JP3669496B2 - Personal authentication information output device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a personal authentication information output apparatus that can be connected to a plurality of information processing systems via a network.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, a system for performing a commercial transaction such as purchasing an article or using a paid information service using a mobile phone is known. In order to carry out a commercial transaction, it is necessary to connect a mobile phone to a network provider via a base station and to connect to a business partner via a network.
[0003]
In order to connect a mobile phone to a network provider, the user usually needs to enter a password into the mobile phone. Even after the mobile phone is connected to the network provider, each time the user tries to use the service provided by the network provider (for example, reading mail or mediating connection with a business partner), the user is prompted to enter the password. There are many cases. However, it is not always possible to unify passwords required in this way into one password. This is because the number of password characters required may vary depending on the service provided by the network provider.
[0004]
Further, in order to conduct commercial transactions with a plurality of business partners, it is usually necessary to set different passwords for each business partner or for each service provided by one business partner. This is because there are many cases where the number of characters of the password required by the customer is different.
[0005]
[Problems to be solved by the invention]
In this way, when using multiple services provided by a network provider or performing business transactions with multiple business partners, it becomes difficult for users to manage passwords centrally because the types of passwords increase. .
[0006]
In order to facilitate password management, it is conceivable to reduce the number of characters in the password and make all passwords the same character string. However, if a password of about 4 digits is used, when a business transaction is conducted in front of the public, the password may be seen by surrounding people and misused. Conversely, if you increase the number of characters in the password, the user cannot remember.
[0007]
One of the objects of the present invention is to provide a personal authentication information output device capable of centrally managing passwords without making the user aware of the increase in the types of passwords even when the number of business partners increases. It is to be.
[0008]
On the other hand, as a personal authentication method, a method using biometric information such as a fingerprint and an iris instead of a password (symbol code string) has been developed (for example, Japanese Patent Laid-Open No. 11-53317). Such personal authentication methods are much more likely to be used for personal authentication when conducting business transactions, because the probability of erroneous authentication as a person is much lower than password-based personal authentication methods. Expected.
[0009]
However, when different personal authentication methods are used for each business partner, it is necessary to construct or change the system so that the mobile phone or the business partner can support a plurality of personal authentication methods. As a solution, for example, (1) a method of implementing a plurality of personal authentication methods in one mobile phone, (2) a method in which a user has a plurality of mobile phones (each of the plurality of mobile phones is a single (3) A method of configuring a system so that one business partner can cope with a plurality of personal authentication methods is conceivable. However, the method (1) results in an increase in the cost of the mobile phone, the method (2) results in inconvenience to the user, and the method (3) results in an increase in the cost of the business partner. Neither result is favorable.
[0010]
One of the objects of the present invention is to provide a personal authentication information output device capable of supporting a plurality of personal authentication methods.
[0011]
[Means for Solving the Problems]
  The personal authentication information output device of the present invention is connected via a network.With terminal equipmentA personal authentication information output device that can be connected to a plurality of information processing systems,The terminal device receives personal authentication information including biometric information from a user and transmits the personal authentication information to the personal authentication information output device via the network. The personal authentication information output device transmits the personal authentication information transmitted from the terminal device. From the database that associates and manages biometric information for each user and biometric information that is different from the biometric information for each user, the biometric information is associated with the biometric information based on the received user biometric information. Database access means for reading out the pseudo biometric information and outputting the read pseudo biometric information as personal authentication information to the information processing system selected from the plurality of information processing systems via the network. ing.
[0012]
  The personal authentication information output device of the present invention is a personal authentication information output device that can be connected to a plurality of information processing systems via a network, and means for receiving the user's biometric information as personal authentication information; Based on the received user biometric information, the pseudo biometric information associated therewith is read out from a database that associates and manages biometric information for each user and pseudo biometric information of biometric information different from the biometric information. And database access means for outputting the read pseudo biometric information as personal authentication information to the information processing system selected from the plurality of information processing systems via the network..
[0013]
  The biological information may be information representing at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting.
[0014]
  The pseudo biological information may be information representing at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting..
[0015]
  The pseudo biological information may be encoded in the same format as the biological information..
[0016]
  The database may manage a plurality of pieces of pseudo-biological information in association with each user's biometric information..
[0017]
  The degree of coincidence between the biometric information received from the user by the means for receiving the biometric information and the biometric information managed in the database is determined, and information indicating user candidates and the probability of each user are determined based on the determination result. Analyzing means for outputting information indicating the certainty level to be represented, and biometric information processing means for processing the simulated biological information read from the database into new simulated biological information using the information output from the analyzing means. May be.
[0018]
  The database may be a removable medium for the personal authentication information output device..
[0019]
  The personal authentication information output device of the present invention is a personal authentication information output device that can be connected to a plurality of information processing systems via a network, and means for receiving the user's biometric information as personal authentication information; Personal authentication means for determining whether there is biometric information that matches the received biometric information of the user from a database that manages biometric information and pseudo-biological information of biometric information different from the biometric information for each user, When it is determined by the personal authentication means that there is matching biometric information, the database is converted into the pseudo biometric information associated with the biometric information, and the converted pseudo biometric information is used as the personal authentication information for the network. The database access to be output to the selected information processing system from among the plurality of information processing systems. And a means.
[0023]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0024]
(Embodiment 1)
FIG. 1 shows an example of the configuration of a personal authentication information output device 290 according to Embodiment 1 of the present invention.
[0025]
The personal authentication information output device 290 is configured to be connected to a plurality of information processing systems via the network 300.
[0026]
In the example shown in FIG. 1, an information processing system 310 (connection destination a) and an information processing system 320 (connection destination b) are shown as connection destinations of the personal authentication information output device 290. However, the number of information processing systems connected to the personal authentication information output device 290 is not limited to two. The personal authentication information output device 290 is configured to be connected to an arbitrary number of information processing systems via the network 300.
