JP5549456B2 - Biometric authentication device and biometric authentication method - Google Patents

Description

  The present invention relates to a biometric authentication device and an authentication method thereof.

As an authentication method of a biometric authentication apparatus that performs authentication using biometric features, 1: 1 authentication and 1: N authentication are known.
In 1: 1 authentication, identification information such as an ID is received together with biometric information from a person who requests authentication, the registered biometric information corresponding to the identification information is specified, and the registered biometric information is compared with the biometric information of the person to be authenticated. This is a method for authenticating whether or not the person is registered.

  1: N authentication accepts only biometric information from a person who requests authentication, and verifies whether or not the person is a registered person by comparing the accepted biometric information with a plurality of registered biometric information registered in advance. Is the method.

  Since 1: N authentication does not require input of identification information for specifying an individual, there is an advantage that it is not necessary to have an IC card for specifying an individual or to store an identification code.

  However, since it is necessary to collate with N pieces of biometric information one by one, it takes time for the collation process, and the other person acceptance rate that is mistakenly recognized as another person is larger than that of 1: 1 authentication. There is a point.

  In an authentication system composed of a client terminal and an authentication server, an identification ID for uniquely identifying biometric authentication data is stored for each address pool from the IP address of the client, and is specified by an authentication ID held for each address pool during authentication A technique for performing biometric authentication data and 1: N authentication is known (for example, Patent Document 1).

  In addition, when there are a plurality of reference biometric data whose matching rate with biometric data transmitted from a client terminal exceeds a set value, a technique for performing user authentication by comparing specific information of the client and characteristic information of the reference biometric data Is known (for example, Patent Document 2).

JP 2009-288936 A JP 2008-108035 A

  An object of the biometric authentication apparatus is to shorten the time required for 1: N authentication.

  The disclosed biometric authentication device is acquired by biometric information acquisition means for acquiring biometric information for verification of the person to be authenticated read by the biometric information reading means, identification information for specifying the authentication target person, and the biometric information acquisition means. An identification information list creating means for creating an identification information list in which the identification information of a plurality of persons authenticated by 1: 1 authentication using the biometric information for verification is registered, and registered biometric information of a plurality of registrants are stored. Registered biometric information storage means, and at the time of 1: N authentication, a plurality of the identification information registered in the identification information list is used to narrow down registrants, and the registered biometric information of the narrowed down registrants is obtained. Biometric authentication means that is obtained from the registered biometric information storage means and performs authentication by comparing the obtained biometric information of the plurality of registrants with the biometric information for verification.

  According to the disclosed biometric authentication device, the time required for 1: N authentication can be shortened.

It is a figure which shows the structure of the biometrics apparatus of 1st Embodiment. It is a flowchart of the history ID list update process of the first embodiment. It is a flowchart of the authentication process using the log | history ID list of 1st Embodiment. It is a figure which shows the structure of the client terminal and authentication server of 2nd Embodiment. It is a flow chart of history ID list update processing of a 2nd embodiment. It is a flowchart of the authentication process using the log | history ID list of 2nd Embodiment. FIGS. 7A and 7B are flowcharts of the history ID list deletion process according to the third embodiment. 8A and 8B are diagrams illustrating a data configuration of the history ID list according to the third embodiment. It is a figure which shows the structure of the authentication system of 4th Embodiment. It is a flow chart of history ID list update processing of a 4th embodiment. It is a flowchart of the authentication process using the log | history ID list of 4th Embodiment. It is a figure which shows the data structure of the log | history ID list of 4th Embodiment.

  FIG. 1 is a diagram illustrating a configuration of the biometric authentication device 11 according to the first embodiment. The biometric authentication device 11 includes a biometric data extraction unit 12 for verification, an authentication mode switching unit 13, and a history ID list creation unit 14. The biometric authentication device 11 includes a biometric authentication unit 15, an authentication target data search unit 16, and a registered biometric data storage management unit 17. The functions of the above-described units of the biometric authentication device 11 can be realized by software or hardware.

  A biometric information input device 18 that reads a fingerprint of a human finger, a blood vessel pattern of a finger or a palm, and the like is provided integrally or separately from the biometric authentication apparatus. The biological information input device 18 is, for example, a fingerprint sensor, a vein sensor that reads veins such as a palm, or the like. The biometric information input device 18 corresponds to biometric information reading means.

  The biometric data extraction unit 12 for collation extracts the feature data of the biometric information read by the biometric information input device 18 and outputs the extracted feature data to the biometric authentication unit 15 as biometric data for collation (collation biometric information). . In the following description, biometric data acquired from a person who has requested authentication (a person to be authenticated) is called biometric data for verification.

  The biometric data extraction unit 12 for collation does not necessarily need to extract the feature data of the biometric information, and all or part of the biometric information read by the biometric information input device 18 is stored in the biometric authentication unit 15 as biometric data for collation. It may be output. The biometric data extraction unit for verification 12 corresponds to biometric information acquisition unit for verification.

  The authentication mode switching unit 13 switches between a 1: 1 authentication mode for inputting identification information for specifying a person who requests authentication and a 1: N authentication mode for not requiring identification information. The authentication mode switching unit 13 is normally set to the 1: N authentication mode, and may be automatically switched to 1: 1 authentication when identification information such as an IC card is input. When the operation is performed, the mode may be switched to the 1: 1 authentication mode.

