JP5903257B2 - Authentication system, registration device, and authentication device - Google Patents

Description

The present invention relates to an authentication system, registration device, and authentication device.

  In recent years, an authentication system (security system) using biometric authentication for authenticating a user based on biometric information such as finger vein information has been operated on a large scale (see, for example, Patent Document 1). In such an authentication system, a specific large number of users may use biometric authentication instead of a specific small number, and when the specific large number is targeted, the authentication rate of biometric authentication may decrease. In such a case, for example, a method in which biometric authentication and authentication by a personal identification number are used together or a method of switching from biometric authentication to authentication by a personal identification number by a certain logic has been proposed.

JP 2010-196436 A

However, since the method as described above is applied uniformly to all users, the security level of the entire authentication system changes. For example, when using authentication by a personal identification number, the security level of the entire authentication system may be lowered.
That is, the above-described method has a problem that the authentication rate cannot be increased without changing the security level of the entire authentication system.

  The present invention has been made to solve the above problems, and its purpose is to provide an authentication system, a registration device, an authentication device, and an authentication system that can increase the authentication rate without changing the security level of the entire authentication system. It is to provide a portable medium.

In order to solve the above-described problem, an aspect of the present invention provides an authentication including a portable medium capable of storing information and an authentication device that authenticates a user using information stored in the portable medium. Flag information indicating a method for authenticating the user, which is flag information set for each user when registering authentication standard information serving as a standard for authenticating the user, and the authentication method The authentication standard information used for the authentication is predetermined between the portable medium and the authentication device, and the portable medium is determined corresponding to the flag information and the flag information. The authentication criteria information corresponding to the flag information, an authentication information acquisition unit for acquiring authentication information from the user, the flag information, and the authentication criteria corresponding to the flag information. information and The authentication information acquisition unit acquires the authentication information corresponding to the read authentication standard information read from the portable medium, compares the acquired authentication information with the read authentication standard information, and compares An authentication system comprising: an authentication processing unit configured to authenticate whether or not the user is a valid user based on a result.

  According to another aspect of the present invention, in the above authentication system, the portable medium has identification information for identifying a user stored in advance in the storage unit, and the authentication processing unit stores the identification information in the authentication system. It is determined whether or not the identification information read from the portable medium matches the identification information corresponding to the user registered in advance, and the user is authorized based on the determination result and the comparison result. It is characterized in that authentication as to whether or not the user is a valid user is performed.

In one embodiment of the present invention, in the above authentication system, the authentication reference information includes at least biometric reference information that is biometric information indicating a physical feature of a user, and the flag information includes the authentication reference information. The authentication rate of the biometric reference information calculated at the time of registration is set based on an authentication rate indicating a probability of how many times authentication can be correctly performed among a plurality of authentications. .

  According to another aspect of the present invention, in the authentication system, the biometric reference information includes basic biometric reference information for which the authentication rate is calculated and additional biometric reference information different from the basic biometric reference information. The portable medium has a first value corresponding to a case where the authentication rate of the basic biometric reference information is greater than or equal to a predetermined first threshold and is greater than or equal to the first threshold. When the flag information and the basic biometric reference information as the authentication reference information are stored in the storage unit, and the authentication rate of the basic biometric reference information is less than the first threshold, the first threshold value The flag information indicating a second value corresponding to the case where the number is less than, and the basic biometric reference information and the additional biometric reference information as the authentication reference information are stored in the storage unit, and the authentication processing unit The basic living body When it is determined that the comparison result between the quasi-information and the authentication information corresponding to the basic biometric reference information acquired by the authentication information acquisition unit is not a valid user, and the flag information is the second value If the user is valid, the user is valid based on the comparison result between the authentication information corresponding to the additional biometric reference information acquired by the authentication information acquisition unit and the additional biometric reference information, and the determination result. It is characterized by authenticating whether or not the user is a user.

Further, according to one aspect of the present invention, in the above authentication system, the information stored in the portable medium when the flag information is the second value is divided and stored in the portable medium in advance. A basic portable medium and an additional portable medium, wherein the basic portable medium includes at least the flag information and the basic information stored in a storage unit of the portable medium. Biometric reference information and the identification information are stored, and the additional portable medium includes at least one of link information associated with the identification information and information stored in a storage unit of the portable medium. The additional biometric reference information is stored.

  Further, according to one aspect of the present invention, in the authentication system, the portable medium has an authentication rate of the basic biometric reference information that is equal to or lower than a predetermined second threshold value that is lower than the first threshold value. In addition, the flag information indicating a third value corresponding to the case where the value is equal to or smaller than the second threshold value, and authentication standard information of a type different from the basic biometric reference information are stored in the storage unit, The authentication processing unit, when the flag information is the third value, the authentication information corresponding to the different types of authentication standard information and the different types of authentication standard information acquired by the authentication information acquisition unit. On the basis of the comparison result and the determination result, authentication is performed as to whether or not the user is a valid user.

  One embodiment of the present invention is characterized in that, in the authentication system, the different types of authentication reference information is the biometric reference information or a password.

