JP5860687B2 - Authentication system - Google Patents

Description

The present invention relates to an authentication system.

2. Description of the Related Art Conventionally, an authentication system that stores user information in a portable medium such as an IC card in advance and uses the portable medium carried by the user to authenticate whether or not the user is a valid user has been used. Yes.
For example, the authentication system includes an authentication device and an IC card. The authentication device is installed in a security gate or the like provided at the entrance of an office building for entrance / exit management of the office building. The IC card stores in advance authentication standard information such as user's finger vein information collected in advance and distributes it to the user. When the user carries the IC card and passes through the security gate, the user brings the IC card close to the authentication device, and further brings the finger close to the finger vein reading device included in the authentication device. The authentication device acquires authentication standard information stored in advance in the IC card from the IC card. The finger vein reader reads the user's finger vein information. The authentication device collates the authentication standard information with the finger vein information. If these two pieces of information match, the authentication device opens the gate, and if they do not match, the authentication device cannot open the gate.

In such an authentication system using biometric information such as finger vein information, for example, finger vein information collected in advance may not completely match the finger vein information read by the finger vein reader. . Therefore, the authentication system makes a determination based on the degree of coincidence between these finger vein information, and if the degree of coincidence is equal to or greater than a predetermined threshold (authentication threshold), it is determined that the user is a valid user, If authentication is accepted and the degree of coincidence is less than the authentication threshold, it may be determined that the user is not a valid user, that is, authentication may be rejected.
Here, for example, in Patent Document 1, the authentication system sets the same value as the authentication threshold for all users. Further, in Patent Document 1, when the degree of coincidence is in the vicinity of the authentication threshold, the authentication system, for example, another authentication method having a lower security level than the verification by finger vein information, for example, PIN (Personal Identification Number), etc. The system switches to an authentication method that uses a personal identification number.

JP 2010-250475 A

However, in the above-described conventional technology, for example, if the authentication threshold value of finger vein verification is increased in order to improve the security level, the number of users who are denied authentication and cannot pass through the security gate increases, and the user's convenience is impaired. It was sometimes.
That is, the above-described conventional technique has a problem that the security level cannot be improved without impairing the convenience of the user.

  The present invention has been made to solve the above problem, and an object of the present invention is to provide an authentication system that can improve the security level of the authentication system without impairing the convenience of the user.

In order to solve the above problems, the present invention is a portable medium that is used by a user and capable of storing information, and the user is a valid user based on information stored in the portable medium. An authentication system comprising: an authentication device that performs authentication of whether or not ; and a registration device that registers information used for the authentication in the portable medium, wherein the portable medium serves as a reference for authenticating the user An authentication standard information storage unit for storing authentication standard information, and an authentication threshold value storage unit for storing an authentication threshold value determined for each user as a threshold value for determining whether authentication is possible , An authentication apparatus includes an authentication information generation unit that acquires information from the user and generates authentication information, the authentication information generated by the authentication information generation unit, and the authentication stored in the authentication reference information storage unit Standard information Matching degree, and, on the basis of the said authentication threshold value stored in the authentication threshold storage unit, and a authentication section by the user to authenticate whether the user is an authorized user, the registration The apparatus acquires an information from the user and generates the authentication reference information, the authentication reference information generation unit, the authentication information generated by the authentication information generation unit, and the authentication reference information generation unit Based on the degree of coincidence with the authentication standard information, a determination unit that determines whether to generate the authentication standard information generated by the authentication standard information generation unit again, and a value corresponding to the degree of coincidence Based on the threshold value calculation unit that calculates the authentication threshold value between a predetermined upper limit value and a predetermined lower limit value, and the determination result of the degree of coincidence by the determination unit, the authentication reference information generation unit Generated And the authentication reference information, and the authentication threshold value calculated by the threshold calculating unit, a registration unit for registering the portable medium is an authentication system comprising: a.

  In the invention described above, the portable medium includes an authentication threshold value storage unit in which the authentication threshold value is stored in advance, and the authentication device stores the authentication threshold value in the authentication threshold value storage unit. The authentication threshold value is acquired, and authentication is performed based on the acquired authentication threshold value to determine whether or not the user is a valid user.

  Further, the present invention is the above invention, wherein the portable medium includes a user identification information storage unit in which user identification information determined for each user is stored in advance as information for identifying a user, and the authentication device includes: An authentication threshold value storage unit in which the authentication threshold value is stored in advance is associated with the user identification information, and the authentication unit acquires the user identification information stored in the user identification information storage unit The authentication threshold value associated with the acquired user identification information is read from the authentication threshold value storage unit, and the user is a valid user based on the read authentication threshold value. It is characterized by authenticating whether or not.

  In the above invention, the present invention further includes an authentication server connected to the authentication device and supplying information necessary for authentication to the authentication device, and the authentication server performs the authentication in association with the user identification information. An authentication threshold value storage unit in which a threshold value is stored in advance is provided, and the portable medium includes a user identification information storage unit in which user identification information determined for each user is stored in advance as information for identifying a user. The authentication unit acquires the user identification information stored in the user identification information storage unit, and displays the authentication threshold associated with the acquired user identification information as the authentication threshold storage unit. And authenticating whether or not the user is a valid user based on the read authentication threshold value.

  In the present invention, the authentication threshold value is a degree of coincidence between the authentication information and the authentication standard information, and is obtained when the authentication standard information is stored in the authentication standard information storage unit in advance. It is characterized in that it is determined in advance based on the determined degree of coincidence.

