JP2022065696A - Identity verification server, identity verification method, and identity verification program - Google Patents

Abstract

To provide an identity verification server capable of instantly verifying identity.SOLUTION: An identity verification server receives, from a user terminal, user information including a user's name and organization, image data of identity verification documents including a face photograph, and face image data, determines whether the user information is the same as user information included in the identity verification documents, performs face authentication using the face photograph included in the image data of the identity verification documents and the photographed face image data, and authenticates the user as having been able to verify the identity, if it is determined that the user information is the same and face authentication means determines that the user is the same person.SELECTED DRAWING: Figure 1

Description

The present invention relates to an identity verification server for performing identity verification online and concluding an electronic signature or an electronic contract, an identity verification method, and an identity verification program.

Electronic contracts that electronically sign contract data are becoming widespread as a method of solving the costs of stamping and signing contracts, the cost of mailing contracts to each other, and the risk of loss. (For example, Patent Document 1)

When concluding an electronic contract, a method of performing an electronic signature using an electronic certificate certifying the signer may be used instead of a seal or signature, but when issuing an electronic certificate, the person must be the person himself / herself. The identity verification document for proof is sent to the certificate authority that issues the digital certificate, and after the certificate authority confirms the identity verification document, the URL and password for downloading the digital certificate are sent by identity verification mail etc. It often takes days or weeks to issue a digital certificate because the method used is common.

Japanese Unexamined Patent Publication No. 2005-222268

For this reason, when using an electronic contract, issuance of an electronic certificate is complicated, it takes time from application to issuance, and an electronic certificate fee is also required, which hinders the spread of electronic contracts.

The present invention has been made in view of such a situation, and an identity verification server capable of quickly and easily concluding an electronic contract by issuing an electronic certificate immediately while reliably verifying the identity. The purpose is to provide.

In the present invention, an identity verification request including user name information is received from a user terminal, user information having user name information and user organization information for specifying a user's affiliation is received, and an identity verification document and a user's identity verification document are received. Identity verification control means for making a face shooting request to the user terminal, user information storage means for storing user information received from the user terminal, and image data of identity verification documents including a face photograph received from the user terminal. Identity verification document storage means for storing, face image storage means for storing face image data received from a user terminal, user information determination means for determining whether user information and user information included in identity verification documents are the same. The user information determination means is the same as the face authentication means for performing face authentication with the face photograph included in the image data of the identity verification document and the captured face image data, and the identity verification control means. If it is determined that the person is the same person and the face authentication means is determined to be the same person, the person is authenticated as if the person can be confirmed.

Further, it has a business card data storage means for storing business card data received from the user terminal, and the user information determination means determines whether the user organization information and the organization information included in the business card data are the same, and controls identity verification. When the user information determination means further determines that the user organization information is the same, the means authenticates as if the identity can be confirmed.

When the identity verification request is received, the identity verification control means determines whether the storage date and time is within the predetermined period when the identity verification document corresponding to the user name is stored in the identity verification document storage means, and within the predetermined period. In the case of, a face photography request is made to the user terminal, and the face recognition means includes a face photograph included in the image data of the identity verification document stored in the identity verification document storage means and a face photograph taken from the user terminal. When face recognition is performed with and, and it is determined that the face recognition means are the same person, the identity verification control means authenticates as if the identity could be confirmed.

Further, it has an identity verification document determining means for determining the authenticity of the received identity verification document, and the identity verification control means further authenticates that the identity verification can be performed when the identity verification document is genuine.

Further, it has an electronic contract generation means for generating an electronic contract, and the identity verification control means determines that the user information is the same and the face authentication means is the same person. If this is the case, the user authenticates that the identity can be confirmed, and the electronic contract generation means requests the electronic certificate issuing server to generate the electronic certificate based on the user information. An electronic signature generation request is made to the electronic signature server, and the received electronic certificate and the electronic signature are attached to generate an electronic contract.

Further, the electronic contract generation means may be configured to destroy the electronic certificate received after the electronic contract is generated.

This is an identity verification method performed by an identity verification server, in which a step of receiving an identity verification request including user name information from a user terminal, user information having user name information and user organization information for specifying a user's affiliation are received, and the user information is received. Identity verification document, step to make a request to shoot the user's face to the user terminal, step to store user information received from the user terminal, step to store image data of identity verification document including face photo received from the user terminal , A step of storing the face image data received from the user terminal, a step of determining whether the user information and the user information included in the identity verification document are the same, a face photograph included in the image data of the identity verification document, and the like. Step to perform face authentication with the captured face image data, if it is determined that the user information is the same and it is determined that they are the same person, the electronic certificate is sent to the electronic certificate issuing server based on the user information. Provided is an electronic contract conclusion method performed by an identity verification server having a generation request, a step of making an electronic signature generation request to an electronic signature server, and a step of assigning a received electronic certificate and an electronic signature to generate an electronic contract. ..

Further, it is an identity verification program that functions a computer as an identity verification server, and is a user having a step of receiving an identity verification request including user name information from a user terminal, user name information, and user organization information for specifying the user's affiliation. Steps to receive information and make an identity verification document, a request to take a picture of the user's face to the user terminal, a step to store user information received from the user terminal, an image of the identity verification document including a face photo received from the user terminal A step of storing data, a step of storing face image data received from a user terminal, a step of determining whether the user information and the user information included in the identity verification document are the same, and included in the image data of the identity verification document. A step to authenticate the face with the face photograph and the photographed face image data, and a step to authenticate as if the identity can be confirmed when the user information is determined to be the same and the same person is determined. Provide an identity verification program with.

