JP2014026482A - Biological information registration method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve such a problem in an authentication system using biological information that a user has to visit an installation site of a registration terminal for registering the user's biological information and also a supervisor has to attend the registration.SOLUTION: In an authentication system, biological information of a user is to be registered on condition that a supervisor authenticates the user. The registration can be performed only when there is predetermined relation between authentication processing by the supervisor and registration processing of the user. For example, the same device performs authentication of the user and registration of the user. Also, the device is configured to register the biological information read from the user within a predetermined time from when the supervisor performs the authentication. Further, the device registers the biological information of the user, when the supervisor prepares biological information for normal authentication and biological information for registration of the user and then the user is authenticated with the latter biological information.

Description

  The present invention relates to a technique for performing authentication using biometric information or registering (including updating) biometric information for this authentication.

  In recent years, due to the problem of information leakage such as unauthorized access and unauthorized take-out, authentication systems using biometric information such as finger veins and fingerprints, which are more convenient than passwords and can ensure security, are becoming popular.

  Currently, in an industry that requires particularly high security, such as payment and financial fields, when the biometric information is registered, the user registers the biometric information after confirming the identity.

  On the other hand, in an office or the like, the information system management department is visited or an administrator is present to register information on the spot. However. Here, especially in offices, the bases are dispersed, so it may be difficult to visit the registration location or to be witnessed by the administrator. Also, in the case of PC login that is used instead of a password, identity verification is required compared to payment. However, it is necessary to ensure the minimum security at the time of registration, such as anyone can register.

  For example, Patent Document 1 proposes a method for physically preventing external interference during registration, preventing impersonation, and reducing personnel correspondence.

JP 2009-055934 A

  However, in Patent Document 1, there is a problem that it is necessary to prepare a special box, which takes time and cost. An object of the present invention is to provide a technique for efficiently registering biometric information while ensuring minimum security for further spread in an office or the like.

  In order to achieve the above object, in the present invention, the biometric information of the user is registered on the condition that the administrator is authenticated. At this time, if the processing for administrator authentication and user registration has a predetermined relationship, registration is performed. For example, it is assumed that the device that authenticates the user and the device that the user registers are the same. Moreover, the structure which registers the read biometric information of the user within a predetermined time from the authentication of the manager is also an aspect of the present invention. Further, the administrator prepares normal biometric information for authentication and biometric information for user registration, and registers the biometric information of the user when authentication is performed using the latter biometric information. Are also included in the present invention.

Hereinafter, details of one embodiment of the present invention will be described.
A computer system that performs authentication using biometric information,
A sensor device for acquiring biological information;
An input device including an input unit that physically inputs an identifier, and an acquisition unit that acquires biological information from the sensor device;
An acquisition unit that communicates with the input device via a network to acquire biometric information obtained by the sensor device, a group to which the Nth identifier, biometric information, and the Nth identifier belong, and an identifier that belongs to the group When the biometric information change authority, the storage unit holding the Nth identifier and the biometric information change permission information, the first identifier and the first biometric information, and the biometric information obtained by the sensor device are compared and matched, Based on the first biometric information change authority, the second biometric information change permission information of the group to which it belongs is effectively changed, and the second biometric information is changed when the biometric information change permission information of the second identifier is valid A biometric authentication system comprising: a server including a processing unit.

  Biometric information can be registered and updated with a simpler technique.

Explanatory drawing which shows the whole structure which concerns on this Embodiment Configuration diagram showing internal configuration of authentication server, PC terminal and biometric information acquisition device The figure which shows the certification information which the certification server has Diagram showing registration permission information held by authentication server Sequence diagram showing processing at the time of PC terminal authentication Sequence diagram showing processing for authentication server authentication Sequence diagram showing processing at the time of biometric information registration of the PC terminal Sequence diagram showing processing for biometric information registration of authentication server Sequence diagram showing the process of administrator authentication during biometric information registration Sequence diagram showing processing for registering biometric information of general users

  Hereinafter, with regard to an embodiment relating to the present invention, a configuration comprising an authentication server according to the present embodiment, a PC terminal connected via a network, a biometric information acquisition device connected to each PC terminal, an administrator, and a user 1 shows the internal configuration of the authentication server, the PC terminal, and the biometric information acquisition apparatus, FIG. 3 shows the biometric information for authentication possessed by the authentication server, and FIG. 3 shows the permission information for biometric information registration possessed by the authentication server. FIG. 4 shows normal biometric information authentication processing in FIGS. 5 and 6, normal biometric information registration processing in FIGS. 7 and 8, and biometric information administrator authentication processing. 9 and FIG. 10 will be described with reference to FIG.