[0027]
Connection / disconnection between the personal authentication information output device 290 and the information processing system is controlled by the network connection means 280. Network 300 may be any type of network (eg, the Internet).
[0028]
The information processing system 310 requests the user to input a password for each service provided by the information processing system 310. In order to determine whether or not a password input from a user is appropriate, the information processing system 310 has a database 330 that manages passwords in association with the user and the content of the service. In the example shown in FIG. 1, the database 330 manages the password 1 in association with the user A and the service a.
[0029]
For example, assume that user A offers the information processing system 310 to use the service a. Such an offer is achieved by, for example, directly or indirectly inputting information indicating that the service a is desired to the information processing system 310. In this case, the information processing system 310 determines whether or not the password input to the information processing system 310 matches the password 1 stored in the database 330. If they match, the information processing system 310 determines that the input password is appropriate, and permits the user A to use the service a. If they do not match, the information processing system 310 refuses that the user A uses the service a.
[0030]
Similarly, the information processing system 320 also requests the user to input a password for each service provided by the information processing system 320. Since the configuration of the information processing system 320 is the same as the configuration of the information processing system 310, the description thereof is omitted here.
[0031]
Personal authentication information output device 290 includes biometric information input means 210, personal authentication means 220, connection destination and service identification means 230, database 240, and database access means 250.
[0032]
The biometric information input unit 210 is used to input the biometric information of the user to the personal authentication information output device 290. When the biometric information represents at least one of a fingerprint, a face, a retina, an iris, a palm shape, and a handwriting, an image input device such as a camera or a tablet is used as the biometric information input unit 210. When the biological information represents sound, a microphone is used as the biological information input unit 210.
[0033]
The personal authentication unit 220 outputs a user authentication result (personal authentication result) based on the user's biometric information input by the biometric information input unit 210.
[0034]
The connection destination and service specifying unit 230 specifies the “information processing system (connection destination)” and “service” that the user has requested to use. Such specification is performed, for example, by referring to information indicating the latest connection destination and information indicating the latest service held in the network connection unit 280. Here, the “information processing system (connection destination)” is an information processing system selected by the user from among a plurality of information processing systems that can be connected to the personal authentication information output device 290. “Service” is a service selected by the user from among a plurality of services provided by the information processing system selected by the user. The information processing system selected by the user can be specified by, for example, a network address, a telephone number, or a connection destination name. The service selected by the user can be specified by, for example, the transaction amount or a response from the connection destination.
[0035]
The database 240 manages passwords in association with personal authentication results by the personal authentication means 220 and connection destination and service identification means 230.
[0036]
Based on the personal authentication result by the personal authentication unit 220 and the identification result by the connection destination and service identification unit 230, the database access unit 250 reads the password associated therewith from the database 240, and reads the read password from the network. The information is output to the information processing system of the connection destination via 300.
[0037]
Hereinafter, the operation of the personal authentication information output device 290 will be described. Here, it is assumed that user A performs a procedure for purchasing an article using service a (article purchase service) provided by information processing system 310. In this case, the user A connects the personal authentication information output device 290 to the information processing system 310 (connection destination a), and determines an article to purchase using the service a. The determination of the article to be purchased is achieved, for example, by following a hierarchical menu displayed on the screen of a display means (not shown).
[0038]
In this way, when the user selects the use of the service a of the information processing system 310, the information processing system 310 personally authenticates the input of the password in order to confirm whether or not the user is the user A himself / herself. Requests to the information output device 290.
[0039]
In response to the request from the information processing system 310, the biometric information input unit 210 requests the user to input biometric information. For example, the biometric information input unit 210 receives biometric information representing a fingerprint from the user and outputs the biometric information to the personal authentication unit 220.
[0040]
When the biometric information representing the fingerprint is input by the biometric information input unit 210, the personal authentication unit 220 outputs a signal specifying a person having the fingerprint to the database access unit 250. For example, when it is confirmed that the user is the user A himself / herself, the personal authentication unit 220 outputs a signal indicating “user A” to the database access unit 250 as a personal authentication result.
[0041]
In response to a request from the information processing system 310, the connection destination and service specifying unit 230 specifies the information processing system selected by the user and the service selected by the user. For example, when the information processing system selected by the user is the information processing system 310 (connection destination a) and the service selected by the user is specified as the service a, the connection destination and service specifying means 230 outputs a signal indicating “connection destination a” and “service a” to the database access unit 250 as a specific result.
[0042]
The database access means 250 receives a signal indicating “user A” from the personal authentication means 220, receives signals indicating “connection destination a” and “service a” from the connection destination and service identification means 230, and receives “user A” and “service A”. The password (“password 1” in the example shown in FIG. 1) associated with “connection destination a” and “service a” is read from the database 240. The password read from the database 240 is transmitted to the information processing system 310 at the connection destination via the network connection unit 280 and the network 300.
[0043]
Thus, according to the personal authentication information output device 290, a password corresponding to the information processing system selected by the user as the connection destination and the service selected by the user is output. Thereby, the user does not need to be aware of whether or not a different password is set according to the connection destination and the service. Even when the number of connection destinations and the types of services increase, the user need only input the same biological information to the biological information input means 210. As a result, even when the number of connection destinations and the types of services increase, centralized management of passwords can be performed without making the user aware of the increase in the types of passwords.
[0044]
Furthermore, according to the personal authentication information output device 290, personal authentication can be performed on the personal authentication information output device 290 side without depending on the personal authentication method of the information processing system of the connection destination. As a result, even when the information processing system at the connection destination continues to adopt the conventional personal authentication method (for example, the personal authentication method based on a password), the personal information with high reliability can be obtained without modifying the information processing system at the connection destination It becomes possible to introduce a method.
