JP2013080401A - Authentication method, authentication device, and program which can be executed by computer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform authentication with high level security by a simple method.SOLUTION: An authentication method which is to be executed by an authentication device, includes: an imaging step in which an imaging unit takes an image of a subject; a face detection step in which a face detection unit detects a face of a person from the image taken by the imaging step; an authorization step in which an authentication unit authorizes an authentication information input unit to input user's authentication information when a face of the person is detected by the face detection step; an input step in which the authentication information input unit inputs the user's authentication information according to a user operation when it is authorized by the authorization step; and an authentication step in which the authentication unit authenticates the user authentication information input by the input step.

Description

  The present invention relates to an authentication method, an authentication device, and a computer-executable program.

  Conventionally, a security system using a camera is known. As an example, as an authentication system using a camera, a user's face image pattern with access rights is registered in advance, the user's face image is input from the camera at the time of access, and matching with the registered image pattern is performed. There is something to judge whether.

  However, such an authentication system has a high security level, but it takes time and effort to register a face image pattern in advance, and pattern matching with the registered image is required, which complicates the authentication process and increases the amount of calculation. There is a problem that increases.

  There is also known a system in which when a PC (personal computer) is stolen, a face photograph is taken at the time of system boot by the built-in camera of the PC, and the photographed face photograph is automatically transmitted to a server.

  However, when the camera is closed with a hand when taking a face picture or when a PC is used in a dark place, the face picture may not be taken well and may not actually function.

JP 2004-265231 A

http://www.phoenix.com/pages/phoenix-failsafe-privacy-policy website

  The present invention has been made in view of the above, and an object of the present invention is to provide an authentication device, an authentication method, and a computer-executable program capable of performing authentication at a high security level with a simple method. To do.

  In order to solve the above-described problems and achieve the object, the present invention is an authentication method executed by an authentication apparatus, in which an imaging unit captures an image of a subject, and a face detection unit includes the imaging step. A face detection step of detecting a person's face from the image captured in step, and when the person's face is detected in the face detection step, the authentication unit permits the authentication information input unit to input user authentication information. An authorization process, an input process in which the authentication information input unit inputs user authentication information in response to a user operation when the authorization process permits the user, and the authentication unit receives the user input in the input process. And an authentication step for authenticating the authentication information.

  According to a preferred aspect of the present invention, it is desirable that the authentication information is a password, a user ID, or biometric information.

  According to a preferred aspect of the present invention, in the authentication step, it is desirable that the authentication unit distinguishes and stores in the storage unit face images of a person who has succeeded in the authentication and a person who has failed the authentication.

  According to a preferred aspect of the present invention, in the authentication step, the authentication information is authenticated when a face of a person is detected in the face detection step after the authentication information is input in the input step. desirable.

  Further, according to a preferred aspect of the present invention, in the authentication step, when a face of a person is continuously detected in the face detection step while the authentication information is input in the input step, the authentication step It is desirable to authenticate information.

  According to a preferred aspect of the present invention, the authentication device is mounted on a computer system, and it is desirable that the OS is activated when the authentication information is authenticated in the authentication step.

  In order to solve the above-described problems and achieve the object, the present invention provides an imaging unit that images a subject, a face detection unit that detects a human face from an image captured by the imaging unit, and a user operation An authentication information input unit that inputs user authentication information according to the authentication information, and an authentication unit that authenticates the user authentication information input by the authentication information input unit. When the user's face is detected, the authentication information input unit permits the input of user authentication information, and after the permission, the authentication information input from the authentication information input unit is authenticated.

  In order to solve the above-described problems and achieve the object, the present invention is a computer program installed in an authentication device, wherein an imaging unit captures an image of a subject, and a face detection unit A face detection step of detecting a person's face from the image captured in the imaging step; and when a person's face is detected in the face detection step, the authentication unit inputs user authentication information by the authentication information input unit. A permission process to permit, an input process in which an authentication information input unit inputs user authentication information in response to a user operation when permitted in the permission process, and a user in which the authentication unit is input in the input process And an authentication step of authenticating the authentication information.