  FIG. 1 is a diagram illustrating a configuration including an authentication server according to the present embodiment, a PC terminal connected via a network, a biometric information acquisition apparatus connected to each PC terminal, an administrator, and a user. . The authentication server 100 includes a plurality of PC terminals connected via a network, manages an administrator's or user's account and biometric information, and performs authentication and biometric information registration based on the account and biometric information from the PC terminal. Update. The PC terminal 200 is connected to the authentication server 100 via a network and is connected to the biometric information acquisition apparatus 300. The PC terminal 200 acquires biometric information from the biometric information acquisition apparatus 300 at the time of authentication or registration, and an administrator or user account. Is obtained from a keyboard input or the like and transmitted to the authentication server 100, and the authentication or registration result is received and notified.

  The biometric information acquisition device 300 is connected to the PC terminal 200 and acquires biometric information of an administrator or a user. The biological information is acquired using a camera, a sensor, or the like built in the biological information acquisition apparatus 300. The administrator A 400 uses the PC terminal 200 and the biometric information acquisition apparatus 300 and has an administrator authority for registering biometric information of each user. Similarly, a PC terminal 210 and a biological information acquisition device 310 are configured and used by a user A410. Alternatively, the PC terminal 220 and the biological information acquisition device 320 are configured and used by the user B420 and the user C421. Since an administrator and a user authenticate with biometric information using an account, a single PC terminal and biometric information acquisition apparatus may be used by a plurality of administrators and users.

  FIG. 2 is a diagram illustrating an internal configuration of the authentication server, the PC terminal, and the biometric information acquisition apparatus. The authentication server 101 transmits a command for account, biometric information, authentication, and biometric information registration to a plurality of PC terminals 201 using the client interface 102 connected to the PC terminal 201 via a network, and in response to the command. A certain authentication result or biometric information registration result is received, an account or biometric information transmitted from the PC terminal 201 is compared with an account held in the storage unit 104 and biometric information is compared, Register or update biometric information held in the storage unit 104, update and reference registration permission information for each account held in the storage unit 104, and reference or register various information in the storage unit 104 Alternatively, the control unit 103 that performs update or deletion, and the administrator or user account. A storage unit 104 that holds information such as count, biometric information, and biometric information registration permission information, and holds each processing method of the control unit 103; a power source that supplies power to the client interface 102, the control unit 103, and the storage unit 104 The unit 105 is configured.

  The PC terminal 201 uses the host interface 202 connected to the authentication server 102 via a network, the client interface 203 connected to the biometric information acquisition apparatus 301 via USB, serial, network, etc., and the authentication and biometric information registration using the client interface 302. The biometric information is acquired from the biometric information acquisition device 301, the administrator or user account and the biometric information are transmitted at the time of authentication or biometric information registration using the host interface 202, the authentication result or the biometric as a response thereto. A control unit 204 that receives an information registration result, acquires account information input by the administrator or user from the display unit 206 and the input unit 207, and a storage unit 205 that stores each processing method of the control unit 204; , Tell administrator or user to enter account A display unit 206 for displaying or displaying information input by the input unit 205, displaying an authentication or biometric information registration result, an input unit 207 for an administrator or user to input account information, and a host interface 202 And a client interface 203, a control unit 204, a storage unit 205, a display unit 206, and a power supply unit 208 that supplies power to the input unit 207. The biometric information acquisition apparatus 301 receives a biometric information acquisition command from the PC terminal 201 using the host interface 302 and the host interface 302 connected to the PC terminal via USB, serial, or network, and the acquired biometric information is stored in the PC terminal 201. The sensor unit 304 includes a control unit 303 that acquires biometric information by transmitting to the sensor, a sensor for acquiring biometric information, a camera, a fingerprint sensor, a touch sensor, and an LED for emitting light. A storage unit 305 that holds the processing method of the control unit 303, holds key information for encrypting and decrypting biometric information, the host interface unit 302, the control unit 303, and the sensor unit 304 The power supply unit 306 supplies power to the storage unit 305 and the power supply unit 306.

