JP2574755B2 - Personal authentication system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Industrial Application Field] The present invention relates to a security system for a plurality of users, for example, in a system such as an entry / exit management system or a bank terminal, particularly, an index / voiceprint. The present invention relates to a personal authentication system suitable for reducing the load on the system when personal identification of a user is performed using personal authentication data such as a face, and for preventing misuse by a third party.

[Conventional technology]

Conventionally, personal authentication to check whether the user is legitimate to prevent unauthorized entry into important facilities such as nuclear power plants and computer rooms, or to prevent unauthorized use of files such as systems for multiple users Has been done. The main means of personal authentication are secret passwords or PINs, ID cards, fingerprints,
Some use personal identification data such as voiceprints and face data that are unique to individuals. JP-A-58-176681 discloses an example of a personal authentication system using a fingerprint, and JP-A-59-194274 discloses an example of using a face data.

[Problems to be solved by the invention]

However, in the case of a system using a password, a personal identification number, or an ID card, measures against theft are not sufficient. Also ID
In the case of a card, there is a risk of unauthorized intrusion and unauthorized use due to forgery.

On the other hand, when using personal authentication data such as fingerprints, it is necessary to store personal authentication data in a central file, and as the number of users increases, the file capacity increases, the system scale increases, and file management becomes complicated. However, there is a drawback that the load on the system increases, for example, the cost of data transmission between the central file and the authentication input / output terminal increases. In order to solve the above-mentioned drawback, there is a method in which each user is provided with a portable information medium such as an IC card, and personal authentication data is stored in the medium. There was a problem that fraud could not be prevented. Even if the authentication data is encrypted and stored, the above problem is not solved.

SUMMARY OF THE INVENTION An object of the present invention is to provide a personal authentication system that solves the above-mentioned problems by reducing the load on the system by distributed processing, performing high-speed processing, and preventing malicious third parties from being illegally operated.

[Means for solving the problem]

In order to achieve the above object, the present invention is characterized by the following means.

First, portable information storage media, such as magnetic cards, ICs
When personal authentication data such as a fingerprint is stored and stored in a card, an optical card, or the like, for example, RSA (Rivent-Shamir-Adlem) is used.
an) Encrypt with a public key encryption method like the method. In public key cryptography, the encryption key used for encryption and the decryption key used for decryption are different, and knowing one and finding the other requires a huge amount of computation, making it virtually impossible. Has nature.

Second, a part of a decryption key to be used as a password is registered on a storage medium. For example, in the RSA method, the decryption key can be 200 digits or more in decimal, and it may be difficult to use the password as it is. Therefore, of the decryption key, for example, only the 30th, 60th, 90th, and 120th digits are used as a password, and the remaining portion is written on a medium.

Third, a relatively large amount of personal authentication data is encrypted by a secret key encryption method that can be processed at a high speed such as, for example, the United States standard encryption method (DES), and the secret key is encrypted by a public key encryption on a medium. To memorize it.

In FIG. 4, the above-mentioned RSA method is adopted as the public key cryptosystem, and a part of the key is a constant unique to the system.

For the RSA method, see, for example, Nikkei Electronics (197
Please refer to “Recent encryption methods that could not be solved without a solution” in the September 4, 2008 issue). In the RSA method, a set of two numbers (n, e) is used as an encryption key, and a set of two numbers (n, d) is used as a decryption key. It is practically impossible to find (n, d) by knowing (n, e). Therefore, by fixing n as a constant peculiar to the system, the third party can obtain the key (n,
e ') and (n, d') cannot be forged.

[Action]

According to the first means, the reliability of the system is improved by encrypting the personal authentication data by the public key cryptosystem and making the user secretly manage only the decryption key as a personal identification number. In other words, only those possessing a medium in which the correct personal identification number and the correct personal authentication data are stored are determined to be valid users, so it is safe even if the personal identification number and / or the storage medium are stolen. is there. In addition, since only the system administrator can know the encryption key, it is impossible to forge the password and the storage medium.

According to the second means, the same reliability improving effect can be achieved with only a four-digit password.

According to the third means, the processing time required for authentication can be shortened.

Further, according to the fourth means, it is possible to independently perform personal authentication with a plurality of authentication terminals without collectively managing information necessary for authentication in a central file.

Therefore, user-specific encryption keys (n,
There is no need to store and manage e) in a file, and authentication can be performed by a plurality of independent authentication terminals.

〔Example〕

Hereinafter, an embodiment of the present invention will be described with reference to FIGS.

