JP2015201040A - biometric authentication device and biometric authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a biometric authentication device and a biometric authentication system that perform safe and continuous biometric authentication with no risk of biometric information being used fraudulently if the biometric information is duplicated or leaked.SOLUTION: The biometric information device according to the embodiment a device that biometrical-authenticates a user by checking biometric information of a user having issued a request for authentication against registered biometric information of the user. The biometric information device includes: a biometric information acquisition unit for acquiring biometric information of a user to be checked; a feature information extraction unit for extracting feature information from the biometric information to be checked according to a determined rule, and a biometric information registration unit for changing the extracted feature information to be used as the biometric information of the user for registration and registering the changed information into a storage unit storing biometric information for registration.

Description

  Embodiments described herein relate generally to a biometric authentication device and a biometric authentication system.

  Currently, various types of biometric authentication methods exist as authentication methods for authenticating users. For example, there are signature (handwriting) authentication, fingerprint authentication, vein authentication, iris authentication, voiceprint authentication, and the like.

  The most introduced biometric authentication method is fingerprint authentication, but it is known that the authentication accuracy decreases for various reasons. For example, the user is susceptible to various influences such as physical condition, environment, and aging, including hand injury and rough hands, wetness in water, and the like. In addition, since the finger directly touches the authentication device, there is a concern about cleanliness.

  Therefore, in order to improve the authentication accuracy of fingerprint authentication, for example, in an information processing apparatus having a plurality of biometric authentication functions, when the first biometric authentication is performed using a fingerprint and the biometric authentication using the fingerprint matches, An information processing apparatus that performs second biometric authentication by face authentication has also been studied (see Patent Document 1).

JP 2011-13855 A

  By the way, in emergency medical care and disaster medical care, there is a case where patient authentication (identity authentication) by a patient is required in order to identify a patient or acquire information necessary for treatment of the patient. For example, if there is consciousness of the person, patient authentication can be performed by the patient himself using an input of a password (password), but if there is no consciousness of the person, patient authentication can be performed. Can not.

  Also, if there is a person's consciousness, it may be possible to authenticate the patient with personal belongings such as an examination ticket or insurance card, but it is not always carried, especially in emergency medicine and disaster medicine, There are many cases in which a doctor's ticket or insurance card is not carried, so it is more likely that patient authentication cannot be performed.

  In addition, it seems that patient authentication can be performed by using the most prevalent fingerprint authentication regardless of the presence or absence of the patient's consciousness or possession.

  However, in emergency medical care and disaster medical care, there is a possibility that the patient himself / herself may be affected by changes in the body due to external causes such as injuries, and thus patient authentication by fingerprint authentication may not be performed.

  Therefore, recently, the use of vein authentication, which is more resistant to the influence of physical changes than fingerprint authentication, has been studied. However, vein authentication is the only information possessed by individual users. Once biometric information is copied or leaked, the user cannot change the vein. No workaround has been found.

  For this reason, when performing vein authentication by vein, it is considered to prevent duplication and leakage by, for example, performing encryption on a biometric information template.

  However, if the decryption key leaks, the same problem will eventually occur. Also, if the decryption authority is given to a specific individual, when performing vein authentication, there is no specific individual who has the decryption authority, or there is a range of decryption authority. If this happens, there is a high possibility that anyone can decrypt it.

  Therefore, there has been a demand for a biometric authentication apparatus and a biometric authentication system that can perform biometric authentication safely and continuously without being abused even if biometric information is duplicated or leaked.

  The biometric authentication device according to the present embodiment is a biometric authentication device that performs biometric authentication between verification biometric information of a user who has received an authentication request and biometric information for registration of the registered user. A biometric information acquisition unit that acquires biometric information for verification, a feature information extraction unit that extracts, from the acquired biometric information for verification of the user, a part of feature information indicated by the biometric information for verification according to a determination rule, A biometric information registration unit that changes the extracted feature information as biometric information for registration of the user and registers the biometric information in the biometric information storage unit for registration.

  The biometric authentication system according to the present embodiment includes a server and a biometric authentication terminal that perform biometric authentication between verification biometric information of a user who has received an authentication request and registered biometric information of the user. In the biometric authentication system, from the biometric information acquisition unit that acquires biometric information for verification of the user and the acquired biometric information for verification of the user, a part of feature information indicated by the biometric information for verification is determined And a biometric information registration unit that changes the extracted feature information as biometric information for registration of the user and registers it in the biometric information storage unit for registration.

