JP2020009454A - Face authentication device - Google Patents

Abstract

To provide a face authentication device that makes difference in security strength between operation that emphasizes security and operation that emphasizes convenience more remarkable.SOLUTION: A face authentication device that includes: a first authentication unit 301 for performing first authentication on a face image of an authentication object on the basis of a threshold value; a second authentication unit 302 for performing second authentication by an authentication method other than face authentication; a detection unit 303 for detecting whether the second authentication unit 302 is used; a threshold change unit 305 for setting a larger value as a threshold value when using the second authentication unit 302 compared with when not using it; and a personal authentication unit 304 that, by using the threshold value after setting, performs personal authentication on the basis of a result of the first authentication when the second authentication unit 302 is not used and performs personal authentication on the basis of the result of the first authentication and a result of the second authentication when using the second authentication unit 302.SELECTED DRAWING: Figure 8

Description

  The present invention relates to a face authentication device, a face authentication method, and a program.

  2. Description of the Related Art Conventionally, in various systems such as an entry / exit monitoring system and an attendance management system, personal authentication by face authentication has been performed on a user who passes through a gate or the like. In such a system, a face authentication device that performs personal authentication by using face authentication in combination with another authentication method has been proposed or put into practical use.

  For example, Patent Literature 1 describes a face authentication device that uses both face authentication and authentication using a password. In the face authentication device described in Patent Literature 1, a password is first input from a user and compared with a registered password. If all the digits of the personal identification number are correctly input, the personal authentication is determined to be successful without performing the face authentication. If no password is entered, or if the password is entered correctly but not more than the predetermined number of digits, the face authentication is not performed and the personal authentication is determined to have failed. In other cases, face authentication is performed, and success or failure of personal authentication is determined according to the result of face authentication. At this time, a threshold value for face authentication is set according to the number of digits of the correctly input personal identification number. Specifically, as the security code with a larger number of digits is correctly input, that is, the higher the security strength is achieved in the authentication method using the security code, the threshold for face authentication is reduced, thereby facilitating personal acceptance. To

  A combination of two or more different types of authentication information, such as the above-described face authentication and authentication using a personal identification number, is called two-factor authentication or multi-factor authentication.

JP 2008-158627 A

  In a face authentication apparatus that uses face authentication in combination with another authentication method, it is conceivable to make it possible to select whether or not to use another authentication method. When another authentication method is not used, personal authentication is performed based only on the result of face authentication, so that security strength is reduced, but convenience is improved. On the other hand, when another authentication method is used, personal authentication is performed based on the result of the face authentication and the result of the other authentication method, so that the convenience is reduced, but the security strength is increased.

  In this way, by selecting whether or not to use another authentication method, a face authentication device that can switch between operation that emphasizes security and operation that emphasizes convenience, on the contrary, has a security strength between both operations. It is desired to make the difference between the two more remarkable. That is, it is desirable to increase the difference between the security strength at the time of operation that emphasizes security and the security strength at the time of operation that emphasizes convenience. However, it is difficult to realize such an operation mode by simply selecting whether or not to use another authentication method.

  An object of the present invention is to provide a face authentication device that solves the above-described problem.

A face authentication device according to an embodiment of the present invention includes:
A first authentication unit that performs first authentication on a face image to be authenticated based on a threshold,
A second authentication unit that performs a second authentication by an authentication method other than face authentication;
A detection unit for detecting whether or not the second authentication unit is used;
When using the second authentication unit, a threshold value changing unit that sets a larger value as the threshold value than when not using the second authentication unit;
Using the threshold value after the setting, if the second authentication unit is not used, personal authentication is performed based on the result of the first authentication. If the second authentication unit is used, the first authentication is performed. And a personal authentication unit for performing personal authentication based on the result of the authentication and the result of the second authentication.

A face authentication method according to another aspect of the present invention includes:
Detecting the use of the second authentication by an authentication method other than face authentication,
When using the second authentication, a larger value is set as the threshold value in the first authentication that performs authentication of the face image to be authenticated based on the threshold value than when the second authentication is not used,
Using the threshold value after the setting, when the second authentication is not used, personal authentication is performed based on the result of the first authentication, and when the second authentication is used, the first authentication is performed. Is performed based on the result of the second authentication and the result of the second authentication.

A program according to another aspect of the present invention includes:
Computer
A first authentication unit that performs first authentication on a face image to be authenticated based on a threshold,
A second authentication unit that performs a second authentication by an authentication method other than face authentication;
A detection unit for detecting whether or not the second authentication unit is used;
When using the second authentication unit, a threshold value changing unit that sets a larger value as the threshold value than when not using the second authentication unit;
Using the threshold value after the setting, if the second authentication unit is not used, personal authentication is performed based on the result of the first authentication. If the second authentication unit is used, the first authentication is performed. A personal authentication unit for performing personal authentication based on the result of the authentication and the result of the second authentication,
Function.

  The present invention has a configuration as described above, and by selecting whether or not to use another authentication method, a face authentication device capable of switching between operation with an emphasis on security and operation with an emphasis on convenience on the contrary. , The difference in security strength between the two operations can be made more remarkable.