  FIG. 3 is a diagram illustrating information stored in the storage unit 104 of the authentication server 101 and used for authentication for each account. An account 501 that is uniquely assigned to each administrator or user and is input during authentication or biometric information registration, biometric information 502 acquired from the biometric information acquisition apparatus 301, and a user name indicating the name of the administrator or user 503, a head office 504 to which a manager or a user belongs, a department 505 to which a manager or user associated with the head office in a 1-to-N relationship, and authority 506 possessed by each manager or user. The biometric information 502 is held as binary data or text data such as image data or encrypted data. The head office 504 and the department 505 are two for the sake of example. The authority 506 assigns an administrator authority for each headquarters 504 or department 505. The software department manager has a biometric information registration permission authority for users belonging to the software department. The hardware department administrator has the biometric information registration permission of users belonging to the hardware department. The development headquarters administrator has the biometric information registration permission authority of the users who belong to the development headquarters, that is, users who belong to the software section or the hardware section. Generally, it does not have biometric information registration permission authority.

  For example, if the account 501 is 00000001 (601), the biometric information 502 is 0x11, 0x22, the user name 503 is the administrator A, the headquarters 504 is the development headquarters, the department 505 is the software department, and the authority 506 is the software department manager information. . Since the biological information has binary information, it is set to 0x11 and 0x22 in the example. That is, the account 501 has the biometric information registration permission authority of 00000001 (601), 00000011 (602), 00000013 (604), and 00000003 (606). Similarly, when the account 501 is 00000011 (602), the biometric information 502 is 0x22, 0x33, the user name 503 is the user A, the headquarter 504 is the development headquarters, the department 505 is the software department, and the authority 506 has general information. That is, it does not have biometric information registration permission authority. Similarly, when the account 501 is 00000012 (603), the biometric information 502 is 0x44, 0x55, the user name 503 is user B, the headquarter 504 is the development headquarters, the department 505 is the hardware section, and the authority 506 is general information. That is, it does not have biometric information registration permission authority.

  Similarly, when the account 501 is 00000013 (604), the biometric information 502 is 0x66, 0x77, the user name 503 is the user C, the headquarter 504 is the development headquarters, the department 505 is the software department, and the authority 506 is general information. That is, it does not have biometric information registration permission authority. Similarly, if the account 501 is 00000002 (605), the biometric information 502 is 0x88, 0x99, the user name 503 is the administrator B, the headquarters 504 is the development headquarters, the department 505 is the hardware department, and the authority 506 is the hardware department manager. Have information. That is, the account 501 has biometric information registration permission authority of 00000012 (603) and 00000002 (605). Similarly, if the account 501 is 00000003 (606), the biometric information 502 is 0xAA, 0xBB, the user name 503 is the administrator C, the headquarters 504 is the development headquarters, the department 505 is the software department, and the authority 506 is the information of the development headquarters manager. Have. That is, the account 501 has the biometric information registration permission authority of 00000001 (601), 00000011 (602), 00000012 (603), 00000013 (604), 00000002 (605), and 00000003 (606).

  FIG. 4 is a diagram showing biometric information registration permission information and registration expiration date for each account, which are held in the storage unit 104 of the authentication server 101. 3 includes an account 511 serving as a key associated with the account 501 in FIG. 3, a registration permission 512 having biometric information registration permission information, and a registration expiration date 513 when the registration permission 512 is permitted. When the registration permission 512 is possible, the account is a registerable account, and when the registration permission 512 is not possible, the status of the account that cannot be registered is indicated. For the expiration date 513, the date and time when the registration process is performed is compared with the expiration date 513. If the date and time is earlier than the expiration date, registration is possible, and if the date and time is later than the expiration date, registration is impossible.

