JP2017033481A - Authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a biological authentication system that can shorten time required for acquisition time of biological information even in a time zone when an in/out of persons is busy.SOLUTION: A biological information acquisition terminal 13 is configured to acquire biological information when entering a first AP area 16, and transmit the acquired biological information to an entering/leaving management server 10 via a first wireless AP 11. The entering/leaving management server 10 is configured to conduct collation of the biological information, generate a key with a deadline when a pre-registered entrance matches biological information on a permitted person, and transmit the key therewith to the biological information acquisition terminal 13 via the first wireless AP 11. When entering a second AP area 17, the biological information acquisition terminal 13 is configured to transmit the acquired key with the deadline to the entering/leaving management server 10 via a second wireless AP 12. The entering/leaving management server 10 is configured to conduct collation of the key with the deadline, and when a collation result matches the key with the deadline of the permitted person, and a deadline of the key with the deadline does not expire, transmit a lock-release instruction to a gate lock-release device 14, and lock-release the gate 15.SELECTED DRAWING: Figure 1

Description

  The present invention relates to speeding up biometric authentication processing in an authentication system.

  Biometric authentication processing is widely adopted that uses data such as personal fingerprints and irises when entering and leaving between buildings and areas where security is important, such as data centers.

  Since entry / exit processing with biometric authentication takes time compared to entry / exit processing using a magnetic card or the like, it is desired to speed up the entry / exit processing with biometric authentication.

  A technique for realizing high-speed biometric authentication processing is disclosed in Patent Document 1, for example.

  Specifically, the person who wants to enter the room is detected, the ID number is read from the wireless IC tag held by the person who wants to enter the room, the biometric information to be collated is stored in the collation table in advance, and then sent from the biometric authentication device. When it comes, the structure which collates with the biometric information stored in the collation table is disclosed.

JP 2007-66107 A

  Patent Document 1 discloses speeding-up of biometric information collation processing, but the most time-consuming step in entry / exit processing is a step of acquiring biometric information. Usually, a terminal that acquires biometric information is installed in the vicinity of an entrance / exit of an entry / exit management area (referred to as an entrance / exit management area), and an authentication process is performed when an entry / exit person inputs biometric information to the terminal. In a time zone in which people come and go, there is a case where a queue is created in front of a terminal that acquires biometric information and it takes time to enter and exit.

  The present specification discloses a biometric authentication system that can reduce the time required to acquire biometric information even in a time zone in which people come and go.

  Specifically, an authentication area is provided near the entrance / exit of the entrance / exit management area, a biometric information acquisition area is provided at a location away from the authentication area, and each authentication subject is provided with a portable biometric information acquisition terminal, The biometric information acquisition process is performed in the biometric information acquisition area.

  In addition, the biometric information acquisition area is composed of a wide range, and wearable devices such as smartphones, PCs, and smart glasses possessed by individuals are used as portable biometric information acquisition terminals. Perform acquisition processing while moving to.

  The biometric information is, for example, a fingerprint. By using a personal information processing device such as a smartphone having a biometric information acquisition function such as a fingerprint acquisition function and a wireless communication function, it is possible to perform biometric authentication processing more simply.

  According to the present invention, the waiting time at the time of entry / exit processing can be shortened.

Conceptual diagram of entry / exit management system Block diagram of entry / exit management system Block diagram of biometric information acquisition terminal Hardware block diagram of biometric information acquisition terminal Block diagram of entry / exit management server Biometric information database Biometric flow Door unlocking flow Flow chart of biometric information acquisition terminal in first AP area Flow chart of biometric information acquisition terminal in second AP area Flow chart of entry / exit management server during biometric authentication processing Flow chart of the entry / exit management server at the time of unlocking authentication processing

  Hereinafter, examples will be described with reference to the drawings.

  FIG. 1 is a conceptual diagram of an entry / exit management system, and FIG. 2 is a block diagram thereof. Reference numerals 11 and 12 are wireless LAN access points (hereinafter, the access points are referred to as APs), and the accessible areas thereof are indicated by dotted lines in FIG. 1, and biometric information acquisition areas (first AP areas) 16, respectively. This is called an authentication area (referred to as a second AP area) 17. In addition, it is configured to include a portable biological information acquisition terminal 13, an entrance / exit management server 10, a gate unlocking device 14, and a gate 15.

  When the biometric information acquisition terminal 13 enters the first AP area 16 and acquires biometric information, it transmits the authentication information (biometric information and ID) to the entry / exit management server 10 via the first wireless AP 11. ID is an identifier of the biometric information acquisition terminal 13.