  Further, in the present invention according to the above invention, the authentication threshold value is an average value of the degree of coincidence between the authentication information and the authentication standard information, and the authentication standard information is stored in advance in the authentication standard information storage unit. In this case, the authentication information is predetermined based on an average value of the degree of coincidence obtained by comparing the authentication information and the authentication reference information a plurality of times.

  Further, the present invention is the above invention, wherein the authentication threshold is a frequency distribution of the degree of coincidence between the authentication information and the authentication reference information, and a class according to the number of times the authentication unit performs authentication, It is predetermined based on a frequency distribution of the degree of coincidence obtained by the frequency according to the degree of coincidence between the authentication information and the authentication reference information.

  According to the present invention, since different authentication threshold values can be set for each user, the security level of the authentication system can be improved without impairing user convenience.

It is a block diagram which shows the structure of the authentication system by the 1st Embodiment of this invention. It is a block diagram which shows the structure of the authentication apparatus as an example, and an IC card. It is a block diagram which shows the information memorize | stored in the user information storage part as an example. It is a flowchart which shows the procedure of the authentication determination of the authentication system as an example. It is a graph which shows the relationship between the person acceptance rate as an example, a stranger rejection rate, and an authentication threshold value. It is a block diagram which shows the structure of the registration apparatus as an example. It is a flowchart which shows the procedure of registration as an example. It is a flowchart which shows the procedure of the calculation of the authentication threshold value as an example. It is a block diagram which shows the structure of the authentication system by the 2nd Embodiment of this invention. It is a block diagram which shows the information memorize | stored in the user information storage part as an example. It is a flowchart which shows the operation | movement of the authentication as an example. It is a flowchart which shows the update procedure of the authentication threshold value as an example. It is a block diagram which shows the information memorize | stored in the user information storage part as an example. It is a flowchart which shows the update procedure of the authentication threshold value by the registration apparatus and authentication apparatus as an example. It is a block diagram which shows the information memorize | stored in the user information storage part and authentication apparatus memory | storage part as an example. It is a block diagram which shows the structure of the authentication system by the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the information memorize | stored in the authentication threshold value memory | storage part as an example. It is a flowchart which shows the operation | movement of the authentication using the authentication server as an example. It is a block diagram which shows the structure of the authentication system as an example.

[First embodiment]
Hereinafter, a first embodiment of an authentication system according to the present invention will be described with reference to the drawings.
FIG. 1 is a configuration diagram showing a configuration when the authentication system according to the present embodiment is installed in a gate.
The authentication system of the present embodiment includes an IC card (portable medium) 100 and an authentication device 200.
The IC card 100 is held by the user 400. The authentication device 200 is installed at the gate 300. The authentication device 200 performs an authentication process for authenticating the user 400 through communication between the IC card 100 and the authentication device 200.

Hereinafter, the configuration and operation of the authentication system according to the present embodiment will be described with reference to FIGS.
FIG. 2 is a block diagram showing the configuration of the IC card 100 and the authentication device 200.
The IC card 100 is a portable medium in which an IC chip having functions for storing and calculating information is incorporated, and includes a user information storage unit 110 and an IC card communication unit 120. Here, the portable medium is a portable information processing medium.
FIG. 3 shows the configuration of information stored in advance in the user information storage unit 110.
The user information includes authentication standard information, an authentication threshold value, and a user ID (user identification information).
The user information storage unit 110 includes an authentication standard information storage unit 111 in which authentication standard information is stored in advance, and an authentication threshold value storage unit 112 in which an authentication threshold is stored in advance.
The authentication reference information is biometric information such as fingerprint information, iris information, and vein information collected in advance from the user 400 and converted into digital information, and is used as one of comparison information in the authentication process performed by the authentication apparatus 200. In the present embodiment, finger vein information is applied to the authentication reference information. The authentication threshold value is used as a reference value when finger vein information is collated in the authentication process performed by the authentication apparatus 200. The authentication threshold setting procedure will be described later.

  The IC card communication unit 120 reads out the authentication standard information from the authentication standard information storage unit 111 and the authentication threshold value from the authentication threshold storage unit 112 as user information, and the IC card communication unit 120 reads out the authentication standard information. The information and the authentication threshold value are transmitted to the authentication device 200.

  The gate 300 is a security gate provided at the entrance of a security area where the user 400 is restricted by the authentication system of the present embodiment. The gate 300 has a flap that opens and closes based on a command from the authentication device 200. When there is no command to open the flap from the authentication device 200, the gate 300 closes the flap. If there is a command to open the flap from the authentication device 200, the gate 300 opens the flap and allows the user 400 to pass.

