JP4685532B2 - Biometric authentication system - Google Patents

Description

  The present invention relates to a biometric authentication system, for example, a biometric authentication system and an authentication method for authenticating a legitimate person using biometric information of a user who makes a business transaction at a financial institution.

  Recently, when a user conducts a transaction such as withdrawal at a financial institution, authentication is performed using the user's biometric information as a personal authentication with a high security level. Attention has been focused on a mechanism that allows traders to accept transactions.

  For example, as a conventional technique using biometric authentication for financial transactions, for example, Japanese Patent Application Laid-Open No. 2004-152046 (Patent Document 1) optically stores a user's biometric information on a medium such as a user's passbook. There is disclosed a technique for authenticating a legitimate user by recording in a readable manner and comparing biometric information acquired from the user at the time of authentication with biometric information recorded on a medium. Yes.

  In Japanese Patent Application Laid-Open No. 2003-50783 (Patent Document 2), a plurality of types of biological information are registered, and an overall similarity with a plurality of types of biological information input at the time of authentication is calculated to perform authentication determination. Thus, a composite authentication system that improves the accuracy of biometric authentication is disclosed.

JP 2004-152046 A JP 2003-50783 A

As in Patent Document 2, a system that performs authentication determination by calculating a total similarity of multiple types of biological information can improve accuracy compared to a system that performs authentication by comparing only one piece of biological information. However, since it is necessary to connect a plurality of types of devices to all terminals that perform authentication, there is a problem that costs increase.
In addition, since it is necessary to manage all types of biological information, the management risk increases. Furthermore, there is a possibility that the problem for each type of biological information cannot be effectively compensated by simply combining multiple types of biological information.

  An object of the present invention is to provide a biometric authentication system and method that can perform biometric authentication with relatively low cost and high security when authenticating a user using a plurality of terminals.

A biometric authentication system according to the present invention includes a first terminal that authenticates a user, and a second terminal that allows a user to operate according to an authentication result in the first terminal and performs business or transaction processing. In the authentication system, the first terminal includes a first biological information reading unit that reads a plurality of types of biological information, a medium reading / writing unit that reads and writes a recording medium, and a biological information reading unit. A first control unit that collates the read biometric information with the biometric information read from the medium reading / writing unit;
The second terminal includes a second biological information reading unit that reads other biological information different from certain biological information, a medium reading unit that reads a recording medium, and biological information read from the second biological information reading unit. A second control unit that collates the biological information read from the medium reading unit, and the first type of biological information read from the first biological information reading unit and the biological information read from the medium reading / writing unit. As a result of the collation, if the authentication is possible, the second type of biometric information is read from the first biometric information reading unit, written to the recording medium from the medium reading / writing unit, and the result of authentication at the first terminal and the first 1 is a biometric authentication system that records biometric information read from one biometric information reading unit on a recording medium and transmits it to a second terminal .

Also preferably, the first terminal includes an iris authentication device or a vein authentication device, the first control unit performs authentication by biometric information of the user acquired by the iris authentication device or a vein authentication device, the The two terminals include any one of a fingerprint authentication device, a face authentication device, and a voice authentication device, and the second control unit is acquired by any of the fingerprint authentication device, the face authentication device, or the voice authentication device. Authentication using biometric information is performed.
In other words, the first terminal acquires biometric information that is resistant to secular change and performs authentication, and the second terminal acquires biometric information that is vulnerable to secular change and performs authentication.
Further, in a preferred embodiment, the recording medium is an IC card comprising a memory and a C PU, the memory, personal information of a user, a plurality of kinds of biometric information, the authentication result (first stage authentication result) of the first terminal And the table which manages the information of the authentication result (2nd step authentication result) in a 2nd terminal is stored.
The table further stores information indicating the expiration date, and the medium reading / writing unit of the first terminal updates the expiration date when the biometric information record in the table is updated.
The biometric authentication system according to a preferred example is applied to a financial system in which the first terminal is at least one reception terminal or a pre-authentication terminal, and the second terminal is a plurality of window terminals or transaction terminals.

