JP2019139431A - Authentication system, authentication method and program - Google Patents

Abstract

To provide a technology that balances the simplification of a process of registering people capable of entering a restricted area and the maintenance of security strength.SOLUTION: An authentication system 1 includes: an acquisition part 210 for acquiring personal identification information of a person to be authenticated; an authentication processing part 220 for executing an authentication process for determining whether or not the person to be authenticated is permitted to enter a target area based on a result of collation between personal identification information and registration information registered in advance; and a registration processing part 110 for additionally registering the personal identification information used for the authentication process as registration information of a first person on the condition that the personal identification information of a specific person is acquired within a first predetermined time from a failure of the authentication process if the authentication process using the personal identification information of the first person fails.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technique for managing entrance to a predetermined area by performing personal authentication.

  As an example of the above-described technique, the following technique is disclosed in Patent Document 1 below. In the technique of Patent Document 1, when identification information of a person who is authorized to pass through in the restricted access area is authenticated, identification information of a person who is not authorized to enter the restricted access area is acquired within a certain time limit. The identification information is registered as “temporary passerby”. As a result, a person who does not have the right to pass through the restricted entry area can temporarily pass through the restricted entry area.

JP 2010-26733 A

  According to the technique of Patent Document 1, a person who can enter the entrance restricted area can be easily registered. On the other hand, there is a possibility that a malicious person may be illegally registered as a temporary passer-by for a certain period of time after the authorized person is authenticated.

  The present invention has been made in view of the above problems. One of the objects of the present invention is to provide a technology that achieves both simplification of the process of registering a person who can enter an area with entry restrictions and maintenance of security strength.

According to the present invention,
Obtaining means for obtaining personal identification information of the person to be authenticated;
An authentication processing means for executing an authentication process for determining whether or not the person to be authenticated is permitted to enter the target area based on a collation result between the personal identification information and registered information registered in advance;
If the authentication process using the personal identification information of the first person fails, the authentication process is performed on the condition that the personal identification information of the specific person is acquired within the first predetermined time from the failure of the authentication process. Registration processing means for additionally registering the used personal identification information as registration information of the first person;
An authentication system is provided.

According to the present invention,
At least one computer
Obtain personal identification information of the person to be authenticated,
Performing an authentication process for determining whether or not the person to be authenticated is permitted to enter the target area based on a collation result between the personal identification information and pre-registered registration information;
If the authentication process using the personal identification information of the first person fails, the authentication process is performed on the condition that the personal identification information of the specific person is acquired within the first predetermined time from the failure of the authentication process. Additionally registering the used personal identification information as registration information of the first person,
An authentication method including the above is provided.

According to the present invention,
A program for causing a computer to execute the above-described authentication method is provided.

  According to the present invention, it is possible to achieve both simplification of the process of registering a person who can enter a restricted area and maintenance of security strength.

It is a block diagram which shows notionally the structure of the authentication system in 1st Embodiment. It is a block diagram which illustrates the hardware constitutions of the authentication system concerning a 1st embodiment. It is a flowchart which illustrates the flow of the process performed by the authentication terminal which concerns on 1st Embodiment. It is a figure which shows an example of the information which a database memorize | stores. It is a flowchart which illustrates the flow of the process performed by the information processing apparatus which concerns on 1st Embodiment. It is a figure for demonstrating the specific example of the additional registration process of the registration information by a registration process part. It is a flowchart which illustrates the flow of the process performed by the information processing apparatus which concerns on 2nd Embodiment. It is a block diagram which shows notionally the structure of the authentication system in 3rd Embodiment. 10 is a flowchart illustrating a flow of processing executed by the information processing apparatus according to the third embodiment. It is a figure which shows an example of the table which memorize | stores the destination information of the terminal of a specific person. It is a figure which shows an example of approval waiting information.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In all the drawings, the same reference numerals are given to the same components, and the description will be omitted as appropriate. Also, unless otherwise specified, in each block diagram, each block represents a functional unit configuration, not a hardware unit configuration.

[First Embodiment]
〔System configuration〕
FIG. 1 is a block diagram conceptually showing the configuration of the authentication system 1 in the first embodiment. As shown in FIG. 1, the authentication system 1 includes an information processing apparatus 10 and an authentication terminal 20 that is communicably connected to the information processing apparatus 10. Note that the authentication system 1 is not limited to the example in the figure, and a plurality of authentication terminals 20 may be connected to the information processing apparatus 10 so as to communicate with each other.