It is a block diagram of a face authentication device concerning a 1st embodiment of the present invention. 1 is a schematic diagram of an entrance / exit management system including a face authentication device according to a first embodiment of the present invention. 5 is a flowchart illustrating an outline of an operation of the face authentication device according to the first embodiment of the present invention. 5 is a flowchart illustrating an outline of an operation of the face authentication device according to the first embodiment of the present invention. FIG. 3 is a conceptual diagram of a combination of face image authentication and IC card authentication and a security strength determined by a matching threshold used in face image authentication in the first embodiment of the present invention. 11 is a flowchart illustrating an example of an operation of a threshold value changing unit in the face authentication device according to the second embodiment of the present invention. It is a figure showing the example of the collation threshold setting screen which the threshold changing part displays in the face authentication device concerning a 2nd embodiment of the present invention. It is a block diagram of a face authentication device concerning a 3rd embodiment of the present invention.

Next, embodiments of the present invention will be described in detail with reference to the drawings.
[First Embodiment]
FIG. 1 is a block diagram of a face authentication device 100 according to the first embodiment of the present invention. FIG. 2 is a schematic diagram of an entry / exit management system including the face authentication device 100 according to the present embodiment. Referring to FIG. 1, a face authentication device 100 according to the present embodiment includes an interface unit 111 with a camera unit 141, an interface unit 112 with an IC card reader 144, and an interface unit 113 with a gate device 142. , A communication interface unit 114, an operation input unit 115, a screen display unit 116, a storage unit 120, and an arithmetic processing unit 130.

  The interface unit 111 is configured to transmit and receive signals to and from the camera unit 141 that captures the face of the person to be authenticated. The transmission and reception of the signal may be either wired or wireless. As shown in FIG. 2, the camera unit 141 is set at a position and an angle of view at which a face portion of the user 143 passing through the gate device 142 can be imaged. The camera unit 141 outputs image data obtained by imaging the face of a person to be collated to the arithmetic processing unit 130 through the interface unit 111, such as a charge coupled device (CCD) element or a complementary metal-oxide semiconductor (CMOS). It is an imaging device including elements and the like. The image data picked up by the camera unit 141 is, for example, a monochrome grayscale image of 256 gradations, but may be a color image.

  The interface unit 112 is configured to exchange signals with the IC card reader 144. The transmission and reception of the signal may be either wired or wireless. The IC card reader 144 is attached near the gate device 142 as shown in FIG. When passing through the gate device 142, when the user 143 approaches the IC card 145 possessed by the user 143, the IC card reader 144 reads information stored in the IC card 145 in a non-contact manner and sends the information to the arithmetic processing unit 130 through the interface unit 112. It is configured to output. The IC card 145 stores information including a user ID and authentication information.

  The interface unit 113 is configured to transmit and receive a signal such as a result of personal authentication with the gate device 142. The transmission and reception of the signal may be either wired or wireless. The gate device 142 performs a predetermined operation according to the received result of the personal authentication. Various predetermined operations can be considered. For example, the gate device 142 automatically opens and closes a door attached to the gate device 142 according to the result of the personal authentication. Alternatively, the gate device 142 is provided with a gate bar that can be manually opened and closed, and unlocks the gate bar only for a certain period of time when the personal authentication is successful. Alternatively, the gate device 142 visually or acoustically outputs a message indicating whether or not traffic is possible, from an alarm attached to the gate device 142 according to the result of the personal authentication. The gate device 142 may be a stationary type or a movable portable type. Further, the gate device 142 may be a device independent of the face authentication device 100 or may be a device integrated with the face authentication device 100.

  The communication interface unit 114 is a communication device that performs data communication with an external device such as a terminal. The communication method may be either wired or wireless.

  The operation input unit 115 is an input device such as a keyboard or a numeric keypad, and is configured to detect an operation of an operator and output the operation to the arithmetic processing unit 130.

  The screen display unit 116 is a screen display device such as an LCD (Liquid Crystal Display) or a PDP (Plasma Display Panel). The screen display unit 116 is configured to display various information such as a result of the comparison on the screen according to an instruction from the arithmetic processing unit 130.

  The storage unit 120 is a storage device such as a hard disk or a memory. The storage unit 120 is configured to store processing information and a program 121 necessary for various processes performed by the arithmetic processing unit 130.

  The program 121 realizes various processing units by being read and executed by the arithmetic processing unit 130. The program 121 is read in advance from an external device (not shown) or a storage medium (not shown) via a data input / output function such as the communication interface unit 114, and is stored in the storage unit 120.

  The main processing information stored in the storage unit 120 includes reference face image data 122, a matching threshold 123, reference card data 124, and IC card authentication use presence / absence data 125.

  The reference face image data 122 is data in which a reference face image used when performing face matching is associated with a user ID. At least one face image of a person having the user ID may be associated with the reference face image data 122 as the reference face image in association with the user ID. Alternatively, the feature amount of the face extracted from the face image of the person having the user ID may be associated with the reference face image data 122 as the reference face information. Here, the face feature amount is a numerical value indicating a feature in each part of the face image for recognizing a positional relationship and a shape of each part constituting the face such as eyes, nose, mouth, eyebrows, and the like. It is used when performing, for example.

  The matching threshold 123 is a threshold used when performing face matching. In the case of this embodiment, the matching threshold 123 is common to all user IDs. Increasing the matching threshold decreases the false acceptance rate and increases security.

  The reference card data 124 is data in which authentication information serving as a reference used when performing IC card authentication is associated with a user ID. In the reference card data 124, information for collating with the authentication information stored in the IC card 145 having the user ID is recorded as the reference authentication information in association with the user ID.