[0045]
In the present embodiment, the example in which the information input to the personal authentication unit 220 is biometric information has been described. One advantage of using biometric information for personal authentication is that the reliability of personal authentication is higher than when a password (symbol code string) is used. Therefore, it can be said that using biometric information for personal authentication is suitable for high-value commercial transactions. Another advantage of using biometric information for personal authentication is that it is less likely to be stolen or misused than when a password (symbol code string) is used. Therefore, it can be said that the use of biometric information for personal authentication is suitable for a commercial transaction in front of the public.
[0046]
However, information input to the personal authentication unit 220 is not limited to biometric information. The information input to the personal authentication unit 220 may be any information that can authenticate an individual. For example, a password (symbol code string) can be input to the personal authentication means 220 instead of the biometric information. Instead of the biometric information input unit 210, any type of input unit that receives input from the user can be used.
[0047]
In the present embodiment, the connection destination and service specifying unit 230 is selected by the information processing system selected by the user and the user among the plurality of information processing systems connectable to the personal authentication information output device 290. An example has been described in which both of services selected by the user among a plurality of services provided by the information processing system are specified. However, the present invention is not limited to this. For example, in one information processing system, when the same password is set regardless of the service provided by the information processing system, the connection destination and the service specifying unit 230 are connected to the personal authentication information output device 290. Only the information processing system selected by the user among the plurality of connectable information processing systems may be specified. As described above, the connection destination and service specifying unit 230 can function as a unit for specifying at least an information processing system selected by the user from among a plurality of information processing systems connectable to the personal authentication information output device 290.
[0048]
In the present embodiment, the example in which the information read from the database 240 by the database access unit 250 is a password (symbol code string) has been described. However, the present invention is not limited to this. The information read from the database 240 by the database access means 250 can be any type of personal authentication information capable of authenticating an individual. The personal authentication information may be, for example, biometric information (code string) obtained as an output of the biometric information input unit 210, or pseudo biometric information (code string) having the same format as the biometric information. . Here, the pseudo biological information refers to information that is artificially generated to resemble biological information.
[0049]
The personal authentication information output device 290 may be always operating, but may be activated only when there is a request for identity verification from the information processing system at the connection destination. The activation means 260 plays a role of activating the personal authentication information output device 290 as necessary. Thereby, the power consumed by the personal authentication information output device 290 is reduced.
[0050]
Note that the connection destination and service specifying unit 230 may acquire information for specifying the connection destination and service from a database (for example, an address book) other than the network connection unit 280.
[0051]
Furthermore, at least one of information held in the database 240, information input to the database 240, and information output from the database 240 may be encrypted.
[0052]
(Embodiment 2)
FIG. 2 shows an example of the configuration of the personal authentication information output apparatus 400 according to the second embodiment of the present invention.
[0053]
As in the first embodiment, personal authentication information output apparatus 400 is connected to a plurality of information processing systems including information processing system 310 (connection destination a) and information processing system 320 (connection destination b) via network 300. It is configured to be possible.
[0054]
Furthermore, the personal authentication information output device 400 is configured to be connectable to a plurality of terminal devices via the network 300.
[0055]
In the example shown in FIG. 2, a terminal device 420 (user terminal A) is shown as an example of a terminal device having a function of inputting biological information representing an iris, and has a function of inputting biological information representing a fingerprint. A terminal device 425 (user terminal B) is shown as an example of the terminal device.
[0056]
The terminal device 420 includes an iris pattern input means 430 for inputting the user's iris pattern, an encryption / decryption means 440 for encrypting the iris pattern, and the encrypted iris pattern via the network 300 for personal authentication information. Network connection means 450 for transmitting to the output device 400. Here, the iris pattern refers to biological information (code string) representing the iris of the user.
[0057]
The terminal device 425 includes a fingerprint pattern input unit 435 that inputs a user's fingerprint pattern, an encryption / decryption unit 445 that encrypts the fingerprint pattern, and the encrypted fingerprint pattern via the network 300. Network connection means 455 for transmitting to the output device 400. Here, the fingerprint pattern refers to biometric information (code string) representing a user's fingerprint.
[0058]
The personal authentication information output device 400 includes a fingerprint / iris correspondence personal authentication unit 480, a connection destination and service specifying unit 230, a database 240, and a database access unit 250.
[0059]
The fingerprint / iris correspondence personal authentication means 480 has a function of outputting a personal authentication result based on the fingerprint pattern and a function of outputting a personal authentication result based on the iris pattern.
[0060]
In FIG. 2, the same components as those shown in FIG. 1 are denoted by the same reference numerals, and detailed description thereof will be omitted.
[0061]
Hereinafter, the operation of the personal authentication information output device 400 will be described. Here, it is assumed that the user A who operates the terminal device 420 uses the service a (article purchase service) provided by the information processing system 310 to perform a procedure for purchasing an article. In this case, the user A connects the terminal device 420 to the information processing system 310 (connection destination a) and determines an article to be purchased using the service a. Determination of the article to be purchased is achieved, for example, by following a hierarchical menu displayed on the screen of a display unit (not shown) of the terminal device 420.
[0062]
In this way, when the user selects the use of the service a of the information processing system 310 using the terminal device 420, the information processing system 310 confirms whether or not the user is the user A himself / herself. The terminal apparatus 420 is requested to input personal authentication information.
[0063]
In response to a request from the information processing system 310, the iris pattern input unit 430 requests the user to input an iris pattern. The iris pattern input by the iris pattern input unit 430 is encrypted by the encryption / decryption unit 440, and the encrypted iris pattern is transmitted to the personal authentication information output device 400 by the network connection unit 450.
