JP2011134030A - Biometric authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid that privacy of a user is intruded while suppressing cost though the cost is taken dependently on the number of pieces of data necessary to prevent information leakage to prevent occurrence of the privacy intrusion of the user, and to allow easy incorporation into a biometric authentication system. <P>SOLUTION: In the biometric authentication system, a client terminal 40 obtains bioinformation of the user, an application server 21 requests authentication of the user from a biometric authentication server 10, obtains an external ID of the user authenticated by the biometric authentication server 10, obtains user information corresponding to the external ID, and provides an application based on the user information, and the biometric authentication server 10 associates an internal ID managed inside a biometric authentication device and the external ID managed inside the application server 21 by use of a stored key, collates tamper resistance storing the key, previously registered bioinformation and the obtained bioinformation, authenticates the user, and returns a result of the authentication. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a biometric information management method in a biometric authentication system.

  The biometric authentication system is a system for receiving authentication for a user to use an application, and generally includes three devices. The three devices are a client terminal that receives biometric information input from the user, a biometric authentication device that authenticates the user by collating the input biometric information with biometric information registered in advance, and authentication is successful. An application system that provides an application to a user permitted to use based on user information of a user registered in advance.

  Conventionally, in a biometric authentication system, biometric authentication of a plurality of application systems is collectively performed by a biometric authentication device. When the biometric authentication device and the application system cooperate, it is necessary to manage a database that associates IDs managed by the biometric authentication device with IDs managed by a plurality of application servers.

  The biometric authentication system described in Patent Literature 1 includes an ID conversion device in addition to a client terminal, a biometric authentication device, and an application system. The client terminal includes biometric information acquisition means for the user, the application system has a pair of ID1 and user information, the ID conversion device has a pair of ID1 and ID2, and the biometric authentication device has ID2 and biometric information registered in advance. A pair of is stored. By providing the ID conversion device, it is not necessary to associate the ID managed by the application system with the biometric authentication device, and the biometric authentication device can be easily incorporated into the system.

JP 2002-278951 A

  In the technique described in Patent Document 1, a pair of ID1 and user information stored in an application system, a pair of ID1 and ID2 stored in an ID conversion device, and an ID2 and biometric stored in a biometric authentication device. If a database paired with information leaks, a third party can associate user information with biological information. Therefore, in order to prevent the occurrence of user privacy infringement, it is necessary to increase the security level of the database to prevent information leakage.

  However, increasing the security level of the database is costly depending on the number of data that needs to be prevented from leaking information. Therefore, when a large number of users are handled by the biometric authentication device, the amount of data is large and the cost is significant. Take it. For this reason, there is a problem that it is difficult to raise the security level.

  In order to solve the above problems, one embodiment of the present invention includes the following configuration. That is, the biometric authentication system of the present invention includes a client terminal, an application server, and a biometric authentication server, the client terminal includes biometric information acquisition means for acquiring biometric information of a user, and the application server includes a biometric authentication server. Means for requesting user authentication, means for acquiring the external ID of the user authenticated by the biometric authentication server, means for acquiring user information corresponding to the external ID, and means for providing an application based on the user information The biometric authentication server includes a conversion means for associating an internal ID managed in the biometric authentication server with an external ID managed in the application server using a stored key, and a resistance for storing the key. Tamper storage means, biological information registered in advance and biological information acquired by the client terminal, Collating, authenticates the user, and means responsive to the result of the authentication, comprising: a.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to avoid that a user's privacy is infringed, restraining cost, and to incorporate in a biometric authentication system easily.

It is a system configuration figure showing an example of a biometrics application application system concerning each example. It is a figure which shows an example of the biometric information 111 for registration in FIG. It is a figure which shows an example of the authentication log | history 112 in FIG. It is a figure which shows an example of the key 113 in FIG. It is a figure which shows an example of the user information 205 in FIG. It is a system configuration diagram showing an example of a biometric information backup system for registration according to each embodiment. It is a figure which shows an example of the biometric information backup 711 for registration in FIG. It is a sequence diagram which shows an example of the user registration process sequence of each Example. FIG. 6 is a sequence diagram illustrating an example of an authentication processing procedure according to the first embodiment. FIG. 10 is a sequence diagram illustrating an example of an identification processing procedure according to the second embodiment. It is a sequence diagram which shows an example of the user deletion process procedure of each Example. It is a sequence diagram which shows an example of the internal ID & key update process sequence of each Example. It is a sequence diagram which shows an example of the biometric information backup process procedure for registration of each Example. It is a hardware block diagram which shows an example of a structure of the terminal of each Example, or a server.

  Hereinafter, embodiments of the present invention will be described in detail in Example 1 and Example 2.