  The history ID list creation unit 14 creates a history ID list (identification information list) 14a in which user IDs (identification information) of persons who have been successfully authenticated are registered. If the authentication is successful during 1: 1 authentication, the history ID list creation unit 14 adds the user ID of the person who has been successfully authenticated to the history ID list 14a. Further, the history ID list creation unit 14 outputs the history ID list 14 a to the biometric authentication unit 15 at the time of 1: N authentication. The history ID list 14 a is stored in a storage unit such as a memory of the history ID list creation unit 14.

At the time of 1: 1 authentication, the biometric authentication unit 15 outputs the user ID of the person to be authenticated to the registered biometric data search unit 16 and instructs the biometric data search.
At the time of 1: N authentication, the biometric authentication unit 15 outputs the history ID list 14a received from the history ID list creation unit 14 to the registered biometric data search unit 16 and instructs the biometric data search.

  The registered biometric data search unit 16 searches for registered biometric data (hereinafter referred to as registered biometric data) stored in the registered biometric data storage management unit 17 using the user ID or the history ID list 14a. Then, the registered biometric data obtained by the search is output to the biometric authentication unit 15.

  The registered biometric data storage management unit 17 stores a plurality of registered biometric data (registered biometric information) in association with the user ID. The registered biometric data is stored in a storage unit such as a memory or a hard disk of the registered biometric data storage management unit 17, for example.

  When the registered biometric data search unit 16 receives the user ID from the biometric authentication unit 15 during 1: 1 authentication, the registered biometric data search unit 16 searches the registered biometric data storage management unit 17 for registered biometric data associated with the user ID. When there is registered biometric data associated with the user ID, the registered biometric data is output to the biometric authentication unit 15. When the registered biometric data does not exist, the biometric authentication unit 15 is notified that the corresponding registered biometric data does not exist.

  Upon receiving the history ID list 14a from the biometric authentication unit 15 during 1: N authentication, the registered biometric data search unit 16 registers registered biometric data corresponding to a plurality of user IDs registered in the history ID list 14a. Search from the data storage management unit 17. Then, a plurality of registered biometric data obtained by the search is output to the biometric authentication unit 15.

  At the time of 1: 1 authentication, the biometric authentication unit 15 performs authentication by comparing the registered biometric data output from the registered biometric data search unit 16 with the biometric data for verification. In the authentication, for example, the similarity between the biometric data for verification and the registered biometric data is calculated. When the authentication is successful, the history ID list creating unit 14 is notified of the authentication success, and the user ID that has been successfully authenticated is output to the history ID list creating unit 14. The user ID list creation unit 14 adds the user ID that has been successfully authenticated to the history ID list 14a.

  When the biometric authentication unit 15 obtains a plurality of registered biometric data from the registered biometric data search unit 16 during 1: N authentication, the biometric authentication unit 15 sequentially compares the plurality of registered biometric data narrowed down by the history ID list 14a and the biometric data for verification. To authenticate.

  When the 1: N authentication using the history ID list 14a fails, the biometric authentication unit 15 notifies the verification biometric data extraction unit 12 that the authentication has failed. When the verification biometric data extraction unit 12 receives the notification of the failure of 1: N authentication, the verification biometric data extraction unit 12 requests the person who has requested authentication to input a user ID. If the user ID is input, it is checked whether or not the user ID is registered in the history ID list 14a. If the user ID is not registered, the input user ID is output to the biometric authentication unit 15. To do.

  The biometric authentication unit 15 performs authentication using the user ID sent from the verification biometric data extraction unit 12 and the acquired biometric data for verification. If the 1: 1 authentication using the user ID is successful, the user ID is output to the history ID list creation unit 14 to instruct addition to the history ID list 14a.

The biometric authentication unit 15 and the registered biometric data search unit 16 correspond to biometric authentication means. The registered biometric data storage management unit 17 corresponds to a registered biometric information storage unit.
According to the biometric authentication device 11 described above, the registered biometric data can be narrowed down by using the history ID list 14a during 1: N authentication. Accordingly, since it is not necessary to collate with all registered biometric data during 1: N authentication, the time required for authentication can be shortened.

  The history ID list 14a according to the embodiment is data managed separately from the registered biometric data. In other words, in the database in which the registered biometric data is registered, it is not data that is managed in direct association with the registered biometric data, so even if the data changes, there is no need for the administrator to correct the data in the database, Database management becomes easy.

The operation of the biometric authentication device 11 will be described with reference to the flowcharts of FIGS. The following processing is executed by the processor (CPU or the like) of the biometric authentication device 11.
FIG. 2 is a flowchart of the history ID list update process of the biometric authentication device 11 according to the first embodiment.

  The authentication mode of the authentication application program that performs biometric authentication is switched from the 1: N authentication mode (IDless) to the 1: 1 authentication mode (FIG. 2, S11). The authentication mode may be switched by, for example, a user performing a switching operation, or the biometric recognition device 11 may autonomously switch when detecting that a user ID has been input.

Next, biometric data for verification obtained by extracting feature data from the biometric information read by the biometric information input device 18 and the user ID are acquired (S12).
Next, the acquired user ID and biometric data for verification are sent to the biometric authentication unit 15 (S13).

  Next, registered biometric data associated with the same user ID as the input user ID is searched from a plurality of registered biometric data stored in the storage unit, and the registered biometric data obtained by the search is retrieved. Authentication is performed using the data and biometric data for verification (S14).