The authentication device 200 is a device that performs authentication processing of the user 400 based on the user information read from the IC card 100. The authentication device communication unit 210, the authentication determination unit (authentication unit) 220, the authentication information generation unit 230, and the like. It is equipped with.
The authentication device communication unit 210 receives the user ID, authentication standard information, and authentication threshold value transmitted by the IC card communication unit 120. In the present embodiment, the authentication device communication unit 210 performs contactless wireless communication with the IC card communication unit 120.
The authentication information generation unit 230 generates authentication information based on the finger vein information of the user 400. In the present embodiment, the authentication information generation unit 230 includes a finger vein sensor that reads the finger vein information of the user 400 when the user 400 brings the finger close to the authentication information generation unit 230, and the finger vein information read by the finger vein sensor is digital information. Generate authentication information.
The authentication determination unit 220 acquires the received authentication reference information and the authentication threshold value from the authentication device communication unit 210 and also acquires the authentication information generated by the authentication information generation unit 230. The authentication determination unit 220 compares the authentication standard information with the authentication information, calculates the degree of coincidence between the authentication standard information and the authentication information, and based on the calculated degree of coincidence and the acquired authentication threshold value. , Whether to accept or reject the authentication of the user 400 is determined. Here, the authentication determination unit 220 determines that the authentication of the user 400 is accepted if the calculated coincidence value is equal to or greater than the authentication threshold, and the authentication of the user 400 is rejected if it is less than the authentication threshold. . In the case of acceptance, the authentication determination unit 220 outputs a command to open the flap to the gate 300.

  FIG. 4 shows an authentication procedure by the authentication system. Here, the IC card 100 in which authentication standard information, which is finger vein information obtained by digitally converting vein information collected from the finger of the user 400 in advance, and an authentication threshold value are stored, is distributed to the user 400. Shall.

When the user 400 passes through the gate 300, the user 400 brings the IC card 100 close to the authentication device 200 installed in the gate 300.
When the IC card 100 enters the area where the IC card 100 can communicate with the authentication device 200, the IC card communication unit 120 transmits the authentication reference information and the authentication threshold value to the authentication device communication unit 210 provided in the authentication device 200. The authentication device communication unit 210 receives the authentication reference information and the authentication threshold value transmitted by the IC card communication unit 120 (step S1).
The authentication information generation unit 230 waits for the finger of the user 400 to be brought close to the authentication information generation unit 230. The authentication information generation unit 230 reads the finger vein information from the finger of the user 400 when the finger of the user 400 is brought close to the authentication information generation unit 230. The authentication information generation unit 230 generates authentication information in which the read finger vein information is converted into digital information (step S2).
The authentication determination unit 220 compares the authentication reference information received by the authentication device communication unit 210 in step S1 with the authentication information generated by the authentication information generation unit 230 in step S2, and calculates the degree of coincidence (step S3 ).
The authentication determination unit 220 determines whether to accept or reject the user authentication based on the authentication threshold value and the degree of coincidence (step S4).
If the degree of coincidence does not exceed the authentication threshold, authentication determination unit 220 determines rejection (step S4-rejection).
In this case, the authentication device 200 ends the authentication process without outputting a command to open the flap to the gate 300 (step S5).
On the other hand, in step S4, the authentication determination unit 220 determines to accept if the degree of coincidence exceeds the authentication threshold (step S4-acceptance).
In this case, the authentication device 200 outputs a command to open the flap to the gate 300 (step S6).

  As described above, the authentication system of the present embodiment is used by the user 400, and the user 400 is authorized based on the IC card (portable medium) 100 capable of storing information and the information stored in the IC card 100. An authentication system comprising an authentication device 200 that authenticates whether or not the user is a user, and the IC card 100 includes an authentication standard information storage unit in which authentication standard information as a standard for authenticating the user 400 is stored in advance The authentication apparatus 200 includes the authentication information generation unit 230 that acquires information from the user 400 and generates authentication information, and the authentication information generated by the authentication information generation unit 230 and the authentication reference information storage unit 111. An authentication threshold value determined in advance for each user 400 as a threshold value for determining the degree of coincidence with the authentication standard information being determined, and whether or not authentication is possible, Based on the user 400 is characterized in that it comprises an authentication judgment unit (authentication unit) 220 for performing authentication of whether the user is an authorized user.

  Further, the IC card (portable medium) 100 provided in the authentication system of this embodiment includes an authentication threshold value storage unit 112 in which an authentication threshold value is stored in advance, and the authentication device 200 includes an authentication threshold value. The authentication threshold value stored in the storage unit 112 is acquired, and whether or not the user is a valid user is authenticated based on the acquired authentication threshold value.

  Further, the IC card (portable medium) 100 provided in the authentication system of the present embodiment is used by the user 400 and can store information, and the information stored in the IC card 100 is based on the information. Whether or not the user 400 is a legitimate user, the IC card 100 included in the authentication system comprising the authentication apparatus 200 that authenticates whether or not the user 400 is a legitimate user. This is information used when authentication is performed by the authentication determination unit (authentication unit) 220 that performs such authentication, and the degree of coincidence with the authentication information generated when the information is acquired from the user 400 by the authentication device 200 Authentication used in advance for each user 400 is used as a threshold for determining the degree of coincidence and whether or not the authentication determination unit 220 can authenticate. The authentication standard information storage unit 111 stores authentication standard information as a standard for authenticating the user 400 as information used when authenticating whether or not the user 400 is a legitimate user based on the It is characterized by providing.

  The authentication apparatus 200 provided in the authentication system of the present embodiment is used by the user 400, and authentication standard information in which authentication standard information is stored in advance as an authentication standard for determining whether or not the user 400 is a valid user. An authentication device 200 included in an authentication system including an IC card (portable medium) 100 including a storage unit 111 and an authentication device 200 that authenticates the user 400 based on information stored in the IC card 100. The authentication information generation unit 230 that acquires information from the user 400 and generates the authentication information, the authentication information generated by the authentication information generation unit 230, and the user 400 stored in advance in the IC card 100 are valid users. As a threshold value for determining the degree of coincidence with authentication standard information as a standard for authenticating whether or not authentication is possible and whether or not authentication is possible Predetermined is authentication threshold every The 400, on the basis of the authentication determination unit for authenticating whether the user 400 is an authorized user (the authentication section) 220, characterized in that it comprises a.