The schematic block diagram which showed an example of the schematic structure of the biometrics terminal which concerns on this embodiment. The hardware block diagram which shows the structure of the biometrics terminal which concerns on this embodiment. When the biometric authentication terminal according to the present embodiment receives an authentication request for authentication from the user, the biometric information for registration and biometric information for registration of the user who has received the authentication request are acquired, and the biometric for verification of the user is acquired. The flowchart which showed the authentication result notification process which authenticates information and biometric information for registration. When the authentication result matches, the biometric authentication terminal according to the present embodiment acquires biometric information for verification that has been successfully authenticated, and updates biometric information for registration based on the biometric information for verification The flowchart which showed the update process. Explanatory drawing which showed the method by which the feature point extraction part of the biometrics terminal which concerns on this embodiment determines a predetermined range from the biometric information for a user's collation according to a determination rule, and extracts the feature point of the predetermined range. Explanatory drawing which showed the concept in which a feature point extraction part selects alternatively the site | part to collate from the biometric information for collation of several site | parts in 2nd Embodiment. In the third embodiment, the feature point extraction unit extracts feature points of each part from the biometric information for collation of a plurality of parts according to the determination rule, and the biometric information registration unit extracts features of two or more parts. Explanatory drawing which showed the concept which combines a point. The schematic block diagram which showed an example of the schematic structure of the biometrics terminal which concerns on 3rd Embodiment. The display screen example which showed the example in which the determination rule change part is provided in 4th Embodiment and a user sets the change of a determination rule. The schematic block diagram which showed an example of the schematic structure of the biometrics terminal which concerns on 5th Embodiment. Explanatory drawing which showed the example of alerting | reporting by the display part of a biometrics authentication terminal in 5th Embodiment. The schematic block diagram which showed an example of the schematic structure of the biometrics terminal which concerns on 6th Embodiment. In the sixth embodiment, the access analysis unit of the biometric authentication terminal periodically monitors an access log to the biometric information storage unit for registration of the biometric authentication server, and the biometric authentication server stores the biometric information for registration. Explanatory drawing of the access log which showed the method of detecting unauthorized access of the. Explanatory drawing when the access analysis part of a biometrics terminal produces the revocation list | wrist from an access log in 6th Embodiment.

  Hereinafter, a biometric authentication terminal (biometric authentication device) 100 according to the present embodiment will be described with reference to the accompanying drawings.

  FIG. 1 is a schematic configuration diagram illustrating an example of a schematic configuration of the biometric authentication terminal 100 according to the present embodiment.

  As shown in FIG. 1, the biometric authentication terminal 100 according to the present embodiment is connected to a registration biometric information storage unit 140 and an external device 200.

  When the biometric authentication terminal 100 acquires biometric information from the user, the biometric authentication terminal 100 performs biometric authentication (an example is vein authentication). The biometric authentication terminal 100 starts communication with the external device 200 when the biometric information for authentication and biometric information for registration match in biometric authentication.

  The external device 200 is an information processing device that forms part of a hospital information system, an electronic medical record system, or the like that forms the backbone of a hospital. The external device 200 is configured to accept a connection from the biometric authentication terminal 100 when the biometric authentication is matched in the biometric authentication terminal 100. For example, when the biometric authentication matches, the external device 200 can transmit / receive patient information to / from the biometric authentication terminal 100.

  The biometric information storage unit for registration 140 is a storage unit that stores biometric information for registration unique to each user who performs biometric authentication. In the present embodiment, the biometric information storage unit for registration 140 is provided in a biometric authentication server (data server) different from the biometric authentication terminal 100 and stores biometric information for registration. In the present embodiment, the registration biometric information storage unit 140 is described on the premise that it is provided in a biometric authentication server different from the biometric authentication terminal 100. However, the biometric authentication terminal 100 stores biometric information for registration. The form in which the part 140 is provided may be sufficient.

  The biometric authentication terminal 100 according to the present embodiment includes a biometric information reading unit 110, a biometric information matching unit 120, a registration biometric information acquisition unit 130, an authentication result notification unit 150, a biometric information acquisition unit 160, a feature point extraction unit 165, and A biometric information registration unit 170 and the like are provided.

  The biometric information reading unit 110 reads biometric information from the user in order to collate the biometric information of the user.

  When the biometric information matching unit 120 detects reading of biometric information of a user by the biometric information reading unit 110, the biometric information matching unit 120 requests acquisition of biometric information for registration of the user. For example, the biometric information matching unit 120 acquires biometric information for user registration from the biometric information storage unit 140 for registration provided in the biometric authentication server via the biometric information acquisition unit 130 for registration. .

  The biometric information acquisition unit 130 for registration receives a user's request for biometric information for registration from the biometric information matching unit 120, and the biometric information for registration of the user from the biometric information storage unit 140 for registration provided in the biometric authentication server. To get. When the biometric information acquisition unit 130 acquires biometric information for registration, the biometric information for registration 130 sends the biometric information for registration to the biometric information matching unit 120.