  In the process of step S14, for example, the processor searches the storage unit using the input user ID as a key, and specifies registered biometric data having the same user ID. Then, the degree of similarity between the registered biometric data obtained by the search and the biometric data for verification is calculated, and the individual is authenticated by determining whether or not the degree of similarity is greater than or equal to a reference value.

  Based on the authentication result, it is confirmed (determined) whether or not the person who requested the authentication is the registrant himself (S15). In the process of step S15, for example, the processor determines that the person is the registrant when the similarity between the registered biometric data and the biometric data for verification is greater than or equal to the reference value, and determines that the person is another person when the similarity is less than the reference value.

If it is determined that the person who has requested authentication is the registrant (S15, YES), the process proceeds to step S16 to notify the user of the authentication success. Then, the user ID successfully authenticated is added to the history ID list 14a (S17).
On the other hand, if it is determined that the person who requested the authentication is another person (S15, NO), the process proceeds to step S18, and the user is notified of the authentication failure.

  FIG. 3 is a flowchart of the authentication process using the history ID list 14a according to the first embodiment. In the following processing, the processor realizes functions such as the biometric data extraction unit 12 for verification, the history ID list creation unit 14, the biometric authentication unit 15, and the registered biometric data search unit 16.

  Biometric data for verification of a person who requests authentication is acquired from the biometric information input device 18 or the like (S21). The biometric data for verification and the history ID list 14a are sent to the biometric authentication unit 15 (S22).

  The biometric authentication unit 15 acquires registered biometric data associated with a plurality of user IDs in the history ID list 14a, and performs authentication using the acquired registered biometric data and verification biometric data (S23).

  In the processing of step S23, for example, the processor uses registered biometric data stored in the storage unit (for example, registered biometric data storage management unit 17) using a plurality of user IDs registered in the history ID list 14a as keys. Search for. Then, the degree of similarity between the plurality of registered biometric data obtained by the search and the biometric data for verification is calculated, and it is determined whether or not the degree of similarity is greater than or equal to a reference value. In this way, by performing the 1: N authentication by narrowing down the registered biometric data using the history ID list 14a, the processing time required for the authentication can be shortened.

  Based on the authentication result, it is confirmed (determined) whether or not the person who requested the authentication is the registrant himself (S24). In the process of step S24, for example, the processor determines that the person is the registrant when the similarity between the registered biometric data and the biometric data for verification is greater than or equal to the reference value, and determines that the person is another person when the similarity is less than the reference value.

  When it is determined that the person who has requested authentication is the registrant (S24, YES), the process proceeds to step S25, and the user is notified of successful authentication. If 1: N authentication using the history ID list 14a is successful, the process ends there.

On the other hand, when it is determined that the user is not the registrant (S24, NO), the process proceeds to step S26 to notify the user of the authentication failure.
If authentication using the history ID list 14a fails, the user is requested to input an ID (S27). If the user inputs the user ID, the user ID is sent to the biometric authentication unit 15 (S28).

The biometric authentication unit 15 identifies registered biometric data associated with the input user ID, and performs authentication using the registered biometric data and biometric data for verification (S29).
In the process of step S29, for example, the processor searches the registered biometric data stored in the storage unit in association with the input user ID, and the registered biometric data obtained by the search is similar to the biometric data for verification. Calculate the degree. Then, it is determined whether the similarity is equal to or higher than a reference value.

Based on the authentication result, it is confirmed (determined) whether or not the person who requested the authentication is the registrant himself (S30).
When it is determined that the user is the registrant (S30, YES), the process proceeds to step S31 to notify the user of the authentication success. Furthermore, the user ID that has been successfully authenticated is added to the history ID list 14a (S32). Thereafter, the process ends.

  That is, when 1: N authentication using the history ID list 14a fails, input of a user ID is requested, and 1: 1 authentication is performed using the input user ID. If the authentication is successful, the user ID input at that time is added to the history ID list 14a. Thereby, the user ID of the user who has succeeded in authentication can be automatically added to the history ID list 14a.

If it is determined in step S30 that the user is not the registrant (S30, NO), the process proceeds to step S33, the authentication failure is notified to the user, and the process is terminated.
According to the first embodiment described above, the following effects can be obtained. The registered biometric data at the time of 1: N authentication can be narrowed down using the history ID list 14a in which user IDs of persons who have been successfully authenticated by the biometric authentication device 11 are registered. Thereby, when performing 1: N authentication, it is only necessary to collate with a part of registered biometric data stored in the storage unit, so that the processing time required for authentication can be shortened.

Since the registered biometric data is narrowed down using the history ID list 14a, it is not necessary to have a mechanism for managing the registered biometric data in groups.
Therefore, even when the group to which the registrant belongs is changed, the administrator does not need to modify the attribute information of the database in which the registered biometric data is registered, so that the data maintenance / management work is simplified.

  Furthermore, since the history ID list 14a is not information directly associated with the biometric authentication device 11 (for example, the MAC address of the device), the registered biometric data is registered even when the biometric authentication device 11 is replaced or discarded. There is no need to modify the database. In the first embodiment, since the history ID list 14a created by the old biometric authentication device 11 can be directly taken over by the newly used biometric authentication device 11, it is not necessary for the administrator to correct the data. Thereby, the operation | work at the time of replacement of the biometrics authentication apparatus 11 becomes easy.