The biometric authentication method according to the present invention is a biometric authentication method in a system that includes a first terminal that authenticates a user and a second terminal that is business-related to the first terminal and performs biometric authentication of the user. There,
In the first terminal, the step of reading the first biological information of the user by the first reading means, and the read first biological information and the first recorded in the recording medium possessed by the user in advance. A first biometric authentication step for performing first biometric authentication by collating biometric information, a step for recording an authentication result in the first biometric authentication step in a memory of a recording medium, and a read by the first reading means Recording the second biological information of the user on a recording medium,
In the second terminal, the second reading means reads the second biological information of the user, the read second biological information, and the second biological information recorded on the recording medium possessed by the user. a second biometric authentication performing a second biometric authentication by collating the information, possess and recording the authentication result by the second biometric authentication step in a memory of the recording medium, the authentication in the first biometric authentication step As a result, when authentication is possible, the biometric authentication method records the second biometric information read by the first reading unit on the recording medium .
〔The invention's effect〕

  According to the present invention, it is possible to authenticate a user with high security by performing authentication based on different biometric information between the first and second terminals. In addition, when there are a plurality of second terminals, biometric authentication is commonly performed by the first terminal, so that it is not necessary to provide the second terminal with an expensive authentication function, and biometric authentication is inexpensive. Can realize the system.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

As shown in FIG. 1, the present embodiment is an example of a biometric authentication system applied to a terminal system realized in a counter of a financial institution's sales office (for employees of a financial institution).
The terminal system is configured by connecting one pre-authentication terminal 1 and a plurality of transaction terminals 2 installed at a window via a network 9 such as a LAN. The pre-authentication terminal 1 performs pre-authentication and registration of the biometrics of employees who perform business. The transaction terminal 2 is a terminal in which an employee performs financial operations such as deposit and transfer to a customer of a financial institution, and the transaction terminal 2 also performs employee biometric authentication. Since transaction terminal 2 is a business transaction terminal installed at a window, it may be referred to as a window terminal. With this system, it is possible to check fraud of employees who use the transaction terminal 2.

  From the viewpoint of a biometric authentication system, an expensive biometric authentication device is used for one pre-authentication terminal 1 commonly used, and inexpensive biometric authentication is used for a plurality of transaction terminals 2 installed at a window. Use the device. An expensive biometric authentication device is, for example, an iris authentication device or a vein authentication device, and an inexpensive biometric authentication device is, for example, a fingerprint authentication device, a camera (face authentication device), a microphone (voice authentication device), or the like. is there. As described above, since the biometric authentication device is used for both the pre-authentication terminal 1 and the transaction terminal 2, the business cannot be performed unless the authentication is successful in both devices. improves.

  Further, in order to improve security, it is conceivable that a plurality of advanced biometric authentication functions are originally given to each transaction terminal 2, but according to the present embodiment, biometric authentication is applied to the pre-authentication terminal 1 and the transaction terminal 2. Since the pre-authentication terminal 1 performs authentication in common, the biometric authentication system can be realized at a low cost.

  In addition, for example, a plurality of types of authentication devices are used for the pre-authentication terminal 1, and if authentication is possible with a certain type of biometric information, other types of biometric information are registered, and the transaction terminal 12 has other types of authentication By having the apparatus and discarding the registered contents after authentication, it is possible to secure security that requires authentication using both pieces of biological information, and to reduce the risk of managing biological information. When biometric information that is vulnerable to secular change is used as another type of biometric information, high-accuracy authentication that compensates for the drawbacks can be performed. The biological information that is resistant to secular change includes, for example, a face, a voice, and the like that is weak to secular change such as a vein.

Next, the configuration of the pre-authentication terminal 1 will be described with reference to FIG.
The pre-authentication terminal 1 includes a plurality of biometric information authentication devices, that is, A biometric information authentication devices 110 and 120, an IC card reading / writing device (R / W) 130, and a biometric information pre-authentication and registration. A biometric information authentication program 101 and a B biometric information registration program 102 are stored in the memory. The A biometric information authentication devices 110 and 120 are, for example, an iris authentication device or a vein authentication device.