  In the first embodiment, 1: 1 verification (Match) is performed on the acquired biometric information and biometric information registered in advance, and verification of the user is performed. In the second embodiment, 1: N matching is performed on the acquired biometric information and the biometric information registered in advance to identify the user. Here, verification and identification are collectively referred to as authentication.

  Hereinafter, embodiments of the present invention will be described in detail.

  FIG. 1 is a system configuration diagram when this embodiment is applied to a remote application.

  The registration client terminal 30 and the authentication client terminal 40 are connected to the application server 20 and the application server 21 via the network 60, and the application server 20 and the application server 21 are connected to the biometric authentication server 10 via the network 50. Connected.

  The biometric authentication server 10 includes a biometric information matching function 100, an external ID-internal ID conversion function 101, an internal ID issuing function 102, application server 20 data 110, and application server 21 data 120. .

  The application server 20 and the application server 21 may be managed in the biometric authentication server 10.

  Hereinafter, the components will be described. The biometric information collation function 100 has a one-to-one collation function for collating one registration biometric information stored in the registration biometric information 111 with one verification biometric information input by the user. Here, the biometric information for registration is biometric information that is first registered by the user (details will be described later in S113 in FIG. 8).

  The verification biometric information is biometric information input every time the user receives verification (details will be described later in S202 and S203 in FIG. 9).

  The external ID-internal ID conversion function 101 is a function that performs conversion from an external ID to an internal ID and from an internal ID to an external ID. In the first embodiment, conversion from an external ID to an internal ID is performed.

  This conversion is a function of performing conversion processing using the key 113 (normal operation key 1131 or update key 1132 or backup key 1133) corresponding to the secret information. For example, this conversion is realized using a common key encryption method. To do. By strictly managing the key, it becomes difficult for a third party to convert between the external ID and the internal ID, and the biometric information for registration and the information of the user information can be prevented from being associated with each other. The key 113 is strictly managed using a hardware cryptographic module or the like in order to prevent a third party from performing the conversion process. In the present embodiment, an object to be strictly managed is a key that is information having a small data size (for example, a 256-bit key in the encryption standard Advanced Encryption Standard), and is strictly and easily obtained by using a hardware encryption module or the like. Can be managed. Further, it may be strictly managed by setting an access authority to the key 113. Note that the key 113 does not need to be used for all of the plurality of application servers, and at least one key may be a key different from other application servers. Conversion processing when the same key is not used is different for each application server. By using a different key for each application server, the security level can be further increased. The internal ID issuing function 102 is a function for issuing an internal ID.

  When repeating registration of user information and biometric information for registration (the process of FIG. 8), the internal ID issued by the biometric authentication server is issued based on a random number, for example, so that a third party cannot infer from the registration order. It is desirable to do. Then, it becomes difficult to guess the correspondence between the user information and the internal ID. In addition, since the issuance is based on a random number, it is difficult to provide a relationship between the internal ID for the application server 20 and the internal ID for the application server 21. When the same person uses a plurality of application servers, the biometric information may be managed corresponding to different internal IDs for each application server.

  The application server 20 data 110 manages information for the application server 20, and the application server 21 data 120 manages information for the application server 21.

  The biometric information for registration 111 stores a pair of the internal ID for the application server 20 and biometric information for registration, and the authentication history 112 stores a pair of the external ID for the application server 20 and the authentication history. The key 113 stores a key for the application server 20 used in the external ID / internal ID conversion function 101.

  In this manner, the biometric authentication server 10 stores the biometric information for registration 111 (a pair of internal ID and biometric information), an authentication history 112 (a pair of external ID and authentication history), and the key 113.

  The correspondence between the external ID and the internal ID can be known when the external ID-internal ID conversion function 101 of the biometric authentication server 10 uses the key 113.

  Therefore, even if a third party obtains biometric information 111 for registration (a pair of internal ID and biometric information) and an authentication history 112 (a pair of external ID and authentication history), the third party uses the key 113. Unless it is obtained, the correspondence between the biometric information and the authentication history cannot be known. Since it is difficult for a third party to associate the biometric information with the authentication history, the privacy infringement risk of the user can be avoided.

  Even if the biometric information for registration 111 is leaked to a third party, the third party cannot follow the association based on the authentication history to estimate who the biometric information belongs to, so the leaked biometric information It is possible to reduce the threat of attacks on the present biometric authentication system or other biometric authentication systems using.

  Since the internal ID issuing function 102 is issued based on a random number in this way, it is difficult to have a relationship between the internal ID system for the application server 20 and the internal ID system for the application server 21, and the key 113 When a different server is used, the conversion process is different for each application server.