  The use presence / absence data 125 of IC card authentication is data indicating whether or not to use IC card authentication. The use presence / absence data 125 of the IC card authentication is set to, for example, a value 1 when the IC card authentication is used, and is reset to a value 0 when the IC card authentication is not used.

  The arithmetic processing unit 130 is an arithmetic processing device having a microprocessor such as an MPU and its peripheral circuits. The arithmetic processing unit 130 is configured to read and execute the program 121 from the storage unit 120 so that the hardware and the program 121 cooperate to realize various processing units. The processing units implemented by the arithmetic processing unit 130 include an input unit 131, a face image acquisition unit 132, a collation unit 133, an IC card authentication use presence / absence detection unit 134, a threshold change unit 135, an IC card information acquisition unit 136, and an IC card authentication. There is a unit 137, a personal authentication unit 138, and an output unit 139.

  The input unit 131 is configured to input the reference face image data 122 and the reference card data 124 from the outside through the communication interface unit 114 or the operation input unit 115, and store the input in the storage unit 120.

  The face image acquisition unit 132 is configured to input image data of a person to be collated captured by the camera unit 141 through the interface unit 111 and acquire (detect) a face image to be collated from the image data. I have. The face image acquiring unit 132 acquires a face image existing in the image data by matching a template indicating a general outline of a human face with the image data. Various known face detection algorithms other than template matching may be used. The face image acquisition unit 132 is configured to transmit the acquired face image to the matching unit 133.

  The matching unit 133 reads the reference face image data 122 and the matching threshold 123 from the storage unit 120, and compares the reference face image included in the reference face image data 122 with the face image to be checked acquired by the face image acquiring unit 132. Based on the result of comparing the similarity between each user ID for each user ID and comparing the calculated similarity for each user ID with the matching threshold 123, the face image to be compared is included in the reference face image data 152. It is configured to determine whether the reference face image matches the reference face image of the user ID or does not match any reference face image. As an example of the similarity, a cross-correlation coefficient between face images can be used. In this case, the similarity increases when both face images include the face portion of the same person, and the similarity decreases when both face images include the face portions of different people. As the similarity between face images, a known similarity calculation technique other than the cross-correlation coefficient can be used. For example, the matching unit 133 extracts the feature amount of the face from the acquired face image to be matched, and the feature amount of the reference face included in the reference face image data 122 and the feature amount of the face extracted from the face image to be matched. May be configured to calculate the similarity between the reference face image and the face image to be compared.

  If there is no reference face image of the user ID whose similarity with the face image to be checked acquired by the face image acquiring unit 132 is equal to or greater than the matching threshold 123, the matching unit 133 determines that the face authentication has failed. Is configured to generate an authentication result. When there is at least one reference face image whose similarity with the matching target face image acquired by the face image acquiring unit 162 is equal to or greater than the matching threshold 123, the matching unit 133 determines the user having the largest similarity. It is configured to generate an authentication result of face authentication success including an ID. Further, the matching unit 133 is configured to transmit the authentication result to the personal authentication unit 138.

  The IC card authentication use presence / absence detection unit 134 is configured to detect the use / non-use of IC card authentication. The IC card authentication use detection unit 134 is configured to detect the use of IC card authentication before the operation of the face authentication device 100 is started. Further, the IC card authentication use presence / absence detection unit 134 is configured to detect the use / non-use of IC card authentication during operation of the face authentication device 100.

  The IC card authentication use presence / absence detection unit 134 determines that the IC card authentication use state is received when a command to use the IC card authentication is received from the administrator via the communication interface unit 114 or the operation input unit 115. To detect. Conversely, when the IC card authentication use presence / absence detection unit 134 receives a command not to use IC card authentication from the administrator, it detects that the IC card authentication is not used. However, the method of detecting the use of IC card authentication is not limited to this. For example, the IC card authentication use presence / absence detecting unit 134 checks whether or not the interface unit 112 with the IC card reader 144 is attached to the arithmetic processing unit 130, and if it is attached, the IC card authentication is used. If it is not attached, it may be configured to detect that the IC card authentication is not used. The IC card authentication use detection unit 134 is configured to update the IC card authentication use data 125 stored in the storage unit 120 according to the detected use of IC card authentication. Further, the IC card authentication use presence / absence detection unit 134 is configured to notify the threshold change unit 135 when the use presence / absence data 125 of IC card authentication is set or changed.

  Upon receiving the notification from the IC card authentication use presence / absence detection unit 134, the threshold change unit 135 reads the IC card authentication use presence / absence data 125 from the storage unit 120, determines the value of the collation threshold 123 according to the data, and determines the decided collation. The threshold value 123 is configured to be stored in the storage unit 120. Specifically, the threshold changing unit 135 determines the collation threshold 123 so that it becomes larger when IC card authentication is used than when it is not used. In the present embodiment, when IC card authentication is used, the threshold changing unit 135 suppresses the false acceptance rate by setting the value TH larger than the predetermined value T0 as the matching threshold 123, and reduces the security strength. Enhance. On the other hand, when the IC card authentication is not used, the threshold changing unit 135 sets the value TL smaller than the predetermined value T0 as the matching threshold 123, thereby suppressing the false rejection rate and increasing the convenience.

  The IC card information acquisition unit 136 is configured to input the storage information of the IC card 145 read by the IC card reader 144 through the interface unit 112. The IC card information acquisition unit 136 is configured to transmit the acquired storage information of the IC card 145 to the IC card authentication unit 137.