  One embodiment of the present invention is characterized in that, in the above authentication system, the flag information is set based on a security rank preset for a user.

One embodiment of the present invention is a registration device for registering authentication standard information serving as a reference for authenticating a user in a portable medium capable of storing information used in an authentication system for authenticating a user. A registration information acquisition unit that acquires the authentication standard information from a registered user, and flag information that is set for each user when registering authentication standard information that is a standard for authenticating the user, and authenticates the user Flag information indicating a method and the authentication standard information used for the authentication method are determined in advance, and the registration information acquisition unit acquires the authentication standard information determined corresponding to the flag information. A registration processing unit that stores the acquired authentication reference information and the flag information in a storage unit of the portable medium.

  In one embodiment of the present invention, in the registration apparatus, the authentication reference information includes at least biometric reference information that is biometric information indicating physical characteristics of the registered user, and the registration processing unit includes: Based on the biometric reference information acquired by the registered information acquisition unit, the authentication rate of the biometric reference information is calculated, and the calculated authentication rate of the biometric reference information or the security set in advance for the registered user The flag information is set based on a rank.

One embodiment of the present invention is an authentication device that performs authentication of a user using information stored in a portable medium capable of storing information, and an authentication information acquisition unit that acquires authentication information from the user; Flag information set for each user when registering authentication standard information that serves as a reference for authenticating the user, and is used for flag information indicating a method for authenticating the user, and for the authentication method The authentication standard information is determined in advance with the portable medium, the authentication standard information defined in correspondence with the flag information is read out from the portable medium, and the read out authentication standard information The authentication information acquisition unit acquires the authentication information corresponding to the authentication information, compares the acquired authentication information with the read authentication standard information, and based on the comparison result, the user is authorized. An authentication processing unit for performing the whether The authentication is an authentication apparatus, characterized in that it comprises a.

  According to the present invention, the authentication rate can be increased without changing the security level of the entire authentication system.

It is the block diagram which showed the structure at the time of installing the authentication system by 1st Embodiment in the gate. It is a schematic block diagram which shows the structure of the authentication system in 1st Embodiment. It is a figure which shows the authentication method corresponding to the flag information in 1st Embodiment. It is a flowchart which shows the process of the authentication apparatus in 1st Embodiment. It is a schematic block diagram which shows the structure of the registration apparatus in 1st Embodiment. It is a flowchart which shows the process of the registration apparatus in 1st Embodiment. It is a flowchart which shows an example of the calculation process of the authentication rate in embodiment of this invention. It is a schematic block diagram which shows the structure of the authentication system in 2nd Embodiment. It is a flowchart which shows the process of the authentication apparatus in 2nd Embodiment. It is a schematic block diagram which shows the structure of the registration apparatus in 2nd Embodiment. It is a flowchart which shows the process of the registration apparatus in 2nd Embodiment. It is the block diagram which showed the structure at the time of installing the authentication system by embodiment of this invention in a door.

  Hereinafter, an authentication system and a registration device according to an embodiment of the present invention will be described with reference to the drawings.

[First Embodiment]
<Authentication System in First Embodiment>
First, the authentication system in the first embodiment will be described.
FIG. 1 is a configuration diagram showing a configuration when the authentication system 1 according to the present embodiment is installed in a gate.
FIG. 2 is a schematic block diagram showing the configuration of the authentication system 1 in the present embodiment.
1 and 2, the authentication system 1 includes an IC card 100 and an authentication device 200. That is, the authentication system 1 includes, for example, an IC card 100 that can store information, such as an entrance / exit system, and an authentication device 200 that performs user authentication (verification) using the information stored in the IC card 100. I have. The authentication device 200 is installed at the gate 300. The IC card 100 is held by the user 400.

  Here, the user 400 is an authorized user of the authentication system 1 and is registered with the registered user registered in the authentication system 1 who is the owner of the IC card 100, and the registered user by picking up the IC card 100. It includes an unauthorized user when a different person uses the authentication system 1 using the IC card 100. Hereinafter, a user including a registered user and an unauthorized user is referred to as “user 400”, and in the case of indicating a registered user, it is simply expressed as “user” or “registered user”.

  The IC card 100 (portable medium) is, for example, a non-contact type IC card, and is a portable medium in which an IC chip having functions for storing and calculating information is incorporated. Here, the portable medium is a portable information processing medium. The IC card 100 includes a user information storage unit 110 and an IC card communication unit 120.

  The user information storage unit 110 (storage unit) stores information used when the user 400 is authenticated. The user information storage unit 110 stores, for example, flag information, authentication standard information, identification information, and the like described later in advance. The user information storage unit 110 includes an identification information storage unit 111, a flag information storage unit 112, and an authentication reference information storage unit 113.