  For example, the authentication terminal 20 is provided in the vicinity of a target area where only authorized persons can enter. The authentication terminal 20 determines whether or not to allow entry into the target area according to the result of the authentication process for the person who wishes to enter the target area. As illustrated in FIG. 1, the authentication terminal 20 includes an acquisition unit 210, a control unit 230, an authentication processing unit 220, and a database 222.

  The acquisition unit 210 acquires personal identification information of a person who wishes to enter the target area (person to be authenticated). The personal identification information acquired by the acquisition unit 210 is used for authentication processing in the authentication processing unit 220.

  The authentication processing unit 220 executes an authentication process using the personal identification information acquired by the acquisition unit 210. Specifically, the authentication processing unit 220 collates the personal identification information acquired by the acquisition unit 210 with registered information registered in advance, thereby allowing the person to be authenticated to enter the target area. It is determined whether or not. Here, the registration information is personal identification information registered in advance in the database 222. By registering personal identification information of a certain person in the database 222 in advance as registration information, the person becomes “a person who is permitted to enter the target area corresponding to the authentication terminal 20”. For example, the registration information is generated according to a prior registration application and registered in the database 222.

  The control unit 230 controls the operation of a security device (not shown) that restricts entry into the target area according to the result of the authentication processing by the authentication processing unit 220. Security devices that restrict entry into the target area are, for example, electronic locks and entry gates. When the person to be authenticated is authenticated (that is, when it is determined that the person to be permitted to enter the target area), the authentication terminal 20 cancels the entrance restriction by the security device. As a result, the person to be authenticated can enter the target area.

  In some cases, the registration information of the person to be authenticated is not registered in the database 222 in advance. For example, when there is a sudden visitor, the registration application may not be in time, and the registration information of the visitor may not be prepared in the database 222. In this case, the visitor cannot enter the target area. In addition, when a regular admission application procedure is performed, it takes time to prepare registration information for the visitor in the database 222. The information processing apparatus 10 includes a registration processing unit 110 that can easily register registration information of a person whose registration information is not registered.

  First, when the authentication process using the personal identification information of a certain person to be authenticated (first person) fails, the authentication processing unit 220 transmits the personal identification information of the first person to the registration processing unit 110. . If the personal identification information of the specific person is acquired by the acquisition unit 210 within the first predetermined time after the failure of the authentication process of the first person, the registration processing unit 110 displays the personal identification information used in the authentication process. It is additionally registered in the database 222 as “first person registration information”. The specific person is a person designated in advance as a person who can execute the additional registration processing by the registration processing unit 110. Although not particularly limited, for example, a manager of the target area or a person in charge of a meeting held in the target area can be designated as the specific person.

  As described above, in the present embodiment, when the first person authentication fails because there is no registration information to be verified, the personal identification information used for the authentication is the personal identification information of the specific person within a predetermined time. On the condition that it is read, it is additionally registered as registration information of the first person. According to the present embodiment, it is possible to additionally register a person who can enter the target area with a simple operation of reading the personal identification information of the specific person. Further, in the present embodiment, the personal identification information of the specific person is acquired at a time later than the personal identification information of the first person who has failed in authentication. As a condition for additional registration. As a result, even if a malicious person performs a secret behind a specific person in order to illegally obtain permission to enter an area where only authorized persons can enter, the personal identification information of that person is registered It is not registered as information. That is, according to the present embodiment, it is possible to achieve both simplification of the process of registering a person who can enter an area with entrance restriction and maintenance of security strength.

  Hereinafter, this embodiment will be described in more detail.

[Hardware configuration]
Each functional component of each device constituting the authentication system 1 may be realized by hardware (eg, a hard-wired electronic circuit) that implements each functional component, or between hardware and software. It may be realized by a combination (for example, a combination of an electronic circuit and a program for controlling the electronic circuit). Hereinafter, the case where each functional component of each device constituting the authentication system 1 is realized by a combination of hardware and software will be further described with reference to FIG. FIG. 2 is a block diagram illustrating a hardware configuration of the authentication system 1 according to the first embodiment.

<Hardware Configuration of Information Processing Apparatus 10>
As illustrated in FIG. 2, the information processing apparatus 10 includes a bus 1002, a processor 1004, a memory 1006, a storage device 1008, an input / output interface 1010, and a network interface 1012.