  The entry / exit management server 10 collates the biometric information, and if it matches the biometric information of a person who has been registered in advance, a temporary key (referred to as a time-limited key) is generated. It transmits to the biometric information acquisition terminal 13 via the wireless AP 11.

  When the biometric information acquisition terminal 13 enters the second AP area 17, the acquired time-limited key is transmitted to the entry / exit management server 10 via the second wireless AP 12 as authenticated information (time-limited key and ID). .

  The entry / exit management server 10 collates keys with time limits. If the collation result matches the key with the time limit of the person permitted to enter and the key with the time limit has not expired, an unlocking instruction is transmitted to the gate unlocking device 14 and the gate 15 is unlocked. .

  FIG. 3 is a block diagram of the biometric information acquisition terminal 13. The biometric information acquisition terminal 13 displays a wireless antenna 130 that performs radio communication with the first wireless AP 11 and the second wireless AP 12, a biometric information acquisition terminal control unit 131, an authentication information storage unit 132, a biometric information reader 133, an authentication state, and the like. A display unit 134 and a wireless control unit 138 are included.

  FIG. 4 is a hardware block diagram of the biometric information acquisition terminal 13. The hardware of the biometric information acquisition terminal 13 includes a radio antenna 130, a CPU 135, a memory 136, a power source 137, a biometric information reader 133, a display unit 134, and a radio control unit 138.

  The functional units of the biometric information acquisition terminal control unit 131 and the authentication information storage unit 132 illustrated in FIG. 3 are realized by the CPU 135 illustrated in FIG. 4 executing a program stored in the memory 136.

  When the biometric information acquisition terminal 13 enters the first AP area 16, it acquires biometric information. If the biometric information acquisition is successful, the biometric information acquisition terminal 13 and the ID unique to the biometric information acquisition terminal 13 stored in the authentication information storage unit 132 are used for authentication. Information (biological information and ID) is sent from the wireless antenna 130 to the entry / exit management server 10 via the first wireless AP 11 as shown in FIG.

  When the biometric information collation is completed in the entry / exit management server 10, a key with a time limit is sent from the entry / exit management server 10 to the biometric information acquisition terminal 13 via the first wireless AP 11. The biometric information acquisition terminal 13 stores the received key with a time limit in the authentication information storage unit 132.

  When the biometric information acquisition terminal 13 enters the second AP area 17, authenticated information (time-limited key and ID) is stored with a time-limited key stored in the authentication information storage unit 132 and an ID unique to the biometric information acquisition terminal 13. 3 is sent from the wireless antenna 130 to the entry / exit management server 10 via the second wireless AP 12.

  FIG. 5 is a functional block diagram of the entry / exit management server 10. The entry / exit management server 10 includes an entry / exit management server control unit 100, an authentication information verification unit 101, an authentication information storage unit 102, a key generation unit 103 with a time limit, and a gate unlocking control unit 104.

  Each processing unit of the entry / exit management server 10 shown in FIG. 5 is realized by the CPU executing a program stored in the memory in a general computer including the CPU and the memory, and implements the processing described below. .

  When the entry / exit management server 10 receives the authentication information (biological information and ID) from the biometric information acquisition terminal 13, the verification source authentication information (biological information and ID) stored in the authentication information storage unit 102 in FIG. Are verified by the authentication information verification unit 101.

  When the authentication information (biometric information and ID) matches, the time-limited key generation unit 103 generates a time-limited key. The generated key with time limit is transmitted to the biometric information acquisition terminal 13 and stored in the authentication information storage unit 102 in association with the ID.

  When the entry / exit management server 10 receives the authenticated information (time-limited key and ID) from the biometric information acquisition terminal 13, it is stored in the received authenticated information (time-limited key and ID) and the authentication information storage unit 102. The authentication information verification unit 101 verifies the verified information (key and ID with time limit) of the verification source.

  When the ID and the key with time limit match, the gate unlock control unit 104 controls the gate unlock device 14 to unlock the gate.

  FIG. 6 is a biometric information database included in the authentication information storage unit 102. The biometric information database includes a plurality of entries EN1, EN2, EN3,... ENn representing the correspondence relationship between ID1, biometric information 2, key 3, and key expiration date 4.

  ID1 and biometric information 2 are managed by a security administrator or the like and stored in advance. The key 3 and the key expiration date 4 are stored when the authentication information (biological information and ID) matches and the key with a time limit is issued by the entry / exit management server 10.

  When the key expires, the key 3 and the key expiration date 4 are deleted.