  The IC card authentication unit 137 reads the reference card data 124 from the storage unit 120, and compares the reference authentication information included in the reference card data 124 with the storage information of the IC card 145 acquired by the IC card information acquisition unit 136, It is configured to perform IC card authentication based on the result of the collation. For example, the IC card authentication unit 137 extracts the user ID and the authentication information from the storage information of the IC card 145, and the reference authentication included in the reference card data 124 having the same user ID as the extracted user ID. The information is compared with the extracted authentication information. If they match, the authentication is successful, and if they do not match, the authentication fails. However, the present invention is not limited to such an authentication method, and a known IC card authentication technique can be used. Further, the IC card authentication unit 137 is configured to transmit an authentication result including the user ID that has been successfully authenticated to the personal authentication unit 138.

  The personal authentication unit 138 is configured to perform personal authentication based on the authentication result of the collation unit 133, the authentication result of the IC card authentication unit 137, and the use / non-use data 125 of the IC card authentication. Specifically, the personal authentication unit 138 reads the IC card authentication use presence / absence data 125 from the storage unit 120, and determines whether IC card authentication is used. When the IC card authentication use presence / absence data 125 indicates that IC card authentication is to be used, the personal authentication unit 138 performs personal authentication based on the authentication result of the collation unit 133 and the authentication result of the IC card authentication unit 137. Is derived. That is, the identity authentication unit 138 determines that if the authentication result of the collation unit 133 and the authentication result of the IC card authentication unit 137 are both successful and the user IDs of the successfully authenticated users are the same, the identity authentication unit 138 identifies the identity of the user. The authentication is determined to be successful. On the other hand, the personal authentication unit 138 determines whether at least one of the authentication result of the collation unit 133 and the authentication result of the IC card authentication unit 137 has failed, or that the user IDs that succeeded in both but succeeded in the authentication are mutually authenticated. If they are different, it is determined that the personal authentication has failed. When the IC card authentication use presence / absence data 125 indicates that IC card authentication is not used, the personal authentication unit 138 uses the authentication result of the collation unit 133 without using the authentication result of the IC card authentication unit 137. To derive the result of personal authentication. That is, the personal authentication unit 138 determines that the personal authentication is successful if the authentication result of the matching unit 133 is successful, and determines that the personal authentication is failed if the authentication result of the matching unit 133 is unsuccessful. The personal authentication unit 138 is configured to transmit the result of personal authentication including the user ID that succeeded in personal authentication to the output unit 139.

  The output unit 139 is configured to transmit the result of the personal authentication generated by the personal authentication unit 138 to the gate device 142 through the interface unit 113. The output unit 139 may display the result of the personal authentication generated by the personal authentication unit 138 on the screen display unit 116 and / or transmit the result to an external device through the communication interface unit 114.

  FIG. 3 is a flowchart showing an outline of the operation of the face authentication apparatus 100. Referring to FIG. 3, first, input unit 131 of face authentication device 100 receives reference face image data 122 from the outside and stores it in storage unit 120 (step S1). Next, the input unit 131 inputs the reference card data 124 from outside and stores it in the storage unit 120 (step S2). Next, the IC card authentication use presence / absence detection unit 134 of the face authentication device 100 detects the use / non-use of IC card authentication based on a command input from the communication interface unit 114 or the operation input unit 115, and based on the detection result. The use presence / absence data 125 for IC card authentication is set (step S3). That is, when a command to use IC card authentication is input, the IC card authentication use presence / absence detection unit 134 sets the value of IC card authentication use presence / absence data 125 to 1 and indicates that IC card authentication is not used. Is reset to zero. Next, the threshold changing unit 135 of the face authentication device 100 sets the matching threshold 123 of the value according to the IC card authentication use presence / absence data 125 in the storage unit 120 (Step S4). That is, the threshold value changing unit 135 sets the comparison threshold value 123 of the value TH when using the IC card authentication, and sets the comparison threshold value 123 of the value TL (<TH) when not using the IC card authentication. The processing of steps S1 to S4 is a preparation processing for starting the operation of face authentication, and may be omitted if performed once. As will be described later with reference to FIG. 4, the use or non-use of the IC card authentication can be changed during operation.

  The following operations are performed during operation. First, the face image acquisition unit 132 of the face authentication device 100 inputs image data obtained by capturing an image of a collation target from the camera unit 141, and acquires a face image to be collated from the image data (step S5). Next, the matching unit 133 of the face authentication device 100 calculates the degree of similarity between each reference face image included in the reference face image data 122 and the face image to be checked obtained by the face image obtaining unit 132 to perform matching. By performing comparison with the threshold value 123, face authentication is performed (step S6).

  Next, the IC card information acquisition unit 136 of the face authentication device 100 reads the use presence / absence data 125 of the IC card authentication from the storage unit 120, and checks the setting state of the availability of the IC card authentication (step S7). The IC card information acquisition unit 136 determines that the IC card authentication is available if the value of the IC card authentication use presence / absence data 125 is 1, and determines that the IC card authentication is unavailable if the value is 0.