  A bus 1002 is a data transmission path through which the processor 1004, the memory 1006, the storage device 1008, the input / output interface 1010, and the network interface 1012 transmit / receive data to / from each other. However, the method of connecting the processors 1004 and the like to each other is not limited to bus connection.

  The processor 1004 is a processor realized by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), or the like.

  The memory 1006 is a main storage device realized by a RAM (Random Access Memory) or the like.

  The storage device 1008 is an auxiliary storage device realized by an HDD (Hard Disk Drive), an SSD (Solid State Drive), a memory card, a ROM (Read Only Memory), or the like. The storage device 1008 stores program modules that implement the functions of the information processing apparatus 10 (such as the registration processing unit 110). The processor 1004 reads each program module into the memory 1006 and executes it, thereby realizing each function corresponding to the program module.

  The input / output interface 1010 is an interface for connecting the information processing apparatus 10 and various input / output devices. For example, an input device such as a mouse or a keyboard or an output device such as a display is connected to the input / output interface 1010.

  The network interface 1012 is an interface for connecting the information processing apparatus 10 to a network. This network is, for example, a local area network (LAN) or a wide area network (WAN). The method of connecting the network interface 1012 to the network may be a wireless connection or a wired connection. The information processing apparatus 10 is communicably connected to at least one or more authentication terminals 20 via the network interface 1012.

<Hardware configuration of authentication terminal 20>
As illustrated in FIG. 2, the authentication terminal 20 includes a bus 2002, a processor 2004, a memory 2006, a storage device 2008, an input / output interface 2010, and a network interface 2012.

  A bus 2002 is a data transmission path through which the processor 2004, the memory 2006, the storage device 2008, the input / output interface 2010, and the network interface 2012 transmit / receive data to / from each other. However, the method of connecting the processors 2004 and the like is not limited to bus connection.

  The processor 2004 is a processor realized by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), or the like.

  The memory 2006 is a main storage device realized by a RAM (Random Access Memory) or the like.

  The storage device 2008 is an auxiliary storage device realized by a hard disk drive (HDD), a solid state drive (SSD), a memory card, a read only memory (ROM), or the like. The storage device 2008 stores program modules that implement the functions of the authentication terminal 20 (such as the acquisition unit 210, the authentication processing unit 220, and the control unit 230). The processor 2004 reads each program module into the memory 2006 and executes it, thereby realizing each function corresponding to the program module. The storage device 2008 also serves as the database 222.

  The input / output interface 2010 is an interface for connecting the authentication terminal 20 and various input / output devices. In the example of FIG. 2, a reading device 212 or an imaging device 214 is connected to the input / output interface 2010. The reading device 212 is a device that reads personal identification information stored in the tangible medium 30. The tangible medium 30 only needs to store information that can be personal identification information. Although not particularly limited, a specific example of the tangible medium 30 is a card-type storage medium (magnetic card or IC card) owned by each person. The imaging device 214 is a device that generates an image including personal biological information such as a face, an iris, or a vein. Although not shown, the input / output interface 2010 may be further connected with a fingerprint sensor for reading a fingerprint, a microphone for acquiring voice for voiceprint authentication, and the like. In addition, the input / output interface 2010 is connected to an input device such as a mouse and a keyboard and an output device such as a display.

  The network interface 2012 is an interface for connecting the authentication terminal 20 to the network. This network is, for example, a local area network (LAN) or a wide area network (WAN). A method of connecting the network interface 2012 to the network may be a wireless connection or a wired connection. The authentication terminal 20 is communicably connected to the information processing apparatus 10 via the network interface 2012. The authentication terminal 20 is connected to a security device 232 such as an electronic lock or an entrance gate via the network interface 2012.

  Note that the hardware configuration illustrated in FIG. 2 is merely an example. The hardware configuration of the authentication system 1 is not limited to the example of FIG.

[Operation example]
A flow of processing of the authentication system 1 according to the present embodiment will be described.

<Processing of Authentication Terminal 20>
First, the flow of processing executed by the authentication terminal 20 will be described with reference to FIG. FIG. 3 is a flowchart illustrating the flow of processing executed by the authentication terminal 20 according to the first embodiment.

  The acquisition unit 210 acquires personal identification information of the person to be authenticated using the reading device 212, the imaging device 214, and the like (S102). The acquisition unit 210 passes the acquired personal identification information to the authentication processing unit 220.

