JP5495603B2 - Authentication device - Google Patents

Description

  The present invention relates to an authentication device used in, for example, an entrance / exit management system.

In a conventional entrance / exit management system, biometric information and ID cards are registered and issued each time an outside person such as a contractor or a business traveler enters or enters the room. It is necessary to delete information and card data.
For this reason, it takes time and cost to register and delete biometric information and ID cards. Further, when the ID card is lost or stolen, the cost of reissuing the ID card has occurred.

JP 2005-182555 A

  An object of the present invention is, for example, to reduce the trouble of issuing a card to an external person and deleting the data of the issued card in an entrance / exit management system.

  The authentication apparatus according to the present invention includes first identification data input to an input device to which first identification data for identifying an individual is input and first registration data previously registered in a storage device as identification data of a specific person Based on the above, a first authentication unit that authenticates by using a CPU (Central Processing Unit) whether the individual identified by the first identification data is a specific person, and the first authentication unit When the individual identified by the identification data is authenticated as a specific person, the data identifies the individual identified by the first identification data and is different from the first identification data. A data registration unit for registering the second identification data input to the input device to which the identification data of 2 is input into the storage device as the second registration data, and a personal identification for identifying the individual Based on the personal identification data input to the input device to which data is input and the second registration data registered by the data registration unit, the individual identified by the personal identification data is the second registration data. A second authentication unit that authenticates using the CPU, or an individual identified by the personal identification data by the second authentication unit by the second registration data. A device operating unit that operates a predetermined device when it is authenticated.

  According to the present invention, for example, in an entrance / exit management system, it is possible to reduce the trouble of issuing a card to an external person and deleting the data of the issued card.

1 is a configuration diagram of an entrance / exit management system 100 according to Embodiment 1. FIG. 3 is a flowchart showing an entrance / exit management method of the entrance / exit management system 100 according to Embodiment 1. 5 is a flowchart of personal data registration processing (S110) in the first embodiment. 5 is a flowchart of ID card data registration processing (S120) in the first embodiment. The flowchart of the traffic approval process (S130) in Embodiment 1. FIG.

Embodiment 1 FIG.
An entrance / exit management system for permitting (approving) a specific place (or entrance) to a specific place for an external person who frequently visits such as a trader or a business traveler will be described.

FIG. 1 is a configuration diagram of an entrance / exit management system 100 according to the first embodiment.
The structure of the entrance / exit management system 100 in Embodiment 1 is demonstrated below based on FIG.

  The entrance / exit management system 100 includes a registration unit area 110, a shared unit area 120, and a dedicated unit area 130, and includes an entrance / exit management device 140.

The registration unit area 110 is a place where the administrator registers personal data and biometric data of users.
The common area 120 is a place where the user receives biometric authentication and registers ID card data.
The dedicated section area 130 is provided for each room (or building, the same applies hereinafter) in which entry (or admission, the same applies hereinafter) is restricted, and is a place where the user receives card authentication and receives an admission permission.

  The registration unit area 110 is provided with a personal data input device 111 and a biometric data reading device 112, and the shared unit area 120 is provided with a biometric data reading device 121 and an ID card data reading device 122. Are provided with an ID card data reader 131 and a door 132 locked by an electric lock 133.

The personal data input device 111 is a device for inputting personal data of a user by an administrator. For example, the personal data input device 111 is configured with a keyboard and a mouse.
The personal data input to the personal data input device 111 includes a “registration number” that identifies the user, a “name” of the user, and identification information of the door 132 that allows the user to pass (hereinafter, “accessible door”). ”), A time period during which the user is allowed to pass through the door 132 (hereinafter referred to as“ passable time period ”), an“ effective period ”of ID card data registered in the common area 120, and the like.

  The biometric data reader (112, 121) is a device that reads biometric data from a user's body. For example, the biometric data reader captures a user's living body such as a fingerprint, fingerprint vein, iris, and face, and reads (extracts) biometric feature information from the captured biometric image as biometric data.

  The ID card data reader (122, 131) IDs data (card type, card number, cardholder name, etc.) recorded on the ID card from the user's ID card (IC card, magnetic card, etc.). It is a device that reads as card data. For example, an ID card data reading device communicates with an ID card (IC card) wirelessly and reads ID card data from the ID card.