[0064]
The decryption unit 470 receives the encrypted iris pattern transmitted from the network connection unit 450 from the network connection unit 460, and generates the iris pattern by decrypting the encrypted iris pattern. The generated iris pattern is output to the fingerprint / iris correspondence personal authentication means 480.
[0065]
When the fingerprint / iris corresponding personal authentication means 480 receives the iris pattern from the decryption means 470, the personal authentication processing based on the iris pattern is executed, and the database access means 250 sends a signal for identifying the person having the iris pattern. Output to. For example, when it is confirmed that the user is the user A himself / herself, the fingerprint / iris correspondence personal authentication unit 480 outputs a signal indicating “user A” to the database access unit 250 as a personal authentication result.
[0066]
The operations of the connection destination and service specifying unit 230, the database 240, and the database access unit 250 are the same as those described in the first embodiment.
[0067]
The database access unit 250 reads the password (“password 1” in the example shown in FIG. 2) associated with “user A”, “connection destination a”, and “service a” from the database 240, and the read password Is output to the encryption means 520.
[0068]
The encryption unit 520 encrypts the password and outputs the encrypted password to the network connection unit 460.
[0069]
The network connection unit 460 transmits the encrypted password to the terminal device 420 via the network 300.
[0070]
The encryption / decryption means 440 of the terminal device 420 generates a password by decrypting the encrypted password. The generated password is transmitted to the information processing system 310 of the connection destination.
[0071]
Similarly, when the user selects the use of the service a of the information processing system 310 using the terminal device 425, the information processing system 310 checks whether the user is the user A himself or herself. The terminal device 425 is requested to input authentication information.
[0072]
In response to a request from the information processing system 310, the fingerprint pattern input unit 435 requests the user to input a fingerprint pattern. The fingerprint pattern input by the fingerprint pattern input unit 435 is encrypted by the encryption / decryption unit 445, and the encrypted fingerprint pattern is transmitted to the personal authentication information output device 400 by the network connection unit 455.
[0073]
The decryption unit 470 receives the encrypted fingerprint pattern transmitted from the network connection unit 455 from the network connection unit 460, and generates the fingerprint pattern by decrypting the encrypted fingerprint pattern. The generated fingerprint pattern is output to the fingerprint / iris correspondence personal authentication means 480.
[0074]
When the fingerprint / iris correspondence personal authentication means 480 receives the fingerprint pattern from the decryption means 470, the personal authentication processing based on the fingerprint pattern is executed, and a signal for specifying a person having the fingerprint pattern is sent to the database access means 250. Output to. For example, when it is confirmed that the user is the user A himself / herself, the fingerprint / iris correspondence personal authentication unit 480 outputs a signal indicating “user A” to the database access unit 250 as a personal authentication result.
[0075]
The operations of the connection destination and service specifying unit 230, the database 240, the database access unit 250, the encryption unit 520, and the network connection unit 460 are the same as those described above.
[0076]
Thus, according to the personal authentication information output device 400, the password corresponding to the information processing system selected by the user as the connection destination and the service selected by the user is output. Thereby, the user does not need to be aware of whether or not a different password is set according to the connection destination and the service. Even when the number of connection destinations and types of services increase, the user need only input the same biological information to the terminal device. As a result, even when the number of connection destinations and the types of services increase, centralized management of passwords can be performed without making the user aware of the increase in the types of passwords.
[0077]
Furthermore, according to the personal authentication information output device 400, the personal authentication information output device 400 can perform personal authentication without depending on the personal authentication method of the information processing system of the connection destination. As a result, even when the information processing system at the connection destination continues to adopt the conventional personal authentication method (for example, the personal authentication method based on a password), the personal information with high reliability can be obtained without modifying the information processing system at the connection destination It becomes possible to introduce a method.
[0078]
Furthermore, according to the personal authentication information output device 400, the personal authentication means 480 that can handle both the fingerprint pattern and the iris pattern is provided. Thereby, it is possible to cope with both the personal authentication method based on the fingerprint pattern and the personal authentication method based on the iris pattern. Thus, by making it possible to support a plurality of personal authentication methods, the user can select a personal authentication method that is convenient for the user. For example, in the case where the user frequently authenticates erroneously if he / she is not the person himself / herself, the user can select a personal authentication method suitable for himself / herself. In addition, even if the user is not suitable for a certain personal authentication method due to physical handicap, it becomes possible for the user to use another personal authentication method instead (for example, a fingerprint cannot be used due to a missing finger) For example, let the disabled use a personal authentication system based on iris patterns).
[0079]
In the present embodiment, the example in which the information input to the personal authentication unit 480 is a fingerprint pattern or an iris pattern has been described. However, the present invention is not limited to this. When the personal authentication unit 480 has a function of outputting a personal authentication result based on N different types of patterns, N different types of patterns may be input to the personal authentication unit 480. Here, N is an arbitrary integer of 2 or more. Each of the N different types of patterns can be any pattern that can authenticate an individual. Each of the N different types of patterns may be biological information or not biological information. For example, when the personal authentication unit 480 has a function of outputting a personal authentication result based on a password (symbol code string), the password (symbol code string) may be input to the personal authentication unit 480. As the biological information, information representing at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting can be used.
[0080]
The personal authentication information output device 400 may be operated by an information distribution service provider (provider) or may be operated by the user himself / herself.
[0081]
In the present embodiment, the iris pattern transmitted from the terminal device 420 to the personal authentication information output device 400 and the fingerprint pattern transmitted from the terminal device 425 to the personal authentication information output device 400 are both encrypted. The example in which the password transmitted from the authentication information output apparatus 400 to the connection information processing system is encrypted has been described. However, these pieces of information do not necessarily have to be encrypted. When these pieces of information are transmitted without being encrypted, an encryption unit and a decryption unit are not necessary.
[0082]
FIG. 3 shows another configuration example of the terminal device 420.