The identification information storage unit 111 stores in advance identification information for identifying a user (registered user) such as ID (Identify) information. Here, the identification information may be identification information assigned to the IC card 100 in association with the user 400.
The flag information storage unit 112 stores flag information indicating a method for authenticating the user 400 in advance. Here, the flag information is, for example, information having a plurality of bits (a plurality of 1-bit flags), and is predetermined (stored) when registering the authentication standard information. In the present embodiment, flags 1 to 5 are taken as the values of the flag information, and five methods for authenticating the user 400 corresponding to the flag information are determined in advance. That is, flag information and authentication standard information used for the authentication method are determined in advance between the IC card 100 and the authentication device 200. Details of the authentication method corresponding to the flag information will be described later.

  The authentication standard information storage unit 113 stores authentication standard information serving as a standard for authenticating the user 400 in advance. Here, the authentication reference information is, for example, biometric reference information or a personal identification number (password) that is biometric information indicating the physical characteristics of the user. This authentication reference information is used when the user 400 is authenticated. Used for. The authentication standard information storage unit 113 stores in advance authentication standard information set corresponding to the flag information. The authentication standard information is registered by a registration device 500 (FIG. 4), which will be described later, and stored in advance in the authentication standard information storage unit 113.

  The IC card communication unit 120 performs information communication with the authentication device 200. In the present embodiment, the IC card communication unit 120 performs non-contact wireless communication with the authentication device 200.

  The gate 300 is a security gate provided at the entrance of a security area where user traffic is managed by the IC card 100 and the authentication device 200. The gate 300 has a flap that opens and closes depending on the result of the authentication process performed by the authentication device 200. When the user 400 is authenticated as a legitimate user, the gate 300 is opened to allow the user 400 to pass through. When it is authenticated that the user is not a valid user, the flap is closed and the user is not allowed to pass.

  The authentication device 200 performs an authentication process for the user 400 based on the information read from the IC card 100. The authentication device 200 includes an authentication device communication unit 210, an authentication processing unit 220, an authentication information acquisition unit 230, a display unit 240, and an identification information storage unit 250. Note that the authentication processing unit 220 of the authentication device 200 is connected to the server device 700 via the network 600.

The authentication device communication unit 210 performs wireless communication with the IC card communication unit 120 of the IC card 100.
The authentication information acquisition unit 230 acquires authentication information from the user 400. In the present embodiment, the authentication information acquisition unit 230 can acquire a plurality of different types of authentication information, and includes a finger vein information acquisition unit 231, a face information acquisition unit 232, and a personal identification number acquisition unit 233. .

The finger vein information acquisition unit 231 includes a finger vein detection sensor that reads the finger vein information of the user 400 when the user 400 brings the finger close to the finger vein information, and authentication that digitizes the finger vein information read by the finger vein detection sensor Get information.
The face information acquisition unit 232 reads the face information of the user 400 when the user 400 brings the face close thereto, and acquires authentication information obtained by converting the read face information into digital information.
The personal identification number acquisition unit 233 is an input device such as a key switch, for example. The personal identification number is input by the user 400 and acquires the input personal identification number as authentication information.

  In the identification information storage unit 250, the IC card 100 to which the identification information is assigned in association with the identification information assigned to each of the plurality of IC cards 100 (or a plurality of users) is invalid (or valid). The identification information indicating whether or not is stored in advance. That is, the identification information storage unit 250 stores information for determining whether or not the identification information matches valid identification information corresponding to a user registered in advance.

For example, when the administrator of the authentication system receives a notification that the IC card 100 has been lost from a user who has distributed the IC card 100, the authentication system administrator authenticates the identification information assigned to the lost IC card 100 in association with the invalid information. The information is stored in the identification information storage unit 250 of the device 200. At this time, for example, the identification information is supplied from the server device 700 via the network 600 and is stored in the identification information storage unit 250 by the authentication processing unit 220.
Further, the identification information stored in the identification information storage unit 250 is read by the authentication processing unit 220 described later, and the user 400 holding the IC card 100 having the invalid identification information is authenticated as not a valid user. To be controlled.

Here, the identification information storage unit 250 may store information indicating validity or invalidity in association with all issued authentication information, or may store only invalid identification information. If identification information is stored in the storage unit 250, it may be configured to indicate that it is invalid.
The display unit 240 displays the message output from the authentication processing unit 220. Here, the message displayed by the display unit 240 is, for example, a message that prompts the user 400 to input authentication information to the authentication information acquisition unit 230.

  The authentication processing unit 220 includes authentication standard information determined in correspondence with the flag information stored in the flag information storage unit 112 of the IC card 100 and identification information stored in the identification information storage unit 111. Data is read from the IC card 100 via the authentication device communication unit 210. The authentication processing unit 220 causes the authentication information acquisition unit 230 to acquire authentication information corresponding to the read authentication reference information. Then, the authentication processing unit 220 compares the authentication information acquired by the authentication information acquisition unit 230 with the read authentication reference information. Further, the authentication processing unit 220 determines whether or not the read identification information matches the identification information corresponding to the user registered in advance. The authentication processing unit 220 authenticates whether or not the user 400 is a valid user based on the comparison result and the determination result.