According to the present invention, user information including user organization information that identifies a user name and affiliation, image data of an identity verification document, business card data, and photographed on the spot from a user terminal that wants to digitally sign an electronic contract. Whether the user information is the same as the identity verification document by receiving the face image data, and whether the photographed face image data and the face photo included in the identity verification document are face-authenticated and the business card data and the organization information are the same. By making a judgment, it is possible to confirm the identity online. Therefore, when the data required for identity verification is received and the identity verification process is completed, an electronic certificate can be issued and an electronic signature can be attached to the electronic contract, so that the electronic contract can be concluded promptly. Can be done.

Further, the identity verification server destroys the electronic certificate issued for concluding the electronic contract after using it for digitally signing the electronic contract, and does not send the issued electronic certificate to the user. For this reason, it is possible to request the issuance of an electronic certificate each time an electronic signature is required, and by requesting identity verification each time, security can be improved and the electronic certificate can be made disposable. It can be set inexpensively.

Furthermore, when the data of the identity verification document is stored in the storage unit, if it is within a predetermined period from the storage, the face authentication is performed using the identity verification document data to improve the security and perform the identity verification procedure. Can be simplified.

FIG. 1 is a drawing showing an example of an overall configuration including an identity verification server in the present invention. FIG. 2 is a diagram showing an example of a functional block diagram of the identity verification server 20. FIG. 3 is a flowchart showing a processing flow of the identity verification server 20 when an identity verification request is received from the user terminal 10 according to the embodiment of the present invention. FIG. 4 is a flowchart showing a processing flow of the identity verification server 20 when an identity verification request is received from the user terminal 10 according to the embodiment of the present invention and the identity verification documents are stored. FIG. 5 is an example of a database stored in the user information storage unit 211 of the identity verification server 20. FIG. 6 is an example of a database stored in the electronic contract storage unit 219 of the identity verification server 20. FIG. 7 is an example of a hardware configuration diagram of the identity verification server 20.

Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. FIG. 1 is a drawing showing an example of an overall configuration including an identity verification server 20 in the present invention. The identity verification server 20 is connected to a plurality of user terminals 10, an electronic certificate issuing server 30, and an electronic signature server 40 via a network, and the electronic signature server 40 is connected to a time stamp server 50. Here, the time stamp network server 50 is connected to the identity verification server 20 via the electronic signature server 40, but may be directly connected to the identity verification server 20. Further, the network may be of any network form such as the Internet regardless of whether it is wired or wireless.

The user terminal 10 is, for example, a terminal used for an identity verification request for making an electronic contract, and is, for example, an information communication terminal such as a personal computer, a mobile phone, or a smartphone. The user terminal 10 connects to the identity verification server 20 via the Internet when making an electronic contract. Here, only two user terminals 10 are shown, but three or more user terminals 10 may be connected. A user who wants to conclude a contract by an electronic contract connects to the identity verification server 20 by the user terminal 10. At this time, the user can log in to the identity verification server 20 by inputting his / her name and address, organization information such as the company to which he / she belongs, registering the user, and setting an ID and password. It may be configured to connect. This is because when a person who belongs to a company concludes a contract on behalf of or on behalf of the company, the organization information of the user is also required.

The user terminal 10 is a terminal provided with a camera. The camera captures a user's face image, an identity verification document, a business card, and the like, and transmits the image data to the identity verification server 20. "Identity verification documents" refers to certificates that can be used to verify identity, such as a driver's license, Individual Number Card, and passport. A scanner may be provided, and the scanner may generate image data of an identity verification document or a business card.

The identity verification server 20 is a server that authenticates identity verification. It should be noted that the configuration may be configured to mediate the granting of an electronic signature or the conclusion of an electronic contract after the authentication of identity verification. For example, it is connected to a user terminal 10 used by a user who is a contractor of an electronic contract, and receives an identity verification request from the user terminal 10 in order to digitally sign a predetermined electronic contract. The identity verification server 20 makes a request for transmitting identity verification document data and business card data, and a request for taking a picture of the user's face, based on the user information including the user's name and address, the organization information to which the user belongs, and the like received from the user terminal 10. conduct. Further, the identity verification server 20 uses the received user information, the identity verification document, the business card data, and the user's face photography data to perform face authentication by comparing the face photo and the face photography data of the identity verification document, and the user information and the person. Identity verification is performed by determining whether the data is the same by comparing with the confirmation document data and business card data, and by determining the authenticity of the identity verification document.

When the identity verification is obtained, the identity verification server 20 generates a signature imprint of the electronic signature, requests the electronic certificate issuing server 30 to issue the electronic certificate, and makes the electronic certificate issued to the electronic signature server 40. It may be configured to make a digital signature generation request based on the above. When the electronic signature is received from the electronic certificate issuing server 30 and the electronic signature server 40, the electronic signature is given to the target electronic contract. If the other party's electronic signature of the contract is also given, the identity verification server 20 concludes the contract and stores the electronic contract in the storage unit.

The digital certificate issuing server 30 is a server owned by a certificate authority that issues a digital certificate, and is a server that performs a digital certificate issuing service. When the electronic certificate issuance request is received from the identity verification server 20, the electronic certificate is issued and sent to the identity verification server 20. The digital certificate is generated in the digital certificate issuing server 30 based on the user information included in the digital certificate issuance request, and is transmitted to the identity verification server 20. The digital certificate includes, for example, an encryption key pair of a private key and a public key for encryption. The key is not limited to this, and a common key may be used.

