JP2010072891A - Authentication apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent unauthorized act, such as spoofing, using a simple arrangement of an authentication apparatus which authenticates passengers at an entrance or exit where passage is restricted, such as, entrance to an office building. <P>SOLUTION: The authentication apparatus 100 inhibits a card reader 300 from reading card authentication information, until a camera image of a passenger's face is obtained by a camera 200. The card reader 300 reads the authentication information from the passenger's card, only if the camera image of the passenger's face is obtained, and will only perform card authentication without performing face authentication. In this way, the need for special arrangement for face authentication is eliminated, and the passenger's face image can be recorded, and since a building manager, or the like, can confirm the passenger's face image afterwards, this provides a deterrent force against unauthorized acts. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an apparatus for performing admission management at an entrance of an entrance restricted area where entrance is restricted such as an office building, a condominium, and a hospital.

In office buildings, condominiums, hospitals, etc., there are many authentication devices that are equipped with doors with electric locks at the entrance and exit to manage the entrance of passers-by when the doors pass to improve security.
In such an authentication apparatus, for example, a camera and a card reader are provided, and a user's identity is confirmed using a photographed image of a passer-by photographed by the camera and an IC (Integrated Circuit) card possessed by the passer-by. .
In other words, in the authentication device, the face image and card information of a person who is permitted to pass through the door are registered in advance, and when a passerby who tries to pass through the door appears, the camera takes a picture of the passerby and takes a picture. If the passerby reads the card information with a card reader, the authentication process is performed to determine whether the face image matches the registered face image. An authentication process is performed to check whether the information matches.
When both the face image and the card are authenticated, the passage of the door may be permitted, or when either the face image or the card is authenticated, the passage of the door may be permitted.

As an authentication apparatus using such a plurality of authentication methods, there is an apparatus described in Patent Document 1.
Further, with regard to face authentication using a camera, since face authentication is easily affected by external light, and the lighting conditions at the time of registration and authentication are not the same, the performance cannot be fully demonstrated. As a countermeasure, there is a configuration in which illumination for photographing a face or a light shielding plate is installed as a countermeasure.
JP 2005-44252 A JP 2006-1555078 A

Patent Document 1 describes a method of operating a combined authentication device of biometric authentication and a card authentication device. However, a non-registrant uses a card of a regular registrant, which is a problem in the operation of only the card authentication device, and performs an authentication operation. Measures against “spoofing” to be performed have not been studied.
For this reason, there is a problem in safety that “spoofing” may be missed only by card authentication, and there is a problem that authentication may not be performed correctly by face variation alone due to variations in lighting.
Even in the combined authentication of face authentication and card authentication, there is a problem that the performance cannot be sufficiently exhibited due to the above-described problems related to face authentication.
Japanese Patent Laid-Open No. 2004-228688 can suppress fluctuations in lighting conditions at the time of registration and authentication, but requires lighting for face photography, a light shielding plate, and the like, and there is a problem that the apparatus scale increases.

  One of the main objects of the present invention is to solve the above-described problems, and it is a main object of the present invention to realize an authentication device that suppresses fraud such as “spoofing” with a simple configuration.

The authentication device according to the present invention is:
A card information input unit for inputting the authentication information from a card in which the authentication information is stored;
A biometric information input unit for inputting biometric information of the user of the card;
When the biometric information is input by the biometric information input unit and the authentication information is input by the card information input unit, it is input by the card information input unit without performing biometric authentication using the biometric information. And an authentication unit that performs card authentication using the authentication information.

  According to the present invention, since biometric authentication such as face authentication is not performed and authentication is performed with a card only when biometric information such as a face image is input, the biometric information of the card user such as the face image is confirmed. Thus, fraud such as “spoofing” can be suppressed with a simple configuration.

Embodiment 1 FIG.
FIG. 1 shows an arrangement example of the authentication device 100 according to the present embodiment.
As shown in FIG. 1, authentication apparatus 100 according to the present embodiment is arranged in the vicinity of an entrance to entrance restriction area 500 where entry is restricted, and authenticates a person who tries to enter entrance restriction area 500. To determine whether or not it is possible to enter the restricted entry area 500.
At the entrance to the entrance restricted area 500, a door 400 with an electric lock provided with an electric lock is arranged. The door 400 with the electric lock succeeds in the authentication of the person, and keeps the closed state and restricts the entrance to the entrance restricted area 500 unless there is an instruction from the authentication device 100.
Further, the authentication device 100 is provided with a camera 200 and a card reader 300.
The camera 200 photographs a passer's face.
The card reader 300 reads authentication information from a card such as a passer's IC card.
In the present embodiment, an example in which the camera 200 that captures the face of a passer is described will be described, but other means for acquiring biometric information of a passer (a card user) may be used. For example, the passerby's fingerprint, the iris in the pupil, the shape of the palm or finger blood vessel, and the like may be used.