  Therefore, the external ID system of the authentication history of the application server 20 data 110 is different from the external ID system of the authentication history of the application server 21 data 120. Even if the third party acquires both authentication histories, authentication history information cannot be associated with the same user between different application servers, and privacy infringement risks such as user behavior traces can be reduced.

  Further, since the internal ID system of the biometric information for registration in the data 110 for the application server 20 and the internal ID system of biometric information for registration in the data 120 for the application server 21 are different, the third party Even if biometric information for registration is obtained, it is difficult to associate biometric information with biometric information registered in another application server based on the internal ID between different application servers, and the privacy infringement risk of the user is reduced. It is possible to reduce the threat of the attack on the biometric authentication system or other biometric authentication system that occurs because the biometric information is associated with different application servers (for example, face image (biometric information) is included in the data 110 for the application server 20). Data stored for application server 21 It is assumed that fingerprint information (biological information) is stored in 120. If both biometric information for registration leaks, the face image is identified by visual inspection, and the face image and fingerprint information are associated with each other. Fingerprint information is personally identified and the risk of a spoofing attack on the application server 21 is increased).

  Furthermore, the system of the internal ID of the biometric information for registration in the data 110 for the application server 20 may be different from the system of the internal ID of the biometric information for registration in the data 120 for the application server 21, and the key 113 is also the application server. Since the registration biometric information and key 113 of the application server 20 data 110 are leaked, the biometric information and key for registration of the data 120 for the application server 21 are hardly affected, and biometric authentication is possible. The server 10 can safely continue processing for the application server 21. In other words, the biometric authentication server 10 has independence in processing for each application server, and can maintain high availability.

  The application server 20 requests a user registration / deletion function 201 having a user registration or deletion function (“/” means “or”) and user verification or user identification from the biometric authentication server 10. Application that provides an application to the user verification / identification request function 202, the user authorization function 203 that authorizes the use of the application based on the user verification and the user identification result, and the application client function 403 of the authentication client terminal 40 via the network 60 It comprises a server function 204 and user information 205 for storing user information.

  As described above, the biometric authentication server 10 manages biometric information 111 for registration (a pair of internal ID and biometric information), and the application server 20 manages user information 205 (a pair of external ID and user information). The correspondence between the external ID and the internal ID can be known when the external ID-internal ID conversion function 101 of the biometric authentication server 10 uses the key 113.

  Therefore, even if a third party obtains biometric information 111 for registration (a pair of internal ID and biometric information) and user information 205 (a pair of external ID and user information), the third party uses the key 113. Unless it is obtained, the correspondence between biometric information and user information cannot be known. Since it is difficult for a third party to associate biometric information with user information, the privacy infringement risk of the user can be reduced.

  Further, even if the biometric information 111 for registration leaks to a third party, the third party cannot easily know who the information is because it is difficult to associate the biometric information with the user information. It is possible to reduce the threat of attacks on the present biometric authentication system or other biometric authentication systems using the biometric information.

  The registration client terminal 30 acquires the biometric information acquisition function 301 for acquiring biometric information for registration from the user, and the user information to acquire the user information to be registered in the user information 205 by the user input or reading of the card information owned by the user. An acquisition function 302 and a registration result display function 303 for displaying a user registration process result are configured.

  The authentication client terminal 40 acquires biometric information acquisition function 401 for acquiring biometric information for verification or identification biometric information from the user, and an external ID used for verification by user input or reading of card information owned by the user. An external ID input function 402 and an application client function 403 that receives application provision from the application server function 204 of the application server 20 via the network 60 are configured.

  FIG. 14 shows an apparatus for realizing the system shown in FIG.

  Each device in FIG. 14 can be realized by using a general computer including a CPU and a storage device. Further, each function constituting each device is embodied on the computer by the CPU executing a program stored in the storage device. Each program may be stored in advance in a storage device in the computer, or introduced to the storage device from another device via an input / output interface and a medium that can be used by the computer when necessary. May be. The medium refers to, for example, a storage medium that can be attached to and detached from the input / output interface, or a communication medium (that is, a wired, wireless, optical network, or a carrier wave or digital signal that propagates through the network).

  FIG. 14 shows the hardware configuration of the biometric authentication server 10, the application server 20, the application server 21, the registration client terminal 30, and the authentication client terminal 40 in the present embodiment. As shown in the figure, these components can include a CPU 800, a primary storage device 801, a secondary storage device 802, an input device 803, an output device 804, and a communication device 805.

  For example, the biometric information authentication function 100, the external ID-internal ID conversion function 101, the internal ID issue function 102, the user registration / deletion function 201 of the application server 20, and the user verification / identification request of the biometric authentication server 10 The function 202, the user authorization function 203, the application server function 204, and the application client function 403 of the authentication client terminal 40 read the data in the secondary storage device 802 into the primary storage device 801 and calculate it by the CPU 800. Realized by processing.