FIG. 1 shows the configuration of an authentication terminal device.
The user 1 carries the memory card 2 created and issued by the administrator in advance and receives authentication. User 1
Inserts the memory card 2 into the card input device 3 and manually inputs the password assigned by the administrator from the password input device 4. The decryption device 5 decrypts the authentication face data from the information (eg, a part of the decryption key) stored in the memory card 2 and the input personal identification number, and converts the image data in which the user's face is photographed. Output. On the other hand, the face image data of the user 1 captured by the camera 6 is input to the identification device 7 together with the decoded face image data.
The discrimination device 7 compares the two pieces of face image data, and outputs whether or not the two pieces of face image data are regarded as coincident as an authentication result. Here, the automatic identification by the device is considered, however, only the display of the reconciliation result is performed, and the identification may be performed by a human.

FIG. 2 shows the contents of the information stored in the memory card 2. The personal authentication face data 23 encrypted by the DES encryption method, the DES key 22 obtained by encrypting the DES encryption key by the RSA encryption method, and a part 21 of the RSA decryption key are stored.

FIG. 3 is a flowchart showing the contents of the processing performed in the decoding device 5 of FIG. First, a complete RSA decryption key is synthesized from the password input by the user and a part 21 of the composite key stored in the memory card 2. The personal identification number is, for example, a combination of numbers of predetermined digits of the RSA composite key, and a part 21 of the decryption key on the memory card 2 has more digits. Even with the above method, the effect of the present invention remains unchanged as long as a complete RSA decryption key cannot be obtained without knowing the password. Next, the DES key is decrypted from the synthesized RSA decryption key, and the face data 23 for personal authentication is decrypted using the finally decrypted DES key to obtain data necessary for authentication. Further, the RSA decryption key mentioned here indicates only d out of a set of two numbers (n, d) necessary for decryption of the RSA encryption, and n is a predetermined system constant. A specific decryption process is P≡C ^d (mod n), where C is encrypted data and P is decrypted data. mod n indicates a remainder modulo n.

As described above, according to the present embodiment, since the authentication processing can be independently performed by a plurality of terminals, the load on the system can be reduced. Also, the use of public key cryptography makes it impossible to forge the memory card itself.
Unless the three requirements of the card and the user are satisfied, the user is not authenticated as a valid user, so that high reliability can be realized. Also, since the password may be a part of the RSA recovery key, the secret management of the user is easy. Furthermore, since a large amount of personal authentication data is encrypted by a high-speed secret key method, there is an effect that authentication processing can be performed at high speed.

As described above, the face image data is used as the authentication data in the present embodiment, but it is needless to say that the same effect can be obtained with a fingerprint, voiceprint, or the like indicating other personal features. Further, the public key / private key method may be a method other than RSA and DES, respectively. Further, the memory card may be any one of those equipped with a CPU, only an IC memory, and an optical memory card. If a card having an erasable memory is used, the key can be changed periodically, and further, the system reliability is improved, and the card can be reused and the economy is improved.

〔The invention's effect〕

According to the present invention, since personal authentication can be performed independently by a plurality of terminals, the load on the system can be reduced, and furthermore, by using a public key cryptosystem and a secret key cryptosystem together, forgery is impossible and the system This has the effect that the reliability of the authentication is improved and the authentication process can be performed at high speed.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a personal authentication system, FIG. 2 is a diagram showing the contents of information stored in a memory card, and FIG. 3 is a flowchart of a process performed by the decryption device in FIG.

 ──────────────────────────────────────────────────続 き Continuation of the front page (56) References JP-A-60-136869 (JP, A) JP-A-61-3254 (JP, A) IPSJ “Information Processing” 25 [6] (1984) 554-560

Claims (2)

(57) [Claims] (1) A public key cryptosystem which combines image data which can be erased in storage contents and which shows characteristics of a user encrypted by a secret key cryptosystem, and said image data. A first decryption key encrypted by a method and a part of a second decryption key for decrypting the first decryption key excluding a predetermined digit number, which is represented by a decimal number And (2) storage medium input means for inputting the storage contents of the storage medium; and (3) a storage medium that is given in advance to an authorized user and is excluded from the second decryption key. (4) a password input by the password input means to one part of the second decryption key input by the storage medium input means; The second decryption key is synthesized by fitting, and the synthesized second Decryption means for decrypting the first decryption key encrypted using the second decryption key and outputting the image data encrypted using the decrypted first decryption key; (5) Image input means for inputting an image representing the characteristics of the user; (6) comparing the image input by the image input means with the image data output by the decoding means; A personal authentication system, comprising: identification means for identifying whether or not the user is a legitimate user, and performing personal authentication. 2. The personal authentication system according to claim 1, wherein said first decryption key is a DES decryption key, and said second decryption key is an RSA decryption key. And personal authentication system.