[0083]
The terminal device 420 shown in FIG. 3 further includes an IC card reader 530. When the user inserts the IC card into the IC card reader 530, the authentication information stored in the IC card is transmitted to the personal authentication information output device 400 together with the iris pattern.
[0084]
The fingerprint / iris correspondence personal authentication means 480 executes personal authentication processing based on the iris pattern and the authentication information stored in the IC card. Thus, it becomes possible to further improve the reliability of personal authentication by combining personal authentication based on biometric information and personal authentication based on information other than biometric information.
[0085]
The personal authentication based on the authentication information stored in the IC card is not necessarily performed in the personal authentication information output device 400. This personal authentication may be performed in another device (operated by another business operator) connected to the network 300.
[0086]
FIG. 4 shows another configuration example of the terminal device 420.
[0087]
The terminal device 420 shown in FIG. 4 further includes user ID input means 540. The user ID input unit 540 is used for a user to input a user ID to the terminal device 420. As the user ID, for example, a user name or a user nickname is used. The user ID is transmitted to the personal authentication information output device 400 together with the iris pattern.
[0088]
The fingerprint / iris-corresponding personal authentication unit 480 determines whether the iris pattern transmitted from the terminal device 420 matches the iris pattern corresponding to the user ID transmitted from the terminal device 420, thereby performing personal authentication processing. Execute. This eliminates the need for the fingerprint / iris-corresponding personal authentication unit 480 to sequentially check to which user among all users in the database the iris pattern transmitted from the terminal device 420 corresponds. Thereby, the time required for the personal authentication processing in the fingerprint / iris corresponding personal authentication means 480 can be greatly shortened.
[0089]
Note that the user ID may be input to the terminal device 420 using the keyboard of the terminal device 420. You may make it convert the audio | voice input from the microphone into user ID using an audio | voice recognition means.
[0090]
An ID unique to the terminal device may be used as the user ID, or a combination of user-specific information such as a user name and an ID unique to the terminal device may be used as the user ID. As an ID unique to the terminal device, for example, a telephone number (when the terminal device is a mobile phone) or an IP address can be used.
[0091]
FIG. 5 shows another configuration example of the terminal device 420. The configuration of the terminal device 420 shown in FIG. 5 is effective when the persons who can use the terminal device 420 are limited.
[0092]
The terminal device 420 shown in FIG. 5 further includes a candidate list storage unit 550. The candidate list storage unit 550 stores a list of user IDs (candidate lists) of persons who can use the terminal device 420. The candidate list is created in advance by the owner of the terminal device 420. The candidate list is transmitted to the personal authentication information output device 400 together with the iris pattern.
[0093]
The fingerprint / iris-corresponding personal authentication unit 480 determines whether the iris pattern transmitted from the terminal device 420 matches the iris pattern corresponding to the user ID in the candidate list transmitted from the terminal device 420. Execute the personal authentication process. This eliminates the need for the fingerprint / iris-corresponding personal authentication unit 480 to sequentially check to which user among all users in the database the iris pattern transmitted from the terminal device 420 corresponds. Thereby, the time required for the personal authentication processing in the fingerprint / iris corresponding personal authentication means 480 can be greatly shortened.
[0094]
The configuration of the terminal device 425 may be changed so that the terminal device 425 has the configuration shown in any of FIGS.
[0095]
(Embodiment 3)
FIG. 6 shows an example of the configuration of the personal authentication information output device 600 according to the third embodiment of the present invention.
[0096]
The personal authentication information output device 600 is configured to be connected to a plurality of information processing systems including the information processing system 750 (connection destination c) and the information processing system 770 (connection destination d) via the network 300. Has been.
[0097]
It is assumed that the information processing system 750 requests the user to input a fingerprint pattern. In order to determine whether or not the fingerprint pattern input from the user is appropriate, the information processing system 750 includes a database 760 that manages the fingerprint pattern in association with the user. In the example shown in FIG. 6, the database 760 manages the fingerprint pattern A in association with the user A.
[0098]
For example, assume that user A offers to use information processing system 750. Such an offer is achieved by, for example, directly or indirectly inputting information indicating that the information processing system 750 is to be used to the information processing system 750. In this case, the information processing system 750 determines whether the fingerprint pattern input to the information processing system 750 matches the fingerprint pattern stored in the database 760. If they match, the information processing system 750 determines that the input fingerprint pattern is appropriate, and permits the user A to use the information processing system 750. If they do not match, the information processing system 750 refuses to use the information processing system 750 by the user A.
[0099]
Similarly, it is assumed that the information processing system 770 also requests the user to input a fingerprint pattern. Since the configuration of the information processing system 770 is the same as the configuration of the information processing system 750, description thereof is omitted here.
[0100]
Furthermore, the personal authentication information output device 600 is configured to be connectable to a plurality of terminal devices including the terminal device 420 via the network 300.
[0101]
The personal authentication information output device 600 includes an iris pattern analysis unit 680, a database 700, and a database access unit 710.
[0102]
In FIG. 6, the same components as those shown in FIG. 2 are denoted by the same reference numerals, and detailed description thereof is omitted.
[0103]
Hereinafter, the operation of the personal authentication information output device 600 will be described. Here, it is assumed that the user A who operates the terminal device 420 performs an article purchase procedure using an article purchase service provided by the information processing system 750. In this case, the user A connects the terminal device 420 to the information processing system 750 (connection destination c), and determines an article to be purchased using the article purchase service. Determination of the article to be purchased is achieved, for example, by following a hierarchical menu displayed on the screen of a display unit (not shown) of the terminal device 420.
[0104]
In this way, when the user selects to use the information processing system 750 using the terminal device 420, the information processing system 750 performs personal authentication in order to confirm whether or not the user is the user A himself / herself. The terminal device 420 is requested to input information.