The registration area 110, the shared area 120, and the dedicated area 130 may be different places or the same place.
In addition, the biometric data reader may be shared between the registration area 110 and the shared area 120, or the ID card data reader may be shared between the shared area 120 and the dedicated area 130.

  The entrance / exit management device 140 (an example of an authentication device) includes a personal data registration unit 141, an ID card data registration approval unit 142 (an example of a first authentication unit), an ID card data registration unit 143 (an example of a data registration unit), A traffic approval unit 144 (an example of a second authentication unit), a door control unit 145 (an example of an apparatus operation unit), and a personal data storage unit 149 are provided.

The personal data registration unit 141 registers (stores) the personal data input to the personal data input device 111 in the registration unit area 110 in the personal data storage unit 149.
Furthermore, the personal data registration unit 141 registers the biometric data read by the biometric data reading device 112 in the registration unit area 110 in the personal data storage unit 149, including the personal data.

  The ID card data registration approval unit 142 includes biometric data (an example of first identification data) read by the biometric data reader 121 (an example of an input device) and personal data registered in the personal data storage unit 149. Whether the individual identified by the biometric data read by the biometric data reader 121 is a specific person identified by the personal data based on the biometric data (an example of the first registration data) is a CPU (Central Processing Unit). Authenticate using

When the ID card data registration approval unit 142 authenticates the individual as a specific person, the ID card data registration unit 143 reads the ID read by the ID card data reading device 122 (an example of an input device) in the shared unit area 120. Card data (second identification data, an example of second registration data) is included in the personal data and registered in the personal data storage unit 149.
Further, the ID card data registration unit 143 determines the expiration date of the ID card data.

  The passage approval unit 144 includes ID card data (an example of personal identification data) read by the ID card data reading device 131 (an example of an input device) in the dedicated area 130 and personal data registered in the personal data storage unit 149. On the basis of the ID card data, the CPU identifies whether the individual identified by the ID card data read by the ID card data reader 131 is an individual identified by the personal data.

  The door control unit 145 is authenticated by the passage approval unit 144 within the expiration date of the ID card data that the individual identified by the ID card data read by the ID card data reader 131 is an individual identified by the personal data. In such a case, the electric lock 133 (an example of a predetermined device) is operated and unlocked.

  The personal data storage unit 149 reads personal data input to the personal data input device 111 in the registration unit area 110, biometric data read by the biometric data reading device 112 in the registration unit area 110, and ID card data reading in the common unit area 120. The ID card data read by the device 122 and the expiration date of the ID card data determined by the ID card data registration unit 143 are stored using a storage medium. For example, the personal data storage unit 149 is composed of a magnetic disk device.

  The entrance / exit management device 140 includes a CPU, a ROM, a RAM, a communication board, a magnetic disk device, and the like (not shown). The CPU is connected to the ROM, RAM, communication board, and magnetic disk device via the bus, and controls these hardware devices.

The communication board is connected to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line by wire or wireless.
The communication board communicates with each device in each area.

  The ROM, RAM, or magnetic disk device stores an OS (Operating System), a program group, and a file group.

  The program group includes a program that executes a function described as “unit” in the embodiment. The program is read and executed by the CPU. That is, the program causes the computer to function as “to part”, and causes the computer to execute the procedures and methods of “to part”.

The file group includes various data (input, output, determination result, calculation result, processing result, etc.) used in “˜unit” described in the embodiment.
Personal data is an example of data included in a file group.

  In the embodiment, arrows included in the configuration diagrams and flowcharts mainly indicate input and output of data and signals.

  In the embodiment, what is described as “to part” may be “to circuit”, “to apparatus”, and “to device”, and “to step”, “to procedure”, and “to processing”. May be. That is, what is described as “to part” may be implemented by any of firmware, software, hardware, or a combination thereof.

FIG. 2 is a flowchart showing an entrance / exit management method of entrance / exit management system 100 according to the first embodiment.
The entrance / exit management method of the entrance / exit management system 100 in Embodiment 1 is demonstrated below based on FIG.