  The data 110 for the application server 20, the data 120 for the application server 21, and the user information 205 of the application server 20 in the biometric authentication server 10 are realized by storing them in the secondary storage device 802.

  The biometric information acquisition function 301, the user information acquisition function 302, and the biometric information acquisition function 401 and the external ID input function 402 of the authentication client terminal 40 of the registration client terminal 30 are realized by the input device 803. The registration result display function 303 of the registration client terminal 30 is realized by the output device 804.

  FIG. 2 is a diagram illustrating an example of the biometric information 111 for registration in FIG.

  The biometric information for registration 111 includes the internal ID issued by the internal ID issuing function 102 and the biometric information for registration registered in S113 of FIG.

  FIG. 3 is a diagram illustrating an example of the authentication history 112 in FIG.

  The authentication history 112 includes an external ID, an authentication type, an authentication result, and a date and time.

  FIG. 4 is a diagram illustrating an example of the key 113 in FIG.

  The key 113 includes a normal operation key 1131, an update time key 1132 used for updating the internal ID and key shown in FIG. 12, a backup key 1133 used for registration biometric information backup shown in FIG. It is comprised including.

  FIG. 5 is a diagram showing an example of the user information 205 in FIG.

  The user information 205 stores user personal information. For example, name and address are stored. In addition, the external ID is stored corresponding to the personal information.

  FIG. 6 is an example of a biometric information backup storage 70 for registration that stores a backup of biometric information 111 for registration in the biometric authentication server 10. The biometric information backup storage 70 for registration stores a biometric information backup for registration independently for each application (data for application server 20 710, data for application server 21) 720.

  FIG. 7 is a diagram illustrating an example of the biometric information backup 711 for registration.

  The biometric information backup for registration 711 stores a pair of backup internal ID and biometric information for registration.

  If the biometric information for registration 111 is broken for some reason, it is difficult for the biometric authentication server 10 to provide a biometric authentication service. Therefore, a backup of the biometric information 111 for registration can be created in advance in the biometric information backup storage 70 for registration, and the biometric information 111 for registration can be restored from the backup storage 70 as necessary. : The ability to continue operation without bringing down the entire system can be kept high.

  8, 9, and 11 will be described. The following steps are performed in relation to the application use of the application server 20 via the user authentication client terminal 40.

  (1) User information and biometric information for registration are registered by the process of FIG.

  (2) The user is authenticated using the biometric information by the process of FIG. 9, and if the authentication is successful and permitted, the user is permitted to use the application.

  (3) User information and biometric information for registration are deleted by the process of FIG.

  Hereinafter, each processing will be described.

  FIG. 8 is a sequence for registering user information and biometric information for registration in the application server 20 and the biometric authentication server 10, respectively. This sequence is performed independently for each application server. That is, FIG. 8 shows an example in which user information for the application server 20 and biometric information for registration are registered. By performing the same sequence as in FIG. Biometric information for registration can be registered.

  The processing procedure will be described below.

  As a premise for starting this sequence, it is assumed that the normal operation key 1131 is stored.

  The user information acquisition function 302 acquires user information from the user by using a touch panel, a keyboard, a card and a card reader (S100). Here, the user information is a member number, name, or address shown in the user information 205. The registration client terminal 30 transmits a user information registration request including the user information acquired in S100 to the application server 20, and the application server 20 receives the request (S101). The user registration / deletion function 201 stores the received user information in the membership number, name, and address items of the user information 205 (S102), and notifies the registration client terminal 30 of the completion of registration (S103).

  The biometric information acquisition function 301 acquires biometric information for user registration (S104), and the registration client terminal 30 transmits a biometric information registration request including the acquired biometric information for registration to the user registration / deletion function 201 ( S105).

  The user registration / deletion function 201 transmits an external ID issue request to the biometric authentication server 10, and the biometric authentication server 10 receives the request (S106).

  The internal ID issuing function 102 refers to the internal ID list issued so far in the biometric information 111 for registration in FIG. 2 so that the same internal ID is not issued twice, and the user information 2 is generated based on a random number to prevent the application server from guessing the correspondence between the user information and the internal ID from the registration order when the registration of biometric information for registration (the process of FIG. 8) is repeated, and the registration of FIG. A line is added to the biometric information 111 and stored in the internal ID column. (S107).

  The external ID-internal ID conversion function 101 converts the generated internal ID into an external ID using the normal operation key 1131 (S108).

  The biometric authentication server 10 returns an external ID to the application server 20 (S109).

  The user registration / deletion function 201 stores the received external ID in the external ID column corresponding to the user information stored in S102 of the user information 205 (S110).