Further, the authentication processing unit 220 causes the gate 300 to open and close the flap based on the authentication result indicating whether or not the user is a valid user. That is, when the authentication processing unit 220 authenticates that the user 400 is a legitimate user, the user opens the flap of the gate 300 to allow the user 400 to pass. The flap is closed to prevent the user 400 from passing.
In addition, the authentication processing unit 220 causes the display unit 240 to display a message that prompts the user 400 to input authentication information to the authentication information acquisition unit 230.

Next, flag information in this embodiment and an authentication method corresponding to the flag information will be described.
FIG. 3 is a diagram illustrating an example of flag information and an authentication method corresponding to the flag information in the present embodiment. In this figure, each digit in the table indicates (a) flag information, (b) flag information setting conditions, and (c) an authentication method corresponding to the flag information.

  As shown in this figure, in the present embodiment, (a) flag information is prepared with five types of values of flag 1 to flag 5, and (c) an authentication method corresponding to the value of each flag information. The user 400 is authenticated. In this embodiment, ID authentication that is an authentication method using ID information, finger vein authentication that is an authentication method using finger vein information, face authentication that is an authentication method using face information, and a password that is an authentication method using a password. A combination of four types of authentication methods is used as the authentication method. That is, in the present embodiment, the authentication processing unit 220 authenticates the user 400 using two types of different biological information (and biological reference information) of finger vein information and face information as biological information (and biological reference information). I do.

  When the flag information is flag 1 (first value), finger vein reference information is stored as authentication reference information in the authentication reference information storage unit 113 of the IC card 100. In this case, the authentication processing unit 220 authenticates the user 400 by an authentication method (first authentication method) that combines ID authentication and finger vein authentication.

When the flag information is flag 2 (second value), the finger vein reference information (basic finger vein reference information) and the additional finger vein reference information are authenticated in the authentication reference information storage unit 113 of the IC card 100. Stored as reference information. That is, the finger vein reference information (biological reference information) in this case includes finger vein reference information (basic biometric reference information) for calculating an authentication rate (matching rate) used when setting flag information, Additional finger vein reference information (additional biometric reference information) different from the finger vein reference information is included. For example, the finger vein reference information is “index finger” finger vein information, and the additional finger vein reference information is “thumb” finger vein information. In this case, the authentication processing unit 220 authenticates the user 400 by an authentication method (second authentication method) that combines ID authentication and finger vein authentication, or a combination of ID authentication and additional finger vein authentication. .
In the present embodiment, two pieces of authentication reference information, that is, finger vein reference information and additional finger vein reference information are stored in the authentication reference information storage unit 113 of the same IC card 100.

  When the flag information is flag 3, the authentication standard information storage unit 113 of the IC card 100 stores the password as authentication standard information. In this case, the authentication processing unit 220 authenticates the user 400 by an authentication method (third authentication method) that combines ID authentication and password authentication.

  When the flag information is flag 4, the face information is stored as authentication reference information in the authentication reference information storage unit 113 of the IC card 100. In this case, the authentication processing unit 220 authenticates the user 400 by an authentication method (fourth authentication method) that combines ID authentication and face authentication.

That is, when the flag information is the flag 3 and the flag 4 (third value), the authentication standard information storage unit 113 of the IC card 100 stores authentication information whose face information or password is different from the finger vein standard authentication. Stored as reference information.
When the flag information is flag 5, authentication standard information is not stored in the authentication standard information storage unit 113 of the IC card 100. In this case, the authentication processing unit 220 authenticates the user 400 using an authentication method based on ID authentication (fifth authentication method).

Next, operation | movement of the authentication system 1 in this embodiment is demonstrated.
FIG. 4 is a flowchart showing the approval process of the authentication device 200 in the present embodiment.
In this figure, first, the authentication device 200 reads flag information from the IC card 100 (step S101). That is, the authentication processing unit 220 of the authentication device 200 reads flag information from the flag information storage unit 112 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210.

Next, the authentication processing unit 220 confirms the flag information read from the IC card 100, and advances the processing to authentication processing corresponding to the flag information (step S102).
When the flag information is flag 1 (first value), the authentication processing unit 220 proceeds with the process to step S103 and reads the identification information from the IC card 100. That is, in step S <b> 103, the authentication processing unit 220 reads identification information (ID information) from the identification information storage unit 111 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210. Note that steps S103 to S107 indicate the authentication process by the first authentication method described above.

  Next, the authentication processing unit 220 confirms the identification information (step S104). That is, the authentication processing unit 220 reads identification information indicating whether the IC card 100 is invalid (or valid) in association with the read identification information from the identification information storage unit 250, and the IC card 100 is valid. Authentication of whether or not there is (whether or not the user 400 is a valid user) is performed. For example, the authentication processing unit 220 determines whether or not the read identification information matches the identification information corresponding to the user registered in advance. If the IC card 100 is valid, the authentication processing unit 220 advances the processing to step S105. In addition, when the IC card 100 is invalid, the authentication processing unit 220 ends the authentication processing by the first authentication method.