The electronic signature server 40 is a server that is connected to the identity verification server 20 via the Internet and is given an electronic signature. For example, the electronic signature server 40 receives from the identity verification server 20 the electronic contract data to be signed and the encryption key (for example, a private key) included in the electronic certificate issued by the electronic certificate issuing server 30. do.

The electronic signature server 40 is connected to the time stamp server 50 via the Internet. The electronic signature server 40 receives a time stamp from the time stamp server 50. The electronic signature server 40 generates, for example, a hash value from the electronic contract data received from the identity verification server 20, and encrypts the hash value with the user's private key to generate an electronic signature. Further, the hash value is transmitted to the time stamp server 50, and the time stamp is received from the time stamp server 50.

The electronic signature server 40 transmits the generated electronic signature and the received time stamp to the identity verification server 20.

The time stamp server 50 is a server owned by the time stamp station that guarantees the time. The Timestamp Bureau guarantees the time as a third party. For example, the time stamp server 50 generates a time stamp using the hash value and time information of the electronic contract received from the electronic signature server 40, and transmits the time stamp to the electronic signature server 40.

FIG. 2 is a diagram showing an example of a functional block diagram of the identity verification server 20. In FIG. 2, the identity verification server 20 includes a user information determination unit 201, an identity verification document determination unit 203, a face authentication unit 205, an identity verification control unit 207, an electronic contract generation unit 208, a communication unit 209, and a storage unit 210. In this example, the identity verification server 20 having the electronic contract generation unit 208 is shown, but the electronic contract generation unit 208 may be a separate server, and the identity verification server 20 may be configured to perform only identity verification authentication. good.

The user information determination unit 201 determines whether the user information and the user information included in the identity verification document are the same. Specifically, the image data of the identity verification document is received from the user terminal 10 and stored in the identity verification document storage unit 213. The user information determination unit 201 refers to the user information storage unit 211 for the user name, address, or user name and address corresponding to the logged-in user, and is read from the image data of the identity verification document. Determine if it is the same as your name and address. The user information determination unit 201 recognizes characters from the image data of the identity verification document by, for example, OCR (optical character recognition) processing, and determines whether or not they are the same based on the character recognition result.

The user information determination unit 201 determines whether the user organization information and the organization information included in the business card data are the same. Specifically, the user information determination unit 201 receives from the user terminal 10 and performs OCR processing on the affiliation name such as a company name or a department included in the business card data stored in the business card data storage unit 217 from the image data of the business card. Read by etc. The read company name or affiliation name is compared with the user organization information associated with the user ID input from the user terminal 10 or logged in, and it is determined whether or not they are the same.

The identity verification document determination unit 203 determines the authenticity of the received identity verification document. The image data of the identity verification document received from the user terminal 10 and stored in the identity verification document storage unit 213 is read out, and it is determined whether or not the identity verification document included in the image data is genuine. For example, the type of certificate such as whether the identity verification document is a driver's license or My Number card is identified by image recognition, and the authenticity is determined by whether the characteristics of the certificate are detected from the image data of the identity verification document. .. The identity verification document determination unit 203 may use a plurality of image data used for the authenticity determination instead of one. For example, image data including the front surface of the identity verification document, image data including the back surface, image data including the side surface so that the thickness can be known, and the like may be used. The identity verification document determination unit 203 may be configured to target only image data having a size and resolution equal to or larger than a predetermined value for authenticity determination, and to determine that the image data cannot be determined if the image data is not.

The face recognition unit 205 performs face recognition using the face photograph included in the image data of the identity verification document and the captured face image data. The face recognition unit 205 reads out the image data including the identity verification document received from the user terminal 10 and stored in the identity verification document storage unit 213, extracts the face photograph, and together with the face image data taken by the user terminal 10. Compare and determine if they are the same person. For example, the face recognition unit 205 has a feature amount extracted from a face photograph of image data in which an identity verification document has been taken, and a feature extracted from face image data taken in response to a face shooting request on the user terminal 10. Compare with the amount to determine if they are the same person. The feature amount may be calculated by detecting a part such as an eye or a nose existing on the face, or an image feature amount may be used, and the feature amount is not limited to one method.

More specifically, the identity verification control unit 207 requests the user terminal 10 for data necessary for concluding an electronic contract, and the determination result by the user information determination unit 201, the identity verification document determination unit 203, and the face authentication unit 205. Authenticate the identity verification based on. When the identity verification control unit 207 authenticates that the identity has been confirmed, the electronic contract generation unit 208 generates an electronic contract.

When the identity verification control unit 207 receives an identity verification request for an electronic signature including user name information from the user terminal 10 for a predetermined electronic contract, the user name information and the user organization information for specifying the user's affiliation are used. The user information, the identity verification document, and the photograph request of the user's face are sent to the user terminal. For example, when the user terminal 10 specifies an electronic contract to be signed and concluded, and the user terminal 10 transmits a user information including the user name of the person who signs the signature, the user terminal 10 sends an identity verification request other than the user name information. Controls to send information about the user, such as user organization information, identity verification documents, and user face capture requests. If the identity verification server 20 is a server that cannot be accessed without logging in, user information such as the user name, address, company name, and affiliation is input in advance for login, and the user information storage unit 211 stores the user information. If so, even if the identity verification request is received, there is no need to request information about the user because the login information is already stored. In that case, the image data of the identity verification document and the request for photographing the user's face are made to the user terminal 10. Further, the electronic contract generation unit 207 may request the user terminal 10 to transmit the image data of the user's business card when the user digitally signs on behalf of the representative of the corporation.