  In addition, since the history ID list 14a is not confidential information, it can be managed by the user. For example, when the history ID list is initially set, the biometric authentication apparatus 11 may read the history ID list 14a that has been created by the user.

  Furthermore, since narrowing down is performed using the history ID list 14a in which user IDs of persons who have succeeded in the authentication using the specific biometric authentication device 11 are registered, when matching with all registered biometric data Compared with, it is possible to reduce the refusal rate for identifying a registered person as another person. Similarly, it is possible to reduce the other person acceptance rate for judging another person as the principal.

  FIG. 4 is a diagram illustrating configurations of the client terminal 21 and the authentication server 22 according to the second embodiment. In the second embodiment, in the client-server type authentication system, the biometric data for verification and the history ID list 14a are transmitted from the client terminal 21 to the authentication server 22, and the authentication server 22 performs authentication using these data. Is what you do. In FIG. 4, the same blocks as those in FIG. Although only one client terminal 21 is shown in FIG. 4, the present invention can also be applied to a system in which two or more client terminals 21 are connected.

  The client terminal 21 includes a verification biometric data extraction unit 12, an authentication mode switching unit 13, and a history ID list creation unit 14. The client terminal 21 includes a biological information input device 18 that is provided integrally with or separately from the apparatus.

  The authentication server 22 includes a biometric authentication unit 15, a registered biometric data search unit 16, and a registered biometric data storage management unit 17. The authentication server 22 is connected to the client terminal 21 via the network 23.

  Here, operations of the client terminal 21 and the authentication server 22 will be described with reference to the flowcharts of FIGS. 5 and 6. The following processing is executed by the processor of the client terminal 21 and the authentication server 22.

FIG. 5 is a flowchart of history ID list update processing according to the second embodiment.
The client terminal 21 acquires the user ID of the person who requests authentication and biometric data for verification (S41). Next, the acquired user ID and biometric data for verification are transmitted to the authentication server 22 (S42).

The authentication server 22 retrieves the registered biometric data associated with the received user ID from the storage unit (stores a plurality of registered biometric data), the registered biometric data obtained by the search, and the client terminal Authentication is performed using the biometric data for verification received from 21 (S43).
In the process of step S43, for example, the processor calculates the similarity between the registered biometric data and the matching biometric data with the same user ID, and determines whether or not the similarity is greater than or equal to a reference value.

  Based on the authentication result, it is determined whether or not the person who requested the authentication is the registrant himself (S44). In the process of step S44, for example, the processor determines that the person is the registrant when the similarity between the registered biometric data and the biometric data for verification is greater than or equal to a reference value, and determines that the person is another person when the similarity is less than the reference value.

When it is determined that the person who has requested authentication is the registrant (S44, YES), the process proceeds to step S45, and the client terminal 21 is notified of the authentication success. Upon receiving the notification of successful authentication, the client terminal 21 adds the user ID that has been successfully authenticated to the history ID list 14a (S46). Thereafter, the process ends.
On the other hand, when it is determined that the person who has requested authentication is another person (S44, NO), the process proceeds to step S47, the authentication failure is notified to the client terminal 21, and the process is terminated.

FIG. 6 is a flowchart of an authentication process using the history ID list 14a according to the second embodiment.
The biometric data for verification of the person who requested authentication is acquired (S51). During 1: N authentication, the biometric data for verification and the history ID list 14a are sent from the client terminal 21 to the authentication server 22 (S52).

  At the time of 1: N authentication, the authentication server 22 acquires a plurality of registered biometric data associated with a plurality of user IDs in the history ID list 14a from the storage unit, and the acquired plurality of registered biometric data and the verification The biometric data is sequentially verified to perform authentication (S53).

  In the process of step S53, for example, the processor searches the storage unit (stores a plurality of registered biometric data) using the user ID registered in the history ID list 14a as a key, and the user ID matches. The registered biometric data to be extracted is extracted. Then, the degrees of similarity between the extracted plurality of registered biometric data and verification biometric data are calculated, respectively, and it is determined whether or not the degree of similarity is equal to or greater than a reference value.

  Based on the authentication result, it is confirmed (determined) whether or not the person who requested the authentication is the registrant himself (S54). In the process of step S54, for example, the processor of the authentication server 22 determines that the person is a registered person when the similarity between the registered biometric data and the biometric data for verification is greater than or equal to a reference value, and determines that the person is another person when the similarity is less than the reference value. To do.

When it is determined that the person who has requested authentication is the registrant (S54, YES), the process proceeds to step S55, and the client terminal 21 is notified of the authentication success.
On the other hand, when it is determined that the person is another person (S54, NO), the process proceeds to step S56, and the authentication server 22 notifies the client terminal 21 of the authentication failure while holding the biometric data for verification. In the processing of step S56, for example, the processor temporarily stores the biometric data for verification that has failed in the memory or the like.

  Next, the client terminal 21 is requested to input a user ID (S57). When the user ID is input, the client terminal 21 transmits the user ID to the authentication server 22 (S58).

  When the authentication server 22 receives the user ID from the client terminal 21 in response to the input request for the user ID, the authentication server 22 associates the received user ID with the biometric data to be stored and stores it in a memory or the like ( S59).

