JP4963225B2 - Personal authentication system - Google Patents

Description

  The present invention relates to a personal authentication system in which personal authentication information acquired by an authentication terminal is sent to a server and personal authentication is performed by the server.

  Conventionally, for the purpose of enabling quick authentication processing without impeding operability, a plurality of copying machines identify image data of a user's face captured by a CCD camera, respectively. The number is transmitted to the authentication server via the LAN together with the number, and the authentication server pre-registers the user's facial feature data for each copying machine ID, and transmits the transmitted user's facial data to the received copy. There has been a personal authentication system that searches from face data registered corresponding to a machine ID and notifies the copying machine of the search result via a LAN (see, for example, Patent Document 1).

  In addition, for the purpose of obtaining a highly accurate authentication result by using existing personal authentication technology as it is, the configuration is not so complicated, and for each target person requiring personal authentication, the attribute of the person The collation reference data is stored in advance for each of a plurality of attributes, and when individual authentication is requested, the plurality of data presented by the person as his / her own attributes are related to an individual who is said to be the person. There has been a personal authentication method in which personal authentication is performed by collating with each of collation reference data of corresponding attributes stored in advance and integrating the collation results of each of the plurality of attributes (for example, Patent Literature 2).

JP 2002-132733 A JP 2001-351507 A

  In a personal authentication system in which personal authentication information acquired by an authentication terminal is sent to a server and personal authentication is performed by the server, it is desired to improve the accuracy of personal authentication in the server. Also, considering that personal authentication cannot be performed when the server is down, when switching to perform local authentication for each authentication terminal when the server is down, the same authentication information as that of the server is assigned to each authentication terminal. There is a problem that some authentication terminals cannot perform personal authentication due to problems such as storage capacity, processing capability, and operation regulations.

  The present invention relates to a personal authentication system in which personal authentication information acquired by an authentication terminal is sent to a server and personal authentication is performed by a server. The server performs more accurate combined personal authentication by combining the results of matching of multiple types of attributes. It is another object of the present invention to provide a personal authentication system capable of performing local personal authentication in accordance with the status of each authentication terminal for each authentication terminal when the server is down. In addition, the decrease in authentication accuracy in local personal authentication was suppressed.

In the present invention, at least one authentication terminal is communicably connected to a server, and when the server is normal, a plurality of types of biometric information obtained by the authentication terminal is stored in advance in the plurality of types of biometric information. A personal authentication system that performs composite personal authentication by combining the verification results of the plurality of types of biometrics information sent to the server having a database, wherein the authentication terminal includes the plurality of types of biometrics for each authentication terminal. A database in which at least one kind of metrics information is stored in advance, and when the server is down, personal authentication or composite personal authentication is performed based on biometric information stored in each database for each authentication terminal on behalf of the server e Bei local personal authentication unit, a profit biometric information of a plurality of species each This is a partial image information of the person's body. In the authentication terminal in which one kind of biometric information is stored in the database, when the server goes down, the local personal authentication means uses the server for the biometric information stored in the database. The personal authentication system is characterized in that personal authentication is performed by increasing the number of collation points of image information and raising the determination criteria compared to personal authentication.

  According to the present invention, the server can perform personal authentication with higher accuracy by combining the matching results of a plurality of types of attributes, and can also perform local personal authentication for each terminal in accordance with the status of each authentication terminal when the server is down. In addition, it is possible to suppress a decrease in authentication accuracy in local personal authentication.

Embodiment 1 FIG.
FIG. 1 is a diagram showing an example of the configuration of a personal authentication system according to the present invention. In this system, a plurality of authentication terminals 1 (only one is shown in FIG. 1) are connected to a server 2 that performs personal authentication via a communication network 3, and when the server 2 is in a normal state, a plurality of types of terminals are used. Biometrics composite personal authentication that integrates each verification result based on biometrics information. FIG. 2 shows an external view of each authentication terminal 1. In the following description, a case where a face image that is face information that is partial image information of a user's body and a fingerprint image that is finger information are used as multiple types of biometric information will be described as an example. .