  FIG. 7 is a sequence diagram showing movements of the biometric information acquisition terminal 13, the first wireless AP 11, and the entry / exit management server 10 during the biometric authentication process.

  When the biometric information acquisition terminal 13 enters the first AP area 16, the first AP area entry notification that is repeatedly transmitted from the first wireless AP 11 is received. The biometric information acquisition terminal 13 that has received the first AP area entry notification M100 transmits an authentication start permission notification M101 to the entry / exit management server 10 via the first wireless AP 11.

  Upon receipt of the authentication start permission notification M101, the entry / exit management server 10 transmits an authentication start notification M102 to the biometric information acquisition terminal 13.

  When the biometric information acquisition terminal 13 receives the authentication start notification M102, “Enter biometric information on the display unit 134 in FIG. A message prompting the user who wants to enter the site to input biometric information is displayed to obtain biometric information (M103).

  When the biometric information acquisition terminal 13 acquires the biometric information, the biometric information acquisition terminal 13 transmits authentication information (biometric information and ID) M104 to the entry / exit management server 10 through the first wireless AP 11 together with an ID unique to the biometric information acquisition terminal 13.

  Upon receipt of the authentication information (biological information and ID) M104, the entry / exit management server 10 collates the authentication information (biological information and ID), and when the authentication is completed (M105), a key with a time limit is generated (M106). ) Store and hold the time-limited key in the entry / exit management server 10 (M107). Further, a key with a time limit is transmitted to the biometric information acquisition terminal 13 via the first wireless AP 11 (M108).

  The biometric information acquisition terminal 13 that has received the key with a time limit holds the key with a time limit (M109), and the biometric authentication is completed (M110).

  FIG. 8 is a sequence diagram showing the movement of the biometric information acquisition terminal 13, the second wireless AP 12, and the entry / exit management server 10 at the time of gate unlocking.

  When the biometric information acquisition terminal 13 enters the second AP area 17, the second AP area entry notification M120 that is repeatedly transmitted from the second wireless AP 12 is received. The biometric information acquisition terminal 13 that has received the second AP area entry notification transmits an unlocking application notification M121 to the entry / exit management server 10 via the second wireless AP 12.

  Upon receipt of the unlock application notification M121, the entry / exit management server 10 transmits an unlock authentication start notification M122 to the biometric information acquisition terminal 13.

  When the biometric information acquisition terminal 13 receives the unlock authentication start notification M122, the biometric information acquisition terminal 13 transmits authenticated information (a key and ID with a time limit) M123 to the entry / exit management server 10 via the second wireless AP 12.

  The entry / exit management server 10 that has received the authenticated information (time-limited key and ID) collates the authenticated information (time-limited key and ID). If the authentication is successful, an unlock authentication completion notification M125 is transmitted to the biometric information acquisition terminal 13 via M124 and the second wireless AP 12. If authentication fails, an authentication failure notification is sent. Since the biometric information acquisition terminal 13 has already acquired the authenticated information based on the authentication information acquired in the first AP area 16 from the entry / exit management server 10, the biometric information acquisition terminal 13 immediately starts the matching process M124 in the second AP area 17. it can.

  Further, since the verification process M124 for authenticated information can be performed in a shorter time than the verification process for authentication information (ie, the biometric information verification process) M105 in FIG. 7, it is compared with the case where the biometric information authentication process is performed in the authentication area. , Congestion can be further reduced.

  Upon receiving the unlocking authentication completion notification M125, the biometric information acquisition terminal 13 displays “Unlocking authentication completed” on the display unit 134 in FIG. A message indicating that unlocking authentication has been completed is displayed (M126).

  In addition, the entry / exit management server 10 that has transmitted the unlock authentication completion notification M125 unlocks the gate 15 (M127). If authentication fails, the gate will not unlock.

  The process of the biological information acquisition terminal 13 will be described with reference to FIGS. The process described below is realized by the CPU 135 shown in FIG. 4 executing a program stored in the memory 136.

  FIG. 9 is a flowchart regarding the operation in the first AP area 16 of the biological information acquisition terminal 13. First, it is checked whether the biometric information acquisition terminal 13 enters the first AP area 16 and receives the first AP area entry notification M100 of FIG. 7 repeatedly transmitted from the first wireless AP 11 (S100). When the AP area entry notification M100 is received (YES in S100), the authentication start permission notification M101 of FIG. 7 is transmitted to the entry / exit management server 10 (S101). When the biometric information acquisition terminal 13 does not receive the first AP area entry notification M100 (NO in S100), the process of S100 is repeated until the first AP area entry notification M100 is received.