  The authentication server 22 reads the registered biometric data corresponding to the received user ID from the storage unit, and performs authentication using the read registered biometric data and the matching biometric data held (S60).

  In the process of step S60, for example, the processor of the authentication server 22 searches the registered biometric data from the storage unit using the user ID as a key. Then, the similarity between the registered biometric data corresponding to the user ID obtained by the search and the biometric data for verification that is held is calculated, and it is determined whether or not the similarity is equal to or higher than a reference value.

Based on the authentication result, it is confirmed (determined) whether or not the person who requested the authentication is the registrant himself (S61).
When it is determined that the person who has requested authentication is the registrant (S61, YES), the process proceeds to step S62, and the authentication server 22 notifies the client terminal 21 of successful authentication.

Upon receiving the notification of successful authentication, the client terminal 21 adds the user ID that has been successfully authenticated to the history ID list 14a (S63). Thereafter, the process ends.
On the other hand, when it is determined that the user is not the registrant (S61, NO), the process proceeds to step S64, and the authentication server 22 notifies the client terminal 21 of the authentication failure and ends the process. In the above embodiment, an example is described in which the authentication server 22 waits for an ID sent from the client terminal 21 while holding the biometric data for verification when it is inferred that the corresponding ID is not included in the history ID list. However, it is of course possible to store the biometric data for verification on the terminal 21 side and send the ID and biometric data for verification input to the terminal later to the authentication server 22 at the same time.

  According to the second embodiment described above, the following effects can be obtained. In the client-server type authentication system, the authentication server 22 can narrow down registered biometric data at the time of 1: N authentication using the history ID list 14a held by the client terminal 21. Thereby, at the time of 1: N authentication, it is only necessary to collate with a part of registered biometric data registered in the authentication server 22, so that the processing time required for authentication can be shortened.

  The history ID list 14a is created by the client terminal 21, and the authentication server 22 does not need to have a mechanism for managing the registered biometric data in units of groups (for example, in units of groups to which the user belongs, in units of client terminals to be used, etc.). Therefore, even when the group to which the registrant belongs is changed, the administrator does not need to modify the attribute information of the database in which the registered biometric data is registered, so that the data maintenance / management work is simplified.

  Furthermore, since the history ID list 14a is not information specific to the client terminal 21 (for example, the address of the terminal), even if the client terminal 21 is replaced or discarded, the data is corrected on the authentication server 22 side. There is no need. For example, when managing the registered biometric data in units of client terminals by the authentication server 22, when the client terminal 21 is replaced, the system administrator needs to correct the address information of the terminal associated with the registered biometric data. . On the other hand, in the second embodiment, since the history ID list 14a created by the old terminal can be taken over as it is to the newly used client terminal 21, it is not necessary for the system administrator to correct the attribute data. . As a result, maintenance and management work when replacing a large number of client terminals 21 can be greatly reduced.

  In addition, since the history ID list 14a is not confidential information, it can be managed by the user. For example, when the history ID list is initially set, the client terminal 21 may read the history ID list 14a created by the user.

  Further, the user ID of the history ID list 14a may be added by the user. By doing so, for example, if the biometric data is registered in the authentication server 22, by registering his / her user ID in the history ID list 14a of the client terminal 21 in the company on a business trip destination, Authentication can be performed without performing 1: 1 authentication.

  Further, an expiration date may be set for the user ID in the history ID list 14a, and the user ID whose expiration date has passed may be deleted. By configuring in this way, it is possible to prevent the user ID of the temporarily used user from remaining in the history ID list 14a and increasing the number of user IDs.

  Next, FIGS. 7A and 7B are flowcharts of history ID list deletion processing according to the third embodiment. One feature of the third embodiment is that a user ID with a small number of uses or a user ID whose time has passed since the last access is deleted from the history ID list 14a. The biometric authentication device according to the third embodiment has the same configuration as the biometric authentication device 11 shown in FIG.

FIG. 7A is a flowchart showing a process for deleting a user ID with a small number of uses within a certain period from the history ID list.
The history ID list creation unit 14 reads the history ID list stored in the storage unit (S71). Then, the number of uses within a certain period for each user ID in the history ID list is confirmed (S72).

FIG. 8A is a diagram showing a data configuration of a user ID list 14b that stores a user ID and the number of uses in association with each other.
The history ID list 14b has a plurality of areas, each having an area for storing a user ID and an area for storing the number of times of use for the last month.
By reading the history ID list 14b in FIG. 8A, the number of uses of the biometric authentication device 11 for one month for each user ID can be confirmed.

Returning to FIG. 7A, user IDs less than or equal to the predetermined number of uses (arbitrary constant value) are extracted (S73).
Next, user IDs that are less than or equal to the extracted number of times of use are deleted (S74). By the process of step S74, for example, the user ID of 1 use and 0 use in FIG. 8A is deleted from the history ID list 14b.
Thereafter, the history ID list 14b from which the user ID with a small number of uses is deleted is stored in a memory or the like (S75).

FIG. 7B is a flowchart showing processing when a user ID that has not been used for a certain period of time is deleted from the history ID list.
The history ID list creation unit 14 reads the history ID list 14c stored in the storage unit (S81).
Next, the last use date and time for each user ID in the history ID list 14c is confirmed (S82).