  The user registration / deletion function 201 transmits a biometric information registration request including the external ID and the biometric information for registration received in S105 to the biometric authentication server 10, and the biometric authentication server 10 receives the request (S111).

  The external ID-internal ID conversion function 101 converts the received biometric information for registration into an internal ID using the received external ID and normal operation key 1131 (S112).

The biometric authentication server 10 registers the received biometric information for registration in the biometric information field for registration corresponding to the converted internal ID of the biometric information for registration 111 (S113).
The user registration / deletion function 201 is notified that registration has been completed (S114).

  The user registration / deletion function 201 notifies the registration client terminal 30 of the registration completion of registration biometric information with an external ID attached thereto, and the registration client terminal 30 receives the registration ID, and the registration result display function 303 outputs the result. Is displayed to the user (S115). Note that the external ID notified to the user in this step is used in S202 of FIG.

  As another embodiment in FIG. 8, when user information registration corresponding to S102 has already been completed, S100 to S103 may be skipped, and the process may be started from S104.

  FIG. 9 is a sequence in which the user receives biometric authentication using the authentication client terminal 40 and uses the application of the application server 20. In this sequence, the user inputs the external ID and the biometric information to the authentication client terminal 40, the input information is sent to the biometric authentication server 10, and the biometric authentication server 10 holds the received verification biometric information and itself. By performing one-to-one verification with one biometric information for registration corresponding to the external ID, verification of the user is performed.

  Hereinafter, the processing procedure shown in FIG. 9 will be described.

  The authentication client terminal 40 requests the application server 20 to use the application (S200).

  The application server 20 requests the authentication client terminal 40 for an external ID and verification biometric information necessary for user verification (S201).

The authentication client terminal 40 acquires an external ID from the user by an external ID input function 402 (for example, realized by a touch panel, a keyboard, or a card and a card reader).
The biometric information acquisition function 401 acquires biometric information for verification from the user, transmits it to the application server 20, and the application server 20 receives it (S202).

  The user verification / identification request function 202 transmits the received external ID and verification biometric information to the biometric authentication server 10 as a user verification request, and the biometric authentication server 10 receives this (S203).

  The external ID-internal ID conversion function 101 converts the received external ID into an internal ID using the normal operation key 1131 (S204). If there is no internal ID corresponding to the received external ID at this time, an error is notified to the application server.

  The biometric information matching function 100 acquires biometric information for registration corresponding to the converted internal ID from the biometric information for registration 111, and performs one-to-one matching with the biometric information for verification received from the user verification / identification request function 202. Then, it is determined whether the biometric information for registration and the biometric information for verification belong to the same person (S205).

  The biometric authentication server 10 stores the external ID received in S203 and the determination result in S205 in the authentication history 112 of FIG.

  The authentication history 112 stores an external ID, verification as an authentication type, determination result (success or failure) as an authentication result, and authentication date and time (S206).

  The biometric authentication server 10 responds the verification result (success or failure) to the user verification / identification request function 202 (S207).

  When the verification result is successful, the user authorization function 203 determines whether to authorize the application provision based on a predetermined authorization determination criterion (S208). If the verification result is unsuccessful, the determination is performed. Without notifying the authentication client terminal 40 of the verification failure, the processing in FIG. 9 is terminated.

  If the authorization determination result in S208 is authorization, the application server function 204 provides the application to the application client function 403 via the network 60 (S209), and the application client function 403 receives the provision (S210). . When the result of the authorization determination in S208 is negative, the application server 20 notifies the authentication client terminal 40 of the authorization determination result and ends the process of FIG.

  FIG. 11 is a sequence for deleting the user information and biometric information for registration registered in the process of FIG. 8, and the user authentication history recorded in S206 of FIG. 9 and S306 of FIG. This is performed at the timing when the user finishes using the application server 20.

  The user registration / deletion function 201 transmits a biometric information for user registration including an external ID and a request to delete the authentication history to the biometric authentication server 10, and the biometric authentication server 10 receives the request (S400).

  The external ID-internal ID conversion function 101 converts the external ID into the internal ID using the normal operation key 1131 (S401).

  The biometric authentication server 10 deletes one line corresponding to the internal ID converted in S401 in the biometric information 111 for registration (S402), deletes a line corresponding to the external ID received in S400 of the authentication history 112 (S403), It responds to the user registration / deletion function 201 that it has been deleted (S404).

  The user registration / deletion function 201 deletes user information to be deleted from the user information 205 (S405).

  FIG. 12 is a sequence for updating the normal operation key 1131.

  Hereinafter, the processing procedure shown in FIG. 12 will be described.

  The biometric authentication server 10 copies the normal operation key 1131 (old key) to the update time key 1132 and overwrites the newly generated key for update as the normal operation key 1131 (new key). (S501).