In the authentication system of the present embodiment configured as described above, the authentication threshold value is stored in the IC card 100 held by each user 400, so that a different authentication threshold value is set for each user 400. be able to. Therefore, in the authentication system of this embodiment, the security level of the authentication system can be improved without impairing the convenience of the user 400.
This function and effect will be described below by taking the entrance / exit management of an office building as an example.

  Here, for example, it is assumed that entrance regulations to an office building have become stricter and the security level is required of the authentication system. In this case, the authentication system of this embodiment can raise the security level of an authentication system by changing the authentication threshold set for every user to a value larger than the conventional setting value.

FIG. 5 shows an example of the relationship between the identity acceptance rate (person authentication rate) and the other person rejection rate (other person rejection rate) and the degree of coincidence in the authentication system using finger vein verification including the authentication system of the present embodiment. . W1 and W2 are acceptance rates. W3 is the rejection rate of others. L1 to L3 are authentication threshold values.
The principal acceptance rate indicates the ratio of the number of times authentication is accepted to the number of authentications when the person to be authenticated is a valid user. Therefore, a person acceptance rate of 100% indicates that authentication is always accepted for a legitimate user, and a person acceptance rate of 0% means that authentication is always rejected even for a legitimate user. Is shown. In other words, an authentication system with a high identity acceptance rate is excellent in convenience for the user 400 because the proportion of the identity rejection is small.
The rejection rate of others indicates the ratio of the number of times authentication is rejected to the number of authentications when the person to be authenticated is a user 400 other than a valid user. Therefore, the rejection rate of 100% indicates that authentication is always rejected if the user 400 is not a legitimate user, and the rejection rate of 0% is a user 400 other than the legitimate user. Indicates that authentication is always accepted. In other words, an authentication system with a high rejection rate of others has a high security level because the ratio of accepting users 400 other than legitimate users is small.
The authentication threshold value indicates a setting value of the security level in the authentication system, and the larger the authentication threshold value, the higher the security level of the authentication system.
For example, if the degree of coincidence A in FIG. 5 is an authentication threshold, the person acceptance rate W1 is about 100% and the other person rejection rate W3 is about 60%. On the other hand, when the authentication threshold value passes through the degree of coincidence C that is greater than the degree of coincidence A, the principal acceptance rate W1 is about 80%, and the other person rejection rate W3 is about 100%. Therefore, an authentication system using the matching degree C as an authentication threshold has a higher security level than an authentication system using the matching degree A as an authentication threshold.

Note that, as described above, there are users who have a relatively high degree of coincidence of fingerprint information and users who have a relatively low degree of identity, so that the person acceptance rate and the other person rejection rate are different for each user 400. Here, as an example, W1 is the user acceptance rate of a user with relatively low matching degree of fingerprint information, and W2 is the user acceptance rate of a user with relatively high matching degree of fingerprint information.
In the authentication system of this embodiment, since the authentication threshold value is stored in the IC card 100 held by each user 400, the authentication threshold value can be set to a different value for each user 400. For example, the authentication system according to the present embodiment sets the authentication threshold of a user having a relatively high principal acceptance rate (that is, the principal acceptance rate W2) among all the users 400 to a degree of coincidence higher than a standard value ( For example, it is set to C) shown in FIG. 5, and the authentication threshold value of the user whose principal acceptance rate is relatively low (that is, the principal acceptance rate W1) is set to a standard match (for example, B shown in FIG. 5). be able to.
When the authentication threshold is set in this way, the rejection rate of users with a relatively high identity acceptance rate is set to about 100%, and the acceptance rate of users with a relatively low identity acceptance rate is set to about 95%. can do. Therefore, the authentication system of the present embodiment can improve the rejection rate of a user with a relatively high personal acceptance rate without reducing the personal acceptance rate of a user with a relatively low personal acceptance rate.
As described above, the authentication system of the present embodiment has an effect that the security level of the authentication system can be improved without impairing the convenience of the user 400.

[User Information Registration Procedure]
Hereinafter, a procedure for registering user information in the IC card 100 in the authentication system of this embodiment will be described with reference to FIGS.
FIG. 6 shows the configuration of the authentication system including the registration device 500.

The IC card 100, the authentication device 200, and the gate 300 are the same as described above.
For example, when registering a new user 400 in the authentication system, the registration device 500 is a device for registering user information in the IC card 100, and includes a registration device communication unit 510 and a registration control unit (registration unit, authentication unit). A threshold value calculation unit) 520 and a registration information acquisition unit 530.
The registration control unit 520 controls the registration device 500 by an authentication standard information generation operation, an authentication standard information registration operation, an authentication confirmation operation, an authentication threshold value calculation operation, and an authentication threshold value registration operation. The authentication standard information generation operation is an operation in which the registration control unit 520 generates authentication standard information in which finger vein information supplied from the registration information acquisition unit 530 is converted into digital information. The authentication standard information registration operation is an operation in which the registration control unit 520 stores the authentication standard information in the authentication standard information storage unit 111 included in the IC card 100 via the registration device communication unit 510 and the IC card communication unit 120. . The authentication confirmation operation is an operation in which the registration control unit 520 confirms whether or not authentication is accepted by the authentication device 200 based on the authentication standard information stored in the authentication standard information storage unit 111. The authentication threshold calculation operation is an operation in which the registration control unit 520 calculates an authentication threshold based on the degree of coincidence between the authentication reference information and the finger vein information. The authentication threshold value registration operation is an operation in which the registration control unit 520 stores the authentication threshold value in the authentication threshold value storage unit 112 via the registration device communication unit 510 and the IC card communication unit 120.
The registration device communication unit 510 receives the authentication standard information from the IC card communication unit 120, and the registration device communication unit 510 transmits the authentication standard information and the authentication threshold value to the IC card communication unit 120. In the present embodiment, the registration device communication unit 510 performs contactless wireless communication with the IC card communication unit 120.
The registration information acquisition unit 530 acquires finger vein information from the user 400. In the present embodiment, for example, the registration information acquisition unit 530 includes a finger vein sensor that reads the finger vein information of the user 400 when the user 400 brings the finger close to the registration information acquisition unit 530.