  For example, if the account 511 is 00000001 (611), the registration permission 512 is permitted and the expiration date 513 has information of 2012/03/01 17:00. In other words, the biometric information can be performed if the date and time when the biometric information registration process is performed is past 2012/03/01 17:00. Similarly, when the account 511 is 00000011 (612), registration permission 512 is permitted and the expiration date 513 has information of 2012/03/01 17:00. In other words, the biometric information can be performed if the date and time when the biometric information registration process is performed is past 2012/03/01 17:00. Similarly, if the account 511 is 00000012 (613), the registration permission 512 is not allowed and the expiration date 513 is-. -Means unlimited. That is, registration processing of biometric information cannot be performed. Similarly, when the account 511 is 00000013 (614), the registration permission 512 is permitted and the expiration date 513 has information of 2012/03/01 17:00. In other words, the biometric information can be performed if the date and time when the biometric information registration process is performed is past 2012/03/01 17:00. Similarly, when the account 511 is 00000002 (615), the registration permission 512 is not allowed and the expiration date 513 is-. -Means unlimited. That is, registration processing of biometric information cannot be performed.

Similarly, when the account 511 is 00000003 (616), the registration permission 512 is permitted and the expiration date 513 has information of 2012/03/01 17:00. In other words, the biometric information can be performed if the date and time when the biometric information registration process is performed is past 2012/03/01 17:00.
FIG. 5 is a diagram showing a processing sequence of the PC terminal 201 at the time of authentication. The processing sequence is held in the storage unit 205 of the PC terminal 201 and executed by the control unit 204. This will be described with reference to FIG. Further, in synchronization with this process of the PC terminal 201, the process of the authentication server 102 shown in FIG. 6 is executed. When an administrator or a user inputs an account from the display unit 206 and the input unit 207 of the PC terminal 201 and gives an instruction to select an authentication start button, for example, the process starts in step S701 and proceeds to step S702. In step S702, a biometric information acquisition command is issued to the biometric information acquisition apparatus 301 to acquire biometric information. Further, the account acquired from the display unit 206 and the input unit 207 is acquired, and the process proceeds to step S703. In step S703, the acquired account and biometric information are transmitted to the authentication server 101, and the process proceeds to step S704. In step S704, authentication success or authentication failure, which is the result of authentication by the authentication server 101, is received, and the process proceeds to step S705. In step S705, the user is notified of the success or failure of authentication using the display unit 206, and the process proceeds to step S706. In step S706, the process ends.

  FIG. 6 is a diagram showing a processing sequence of the authentication server 101 during normal authentication. The processing sequence is held in the storage unit 104 of the authentication server 101 and executed by the control unit 103. This will be described with reference to FIGS. Further, the process of the PC terminal 201 shown in FIG. 5 is executed in synchronization with the process of the authentication server 101. In step S711, the process starts, and the process proceeds to step S712. In step S712, an account and biometric information are received from the PC terminal 201, and the process proceeds to step S713. In step S713, an account is searched from FIG. 3, and biometric information is acquired if there is a corresponding account. If there is no corresponding account, authentication fails and the process proceeds to step S714.

  If the biometric information acquired from FIG. 3 and the biometric information acquired from the PC terminal 201 are compared and coincident with each other, the authentication is successful, and the process proceeds to step S714. On the other hand, if they do not match, authentication fails and the process proceeds to step S714. In step S714, authentication success or authentication failure is transmitted to the PC terminal 201, and the process proceeds to step S715. In step S715, the process ends. In the comparison of the biometric information in step S713, it is simply determined whether or not they match, but it is only necessary to determine whether the authentication is successful or unsuccessful, and other determination methods may be used.