  According to the present invention, authentication at a high security level can be performed by a simple method.

FIG. 1 is a conceptual diagram of an authentication apparatus according to the present embodiment. FIG. 2 is a flowchart showing an outline of an authentication procedure of the authentication apparatus of FIG. FIG. 3 is a schematic external view of a notebook PC to which the authentication apparatus according to the present embodiment is applied. FIG. 4 is a diagram illustrating a schematic hardware configuration example of the notebook PC of FIG. 3. FIG. 5 is a flowchart for explaining the outline of the authentication operation of the notebook PC of FIG. FIG. 6 is a diagram illustrating a display example of a screen at the time of authentication. FIG. 7 is a diagram illustrating an example of the timing of the authentication operation. FIG. 8 is a diagram illustrating an example of the timing of the authentication operation according to the first modification. FIG. 9 is a diagram illustrating an example of the timing of the authentication operation according to the second modification.

  Hereinafter, an authentication method, an authentication apparatus, and a computer-executable program according to the present invention will be described in detail with reference to the drawings. Although the components of the present invention are generally illustrated in the drawings herein, it can be readily understood that they may be arranged and designed in a wide variety of configurations with various configurations. Accordingly, the following more detailed description of the apparatus, system and method embodiments of the present invention is not intended to limit the scope of the invention as set forth in the claims, but merely as an example of selected embodiments of the invention. It is intended merely to illustrate selected embodiments of apparatus, systems and methods consistent with the present invention as set forth in the claims herein. Those skilled in the art will appreciate that the present invention may be implemented without one or more of the specific details or with other methods, components, and materials. Note that the present invention is not limited to the embodiments. In addition, constituent elements in the following embodiments include those that can be easily assumed by those skilled in the art or that are substantially the same.

(Embodiment)
FIG. 1 is a conceptual diagram of an authentication apparatus according to the present embodiment. FIG. 2 is a flowchart showing an outline of an authentication procedure of the authentication apparatus of FIG. The authentication device can be configured by a hardware or software module, or a combination thereof.

  The authentication device 1 can be mounted on a device requiring authentication such as a notebook PC, a desktop PC, a PDA, a mobile phone, an ATM, and a security door. As illustrated in FIG. 1, the authentication device 1 includes an imaging unit 2, a face detection unit 3, an authentication information input unit 4, an authentication unit 5, and a storage unit 6.

  The imaging unit 2 outputs an image obtained by imaging the subject to the face detection unit 3. The imaging unit 3 can be composed of, for example, a CCD camera or a CMOS camera.

  The face detection unit 3 detects a face from the image captured by the imaging unit 2 and outputs the detected face image to the authentication unit 5. The face detection unit 3 determines whether or not there is a portion corresponding to a human face in the image with a simple algorithm.

  The authentication information input unit 4, when permitted by the authentication unit 5, inputs user authentication information and outputs it to the authentication unit 5 in response to a user operation. Here, the authentication information is, for example, a password, ID, biometric information (fingerprint, voiceprint, vein, palm, retina, iris, etc.), USB token, or a combination thereof. The authentication information input unit 4 can be configured with a keyboard, a biometric information sensor, a USB memory, and the like.

  The authentication unit 5 permits the input of user authentication information from the authentication information input unit 4 when a face is detected by the face detection unit 3. The authentication unit 5 authenticates the user and permits the use of the target device 7 when the user authentication information from the authentication information input unit 4 matches the previously registered authentication information. In addition, when the authentication is successful, the authentication unit 5 stores the face image detected as a person who has succeeded in the authentication in the storage unit 6. Here, the target device 7 is, for example, a notebook PC, a desktop PC, a PDA, a mobile phone, an ATM, a security door, or the like.

  Further, when the user authentication information from the authentication information input unit 4 does not match the pre-registered authentication information, the authentication unit 5 prohibits the use of the target device 7 and is detected as a person who has failed in the authentication. The face image is stored in the storage unit 6.