  The biometric information matching unit 120 includes the biometric information for user authentication acquired from the biometric information reading unit 110 and the biometric information of the biometric information for user registration acquired from the biometric information storage unit 140 for registration provided in the biometric authentication server. Verification is to be performed. The biometric information collation unit 120 is configured to send the biometric information collation result to the authentication result notification unit 150.

  When the authentication result is acquired from the biometric information matching unit 120, the authentication result notifying unit 150 notifies that the authentication is successful, and starts communication with the external device 200. It is like that. When the authentication results do not match, the authentication result notification unit 150 notifies that the authentication results do not match.

  The biometric information acquisition unit 160 acquires biometric information for verification of a user who has been normally authenticated by the biometric information verification unit 120. Note that “normally authenticated” means that the authentication results match (success in authentication). Therefore, the biometric information acquisition unit 160 acquires biometric information for verification every time the authentication results match.

  The feature point extraction unit (feature information extraction unit) 165 acquires the biometric information for collation of the user acquired by the biometric information acquisition unit 160, and obtains the feature points (partial feature information) indicated by the biometric information for collation. Extraction is performed according to decision rules.

  Here, the determination rule refers to a rule for extracting feature points (feature information) for generating biometric information for user registration from biometric information for user verification.

  The biometric information registration unit 170 changes the feature point (feature information) extracted by the feature point extraction unit 165 as biometric information for user registration and registers it in the biometric information storage unit 140 for registration.

  The biometric authentication terminal 100 according to the present embodiment extracts a feature point from the user's biometric biometric information according to the determination rule every time authentication is successful, changes the biometric information for registration, and registers the biometric information. The biometric information for registration can be updated.

  As described above, the biometric authentication terminal 100 according to the present embodiment can update (change) the biometric information for registration of the user when authentication is normally performed. Even if leaked, biometric authentication can be performed safely and continuously without misuse of biometric information.

  FIG. 2 is a hardware block diagram illustrating a configuration of the biometric authentication terminal 100 according to the present embodiment.

  As shown in FIG. 2, a biometric authentication terminal 100 according to the present embodiment includes a CPU (Central Processing Unit) 101, a ROM (Read Only Memory) 102, a RAM (Random Access Memory) 103, a network interface unit 104, and an operation unit 105. , A display unit 106, a storage unit 107, an internal bus 108, and the like.

  The CPU 101 can realize the functions of various programs by loading various programs stored in the ROM 102 into the RAM 103 and expanding the programs. The RAM 103 is used as a work area (working memory). The ROM 102 stores various programs. Various programs stored in the ROM 102 include programs for realizing functions such as the biometric information reading unit 110 to the biometric information registration unit 170 shown in FIG.

  The network interface unit 104 is an interface unit for communicating with the external device 200 (FIG. 1) via a network (not shown).

  The operation unit 105 is an input device configured with a touch panel, for example. A touch panel is an electronic component that combines a display device such as a liquid crystal panel and a position input device such as a touch pad, and operates an apparatus by pressing a display button assigned to a position on the screen. It is.

  The display unit 106 is a member that is used integrally with the operation unit 105, and is a display device that visually displays display buttons and operation methods for the user.

  The storage unit 107 is a storage unit that constitutes a storage memory, and includes a RAM, a hard disk, and the like. In this embodiment, the memory | storage part 107 comprises the memory | storage part which memorize | stores an authentication result or stores a collation history, for example.

  Thereby, in this embodiment, the biometric authentication terminal 100 can implement | achieve the function of the biometric authentication terminal 100 shown in FIG. 1 by running the program stored in ROM102.

(Authentication result notification process)
First, the biometric authentication terminal 100 according to the present embodiment has a general authentication function, and the general authentication function will be described.

  3, when the biometric authentication terminal 100 according to the present embodiment receives an authentication request (authentication request) for authentication from a user, the biometric information for registration and biometric information for registration of the user who has received the authentication request are displayed. It is the flowchart which showed the authentication result notification process which acquires and authenticates the biometric information for collation and biometric information for registration of the user. In FIG. 3, reference numerals with numerals added to S indicate steps in the flowchart.

  First, the biometric authentication terminal 100 according to the present embodiment accepts an operation by the operation unit 105 configured with a touch panel from a user, and accepts a biometric authentication request (step S001).

  Next, the biometric information reading unit 110 of the biometric authentication terminal 100 reads the user's biometric information and acquires the user's biometric information for verification (step S003). The biometric information reading unit 110 sends the acquired biometric information for verification to the biometric information verification unit 120.

  The biometric information matching unit 120 of the biometric authentication terminal 100 acquires biometric information for verification from the biometric information reading unit 110 when the biometric information reading unit 110 detects reading of the biometric information of the user, and acquires the acquired biometric information for registration of the user. Is sent to the biometric information acquisition unit 130 for registration (step S005).