When requesting the image data of the identity verification document to the user terminal 10, the identity verification control unit 207 may request the image data of each of the front surface, the back surface, and the side surface. Further, the identity verification control unit 207 may request the user terminal 10 to take a picture of the user's face and request the user terminal 10 to take a picture on the spot using the camera of the user terminal 10. At this time, it may be requested to photograph not only the front surface of the face but also the left side surface and the right side surface. Further, if the identity verification document, face photography data, or business card data received from the user terminal 10 is not image data having a predetermined resolution and data size, the identity verification control unit 207 determines an error and retransmits the data. You may make a request to the terminal 10.

When the identity verification control unit 207 receives the image data of the identity verification document and the face image data taken by the user terminal 10 from the user terminal 10, the user information determination unit 201, the identity verification document determination unit 203, and the face recognition unit Let 205 make a judgment respectively.

When the user information determination unit 201 determines that the user information is the same and the face recognition unit 205 determines that the person is the same person, the identity verification control unit 207 authenticates that the identity has been confirmed. In addition, when the identity verification document determination unit 203 further determines that the identity verification document is genuine, the identity verification control unit 207 may authenticate as if the identity verification was possible. Further, when the user information determination unit 201 further determines that the user organization information included in the business card data and the user organization information of the user information are the same, the identity verification control unit 207 authenticates as if the identity verification was possible. You may go.

Further, when the identity verification control unit 207 receives the identity verification request for electronic signature from the user terminal 10, the identity verification control unit 207 determines and stores the identity verification document corresponding to the user in the identity verification document storage unit 213. If so, it may be determined whether or not the storage date and time is within the predetermined period, and if it is within the predetermined period, it may be omitted to request the user terminal 10 to take a face image and request the image data of the identity verification document. .. Not limited to this, the identity verification document storage unit 213 stores only the identity verification documents within a predetermined period from the storage date and time, and the image data of the identity verification documents is deleted after the predetermined period elapses. If so, the identity verification control unit 207 does not determine whether the storage date and time is within the predetermined period, but only determines whether the image data of the identity verification document is stored in the identity verification document storage unit 213. You may.

The electronic contract generation unit 208 generates an electronic contract. The electronic certificate issuance is requested to the electronic certificate issuing server 30, and the electronic signature generation request is made to the electronic signature server 40, and the electronic contract is generated by the received electronic certificate and electronic signature. The electronic contract generation unit 208 makes an electronic certificate generation request to the electronic certificate issuing server 30 and an electronic signature generation request to the electronic signature server 40 based on the user information.

The electronic contract generation unit 208 may generate image data of a signature imprint for an electronic signature. Not limited to this, the electronic signature server 40 may be configured to generate image data of the signature imprint together with the electronic signature. When the electronic contract generation unit 208 receives the electronic certificate from the electronic certificate issuing server 30, it sends the received electronic certificate and the electronic contract to be concluded to the electronic signature server 40 together with the electronic signature generation request, and the electronic signature server 40. When the electronic signature is received from, the electronic signature is given to the electronic contract together with the image data of the signature imprint. It should be noted that the electronic signature server 40 may be configured to receive the time stamp together with the electronic signature.

The electronic contract generation unit 208 may be configured to give an electronic signature to the electronic contract, and when the electronic signature is given by both users, destroy the electronic certificate used for concluding the electronic contract.

The communication unit 209 sends / receives data to / from the user terminal 10 and also sends / receives data to / from the electronic certificate issuing server 30 and the electronic signature server 40. The communication method may be wired or wireless.

The storage unit 210 includes a user information storage unit 211, an identity verification document storage unit 213, a face image storage unit 215, a business card data storage unit 217, and an electronic contract storage unit 219. In the storage unit 210, user information, identity verification documents, face images, and business card data are configured as separate storage units, but the storage unit is not limited to this, and all of them may be stored as one storage unit. Or, of course, it may be composed of three storage units.

The user information storage unit 211 stores the user information received from the user terminal 10. For example, the user name, user address, date of birth, and user organization information (company name, department name, etc.) that identifies the user's affiliation are stored in association with the user ID uniquely given to the user. Further, when the identity verification server 20 is configured to require login, the ID and password required for login may also be stored.

Further, the user information storage unit 211 includes a user information determination result and an organization information determination result determined by the user information determination unit 201, an authenticity determination result determined by the identity verification document determination unit 203, and a face authenticated by the face authentication unit 205. The authentication result, the final identity verification result, and the identity verification registration date may be stored. In this case, all the determination results are stored in the user information storage unit 211, but the present invention is not limited to this. For example, the identity verification document storage unit 213 may store the authenticity determination result determined by the identity verification document determination unit 203 in association with the identity verification document data.

The identity verification document storage unit 213 stores the image data of the identity verification document including the face photograph received from the user terminal 10. For example, the image data of the identity verification document is stored in association with the user ID. The identity verification document is an official certificate with a photograph of the person, for example, a driver's license, a passport, an Individual Number Card, or the like. In this case, the image data to be stored is not limited to one, and may be plural. For example, the image data on the front surface, the image data on the back surface, and the image data on the side surface (thickness) of the identity verification document may be stored. The identity verification document storage unit 213 may store the storage date stored in the identity verification document storage unit 213 together with the image data of the identity verification document. Further, the identity verification document storage unit 213 may be configured to delete the image data of the identity verification document after a predetermined period, for example, one year has elapsed from the storage date.