  When determining that the IC card authentication is available, the IC card information acquisition unit 136 acquires the storage information read by the IC card reader 144 from the IC card 145 of the user 143 passing through the gate device 142 (Step S8). Next, the IC card authentication unit 137 of the face authentication device 100 collates the reference authentication information included in the reference card data 124 with the storage information of the IC card 145 acquired by the IC card information acquisition unit 136, and performs IC card authentication. Is performed (step S9). Next, the personal authentication unit 138 of the face authentication device 100 derives the result of the personal authentication based on the result of the face authentication performed in step S6 and the result of the IC card authentication performed in step S9 (step S10). On the other hand, when it is determined that the IC card authentication cannot be used, the personal authentication unit 138 derives the result of the personal authentication based on the result of the face authentication performed in step S6 without performing the IC card authentication (step S11). ).

  Next, the output unit 139 of the face authentication device 100 outputs the result of the personal authentication to the gate device 142 through the interface unit 113 (Step S12). Then, the face authentication device 100 returns to step S5 and repeats the same processing as the above-described processing.

  Further, the face authentication device 100 is configured to execute the processing shown in FIG. 4 in parallel with the processing shown in FIG. Referring to FIG. 4, if the value of IC card authentication use presence / absence data 125 stored in storage unit 120 is 1, ie, IC card authentication use presence / absence detection unit 134 of face authentication device 100 If the password is used (YES in step S21), it is monitored that a command not to use the IC card authentication is input from the user through the communication interface unit 114 or the operation input unit 115 (step S22). When the command indicating that the IC card authentication is not used is input, the IC card authentication use presence / absence detection unit 134 changes the value of the IC card authentication use presence / absence data 125 stored in the storage unit 120 to 0. (Step S24). Next, the threshold changing unit 135 of the face authentication device 100 changes the value of the matching threshold 123 stored in the storage unit 120 to TL (Step S25). Then, the face authentication device 100 returns to the process of step S21.

  On the other hand, if the value of the IC card authentication use presence / absence data 125 stored in the storage unit 120 is 0, that is, if the IC card authentication use is not used (step S21). NO), it is monitored that a command to use IC card authentication is input from the user through the communication interface unit 114 or the operation input unit 115 (step S25). When a command to use IC card authentication is input, IC card authentication use presence / absence detecting section 134 changes the value of IC card authentication use presence / absence data 125 stored in storage section 120 to 1. (Step S26). Next, the threshold changing unit 135 of the face authentication device 100 changes the value of the matching threshold 123 stored in the storage unit 120 to TH (Step S27). Then, the face authentication device 100 returns to the process of step S21.

  As described above, in the face authentication device 100 according to the present embodiment, when performing personal authentication using both face authentication and IC card authentication, the matching threshold 123 used for face authentication is set to TH larger than the reference value T0. Therefore, the security strength is higher (the security strength at this time is SL6). On the other hand, in the face authentication device 100 according to the present embodiment, when performing personal authentication based on the face authentication result without using the IC card authentication, the matching threshold 123 used for face authentication is set to TL smaller than the reference value T0. Therefore, the security strength is lower (the security strength at this time is SL1). As a result, the difference (SL6-SL1) in security strength between the case where IC card authentication is used and the case where IC card authentication is not used in face authentication apparatus 100 can be made more remarkable.

  On the other hand, when the collation threshold 123 used for face authentication is fixed regardless of the use of IC card authentication, for example, if it is fixed to T0, personal authentication is performed by face authentication without using IC card authentication. In this case, the security strength is higher than SL1 (the security strength at this time is SL2), and the security strength when performing personal authentication using face authentication and IC card authentication together is lower than SL6 (security at this time). The strength is SL5). Therefore, the obtained security strength difference (SL5-SL2) is smaller than the security strength difference (SL6-SL1).

  In addition, when the concept of Patent Document 1 that the threshold value of face authentication is reduced as the security level is increased by an authentication method other than face authentication is applied, when IC card authentication is used, TL is set to the matching threshold value 123. If the user does not use the IC card authentication and uses the IC card authentication, TH is used as the matching threshold 123. Then, the security strength when performing face authentication without using the IC card authentication becomes higher than SL2 (the security strength at this time is assumed to be SL3), and the face authentication and the IC card authentication are used together. Thus, the security strength when performing the personal authentication is further lower than SL5 (the security strength at this time is SL4). Therefore, the obtained security strength difference (SL4-SL3) is smaller than the security strength difference (SL5-SL2).

FIG. 5 is a conceptual diagram of a combination of face authentication and IC card authentication, and a security strength determined by a matching threshold used in face authentication. In FIG. 5, SL1 to SL6 represent security strengths according to the following combinations.
SL1: Personal authentication using face authentication alone with collation threshold TL SL2: Personal authentication using face authentication alone with collation threshold T0 SL3: Personal authentication using face authentication alone with collation threshold TH SL4: Combination of face authentication with collation threshold TL and IC card authentication Personal authentication by combined use SL5: Personal authentication by combined use of face authentication and IC card authentication with collation threshold T0 SL6: Personal authentication by combined use of face authentication with collation threshold TH and IC card authentication Here, TH>T0> TL. .

  As described above, according to the present embodiment, by selecting whether or not to use the IC card authentication, it is possible to switch the operation that emphasizes security and the operation that emphasizes convenience to the contrary in the face authentication device 100. The difference in security strength between the two operations can be made more remarkable.

[Second embodiment]
Next, a second embodiment of the present invention will be described. The face authentication device 200 according to the present embodiment differs from the first embodiment in that the threshold value changing unit 135 is configured to change the value of the matching threshold value 123 according to a request from the user. Other configurations and operations are the same as those of the first embodiment.