  The storage unit 6 is a non-volatile memory, and stores a face image of a person who has succeeded in authentication and a face image of a user who has failed in authentication in a distinguishable manner.

  With reference to FIG. 2, the outline of the authentication procedure of the authentication apparatus 1 will be described. In FIG. 2, the imaging unit 1 starts imaging a subject, and outputs the captured image to the face detection unit 3 (step S1). The face detection unit 3 performs face detection processing on the image input from the imaging unit 1 and outputs a face image to the authentication unit 5 when a face is detected (“Yes” in step S2).

  When the face is detected by the face detection unit 3 (“Yes” in step S2), the authentication unit 5 permits the input of user authentication information from the authentication information input unit 4 (step S3). As a result, the user can input the authentication information from the authentication information input unit 4. When the input of the user authentication information is permitted, the authentication information input unit 4 inputs the user authentication information in response to the user operation, and outputs the input user authentication information to the authentication unit 5 (step S4). .

  The authentication unit 5 determines whether or not the user authentication information input from the authentication information input unit 4 matches the authentication information registered in advance (step S5). If the user authentication information input from the authentication information input unit 4 matches the authentication information registered in advance (“Yes” in Step S5), the authentication unit 5 permits the use of the target device 7 (Step S5). S6). And the authentication part 5 records a face image in the memory | storage part 6 as a person who succeeded in authentication (step S7).

  On the other hand, if the authentication information of the user input from the authentication information input unit 4 does not match the authentication information registered in advance (“No” in step S5), the authentication unit 5 permits the use of the target device 7. First, the face image is stored in the storage unit 6 as a person who has failed authentication (step S8).

  According to the above configuration, the imaging unit 2 images the subject, the face detection unit 3 detects the human face from the captured image, and after the human face is detected, the authentication unit 5 detects the authentication information input unit 4. The authentication information input unit 4 inputs the user authentication information in response to a user operation, and the authentication unit 5 authenticates the input user authentication information. Therefore, it is possible to perform authentication with a high security level by a simple method by adding face detection as an auxiliary. In other words, a person who tries to gain unauthorized access hesitates to access when he / she finds himself / herself photographed by the camera, so that the security level can be improved.

  Further, since the authentication information is a password, a user ID, or biometric information, it is possible to perform authentication using information conventionally used for authentication.

  In addition, since the face images of the person who succeeded in authentication and the person who failed in authentication are recorded separately in the recording unit 6, it is possible to analyze the person who has illegally accessed afterwards. In other words, the face image of a person who has been illegally accessed and failed to authenticate is stored, so that the person can be analyzed, and even if the password is successfully stolen, the face image is recorded. Therefore, it becomes possible to analyze the person.

  The authentication unit 5 permits the authentication information input unit 4 to input the user authentication information after the person's face is detected. However, after the user authentication information is input, the authentication unit 5 Detection may be a condition for authentication. Further, the authentication condition may be that the user continuously detects a face while inputting authentication information at the authentication information input unit 4.

(Example)
FIG. 3 is a schematic external view of a notebook PC to which the authentication apparatus according to the present embodiment is applied. As shown in the figure, the notebook PC 10 includes a main body side casing 11 and a display side casing 12 which are both substantially rectangular parallelepipeds. The main body side housing 11 includes an HID (Human Interface Device) having a keyboard 21, a touch pad (pointing device) 22, and the like. The display-side casing 12 includes an LCD (liquid crystal display) 23 and a camera unit 61 that is disposed on the display surface side of the LCD 23 at a substantially upper center thereof and can image a front subject.

  Further, the main body side casing 11 and the display side casing 12 are connected to each other by a pair of left and right connecting portions (hinge portions) 13a and 13b at the respective end portions, and the connecting portions 13a and 13b are connected to these casings. Is supported to be openable and closable.

  FIG. 4 is a diagram showing a schematic hardware configuration example of the notebook PC 10 of FIG. As shown in the figure, the notebook PC 10 includes a CPU 31, ROM 32, memory 33, HDD (hard disk) 34, video controller 35, LCD 23, communication control unit 37, embedded controller 38, HID 39, and power supply circuit 40. The camera module 41 and the authentication device 42 are provided, and each unit is connected directly or indirectly via a bus.