Next, the configuration of the transaction terminal 2 will be described with reference to FIG.
The plurality of transaction terminals 2 connected to the LAN 9 are terminals for executing a financial business, and each has a business program 202 for executing the business stored in a memory. Further, in order to perform biometric authentication, the transaction terminal 2 includes a B biometric information authentication device 210 and an IC card R / W 220, and has a B biometric information authentication program 201 stored in a memory. The B biometric information authentication device 210 is, for example, a fingerprint authentication device, a camera (face authentication device), or a microphone (voice authentication device).

Next, the hardware configuration of the transaction terminal 2 will be described with reference to FIG.
The terminal 2 is connected to the bus 37 and includes a CPU 31, a memory 32, an input device 33 that receives input from an operator, a display 34 that displays transaction details, a hard disk 35, and a biometric authentication device 210. In the hard disk 35, a biometric authentication program 201, a business program 202, and an OS (operating system) 35 are stored.

The biometric authentication device 210 includes a control unit 41, a memory 42, and a sensor unit 43 that reads biometric information. The control unit 41 collates biometric information and performs an authentication process. The memory 42 temporarily stores biological information read by the sensor unit 43 and biological information acquired from the IC card 6.
The example of FIG. 4 is a configuration example of the transaction terminal 2, but the hardware configuration of the pre-authentication terminal 1 is substantially the same, and the configuration can be easily understood.

  The IC card 6 includes a control unit 61 having a CPU and a memory 62. The memory 62 holds a table 7 as shown in FIG. 7, and stores personal information and biometric information of the user, and biometric information authentication results. That is, the table 7 stores information indicating the first stage authentication result 730 and the second stage authentication result 740 as a plurality of authentication results, including the personal information 700, the biometric information A710, and the biometric information B720. The first-stage authentication result 730 includes information on the A-authentication result 731, the B-registration result 732, and the expiration date 733, and the second-stage authentication result includes the B-authentication result 741 and the last authentication date / time 742.

  Next, the operation of biometric authentication will be described with reference to the flowcharts of FIGS. In the following description, when referring to the hardware configuration of FIG. 4, when the terminal is the transaction terminal 1, the reference numeral of FIG. 4 is used, while when the terminal of FIG. 4 is the pre-authentication terminal 1, reference is made. The symbol is represented by adding “′ (dash)”.

First, the processing operation in the pre-authentication terminal 1 will be described with reference to FIG.
The CPU 31 'of the pre-authentication terminal 1 starts the A biometric authentication program 101 on the hard disk 35', displays the screen 901 (FIG. 9 ) on the display 34 '(step 801), and inserts an IC card into the user. Prompt.
When the IC card 6 is set in the IC card R / W 130, the biological information A710 is acquired from the table of the memory 62 of the IC card 6 and stored in the memory 42 '(step 802).

  When the reading of the IC card 6 is completed, the CPU 31 ′ of the terminal 1 displays a screen 902 on the display 34 ′ (step 803) and prompts the user to set the biometric A on the biometric authentication device 110. When the biometric A is set in the biometric authentication device 110, the control unit 41 ′ of the biometric authentication device 110 reads the biometric information A set in the sensor unit 43 ′ and stores it in the memory 42 ′. (Step 804).

  The control unit 41 ′ of the biometric authentication device 110 collates the two pieces of biometric information (the biometric information A 710 and the biometric information A) stored in the memory 42 ′ (Step 805). As a result of the collation, if the two match, the biological information A is discarded from the memory 42 '(step 806). The control unit 61 of the IC card 6 updates the A authentication result 731 in the table of the memory 62 to “appropriate” (OK) (step 807).

On the other hand, if they do not match as a result of the collation, the CPU 31 ′ of the pre-authentication terminal 1 displays the screen 911 on the display 34 ′ (step 821), and the control unit 41 ′ of the biometric authentication device 110 receives the biometric information A from the memory 42 ′. Discard (step 822). The control unit 61 of the IC card 6 updates the A authentication result 731 in the table 7 of the memory 62 to “inappropriate” (NG), the B registration result 732 to NG, and the expiration date 733 to invalid (step 823). As described above, the transaction at the transaction terminal 2 can be restricted by invalidating the expiration date 733 when the authentication fails. Thereafter, the CPU 31 'of the terminal 1 displays a screen 904 on the display 34' (step 824), ejects the IC card, and ends the transaction.