[0105]
In response to the request from the information processing system 750, the iris pattern input unit 430 requests the user to input an iris pattern (image data). The iris pattern input by the iris pattern input unit 430 is encrypted by the encryption / decryption unit 440, and the encrypted iris pattern is transmitted to the personal authentication information output device 600 by the network connection unit 450.
[0106]
The decryption unit 470 receives the encrypted iris pattern transmitted from the network connection unit 450 from the network connection unit 460, and generates the iris pattern by decrypting the encrypted iris pattern. The generated iris pattern is output to the iris pattern analyzing means 680.
[0107]
The iris pattern analysis means 680 analyzes the iris pattern (image data) and outputs an iris pattern (a bit string of “0” or “1”) as the analysis result.
[0108]
The database 700 manages the pseudo fingerprint pattern (“0” or “1” bit string) in association with the iris pattern (“0” or “1” bit string). Here, the pseudo fingerprint pattern refers to a pattern having the same format as the fingerprint pattern (a bit string of “0” or “1”).
[0109]
The database access unit 710 includes an iris pattern (a bit string “0” or “1”) output as an analysis result from the iris pattern analysis unit 680 and an iris pattern (“0” or “1”) stored in the database 700. Bit string) matches. Only when they match, the database access unit 710 reads the pseudo fingerprint pattern corresponding to the iris pattern from the database 700 and outputs it to the encryption unit 520.
[0110]
The encryption unit 520 encrypts the pseudo fingerprint pattern and outputs the encrypted pseudo fingerprint pattern to the network connection unit 460.
[0111]
The network connection unit 460 transmits the encrypted pseudo fingerprint pattern to the terminal device 420 via the network 300.
[0112]
The encryption / decryption means 440 of the terminal device 420 generates a pseudo fingerprint pattern by decrypting the encrypted pseudo fingerprint pattern. The generated pseudo fingerprint pattern is transmitted to the information processing system 750 of the connection destination.
[0113]
As described above, the personal authentication information output apparatus 600 uses the input first type personal authentication information (for example, iris pattern) as the second type personal authentication information (for example, pseudo fingerprint) different from the first type. And a second type of personal authentication information is output to a connection destination information processing system. Thereby, it is possible to provide a user interface that adopts the personal authentication method based on the first type of personal authentication information for the information processing system that adopts the personal authentication method based on the second type of personal authentication information. become. As a result, the user can select a personal authentication method that is convenient for the user. For example, a physically handicapped person who cannot use a fingerprint due to a missing finger is asked to input an iris pattern, and the iris pattern is converted into a pseudo-fingerprint pattern (a pattern identical to the fingerprint). It becomes possible to use an information processing system employing a personal authentication method.
[0114]
Also, since the personal authentication information output device 600 converts the personal authentication information, one terminal device does not need to implement a plurality of personal authentication methods, and the user does not need to have a plurality of terminal devices. There is no need to change the system 750 configuration.
[0115]
Note that the first type personal authentication information and the second type personal authentication information described above may be any type of personal authentication information capable of authenticating an individual. For example, the first-type personal authentication information and the second-type personal authentication information described above may be biometric information (code string) or pseudo-biometric information (code string), respectively. It may be a password (symbol code string). The biometric information may be information representing at least one of a fingerprint, a face, a retina, an iris, a palm shape, voice, and handwriting.
[0116]
In the terminal device 420, instead of the iris pattern input unit 430, a biometric information input unit that inputs biometric information other than the iris pattern (for example, biometric information representing a fingerprint, a face, a retina, a palm, voice, a handwriting, etc.) is provided. Thus, in the personal authentication information output device 600, instead of the iris pattern analysis unit 680, an analysis unit corresponding to the biometric information input unit may be provided.
[0117]
Instead of the pseudo fingerprint pattern, pseudo biometric information other than the pseudo fingerprint pattern (for example, pseudo biometric information representing a face, retina, iris, palm, voice, handwriting, etc.) may be stored in the database 700. . A password or biometric information may be stored in the database 700 instead of the pseudo biometric information.
[0118]
In addition, by associating a plurality of pieces of biological information (or pseudo biological information) with one user in the database 700, the personal authentication information output device 600 can be adapted to various information processing systems with one biological feature. May be configured.
[0119]
In the present embodiment, the iris pattern transmitted from the terminal device 420 to the personal authentication information output device 600 is encrypted, and the pseudo fingerprint transmitted from the personal authentication information output device 600 to the connected information processing system. The example in which the pattern is encrypted has been described. However, these pieces of information do not necessarily have to be encrypted. When these pieces of information are transmitted without being encrypted, an encryption unit and a decryption unit are not necessary.
[0120]
Furthermore, at least one of information held in the database 700, information input to the database 700, and information output from the database 700 may be encrypted.
[0121]
In the present embodiment, the pseudo-fingerprint pattern is not defined in the database 700 in association with the connection destination and the content of the service, but the connection is made in the same manner as described in the first and second embodiments. A pseudo fingerprint pattern may be defined in association with the destination and the content of the service.
[0122]
FIG. 7 shows another configuration example of the personal authentication information output device 600.
[0123]
In FIG. 7, the same components as those shown in FIG. 6 are denoted by the same reference numerals, and detailed description thereof will be omitted.
[0124]
The iris pattern analysis unit 800 receives the iris pattern from the decoding unit 470 and analyzes the iris pattern to thereby obtain information indicating the candidate of the user and information indicating the certainty of the probability of each user. Is output to the biological information processing means 810 as the analysis result. For example, when the certainty that the user is the user A is 0.9, the certainty that the user is the user B is 0, and the certainty that the user is the user C is 0.1, the iris pattern analysis The means 800 outputs information indicating the user candidate (user A, user C) and information indicating the certainty factor (0.9, 0.1) to the biological information processing means 810.