FIG. 7 shows a procedure for setting an authentication threshold value between the registration apparatus 500 and the IC card 100.
The registration information acquisition unit 530 acquires finger vein information from the user 400. The registration control unit 520 generates authentication standard information obtained by converting the acquired finger vein information into digital information (step S101, authentication standard information generation operation).

  The registration control unit 520 stores the authentication standard information in the authentication standard information storage unit 111 provided in the IC card 100 via the registration device communication unit 510 and the IC card communication unit 120 (step S102, authentication standard information registration operation). ).

  The registration control unit 520 reads the authentication standard information stored in the authentication standard information storage unit 111 via the registration device communication unit 510 and the IC card communication unit 120 (step S103).

  The registration information acquisition unit 530 acquires finger vein information from the user 400. The registration control unit 520 generates authentication information in which the acquired finger vein information is converted into digital information (step S104).

The registration control unit 520 compares the read authentication standard information with the generated authentication information to calculate the degree of coincidence (step S105). Here, in order to obtain the average value of the degree of coincidence between the authentication reference information and the authentication information, the registration control unit 520 performs steps S103 to S105 a plurality of times. In this embodiment, the registration control unit 520 repeats steps S103 to S105, for example, three times, but may be performed once, for example.
The registration control unit 520 obtains an average value of the degree of coincidence calculated in steps S103 to S105 (step S106).

  The registration control unit 520 determines whether or not the average value of the obtained matching degrees exceeds the reference value (step S107). Here, the reference value is a value determined based on, for example, the lower limit value of the security level required for the authentication system of this embodiment, that is, the lower limit value of the other person rejection rate. For example, when the degree of coincidence is indexed as 1000 when the authentication standard information and the authentication information completely match, and as 0 when the case where the authentication standard information and the authentication information completely match does not match, this embodiment For example, the reference value is set as 500. Here, the obtained degree of coincidence means that when the value is less than the reference value, the acceptance rate is low. In this case, the registration control unit 520 returns the procedure to step S101 (step S107-re-registration). On the other hand, if the average value of the degree of coincidence is greater than or equal to the reference value, registration control unit 520 proceeds with the next procedure (step S107—permitted) (steps S104 to S107 authentication confirmation operation).

  Registration control unit 520 calculates an authentication threshold value according to a predetermined procedure (step S108, authentication threshold value calculation operation). The predetermined procedure will be described later.

  The registration control unit 520 stores the authentication threshold value in the authentication threshold value storage unit 112 included in the IC card 100 via the registration device communication unit 510 and the IC card communication unit 120 (step S109, authentication threshold). Value registration operation).

  As described above, the registration device 500 provided in the authentication system of the present embodiment is based on an IC card (portable medium) 100 that can be used by a user and can store information, and information stored in the IC card 100. A registration device 500 used in an authentication system comprising: an authentication device 200 that authenticates whether or not a user is a valid user; and a registration device 500 that registers user information in the IC card 100, A threshold value used when authentication is performed by an authentication determination unit (authentication unit) 220 that authenticates whether or not the user 400 is a valid user, which is included in the authentication device 200, and the authentication device 200 The authentication information generated by acquiring the information from the user 400 by the authentication information generation unit 230 provided, and the authentication standard information description provided in the IC card 100 For each user 400 that is used when the authentication determination unit 220 determines whether or not authentication is possible based on the degree of coincidence with the authentication reference information as a reference for authenticating the user 400 stored in advance in the unit 111. A registration control unit (authentication threshold value) that is calculated for each user 400 based on the degree of coincidence between the authentication information and the authentication standard information obtained when the predetermined authentication threshold value is stored in the authentication standard information storage unit 111 in advance. A value calculation unit) 520, and a registration control unit (registration unit) 520 that registers the authentication threshold value calculated by the registration control unit 520.

[Authentication threshold setting procedure]
FIG. 8 shows an example of the procedure for calculating the authentication threshold in step S108 described above.
The registration control unit 520 calculates an authentication threshold value based on the average value of the matching degrees (step S108). For example, in the present embodiment, if the average value of the coincidence is 500 or more and less than 600, the authentication threshold is set to 500, and if the average value of the coincidence is 600 or more and less than 800, the authentication threshold is set to the coincidence. If the average value of the coincidence is 800 or more, the authentication threshold value is set to 800 and the authentication threshold value is calculated.
In the present embodiment, since the registration control unit 520 repeats steps S103 to S105, for example, three times, the registration threshold value is calculated based on the average value of the matching degrees. If S103 to S105 are performed once, for example, the authentication threshold value may be calculated based on the degree of coincidence.