  The biometric information acquisition terminal 13 that has transmitted the authentication start permission notification M101 checks whether the authentication start notification M102 of FIG. 7 has been received from the entry / exit management server 10 within a predetermined period T1 (S102). When the authentication start notification M102 is received within the period T1 (YES in S102), a display prompting input of biometric information is displayed on the display unit, and when the authentication start notification M102 is not received within the period T (NO in S102), S100 Return to the process.

  The biometric information acquisition terminal 13 that has received the authentication start notification M102 checks whether the biometric information has been acquired normally (S104). If the biological information can be normally acquired within the period T2 (YES in S104), the authentication information (biological information and ID) transmission M104 of FIG. 7 is performed to the entry / exit management server 10, and the biological information is acquired within the period T2. If it cannot be acquired normally (NO in S104), the process returns to S100.

  The biometric information acquisition terminal 13 that has performed authentication information (biometric information and ID) transmission M104 checks whether a key with a time limit is received within the period T3 from the entry / exit management server 10 (S106). When the time-limited key is received within the period T3 (YES in S106), the time-limited key is stored in the authentication information storage unit 132 (S107). If no time-limited key is received within the period T3 (NO in S106), the process returns to S100.

  FIG. 10 is a flowchart regarding the operation of the biometric information acquisition terminal 13 in the second AP area 17. The biometric information acquisition terminal 13 storing the time-limited key checks whether it has received the second AP area entry notification M120 of FIG. 8 repeatedly transmitted from the second wireless AP 12 during the period until the expiration date of the time-limited key expires. Perform (S110, S111). If the second AP area entry notification M120 is received before the expiration date of the key with a time limit (YES in S110), the unlock application notification M121 of FIG. 8 is transmitted to the entry / exit management server 10 (S112). When the expiration date of the key with a time limit expires before receiving the second AP area entry notification M120 (NO in S111), the process returns to S108 in FIG. 9 to discard the key with the time limit, and in S100 of FIG. Return to processing.

  The biometric information acquisition terminal 13 that has transmitted the unlocking application notification M121 to the entry / exit management server 10 checks whether or not the unlocking authentication start notification M122 of FIG. 8 has been received from the entry / exit management server 10 within the period T4 (S113). . If the unlock authentication notification M122 is received within the period T4 (YES in S113), the authenticated information (key with time limit and ID) is transmitted to the entry / exit management server 10 (S114). If the unlock authentication notification M122 is not received within the period T4 (NO in S113), the time-limited key in FIG. 10 is discarded (S108), and the process returns to S100 in FIG.

  The biometric information acquisition terminal 13 that has transmitted the authenticated information (time-limited key and ID) to the entry / exit management server 10 checks whether the unlock authentication completion notification M125 of FIG. 8 has been received from the entry / exit management server 10 within the period T5. (S115). When the unlocking authentication completion notification M125 is received within the period T5 (YES in S115), “Unlocking authentication is complete” is displayed on the display unit 134 of FIG. A message indicating that unlocking authentication has been completed is displayed (S116). If the unlock authentication completion notification M125 is not received within the period T5 (NO in S115), a message such as “Authentication did not end normally” is displayed on the display unit 134 in FIG. 3 (S117). Returning to FIG. 9, the time-limited key of FIG. 10 is discarded (S108), and the process returns to S100.

  The processing of the entry / exit management server 10 will be described with reference to FIGS. The processing described below is realized by the CPU executing a program stored in the memory in the computer.

  FIG. 11 is a flowchart relating to the biometric authentication process of the entry / exit management server 10. The entrance / exit management server 10 checks whether the authentication start permission notification M101 of FIG. 7 is received from the biometric information acquisition terminal 13 (S120). When the authentication start permission notification M101 is received (YES in S120), the authentication start notification M102 of FIG. 7 is transmitted to the biometric information acquisition terminal 13 via the first wireless AP 11. If the authentication start permission notification M101 has not been received (NO in S120), the process of S120 in FIG. 11 is repeated.

  It is checked whether the entry / exit management server 10 has received (biometric information and ID) within the period T10 from the biometric information acquisition terminal 13 that has transmitted the authentication start notification M102 (S122). When the authentication information (biological information and ID) is received within the period T10, the received authentication information (biological information and ID) is stored in the authentication information verification unit 101 (S123), and verification is performed from the authentication information storage unit 102. The target authentication information (biological information and ID) is stored in the authentication information collating unit 101 (S124), and the authentication information (biological information and ID) is collated (S125). If the authentication information (biological information and ID) is not received within the period T10 in FIG. 11, the process returns to the process of S120 in FIG.