  The authentication processing unit 220 performs an authentication process using the personal identification information acquired by the acquisition unit 210 (S104). For example, the authentication processing unit 220 searches for registration information corresponding to the acquired personal identification information from the database 222 illustrated in FIG.

  FIG. 4 is a diagram illustrating an example of information stored in the database 222. The database 222 illustrated in FIG. 4 stores an ID (Identifier), a specific person flag, approver information, an approval time, and an authentication time in association with each other.

  The ID stored in the database 222 is an example of registration information. In this case, for example, the authentication processing unit 220 collates the ID (individual identification information) read from the tangible medium 30 by the acquisition unit 210 with the reading device 212 and the ID (registration information) stored in the database 222. To do. Then, the authentication processing unit 220 can determine whether or not the person to be authenticated is permitted to enter the target area according to the ID collation result. Instead of the ID in FIG. 4, biometric information (for example, a human face image or a feature amount that can be extracted from the face image) may be stored as registration information. In this case, the authentication processing unit 220 collates the biometric information (personal identification information) acquired by the acquisition unit 210 using the imaging device 214 with the biometric information (registered information) stored in the database 222. Then, the authentication processing unit 220 can determine whether or not the person to be authenticated is permitted to enter the target area according to the collation result of the biometric information.

  The specific person flag is an example of information indicating whether or not the person is a person who can execute additional registration processing by a registration processing unit 110 described later. In the example of FIG. 4, it can be seen that the person with ID “01020304” is a specific person, and the person with ID “01020708” is not a specific person.

  The approver information is information indicating a specific person who approved the additional registration processing by the registration processing unit 110 described later. The approval time is information indicating the time when personal identification information of a person who failed to be authenticated is additionally registered as registration information by an additional registration process by the registration processing unit 110 described later.

  The authentication time indicates the time when the authentication of the person to be authenticated was successful. The authentication time is stored in the database 222 as follows, for example. First, when the authentication target person is successfully authenticated (corresponding registration information is found), the authentication processing unit 220 acquires the time when the authentication is successful and notifies the control unit 230 of the time. The control unit 230 stores the notified time in the database 222.

  Returning to FIG. 3, the control unit 230 controls the security device 232 such as an electronic lock or an entrance gate according to the result of the authentication processing by the authentication processing unit 220 (S <b> 106). For example, when the authentication process succeeds in authenticating the person to be authenticated, the control unit 230 cancels the entrance restriction by the security device 232 such as an electronic lock or an entrance gate. As a result, the person to be authenticated can enter the target area. On the other hand, when the authentication processing by the authentication processing unit 220 is “authentication failure”, the control unit 230 does not release the entrance restriction by the security device 232 such as an electronic lock or an entrance gate.

  Further, the control unit 230 transmits information corresponding to the result of the authentication processing by the authentication processing unit 220 to the information processing apparatus 10. Specifically, when the authentication process using the personal identification information acquired in the process of S102 fails (S108: NO), the control unit 230 determines the personal identification information (personal identification information of the person who has failed authentication). Is transmitted to the information processing apparatus 10 (S110). In this case, the control unit 230 associates information indicating “personal identification information of a person who has failed authentication” with the personal identification information transmitted to the information processing apparatus 10. Further, when the authentication process using the personal identification information acquired in the process of S102 is successful (S108: YES), the control unit 230 further determines whether or not the authenticated person is a specific person (S112). ). As an example, the control unit 230 determines whether or not the specific flag associated with the registration information specified from the database 222 is “present”. The control unit 230 can determine that the authenticated person is a specific person when the “specific person flag” associated with the registration information is “Yes”. When the authenticated person is the specific person (S112: YES), the control unit 230 transmits the personal identification information (the personal identification information of the specific person) acquired in the process of S102 to the information processing apparatus 10 (S114). . In this case, the control unit 230 associates information indicating “personal identification information of a specific person” with the personal identification information transmitted to the information processing apparatus 10. On the other hand, when the authenticated person is not a specific person (S120: NO), the control unit 230 does not execute the process of S114 described above.

<Processing of Information Processing Device 10>
Next, the flow of processing executed by the information processing apparatus 10 will be described with reference to FIG. FIG. 5 is a flowchart illustrating the flow of processing executed by the information processing apparatus 10 according to the first embodiment.