[0125]
The biological information processing unit 810 processes the pseudo biological information output from the database access unit 710 using information indicating the certainty level output from the iris pattern analysis unit 800. For example, the biometric information processing unit 810 generates a new pseudo fingerprint pattern by synthesizing a pattern corresponding to 90% of the pseudo fingerprint pattern of the user A and a pattern corresponding to 10% of the pseudo fingerprint pattern of the user C. . The pseudo biometric information processed by the biometric information processing unit 810 in this way is output to the encryption unit 520.
[0126]
Unlike passwords, biometric information varies each time biometric information is acquired. For example, every time a fingerprint pattern is acquired by a sensor, the fingerprint pattern changes. As described with reference to FIG. 7, by processing the pseudo fingerprint pattern according to the analysis result of the biological information, it is possible to simulate the fluctuation of the fingerprint pattern. As a result, a more natural fingerprint pattern can be input to the information processing system.
[0127]
FIG. 8 shows another configuration example of the personal authentication information output device 600.
[0128]
The personal authentication information output device 600 is configured such that an IC card 830 can be inserted. The IC card 830 stores an iris pattern (a bit string of “0” or “1”) and a fingerprint pattern (a bit string of “0” or “1”) as a pair. When the IC card 830 is inserted into the personal authentication information output device 600, the IC card data access unit 820 includes an iris pattern (a bit string of “0” or “1”) output as an analysis result from the iris pattern analysis unit 680. It is determined whether or not the iris pattern (a bit string “0” or “1”) stored in the IC card 830 matches. Only when they match, the IC card data access means 820 reads the fingerprint pattern corresponding to the iris pattern from the IC card 830 and outputs it to the encryption means 520.
[0129]
  In this way, by configuring the database with a removable medium such as an IC card or a memory, it becomes possible to configure a personal authentication information output device that can be used by many users.
As another embodiment of the present invention, a personal authentication information output device of the present invention is a personal authentication information output device that can be connected to a plurality of information processing systems via a network, and receives an input from a user. At least a receiving input means, a personal authentication means for outputting a personal authentication result of the user based on an input from the user, and an information processing system selected by the user among the plurality of information processing systems A specifying means for specifying, a database for managing personal authentication information in association with a personal authentication result by the personal authentication means and a specifying result by the specifying means, a personal authentication result by the personal authentication means and a specifying result by the specifying means, On the basis of the personal authentication information associated therewith from the database, and the read personal authentication information The has a database access means for outputting the selected information processing system via the network, thereby the objective described above being achieved.
The specifying unit may further specify a service selected by the user among a plurality of services provided by the information processing system selected by the user.
The personal authentication information may be a password, biometric information, or pseudo biometric information.
The input from the user may be biometric information representing at least one of a fingerprint, a face, a retina, an iris, a palm, a voice, and a handwriting.
Another personal authentication information output device of the present invention is a personal authentication information output device that can be connected to a plurality of terminal devices and a plurality of information processing systems via a network, wherein the plurality of terminal devices are: A first terminal device having first input means for receiving a first type of input from a user; and a second input means for receiving a second type of input different from the first type from the user. The first type input and the second type input from the user are provided to the personal authentication information output device via the network, respectively. The personal authentication information output device includes: a personal authentication unit that outputs a personal authentication result of the user based on one of the first type input and the second type input from the user; Managing personal authentication information in association with at least a specifying means for specifying an information processing system selected by the user among a plurality of information processing systems, a personal authentication result by the personal authentication means and a specifying result by the specifying means Based on the database, the personal authentication result by the personal authentication means and the specific result by the specifying means, the personal authentication information associated therewith is read from the database, and the read personal authentication information is read from the network. And database access means for outputting to the selected information processing system via the selected information processing system.
The specifying unit may further specify a service selected by the user among a plurality of services provided by the information processing system selected by the user.
The personal authentication information may be a password, biometric information, or pseudo biometric information.
The input from the user may be biometric information representing at least one of a fingerprint, a face, a retina, an iris, a palm, a voice, and a handwriting.
Another personal authentication information output device of the present invention is a personal authentication information output device that can be connected to a plurality of terminal devices and a plurality of information processing systems via a network, wherein the plurality of terminal devices are: A first terminal device having a first input means for receiving a first type of personal authentication information from a user, wherein the first type of personal authentication information is transmitted via the network to the personal authentication information output device; The personal authentication information output device is provided with a database for managing a second type of personal authentication information different from the first type in association with the first type of personal authentication information; Based on the type of personal authentication information, the second type of personal authentication information associated therewith is read from the database, and the read Database access means for outputting the second type of personal authentication information to the information processing system selected from the plurality of information processing systems via the network, thereby achieving the above object. The
Each of the first type personal authentication information and the second type personal authentication information may be a password, biometric information, or pseudo biometric information.
The biometric information may represent at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting.
The database may be a medium removable from the personal authentication information output device.
According to the present invention, personal authentication information (for example, a password) corresponding to at least the information processing system selected by the user as the connection destination is output. Thereby, the user does not need to be aware of whether different personal authentication information (for example, password) is set according to the information processing system of the connection destination. Even when the number of information processing systems connected to increases, the user need only input the same input to the input means. As a result, even when the number of information processing systems connected to increases, it is possible to unify personal authentication information (for example, passwords) without making the user aware of the increase in the types of personal authentication information (for example, passwords). Management becomes possible.
Furthermore, according to the present invention, personal authentication can be performed on the personal authentication information output device side without depending on the personal authentication method of the information processing system of the connection destination. As a result, even when the information processing system at the connection destination continues to adopt the conventional personal authentication method (for example, the personal authentication method based on a password), the personal information with high reliability can be obtained without modifying the information processing system at the connection destination. It becomes possible to introduce a method.