  FIG. 2 shows a configuration example of the authentication apparatus 100 according to the present embodiment.

The camera image input unit 101 inputs camera image information of a passer's face, which is an example of biometric information, from the camera 200. The camera image input unit 101 is an example of a biological information input unit.
The card information input unit 102 inputs authentication information for a passer's card read by the card reader 300.

The authentication unit 103 verifies the passerby by comparing the authentication information input by the card information input unit 102 with the registration information stored in the registration information storage unit 104.
The authentication unit 103 permits the camera image input unit 101 to input the camera image of the passer's face and prohibits the card information input unit 102 from inputting authentication information. When the camera image of the person's face is input, the authentication information of the card information input unit 102 is allowed to be input. When the authentication information is input by the card information input unit 102, the authentication by the camera image is performed. Without authentication, card authentication using authentication information is performed.

The registration information storage unit 104 stores registration information registered in advance for verification with the card authentication information.
The passage information storage unit 105 stores information related to authentication of passers-by such as an authentication result by the authentication unit 103, an authentication date and time, and a camera image input by the camera image input unit 101. The traffic information storage unit 105 is an example of an information storage unit.
The display unit 106 displays an authentication result or the like to a passerby.
When the authentication is successful, the electric lock control unit 107 unlocks the electric lock of the door 400 with the electric lock.

  Next, an operation example of the authentication apparatus 100 according to the present embodiment will be described using the flowchart of FIG.

First, as an initial state, the authentication unit 103 controls the card reader 300 and the card information input unit 102 to prohibit card reading (ST301), and controls the camera 200 and the camera image input unit 101 to detect a face ( The photographing of the passer's face is permitted (ST302).
Next, when a passerby stands in front of the authentication device 100 and tries to operate the authentication device 100 in order to enter the restricted access area 500, the camera 200 captures the face of the passerby, and the camera image input unit 101 detects the camera. The image is input, and authentication unit 103 detects a passerby (YES in ST303).
Next, authentication section 103 controls card reader 300 and card information input section 102 to permit card reading (ST304).
That is, if the passer's face is not photographed by the camera 200, the passer cannot read the authentication information into the card reader 300, and card authentication cannot be started.

When the passerby causes the card reader 300 to read the card authentication information, the card information input unit 102 acquires the authentication information from the card reader 300 and passes the authentication information to the authentication unit 103 (YES in ST305).
Next, authentication section 103 reads registration information corresponding to the authentication information acquired from card information input section 102 from registration information storage section 104 (ST306).
Next, authentication section 103 performs card authentication by comparing authentication information with registration information (ST307).
If the card authentication is successful (YES in ST308), authentication unit 103 instructs electric lock control unit 107 to unlock, and electric lock control unit 107 unlocks the electric lock of door 400 with the electric lock (ST309). .
On the other hand, when the card authentication fails (NO in ST308), authentication section 103 performs a predetermined error process (ST310).
Note that the authentication result is notified from the display unit 106 whether the authentication is successful or unsuccessful.
Further, the authentication unit 103 outputs information related to authentication of a passer-by such as an authentication result, an authentication date and time, and a camera image input by the camera image input unit 101 to the passing information storage unit 105, and the passing information storage unit 105 outputs the information. Is stored (ST311).

  As described above, in the present embodiment, only the card authentication is performed without performing the face authentication, so that the face photographing illumination, the light shielding plate, and the like necessary for performing the face authentication with high accuracy are unnecessary.

Also, if the passer's face is not detected (a photographed image of the passer's face cannot be obtained), authentication with the card is not performed, so the face image is recorded after card authentication, and the building manager is later Etc. can confirm the passerby's face image.
As a result, even when a non-registrant obtains a registrant's card during card-only operation and attempts to authenticate the card illegally, the authentication operation cannot be performed unless a standing face is photographed in front of the authentication device. Therefore, it becomes a deterrent to unauthorized operations such as “spoofing”.

Embodiment 2. FIG.
In the present embodiment, an authentication apparatus that can select face authentication in addition to card authentication will be described.