  The registration processing unit 110 determines whether or not the personal identification information of the person who has failed in authentication has been acquired from the authentication terminal 20 (S202). In the registration processing unit 110, for example, the personal identification information acquired from the authentication terminal 20 based on the information associated with the personal identification information in the processing of S110 described above is “personal identification information of a person who has failed authentication”. It can be determined whether or not. In addition, when the information processing apparatus 10 has a database similar to the database illustrated in FIG. 4, the registration processing unit 110 authenticates the authentication terminal based on the collation result with the registration information stored in the database. It is also possible to determine whether or not the personal identification information acquired from 20 is “personal identification information of a person who has failed authentication”. When the personal identification information acquired from the authentication terminal 20 is not “personal identification information of a person who has failed authentication” (S202: NO), the processing described below is not executed. In this case, the registration processing unit 110 stands by until the personal identification information of the person who has failed authentication is acquired.

When the personal identification information of the person who failed the authentication is acquired (S202: YES), it is further determined whether or not the personal identification information of the specific person is further acquired from the authentication terminal 20 (S204). For example, the registration processing unit 110 determines whether or not the personal identification information acquired from the authentication terminal 20 is “personal identification information of a specific person” based on the information associated with the personal identification information in the process of S114 described above. Can be determined. In addition, when the information processing apparatus 10 has a database similar to the database illustrated in FIG. 4, the registration processing unit 110 authenticates the authentication terminal based on the collation result with the registration information stored in the database. It is also possible to determine whether or not the personal identification information acquired from 20 is “personal identification information of a specific person”. If the personal identification information of the specific person has not been acquired (S204: NO), the registration processing unit 110 repeats the determination process of S204 until the _first predetermined time T1 elapses after the authentication failure ( S206: NO). For example, the registration processing unit 110 can calculate the elapsed time since the authentication failed based on the time when the personal identification information was acquired in the process of S202. It is preferable that the _first predetermined time T1 for determining whether or not to perform additional registration is not so long. When the first predetermined time T ₁ is too long, the person fails to authenticate before a specific person, there is a possibility that registered regardless intention of a specific person. The first predetermined time T1 is preferably 10 seconds or shorter, more preferably 3 seconds or shorter. In this way, by limiting the length of the first predetermined time T1, it is possible to reduce the possibility that unintended person registration information is erroneously registered in the database 222.

  When the personal identification information of the specific person is acquired before the first predetermined time elapses after the authentication failure (S204: YES), the registration processing unit 110, for example, as shown in FIG. The acquired “identification information of the person who has failed authentication” is additionally registered in the database 222 as registration information of the person (S208). FIG. 6 is a diagram for explaining a specific example of registration information additional registration processing by the registration processing unit 110. The registration processing unit 110, based on the “personal identification information that has failed authentication” acquired from the authentication terminal 20 in the process of S202 and the “personal identification information of a specific person” acquired from the authentication terminal 20 in the process of S206, A record to be additionally registered in the database 222 is generated. In FIG. 6, “01020506” is acquired as the personal identification information that has failed in the process of S202, and “01020304” is acquired as the personal identification information of the specific person in the process of S206. As an example, record A is shown.

On the other hand, if the first predetermined time T ₁ is passed from authentication failure (S206: YES), the registration processing unit 110 registers the "personal identification information of the person authentication fails" acquired from the authentication terminal 20 of the person The process ends without additional registration in the database 222 as information.

  As described above, the personal identification information of the person who has failed to be authenticated is stored in the database 222 as the registered information of the person, so that the authentication process of the person succeeds thereafter.

[Second Embodiment]
This embodiment is the same as the first embodiment except for the following points.

  In the present embodiment, the registration processing unit 110 is configured to execute a process as described in FIG. 5 when the personal identification information of a specific person is acquired before the personal identification information that has failed in the authentication process. Move to (Additional registration mode). Further, the registration processing unit 110 ends the additional registration mode when the second predetermined time has elapsed since the acquisition of the personal identification information of the specific person.

[Hardware configuration]
The authentication system 1 of this embodiment has the same hardware configuration (example: FIG. 2) as that of the first embodiment. The storage device 1008 of this embodiment further stores a program module that realizes the function of the registration processing unit 110 described above. The processor 1004 reads these program modules into the memory 1006 and executes them, thereby realizing the function of the registration processing unit 110 according to the present embodiment.