  As described above, the authentication threshold value in the authentication system of the present embodiment is the degree of coincidence between the authentication information and the authentication standard information, and is obtained when the authentication standard information is stored in the authentication standard information storage unit 111 in advance. It is predetermined based on the degree of coincidence.

  The authentication threshold in the authentication system of the present embodiment is the average value of the degree of coincidence between the authentication information and the authentication reference information, and the authentication reference information is stored in the authentication reference information storage unit 111 in advance. When storing, it is predetermined based on the average value of the degree of coincidence obtained by comparing authentication information and authentication reference information a plurality of times.

  The authentication system of the present embodiment configured as described above can set different authentication threshold values according to the degree of coincidence calculated for each user 400. Therefore, for example, the authentication system narrows down to users 400 whose authentication is likely to be rejected, and sets an authentication threshold value close to the lower limit value of the security level required for the authentication system of the present embodiment, so that authentication is not easily rejected. In addition, it is possible to increase the authentication threshold of other users 400 and improve the security level.

The registration apparatus 500 included in the authentication system of the present embodiment can set the authentication threshold value to a different value for each user 400.
Furthermore, the registration apparatus 500 calculates the authentication threshold value based on the average value of the degree of coincidence after obtaining the degree of coincidence several times. Thereby, the disturbance (for example, the change of the position where the finger is placed on the finger vein sensor) during the authentication confirmation operation can be averaged. For this reason, the registration device 500 can set an authentication threshold value in which both the person acceptance rate and the other-person rejection rate are high in the authentication operation by the authentication device 200. Therefore, the authentication system of the present embodiment can improve the rejection rate of a user with a relatively high personal acceptance rate without reducing the personal acceptance rate of a user with a relatively low personal acceptance rate.
As described above, the authentication system of the present embodiment has an effect that the security level of the authentication system can be improved without impairing the convenience of the user 400.

[Second Embodiment]
In the first embodiment, the authentication threshold value is stored in the authentication threshold value storage unit 112 included in the IC card 100. However, the authentication device 200 includes the authentication threshold value storage unit 241, and the authentication threshold is set. The value may be stored in the value storage unit 241. Hereinafter, a second embodiment of an authentication system according to the present invention will be described with reference to the drawings. Note that description of the same configuration and operation as in the first embodiment is omitted.

9 to 11 show a configuration when the authentication device 200 includes an authentication device storage unit 240 having an authentication threshold value storage unit 241. FIG.
In this case, the IC card 100 includes a user ID storage unit 113 that stores in advance a user ID assigned to the user 400 as a unique value. The authentication threshold value storage unit 241 included in the authentication device 200 stores an authentication threshold value in advance in association with the user ID.
The authentication device 200 acquires a user ID from the IC card 100 together with the authentication reference information (step S201).
The authentication device 200 selects an authentication threshold corresponding to the acquired user ID as an authentication threshold used for authenticating the user 400 (step S202).

  As described above, the IC card (portable medium) 100 in the authentication system according to the present embodiment has a user ID storage unit (users) in which user identification information determined for each user 400 is stored in advance as information for identifying the user 400. (Identification information storage unit) 113, the authentication apparatus 200 includes an authentication threshold value storage unit 241 in which an authentication threshold value is stored in advance in association with user identification information, and an authentication determination unit (authentication unit) 220 includes The user identification information stored in the user identification information storage unit is acquired, the authentication threshold value associated with the acquired user identification information is read from the authentication threshold value storage unit 241, and the read authentication is performed. Based on the threshold value, it is characterized in that it is authenticated whether or not the user 400 is a valid user.

  By doing in this way, since the authentication system of this embodiment can change an authentication threshold value without using the IC card 100, it is not necessary to collect and redistribute the IC card 100. The authentication threshold, that is, the security level can be changed.

The authentication threshold value can be determined based on the frequency distribution of coincidence.
Hereinafter, the configuration and operation for updating the authentication threshold will be described with reference to FIGS. 12 and 13.
FIG. 12 shows a procedure for updating the authentication threshold value between the registration apparatus 500 and the IC card 100.
FIG. 13 shows a configuration of information stored in the user information storage unit 110 included in the IC card 100.
The IC card 100 includes a coincidence frequency distribution storage unit 114 that stores the calculated coincidence when the coincidence is calculated by the authentication operation.
The registration device 500 obtains the coincidence frequency distribution stored in advance in the coincidence frequency distribution storage unit 114 from the IC card 100, and calculates an authentication threshold based on the obtained coincidence frequency distribution.

  For example, when the frequency distribution of coincidence is a so-called asymmetric type, the authentication threshold value is calculated by the following (Equation 1).

  Authentication threshold = standard threshold + average coincidence value−100 (Equation 1)

  Further, for example, when the frequency distribution of coincidence is a so-called symmetric type, the authentication threshold value is calculated by the following (Equation 2).

  Authentication threshold = standard threshold + matching average value−matching standard deviation × constant (Expression 2)

  For example, when the frequency distribution of coincidence is a so-called L shape, the authentication threshold value is calculated by the following (Equation 3).

  Authentication threshold = standard threshold + corrected average value−100 (Equation 3)

  Here, the asymmetric type means that the power distribution is asymmetric with the average coincidence value as the axis of symmetry. The symmetric type means that the power distribution is asymmetric with the average coincidence value as the axis of symmetry. L-shaped means that many frequencies are distributed in a class smaller than the average value of coincidence.