The face image storage unit 215 stores the face image data received from the user terminal 10 in association with, for example, the user ID. For example, the identity verification control unit 207 makes a face photography request to the user terminal 10, and as a response, the image data taken by the user terminal 10 is taken, and the received image data is stored in the face image storage unit 215 as face image data. The face image data is not limited to one, and a plurality of face image data such as a front face image, a left profile, and a right profile may be stored.

The business card data storage unit 217 stores the business card data received from the user terminal 10 in association with, for example, the user ID. Business card data is image data obtained by photographing a business card. The business card data to be stored is not limited to one, and a plurality of business card data such as the front surface and the back surface may be stored.

The electronic contract storage unit 219 stores the concluded electronic contract. The contract ID uniquely assigned to each electronic contract in association with the electronic contract data and the electronic contract conclusion date may be stored. Electronic contract data with an electronic signature is stored.

FIG. 3 is a flowchart showing a processing flow of the identity verification server 20 when an identity verification request is received from the user terminal 10 according to the embodiment of the present invention. Here, a case where an identity verification request is made when assigning an electronic signature for concluding an electronic contract will be described as an example, but the purpose of identity verification is not limited to the granting of an electronic signature.

First, the communication unit 209 of the identity verification server 20 receives the identity verification request from the user terminal 10 (step S301). The identity verification request from the user terminal 10 includes information for specifying an electronic contract to be digitally signed, user information such as a user name, and the like. If the user cannot be accessed without logging in after registering the user in advance, the user information may not be included in the identity verification request. In this case, the user information storage unit 211 is referred to based on the login information, and the user information is acquired.

The identity verification control unit 207 determines whether or not the identity verification document corresponding to the user information is stored (step S302). Specifically, based on the user information included in the identity verification request, it is determined whether or not the image data of the identity verification document corresponding to the user information is stored in the identity verification document storage unit 213. If it is stored, go to (Yes) and (1), and the case will be described with reference to FIG.

When the image data of the identity verification document of the user who made the identity verification request is not stored in the identity verification document storage unit 213 (No), the identity verification control unit 207 transfers the identity verification document data and the business card data to the user terminal 10. Request (step S303). Further, even when the storage date and time of the identity verification document data is not within the predetermined period (No in step S401 (2)), the identity verification document data and the business card data are requested to the user terminal 10. Here, if additional detailed information such as the user's address, date of birth, company name where the user works, department to which the user belongs, etc. is required for the user information, the identity verification control unit 207 is the user. Information is acquired by providing a predetermined form to the terminal 10 and having the terminal 10 input the form. Also, regarding the image data of the identity verification document, for example, a document recognized as the identity verification document (driver's license, my number, etc.) is shown, and the image data obtained by photographing one of the documents is requested to be transmitted. As image data, three image data of the front side, the back side, and the side surface of the identity verification document may be requested. Similarly, as for the business card data, three image data of the front surface, the back surface, and the side surface of the business card may be requested, or the image data of only the front surface may be requested. At this time, the image may be configured to accept only images having a predetermined size or more and a resolution or more.

When the identity verification control unit 207 receives the identity verification document data and the business card data from the user terminal 10, they store them in the identity verification document storage unit 213 and the business card data storage unit 217, respectively (step S304). At this time, it is stored in association with the user information. When storing, the storage date may be stored together.

The identity verification control unit 207 transmits a face photographing request to the user terminal 10 (step S305). This is to prevent spoofing and confirm the identity of the user who performs the electronic signature. The identity verification control unit 207 requests that the camera of the user terminal 10 photograph the front surface, the left side surface, and the right side surface of the user's face and transmit each of them. The face photography data received by the identity verification control unit 207 is used for determining the identity of the face photograph possessed by the identity verification document.

When the identity verification control unit 207 receives the face photographing data from the user terminal 10, it stores the user information in the face image storage unit 215 in association with the user information, for example, the user ID (step S306). The stored face image data may be discarded after being used for face recognition by the face recognition unit 205, or may be stored for a predetermined period in association with the face recognition result.

When the data required for identity verification is received from the user terminal 10, the identity verification control unit 207 causes the user information determination unit 201, the identity verification document determination unit 203, and the face authentication unit 205 to make determinations for identity verification, respectively.

The identity verification document determination unit 203 determines the authenticity of the identity verification document (step S307). For example, the identity verification document determination unit 203 identifies the identity verification document from one or more image data of the identity verification document, and determines whether or not the identity verification document included in the image data has the characteristics of the document. By doing so, it is determined whether or not the identity verification document included in the image data of the identity verification document is genuine. In addition, in the authenticity determination of the identity verification document, another known method such as using the feature amount of the image data may be used. In the case of a fake (fake), the identity cannot be confirmed, so the process ends as if the identity could not be confirmed. At this time, the user terminal 10 may be notified that the electronic signature procedure cannot be performed because the identity cannot be confirmed.

If it is genuine (genuine), then the user information determination unit 201 determines whether the user information and the identity verification document are the same (step S308). The user information determination unit 201 determines whether or not the user information corresponding to the user terminal 10 and the user information extracted from the image data including the identity verification document are the same. Specifically, whether the user name, address, and date of birth of the user received or logged in from the user terminal 10 are the same as the user name, address, and date of birth extracted from the image data obtained by taking the identity verification document. Judgment is made.