  FIG. 7 is a diagram showing a processing sequence of the PC terminal 201 at the time of biometric information registration, which is held in the storage unit 205 of the PC terminal 201 and executed by the control unit 204. This will be described with reference to FIG. Further, in synchronization with this process of the PC terminal 201, the process of the authentication server 102 shown in FIG. 8 is executed. When an administrator or a user inputs an account from the display unit 206 and the input unit 207 of the PC terminal 201 and gives an instruction such as selecting a biometric information registration start button, the process starts at step S721 and goes to step S722. move on. In step S722, a biometric information acquisition command is issued to the biometric information acquisition apparatus 301 to acquire biometric information. Further, the account acquired from the display unit 206 and the input unit 207 is acquired, and the process proceeds to step S723. In step S723, the acquired account and biometric information are transmitted to the authentication server 101, and the process proceeds to step S724. In step S724, registration success or registration failure, which is a result of registering or updating biometric information in the authentication server 101, is received, and the process proceeds to step S725. In step S725, the user is notified of registration success or registration failure using the display unit 206, and the process proceeds to step S726. In step S726, the process ends.

FIG. 8 is a diagram showing a processing sequence of the authentication server 101 at the time of normal biometric information registration, which is held in the storage unit 104 of the authentication server 101 and executed by the control unit 103. This will be described with reference to FIGS.
Further, the process of the PC terminal 201 shown in FIG. 7 is executed in synchronization with this process of the authentication server 101. The process starts in step S731, and proceeds to step S732. In step S732, an account and biometric information are received from the PC terminal 201, and the process proceeds to step S733. In step S733, an account is searched from FIG. 3, and if there is a corresponding account, the biometric information received from the PC terminal 201 is registered or updated, the registration is successful, and the process proceeds to step S734. If there is no corresponding account, it is determined that the registration has failed and the process proceeds to step S734. In step S734, registration success or registration failure is transmitted to the PC terminal 201, and the process proceeds to step S735. In step S735, the process ends. The authentication process of FIGS. 5 and 6 may be added before biometric information registration, and only when authentication is successful, the system may proceed to the biometric information registration process of FIGS. 7 and 8.

  Next, a method of requiring authentication of an administrator who has administrator authority of the head office or department to which the user belongs before the user registers biometric information according to the present embodiment will be described. Before the user registers biometric information, the administrator performs authentication from the PC terminal 201, that is, performs the process of FIG. At that time, the authentication server 101 performs the processing of FIG. Thereafter, the user registers biometric information from the PC terminal 201, that is, performs the process of FIG. At that time, the authentication server 101 performs the process of FIG.

  FIG. 9 is a diagram showing a processing sequence when the administrator authenticates in advance before the user registers biometric information, and is held in the storage unit 104 of the authentication server 101 and executed by the control unit 103. . This will be described with reference to FIGS. 2, 3, and 4. At this time, the processing of the PC terminal 201 shown in FIG. 5 is executed in synchronization with the main processing of the authentication server 101. In step S741, the process is started, and the process proceeds to step S742. In step S742, an account and biometric information are received from the PC terminal 201, and the process proceeds to step S743. In step S743, an account is searched from FIG. 3, and biometric information is acquired if there is a corresponding account. If there is no corresponding account, authentication fails and the process proceeds to step S748. If the biometric information acquired from FIG. 3 and the biometric information acquired from the PC terminal 201 are compared with each other, the authentication is successful, and the process proceeds to step S744. On the other hand, if they do not match, authentication is failed and the process proceeds to step S748. In step S744, the authority 506 of the corresponding account 501 is acquired from FIG. 3, and the process proceeds to step S745. In step S745, an account of the head office and department targeted by the acquired authority is acquired, and the process proceeds to step S746. For example, in FIG. 3, when the account 501 is successfully authenticated with 00000001 (601), the authority 506 is a software department administrator, so the head office 504 acquires the account 501 which is the development head office and the department 505 is the software department. The account 501 corresponds to 00000001 (601), 00000011 (602), 00000013 (604), and 00000003 (606). In step S746, the corresponding account 511 is searched based on the account 501 acquired in FIG. 4 from step S745, the registration permission 512 of the corresponding account 511 is set to be permitted, and the process proceeds to step S747. It should be noted that the initial value of registration permission is set as impossible. In step S747, the expiration date of the account 511 acquired in step S745 in step S746 is set, and the process proceeds to step S748. The expiration date may be obtained by the administrator setting and sending the expiration date from the PC terminal at the time of authentication, or may be obtained by adding a predetermined date to the processing date. In step S748, the registration result of registration success or registration failure is transmitted to the PC terminal 201, and the process proceeds to step S749. In step S749, the process ends.