  Next, the registration apparatus 500 stores the calculated authentication threshold value in the authentication threshold value storage unit 112 included in the IC card 100.

  As described above, the authentication threshold value in the authentication system of the present embodiment is a frequency distribution of the degree of coincidence between the authentication information and the authentication reference information, and corresponds to the number of times the authentication determination unit (authentication unit) 220 performs authentication. It is predetermined based on a frequency distribution of the degree of coincidence obtained by the class and the frequency according to the degree of coincidence between the authentication information and the authentication reference information.

  As described above, the authentication system of the present embodiment can determine the authentication threshold value based on the frequency distribution of the degree of coincidence, and the frequency distribution may show a certain tendency by repeating authentication. The effect that the person acceptance rate can be improved for the user 400 whose authentication has been easily rejected as time passes, or the security level can be further improved for the user 400 whose authentication is easy to be accepted. Play.

  As shown in FIGS. 14 and 15, the coincidence degree frequency distribution may be stored in the coincidence degree frequency distribution storage unit 243 by the authentication device storage unit 240 including the coincidence degree frequency distribution storage unit 243. . In this case, since it is not necessary to store the coincidence frequency distribution in the IC card 100, the IC card 100 can be configured with a small memory capacity.

[Third embodiment]
In the first embodiment, the authentication system including the IC card 100 and the authentication device 200 has been described. However, the authentication server 700 connected via the network has all or part of the functions of the authentication device 200. It may be allowed. Hereinafter, a third embodiment of an authentication system according to the present invention will be described with reference to the drawings. Note that description of the same configuration and operation as in the first embodiment is omitted.

16 to 18 show the configuration and operation of the authentication system in the present embodiment. The authentication system of this embodiment includes an IC card 100, an authentication device 200, and an authentication server 700 connected to the authentication device 200 via a network. The authentication device 200 is provided in the gate 300.
The IC card 100 includes an authentication standard information storage unit 111 in which authentication standard information is stored in advance, and a user ID storage unit 113 in which a user ID assigned as a unique value to the user 400 is stored in advance.
The authentication server 700 includes an authentication server storage unit 710. The authentication server storage unit 710 includes an authentication threshold storage unit 711 in which an authentication threshold is stored in advance in association with the user ID.

The authentication device 200 acquires a user ID and authentication reference information from the IC card 100 (step S301).
The authentication device 200 transmits the user ID acquired in step S301 to the authentication server device 700 (step S302), and acquires an authentication threshold corresponding to the transmitted user ID from the authentication server storage unit 710 ( step S303 ). .
The authentication device 200 performs the same processing as that in steps S2 to S6 described above (from steps S304 to S308 ).

  As described above, the authentication system of the present embodiment includes the authentication server 700 that is connected to the authentication apparatus 200 and supplies information necessary for authentication to the authentication apparatus 200. The authentication server 700 is associated with the user identification information, and is authenticated. The IC card (portable medium) 100 is pre-stored with user identification information determined for each user as information for identifying the user 400. The authentication threshold value storage unit 711 stores a threshold value in advance. A user ID storage unit (user identification information storage unit) 113, and an authentication determination unit (authentication unit) 220 acquires the user identification information stored in the user ID storage unit 113, and the acquired user identification information and The associated authentication threshold value is read from the authentication threshold value storage unit 711, and the user 400 is authorized based on the read authentication threshold value. And performing authentication of whether or not over THE.

  For example, the authentication system according to the present embodiment includes the authentication device 200 in each of the plurality of gates 300, and when the authentication server 700 is a large-scale authentication system connected to each authentication device 200, There are effects like this.

  That is, since the authentication threshold value is stored in the authentication server 700 in the authentication system of the present embodiment, it is not necessary to store the authentication threshold value in each IC card 100 or each authentication device 200. For this reason, the authentication system of this embodiment does not need to memorize | store an authentication threshold value in each authentication apparatus 200, for example when changing an authentication threshold value, and can save an effort.

  In this embodiment, the authentication apparatus 200 acquires the authentication threshold value from the authentication server 700 at the time of authentication. However, the authentication apparatus 200 acquires the authentication threshold value from the authentication server 700 in advance. Also good. Thereby, since the communication time at the time of authentication can be shortened, the time required for authentication can be shortened, and the convenience of the user 400 can be improved.

  Moreover, although the above-mentioned embodiment demonstrated based on the example which installed the authentication system in the gate 300, this invention is not limited to this. For example, you may install the authentication system of this invention in a door.

  FIG. 19 is a configuration diagram showing a configuration when the authentication system is installed on the door. In the example illustrated, the authentication system includes an IC card 100 and an authentication device 200. The authentication device 200 is installed on the door 600. The operation and configuration of each unit provided in the authentication apparatus 200 are the same as those shown in FIG. The IC card 100 is held by the user 400.

  Thus, the IC card 100 and the authentication device 200 can communicate with each other when the user 400 holds the IC card 100 over the authentication device 200. For example, as shown in the figure, when the authentication system is installed on the door 600, the authentication device 200 reads authentication information stored in the IC card 100 by the authentication device 200 and transmits the read authentication information to the door 600. The door 600 can control the opening and closing of the door 600 based on the authentication information.