First, “personal data registration processing” for registering personal data in the registration unit area 110 is performed (S110).
Next, “ID card data registration processing” for registering the ID card data and the expiration date of the ID card data is performed after the authentication processing based on the personal data in the shared area 120 (S120).
Then, after the authentication process based on the ID card data and the expiration date of the ID card data, the “passage approval process” for unlocking the electric lock 133 is performed in the dedicated area 130 (S130).

  The personal data registration process (S110) is performed only once for each user for the first time, and the ID card data registration process (S120) is performed when the ID card data is not registered (the registered ID card data has expired). The traffic approval process (S130) is performed every time the room is entered.

  Details of each process (S110 to S130) will be described below.

FIG. 3 is a flowchart of the personal data registration process (S110) in the first embodiment.
The personal data registration process (S110) in the first embodiment will be described below with reference to FIG.

<S111>
In the registration unit area 110, the administrator inputs personal data of a user who wants to permit entry into a specific room into the personal data input device 111. As described above, the personal data includes a registration number, a name, a passable door, a passable time zone, a valid period, and the like.
The personal data input device 111 outputs the input personal data to the entrance / exit management device 140.
The personal data registration unit 141 of the entrance / exit management device 140 inputs the personal data output from the personal data input device 111.
After S111, the process proceeds to S112.

<S112>
A user whose personal data is input to the personal data input device 111 places his / her biological body (for example, a finger) on the biological data reader 112.
The biometric data reading device 112 reads biometric data from the arranged user's living body and outputs the read biometric data to the entrance / exit management device 140.
The personal data registration unit 141 of the entrance / exit management device 140 receives the biometric data output from the biometric data reader 112.
After S112, the process proceeds to S113.

<S113>
The personal data registration unit 141 adds the biometric data input in S112 to the personal data input in S111, and registers the personal data added with the biometric data in the personal data storage unit 149.
After S113, the personal data registration process (S110) ends.

FIG. 4 is a flowchart of the ID card data registration process (S120) in the first embodiment.
The ID card data registration process (S120) in the first embodiment will be described below based on FIG.

<S121>
In the shared area 120, the user places a biological part corresponding to the biological data registered in the personal data registration process (S110) in the biological data reader 121.
The biometric data reading device 121 reads biometric data from the arranged user's living body, and outputs the read biometric data to the entrance / exit management device 140.
The ID card data registration approval unit 142 of the entrance / exit management device 140 receives the biometric data output from the biometric data reader 121.
After S121, the process proceeds to S122.

<S122>
The ID card data registration approval unit 142 uses the biometric data (hereinafter referred to as “input biometric data”) input in S121 to be included in the individual data registered in the personal data storage unit 149 (hereinafter referred to as “registered biometric data”). Biometric authentication is performed by comparing with "data").

  Hereinafter, personal data including registered biometric data that matches the input biometric data is referred to as “biometric personal data”, and biometric personal data exists as “verification OK (authentication OK)”, and there is no biometric personal data. The case is referred to as “verification NG (authentication NG)”.

“Verification OK” authenticates that the user whose biometric data is read by the biometric data reader 121 in the common area 120 is a registrant who has registered personal data, and registers the ID card data of the user. Means to approve.
“Verification NG” means that the user is not authenticated as a registrant and does not approve registration of the user's ID card data.

  After S122, the process proceeds to S123.

<S123>
If “verification is OK” in S122 (YES), the process proceeds to S124.
If “verification NG” in S122 (NO), the process returns to S121.

<S124>
The user who has been authenticated as a registrant in S122 brings the owned ID card closer to the ID card data reader 122. In the ID card, information for identifying the card (for example, card type, card number, owner's name, etc.) is recorded as ID card data. For example, an ID card issued as a dedicated card used in the entrance / exit management system 100 can be used. For example, a general cash card, a credit card, a member's card, a point card, etc. can be used as an ID card.
The ID card data reader 122 reads the ID card data from the approached ID card by wireless communication, and outputs the read ID card data to the entrance / exit management device 140.
The ID card data registration unit 143 of the entrance / exit management device 140 receives the ID card data output from the ID card data reading device 122.
After S124, the process proceeds to S125.