[Operation example]
FIG. 7 is a flowchart illustrating the flow of processing executed by the information processing apparatus 10 according to the second embodiment.

When the registration processing unit 110 acquires the personal identification information of the specific person before the personal identification information of the person who has failed authentication (S302: YES), the registration processing unit 110 is configured to execute a process as described in FIG. The process proceeds to the additional registration mode (S304). The additional registration mode continues until the _second predetermined time T2 elapses after the personal identification information of the specific person is acquired in the process of S302 (S306: NO). If the personal identification information of the person who has failed in authentication is acquired before the _second predetermined time T2 elapses, the additional registration process described with reference to FIG. 5 is executed. It should be noted that the second predetermined time T ₂ are also the same as the first predetermined time T _1, may be different. Since the acquired personal identification information of a specific person in the process of S302 if the second predetermined time _{T 2} has elapsed (S306: YES), the registration processing unit 110 ends the additional registration mode (S308). After completion of the additional registration mode, even if the personal identification information of the person who has failed in authentication is acquired, the additional registration process described with reference to FIG. 5 is not executed.

  As described above, in the present embodiment, when the personal identification information of a specific person is acquired before the personal identification information of the person who has failed authentication, the registration is performed for the second predetermined time from the acquisition time of the personal identification information of the specific person. The processing unit 110 shifts to the additional registration mode. As described in the first embodiment, the personal identification information of the person who has failed in authentication is the personal identification information of the specific person within the first predetermined time from the acquisition time of the personal identification information of the person who has failed in the authentication. When the information is acquired again, it is additionally registered in the database 222. By doing in this way, it can be easily discriminate | determined by the authentication system 1 side whether the specific person intends to register personal identification information of the person who failed in authentication as registration information. Therefore, according to the present embodiment, it is possible to further reduce the possibility that unintended person registration information is erroneously registered in the database 222.

[Third Embodiment]
This embodiment is the same as the second embodiment except for the following points.

〔System configuration〕
FIG. 8 is a block diagram conceptually showing the configuration of the authentication system 1 in the third embodiment. The authentication system 1 of this embodiment further includes an approval waiting information notification unit 112. If the personal identification information of a specific person is acquired between the failure of the authentication process of a certain person and the elapse of the _first predetermined time T1, the approval waiting information notifying unit 112 additionally registers with the terminal of the specific person Notify approval waiting information. The approval waiting information is information for notifying a specific person that there is a person waiting for approval of the additional registration process of the personal identification information. The registration processing unit 110 according to the present embodiment additionally registers the personal identification information of the person who has failed in authentication as the registration information of the person in the database 222 when a reply to approve the additional registration is acquired from the terminal of the specific person. To do.

[Hardware configuration]
The authentication system 1 of this embodiment has the same hardware configuration (example: FIG. 2) as that of the first and second embodiments. The storage device 1008 of this embodiment further stores program modules that realize the functions of the above-described approval waiting information notification unit 112 and registration processing unit 110. The processor 1004 reads the program modules into the memory 1006 and executes them, thereby realizing the functions of the approval waiting information notification unit 112 and the registration processing unit 110 described above.

[Operation example]
The flow of processing executed by the information processing apparatus 10 according to this embodiment will be described with reference to FIG. FIG. 9 is a flowchart illustrating the flow of processing executed by the information processing apparatus 10 according to the third embodiment. The process shown in FIG. 9 is executed after the process of S304 in FIG. 7 (process for shifting to the additional registration mode).

  First, the registration processing unit 110 determines whether or not personal identification information of a person who has failed in authentication has been acquired from the authentication terminal 20 (S202). This process is the same as the process of S202 of FIG.