The user information determination unit 201 may read the user name, address, and date of birth from the image data obtained by capturing the identity verification document, for example, by OCR processing. The user information determination unit 201 may read out the user information stored in the user information storage unit 211 and read out and determine the image data of the identity verification document stored in the identity verification document storage unit 213. If the read user name, address, date of birth and the user information stored in the user information storage unit 211 are not the same (not the same), the identity cannot be confirmed, and the process ends as if the identity could not be confirmed. At this time, the user terminal 10 may be notified that the identity cannot be confirmed.

When the user information and the user information included in the image data of the identity verification document are the same (same), it is determined whether the face image data included in the identity verification document and the face photography data are the same (step S309). The face recognition unit 205 extracts the face image data included in the identity verification document, and performs face recognition to determine whether or not the person is the same as the face in the face shooting data taken by the user terminal 10. As the face recognition method, each part of the face may be extracted and each feature may be calculated to determine whether or not the person is the same person, or the feature amount of the image data may be calculated to determine the existing face recognition. Perform face recognition with technology. As a result of face authentication, when the face recognition unit 205 determines that the person is not the same person (not the same person), the person cannot be confirmed, so the process is terminated as if the person could not be confirmed. At this time, the user terminal 10 may be notified that the electronic signature procedure cannot be performed because the identity cannot be confirmed.

When the face authentication unit 205 determines that they are the same person (same), it is determined whether the user information determination unit 201 user information and the business card data are the same (step S310). The user information determination unit 201 determines whether or not the user organization information in the user information corresponding to the user terminal 10 and the user organization information extracted from the image data obtained by photographing the business card are the same. Specifically, the user organization information (company name, department name) that specifies the affiliation of the user corresponding to the user received or logged in from the user terminal 10 and the user organization information extracted from the image data obtained by photographing the business card are Determine if they are the same.

The user information determination unit 201 may read the company name or department name to which the user belongs from the image data of the business card, for example, by OCR processing. The user information determination unit 201 may read out the user information stored in the user information storage unit 211 and read out and determine the image data of the business card stored in the business card data storage unit 217. If the user information in the user information and the user organization information included in the business card data are not the same (not the same), the identity cannot be confirmed, so the process ends as if the identity could not be confirmed. At this time, the user terminal 10 may be notified that the electronic signature procedure cannot be performed because the identity cannot be confirmed.

When the user information determination unit 201 determines that the user information and the business card data are the same, the identity verification control unit 207 authenticates as if the identity could be confirmed (step S311). Further, the electronic contract generation unit 208 makes a request for issuing an electronic certificate and an electronic signature (step S312). That is, the electronic contract generation unit 208 transmits the user information received from the user terminal 10, such as the user name, address, date of birth, company name, affiliation, etc., to the electronic certificate server 30, thereby performing electronic certification. Send a call generation request. Upon receiving the electronic certificate from the electronic certificate server 30, the electronic contract generation unit 208 transmits the electronic contract to the electronic signature server 40 together with the electronic contract to be concluded with the private key included in the electronic certificate, and sends an electronic signature generation request.

The electronic signature server 40 generates a hash value from the received electronic contract, and generates an electronic signature by encrypting the hash value with a private key. The electronic signature server 40 transmits the generated electronic signature to the identity verification server 20. When the electronic signature server 40 receives the electronic signature generation request, the electronic signature server 40 transmits the time stamp generation request to the time stamp server 50, and the time stamp generated based on the hash value generated from the electronic contract is transmitted from the time stamp server 50. You may try to receive it. In this case, the electronic signature server 40 transmits the electronic signature and the time stamp to the identity verification server 20.

The electronic contract generation unit 208 attaches the received electronic certificate and electronic signature to the electronic contract (step S313). The electronic contract generation unit 208 attaches the electronic certificate and public key received from the electronic certificate issuing server 30, the electronic signature received from the electronic signature server 40, and the generated signature imprint data to the electronic contract, and generates an electronic contract. do.

When the electronic signatures of all the contractors are given, the electronic contract generation unit 208 stores the generated electronic contract in the electronic contract storage unit 219 (step S314). At this time, the digital certificate of each user may be destroyed. This is because the certificate can be obtained more easily and inexpensively by using an electronic certificate that has already been used for verification and is not used for concluding other contracts.

In FIG. 3, after requesting the identity verification document and the business card data, the face photography request is made, but it is not always necessary to be in this order, and after the face photography request, the identity verification document and the business card data are requested. It may be in the order of identity verification documents, face photography, and business card data.

In addition, the order of identity verification determination is as follows: identity verification of identity verification documents, identity determination of user information and identity verification documents, identity determination of face photography data and face image data of identity verification documents, user information and business card data. The identity determination does not necessarily have to be performed in this order, and the order does not matter. Further, all the determinations may be performed simultaneously.

FIG. 4 is a flowchart showing a processing flow of the identity verification server 20 when an identity verification request for electronic signature is received from the user terminal 10 according to the embodiment of the present invention and the identity verification document is stored. ..

The identity verification control unit 207 determines whether or not the identity verification document corresponding to the user information is stored (step S302), and if it is stored (Yes to (1)), the identity verification control unit 207 further It is determined whether or not the storage date and time of the identity verification document data is within the predetermined period (step S401). The identity verification control unit 207 refers to the identity verification document storage unit 213, reads out the storage date and time of the identity verification document corresponding to the user information received from the user terminal 10, and determines whether or not it is within a predetermined period. The predetermined period is, for example, a period of one year or less, a period of six months or less, and the like. It should be noted that this step S401 is unnecessary if the identity verification document storage unit 213 is configured to delete the identity verification document data for which a predetermined period has passed.