  In both figures, an authentication terminal 1 performs a camera 11 for acquiring a face image as face information, a fingerprint reading sensor 12 for acquiring a fingerprint image as finger information, various guidance displays, and instructions operated by a user. A database in which at least one of the acquired face image and fingerprint image is registered and stored as face information registration data 14a and finger information registration data 14b, respectively. 14. Terminal side including a computer which is connected to these and performs control processing including local personal authentication at the authentication terminal 1 and communicates with the server-side control processing unit 24 of the server 2 via the communication network 3 A control processing unit 15 is provided. Information to be registered and stored in the database 14 is determined in advance according to the storage capacity, processing capability, operational rules, etc. of each authentication terminal.

  The server 2 includes a display unit 21 including a liquid crystal display unit for displaying various information related to personal authentication by the administrator in the server 2, an input operation unit 22 for input by the administrator, a communication network 3 is a database 23 in which face images and fingerprint images for personal authentication at each authentication terminal 1 connected via the 3 are registered and stored as face information registration data 23a and finger information registration data 23b, respectively. A server-side control processing unit 24 including a computer that performs control processing including composite personal authentication in the server 2 and communicates with the terminal-side control processing unit 15 of each authentication terminal 1 via the communication network 3. Prepare.

  The display unit with input operation unit 13 of the authentication terminal 1 may have a configuration in which the input operation unit and the display unit are separated as on the server side, and the display unit 21 and the input operation unit 22 of the server 2 are used for authentication. It is good also as a display part with an input operation part like the terminal side.

  Regarding the registration of face information and finger information, if there is a registration request for face information and finger information from the display unit with input operation unit 13 by the user's operation in the authentication terminal 1, the terminal side control processing unit 15 11 and the fingerprint reading sensor 12 are driven to capture the user's face image and fingerprint image. Then, for example, the face information registration data 14a and the finger information registration data 14b are created by performing a trimming process or the like for cutting out a predetermined size and an image range.

  The authentication terminal 1 uses both face information and finger information because of the storage capacity of the database 14, the processing capacity of the terminal-side control processing unit 15, physical restrictions such as operation specifications of the authentication terminal, or operational restrictions. Whether to perform the authentication process or one of the two is determined in advance for each authentication terminal 1, and the created face information registration data 14a and finger information registration data 14b At least one of them is registered and stored in the database 14 as information for local personal authentication at the authentication terminal 1.

  The created face information registration data and finger information registration data are sent to the server 2 via the communication network 3, and the server-side control processing unit 24 stores the face information registration data 23a and finger information registration in the database 23, respectively. Register and store as data 23b.

  The face image and the fingerprint image acquired by the camera 11 and the fingerprint reading sensor 12 are first sent from the authentication terminal 1 to the server 2 and subjected to trimming processing etc. on the server 2 side to perform face information registration data 23a and finger information registration, respectively. After the data 23b is created and registered and stored in the database 23, at least one of the previously created registration data is sent to the authentication terminal 1 that has sent the face image and the fingerprint image, and the authentication terminal On the one side, these may be registered and stored in the database 14 as face information registration data 14a and finger information registration data 14b.

  Whether each of the authentication terminals 1 performs local personal authentication as “both face information and finger information”, “face information only”, or “finger information only” (local authentication mode), for example, terminal-side control processing A corresponding flag is prepared in each memory in the unit 15 (not shown), and the determination is made based on the flag state.

  FIG. 3 shows an operation flowchart for explaining the operation of the personal authentication system according to the present invention. The operation will be described below. In the authentication terminal 1, the terminal-side control processing unit 15 acquires the face image and the fingerprint image, which are biometric information for authentication, from the camera 11 and the fingerprint reading sensor 12 (step S 1), and changes the state of the server 2. Check (step S2). If the server 2 is operating in a normal operating state, face information and finger information (authentication biometric information) including the acquired face image and fingerprint image are notified and transmitted to the server 2 (step S3).