  The biometric authentication server 10 reads all internal IDs in the biometric information 111 for registration in FIG. 2 (S502), and the external ID-internal ID conversion function 101 uses the update key 1132 (old key) to obtain the internal ID. The external ID is converted into an external ID (S503), the external ID-internal ID conversion function 101 uses the normal operation key 1131 (new key) to convert the external ID into the internal ID (S504), and the biometric authentication server 10 is for registration. The internal ID of the biological information 111 is updated (S505).

  The biometric authentication server 10 discards the old key by deleting the update key 1132 (S506).

  Through the above-described processing of FIG. 12, the normal operation key 1131 is updated, and at the same time, the internal ID of the biometric information for registration 111 is updated.

  The external ID-internal ID conversion function 101 uses a normal operation key 1131. By strictly managing the normal operation key 1131 using a hardware cryptographic module or the like, a third party can acquire an external ID-internal ID. The conversion function 101 is prevented from being realized, and the internal ID and external ID information are prevented from being associated with each other. If the normal operation key 1131 and the biometric information for registration 111 are transferred to a third party, there is a risk that the external ID may be associated with the biometric information via the internal ID.

  The internal ID in the normal operation key 1131 and the biometric information for registration 111 can be updated even if the normal operation key 1131 or the biometric information for registration 111 is passed to a third party by the processing of FIG. , It is possible to continue to prevent the internal ID and the external ID information from being associated with each other.

  The processing in FIG. 12 can be performed by the biometric authentication server 10 alone, and there is an advantage that the processing in the application server 20, the registration client terminal 30, and the authentication client terminal 40 is not necessary, and the operational load is small. .

  FIG. 13 is a sequence in which a backup 711 of the biometric information 111 for registration of the biometric authentication server 10 is generated and stored in the biometric information backup storage 70 for registration.

  Hereinafter, the processing procedure shown in FIG. 13 will be described.

  The biometric authentication server 10 generates a new backup key used by the external ID-internal ID conversion function 101 and stores it in the backup key 1133 (S600).

  The biometric authentication server 10 acquires all internal IDs for the application server 20 from the biometric information 111 for registration (S601), and the external ID-internal ID conversion function 101 uses the normal operation key 1131 to change the internal ID to the external ID. The external ID / internal ID conversion function 101 converts the external ID into a backup internal ID for the registration biometric information backup storage 70 using the backup key 1133 (S603).

  The biometric authentication server 10 transmits all the paired information between the converted backup internal ID and the biometric information for registration as backup data to the biometric information backup storage 70 for registration, and the biometric information backup storage 70 for registration receives this. (S604) The received backup data is stored in the biometric information backup for registration 711 (S605), and the completion of the backup is notified to the biometric authentication server 10 (S606).

  The registration biometric information backup 711 is created by replacing the internal ID of the biometric information for registration 111 with the backup internal ID by the processing of FIG.

  By such processing, the biometric information backup for registration 711 stores the backup internal ID and the biometric information for registration. The correspondence relationship between the external ID and the internal ID and the correspondence relationship between the external ID and the backup internal ID are obtained when the external ID-internal ID conversion function 101 of the biometric authentication server 10 uses the normal operation key 1131 and the backup key 1133. Can only know. Therefore, unless the third party obtains the normal operation key 1131 and the backup key 1133, it is difficult for the third party to associate the internal ID with the backup internal ID.

  Therefore, even if the registration biometric information backup 711 is leaked, the information on the association between the internal ID and the biometric information in the registration biometric information 111 that is the backup source is not leaked, and the biometric authentication server 10 does not leak the registration biometric information. The operation can be continued using the information 111, and the availability can be kept high.

  Furthermore, when the biometric information backup for registration 711 is leaked, the backup key 1133 is updated and the backup is regenerated, thereby associating the backup internal ID of the leaked biometric information backup for registration 711 with the biometric information. This information can be effectively invalidated.

  Even if a third party obtains biometric information backup 711 for registration (a pair of backup internal ID and biometric information) and authentication history 112 (a pair of external ID and authentication history), the backup key 1133 is not obtained. As long as it is difficult to know the correspondence between biometric information and authentication history. Since it is difficult for a third party to associate the biometric information with the authentication history, the privacy infringement risk of the user can be avoided. Even if the biometric information backup 711 for registration leaks to a third party, the third party cannot follow the association based on the authentication history to estimate who the biometric information belongs to. The threat of attacks on the biometric authentication system or other biometric authentication systems using information can be reduced.

  Furthermore, even if a third party obtains biometric information backup 711 for registration (a pair of backup internal ID and biometric information) and user information 205 (a pair of external ID and user information), the third party is backed up. Unless the key 1133 is obtained, it is difficult to know the correspondence between the biometric information and the user information. Since it is difficult for a third party to associate biometric information with user information, the privacy infringement risk of the user can be reduced.