  In step S <b> 105, the authentication processing unit 220 reads finger vein reference information from the IC card 100. That is, the authentication processing unit 220 reads the finger vein reference information from the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210.

  Next, the authentication processing unit 220 performs finger vein authentication, and authenticates whether or not the user 400 is a valid user (step S106). That is, the authentication processing unit 220 causes the display unit 240 to output a message that prompts the user 400 to acquire finger vein information from the finger vein information acquisition unit 231 of the authentication information acquisition unit 230. Here, the finger vein information is authentication information corresponding to the finger vein reference information read from the IC card 100. Then, the authentication processing unit 220 compares the finger vein reference information read from the IC card 100 with the finger vein information acquired by the finger vein information acquisition unit 231, and based on the comparison result, the user 400 is an authorized user. It authenticates whether or not.

  Here, the authentication processing unit 220 authenticates whether or not the user 400 is a valid user, for example, based on whether or not the degree of coincidence as a comparison result is greater than or equal to a predetermined authentication threshold. When the authentication processing unit 220 authenticates that the user 400 is a legitimate user, the process proceeds to step S107, and when the user 400 authenticates that the user 400 is not a legitimate user, the authentication processing unit 220 performs the authentication process by the first authentication method. Terminate.

  In step S107, the authentication processing unit 220 opens the flap of the gate 300 to allow the user 400 to pass, and ends the authentication processing by the first authentication method.

  As described above, the authentication processing unit 220 authenticates the user 400 by the first authentication method when the flag information is the flag 1 (first value). In this first authentication method, as shown in steps S103 to S106, the authentication processing unit 220 first compares the finger vein reference information with the finger vein information acquired by the finger vein information acquisition unit 231. Do. The authentication processing unit 220 authenticates whether or not the user 400 is a valid user based on the comparison result and the determination result of the identification information (ID information).

  If the flag information is flag 2 (second value) in step S102, the authentication processing unit 220 advances the process to step S108, and reads the identification information from the IC card 100. That is, in step S <b> 108, the authentication processing unit 220 reads identification information (ID information) from the identification information storage unit 111 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210. Note that steps S108 to S113 show the authentication process by the second authentication method described above.

  Next, the authentication process part 220 confirms identification information (step S109). That is, the authentication processing unit 220 reads identification information indicating whether the IC card 100 is invalid (or valid) in association with the read identification information from the identification information storage unit 250, and the IC card 100 is valid. Authentication of whether or not there is (whether or not the user 400 is a valid user) is performed. For example, the authentication processing unit 220 determines whether or not the read identification information matches the identification information corresponding to the user registered in advance. If the IC card 100 is valid, the authentication processing unit 220 proceeds with the process to step S110. In addition, when the IC card 100 is invalid, the authentication processing unit 220 ends the authentication processing by the second authentication method.

  In step S110, the authentication processing unit 220 reads finger vein reference information from the IC card 100. That is, the authentication processing unit 220 reads finger vein reference information (here, basic finger vein reference information) from the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210. .

  Next, the authentication processing unit 220 performs finger vein authentication and authenticates whether or not the user 400 is a valid user (step S111). That is, the authentication processing unit 220 causes the display unit 240 to output a message that prompts the user 400 to acquire finger vein information from the finger vein information acquisition unit 231 of the authentication information acquisition unit 230. Here, the finger vein information is authentication information corresponding to the finger vein reference information read from the IC card 100, for example, finger vein information of “index finger”. Then, the authentication processing unit 220 compares the finger vein reference information read from the IC card 100 with the finger vein information acquired by the finger vein information acquisition unit 231, and based on the comparison result, the user 400 is an authorized user. It authenticates whether or not.

  Here, the authentication processing unit 220 authenticates whether or not the user 400 is a valid user, for example, based on whether or not the degree of coincidence as a comparison result is greater than or equal to a predetermined authentication threshold. The authentication processing unit 220 proceeds with the process to step S107 when the user 400 is authenticated as a valid user, and proceeds with the process to step S112 when the user 400 is authenticated as not a valid user.

  Next, in step S <b> 112, the authentication processing unit 220 reads additional finger vein reference information from the IC card 100. That is, the authentication processing unit 220 reads additional finger vein reference information from the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210.

  Next, the authentication processing unit 220 performs additional finger vein authentication to authenticate whether or not the user 400 is a valid user (step S113). That is, the authentication processing unit 220 causes the display unit 240 to output a message that prompts the user 400 to acquire additional finger vein information from the finger vein information acquisition unit 231 of the authentication information acquisition unit 230. Here, the additional finger vein information is authentication information corresponding to the additional finger vein reference information read from the IC card 100, for example, finger vein information of “thumb”. Then, the authentication processing unit 220 compares the additional finger vein reference information read from the IC card 100 with the additional finger vein information acquired by the finger vein information acquisition unit 231, and based on the comparison result, the user 400 Authenticate whether the user is valid or not.