If the storage date and time of the identity verification document data is within the specified period (Yes), the stored identity verification document data can be used, so the request for sending the identity verification document data is unnecessary, and only the face photography request is sent. (Step S402). Further, when the storage date and time of the identity verification document data is within a predetermined period, the business card data transmission request is not required, and the business card data and the user corresponding to the user information received from the user terminal 10 stored in the business card data storage unit 217 are not required. The configuration is such that the user organization information stored in the information storage unit 211 is used, but the present invention is not limited to this, and a business card data transmission request may be made.

The identity verification control unit 207 requests that the camera of the user terminal 10 photograph the user's face, for example, the front surface, the left side surface, and the right side surface, and transmit each of them. The electronic contract generation unit 207 may prepare an Internet page for photographing and transmitting the image and provide it to the user terminal 10. The received face photography data is used by the face recognition unit 205 to determine whether or not the person is the same as the face photograph possessed by the identity verification document.

If the storage date and time of the identity verification document data is not within the specified period (No to (2)), the stored identity verification document cannot be used for identity verification, so the process returns to step S303 to verify the identity. Request document data and business card data to the user terminal 10.

When the identity verification control unit 207 receives the face photography data from the user terminal 10, it stores the user information in the face image storage unit 215 in association with the user information, for example, the user ID (step S403). The stored face image data may be discarded after being used for face recognition by the face recognition unit 205, or may be stored for a predetermined period in association with the face recognition result.

The face recognition unit 205 determines whether the face image data included in the identity verification document and the face photography data are the same (step S404). The face recognition unit 205 extracts the face image data included in the identity verification document stored in the identity verification document storage unit 213, and determines whether or not the face is the same as the face of the face capture data captured by the user terminal 10. Perform face recognition. As the face recognition method, each part of the face may be extracted and each feature may be calculated to determine whether or not the person is the same person, or the feature amount of the image data may be calculated to determine the existing face recognition. Perform face recognition with technology. As a result of face authentication, when the face recognition unit 205 determines that the person is not the same person (not the same person), the person cannot be confirmed, so the process is terminated as if the person could not be confirmed. At this time, the user terminal 10 may be notified that the electronic signature procedure cannot be performed because the identity cannot be confirmed.

When the face recognition unit 205 determines that the person is the same (same), the identity verification control unit 207 authenticates the person as if the identity could be confirmed (step S405). Then, the electronic contract generation unit 208 makes an electronic certificate issuance request to the electronic certificate issuing server 30 and an electronic signature issuance request to the electronic signature server 40 (step S406). Here, if the storage date and time of the identity verification document is within the predetermined period, the request for the business card data is also omitted, but when the business card data is also requested, the user information and the business card data are the same as in step S310. May be determined.

The electronic contract generation unit 208 attaches the received electronic certificate and electronic signature to the electronic contract (step S407). The electronic contract generation unit 208 attaches the electronic certificate and public key received from the electronic certificate issuing server 30, the electronic signature received from the electronic signature server 40, and the generated signature imprint data to the electronic contract, and generates an electronic contract. do.

When the electronic signatures of all the contractors are given, the electronic contract generation unit 208 stores the generated electronic contract in the electronic contract storage unit 219 (step S408). At this time, the digital certificate of each user may be destroyed. This is because the certificate can be obtained more easily and inexpensively by using an electronic certificate that has already been used for verification and is not used for concluding other contracts. Then, the process is terminated.

FIG. 5 is an example of a database stored in the user information storage unit 211 of the identity verification server 20. User information such as user name, address, date of birth, company name, affiliation, and other user organization information input by the user terminal 10 and received by the identity verification server 20 is uniquely given to the user in the user information storage unit 211. It is stored in association with the user ID to be used. These user information may be requested and stored when the electronic signature request is sent to the identity verification server 20, and the user information may be requested by requesting user registration when accessing the identity verification server 20. You may try to remember it. If login is required when making an electronic signature request on the identity verification server 20, the login name and password required for login may be stored in association with the user ID.

Further, the user information storage unit 211 stores the determination result and the authentication result determined by the user information determination unit 201, the identity verification document determination unit 203, and the face recognition unit 205 in association with the user information. As the user information determination result, the user information determination unit 201 stores the same determination result of the user's name, address, and date of birth and the name, address, and date of birth extracted from the data of the identity verification document. In the face recognition result, the face recognition unit 205 stores the face recognition result of the face photography data transmitted from the user terminal 10 and the face photo data extracted from the image data of the identity verification document. As the face recognition result, data such as a scoring result when compared may also be stored.

As the organization information determination result, the user information determination unit 201 determines the same determination between the user organization information such as the company name and department name included in the user information and the information such as the company name and department name extracted from the business card data. Remember the results you have done. The certificate authenticity determination result stores the authenticity determination result of the identity verification document performed by the identity verification document determination unit 203. The identity verification result is the result of all the judgments of the user information judgment result, the face authentication result, the organization information judgment result, and the certificate authenticity judgment result, which are the judgment results for the identity verification, and whether the identity verification was possible or not. Remember. When it can be determined that the certificate is genuine and the user information, organization information, and face authentication are the same, it is stored as if the identity could be confirmed. If any one of them is determined to be not the same or is fake, it is memorized as not being able to confirm the identity. It should be noted that only the identity verification result may be stored, and the user information determination result, face authentication result, organization information determination result, and certificate authenticity determination result may not be stored. In addition, the date and time when the identity verification was performed may be stored as the identity verification registration date.