  The biometric information matching unit 120 obtains the biometric information for registration corresponding to the biometric information for verification of the acquired user from the biometric information storage unit 140 for registration provided in the biometric authentication server via the biometric information for registration acquisition unit 130. Obtained (step S007).

  The biometric information matching unit 120 authenticates the user's biometric information for verification acquired from the biometric information reading unit 110 and the biometric information for user registration acquired from the biometric information acquisition unit 130 for registration (step S009).

  The biometric information matching unit 120 authenticates the matching biometric information and the registration biometric information, and determines whether the biometric information for matching matches the biometric information for registration (step S011). In this case (Yes in step S011), the authentication result notifying unit 150 notifies that the authentication has been normally performed (authentication match) (step S013).

  Further, the authentication result notifying unit 150 starts communication with the external device 200 when it is normally authenticated (step S015), and ends the authentication result notifying process.

  On the other hand, when the biometric information for verification does not match the biometric information for registration (No in step S011), the authentication result notification unit 150 notifies that the authentication results do not match (authentication mismatch) (step S017). The authentication result notification process is terminated.

(Biometric information update process)
The biometric authentication terminal 100 according to the present embodiment has a function of updating (changing) biometric information for registration of a user. If the authentication result matches in biometric authentication, the biometric authentication terminal 100 is further based on the biometric information. Information is updated (changed). Hereinafter, the biometric information update process of the biometric authentication terminal 100 according to the present embodiment will be described.

  FIG. 4 shows that biometric authentication terminal 100 according to the present embodiment acquires biometric information for verification that has been successfully authenticated when the authentication results match, and biometric information for registration based on the biometric information for verification. It is the flowchart which showed the biometric information update process which updates. In FIG. 4, reference numerals with numbers added to S indicate steps in the flowchart.

  First, when the biometric authentication terminal 100 according to the present embodiment performs biometric authentication and notifies that it has been successfully authenticated (authentication match) (step S013), the biometric information acquisition unit 160 of the biometric authentication terminal 100 displays Then, biometric information for collation of the user who has been normally authenticated by the biometric information collating unit 120 is acquired from the biometric information reading unit 110 (step S101). For example, it is assumed that the biometric information acquisition unit 160 acquires biometric information for verification of the user every time authentication is normally performed.

  The feature point extraction unit 165 acquires the biometric information for user verification acquired by the biometric information acquisition unit 160, and extracts the feature point indicated by the biometric information for verification according to the determination rule (step S103).

  For example, the feature point extraction unit 165 can use a rule for determining a predetermined range in a predetermined range indicated by the user's biometric information for collation and extracting feature points in the predetermined range as the determination rule.

  FIG. 5 shows a method in which the feature point extraction unit 165 of the biometric authentication terminal 100 according to the present embodiment determines a predetermined range from the biometric information for user verification according to the determination rule, and extracts feature points in the predetermined range. It is explanatory drawing which showed.

  In FIG. 5A, the predetermined range is indicated by coordinates, and the feature point extraction unit 165 displays the range surrounded by the coordinates (100, 200) and the coordinates (300, 300) as the predetermined range. As described above, feature points included in this range are extracted. Similarly, the feature point extraction unit 165 extracts a feature point included in this range by setting a range surrounded by the coordinates (150, 300) and the coordinates (450, 500) as a predetermined range.

  In FIG. 5B, a plurality of coordinates are registered in advance as feature point coordinates. Using the feature point coordinates, a predetermined range is set, and feature points included in this range are extracted. Note that the plurality of coordinates registered in advance (predefined coordinates) may be randomly changed.

  In FIG.5 (c), a feature point is extracted from the biometric information for collation using the mask image which shows a predetermined range using the mask image created by the feature point coordinate as a predetermined range.

  In addition, for example, the decision rule may set a predetermined range indicated by coordinates, taking into account the acceptance rate of others who mistakenly accept others, or the rejection rate of mistaken identity while being a principal, Can be combined. In addition, since the acceptance rate of others and the rejection rate of identity change also depending on the part where the biometric authentication is performed, it can be combined depending on the part where the authentication is performed.

  As described above, the determination rule may be a rule for randomly changing a predetermined range indicating a feature point to be extracted, and a part to be authenticated as biometric information for verification such as a person rejection rate or a stranger acceptance rate. The rule may be changed according to the ratio.

  The biometric information registration unit 170 changes the feature points in a predetermined range extracted by the feature point extraction unit 165 as biometric information for user registration, and registers it in the biometric information storage unit 140 for registration provided in the biometric authentication server. (Step S105).

  In the biometric authentication terminal 100 according to the present embodiment, the biometric information registration unit 170 changes the feature points to biometric information for registration and registers it in the biometric information storage unit 140 for registration of the biometric authentication server, thereby registering the user. The biometric information is updated (step S107), and the biometric information update process is terminated.