  When the personal identification information of the person who has failed authentication is acquired (S402: YES), the approval waiting information notification unit 112 notifies the approval waiting information to the terminal owned by the specific person (S404). For example, the destination information of the terminal owned by the specific person is associated with the personal identification information of the specific person acquired in the process of S302 (for example, FIG. 10). FIG. 10 is a diagram illustrating an example of a table that stores destination information of a specific person's terminal. The table as shown in FIG. 10 is defined in advance in the storage device 1008 of the information processing apparatus 10, for example. The approval waiting information notification unit 112 can acquire the destination information of the terminal owned by the specific person based on the personal identification information of the specific person acquired in the process of S302. For example, when the ID “1020304” is acquired in the process of S302, the approval waiting information notification unit 112 can acquire the destination information “paul@abc.com” corresponding to the ID. Then, the approval waiting information notification unit 112 notifies the specific person of approval waiting information as shown in FIG. 11, for example, using the acquired destination information. FIG. 11 is a diagram showing an example of approval waiting information. The specific person confirms approval waiting information as shown in FIG. 11 on his / her terminal, and determines whether or not to perform approval. In the example of FIG. 11, when a specific person presses an “approval” button on his / her terminal, information indicating approval of additional registration of personal identification information of the person who has failed authentication is returned to the information processing apparatus 10. . When the specific person presses the “approval” button on his / her terminal, information indicating that the additional registration of the personal identification information of the person who has failed in authentication is rejected is returned to the information processing apparatus 10.

The registration processing unit 110 performs registration from the specific person's terminal until the _third predetermined time T3 has elapsed from the notification of the approval waiting information or until a reply to reject additional registration is received from the specific person's terminal. Wait for a reply to approve (S406: NO, S408: NO). The third predetermined time T ₃ can be set to any length. When the registration processing unit 110 receives a reply to approve the registration from the terminal of the specific person (S406: YES), the registration processing unit 110 additionally registers the personal identification information of the person who has failed in the database 222 as the registration information of the person. (S410). On the other hand, has passed the third predetermined time T ₃ from the notification of the approval waiting information, or, if it receives a reply dismissing the additional registration from a terminal of a specific person (S408: YES), the registration processing unit 110, The process ends without additionally registering the personal identification information of the person who has failed in the database 222 as registration information of the person.

  As described above, also according to this embodiment, the same operations and effects as those of the second embodiment can be obtained. Further, the specific person can grasp that there is a person waiting for approval of additional registration by the approval waiting information of the present embodiment. Thereby, the possibility that registration information of an unintended person is erroneously registered in the database 222 can be further reduced.

  As mentioned above, although embodiment of this invention was described with reference to drawings, these are the illustrations of this invention, Various structures other than the above are also employable.

For example, the authentication processing unit 220 and the database 222 related to the authentication process may be provided in the information processing apparatus 10. In this case, the authentication terminal 20 transmits the personal identification information acquired by the acquisition unit 210 to the information processing apparatus 10, and the information processing apparatus 10 executes authentication processing using the personal identification information acquired from the authentication terminal 20. . The information processing apparatus 10, if the authentication fails processing using personal identification information acquired from the authentication terminal 20, further acquires the personal identification information of a specific person from the authentication terminal 20 to the first predetermined time T ₁ As a condition, personal identification information of the person who has failed in the authentication is registered in the database 222 as registration information of the person. Note that the authentication terminal 20 can determine whether or not to allow the person to enter the target area according to the result of the authentication process acquired from the information processing apparatus 10.

  For example, the authentication terminal 20 may have the function of the information processing apparatus 10 together. In this case, the process described as the process of the information processing apparatus 10 in each embodiment described above is executed on the authentication terminal 20.

  In the plurality of flowcharts used in the above description, a plurality of steps (processes) are described in order, but the execution order of the steps executed in each embodiment is not limited to the description order. In each embodiment, the order of the illustrated steps can be changed within a range that does not hinder the contents. Moreover, each above-mentioned embodiment can be combined in the range in which the content does not conflict.