  The CPU 31 controls the notebook PC 10 as a whole by the OS 34a stored in the HDD 34 connected via the bus, and controls functions based on various programs stored in the HDD 34. The ROM 32 stores a BIOS (Basic Input / Output System: basic input / output system) 32a, data, and the like.

  The memory 33 is composed of a cache memory and a RAM, and is a writable memory used as a work area for writing processing data of the execution program as a read area for the execution program of the CPU 31.

  The HDD 34 includes, for example, an OS such as Windows (registered trademark) for controlling the notebook PC 10 as a whole, various drivers 34b for hardware operation of peripheral devices, and an application 34c directed to a specific task. It has a function to memorize.

  The video controller 35 converts display information into a video signal under the control of the CPU 31, and outputs the converted video signal to the LCD 23 for display. The LCD 23 has a function of displaying various information according to the control of the CPU 31. In addition, a display is not restricted to this, You may decide to use other displays, such as an organic EL display and CRT. The communication control unit 37 is a unit for performing communication via a network.

  The embedded controller 38 includes an MPU, a memory, a ROM storing a program, an A / D converter, a D / A converter, and the like. The embedded controller 38 is connected to the HID 39 and the power supply circuit 40, and controls the operation of the HID 39 and the power supply circuit 40. The embedded controller 38 controls power supply to each device by the power supply circuit 40 and performs power supply control according to the system state (ACPI state).

  The HID 39 is a user interface device for performing user input. The keyboard 21 includes various keys for inputting characters, commands, etc., a touch for moving the cursor on the screen, and selecting various menus. A pad 22, a mouse, a touch panel, a microphone for inputting voice, and the like.

  The power supply circuit 40 includes an AC adapter, an intelligent battery, a charger for charging the intelligent battery, a DC / DC converter, and the like.

  The camera module 41 includes a camera unit 61 and a camera processing unit 64. The camera unit 61 includes a lens 62 and an imaging unit (camera) 63. The lens 62 images subject light. The imaging unit 63 includes an imaging element such as a CCD (Charge Coupled Device) or CMOS (Complementary Metal-Oxide Semiconductor), an RGB color filter, and the like, and converts subject light captured by the lens 62 into an electrical signal. The image signal is output to the camera processing unit 64 as R, G, B image signals.

  The camera processing unit 64 includes an A / D converter, an image processing LSI, a memory, and the like, performs drive timing of the image sensor, exposure control, and the like, and performs various processing on RGB image signals obtained by the image capturing unit 63. Signal processing is performed, and processing for detecting a face is performed based on an image signal obtained by the imaging unit 63. When a face is detected, the detected face image is output to the authentication processing device. Here, it is to detect whether or not there is a part corresponding to a face in the image. Compared to the process of determining whether or not it matches the registered face image, a simple algorithm and high-speed detection are performed. Is possible. Since a technique for detecting a face from a captured image is well known, detailed description thereof is omitted.

  The authentication device 42 includes an authentication processing unit 51 and a storage unit 52 composed of a nonvolatile memory. The authentication device 51 employs a single sign-on (SSO) system, and stores a password, a BIOS password, and an OS password registered in advance by the user in the storage unit 52 in association with each other. The authentication processing unit 51 permits the input of the user's password from the HID 39 when the face detection unit 3 of the camera module 41 detects a face. The authentication processing unit 51 determines whether or not the password input from the HID 39 after the authorization matches the user's password stored in the storage unit 52. If they match, the authentication processing unit 51 authenticates the user and stores the storage unit 52. The BIOS password and the OS password stored in the are notified to the BIOS 32a and the OS 34a. As a result, the BIOS 32a and the OS 34a are activated. Further, the authentication processing unit 51 stores in the storage unit 52 the face image of the person who has succeeded in authentication and the face image of the person who has failed in authentication. The authentication processing unit 51 may transmit the face image of the person who has failed the authentication to the security management server connected to the network or the terminal device of the owner of the notebook PC 10 via the communication control unit 37. .