  FIG. 6 is a flowchart illustrating an example of a process of the threshold changing unit 135 that changes the matching threshold according to a request from the user. For example, when a command requesting a change of the collation threshold is input from the operation input unit 115, the threshold changing unit 135 starts the processing illustrated in FIG.

  The threshold changing unit 135 first displays a collation threshold setting screen on the screen display unit 116 (Step S31). FIG. 7 shows an example of the collation threshold setting screen. The collation threshold setting screen in this example has a radio button for selecting whether to use the IC card authentication, a slide bar for designating a collation threshold value, an OK button, and a cancel button.

  Next, the threshold value changing unit 135 inputs designation of use or non-use of IC card authentication from the user (step S32). In the collation threshold setting screen shown in FIG. 7, the user specifies whether or not to use IC card authentication using radio buttons. Next, the threshold changing unit 135 inputs a matching threshold from the user (step S33). In the collation threshold setting screen of FIG. 7, the user moves the position of the slider on the slide bar to the left and right to specify the collation threshold. Next, when the OK button is clicked, the threshold value changing unit 135 executes the processing from step S34 in FIG. When the cancel button is clicked, the processing in FIG. 6 ends.

  In step S34, the threshold changing unit 135 determines whether to use IC card authentication based on the state of the radio button. Next, if the IC card authentication is not used (NO in step S34), the threshold changing unit 135 updates the matching threshold 123 of the storage unit 120 with the matching threshold of a value corresponding to the position of the slider on the slide bar. The use / non-use data 125 of the card authentication is updated to a state of no use (step S35). If IC card authentication is used (YES in step S34), threshold changing section 135 determines whether or not the value corresponding to the position of the knob of the slide bar is greater than predetermined value T0 (step S36). If the value is larger than the predetermined value T0, the matching threshold 123 of the storage unit 120 is updated with the matching threshold corresponding to the position of the slide bar knob, and the use / non-use data 125 of the IC card authentication is updated to the use state. (Step S35).

  On the other hand, if the value corresponding to the position of the knob of the slide bar is not greater than the predetermined value T0 (NO in step S36), the threshold changing unit 135 rejects the change and inputs a collation threshold equal to or more than the predetermined value T0. A message prompting the user is displayed on the screen display unit 116 (step S37). Then, the threshold changing unit 135 returns to Step S33 and accepts re-input of the collation threshold.

  As described above, in the present embodiment, before changing the value of the collation threshold 123 according to the request from the user, the threshold changing unit 135 determines whether the use of the IC card authentication and the value of the collation threshold 123 after the change are predetermined. It is checked whether the value is greater than the value. If the changed collation threshold value is not greater than the predetermined value while using IC card authentication, the request is rejected. As a result, it is possible to prevent the security strength when using the IC card authentication from being reduced.

  In FIG. 6, when IC card authentication is not used, the threshold changing unit 135 changes the matching threshold with the value specified by the user, but checks whether the value specified by the user is smaller than the predetermined value T0. If not, the request may be rejected. Thus, it is possible to prevent the security strength when using the IC card authentication from being increased.

  In the above embodiments, IC card authentication is used as an authentication method other than face authentication. However, password authentication or the like may be used as an authentication method other than face authentication. The authentication is not limited to two-factor authentication, but may be multi-factor authentication. Alternatively, multi-step authentication such as two-step authentication may be used. In this case, an authentication method other than face authentication may be iris authentication, fingerprint authentication, or the like.

  In each of the above embodiments, the matching threshold used for face authentication is common to all user IDs. However, the matching threshold may be set for each user.

[Third embodiment]
Next, a third embodiment of the present invention will be described. FIG. 8 is a block diagram of the face authentication device 300 according to the present embodiment. Referring to FIG. 8, the face authentication device 300 includes a first authentication unit 301, a second authentication unit 302, a detection unit 303, a personal authentication unit 304, and a threshold change unit 305. .

  The first authentication unit 301 is configured to perform first authentication on a face image to be authenticated based on a threshold. The first authentication unit 301 can be configured similarly to the matching unit 133 in FIG. 1, but is not limited thereto. The second authentication unit 302 is configured to perform the second authentication by an authentication method other than the face authentication. The second authentication unit 302 can be configured similarly to the IC card authentication unit 137 of FIG. 1, but is not limited thereto. The detection unit 303 is configured to detect whether or not the second authentication unit 302 is used. The detection unit 303 can be configured similarly to the IC card authentication use presence / absence detection unit 134 in FIG. 1, but is not limited thereto. The threshold value changing unit 305 is configured to set a larger value to the threshold value when using the second authentication unit 302 than when not using it. The threshold value changing unit 305 can be configured similarly to the threshold value changing unit 135 in FIG. 1, but is not limited thereto. The personal authentication unit 304 performs the personal authentication based on the result of the first authentication when not using the second authentication unit 302 using the threshold value after the setting, and using the second authentication unit 302. Is configured to perform personal authentication based on the result of the first authentication and the result of the second authentication. The personal authentication unit 304 can be configured similarly to the personal authentication unit 138 in FIG. 1, but is not limited thereto.

  The thus configured face authentication device 300 according to the present embodiment operates as follows. That is, the detection unit 303 detects whether or not the second authentication is used by an authentication method other than the face authentication. The threshold value changing unit 305 sets a larger value to the threshold value in the first authentication in which the authentication of the face image to be authenticated is performed based on the threshold value when the second authentication is used as compared with when the second authentication is not used. The personal authentication unit 138 performs the personal authentication based on the result of the first authentication when the second authentication is not used, and uses the first threshold when the second authentication is used, using the threshold value after the setting. Personal authentication is performed based on the result of the authentication and the result of the second authentication.