  If the authentication is successful, the CPU 31 ′ of the terminal 1 starts the B biometric information registration program on the hard disk 35 ′, displays the screen 903 on the display 34 ′ (step 808), and sends the biometric B to the user as a biometric authentication device. Prompt to set to 120. When the biometric B is set in the biometric authentication device 120, the control unit 41 ′ of the biometric authentication device 120 reads the biometric information B set in the sensor unit 43 ′ and stores it in the memory 42 ′ (step 809).

  The CPU 31 ′ of the terminal 1 writes the biological information B stored in the memory 42 ′ into the biological information B 720 of the table in the memory 62 of the IC card 6 set in the IC card R / W 130 (Step 810). If the writing is successful, the biometric information B is discarded from the memory 42 ′ (step 811), and the control unit 61 of the IC card 6 updates the B registration result of the table in the memory 62 and updates the expiration date to a predetermined time limit. (Step 812). Thereafter, the CPU 31 ′ of the terminal 1 displays a screen 904 on the display 34 ′ (step 813), ejects the IC card, and ends the transaction.

If writing to the memory 62 of the IC card 6 fails, the CPU 31 'of the terminal 1 displays the screen 912 on the display 34' (step 831), and the control unit 41 'of the biometric authentication device 110 receives the biometric from the memory 42'. Information A is discarded (step 832). The control unit 61 of the IC card 6 sets the B registration result 732 in the table of the memory 62 to NG and updates the expiration date 733 to invalid (step 833).
Thus, by invalidating the expiration date 733 when registration fails, transactions at the transaction terminal 200 can be restricted. Thereafter, the CPU 31 ′ of the terminal 1 displays a screen 904 on the display 34 ′ (step 834), ejects the IC card, and ends the transaction.

  In addition to the date and time, the expiration date set in the pre-authentication terminal 1 is a method of setting a limit on the number of authentications at the transaction terminal, issuing a receipt with a chip embedded in the user, etc., and monitoring the location. There is a method of validating authentication until the person leaves the store, and by setting an expiration date according to the security policy, it is possible to prevent unauthorized transactions and obtain strong security.

Next, the processing operation in the transaction terminal 2 will be described with reference to FIG.
When the authentication at the pre-authentication terminal 1 is completed, the CPU 31 of the transaction terminal 2 starts the B biometric information authentication program 201 on the hard disk 35, displays a screen 901 on the display 34 (step 851), and gives the user an IC card. Prompt insertion. When the IC card 6 is set in the IC card R / W 220, the biometric information B720 and the expiration date 733 are obtained from the table of the memory 62 of the IC card 6 and stored in the memory 42 (step 852).

When reading of the IC card 6 is completed, the CPU 31 of the transaction terminal 2 confirms the expiration date stored in the memory 42 (step 853) , and if it is within the expiration date, displays the screen 903 on the display 34 ( step 854 ), The user is prompted to set the biometric B in the biometric authentication device 210.
If the expiration date is invalid or invalid, a screen 913 is displayed on the display 34 (step 871), and the biometric information B and the expiration date are discarded from the memory 42 (step 872). Thereafter, the CPU 31 of the transaction terminal 2 displays a screen 904 on the display 34 (step 874), ejects the IC card, and ends the transaction.

When the biometric B is set in the biometric authentication device 210, the control unit 41 of the biometric authentication device 210 reads the biometric information B set in the sensor unit 43 and stores it in the memory 42. ( Step 855 ).
The control unit 41 of the biometric authentication device 210 collates the two pieces of biometric information stored in the memory 42 ( step 856 ). If they match as a result of the collation, the biometric information B and the expiration date are discarded from the memory 42 ( step 857 ). The control unit 61 of the IC card 6 updates the B authentication result 741 in the table of the memory 62 to OK and the last authentication date and time 742 to the current time ( step 858 ).

