function for operating an input device, and a biometric authentication that describes a procedure for causing a client terminal to perform biometric authentication using a function provided by the biometric information input device operation plug-in A biometric authentication method in a biometric authentication system comprising a script and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Receiving and storing a web application identifier for uniquely identifying the biometric authentication request script;
The client terminal is
Receiving from the biometric authentication support server user identification information for uniquely identifying the user by the online service server and the biometric authentication support server, the biometric information input device operation plug-in, and the biometric authentication script; The step of storing in
The client terminal is
Activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Accessing address information of an online service provided by the online service server via a browser;
The online service server is
Receiving the access from the browser, transmitting the biometric request script to the browser, causing the biometric request script to be executed on the browser, and executing the biometric script stored in the storage unit of the client terminal;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, a callback address information acquisition request is acquired by transmitting a callback address information acquisition request to the biometric authentication support server using the user identifier as a parameter, and the callback obtained by acquiring the browser Connecting to address information;
The online service server is
A biometric authentication method, comprising: receiving an access from a browser, specifying a user based on a user identifier included in callback address information, and providing an online service. A client terminal comprising an online service server for providing an online service; a biometric information input device; a storage unit; and a browser having a function of operating the storage unit via a browser script; and biometric information via the browser script to the browser A biometric information input device operation plug-in for adding a function for operating an input device, and a biometric authentication that describes a procedure for causing a client terminal to perform biometric authentication using a function provided by the biometric information input device operation plug-in An authentication method in a biometric authentication system including a script and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
The address information of the online service provided by itself and the callback address information for receiving the service request from the browser after successful biometric authentication are transmitted to the biometric authentication support server, and the online service is transmitted from the biometric authentication support server. Receiving and storing a web application identifier that uniquely identifies, a web application key that is different for each online service, and the biometric request script;
The client terminal is
From the biometric authentication support server, user identification information for uniquely identifying a user in the online service server and the biometric authentication support server, a user key different for each user, the biometric information input device operation plug-in, and the biometric authentication script, And storing in the storage unit;
The client terminal is
Activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Accessing address information of an online service provided by the online service server via a browser;
The online service server is
Web application access time is generated in response to access from a browser, and MAC application information is generated by adding MAC to the character string concatenating the web application access time and the web application identification information with the web application key. The web application information with MAC and the biometric request script are transmitted to a browser, the biometric request script is executed on the browser, and the web application information with MAC is stored in the storage unit of the client terminal as an argument. Executing a biometric script;
The client terminal is
The biometric authentication script is executed, the biometric information input device is operated to acquire the biometric information of the user, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. When the authentication is successful, the MAC with the user key is added to the character string obtained by concatenating the user identification information to the Web application information with MAC to generate client information with MAC, and the biometric authentication support server receives the MAC. Sending callback address information acquisition request with attached client information as a parameter;
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Sending to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, connecting the browser to the callback address information included in the callback information with MAC, and
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. A step of verifying whether the time difference from the information generation time is within the valid time, and if it is within the valid time, specifying a user based on the user identifier included in the callback information with MAC and providing an online service And a biometric authentication method. A client terminal comprising an online service server for providing an online service; a biometric information input device; a storage unit; and a browser having a function of operating the storage unit via a browser script; and biometric information via the browser script to the browser A biometric information input device operation plug-in for adding a function for operating an input device, and a biometric authentication that describes a procedure for causing a client terminal to perform biometric authentication using a function provided by the biometric information input device operation plug-in An authentication method in a biometric authentication system including a script and a biometric authentication support server that stores a biometric authentication request script that calls the biometric authentication script,
The online service server is
Transmitting to the biometric authentication support server address information of an online service provided by itself and callback address information for accepting a service request from the browser after successful biometric authentication;
The biometric authentication support server is
Generate a web application identifier that uniquely identifies the online service, a web application key that differs for each online service, and a cross-access permission list that contains the origin information of the received online service address information. Transmitting the biometric authentication request script to an online service server;
The client terminal is
Receiving and storing the user identification information, the user key, the biometric information input device operation plug-in, the biometric authentication script, and the cross access permission list from the biometric authentication support server;
The client terminal is
Activating the biometric information input device to generate a biometric information template for the user, and storing the generated biometric information template in a storage unit;
The client terminal is
Accessing address information of an online service provided by the online service server via a browser;
The online service server is
Web application access time is generated in response to access from a browser, and MAC application information is generated by adding MAC to the character string concatenating the web application access time and the web application identification information with the web application key. The web application information with MAC and the biometric request script are transmitted to a browser, the biometric request script is executed on the browser, and the web application information with MAC is stored in the storage unit of the client terminal as an argument. Executing a biometric script;
The client terminal is
Upon execution of the biometric authentication script, a biometric authentication support server is sent an update check request for a cross access permission list, and the latest cross access permission list is received from the biometric authentication support server and stored in the storage unit, and biometric authentication is performed. The origin information of the caller of the script is acquired, and it is verified whether the caller origin information is included in the cross-access permission list stored in the storage unit. The biometric information of the user is acquired by operating, and the user is authenticated by comparing the acquired biometric information with the biometric information template stored in the storage unit. The MAC with the user key is added to the character string concatenated with the user identification information to generate client information with MAC, and the biometric authentication support server Sending a request for call-back address information client information with MAC as a parameter,
The biometric authentication support server is
In response to a callback address information acquisition request, when MAC authentication of the MAC-added client information acquired as a parameter and MAC authentication of the MAC-applied Web application information included in the MAC-added client information are performed, both authentications succeed Next, generate the callback information generation time, verify whether the time difference between the callback information generation time and the web application access time included in the application information with MAC is within the valid time. Generating a callback information with MAC by adding a MAC with the Web application key to a character string obtained by concatenating the callback address information, the user identification information, and the callback information generation time, and generating the callback information with MAC Sending to the client terminal;
The client terminal is
Using the received callback information with MAC as a parameter, connecting the browser to the callback address information included in the callback information with MAC, and
The online service server is
When MAC access callback information obtained as a parameter is MAC-authenticated from the browser and MAC authentication is successful, the current time is obtained and the callback included in the current time and MAC callback information. A step of verifying whether the time difference from the information generation time is within the valid time, and if it is within the valid time, specifying a user based on the user identifier included in the callback information with MAC and providing an online service And a biometric authentication method.

Images