  Here, the authentication processing unit 220 authenticates whether or not the user 400 is a valid user, for example, based on whether or not the degree of coincidence as a comparison result is greater than or equal to a predetermined authentication threshold. When the authentication processing unit 220 authenticates that the user 400 is a legitimate user, the process proceeds to step S107. When the user 400 authenticates that the user 400 is not a legitimate user, the authentication processing unit 220 performs the authentication process according to the second authentication method. Terminate.

  As described above, the authentication processing unit 220 authenticates the user 400 by the second authentication method when the flag information is the flag 2 (second value). In this second authentication method, as shown in steps S108 to S113, first, the authentication processing unit 220 causes the basic finger vein reference information (basic biometric reference information) and the finger vein information acquisition unit 231 to acquire. Compare with finger vein information. The authentication processing unit 220 authenticates whether or not the user 400 is a valid user based on the comparison result and the determination result of the identification information (ID information). Further, when it is determined that the comparison result is not a valid user, the authentication processing unit 220 further compares the additional finger vein reference information with the additional finger vein information acquired by the finger vein information acquisition unit 231. Based on the result and the determination result of the identification information (ID information), it is authenticated whether or not the user 400 is a valid user.

  If the flag information is flag 3 in step S102, the authentication processing unit 220 proceeds with the process to step S114 and reads the identification information from the IC card 100. That is, in step S114, the authentication processing unit 220 reads identification information (ID information) from the identification information storage unit 111 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210. Note that steps S114 to S117 show the authentication process by the third authentication method described above.

  Next, the authentication processing unit 220 confirms the identification information (step S115). That is, the authentication processing unit 220 reads identification information indicating whether the IC card 100 is invalid (or valid) in association with the read identification information from the identification information storage unit 250, and the IC card 100 is valid. Authentication of whether or not there is (whether or not the user 400 is a valid user) is performed. For example, the authentication processing unit 220 determines whether or not the read identification information matches the identification information corresponding to the user registered in advance. If the IC card 100 is valid, the authentication processing unit 220 advances the processing to step S116. In addition, when the IC card 100 is invalid, the authentication processing unit 220 ends the authentication processing by the third authentication method.

  In step S <b> 116, the authentication processing unit 220 reads a password from the IC card 100 as authentication reference information. That is, the authentication processing unit 220 reads the password from the authentication standard information storage unit 113 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210.

  Next, the authentication processing unit 220 performs password authentication to authenticate whether or not the user 400 is a valid user (step S117). That is, the authentication processing unit 220 causes the display unit 240 to output a message that prompts the user 400 to acquire the personal identification number by the personal identification number acquisition unit 233 of the authentication information acquisition unit 230. Then, the authentication processing unit 220 compares the personal identification number read from the IC card 100 with the personal identification number acquired by the personal identification number acquisition unit 233, and based on the comparison result, whether or not the user 400 is a valid user. Authenticate. The authentication processing unit 220 authenticates whether or not the user 400 is a legitimate user based on whether or not the comparison results of the passwords are the same. If the authentication processing unit 220 authenticates that the user 400 is a valid user, the process proceeds to step S107. If the authentication processing unit 220 authenticates that the user 400 is not a valid user, the authentication processing unit 220 performs the authentication process according to the third authentication method. Terminate.

  As described above, when the flag information is flag 3, the authentication processing unit 220 authenticates the user 400 by the third authentication method. In this third authentication method, as shown in step S114 to step S117, the authentication processing unit 220 acquires the personal identification number, which is a type of authentication standard information different from the finger vein standard information, and the personal identification number acquisition unit 233. Based on the comparison result with the identification number and the determination result of the identification information (ID information), it is authenticated whether or not the user 400 is a valid user.

  If the flag information is flag 4 in step S102, the authentication processing unit 220 advances the process to step S118 and reads the identification information from the IC card 100. That is, in step S <b> 118, the authentication processing unit 220 reads identification information (ID information) from the identification information storage unit 111 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210. Note that steps S118 to S121 show the authentication process by the fourth authentication method described above.

  Next, the authentication processing unit 220 confirms the identification information (step S118). That is, the authentication processing unit 220 reads identification information indicating whether the IC card 100 is invalid (or valid) in association with the read identification information from the identification information storage unit 250, and the IC card 100 is valid. Authentication of whether or not there is (whether or not the user 400 is a valid user) is performed. For example, the authentication processing unit 220 determines whether or not the read identification information matches the identification information corresponding to the user registered in advance. If the IC card 100 is valid, the authentication processing unit 220 proceeds with the process to step S119. In addition, when the IC card 100 is invalid, the authentication processing unit 220 ends the authentication processing by the fourth authentication method.

  In step S119, the authentication processing unit 220 reads the face reference information from the IC card 100. That is, the authentication processing unit 220 reads face reference information from the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210.

  Next, the authentication processing unit 220 performs face authentication and authenticates whether or not the user 400 is a valid user (step S120). That is, the authentication processing unit 220 causes the display unit 240 to output a message that prompts the user 400 to acquire the face information from the face information acquisition unit 232 of the authentication information acquisition unit 230. Here, the face information is authentication information corresponding to the face reference information read from the IC card 100. Then, the authentication processing unit 220 compares the face reference information read from the IC card 100 with the face information acquired by the face information acquisition unit 232, and whether the user 400 is a valid user based on the comparison result. Authenticate whether or not.