  On the other hand, if they do not match as a result of the collation, the CPU 31 of the transaction terminal 2 displays the screen 911 on the display 34 (step 881), and the control unit 41 of the biometric authentication device 210 obtains the biometric information B and the expiration date from the memory 42. Discard (step 882). The control unit 61 of the IC card 6 updates the B authentication result 741 in the table of the memory 62 to NG and the last authentication date and time 742 to the current time (step 883). Thereafter, the CPU 31 of the transaction terminal 2 displays a screen 904 on the display 34 (step 884), discharges the IC card, and ends the transaction.

  If the authentication is successful, the CPU 31 of the transaction terminal 2 activates the business program 202 on the hard disk 35 and performs a business transaction. When the business transaction ends, the CPU 31 of the transaction terminal 2 displays a screen 904 on the display 34 (step 860), discharges the IC card, and ends the transaction.

As described above, according to this embodiment, for example, pre-authentication is performed with biometric information A that is resistant to secular change, and biometric information B that is vulnerable to secular change is registered each time. Authentication can be performed, and the authentication accuracy can be improved.
Further, when authentication is successful at the transaction terminal 2, by deleting the biometric information B from the recording medium, the biometric information B only needs to be held for a period from the completion of the pre-authentication to the start of the transaction, and the management risk can be reduced. .

  Further, for example, an IC card that holds personal information 700 and biometric information A 710 that is resistant to secular change, biometric information B 720 that is sensitive to personal information 700 and secular change, a first step authentication result 730, and a second step authentication result 740 are held. It is divided into two IC cards, and usually only the latter is used. The former is stored carefully, and is used only when the biometric information B is updated for a certain period or at a timing desired by the user. In such an embodiment, taking advantage of the weakness of biological information B over time, the registered information is invalidated due to aging even if the latter card that is usually carried is lost or stolen. Therefore, fatal personal information can be prevented from being leaked.

Next, another embodiment will be described with reference to FIG.
The pre-authentication terminal 1 of FIG. 8 is different from the pre-authentication terminal 1 shown in FIG. 2 of the first embodiment in that the B biometric information authentication device 120 and the B biometric information registration program 102 are not provided. The hardware configuration is the same as in FIG.
In the second embodiment, the biometric information B to be authenticated by the transaction terminal 2 is registered in advance in the IC card, and the A authentication result 731 collated in step 805 in step 807 of the flowchart of the pre-authentication terminal 1 (FIG. 5). And the expiration date 733 is updated, and registration is not performed.

  Thereby, for example, by connecting an expensive biometric authentication device A110 to one or a plurality of pre-authentication terminals 1 and connecting an inexpensive biometric authentication device B210 to a transaction terminal 2 installed at each window, both pieces of biometric information are obtained. It is possible to secure the security that requires authentication by the method and to reduce the cost.

The said Example is an example applied to the system which has the pre-authentication terminal 1 and the transaction terminal 2 for the business processing in the counter of the sales office of a financial institution.
However, according to the third embodiment, as shown in FIG. 9, it can be applied as a biometric authentication system for a general user in a financial institution.
This example is a system in which a general user obtains a number tag at the reception terminal 1 ′ when visiting a store, inputs the purpose of visiting the store and necessary items, and receives a transaction service from a bank employee at the window terminal 2 ′. Concerning biometric authentication, the reception terminal 1 ′ has the same configuration as the pre-authentication terminal 1 described above, and the window terminal 2 ′ is configured in the same manner as the transaction terminal 2 described above. Obtainable.

  In the above embodiment, an IC card is used as an example of a medium for storing biological information, but it may be recorded on another recording medium.

The figure which shows the outline of the terminal system of the financial institution with which one Example is applied, The figure which shows the structure of the pre-authentication terminal 1 in the biometrics authentication system of one Example, The figure which shows the structure of the transaction terminal 2 in the biometrics authentication system of one Example, The figure which shows the hardware constitutions of the transaction terminal 2 in the biometrics authentication system of one Example, The flowchart figure which shows the process operation | movement of the biometric authentication in the pre-authentication terminal 1 of one Example. The flowchart figure which shows the processing operation of the biometric authentication in the transaction terminal 2 of one Example. The figure which shows the structural example of the table in memory of IC card 6 in one Example. The figure which shows the structure of the terminal in the biometrics authentication system by another Example, The figure which shows the example of the display screen of display 34 'in the biometrics authentication process in one Example. The figure which shows the outline of the terminal system of the financial institution by another example. [Explanation of symbols]

Explanation of symbols

1: pre-authentication terminal, 2: transaction terminal, 101, 201: biometric information authentication program, 102: biometric information registration program, 110, 120, 210: biometric information authentication device 130, 220: IC card R / W,
42, 42 ': Memory, 6: IC card, 62: Memory, 7: Table.