FIG. 8B is a diagram showing a data configuration of the history ID list 14c that stores the user ID and the last use date in association with each other.
The history ID list 14c has a plurality of areas, each having an area for storing a user ID and an area for storing the last use date.

  Returning to FIG. 7B, user IDs used before a predetermined period (a certain period) are extracted (S83). In the process of step S83, for example, user IDs before the date and time when the last use date and time of the history ID list 14c in FIG.

  Next, the user ID whose last use date and time is a predetermined period or more, that is, the user ID that has not been used for a certain period or more is deleted from the history ID list 14c (S84). Then, the history ID list 14c after deleting the user ID is stored in a storage unit such as a memory (S85).

FIG. 8B shows that two user IDs with the oldest use date and time are to be deleted.
According to the third embodiment described above, the history ID list 14b or 14c can be obtained by deleting from the history ID list 14b or 14c a user ID that is less frequently used or a user ID that has not been used for a certain period of time. The number of registered users can be limited. As a result, when a large number of people use one biometric authentication device 11, it is possible to prevent an increase in the number of people narrowed down in 1: N authentication and an increase in authentication processing time.

  FIG. 9 is a diagram illustrating a configuration of the authentication system according to the fourth embodiment. The fourth embodiment relates to a client-server type authentication system in which the client terminal 21 can select and use an arbitrary authentication server among a plurality of authentication servers 32-34. In the following description, the same blocks as those shown in FIGS. 1 and 4 are denoted by the same reference numerals, and description thereof is omitted.

  In FIG. 9, the client terminal device 21 includes a biometric data extraction unit 12 for verification, an authentication mode switching unit 13, a history ID list creation unit 14, and an authentication server selection unit 31. In addition, the biometric information input device 18 is connected to the client terminal 21 as a device built in the client terminal 21 or as another device. The authentication server selection unit 31 selects one of a plurality of authentication servers 32-34 described later.

The client terminal 21 is connected to a plurality of authentication servers 32-34 via the network 23.
The authentication server 32 includes a biometric authentication unit 15, a registered biometric data search unit 16, and a registered biometric data storage management unit 17. The authentication servers 33 and 34 have the same configuration as the authentication server 32.

Here, operations of the client terminal 21 and the authentication servers 32-34 according to the fourth embodiment will be described with reference to the flowcharts of FIGS.
FIG. 10 is a flowchart of history ID list update processing according to the fourth embodiment.

The client terminal 21 selects an arbitrary authentication server from among a plurality of authentication servers (S91).
The authentication application mode is switched from the 1: N authentication mode to the 1: 1 authentication mode (S92).

  Next, the user ID of the person who requests authentication and biometric data for verification are acquired (S93). Next, the acquired user ID and biometric data for verification are transmitted to the selected authentication server (S94).

  The authentication server that has received the user ID and the biometric data for verification from the client terminal 21 (hereinafter, the case where the authentication server 33 is selected) is registered with the biometric data for registration and biometric data that is associated with the user ID. Authentication is performed using the data (S95).

  In the process of step S95, for example, the processor of the authentication server 33 acquires registered biometric data corresponding to the received user ID from the storage unit, and calculates the similarity between the acquired registered biometric data and verification biometric data. Then, it is determined whether the similarity is equal to or higher than a reference value.

  Based on the authentication result of step S95, it is determined whether or not the person who requested the authentication is the registrant (S96). In the process of step S96, for example, the processor of the authentication server 33 determines that the person is the registrant when the similarity between the registered biometric data and the biometric data for verification is greater than or equal to the reference value, and determines that the person is another person when the similarity is less than the reference value. To do.

  When it is determined that the person who has requested authentication is the registrant (S96, YES), the process proceeds to step S97, and the authentication server 33 notifies the client terminal 21 of successful authentication. The client terminal 21 that has received the notification of successful authentication notifies the user of successful authentication (S97). Furthermore, the client terminal 21 adds the user ID that has been successfully authenticated to the history ID list 14a (S98).

  On the other hand, when the person who has requested authentication is determined to be another person (S96, NO), the process proceeds to step S99, and the authentication server 33 notifies the client terminal 21 of the authentication failure. The client terminal 21 that has received the notification of the authentication failure notifies the user of the authentication failure (S99).

  FIG. 11 is a flowchart of authentication processing using a history ID list according to the fourth embodiment. In the following description of the processes, the same processes as those in the flowchart of FIG.

In FIG. 11, the client terminal 21 selects one authentication server from among a plurality of authentication servers (S101).
The processing of steps S51 to S63 in FIG. 11 is the same as the processing of the same step number in FIG. Through the processing of steps S51 to S63, the biometric data for verification and the history ID list 14a are transmitted to the authentication server selected by the client terminal 21, and the authentication server matches the registered biometric data narrowed down using the history ID list 14a. Is done. Thereby, also in the authentication system using a some authentication server, the same effect as 2nd Embodiment can be acquired.

FIG. 12 is a diagram illustrating a data configuration of the history ID list 14d according to the fourth embodiment.
The history ID list 14d is a set of data including an area for storing a user ID, an area for storing a plurality of domain names that specify an authentication server, and an area for storing the number of uses for the last two months for each domain name. It has a structure. The history ID list 14d may have only an area for storing a user ID and a domain name without having an area for storing the number of times of use.