  Here, the authentication processing unit 220 authenticates whether or not the user 400 is a valid user, for example, based on whether or not the degree of coincidence as a comparison result is greater than or equal to a predetermined authentication threshold. If the authentication processing unit 220 authenticates that the user 400 is a valid user, the process proceeds to step S107. If the authentication processing unit 220 authenticates that the user 400 is not a valid user, the authentication processing unit 220 performs the authentication process according to the fourth authentication method. Terminate.

  Thus, when the flag information is flag 4, the authentication processing unit 220 authenticates the user 400 by the fourth authentication method. In the fourth authentication method, as shown in steps S118 to S121, the authentication processing unit 220 stores the face reference information, which is a different type of authentication reference information from the finger vein reference information, and the face information acquisition unit 232. Based on the comparison result with the acquired face information and the determination result of the identification information (ID information), whether or not the user 400 is a valid user is authenticated. In the present embodiment, the flag 3 and the flag 4 correspond to the third value in the flag information.

  If the flag information is flag 5 in step S102, the authentication processing unit 220 advances the process to step S122 and reads the identification information from the IC card 100. That is, in step S122, the authentication processing unit 220 reads identification information (ID information) from the identification information storage unit 111 of the IC card 100 via the card communication unit 120 and the authentication device communication unit 210. Steps S122 to S123 show the authentication process by the fifth authentication method described above.

Next, the authentication process part 220 confirms identification information (step S123). That is, the authentication processing unit 220 reads identification information indicating whether the IC card 100 is invalid (or valid) in association with the read identification information from the identification information storage unit 250, and the IC card 100 is valid. Authentication of whether or not there is (whether or not the user 400 is a valid user) is performed. For example, the authentication processing unit 220 determines whether or not the read identification information matches the identification information corresponding to the user registered in advance. If the authentication processing unit 220 authenticates that the user 400 is a valid user, the process proceeds to step S107. If the authentication processing unit 220 authenticates that the user 400 is not a valid user, the authentication processing unit 220 performs authentication processing according to the fifth authentication method. Terminate.
In this case, since the authentication processing unit 220 does not perform the comparison based on the authentication standard information, the comparison result based on the authentication standard information and the identification information (ID information) are assumed to be a result of matching the comparison results based on the authentication standard information. ), Whether or not the user 400 is a valid user is authenticated.

<Registration Device in First Embodiment>
Next, a registration device that registers authentication standard information in the IC card 100 used in the authentication system 1 described above will be described.
FIG. 5 is a schematic block diagram showing the configuration of the registration apparatus 500 in this embodiment.
In FIG. 5, the same components as those in FIG. 2 are denoted by the same reference numerals, and the description thereof is omitted.

  In this figure, a registration device 500 registers authentication standard information as a standard for authenticating the user 400 in the IC card 100 capable of storing information used in the authentication system 1 for authenticating the user 400. The registration device 500 includes a registration device communication unit 510, a registration processing unit 520, a registration information acquisition unit 530, and a display unit 540. The registration processing unit 520 of the registration apparatus 500 is connected to the server apparatus 700 via the network 600.

The registration device communication unit 510 performs wireless communication with the IC card communication unit 120 of the IC card 100.
The registration information acquisition unit 530 acquires authentication reference information registered in the IC card 100 and comparison authentication information from the registered user. In the present embodiment, the registration information acquisition unit 530 is capable of acquiring a plurality of different types of authentication reference information and authentication information, and includes a finger vein information acquisition unit 531, a face information acquisition unit 532, and a password number acquisition unit 533. It has.

The finger vein information acquisition unit 531 includes a finger vein detection sensor that reads a registered user's finger vein information when the registered user brings the finger close to the finger vein information, and authentication that digitizes the finger vein information read by the finger vein detection sensor Obtain reference information and authentication information.
The face information acquisition unit 532 reads the registered user's face information when the registered user brings the face close thereto, and acquires authentication reference information and authentication information obtained by converting the read face information into digital information.
The personal identification number acquisition unit 533 is an input device such as a key switch, for example. The personal identification number is input by a registered user, and the input personal identification number is acquired as authentication reference information and authentication information.

  The display unit 540 displays the message output from the registration processing unit 520. Here, the message displayed on the display unit 240 is, for example, a message that prompts the registered information acquisition unit 230 to input authentication standard information to the registered user.