FIG. 4 shows a configuration example of the authentication apparatus 100 according to the present embodiment.
Compared to FIG. 2, there are a face authentication unit 1031 and a card authentication unit 1032 as internal functions of the authentication unit 103, and a face registration information storage unit 1041 and card registration information as internal functions of the registration information storage unit 104. A storage unit 1042 exists.
In addition, a setting unit 108 and a determination unit 109 are added.

The face authentication unit 1031 performs face authentication of the passer by comparing the face image of the passer by the camera 200 with the face registration information stored in the face registration information storage unit 1041.
The card authentication unit 1032 performs the card authentication described in the first embodiment.
The face registration information storage unit 1041 stores face registration information that is a face image of the registrant.
The card registration information storage unit 1042 stores card registration information that is card information of the registrant.

The setting unit 108 sets an operation pattern (authentication mode).
In authentication apparatus 100 according to the present embodiment, when authentication is performed with a card only when a face shown in the first embodiment is detected (first authentication mode), authentication with only the card is performed (without face detection). When performing authentication, when performing face only authentication (second authentication mode), when performing either face or card authentication, or performing both face and card authentication (second authentication mode) Although there are operation patterns (authentication modes), the setting unit 108 sets which of the five operation patterns is to be implemented.
The setting unit 108 is an example of an authentication mode setting unit.

  The determination unit 109 determines the total authentication result according to the operation pattern setting of the setting unit 108 such as positive when both the face and the card are authenticated, and positive when either the face and the card are authenticated. put out.

  Next, an operation example of the authentication apparatus 100 according to the present embodiment will be described with reference to the flowchart of FIG.

First, authentication section 103 controls card reader 300 and card information input section 102 to prohibit card reading (ST501), and controls camera 200 and camera image input section 101 to prohibit face detection (ST502). ).
Next, authentication section 103 reads the operation pattern set by setting section 108 (ST503), and determines whether the operation pattern is an operation pattern only for card authentication (ST504).
As a result, if it is not an operation pattern only for card authentication, that is, a fate pattern with face detection (YES in ST504), the camera 200 and the camera image input unit 101 are controlled to allow face detection (ST505), It is determined whether or not a passer's face has been detected (whether or not a camera image of the passer's face has been input) (ST506).
As a result, when a face is detected (YES in ST506), authentication section 103 determines whether the operation pattern requires face authentication as well as face detection (ST507).
If face authentication is required (YES in ST507), face authentication section 1031 reads face registration information from face registration information storage section 1041 (ST508), performs face authentication processing (ST509), and the face is authenticated. It is determined whether or not (ST510).
If face authentication fails (NO in ST510), a predetermined error process (ST519) is performed. If face authentication succeeds (YES in ST510), the authentication unit 103 next requires an operation pattern that requires card reading. If the card authentication is unnecessary (YES in ST511), the determination unit 109 performs a determination process (ST517), determines the total authentication result, and the traffic information storage unit 105 Stores the passage operation (ST518) and displays the result.

On the other hand, when the operation pattern is a card authentication only operation pattern (NO in ST504) in the operation pattern reading (ST503), or when face authentication processing is not required (NO in ST507), card authentication processing is required. (NO in ST511) authentication section 103 permits card reading (ST512). Note that the case of NO in ST507 is a case where the operation pattern described in the first embodiment is implemented.
Authentication section 103 determines whether or not card authentication information has been input from card reader 300 and card information input section 102 (ST513). If card authentication information has been input (YES in ST513), card authentication is performed. Unit 1032 reads out card registration information from card registration information storage unit 1042 (ST514), and performs card authentication processing (ST515).
If the card authentication is unsuccessful (NO in ST516), a predetermined error process (ST520) is performed. If the card authentication is successful (YES in ST516), the determining unit 109 performs a determining process (ST517), The traffic information storage unit 105 stores the traffic operation (ST518) and displays the result.

  As described above, according to the present embodiment, it is possible to flexibly set an operation pattern for authentication according to the security level. Further, since authentication is performed according to the set operation pattern, the range of operation is widened.

  Finally, a hardware configuration example of the authentication apparatus 100 shown in the first and second embodiments will be described.

The authentication device 100 includes, for example, a CPU (Central Processing Unit, central processing unit, processing unit, processing unit, microprocessor, microcomputer, processor) that executes a program.
The CPU is connected to, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), a communication board, a display device, a card reader, a camera, and a magnetic disk device via the bus, and controls these hardware devices. .
Further, the CPU may be connected to an FDD (Flexible Disk Drive), a compact disk device (CDD), a printer device, and a scanner device. Further, instead of the magnetic disk device, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM is an example of a volatile memory. The storage medium of the bus, FDD, CDD, and magnetic disk device is an example of a nonvolatile memory. These are examples of the storage device.
A communication board, a card reader, a camera, a mouse, a scanner device, an FDD, and the like are examples of an input device.
Communication boards, display devices, printer devices, and the like are examples of output devices.