  FIG. 5 is a flowchart for explaining the outline of the authentication operation of the notebook PC 10 of FIG. FIG. 6 is a diagram illustrating a display example of a screen at the time of authentication. FIG. 7 is a diagram illustrating an example of the timing of the authentication operation.

  In FIG. 5, when the notebook PC 1 is powered on, the camera module 41 and the authentication device 42 start operating (step S11). First, the authentication processing unit 51 of the authentication device displays a message “Please bring your face close to the camera” on the screen of the LCD 23 via the CPU 31 (step S12: see FIG. 6A). Then, the camera module 41 starts imaging (step S12). Specifically, the camera unit 61 captures an image of the subject and outputs an image of the captured subject to the camera processing unit 64. The camera processing unit 64 performs face detection processing on the image input from the camera unit 61, and when a face is detected, outputs the face image to the authentication processing unit 51 of the authentication device 42 ("Yes" in step S14). "). When the camera processing unit 64 detects a face, the camera unit 63 ends the imaging (see FIG. 7). Here, in order to facilitate the detection of a face even in a dark environment, the background of the screen of the LCD 23 may be displayed in white while the face detection is being performed. Further, when a plurality of faces are detected, there is a possibility that another person may look into the password input, so that a warning display (for example, a message such as “There is a person behind”) may be displayed.

  When the camera processing unit 64 detects a face, the authentication processing unit 51 permits the password input by the HID 39 via the embedded controller 38 (step S15), and the password input to the LCD 23 via the CPU 31. A request screen is displayed (step S16: see FIG. 6B). When the user inputs a password via the HID 39 (step S17), the authentication processing unit 51 determines whether or not the input password matches the password registered in the storage unit 52 (step S18). If the input password matches the registered password (“Yes” in step S18), the authentication processing unit 51 authenticates the user and indicates on the screen of the LCD 23 that the authentication is successful via the CPU 31. Display (step S19: see FIG. 6C). Thereafter, the authentication processing unit 51 transmits the BIOS password to the BIOS 32a, and transmits the OS password to the OS 34a (step S20). Thus, after the BIOS 32a is activated, the OS 34a is activated (see FIG. 6D), and the user can use the notebook PC 10. In addition, the authentication processing unit 51 records the face image in the storage unit 52 as a person who has succeeded in authentication (step S21).

  On the other hand, if the input password does not match the registered password (“No” in step S18), the authentication processing unit 51 displays on the screen of the LCD 23 that the authentication has failed via the CPU 11. (Step S22: FIG. 6E), the face image is recorded in the storage unit 52 as a person who has failed in the authentication (Step S23). In this case, since the BIOS 32a and the OS 34a are not activated, the user cannot use the notebook PC 10.

  As described above, according to the notebook PC 10 according to the present embodiment, the camera unit 61 images a subject, the camera processing unit 64 detects a human face from the captured image, and the authentication processing unit 52 After the person's face is detected, the authentication information input unit 4 allows the input of the user's password, the HID 39 inputs the user's password according to the user operation, and the authentication processing unit 51 uses the input user's password. Since authentication is performed, it is possible to perform authentication at a high security level with a simple method by supplementing face detection.

  In the above embodiment, the authentication device 42 adopting the SOS method performs authentication. However, the present invention is not limited to this, and other methods may be used, and the BIOS or OS may be used by the user. However, the implementation example is not limited to this.

(Modification)
The authentication processing unit 51 permits the input of the user's password by the HID 39 after the person's face is detected, but further authenticates that the person's face is detected after the user's password is input. It is good also as conditions. FIG. 8 is a diagram illustrating an example of the timing of the authentication operation according to the first modification.