Furthermore, according to the present invention, personal authentication means that can handle both a first type of input from a user (for example, a fingerprint pattern) and a second type of input from a user (for example, an iris pattern). Is provided. Accordingly, both the personal authentication method based on the first type input and the personal authentication method based on the second type input can be supported. Thus, by making it possible to support a plurality of personal authentication methods, the user can select a personal authentication method that is convenient for the user.
[0130]
【The invention's effect】
  The present inventionThe first type personal authentication information (for example, iris pattern) input is converted into a second type personal authentication information (for example, a pseudo fingerprint pattern) different from the first type, and the second type Type personal authentication information is output to the information processing system of the connection destination. Thereby, it is possible to provide a user interface that adopts the personal authentication method based on the first type of personal authentication information for the information processing system that adopts the personal authentication method based on the second type of personal authentication information. become. As a result, the user can select a personal authentication method that is convenient for the user.
[0131]
Furthermore, according to the present invention, personal authentication can be performed on the personal authentication information output device side without depending on the personal authentication method of the information processing system of the connection destination. As a result, even when the information processing system at the connection destination continues to adopt the conventional personal authentication method (for example, the personal authentication method based on a password), the personal information with high reliability can be obtained without modifying the information processing system at the connection destination It becomes possible to introduce a method.
[0132]
Furthermore, according to the present invention, personal authentication means that can handle both a first type of input from a user (for example, a fingerprint pattern) and a second type of input from a user (for example, an iris pattern). Is provided. Thereby, it is possible to cope with both the personal authentication method based on the first type input and the personal authentication method based on the second type input. Thus, by making it possible to support a plurality of personal authentication methods, the user can select a personal authentication method that is convenient for the user.
[0133]
Further, according to the present invention, the input first type personal authentication information (for example, iris pattern) is converted into second type personal authentication information (for example, pseudo fingerprint pattern) different from the first type. Then, the second type personal authentication information is output to the information processing system of the connection destination. Thereby, it is possible to provide a user interface that adopts the personal authentication method based on the first type of personal authentication information for the information processing system that adopts the personal authentication method based on the second type of personal authentication information. become. As a result, the user can select a personal authentication method that is convenient for the user.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of the configuration of a personal authentication information output device 290 according to a first embodiment of the present invention.
FIG. 2 is a diagram showing an example of a configuration of a personal authentication information output device 400 according to Embodiment 2 of the present invention.
FIG. 3 is a diagram illustrating another configuration example of the terminal device 420;
4 is a diagram showing another configuration example of the terminal device 420. FIG.
FIG. 5 is a diagram showing another configuration example of the terminal device 420;
FIG. 6 is a diagram showing an example of the configuration of a personal authentication information output device 600 according to Embodiment 3 of the present invention.
7 is a diagram showing another configuration example of the personal authentication information output device 600. FIG.
FIG. 8 is a diagram showing another configuration example of the personal authentication information output device 600
[Explanation of symbols]
210 Biological information input means
220 Personal authentication means
230 Connection destination and service identification means
240 database
250 Database access means
290 Personal authentication information output device

Claims (9)

A personal authentication information output device capable of connecting to a terminal device and a plurality of information processing systems via a network, wherein the terminal device receives personal authentication information consisting of biometric information from a user, and To the personal authentication information output device,
The personal authentication information output device includes:
Means for receiving biometric information which is personal authentication information transmitted from the terminal device;
Based on the received user biometric information, the pseudo biometric information associated therewith is read out from the database that manages biometric information and pseudo biometric information of biometric information different from the biometric information for each user, A personal authentication information output device comprising: database access means for outputting the read pseudo biometric information as personal authentication information to the information processing system selected from the plurality of information processing systems via the network . A personal authentication information output device capable of connecting to a plurality of information processing systems via a network,
Means for receiving the user's biometric information as personal authentication information;
Based on the received user biometric information, the pseudo biometric information associated therewith is read out from the database that manages biometric information and pseudo biometric information of biometric information different from the biometric information for each user, A personal authentication information output device comprising: database access means for outputting the read pseudo biometric information as personal authentication information to the information processing system selected from the plurality of information processing systems via the network . The personal authentication information output device according to claim 1 , wherein the biological information is information representing at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting. The personal authentication information output device according to claim 1, wherein the pseudo biological information is information representing at least one of a fingerprint, a face, a retina, an iris, a palm shape, a voice, and a handwriting . 5. The personal authentication information output device according to claim 1, wherein the pseudo biometric information is encoded in the same format as the biometric information . The personal authentication information output device according to claim 1, wherein the database manages a plurality of pieces of pseudo biometric information in association with each biometric information of a user . The degree of coincidence between the biometric information received from the user by the means for receiving the biometric information and the biometric information managed in the database is determined, and information indicating user candidates and the probability of each user are determined based on the determination result. Analyzing means for outputting information indicating the certainty of representing, and biometric information processing means for processing the simulated biological information read from the database into new simulated biological information using the information output from the analyzing means. The personal authentication information output device according to any one of claims 1 to 6 . The personal authentication information output device according to claim 1, wherein the database is a medium that can be attached to and detached from the personal authentication information output device. A personal authentication information output device capable of connecting to a plurality of information processing systems via a network,
Means for receiving the user's biometric information as personal authentication information ;
Personal authentication means for determining whether there is biometric information that matches the biometric information of the received user from a database that manages biometric information and pseudo-biological information of biometric information different from the biometric information for each user;
When it is determined by the personal authentication means that there is matching biometric information, the database is converted into the pseudo biometric information associated with the biometric information, and the converted pseudo biometric information is used as the personal authentication information for the network. And a database access means for outputting to a selected information processing system from among the plurality of information processing systems.

Images