  It is checked whether the authentication information matches as a result of the verification of the authentication information (biological information and ID) (S126). If the authentication information matches, the time-limited key generation unit 103 generates a time-limited key associated with the ID, stores it in the authentication information storage unit 102 (S127), and transmits the time-limited key to the biometric information acquisition terminal 13. Then, the authentication information (biometric information and ID) stored in the authentication information collating unit 101 is discarded (S129), and the process returns to S120 in FIG. If the authentication information does not match, the authentication information (biometric information and ID) stored in the authentication information verification unit 101 is discarded (S129), and the process returns to S120 in FIG.

  FIG. 12 is a flowchart regarding the unlocking authentication process of the entry / exit management server 10. The entrance / exit management server 10 checks whether the unlock application notification M121 of FIG. 8 has been received from the biometric information acquisition terminal 13 (S130). When the unlock application notification M121 is received, the unlock authentication start notification M122 of FIG. 8 is transmitted to the biometric information acquisition terminal 13 via the second wireless AP 12 (S131). If the unlock application notification M121 has not been received, the process of S130 is repeated.

  It is checked whether the entry / exit management server 10 has received the authenticated information (time-limited key and ID) within the period T11 from the biometric information acquisition terminal 13 that has transmitted the unlock authentication start notification M122 (S132). When the authenticated information (time-limited key and ID) is received, the authenticated information (time-limited key and ID) is stored in the authentication information matching unit 101 (S133), and the authenticated information to be verified from the authentication information storage unit 102 (Time-limited key and ID) are stored in the authentication information collating unit 101 (S134), and the authenticated information (time-limited key and ID) in FIG. 12 is collated (S135).

  The verification result of the authenticated information (time-limited key and ID) in FIG. 12 is checked (S136). If they match, the unlocking authentication completion notification M125 in FIG. 8 is sent to the biometric information acquisition terminal 13 (S137). An unlocking instruction is transmitted from the gate unlocking control unit 104 to the gate opening / closing unit 14 (S138), and the authenticated information (key with time limit and ID) stored in the authentication information matching unit 101 is discarded (S139). The process returns to the process of S130. If the authentication results do not match, the authenticated information (time-limited key and ID) stored in the authentication information matching unit 101 is discarded (S139), and the process returns to S130 in FIG.

  The entry / exit management server 10 performs a plurality of processes shown in FIGS. 11 and 12 in parallel.

10: entry / exit management server, 11: first wireless AP, 12: second wireless AP, 13: biometric information acquisition terminal, 14: gate unlocking device, 15: gate, 100: entry / exit management server control unit, 101: Authentication information verification unit, 102: Authentication information storage unit, 103: Key generation unit with time limit, 104: Gate unlocking control unit, 130: Wireless antenna, 131: Biometric information acquisition terminal control unit, 132: Authentication information storage unit, 133 : Biometric information reader 134: Display unit 135: CPU 136: Memory 137: Power source 138: Wireless control unit

Claims (4)

An entrance / exit management server for managing entrance to the entrance / exit management area;
An information acquisition terminal for authentication;
A first wireless access point that constitutes an authentication information acquisition area that uses the authentication information acquisition terminal;
A second wireless access point that constitutes an authentication area that uses the authentication information acquisition terminal,
The authentication information acquisition terminal acquires authentication information from a person to be authenticated in the authentication information acquisition area, and transmits the authentication information to the entry / exit management server.
The entrance / exit management server collates the acquired authentication information with a pre-registered authentication information of a person permitted to enter,
If authentication is successful in the verification, authenticated information is generated and transmitted to the authentication information acquisition terminal,
The authentication information acquisition terminal is
The acquired authenticated information is transmitted to the entry / exit management server within the authentication area,
The entry / exit management server collates the transmitted authenticated information with the transmitted authenticated information. The authentication system according to claim 1,
The authentication information acquisition terminal is
Obtaining the authenticated information in the authentication information acquisition area;
An authentication system, wherein the authenticated information is transmitted to the entry / exit management server within the authentication area. The authentication system according to claim 1 or 2,
The second wireless access point configures the authentication area near the entrance / exit of the entry / exit area,
The authentication system according to claim 1, wherein the first wireless access point forms an authentication information acquisition area wider than the authentication area at a distance from the entrance / exit to the authentication area. The authentication system according to any one of claims 1 to 3,
The authentication information is biometric information,
The authentication system, wherein the authenticated information is a key with a time limit.

Images