FIG. 6 is an example of a database stored in the electronic contract storage unit 219 of the identity verification server 20. The electronic contract storage unit 219 stores the concluded electronic contract. The contract name, contract data, and the registration date in which the contract is stored in the electronic contract storage unit 219 are stored in association with the contract ID uniquely assigned to the contract. Here, the registration date and the like are also stored in association with each other, but the form of the database is not limited to this.

FIG. 7 is an example of a hardware configuration diagram of the identity verification server 20. The identity verification server 20 may be configured as a computer and a program executed on a personal computer. It should be noted that it does not necessarily have to be composed of one computer, and may be configured by a plurality of computers.

The computer is a computer-readable recording medium such as a CPU (central processing unit) 701, a RAM (Random Access Memory) 703, a ROM (Read Only Memory) 705, and a hard disk drive connected to the CPU 701 via a bus. An external storage device 707, a communication interface 709 for connecting to a communication network line, an I / O interface 711, and the like are provided. The I / O interface 711 includes buttons and keys which are interfaces 715, and a display 713 which is a display device. Is connected. In this case, for example, the functions of the user information 201 of the identity verification server 20, the identity verification document determination unit 203, the face authentication unit 205, the identity verification control unit 207, and the electronic contract generation unit 208 are realized by a program executed on the computer. The function of the storage unit 210 is realized by the external storage device 707. The program that realizes various functions is stored in the external storage device 707, read out in the RAM 703, and then executed by the CPU 701.

10 User terminal 20 Identity verification server 30 Electronic certificate issuing server 40 Digital signature server 50 Timestamp server

Claims (8)

The user receives an identity verification request including user name information from the user terminal, receives user information having user name information and user organization information that identifies the user's affiliation, and makes an identity verification document and a request for photographing the user's face. Identity verification control means to the terminal and
A user information storage means for storing the user information received from the user terminal, and
An identity verification document storage means for storing image data of an identity verification document including a face photograph received from the user terminal, and
A face image storage means for storing face image data received from the user terminal, and
A user information determining means for determining whether the user information and the user information included in the identity verification document are the same, and
A face recognition means for performing face recognition using the face photograph included in the image data of the identity verification document and the photographed face image data.
When the user information determination means determines that the user information is the same and the face recognition means determines that the person is the same person, the identity verification control means authenticates the person as if the identity could be confirmed. Confirmation server. Further, it has a business card data storage means for storing business card data received from the user terminal.
The user information determination means determines whether the user organization information and the organization information included in the business card data are the same.
The identity verification server according to claim 1, wherein the identity verification control means authenticates as if the identity could be confirmed when the user information determination means further determines that the user organization information is the same. When the identity verification request is received, the identity verification control means determines whether the storage date and time is within a predetermined period when the identity verification document corresponding to the user name is stored in the identity verification document storage means. If it is within the specified period, a face shooting request is made to the user terminal, and the face is photographed.
The face recognition means performs face recognition with a face photograph included in the image data of the identity verification document stored in the identity verification document storage means and a face photograph taken from the user terminal.
The identity verification server according to claim 1 or 2, wherein when it is determined that the face recognition means are the same person, the identity verification control means authenticates as if the identity could be confirmed. In addition, it has an identity verification document determination means for determining the authenticity of the received identity verification document.
The identity verification control means according to claim 1 to 3, further authenticates that the identity verification document can be verified when the identity verification document is genuine. Furthermore, it has an electronic contract generation means for generating an electronic contract,
When the user information determination means determines that the user information is the same and the face recognition means determines that the person is the same person, the identity verification control means authenticates the person as being able to confirm the identity. When the electronic contract generation means authenticates that the identity verification control means has confirmed the identity,
The electronic contract generation means makes an electronic certificate generation request to an electronic certificate issuing server and an electronic signature generation request to an electronic signature server based on the user information, and grants the received electronic certificate and the electronic signature. The identity verification server according to claims 1 to 4, which generates an electronic contract. The identity verification server according to claim 5, wherein the electronic contract generation means destroys the electronic certificate received after the electronic contract is generated. Identity verification This is an identity verification method performed by an identity verification server.
A step of receiving an identity verification request including user name information from a user terminal, receiving user information having the user name information and user organization information specifying the user's affiliation, and making an identity verification document and a request for taking a picture of the user's face. Steps to the user terminal,
A step of storing the user information received from the user terminal,
A step of storing image data of an identity verification document including a face photograph received from the user terminal.
The step of storing the face image data received from the user terminal,
A step of determining whether the user information and the user information included in the identity verification document are the same.
A step of performing face recognition with a face photograph included in the image data of the identity verification document and the face image data taken.
If it is determined that the user information is the same and it is determined that the user information is the same person, the step of authenticating that the identity can be confirmed,
An identity verification method performed by an identity verification server that has. An identity verification program that allows a computer to function as an identity verification server.
A step of receiving an identity verification request including user name information from a user terminal,
A step of receiving user information having the user name information and user organization information specifying the user's affiliation, and making an identity verification document and a request for photographing the user's face to the user terminal.
A step of storing the user information received from the user terminal,
A step of storing image data of an identity verification document including a face photograph received from the user terminal.
The step of storing the face image data received from the user terminal,
A step of determining whether the user information and the user information included in the identity verification document are the same.
A step of performing face recognition with a face photograph included in the image data of the identity verification document and the face image data taken.
If it is determined that the user information is the same and it is determined that the user information is the same person, the step of authenticating that the identity can be confirmed,
Identity verification program with and.

Images