  FIG. 10 is a diagram illustrating a processing sequence when the user registers biometric information after the administrator performs authentication in advance, and is stored in the storage unit 104 of the authentication server 101 and executed by the control unit 103. The This will be described with reference to FIGS. 2, 3, and 4. At this time, the processing of the PC terminal 201 shown in FIG. 7 is executed in synchronization with the main processing of the authentication server 101. In step S751, the process is started, and the process proceeds to step S752. In step S752, an account and biometric information are received from the PC terminal 201, and the process proceeds to step S753. In step S753, the account 511 is searched from FIG. 4, and if there is a corresponding account, a registration permission 512 is acquired.

  If registration permission 512 is permitted, the process proceeds to step S754. On the other hand, if the registration permission 512 is not possible, the process proceeds to step S756 as registration failure. In step S754, the expiration date 513 of the corresponding account 511 is acquired, and the processing date and time is acquired and compared. If the acquired date is before the expiration date 513, the process proceeds to step S755. On the other hand, if the acquired date and time is after the expiration date 513, the expiration date has expired, and the process proceeds to step S756 as a registration failure. In step S755, the biometric information of the corresponding account in FIG. 3 is registered or updated, and the registration is successful, and the process proceeds to step S756. In step S756, registration success or registration failure is transmitted to the PC terminal 201, and the process proceeds to step S757. In step S757, the process ends. 9 and 10, the expiration date is used after using the registration permission information. However, the expiration date may not be used. In that case, the processing of step S747 in FIG. 9 and step S754 in FIG. 10 is omitted. If step S753 is possible, step S755 is processed.

  According to the present embodiment described above, a user who wants to register or update biometric information can register biometric information if an administrator belonging to the same group is remotely authenticated in advance.

100 authentication server, 101 authentication server, 102 client interface, 103 control unit, 104 storage unit, 105 power supply unit,
200 PC terminal, 201 PC terminal, 202 Host interface, 203 Client interface, 204 Control unit, 205 Storage unit, 206 Display unit, 207 Input unit, 208 Power supply unit, 210, PC terminal, 220, PC terminal,
300 biological information acquisition device, 301 biological information acquisition device, 302 host interface, 303 control unit, 304 sensor unit, 305 storage unit, 306 power supply unit, 310 biological information acquisition device, 320 biological information acquisition device,
400 Administrator A, 410 User A, 420 User B, 421 User C,
501 account, 502 biometric information, 503 user name, 504 headquarters, 505 department, 506 authority, 511 account, 512 registration permission, 513 expiration date

Claims (5)

A method of registering biometric information used for user authentication in a predetermined organization,
Authenticate administrators in the organization,
Determining whether the process for registering the biometric information of the user satisfies a predetermined condition for authentication of the administrator;
If the condition is met, by registering the user's biometric information,
A biometric information registration method capable of executing authentication of the user using the registered biometric information. The biometric information registration method according to claim 1,
For the administrator's biometric information, first biometric information for normal authentication and second biometric information for registration of the user's biometric information are stored,
The biometric information registration method characterized in that the biometric information of the user is registered when authentication using the second biometric information is successful as the predetermined condition. In the biometric information registration method according to claim 1 or 2,
The biometric information registration method, wherein the biometric information registration is an update of the biometric information of the user stored in advance. The biometric information registration method according to claim 3,
When the predetermined condition is satisfied, information indicating whether or not the update of the biological information is valid is validated. The biometric information registration method according to claim 4,
A biometric information registration method characterized in that if the information indicating whether the biometric information update is valid is valid, the biometric information has a time limit.

Images