  As described above, in the biometric authentication terminal 100 according to the present embodiment, the biometric information acquisition unit 160 acquires biometric information for user verification every time authentication is normally performed, and the feature point extraction unit 165 A feature point indicated by the biometric information for collation is extracted from the biometric information for collation according to the determination rule. In addition, the biometric information registration unit 170 changes the feature point extracted by the feature point extraction unit 165 as biometric information for user registration and registers it in the biometric information storage unit 140 for registration.

  Thereby, the biometric authentication terminal 100 according to the present embodiment converts the biometric information for registration stored in the biometric information storage unit 140 for registration of the biometric authentication server into biometric information for verification authenticated by the biometric information verification unit 120. Based on this, it can be updated (changed) as biometric information for registration of the user, so that biometric authentication can be performed safely and continuously without being misused even if the biometric information is duplicated or leaked.

  Note that the biometric authentication terminal 100 according to the present embodiment deletes the existing biometric information for registration when the biometric information for registration of the user is registered in the biometric information storage unit 140 for registration of the biometric authentication server. It has become. Therefore, the biometric information storage unit for registration 140 can always register only new biometric information for registration without leaving the biometric information for past registration of the user.

(Second Embodiment)
In the first embodiment, the determination rule is such that a predetermined range is set from the biometric information for verification in one part, and feature points in that range are extracted.

  In the second embodiment, biometric information for verification at a plurality of parts is acquired, and feature points are alternatively extracted from the biometric information for verification at the plurality of parts. Since the second embodiment can be realized by the same configuration as the first embodiment, only different parts will be described.

  In 2nd Embodiment, the biometric information acquisition part 160 acquires the biometric information for a user's some collation. For example, as a part, 8 palms, “back of hand”, “back of hand”, “thumb”, “index finger”, “middle finger”, “ring finger”, “little finger” and “arm” can be targeted. When included, biometric information for verification at 16 locations can be acquired.

  The biometric information acquisition unit 160 may acquire a plurality of pieces of biometric information for verification at a time, or for each part, the biometric information reading unit 110 reads each biometric information and acquires a plurality of pieces of biometric information for verification. You may make it do.

  The feature point extraction unit 165 selectively selects a part to be collated from the obtained biometric information for collation of a plurality of parts according to the determination rule.

  FIG. 6 is an explanatory diagram showing a concept in which the feature point extraction unit 165 alternatively selects a part to be collated from a plurality of parts of biometric information for collation in the second embodiment.

  FIG. 6 shows biometric information for collation such as palm (right), thumb (right), back of hand (left), and the like, and the feature point extraction unit 165 performs biometric biometrics for these parts according to the determination rule. A part to be registered as biometric information for registration is alternatively selected from the information.

  In this case, as a method for selecting a part to be registered, for example, the biometric information for collation of a plurality of parts obtained may be selected by rotation or may be selected randomly (randomly).

  As described above, in the second embodiment, the biometric information acquisition unit 160 acquires a plurality of pieces of verification biometric information of the user, and the feature point extraction unit 165 conforms to the determination rule and acquires the plurality of pieces of verification biometrics. A part to be registered as biometric information for registration is alternatively selected from the information.

  Thereby, in 2nd Embodiment, the biometric information for a user's registration is updated by changing the biometric information for a user's registration currently stored in the biometric information server for registration 140 of a biometrics authentication server regularly. be able to. Further, in the second embodiment, the feature points of the part extracted alternatively can be directly updated as biometric information for user registration.

  As described above, since the biometric authentication terminal 100 according to the second embodiment can periodically change the biometric information for registration in accordance with the decision rule, even if the biometric information is duplicated or leaked, it is misused. There is little possibility that

(Third embodiment)
In the second embodiment, biometric information for verification at a plurality of parts is acquired, and a part to be registered as biometric information for registration is alternatively selected from biometric information for verification at a plurality of parts in accordance with a decision rule. It was.

  In the third embodiment, as in the second embodiment, biometric information for verification in a plurality of parts is acquired. However, the determination rule is that two or more pieces of biometric information for verification in a plurality of parts are acquired. It is a rule to combine biometric information for comparing parts.

  Therefore, the feature point extraction unit 165 determines a part to be combined according to the determination rule, and extracts a feature point indicated by each biometric information for matching for each determined part.

  The biometric information registration unit 170 combines the biometric information for collation according to the determination rule, and changes the feature points for each part extracted from two or more parts as biometric information for user registration, for registration in the biometric authentication server. Registration is performed in the biological information storage unit 140.

  In FIG. 7, in the third embodiment, the feature point extraction unit 165 extracts feature points of each part from the biometric information for collation of a plurality of parts according to the determination rule, and the biometric information registration unit 170 It is explanatory drawing which showed the concept which combines the feature point of two or more site | parts.