<S125>
Each personal data includes the validity period of the ID card data.
The ID card data registration unit 143 determines the validity period of the ID card data input in S124 based on the validity period of the ID card data included in the biometric personal data (see S122).
For example, if the validity period of the ID card data is “1 day”, the ID card data registration unit 143 sets the date of the day as the validity period of the ID card data. Also, for example, if the validity period of the ID card data is “3 hours”, the ID card data registration unit 143 sets the date and time of 3 hours after the current time as the validity period of the ID card data.
After S125, the process proceeds to S126.

<S126>
The ID card data registration unit 143 registers the biometric authentication personal data including the ID card data input in S124 and the expiration date determined in S125.
After S126, the ID card data registration process (S120) ends.

FIG. 5 is a flowchart of the traffic approval process (S130) in the first embodiment.
The flowchart of the traffic approval process (S130) in Embodiment 1 is demonstrated below based on FIG.

<S131>
In the dedicated area 130, the user brings the ID card corresponding to the ID card data registered in the ID card data registration process (S120) closer to the ID card data reader 131.
The ID card data reading device 131 reads the ID card data from the approached ID card by wireless communication, and outputs the read ID card data to the entrance / exit management device 140.
The passage approval unit 144 of the entrance / exit management device 140 inputs the ID card data output from the ID card data reading device 131.
After S131, the process proceeds to S132.

<S132>
The passage approval unit 144 uses the ID card data (hereinafter referred to as “input ID card data”) input in S131 as the ID card data (hereinafter referred to as “registration ID”) included in each personal data registered in the personal data storage unit 149. Card authentication is performed by comparing with card data).

  Hereinafter, personal data including registered ID card data that matches the input ID card data is referred to as “card authentication personal data”, and the case where the card authentication personal data exists is referred to as “verification OK (authentication OK)”. The case where it does not exist is referred to as “verification NG (authentication NG)”.

“Verification OK” indicates that the user whose ID card data reading device 131 in the dedicated area 130 has read the ID card data is authenticated as a registered person who has registered personal data including the ID card data. Means.
“Verification NG” means that the user is not authenticated as a registrant and does not approve passage of the door 132 by the user.

  After S132, the process proceeds to S133.

<S133>
If “verification is OK” in S132 (YES), the process proceeds to S134.
If “verification NG” in S132 (NO), the process returns to S131.

<S134>
The card authentication personal data (see S132) includes the expiration date of the ID card data.
The passage approval unit 144 determines whether the expiration date of the ID card data has expired based on the card authentication personal data.
If the expiration date of the ID card data has not expired (YES), the process proceeds to S135.
When the expiration date of the ID card data has expired (NO), the user is not approved to pass the door 132, and the pass approval process (S130) ends.

<S135>
The card authentication personal data includes a passable door and a passable time zone.
The passage approval unit 144 determines whether the user can pass through the door 132 based on the passable door and the passable time zone included in the card authentication personal data.
At this time, the passage approval unit 144 specifies the door 132 corresponding to the ID card data reader 131 that has output the ID card data in S131, and determines whether the specified door 132 is a passable door. The passage approval unit 144 can identify the door 132 corresponding to the ID card data reading device 131 based on information registered in advance in the storage device (information indicating the door 132 corresponding to each ID card data reading device 131). Shall. Furthermore, the traffic approval unit 144 determines whether the current time is a time included in the passable time zone. When it is determined that the door 132 is a passable door and the current time is included in the passable time zone, the pass approval unit 144 determines that the user can pass through the door 132, and the user The passage of the door 132 is approved.
If the user can pass through the door 132 (YES), the process proceeds to S136.
When the user cannot pass through the door 132 (NO), the user is not approved to pass through the door 132, and the passage approval process (S130) ends.

<S136>
The door control unit 145 controls the electric lock 133 to unlock the electric lock 133.
The user can enter a room whose entry is restricted from the door 132 where the electric lock 133 is unlocked.
After S136, the traffic approval process (S130) ends.

As processing other than the above, the ID card data registration unit 143 refers to each personal data registered in the personal data storage unit 149 periodically (for example, every day at midnight), and the ID card whose expiration date has expired Delete data from personal data. The user cannot enter the room from the door 132 unless biometric authentication is performed again in the shared area 120 and new ID card data is registered.
The personal data may not be expired and the personal data registered for the first time (excluding ID card data) may be used continuously.