  The server-side control processing unit 24 of the server 2 searches the face information registration data 23a and the finger information registration data 23b in the database 23 with the transmitted face information and finger information, respectively, and performs collation. The combined personal authentication is performed (step S13). If there is a match in each of the collations, “match”, and if there is no match in at least one, “mismatch” is sent to the authentication terminal 1 that has transmitted the face information and finger information as a collation result. Send back (step S14).

  If the verification result is “match” (step S10), the terminal-side control processing unit 15 of the authentication terminal 1 that has been sent back, for example, a control target (not shown) including an electric lock of a door for entering the security area, for example. A collation matching process is performed in which a security release signal such as an unlocking signal is sent to (step S11). On the other hand, if the collation result is “mismatch” in step S10, the terminal-side control processing unit 15 is a control target (not shown) including, for example, an alarm device for notifying that a suspicious person is about to enter the security area. A verification mismatch process is performed in which a security enhancement signal such as an alarm issue command signal is sent to (step S12).

  If the terminal-side control processing unit 15 of the authentication terminal 1 determines in step S2 that the server 2 is not operating (normal state) and is in a down state where normal composite personal authentication cannot be performed, The local personal authentication mode of the authentication terminal 1 is checked based on, for example, the state of the local personal authentication mode flag set in the memory in the terminal-side control processing unit 15 (step S4).

  In step S4, if the local personal authentication mode is set to “both face information and finger information”, both face / finger collation, that is, the acquired face information and finger information as in the server 2 shown in step S13. Then, each face information registration data 14a and finger information registration data 14b in the database 14 are searched and collated, and composite personal authentication is performed by combining these collation results (step S5).

  In step S4, if the local personal authentication mode is set to “face information only”, the face information registration data 14a in the database 14 is searched and collated with the acquired face information, and personal authentication based on the collation result is performed. I do. At this time, the number of face image information matching points is increased from the face information matching performed in the server 2 to increase the face determination criterion (step S6), and the acquired face information is compared with the face image of the face information registration data 14a. The personal authentication is performed by (step S8).

  In step S4, if the local personal authentication mode is set to “finger information only”, the finger information registration data 14b in the database 14 is searched using the obtained finger information and collation is performed. I do. At this time, the finger judgment standard is raised by increasing the number of finger image information matching points compared to the finger information matching performed in the server 2 (step S7), and the finger information registered in the finger information registration data 14b is compared. The personal authentication is performed (step S9).

  In addition, in the authentication terminal 1 that performs personal authentication of only finger information, in order to increase the number of verification points, a plurality of pieces of finger information are stored as the finger information registration data 14b, and the obtained plurality of fingers are stored. Individual authentication may be performed by collating information and finger images for a plurality of finger information registration data 14b.

  Then, local personal authentication by composite personal authentication by “both face information and finger information” in step S5, local personal authentication by “face information only” in step S8, and local personal authentication by “finger information only” in step S9. According to the result, the terminal-side control processing unit 15 of the authentication terminal 1 controls the control object (not shown) including, for example, an electric lock of a door for entering the security area if the collation result is “match” (step S10). A collation matching process is performed in which a security release signal such as an unlocking signal is sent to (step S11). On the other hand, if the collation result is “mismatch” in step S10, the terminal-side control processing unit 15 is a control target (not shown) including, for example, an alarm device for notifying that a suspicious person is about to enter the security area. A verification mismatch process is performed in which a security enhancement signal such as an alarm issue command signal is sent to (step S12).

  Note that the terminal-side control processing unit 15 of the authentication terminal 1 determines whether the server 2 is operating or down in step S2, for example, if it generates an abnormal signal when the server 2 is in an abnormal state. Or a dedicated response request signal or the like may be sent to the server-side control processing unit 24 of the server 2 to determine whether or not there is a response. Further, for example, when the authentication biometric information including the acquired face information and finger information is sent to the server 2 for the time being and the verification result is not sent back even after a predetermined time, the operation is in progress. Instead, it may be determined that it is in the down state.