  In FIG. 7, the feature point extraction unit 165 extracts palm collation biometric information and index finger biometric information according to the determination rule. In addition, the biometric information registration unit 170 superimposes the extracted biometric information for palm collation and the extracted biometric information for collation of the index finger, and stores the information in the biometric information storage unit 140 for registration provided in the biometric authentication server. The biometric information for registration is registered.

  The biometric information registration unit 170 may combine two or more parts of biometric information for collation and register them as biometric information for registration in the biometric information storage unit 140 for registration. In addition, for example, biometric information for palm verification is assigned to the upper half in the authentication area of biometric information for registration, and biometric information for verification of the index finger is assigned to the lower half in the authentication area of biometric information for registration. Also good.

  Moreover, the information which combines or superimposes biometric information for collation is not limited to two, and may be three or more. Moreover, it is one part and you may make it overlap two or more area | regions in the part. Further, information on which part biometric information for collation is combined may be separately recorded in a table.

(Fourth embodiment)
In the first to third embodiments, feature points are extracted from biometric information for verification acquired by the biometric information acquisition unit 160 according to various decision rules, the extracted feature points are changed as biometric information for registration, and biometric authentication is performed. Registration is performed in the biometric information storage unit 140 for registration provided in the server.

  In the fourth embodiment, for example, a decision rule changing unit that appropriately changes the decision rules applied in the first to third embodiments is provided.

  FIG. 8 is a schematic configuration diagram illustrating an example of a schematic configuration of the biometric authentication terminal 100A according to the third embodiment.

  The fourth embodiment shown in FIG. 8 is different from the first embodiment shown in FIG. 1 in that a determination rule changing unit 175 is provided. Therefore, the determination rule changing unit 175 different from the other embodiments will be described.

  The decision rule changing unit 175 changes the decision rule itself to be applied. For example, it is possible to change the decision rule to be applied every time a certain time elapses or to apply the biometric authentication every time biometric authentication is performed.

  In this case, the biometric information acquisition unit 160 acquires biometric information for verification of the user at the site to be authenticated according to the changed decision rule.

  Further, the feature point extraction unit 165 extracts the feature point indicated by the biometric information for verification from the acquired biometric information for verification of the user according to the changed decision rule.

  In addition, the biometric information registration unit 170 changes the feature point extracted by the feature point extraction unit 165 as biometric information for user registration, and registers it in the biometric information storage unit 140 for registration of the biometric authentication server.

  FIG. 9 is an example of a display screen showing an example in which the determination rule changing unit 175 is provided in the fourth embodiment, and the user sets the change of the determination rule.

  FIG. 9 shows the setting contents and setting method of the decision rule setting information indicating the setting information of the decision rule. For example, feature point determination rules, condition 1 and condition 2 pull-down boxes are shown. The feature point determination rule indicates a determination rule setting method applied in the first to third embodiments.

  In the feature point determination rule shown in FIG. 9, random extraction is set as the setting of the determination rule shown in the first to third embodiments. In addition to random extraction, for example, rotation of decision rules according to order, a decision rule determined in advance, a decision rule in which a pattern is decided in advance, and the like are applicable.

  Condition 1 is set to change the decision rule at regular intervals. In this condition 1, in addition, it is possible to select for each authentication that changes the determination rule every time biometric authentication is performed.

  In the condition 2, since it is set in the condition 1 that the decision rule is changed every certain time, the certain time can be set. For example, in the condition 1, when every authentication is selected, the decision rule can be changed every 5 times authentication.

(Fifth embodiment)
In the fifth embodiment, for example, based on the determination rule applied in the first to fourth embodiments, a guide information notification unit that notifies guide information for acquiring biometric information for a user's collation is provided. It comes to be prepared.

  FIG. 10 is a schematic configuration diagram illustrating an example of a schematic configuration of a biometric authentication terminal 100B according to the fifth embodiment.

  The fifth embodiment shown in FIG. 10 differs from, for example, the fourth embodiment shown in FIG. 8 in that a guidance information notification unit 180 is provided. Therefore, the guidance information notification unit 180 different from the other embodiments will be described.

  The guide information notification unit 180 notifies the guide information for acquiring the biometric information for user verification from the user.

  In this case, the guidance information notification unit 180 uses the display unit 106 (see FIG. 2) of the biometric authentication terminal 100B to notify the user's part to be acquired.

  FIG. 11 is an explanatory diagram illustrating a notification example that the display unit 106 of the biometric authentication terminal 100B notifies in the fifth embodiment.

  In FIG. 11A, “Please hold your left palm up” is displayed on the display unit 106.

  In FIG. 11B, the part of the biometric information for verification to be obtained is visually displayed to the user on the display unit 106 using icons or silhouettes.