In the history ID list 14d, a plurality of domain names (authentication server names) are stored in association with user IDs.
Therefore, when one authentication server is selected from a plurality of authentication servers, the user ID registered in the selected authentication server is extracted from the history ID list 14d and registered in the authentication server. A history ID list of user IDs can be created. The client terminal 21 transmits the created history ID list to the selected authentication server, so that the authentication server can perform authentication using the history ID list.

  According to the above-described fourth embodiment, in the authentication system in which the client terminal 21 can use the plurality of authentication servers 32-34, only the user ID of the person who has performed authentication using the selected authentication server is used. A history ID list can be created. Then, by transmitting the created history ID list to the selected authentication server, the authentication server can narrow down the registered biometric data to be compared with the biometric data for verification. Thereby, the processing time of the authentication process in each authentication server can be shortened.

In the fourth embodiment, the following effects can be obtained as in the first and second embodiments.
In the client-server type authentication system, the authentication server 32-34 can narrow down registered biometric data at the time of 1: N authentication using the history ID list 14d held by the client terminal 21. Thereby, at the time of 1: N authentication, the authentication server 32-34 only needs to collate with a part of the registered biometric data, so that the processing time required for authentication can be shortened.

  The history ID list 14d is created by the client terminal 21, and the authentication servers 32-34 need not have a mechanism for managing the registered biometric data in units of groups (for example, in units of client terminals). Therefore, even when the group to which the registrant belongs is changed, the system administrator does not need to modify the attribute information of the database in which the registered biometric data is registered, so that the data maintenance / management work is simplified.

  Further, since the history ID list 14d is not information specific to the client terminal 21 (for example, the address of the terminal), even if the client terminal 21 is replaced or discarded, the data is corrected on the authentication server 22 side. There is no need. For example, when managing the registered biometric data in units of the client terminal 21 by the authentication server 32-34, when the client terminal 21 is replaced, the system administrator corrects the address information of the client terminal associated with the registered biometric data. There is a need to. On the other hand, in the fourth embodiment, since the history ID list 14d created by the old terminal can be taken over as it is to the newly used client terminal 21, it is not necessary for the system administrator to correct the attribute data. . As a result, maintenance and management work when replacing a large number of client terminals 21 can be greatly reduced.

  In addition, since the history ID list 14d is not secret information, it can be managed by the user. For example, when the history ID list is initially set, the client terminal 21 may read the history ID list 14d created by the user.

  Further, the user ID of the history ID list 14d may be added by the user. In this way, for example, if a person whose biometric data is registered in the authentication server 22, by registering his / her user ID in the history ID list 14d of the client terminal 21 in the company on a business trip destination, Authentication can be performed without performing 1: 1 authentication.

The following additional notes are disclosed with respect to the embodiments including the first to fourth embodiments described above.
(Appendix 1)
Biometric information acquisition means for acquiring biometric information for verification of the person to be authenticated read by the biometric information reading means;
Creating an identification information list in which the identification information of a plurality of persons who have been authenticated by 1: 1 authentication using identification information for specifying a person to be authenticated and the biometric information for verification acquired by the biometric information acquisition means is registered Identification information list creation means for
Registered biometric information storage means for storing registered biometric information of a plurality of registrants;
At the time of 1: N authentication, registrants are narrowed down using a plurality of identification information registered in the identification information list, and registered biometric information of the plurality of registrants is obtained from the registered biometric information storage means, A biometric authentication device comprising biometric authentication means for performing authentication by collating a plurality of acquired registered biometric information with the biometric information for verification.
(Appendix 2)
When the biometric authentication unit determines that the person is not the registrant by 1: N authentication using the identification information list, the biometric authentication unit requests input of identification information of the person to be authenticated, and is specified by the input identification information. The biometric authentication device according to appendix 1, wherein authentication is performed by comparing biometric information with the verification biometric information of the person to be authenticated, and when the authentication is successful, the identification information is registered in the identification information list.
(Appendix 3)
The identification information list creating means creates an identification information list in which a user ID for identifying a user is associated with data indicating the number of uses within a predetermined period, and data whose number of uses is equal to or less than a predetermined value is stored in the identification information list The biometric authentication device according to supplementary note 1 or 2, which is deleted from the device.
(Appendix 4)
The identification information list creation means creates an identification information list in which a user ID for identifying a user and data indicating the last use date / time are associated with each other, and data whose last use date / time is earlier than a certain date / time is extracted from the identification information list. The biometric authentication device according to Supplementary Note 1 or 2 to be deleted.
(Appendix 5)
An authentication server used in a client-server type authentication system that performs authentication by transmitting biometric information for verification from a client terminal to an authentication server,
Registered biometric information storage means for storing registered biometric information of a plurality of registrants;
The biometric information for verification of the person to be authenticated and the identification information list in which the identification information of a plurality of authenticated persons are registered are received from the client terminal, and the identification information in the identification information list is used during 1: N authentication. The registered biometric information of the plurality of registered registrants is acquired from the registered biometric information storage means, and the plurality of registered biometric information and the verification biometric information are collated for authentication. An authentication server comprising biometric authentication means.
(Appendix 6)
The biometric authentication means requests the client terminal to input identification information of the authentication target when the authentication target is determined not to be the registrant by 1: N authentication using the identification information list; After receiving identification information from the client terminal, authentication is performed by comparing the registered biometric information specified by the received identification information with the biometric information for verification of the person to be authenticated. The authentication server according to appendix 5, wherein identification information is transmitted to the client terminal device and added to the identification information list.
(Appendix 7)
A client terminal used in a client-server type authentication system that performs authentication by transmitting biometric information for verification from a client terminal to an authentication server,
Biometric information acquisition means for acquiring biometric information for verification of the person to be authenticated read by the biometric information reading means, and transmitting the acquired biometric information for verification to the authentication server;
Among the persons to be authenticated who have transmitted the verification biometric information from the biometric information acquisition means, an identification information list in which identification information of persons authenticated by the authentication server is registered is created, and at the time of 1: N authentication, A client terminal comprising: an identification information list creating means for transmitting an identification information list to the authentication server.
(Appendix 8)
The identification information list creation means creates an identification information list in which a user ID for identifying a user and data indicating the last use date / time are associated with each other, and data whose last use date / time is earlier than a certain date / time is extracted from the identification information list. The biometric authentication device according to Supplementary Note 1 or 2 to be deleted.
(Appendix 9)
The identification information list creation means creates an identification information list in which a user ID for identifying a user and data indicating the last use date / time are associated with each other, and data whose last use date / time is earlier than a certain date / time is extracted from the identification information list. The biometric authentication device according to Supplementary Note 1 or 2 to be deleted.
(Appendix 10)
Obtain biometric information for verification of the person to be authenticated,
Creating an identification information list in which identification information of a plurality of persons authenticated by 1: 1 authentication using identification information for identifying a person to be authenticated and the biometric information for verification is registered;
At 1: N authentication, the identification information list is used to narrow down registrants, and the biometrics that is authenticated by collating the registered biometric information of a plurality of registrants with the verification subject's biometric information. Authentication method.
(Appendix 11)
As a result of 1: N authentication using the identification information list, when it is determined that the person to be authenticated is not the registrant, the user is requested to input the identification information of the person to be authenticated and specified by the inputted identification information. Authentication is performed by comparing the registered biometric information and the verification biometric information of the person to be authenticated,
The biometric authentication method according to claim 11, wherein when the authentication target person is determined to be the registrant himself, the identification information of the authentication target person is added to the identification information list.