  As described above, according to the present embodiment, by selecting whether or not to use another authentication method, it is possible to switch between an operation that emphasizes security and an operation that emphasizes convenience on the contrary. The performance difference between the two operations can be made more remarkable. The reason is that the threshold value changing unit sets a larger value for the threshold value when using the second authentication unit than when not using the second authentication unit.

  Although the present invention has been described with reference to the above embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  For example, in the first embodiment, in order to further increase the difference in security strength, when IC card authentication is used, a value TH larger than a predetermined value T0 is set as the collation threshold 123 so that the security threshold is set. When the strength is increased and the IC card authentication is not used, the security strength is reduced by setting the value TL smaller than the predetermined value T0 as the collation threshold 123. However, the basis of the present invention is to increase the matching threshold 123 when using authentication other than face authentication as compared to when not using authentication. Therefore, when IC card authentication is not used, the matching threshold 123 may be set to the same value as T0. Alternatively, for face authentication, it is possible to perform face authentication while walking without stopping in front of the camera, walk-through face authentication, and execute face authentication triggered by stopping in front of the gate and touching the screen, etc. There is face authentication with trigger. Therefore, as the set value of the collation threshold 123 when not using the IC card authentication, the collation threshold 123 is set to T0 for face authentication with a trigger, and the collation threshold 123 is set to TL for walk-through face authentication that places more priority on convenience. You may make it.

  In the first embodiment, face authentication is performed independently of IC card authentication when IC card authentication is used. However, when IC card authentication is used, face authentication may be performed using the authentication result of IC card authentication. Specifically, when using the IC card authentication, first, the IC card authentication is performed, and then the face authentication is performed using the result of the IC card authentication. In the face authentication, the similarity between the reference face image registered in the reference face image data 122 and the face image to be verified is calculated in correspondence with the user ID that has been successfully authenticated by the IC card authentication. Match faces. As described above, by comparing the face of one individual identified by IC card authentication with the face to be checked, the processing amount of face authentication when using IC card authentication can be reduced, and the authentication accuracy can be increased. .

  INDUSTRIAL APPLICABILITY The present invention can be used for an entry / exit monitoring system, an attendance management system, and the like, and particularly when a threshold used for collation is appropriately and automatically corrected without incurring a burden on a user to improve convenience and safety. Suitable for.

Some or all of the above embodiments may be described as in the following supplementary notes, but are not limited thereto.
[Appendix 1]
A first authentication unit that performs first authentication on a face image to be authenticated based on a threshold,
A second authentication unit that performs a second authentication by an authentication method other than face authentication;
A detection unit for detecting whether or not the second authentication unit is used;
When using the second authentication unit, a threshold value changing unit that sets a larger value as the threshold value than when not using the second authentication unit;
Using the threshold value after the setting, if the second authentication unit is not used, personal authentication is performed based on the result of the first authentication. If the second authentication unit is used, the first authentication is performed. And a personal authentication unit for performing personal authentication based on the result of the authentication and the result of the second authentication.
[Appendix 2]
Before changing the threshold value according to a request from a user, the threshold value changing unit determines whether or not the second authentication unit is used and whether or not the changed threshold value is greater than a predetermined value. Checking, using the second authentication unit, and rejecting the request if the changed threshold value is not greater than the predetermined value,
The face authentication device according to supplementary note 1.
[Appendix 3]
The detection unit performs the detection based on a command from a user that specifies whether to use the second authentication unit.
3. The face authentication device according to claim 1 or 2.
[Appendix 4]
The detection unit performs the detection based on the presence or absence of an interface unit for acquiring authentication information used by the second authentication unit from the authentication target,
The face authentication device according to any one of supplementary notes 1 to 3.
[Appendix 5]
The threshold value changing unit sets the threshold value to be larger than a predetermined value when using the second authentication unit,
The face authentication device according to any one of supplementary notes 1 to 4.
[Appendix 6]
Detecting the use of the second authentication by an authentication method other than face authentication,
When using the second authentication, a larger value is set as the threshold in the first authentication that performs authentication of the face image to be authenticated based on the threshold as compared to when the second authentication is not used,
Using the threshold value after the setting, when the second authentication is not used, personal authentication is performed based on the result of the first authentication, and when the second authentication is used, the first authentication is performed. Performing personal authentication based on the result of the second authentication and the result of the second authentication;
Face authentication method.
[Appendix 7]
In the setting of the threshold value, before changing the value of the threshold value according to a request from a user, it is checked whether the second authentication is used, and whether the value of the threshold value after the change is larger than a predetermined value. Using the second authentication, and rejecting the request if the changed threshold value is not greater than the predetermined value,
A face authentication method according to attachment 6.
[Appendix 8]
In the detection of the use or non-use of the second authentication, the detection is performed based on a command from a user that specifies the use or non-use of the second authentication.
A face authentication method according to attachment 6 or 7.
[Appendix 9]
In the detection of the presence or absence of the use of the second authentication, the detection is performed based on the presence or absence of an interface unit for acquiring authentication information used in the second authentication from the authentication target,
The face authentication method according to any one of supplementary notes 6 to 8.
[Appendix 10]
In the setting of the threshold, the threshold is set to be larger than a predetermined value when the second authentication is used,
A face authentication method according to any one of supplementary notes 5 to 9.
[Appendix 11]
Computer
A first authentication unit that performs first authentication on a face image to be authenticated based on a threshold,
A second authentication unit that performs a second authentication by an authentication method other than face authentication;
A detection unit for detecting whether or not the second authentication unit is used;
When using the second authentication unit, a threshold value changing unit that sets a larger value as the threshold value than when not using the second authentication unit;
Using the threshold value after the setting, if the second authentication unit is not used, personal authentication is performed based on the result of the first authentication. If the second authentication unit is used, the first authentication is performed. A personal authentication unit for performing personal authentication based on the result of the authentication and the result of the second authentication,
Program to make it work.
[Supplementary Note 12]
In the first authentication, the feature amount of the face extracted from the face image to be authenticated is compared with the feature amount of the face extracted from the reference face image for each registered user, and the face image and the reference face image are compared. Calculate the similarity of
A face authentication device, a face authentication method, and a program according to any one of supplementary notes 1 to 11.
[Appendix 13]
In the setting of the threshold, when the second authentication is used, a value larger than a predetermined value is set as the threshold,
A face authentication device, a face authentication method, and a program according to any one of supplementary notes 1 to 12.
[Appendix 14]
In the setting of the threshold, when the second authentication is not used, a value equal to or smaller than a predetermined value is set as the threshold.
A face authentication device, a face authentication method, and a program according to any one of supplementary notes 1 to 13.
[Appendix 15]
In the first authentication, when the second authentication is used, the similarity between the face image to be authenticated and the reference face image of the registered user authenticated by the second authentication is calculated. Perform the first authentication by comparing with the threshold value,
A face authentication device, a face authentication method, and a program according to any one of supplementary notes 1 to 14.