Claims (9)

A biometric authentication system comprising: a first terminal that authenticates a user; and a second terminal that allows a user operation according to an authentication result in the first terminal and performs business or transaction processing.
The first terminal includes a first biological information reading unit that reads a plurality of types of biological information, a medium reading / writing unit that reads and writes a recording medium, and biological information read from the biological information reading unit. And a first control unit for collating biometric information read from the medium reading / writing unit,
The second terminal reads from the second biological information reading unit that reads other biological information different from the certain biological information, a medium reading unit that reads the recording medium, and the second biological information reading unit. A second control unit for collating the biometric information and the biometric information read from the medium reading unit,
When the first type of biometric information read from the first biometric information reading unit and the biometric information read from the medium reading / writing unit are collated, if authentication is possible, the first biometric information reading unit Read the second type of biological information and write to the recording medium from the medium reading / writing unit,
A biometric authentication system , wherein a result of authentication in the first terminal and biometric information read from the first biometric information reading unit are recorded on the recording medium and transmitted to the second terminal . The first terminal includes an iris authentication device or a vein authentication device, and the first control unit performs authentication based on the user's biometric information acquired by the iris authentication device or the vein authentication device,
The second terminal includes any one of a fingerprint authentication device, a face authentication device, and a voice authentication device, and the second control unit is any one of the fingerprint authentication device, the face authentication device, and the voice authentication device. The biometric authentication system according to claim 1, wherein authentication is performed using the biometric information acquired in step 1. 3. The first terminal according to claim 1, wherein the first terminal acquires biometric information that is resistant to secular change and performs authentication, and the second terminal acquires biometric information that is weak against secular change and performs authentication. Biometric authentication system. The recording medium is an IC card including a memory and a CPU. In the memory, user identity information, a plurality of types of biological information, an authentication result (first-step authentication result) in the first terminal, and the second The biometric authentication system according to any one of claims 1 to 3, further comprising a table for managing information on authentication results (second-step authentication results) in the terminal. The table further stores information indicating an expiration date,
5. The biometric authentication system according to claim 4, wherein the medium reading / writing unit of the first terminal updates the expiration date when the record of the biometric information in the table is updated. 6. The biometric authentication system according to claim 1, wherein said first terminal is at least one reception terminal or pre-authentication terminal, and said second terminal is applied to a financial system that is a plurality of window terminals or transaction terminals. . A biometric authentication method in a system including a first terminal that performs user authentication and a second terminal that is business-related to the first terminal and performs biometric authentication of the user,
In the first terminal, a step of reading the first biometric information of the user by the first reading means, and the first biometric information read and the first prerecorded on the recording medium possessed by the user. A first biometric authentication step for performing a first biometric authentication by collating with one biometric information, a step of recording an authentication result of the first biometric authentication step in a memory of the recording medium, and the first reading means Recording the second biometric information of the user read in step 1 on the recording medium,
In the second terminal, the step of reading the second biological information of the user by the second reading means, the read second biological information, and the second recorded in the recording medium possessed by the user. A second biometric authentication step for performing a second biometric authentication by collating the biometric information of the second biometric information, and a step of recording an authentication result of the second biometric authentication step in a memory of the recording medium,
A biometric authentication method comprising: recording the second biometric information read by the first reading unit on the recording medium when authentication is possible as a result of authentication in the first biometric authentication step. 8. The biometric authentication method according to claim 7, wherein the first terminal performs biometric authentication by iris or vein, and the second terminal performs biometric authentication by any one of fingerprint, face, and voice. On the recording medium, information on the user's identity, a plurality of types of biometric information including the first and second biometric information, authentication results in the first terminal, and authentication result information in the second terminal are recorded. 9. The biometric authentication method according to claim 7 or 8, wherein:

Images