  Moreover, the frequency distribution of the coincidence degree described in the first embodiment may be stored in the authentication server 700 in the second embodiment. In this case, for example, in the authentication system constituted by a plurality of authentication devices 200, each authentication device 200 does not need to store the coincidence frequency distribution, and thus can be configured with a small memory capacity.

  In the above-described embodiment, the IC card 100 is a non-contact type IC card, and the IC card communication unit 120 is described as performing non-contact wireless communication with the authentication device 200. The IC card 100 may be a contact IC card, and the IC card communication unit 120 may perform contact communication with the authentication device 200.

  In the above-described embodiment, the IC card 100 is applied as a portable medium for storing user information. However, various media including an IC chip such as an RFID may be applied. Various wireless communications may be applied to the communication between the medium and the authentication device 200.

  The authentication device 200 included in the authentication system in the above-described embodiment, or each unit included in the authentication device 200, and each unit included in the registration device 500 or the registration device 500 (hereinafter simply referred to as each unit) are: Each part may be realized by dedicated hardware, and each part is constituted by a memory and a CPU (central processing unit), and a program for realizing the function of each part is loaded into the memory and executed. The function may be realized by.

  Further, by recording a program for realizing the function of each unit in the above-described embodiment on a computer-readable recording medium, causing the computer system to read and execute the program recorded on this recording medium, each unit Processing may be performed. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above, and various design changes and the like can be made without departing from the scope of the present invention. Is possible.

  DESCRIPTION OF SYMBOLS 100 ... IC card (portable medium), 111 ... Authentication reference | standard information storage part, 112 ... Authentication threshold value memory | storage part, 113 ... User ID (user identification information storage part), 114 ... Concordance frequency distribution storage part, 200 ... Authentication device, 220 ... Authentication determination unit (authentication unit), 230 ... Authentication information generation unit, 241 ... Authentication threshold value storage unit, 400 ... User, 500 ... Registration device, 520 ... Registration control unit, 700 ... Authentication server, 711 ... Authentication threshold storage unit

Claims (6)

Are available to the user, and storage capable portable medium information, based on the information stored in the portable medium, and the authentication device by the user to authenticate whether the user is an authorized user, the An authentication system comprising a registration device that registers information used for the authentication in a portable medium ,
The portable medium is
An authentication threshold information storage unit for storing authentication criterion information as a criterion for authenticating the user, and an authentication threshold value for storing an authentication threshold value determined for each user as a threshold value for determining whether or not authentication is possible A storage unit ,
The authentication device
An authentication information generating unit for acquiring information from the user and generating authentication information;
The degree of coincidence between the authentication information generated by the authentication information generation unit and the authentication standard information stored in the authentication standard information storage unit, and the authentication stored in the authentication threshold value storage unit An authentication unit that authenticates whether or not the user is a valid user based on a threshold ;
The registration device
An authentication standard information generation unit that acquires information from the user and generates the authentication standard information;
The authentication standard generated by the authentication standard information generation unit based on the degree of coincidence between the authentication information generated by the authentication information generation unit and the authentication standard information generated by the authentication standard information generation unit A determination unit that determines whether or not to generate information again;
A threshold value calculation unit for calculating the authentication threshold value corresponding to the degree of coincidence between a predetermined upper limit value and a predetermined lower limit value;
Based on the determination result of the degree of coincidence by the determination unit, the authentication standard information generated by the authentication standard information generation unit and the authentication threshold calculated by the threshold calculation unit are A registration unit for registering on a portable medium;
An authentication system comprising: The portable medium is
As information for identifying a user, a user identification information storage unit in which user identification information determined for each user is stored in advance,
The authentication device
In association with the user identification information, an authentication threshold storage unit in which the authentication threshold is stored in advance is provided,
The authentication unit acquires the user identification information stored in the user identification information storage unit, and displays the authentication threshold associated with the acquired user identification information as the authentication threshold storage unit. The authentication system according to claim 1, wherein authentication is performed to determine whether the user is a valid user based on the read authentication threshold value. An authentication server connected to the authentication device and supplying information required for authentication to the authentication device;
The portable medium is
As information for identifying a user, a user identification information storage unit in which user identification information determined for each user is stored in advance,
The authentication server is
In association with the user identification information, an authentication threshold storage unit in which the authentication threshold is stored in advance is provided,
The authentication unit
The user identification information stored in the user identification information storage unit is acquired, the authentication threshold value associated with the acquired user identification information is read from the authentication threshold value storage unit, and the read The authentication system according to claim 1, wherein authentication is performed based on an authentication threshold value to determine whether or not the user is a valid user. The authentication threshold is:
The degree of coincidence between the authentication information and the authentication standard information, which is predetermined based on the degree of coincidence obtained when the authentication standard information is stored in the authentication standard information storage unit in advance. The authentication system according to any one of claims 1 to 3 . The authentication threshold is:
The average value of the degree of coincidence between the authentication information and the authentication standard information, and when the authentication standard information is stored in the authentication standard information storage unit in advance, the authentication information and the authentication standard information are compared multiple times. The authentication system according to any one of claims 1 to 4 , wherein the authentication system is predetermined based on an average value of the degree of coincidence obtained by the above. The authentication threshold is:
It is a frequency distribution of the degree of coincidence between the authentication information and the authentication standard information, the class according to the number of times the authentication unit performs authentication, and the frequency according to the degree of coincidence between the authentication information and the authentication standard information, The authentication system according to any one of claims 1 to 5 , wherein the authentication system is predetermined based on a frequency distribution of the degree of coincidence obtained by the following.

Images