11 Biometric Authentication Device 12 Biometric Data Extraction Unit for Verification 13 Authentication Mode Switching Unit 14 History ID List Creation Units 14a-14d History ID List 15 Biometric Authentication Unit 16 Registered Biometric Data Search Unit 17 Registered Biometric Data Storage Management Unit 18 Biometric Information Input Device 21 Client terminal 22, 32-34 Authentication server

Claims (5)

Biometric information acquisition means for acquiring biometric information for verification of the person to be authenticated read by the biometric information reading means;
An identification information list in which identification information of a plurality of persons authenticated by 1: 1 authentication using identification information for specifying an authentication target and the biometric information for verification acquired by the biometric information acquisition unit is created is created. An identification information list creation means;
And the registered biometric information storage means for storing in association with the registered biometric information of a plurality of subscribers of the identification information and the plurality of registrants,
1: when the N authentication, among the registered biometric information of the plurality of registrants, the registers the registered biometric information of a plurality of registrants corresponding to the identification information of the plurality of persons registered in the identification information list A biometric authentication apparatus comprising biometric authentication means that is obtained from biometric information storage means and performs authentication by collating the registered biometric information of the obtained plurality of registrants with the biometric information for verification.   When the biometric authentication unit determines that the person is not the registrant by 1: N authentication using the identification information list, the biometric authentication unit requests input of identification information of the person to be authenticated, and is specified by the input identification information. The biometric authentication device according to claim 1, wherein authentication is performed by comparing registered biometric information and biometric information for verification, and when the authentication is successful, the identification information is added to the identification information list. An authentication server used in a client-server type authentication system that performs authentication by transmitting biometric information for verification from a client terminal to an authentication server,
Registered biometric information storage means for storing registered biometric information of a plurality of registrants;
The biometric information for verification of the person to be authenticated and the identification information list in which the identification information of a plurality of authenticated persons are registered are received from the client terminal, and the identification information in the identification information list is used during 1: N authentication. The registered biometric information of the plurality of registered registrants is acquired from the registered biometric information storage unit, and the registered biometric information of the plurality of registrants is compared with the biometric information for verification. And an authentication server comprising biometric authentication means for performing authentication.   When the biometric authentication unit determines that the person is not the registrant by 1: N authentication using the identification information list, the biometric authentication unit requests the client terminal to input identification information of the person to be authenticated, and the identification information is received from the client terminal. Is received, authentication is performed by verifying the registered biometric information specified by the received identification information and the biometric information for verification, and when the authentication is successful, the identification information is transmitted to the client terminal. The authentication server according to claim 3, which is added to the identification information list. A biometric authentication method executed by a processor of a biometric authentication device,
Obtain biometric information for verification of the person to be authenticated,
Creating an identification information list in which identification information of a plurality of persons authenticated by 1: 1 authentication using identification information for identifying a person to be authenticated and the biometric information for verification is registered;
1: when the N authentication, from the storage unit in association with the registered biometric information of a plurality of subscribers of the identification information and the plurality of registrants, the identification of the plurality of persons registered in the identification information list multiple Tokushi preparative registered biometric information of a registrant, the biometric authentication method of performing authentication by collating the obtained plurality of registrants of the registered biometric information and the verification biometric information corresponding to the information.

Images