  Further, although not described in detail in the above description, registration information of face information and finger information registered in the respective databases 14 and 23 of the authentication terminal 1 and the server 2, or acquired by the authentication terminal 1 and stored in the server 2. In the face information and finger information that is sent biometric information for authentication, the acquired authentication terminal, terminal ID (terminal identification number) indicating the control object regarding the final security, control object ID (control object identification number) Add as needed.

Embodiment 2. FIG.
Further, in the above embodiment, in the local personal authentication when the server is down, by performing personal authentication with a higher determination criterion, a decrease in authentication accuracy is suppressed, but instead of or in addition to this, Before acquiring the biometric information for verification at each authentication terminal 1, the user is allowed to input a user ID, which is a personal identification number, using the display unit with input operation unit 13, for example, and the terminal-side control processing unit 15 You may make it perform personal authentication by ID. In this case, the user ID, which is the personal identification number, is added to each user's face information and finger information registered and stored in the database 14, and this is searched for collation.

  In each of the above embodiments, as biometric information used for personal authentication, face information and finger information including a face image and a fingerprint image have been described as examples. However, biometric information to be used is limited to this. However, biometric information composed of partial image information of other parts of the user's body such as the retina and blood vessels may be selected and used. Moreover, you may make it perform composite personal authentication by 3 or more types of biometric information. Note that the biometric information acquisition unit including the camera 11 and the fingerprint reading sensor 12 of the authentication terminal 1 is changed depending on the biometric information to be used.

It is a figure which shows an example of a structure of the personal authentication system by this invention. It is an external view which shows an example of the terminal for authentication of FIG. It is an operation | movement flowchart for demonstrating operation | movement of the personal authentication system by this invention.

Explanation of symbols

  1 authentication terminal, 2 server, 3 communication network, 11 camera, 12 sensor, 13 display unit with input operation unit, 14 database, 14a face information registration data, 14b finger information registration data, 15 terminal side control processing unit, 21 display Part, 22 input operation part, 23 database, 23a face information registration data, 23b finger information registration data, 24 server side control processing part.

Claims (4)

At least one authentication terminal is communicably connected to the server, and when the server is normal, a plurality of types of biometric information of the user acquired by the authentication terminal is stored in advance. A personal authentication system that performs composite personal authentication by combining the verification results of the plurality of types of biometric information sent to the server,
The authentication terminal is
A database that stores in advance at least one of the plurality of types of biometric information for each authentication terminal;
Local personal authentication means for performing personal authentication or composite personal authentication based on biometric information stored in each database for each authentication terminal on behalf of the server when the server is down;
Bei to give a,
Multiple types of biometric information are partial image information of the user's body,
In an authentication terminal that stores one type of biometric information in the database, the local personal authentication means when the server goes down, the number of verification points of the image information for the biometric information stored in the database compared to personal authentication at the server Increase personal identification with increased criteria.
A personal authentication system characterized by that. Includes finger information as biometric information,
An authentication terminal that stores one type of biometric information in the database stores multiple finger information for each user in the database, and the local personal authentication means raises the criterion based on multiple finger information. The personal authentication system according to claim 1 , wherein personal authentication is performed. An authentication terminal storing one type of biometric information in the database stores the user's personal identification number together with the biometric information in the database, and the local personal authentication means is input from the outside when the server goes down. The personal authentication system according to claim 1 , wherein personal authentication is performed by adding identification number verification. At least one authentication terminal is communicably connected to the server, and when the server is normal, a plurality of types of biometric information of the user acquired by the authentication terminal is stored in advance. A personal authentication system that performs composite personal authentication by combining the verification results of the plurality of types of biometric information sent to the server,
The authentication terminal is
A database that stores in advance at least one of the plurality of types of biometric information for each authentication terminal;
Local personal authentication means for performing personal authentication or composite personal authentication based on biometric information stored in each database for each authentication terminal on behalf of the server when the server is down;
Bei to give a,
An authentication terminal storing one type of biometric information in the database stores the user's personal identification number together with the biometric information in the database, and the local personal authentication means is input from the outside when the server goes down. Perform personal authentication with additional identification number verification,
A personal authentication system characterized by that.

Images