  In FIG. 11C, a message stating “Please operate according to the voice” is displayed on the display unit 106, and a speaker (not shown) is used to voice “Hold your left palm up. Please notify the user. "

  As described above, in the fifth embodiment, since the guidance information notification unit 180 of the biometric authentication terminal 100B can notify the site to be acquired, the user can easily recognize the site for biometric authentication. it can.

(Sixth embodiment)
In the sixth embodiment, for example, an access log that acquires an access log to the biometric information storage unit 140 for registration used in the biometric information storage unit 140 used in the first to fifth embodiments. An acquisition unit is further provided.

  FIG. 12 is a schematic configuration diagram illustrating an example of a schematic configuration of a biometric authentication terminal 100C according to the sixth embodiment.

  For example, the sixth embodiment shown in FIG. 12 is different from the fifth embodiment shown in FIG. 10 in that an access analysis unit 185 is provided. Therefore, the access analysis unit 185, which is a different component from the other embodiments, will be described.

  The access analysis unit 185 acquires an access log to the biometric information storage unit 140 for registration provided in the biometric authentication server.

  For example, when the access biometric information storage unit 140 provided in the biometric authentication server is accessed, the access analysis unit 185 determines whether the access source is an access source for which access is permitted in advance. If the access source is an access source to which access is not permitted in advance, the registration biometric information of the user accessed from the access source is not used.

  FIG. 13 shows that, in the sixth embodiment, the access analysis unit 185 of the biometric authentication terminal 100C periodically monitors the access log to the biometric authentication registration biometric storage unit 140 of the biometric authentication server. It is explanatory drawing of the access log which showed the method of detecting the unauthorized access to the biometric information storage part for registration 140.

  As shown in FIG. 13, this access log includes columns for date / time, access source, access destination, user name, and access target.

  In FIG. 13, for example, when the date and time is July 4, 2013, 12:00 am, the registration biometric information storage unit 140 is stored in the hospital server (access source). Access history is described.

  In addition, a biometric authentication server in which a biometric information storage unit 140 for registration is stored from a pre-registered in-hospital server (access source) on July 4, 2013 at 12:00:10 The access history is described in (Access Destination).

  Moreover, the biometric information storage unit 140 for registration is stored from an unregistered server (access source) indicating a server other than a pre-registered server at 12:00:20 on July 4, 2013. A history of accessing a biometric authentication server (access destination) is described. As an access destination from the unregistered server, the user name of the access destination is “AAA”, and the access target is “identifier: 1” indicating biometric information for palm registration.

  Further, the history of accessing the in-hospital server (access destination) from the biometric authentication server (access source) at 12:00:30 on July 4, 2013 is described.

  In the sixth embodiment, when the access analysis unit 185 of the biometric authentication terminal 100C detects a history of accessing the biometric authentication server storing the biometric information storage unit 140 for registration from an unregistered server, the accessed user Use of name and access target is prohibited. In this case, the biometric information for registration that is an access target may be deleted, and an access restriction that prohibits future access may be provided.

  The access analysis unit 185 can also create a revocation list as a list of biometric information for registration prohibited from use, and manage the revocation history.

  FIG. 14 is an explanatory diagram when the access analysis unit 185 of the biometric authentication terminal 100C creates a revocation list from the access log in the sixth embodiment.

  As shown in FIG. 14, the revocation list includes columns for date and time, biometric information to be revoked, and users to be revoked.

  In FIG. 14, for example, the date and time is June 4, 2013, 10:20:50 am, “back of hand” of the user name “BBB” stored in the biometric authentication server biometric information storage unit 140 for registration. The history of deleting the biometric information for registration (biometric information) from the biometric information storage unit 140 for registration is described.

  In addition, the registration biometric of “palm” of the user name “AAA” stored in the biometric information storage unit 140 for registration of the biometric authentication server at 12:00 am 20 seconds on July 4, 2013 A history of deleting information (biological information) from the biometric information storage unit 140 for registration is described.

  Note that the revocation list is not limited to the one from which the biometric information for registration is deleted.

  As described above, in the sixth embodiment, the access analysis unit 185 of the biometric authentication terminal 100C uses the biometric information for registration of the user as unauthorized access when there is an access from an unregistered server. Since it can restrict | limit, the abuse by the leak of a user's biometric information can be prevented beforehand.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the equivalents thereof.

  Further, in the embodiment of the present invention, each step of the flowchart shows an example of processing that is performed in time series in the order described. The process to be executed is also included.