A part or all of the above embodiments can be described as in the following supplementary notes, but is not limited thereto.
1.
Obtaining means for obtaining personal identification information of the person to be authenticated;
An authentication processing means for executing an authentication process for determining whether or not the person to be authenticated is permitted to enter the target area based on a collation result between the personal identification information and registered information registered in advance;
If the authentication process using the personal identification information of the first person fails, the authentication process is performed on the condition that the personal identification information of the specific person is acquired within the first predetermined time from the failure of the authentication process. Registration processing means for additionally registering the used personal identification information as registration information of the first person;
Having an authentication system.
2.
The first predetermined time is 10 seconds or less;
1. The authentication system described in.
3.
The first predetermined time is 3 seconds or less;
2. The authentication system described in.
4).
The personal identification information is stored in a predetermined tangible medium;
1. To 3. The authentication system according to any one of the above.
5.
The personal identification information is biometric information of a person.
1. To 3. The authentication system according to any one of the above.
6).
The biometric information is an image including a human face or an image feature amount that can be extracted from the image.
5. The authentication system described in.
7).
When the personal identification information of the specific person is acquired before the personal identification information that has failed in the authentication process, the registration processing means passes a second predetermined time from acquisition of the personal identification information of the specific person In the meantime, transition to a mode in which the registration information can be additionally registered,
1. To 6. The authentication system according to any one of the above.
8).
It is provided near the entrance of an area where only authorized persons can enter,
1. To 7. The authentication system according to any one of the above.
9.
At least one computer
Obtain personal identification information of the person to be authenticated,
Performing an authentication process for determining whether or not the person to be authenticated is permitted to enter the target area based on a collation result between the personal identification information and pre-registered registration information;
If the authentication process using the personal identification information of the first person fails, the authentication process is performed on the condition that the personal identification information of the specific person is acquired within the first predetermined time from the failure of the authentication process. Additionally registering the used personal identification information as registration information of the first person,
An authentication method that includes:
10.
The first predetermined time is 10 seconds or less;
9. Authentication method described in.
11.
The first predetermined time is 3 seconds or less;
10. Authentication method described in.
12
The personal identification information is stored in a predetermined tangible medium;
9. To 11. The authentication method as described in any one of these.
13.
The personal identification information is biometric information of a person.
9. To 12. The authentication method as described in any one of these.
14
The biometric information is an image including a human face or an image feature amount that can be extracted from the image.
13. Authentication method described in.
15.
When the personal identification information of the specific person is acquired before the personal identification information for which the authentication process has failed, until the second predetermined time elapses from the acquisition of the personal identification information of the specific person During the period, the mode shifts to a mode in which the registration information can be additionally registered.
9. To 14. The authentication method as described in any one of these.
16.
The device for obtaining the personal identification information of the person to be authenticated is provided in the vicinity of the entrance of an area where only authorized persons can enter,
9. To 15. The authentication method as described in any one of these.
17.
At least one computer; To 16. The program which performs the authentication method as described in any one of these.

1 Authentication System 10 Information Processing Device 1002 Bus 1004 Processor 1006 Memory 1008 Storage Device 1010 Input / Output Interface 1012 Network Interface 110 Registration Processing Unit 112 Approval Waiting Information Notification Unit 20 Authentication Terminal 2002 Bus 2004 Processor 2006 Memory 2008 Storage Device 2010 Input / Output Interface 2012 Network interface 210 Acquisition unit 212 Reading device 214 Imaging device 220 Authentication processing unit 222 Database 230 Control unit 232 Security device 30 Tangible medium

Claims (10)

Obtaining means for obtaining personal identification information of the person to be authenticated;
An authentication processing means for executing an authentication process for determining whether or not the person to be authenticated is permitted to enter the target area based on a collation result between the personal identification information and registered information registered in advance;
If the authentication process using the personal identification information of the first person fails, the authentication process is performed on the condition that the personal identification information of the specific person is acquired within the first predetermined time from the failure of the authentication process. Registration processing means for additionally registering the used personal identification information as registration information of the first person;
Having an authentication system. The first predetermined time is 10 seconds or less;
The authentication system according to claim 1. The first predetermined time is 3 seconds or less;
The authentication system according to claim 2. The personal identification information is stored in a predetermined tangible medium;
The authentication system according to any one of claims 1 to 3. The personal identification information is biometric information of a person.
The authentication system according to any one of claims 1 to 3. The biometric information is an image including a human face or an image feature amount that can be extracted from the image.
The authentication system according to claim 5. When the personal identification information of the specific person is acquired before the personal identification information that has failed in the authentication process, the registration processing means passes a second predetermined time from acquisition of the personal identification information of the specific person In the meantime, transition to a mode in which the registration information can be additionally registered,
The authentication system according to any one of claims 1 to 6. It is provided near the entrance of an area where only authorized persons can enter,
The authentication system according to any one of claims 1 to 7. At least one computer
Obtain personal identification information of the person to be authenticated,
Performing an authentication process for determining whether or not the person to be authenticated is permitted to enter the target area based on a collation result between the personal identification information and pre-registered registration information;
If the authentication process using the personal identification information of the first person fails, the authentication process is performed on the condition that the personal identification information of the specific person is acquired within the first predetermined time from the failure of the authentication process. Additionally registering the used personal identification information as registration information of the first person,
An authentication method that includes:   A program causing at least one computer to execute the authentication method according to claim 9.

Images