  Even if the biometric information backup for registration 711 is leaked to a third party, it is difficult for the third party to know who the biometric information belongs to. Therefore, the main body using the leaked biometric information. The threat of attacks on the authentication system or other biometric authentication systems can be reduced.

  Example 1 is an example of an authentication system in which a user inputs an external ID and verification biometric information, and collates with a biometric information for registration corresponding to a user's internal ID registered in advance. Easy to manage. The first embodiment is higher than the second embodiment in order to perform so-called 1: 1 collation, which compares the biometric information for verification with specific biometric information for registration corresponding to the user's internal ID, as compared to the second embodiment. Collation can be performed with high accuracy, higher authentication accuracy can be realized, and the processing time can be shortened because only one calculation of the collation processing is required.

  Hereinafter, embodiments of the present invention will be described in detail.

  1, the biometric information collation function 100 has a 1-to-N collation function that collates all biometric information for registration stored in the biometric information for registration 111 with one given biometric information for identification. The biometric information for identification is biometric information input every time the user uses the authentication function, and is biometric information acquired by the biometric information acquisition function 401 and transmitted to the biometric authentication server 10 (for details, see S302 in FIG. 10). , Described later in S303). The external ID-internal ID conversion function 101 is a function for converting from an external ID to an internal ID and from an internal ID to an external ID. In the second embodiment, conversion from an internal ID to an external ID is performed.

  Other functions in FIG. 1 are the same as those in the first embodiment. Further, since the verification method of FIG. 9 of the first embodiment corresponds to the identification method of FIG. 10 in the second embodiment, FIGS. 2 to 8 and FIGS. 11 to 14 are the same as the first embodiment.

  Hereinafter, the process of FIG. 10 will be described.

  FIG. 10 is a sequence in which the user receives biometric authentication using the authentication client terminal 40 and uses the application of the application server 20. In this sequence, the user inputs the biometric information to the authentication client terminal 40, and the input biometric information is sent to the biometric authentication server 10. The biometric authentication server 10 receives the received biometric information for identification and all of the biometric information it holds. Identification is performed by performing one-to-N comparison with biometric information for registration.

  Hereinafter, the processing procedure shown in FIG. 10 will be described.

  The authentication client terminal 40 requests the application server 20 to use the application (S300).

  The application server 20 requests biometric information for identification necessary for user identification from the authentication client terminal 40 (S301).

  The authentication client terminal 40 acquires the biometric information for identification from the user by the biometric information acquisition function 401, transmits it to the application server 20, and the application server 20 receives it (S302).

  The user verification / identification request function 202 transmits the received identification biometric information to the biometric authentication server 10 as a user identification request, and the biometric authentication server 10 receives this (S303).

  The biometric information matching function 100 performs one-to-N matching between the received identification biometric information and all biometric information registered in the registration biometric information 111, and corresponds to the biometric information of the same person as the received identification biometric information. The internal ID to be acquired is acquired (S304). If there is no biometric information of the same person, the process proceeds to S306 as identification failure.

  The external ID-internal ID conversion function 101 converts the acquired internal ID into an external ID using the normal operation key 1131 (S305).

  The biometric authentication server 10 stores the external ID converted in S305 in the authentication history 112 as an identification result.

  When the internal ID is acquired in S304, the authentication history 112 stores the external ID converted in S305, the authentication type, the success and the external ID in the authentication result, and the authentication date and time. In the authentication history 112, the external ID is blank, the authentication type is identified, the authentication result fails, and the authentication date and time is stored (S306).

  The biometric authentication server 10 responds the identification result (success and external ID or failure) to the user verification / identification request function 202 (S307).

  When the identification result is successful, the user authorization function 203 determines whether to authorize application provision based on a predetermined authorization determination criterion (S308). If the identification result is unsuccessful, the determination is performed. Without notifying the authentication client terminal 40 of the identification failure, the processing of FIG.

  If the result of the authorization determination in S308 is authorization, the application server function 204 provides the application to the application client function 403 via the network 60 (S309), and the application client function 403 receives the provision (S310). .

  If the authorization determination result in S308 is negative, the application server 20 notifies the authentication client terminal 40 of the authorization determination result and ends the processing in FIG.

  There is another application method of the processing of FIG. In advance, users who are not authorized to use the application server are registered in the biometric information 111 for registration. In S300 to S307 in FIG. 10, processing similar to the above is performed.

  The user authorization function 203 determines application authorization when the identification result is unsuccessful (if it does not fall under the application server use unapproved user list) (S308), and the application server function 204 sends the application to the application client function 403. Provided (S309), and the application client function 403 receives the provision (S310).