  In the above-described series of processing, the ID card data is registered by the user, so that time and labor for registering / deleting the ID card for entering and exiting the room in the dedicated area 130 can be omitted.

In the first embodiment, the following entrance / exit management system 100 has been described.
The entrance / exit management system 100 is a system that reads and authenticates a card or biometric information, and locks and unlocks an electric lock, and has the following functions.
(1) A function of identifying an individual by biometric authentication and registering card data (ID card data registration approval unit 142, ID card data registration unit 143).
(2) A function of deleting registered card data after a set time (ID card data registration unit 143).

For example, the entrance / exit management system 100 has the following effects.
Even if the administrator wants to allow outside people who visit frequently, such as traders and business travelers, to enter a specific place for a certain period of time, he / she registers personal data every time an outside person visits and enters / exits ID There is no need to issue a card. The administrator only needs to register personal data once for each external person.
If an individual ID card (cash card, credit card, etc.) owned by the user is used as the ID card for entering and leaving the room, the ID card issuance cost is not incurred.
Moreover, since registration of ID card data is performed after biometric authentication based on personal data, security can be ensured.
Furthermore, by providing an expiration date for the registered ID card data, every time an external person visits, biometric authentication and registration of the ID card data are required, thereby improving security.

  The biometric data registered in the registration unit area 110 and the ID card data registered in the shared unit area 120 are examples of identification data for identifying a user. Other identification data (ID card data, password, etc.) may be registered instead of the biometric data in the registration unit area 110, and other identification data (biological data, password, etc.) may be used instead of the ID card data in the shared unit area 120. Etc.) may be registered.

  The ID card may be a terminal device (for example, a mobile phone) provided with an IC chip in which identification data is recorded.

  The ID card may be one in which identification data is displayed instead of being recorded on the storage medium (for example, a driver's license). In this case, the ID card data input device (122, 131) captures the identification data displayed on the ID card, the ID card data registration unit 143 registers the captured image data as ID card data, and the traffic approval unit. 144 compares the image of the input ID card data with the image of the registered ID card data.

  The method described in the first embodiment may be used in a system other than the entrance / exit management system 100 (for example, a terminal management system that manages the use of terminal devices).

  DESCRIPTION OF SYMBOLS 100 Entrance / exit management system, 110 Registration part area, 111 Personal data input device, 112 Biometric data reader, 120 Shared part area, 121 Biometric data reader, 122 ID card data reader, 130 Dedicated part area, 131 ID card data Reading device, 132 door, 133 electric lock, 140 entrance / exit management device, 141 personal data registration unit, 142 ID card data registration approval unit, 143 ID card data registration unit, 144 traffic approval unit, 145 door control unit, 149 personal data Memory part.

Claims (4)

A specific person who is permitted to register the first identification data input to the input device to which the first identification data that is the first type identification data for identifying the individual is input and the second type identification data. on the basis of the first registration data registered in advance in the storage device as the first type of identification data for identifying a first of the individual to authenticate by using the whether a particular person CPU (Central Proccessing unit) The authentication part of
When the first authentication unit by a previous Kiko person is authenticated as the a specific user, the input device second identification data before the second type of identification data for identifying Kiko person is input A data registration unit for registering the second identification data input to the storage device as second registration data;
Based on the personal identification data input to the input device to which personal identification data, which is the second type of identification data for identifying the user, is input, and the second registration data registered by the data registration unit. a second authentication unit that authenticates using the user the second CPU or the registration data is the person who is registered,
Wherein if the user by the second authentication unit is authenticated as a pre-Kiko person, the authentication apparatus characterized by comprising a device operation section for operating the given device. The data registration unit determines an expiration date of the second registration data;
The device operation unit, when the user is authenticated in the expiration date of the second registration data to be pre-Kiko person, authentication of claim 1, wherein the operating the predetermined device apparatus. The first identification data and the first registration data are biometric data read from an individual's living body,
The authentication apparatus according to claim 1, wherein the personal identification data and the second registration data are card data read from a card. The authentication apparatus according to any one of claims 1 to 3, wherein the device operation unit operates the electric lock that locks the door as the predetermined device to unlock the electric lock.

Images