  The communication board may be connected to, for example, a LAN (local area network), the Internet, a WAN (wide area network), or the like.

The magnetic disk device stores an operating system (OS), a program group, and a file group.
The programs in the program group are executed by the CPU using an operating system and a window system.

The RAM temporarily stores at least part of an operating system program and application programs to be executed by the CPU.
The RAM stores various data necessary for processing by the CPU.

  The program group stores a program for executing the function described as “˜unit” in the description of the first and second embodiments. The program is read and executed by the CPU.

In the file group 924, in the description of the first and second embodiments, “determination of”, “calculation of”, “comparison of”, “collation of”, “evaluation of”, “update of” ”,“ Setting of ”,“ registration of ”,“ selection of ”, etc., information, data, signal values, variable values, and parameters indicating the results of the processing are represented by“ ˜file ”or“ ˜ It is stored as each item of “Database”.
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
The arrows in the flowcharts described in the first and second embodiments mainly indicate input / output of data and signals. The data and signal values are RAM memory, FDD flexible disk, CDD compact disk, magnetic Recording is performed on a recording medium such as a magnetic disk of the disk device, other optical disks, mini disks, and DVDs. Data and signals are transmitted on-line via buses, signal lines, cables, and other transmission media.

  In addition, what is described as “˜unit” in the description of the first and second embodiments may be “˜circuit”, “˜device”, “˜device”, and “˜step”, It may be “to procedure” or “to process”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU and executed by the CPU. That is, the program causes the computer to function as “to part” in the first and second embodiments. Alternatively, the computer executes the procedure and method of “to unit” in the first and second embodiments.

  As described above, the authentication device 100 described in the first and second embodiments includes a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, a display device as an output device, and a communication board. As described above, the function indicated as “to part” is realized by using these processing device, storage device, input device, and output device.

FIG. 3 is a diagram illustrating an arrangement example of authentication devices according to the first embodiment. FIG. 3 shows a configuration example of an authentication apparatus according to the first embodiment. FIG. 3 is a flowchart showing an operation example of the authentication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of an authentication device according to a second embodiment. FIG. 10 is a flowchart showing an operation example of the authentication apparatus according to the second embodiment.

Explanation of symbols

  100 authentication device 101 camera image input unit 102 card information input unit 103 authentication unit 104 registration information storage unit 105 traffic information storage unit 106 display unit 107 electric lock control unit 108 setting unit 109 determination unit 200 camera, 300 card reader, 400 door with electric lock, 500 entrance restricted area, 1031 face authentication unit, 1032 card authentication unit, 1041 face registration information storage unit, 1042 card registration information storage unit.

Claims (5)

A card information input unit for inputting the authentication information from a card in which the authentication information is stored;
A biometric information input unit for inputting biometric information of the user of the card;
When the biometric information is input by the biometric information input unit and the authentication information is input by the card information input unit, it is input by the card information input unit without performing biometric authentication using the biometric information. And an authentication unit that performs card authentication using the authentication information. The authentication unit
Permit the input of the biometric information by the biometric information input unit, prohibit the input of the authentication information by the card information input unit,
When the biometric information is input by the biometric information input unit, input of the authentication information by the card information input unit is permitted, and when the authentication information is input by the card information input unit, The authentication apparatus according to claim 1, wherein card authentication is performed without performing authentication. The authentication device further includes:
The authentication apparatus according to claim 1, further comprising an information storage unit that stores the biological information input by the biological information input unit. The authentication unit
Biometric authentication using the biometric information is possible,
The authentication device further includes:
As the authentication mode of the authentication unit, at least when the biometric information is input by the biometric information input unit, the card information input unit allows the authentication information to be input and the card information input unit performs the authentication. A first authentication mode for performing card authentication without performing biometric authentication when information is input, and a second authentication mode for performing biometric authentication when the biometric information is input by the biometric information input unit are set. It has an authentication mode setting part,
The authentication unit
The authentication apparatus according to claim 2 or 3, wherein authentication is performed in accordance with an authentication mode set by the authentication mode setting unit. The biological information input unit is
The authentication apparatus according to claim 1, wherein image information of a face portion of a user of the card photographed by a camera is input.

Images