  In FIG. 8, when the camera processing unit 64 detects a person's face from the image captured by the camera unit 61, the authentication processing unit 52 permits the input of the user password by the HID 39. Subsequently, after the password is input from the HID 39, when the camera unit 61 captures an image and the camera processing unit 64 detects a human face, the authentication processing unit 51 authenticates the input user password. To do. Thereby, since the face is detected twice, the security can be further improved.

  Further, it may be a condition for authentication to continuously detect a face while the user inputs a password with HID39. FIG. 9 is a diagram illustrating an example of the timing of the authentication operation according to the second modification. In FIG. 9, until the password input is completed, imaging by the camera unit 61 and face detection processing by the camera processing unit 64 are performed. When the camera processing unit 64 detects a human face from the captured image, the authentication processing unit 52 allows the user to input a password. Furthermore, when the camera processing unit 64 continuously detects a human face before the password is input from the HID 39, the authentication processing unit 51 authenticates the input user password. As a result, since the face is detected while the password is being input, the security can be further improved.

  As described above, the authentication method, the authentication apparatus, and the computer-executable program according to the present invention are suitable for various apparatuses that require authentication.

DESCRIPTION OF SYMBOLS 1 Authentication apparatus 2 Image pick-up part 3 Face detection part 4 Authentication information input part 5 Authentication part 6 Memory | storage part 10 Notebook PC
DESCRIPTION OF SYMBOLS 11 Main body side housing | casing 12 Display side housing | casing 13a, b Connection part 21 Keyboard 22 Touchpad 23 LCD (liquid crystal display)
31 CPU
32 ROM
33 Memory 34 HDD (Hard Disk)
35 Video Controller 37 Communication Control Unit 38 Embedded Controller 39 HID
DESCRIPTION OF SYMBOLS 40 Power supply circuit 41 Camera module 42 Authentication apparatus 51 Authentication process part 52 Memory | storage part 61 Camera part 62 Lens 63 Imaging part 64 Camera process part

Claims (8)

An authentication method executed by an authentication device,
An imaging step in which the imaging unit images the subject;
A face detection step in which a face detection unit detects a person's face from the image captured in the imaging step;
When a face of a person is detected in the face detection step, an authentication unit permits an input of user authentication information by an authentication information input unit; and
When permitted in the permission step, the authentication information input unit inputs user authentication information in response to a user operation; and
The authentication unit authenticates the user authentication information input in the input step; and
An authentication method that includes:   The authentication method according to claim 1, wherein the authentication information is a password, a user ID, or biometric information.   3. The authentication according to claim 1, wherein in the authentication step, the authentication unit distinguishes and stores in a storage unit a face image of a person who has succeeded in the authentication and a person who has failed in the authentication. Method.   4. The authentication process according to claim 1, wherein the authentication process authenticates the authentication information when a face of a person is detected in the face detection process after the authentication information is input in the input process. 5. The authentication method as described in any one.   The authentication process is characterized in that the authentication information is authenticated when a face of a person is continuously detected in the face detection process while the authentication information is input in the input process. The authentication method according to any one of claims 1 to 3. The authentication device is mounted on a computer system,
The authentication method according to any one of claims 1 to 5, wherein an OS is activated when user authentication information is authenticated in the authentication step. An imaging unit for imaging a subject;
A face detection unit for detecting a human face from an image captured by the imaging unit;
An authentication information input unit for inputting user authentication information in response to a user operation;
An authentication unit for authenticating user authentication information input in the authentication information input unit;
With
The authentication unit permits the input of user authentication information by the authentication information input unit when a face of a person is detected by the face detection unit, and receives the authentication information input from the authentication information input unit after the permission. An authentication device that performs authentication. A computer program installed in the authentication device,
An imaging step in which the imaging unit images the subject;
A face detection step in which a face detection unit detects a person's face from the image captured in the imaging step;
When a face of a person is detected in the face detection step, an authentication unit permits an input of user authentication information by an authentication information input unit; and
When permitted in the permission step, an input step in which the authentication information input unit inputs user authentication information in response to a user operation;
The authentication unit authenticates the user authentication information input in the input step; and
A computer-executable program characterized by causing a computer to execute.

Images