  In S308, when the user authorization function 203 obtains success and an external ID as the identification result, the user authorization function 203 determines that the application is not authorized (in the case of corresponding to the application server utilization unauthorized user list) (S308), and the application server 20 Notifies the authentication client terminal 40 of the authorization determination result, and ends the processing of FIG.

  The second embodiment is an embodiment of an authentication system in which a user inputs biometric information for identification and performs user identification from biometric information for registration in which the biometric information is registered in advance, and can be managed strictly and easily.

  Compared to the first embodiment, the second embodiment does not require the user to input an external ID, and the user convenience is higher than the first embodiment.

  In the first embodiment and the second embodiment, the authentication history 112 stores an external ID and authentication history pair for the application server 20, but stores an internal ID and authentication history pair for the application server 20. You can also. In this case, in the process of FIG. 9, the internal ID is stored instead of the external ID in S206. In the process of FIG. 11, the line corresponding to the internal ID is deleted in S403. In the process of FIG. ID is stored.

  This embodiment is effective when importance is attached to the threat of insider fraud in the biometric authentication server. Even if the insider of the biometric authentication server refers to the authentication history 112 with the insider authority and obtains the user information 205 by another means, the authentication history cannot be associated with the user information, and the user's privacy Can be avoided.

DESCRIPTION OF SYMBOLS 10 Biometric authentication server 20 Application server 21 Application server 30 Client terminal for registration 40 Client terminal for authentication 50 Network 60 Network 70 Biometric information backup storage for registration

Claims (8)

In a biometric authentication system that authenticates users using biometric information,
A client terminal, an application server, and a biometric authentication server;
The client terminal is
Comprising biometric information acquisition means for acquiring biometric information of the user,
The application server is
Means for requesting the biometric server to authenticate the user;
Means for acquiring an external ID of the user authenticated by the biometric authentication server;
Means for obtaining user information corresponding to the external ID;
Means for providing an application based on the user information;
The biometric authentication server is
Conversion means for associating the internal ID managed in the biometric authentication device with the external ID managed in the application server using a stored key;
Tamper-resistant storage means for storing the key;
A biometric authentication system comprising: means for collating the biometric information registered in advance with the biometric information acquired by the client terminal, authenticating the user, and responding to the authentication result. The biometric authentication system according to claim 1,
The client terminal is
Means for acquiring the user's external ID in addition to the biometric information acquired by the client terminal;
The biometric authentication server is
Means for acquiring the biometric information acquired by the client terminal and the external ID, and converting the external ID into the internal ID using the key;
Means for acquiring the pre-registered biometric information corresponding to the internal ID managed in the biometric information database for registration,
The responding unit collates the pre-registered biometric information corresponding to the internal ID acquired by the biometric information acquiring unit with the biometric information acquired by the client terminal, and the result of the verification The biometric authentication system characterized by transmitting. The biometric authentication system according to claim 2,
The biometric authentication server is
A biometric authentication system comprising means for notifying the application server of an error when the conversion from the external ID to the internal ID fails. The biometric authentication system according to claim 1,
The biometric authentication server is
Means for acquiring biometric information acquired by the client terminal;
The biometric information acquired by the client terminal is identified using a plurality of the preregistered biometric information managed in the biometric information database for registration, and if the identification is successful, the corresponding preregistered biometric information is registered. Means for obtaining the biometric information and obtaining the internal ID corresponding to the obtained biometric information;
Means for converting the internal ID into the external ID using the key,
The biometric authentication system characterized in that the responding unit responds with success and an external ID when the identification is successful and responds with failure when the identification is unsuccessful. The biometric authentication system according to any one of claims 1 to 4,
Have multiple application servers,
A biometric authentication system, wherein at least one of the keys is different from another application server. The biometric authentication system according to any one of claims 1 to 5,
The key and the internal ID include a biometric information backup storage for registration that includes means for storing different backup keys and backup internal IDs, respectively.
The biometric authentication server is
Means for generating a backup key different from the key;
Means for converting the internal ID into the external ID using the key;
Means for converting the external ID into the backup internal ID using the backup key;
Means for transmitting a pair of the biometric information registered in advance and the backup internal ID to the biometric information backup storage for registration. The biometric authentication system according to any one of claims 1 to 6,
The biometric authentication server is
Means for generating a new key different from the key;
Means for converting the acquired internal ID into the external ID with the key;
Means for converting the external ID into a new internal ID with the new key;
Means for updating the internal ID to the new internal ID converted by the new key. The biometric authentication system according to claim 7,
The biometric authentication server is
After updating the internal ID to the new internal ID,
A biometric authentication system comprising means for discarding the key.

Images