100, 100A, 100B, 100C Biometric authentication terminal (Biometric authentication device)
101 CPU
102 ROM
103 RAM
104 network interface unit 105 operation unit 106 display unit 107 storage unit 108 internal bus 110 biometric information reading unit 120 biometric information matching unit 130 biometric information acquisition unit for registration 140 biometric information storage unit for registration 150 authentication result notification unit 160 biometric information acquisition unit 165 Feature point extraction unit (feature information extraction unit)
170 Biometric information registration unit 175 Determination rule change unit 180 Guidance information notification unit 185 Access analysis unit

Claims (11)

A biometric authentication device that performs biometric authentication between biometric information for verification of a user who has received an authentication request and biometric information for registration of the registered user,
A biometric information acquisition unit for acquiring biometric information for collation of the user;
A feature information extraction unit that extracts a part of the feature information indicated by the biometric information for verification from the acquired biometric information for verification of the user according to a determination rule;
A biometric information registration unit that changes the extracted feature information as biometric information for registration of the user and registers the biometric information for registration;
A biometric authentication device. The decision rule is:
Among the predetermined range indicated by the biometric information for verification is a rule for determining a predetermined range,
The feature information extraction unit includes:
The predetermined range determined by the determination rule is extracted from a predetermined range indicated by the user biometric information for verification,
The biometric information registration unit
The biometric authentication device according to claim 1, wherein the extracted feature information in the predetermined range is changed as biometric information for registration of the user and registered in the biometric information storage unit for registration. The decision rule is:
A rule for randomly changing the predetermined range;
The feature information extraction unit includes:
The predetermined range changed by the determination rule is extracted from the predetermined range indicated by the user biometric information for verification,
The biometric information registration unit
The biometric authentication device according to claim 1, wherein the extracted characteristic information in the predetermined range is changed as biometric information for registration of the user and registered in the biometric information storage unit for registration. The decision rule is:
Including a rule for changing a portion to be authenticated as the biometric information for verification,
The biological information acquisition unit
In accordance with the decision rule, obtain biometric information for verification of the user of the changed site to be authenticated,
The feature information extraction unit includes:
Extracting part of the feature information indicated by the biometric information for collation according to the determination rule from the biometric information for collation of the user of the changed site to be authenticated,
The biometric information registration unit
The biometric authentication apparatus according to any one of claims 1 to 3, wherein the extracted feature information is changed as biometric information for registration of the user and registered in the biometric information storage unit for registration. The biological information acquisition unit
Obtaining authenticated biometric information for the user from a plurality of parts of the user,
The feature information extraction unit includes:
The biometric authentication according to any one of claims 1 to 4, wherein according to the determination rule, biometric information for registration of a part to be registered is alternatively selected from the obtained biometric information for verification of the plurality of parts. apparatus. The biological information acquisition unit
Obtaining authenticated biometric information for the user from a plurality of parts of the user,
The decision rule is:
Including a rule for combining biometric information for collation of two or more parts from the obtained biometric information for collation of the plurality of parts,
The feature information extraction unit includes:
A part of the feature information indicated by the biometric information for verification for each part is extracted for each part according to the determination rule,
The biometric information registration unit
The extracted feature information for each part is changed in combination with biometric information for collation of the two or more parts in accordance with the decision rule, and is registered as biometric information for registration of the user. The biometric authentication device according to item. A decision rule changing unit for changing the decision rule itself to be applied;
The decision rule changing unit
Change the decision rule to be applied after a certain period of time,
The biological information acquisition unit
In accordance with the changed decision rule, obtain biometric information for verification of the user of the site to be authenticated,
The feature information extraction unit includes:
From the acquired biometric information for verification of the user, a part of feature information indicated by the biometric information for verification is extracted according to the determination rule,
The biometric information registration unit
The biometric authentication device according to any one of claims 1 to 6, wherein the extracted feature information is changed as biometric information for registration of the user and registered in the biometric information storage unit for registration. The biometric authentication device according to any one of claims 1 to 7, further comprising a guide information notification unit configured to notify guide information for acquiring the biometric information for verification of the user from a plurality of parts of the user. An access log acquisition unit for acquiring an access log to the biometric information storage unit for registration;
The access log acquisition unit
In the access log that has accessed the biometric information storage unit for registration, it is determined whether or not the access source has been permitted access in advance, and there is an access from an access source that is not permitted access in the access log The biometric device according to any one of claims 1 to 8, wherein the biometric information for registration that is the access destination is restricted so that authentication using the biometric authentication information for registration is not performed. Authentication device. A biometric authentication system comprising a server and a biometric authentication terminal that performs biometric authentication of biometric information for verification of a user who has received an authentication request and biometric information for registration of the registered user.
A biometric information acquisition unit for acquiring biometric information for collation of the user;
A feature information extraction unit that extracts a part of the feature information indicated by the biometric information for verification from the acquired biometric information for verification of the user according to a determination rule;
A biometric information registration unit that changes the extracted feature information as biometric information for registration of the user and registers the biometric information for registration;
A biometric authentication system. The server includes the registration information storage unit,
The biometric authentication terminal is
The biometric information acquisition unit, the feature information extraction unit, and the biometric information registration unit;
A biometric authentication system according to claim 10.

Images