100 face authentication device 111 interface 112 interface 113 interface 114 communication interface 115 operation input 116 screen display 120 storage 121 program 122 reference face image data 123 verification threshold 124 ... Reference card data 125... IC card authentication use data 130... Arithmetic processing unit 131... Input unit 132... Face image acquisition unit 133. Information acquisition unit 137 IC card authentication unit 138 Identity authentication unit 139 Output unit 141 Camera unit 142 Gate device 143 User 144 IC card reader 145 IC card 200 Face authentication device 300 Face authentication device 301 , A first authentication unit 302, a second authentication unit 303, Out section 304 ... personal authentication unit 305 ... threshold change unit

Claims (10)

A first authentication unit that performs first authentication on a face image to be authenticated based on a threshold,
A second authentication unit that performs a second authentication by an authentication method other than face authentication;
A detection unit for detecting whether or not the second authentication unit is used;
When using the second authentication unit, a threshold value changing unit that sets a larger value as the threshold value than when not using the second authentication unit;
Using the threshold value after the setting, if the second authentication unit is not used, personal authentication is performed based on the result of the first authentication. If the second authentication unit is used, the first authentication is performed. And a personal authentication unit for performing personal authentication based on the result of the authentication and the result of the second authentication. Before changing the threshold value according to a request from a user, the threshold value changing unit determines whether or not the second authentication unit is used and whether or not the changed threshold value is greater than a predetermined value. Checking, using the second authentication unit, and rejecting the request if the changed threshold value is not greater than the predetermined value,
The face authentication device according to claim 1. The detection unit performs the detection based on a command from a user that specifies whether to use the second authentication unit.
The face authentication device according to claim 1. The detection unit performs the detection based on the presence or absence of an interface unit for acquiring authentication information used by the second authentication unit from the authentication target,
The face authentication device according to claim 1. The threshold value changing unit sets the threshold value to be larger than a predetermined value when using the second authentication unit,
The face authentication device according to claim 1. Detecting the use of the second authentication by an authentication method other than face authentication,
When using the second authentication, a larger value is set as the threshold value in the first authentication that performs authentication of the face image to be authenticated based on the threshold value than when the second authentication is not used,
Using the threshold value after the setting, when the second authentication is not used, personal authentication is performed based on the result of the first authentication, and when the second authentication is used, the first authentication is performed. Performing personal authentication based on the result of the second authentication and the result of the second authentication;
Face authentication method. In the setting of the threshold value, before changing the value of the threshold value according to a request from a user, it is checked whether the second authentication is used, and whether the value of the threshold value after the change is larger than a predetermined value. Using the second authentication, and rejecting the request if the changed threshold value is not greater than the predetermined value,
The face authentication method according to claim 6. In the detection of the presence or absence of the use of the second authentication, the detection is performed based on the presence or absence of an interface unit for acquiring authentication information used in the second authentication from the authentication target,
The face authentication method according to claim 6. In the setting of the threshold, the threshold is set to be larger than a predetermined value when the second authentication is used,
The face authentication method according to claim 6. Computer
A first authentication unit that performs first authentication on a face image to be authenticated based on a threshold,
A second authentication unit that performs a second authentication by an authentication method other than face authentication;
A detection unit for detecting whether or not the second authentication unit is used;
When using the second authentication unit, a threshold value changing unit that sets a larger value as the threshold value than when not using the second authentication unit;
Using the threshold value after the setting, if the second authentication unit is not used, personal authentication is performed based on the result of the first authentication. If the second authentication unit is used, the first authentication is performed. A personal authentication unit for performing personal authentication based on the result of the authentication and the result of the second authentication,
Program to make it work.

Images