The registration processing unit 520 causes the registration information acquisition unit 530 to acquire authentication standard information corresponding to flag information indicating a method for authenticating the user 400, and identifies the acquired authentication standard information, flag information, and registered user Information (ID information) is stored in the user information storage unit 110 of the IC card 100.
The authentication reference information includes at least biometric reference information that is biometric information indicating the physical characteristics of the registered user. The registration processing unit 520 calculates the authentication rate of the biometric reference information based on the biometric reference information acquired by the registration information acquisition unit 530, and is set in advance for the calculated authentication rate of the biometric reference information or the registered user. The flag information is set based on the security rank. In the present embodiment, as an example of the authentication rate of the biometric reference information, a mode using the authentication rate of the basic finger vein reference information described above will be described. Calculation of the authentication rate of the biometric reference information will be described later. The security rank set in advance for the registered user includes, for example, attributes of users such as general employees and VIP (Very Important Person) employees (executive officers).
In addition, the registration processing unit 520 causes the display unit 540 to display a message that prompts the registered user to input authentication standard information to the registration information acquisition unit 230.

Next, the operation of the registration apparatus 500 in this embodiment will be described.
Here, an example in which authentication standard information is newly registered in the IC card 100 will be described.

FIG. 6 is a flowchart showing a registration process of the registration apparatus 500 in the present embodiment.
In this figure, first, the registration apparatus 500 writes identification information into the IC card 100 (step S201). That is, the registration processing unit 520 of the registration device 500 acquires identification information (ID information) from the server device 700 via the network 600. The registration processing unit 520 stores the acquired identification information (ID information) in the identification information storage unit 11 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510.

  Next, the registration processing unit 520 determines whether or not the registered user is a VIP employee (executive employee) (step S202). If the registered user is a VIP employee (executive employee), the registration processing unit 520 advances the process to step S203. If the registered user is not a VIP employee (executive employee) (if it is a general employee), the process proceeds to step S204.

  In step S <b> 203, the registration processing unit 520 writes the flag 5 as flag information in the IC card 100. That is, the registration processing unit 520 stores the flag 5 as flag information in the flag information storage unit 112 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. In other words, the flag information is set based on a security rank (for example, VIP employee, general employee, etc.) preset for the registered user. The registration processing unit 520 stores the flag information in the flag information storage unit 112 and then ends the registration process.

  In step S204, the registration processing unit 520 temporarily registers finger vein information. In other words, the registration processing unit 520 causes the display unit 540 to display a message that prompts the registered user to input finger vein reference information in the finger vein information acquisition unit 531 of the registration information acquisition unit 230. Then, the registration processing unit 520 acquires the finger vein information acquired by the finger vein information acquisition unit 531 as finger vein reference information. As a result, the registered user temporarily registers the finger vein reference information.

  Next, the registration processing unit 520 confirms registration of finger vein reference information (step S205). Here, the registration processing unit 520 actually performs trial authentication several times (for example, three times) to verify whether or not the temporarily registered finger vein reference information (basic finger vein reference information) can be correctly authenticated, thereby authenticating the finger vein reference information. Calculate the rate. Details of the trial authentication and the calculation of the authentication rate of the finger vein reference information will be described later with reference to FIG. The registration processing unit 520 branches the process to each process (steps S206 to S208) for setting flag information based on the calculated authentication rate of the finger vein reference information. That is, the flag information is set based on the authentication rate of the biometric reference information (finger vein reference information) calculated when the authentication reference information is registered.

In step S205, when the authentication rate of the finger vein reference information is equal to or higher than a predetermined first threshold, the registration processing unit 520 determines that the authentication rate is high and registration of the finger vein reference information is not a problem, and the process Advances to step S206.
If the authentication rate of the finger vein reference information is less than the first threshold and greater than the second threshold, the registration processing unit 520 determines that the authentication rate is low, and advances the processing to step S207.
If the authentication rate of the finger vein reference information is equal to or lower than the second threshold, the registration processing unit 520 determines that the finger vein reference information cannot be registered, and the process proceeds to step S208.

  In step S206, the registration processing unit 520 writes the temporarily registered finger vein reference information (basic finger vein reference information) and flag 1 as flag information to the IC card 100. That is, the registration processing unit 520 stores the flag 1 as flag information in the flag information storage unit 112 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. Then, the registration processing unit 520 stores the finger vein reference information temporarily registered in the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. That is, the IC card 100 includes flag information indicating the flag 1 (first value) corresponding to the case where the authentication rate of the basic finger vein reference information is equal to or higher than the first threshold when the authentication rate is equal to or higher than the first threshold. Basic finger vein reference information is stored in the user information storage unit 110 as authentication reference information. The registration processing unit 520 ends the registration process after the process of step S206.

  In step S207, the registration processing unit 520 writes the temporarily registered finger vein reference information (basic finger vein reference information) and additional finger vein reference information, and the flag 2 as flag information to the IC card 100. That is, the registration processing unit 520 causes the display unit 540 to display a message that prompts the registered user to input additional finger vein reference information (additional finger vein reference information) in the finger vein information acquisition unit 531. Then, the registration processing unit 520 acquires the finger vein information acquired by the finger vein information acquisition unit 531 as additional finger vein reference information. The registration processing unit 520 stores the flag 2 as flag information in the flag information storage unit 112 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. Then, the registration processing unit 520 stores the finger vein reference information and the additional finger vein reference information temporarily registered in the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510.

  That is, the IC card 100 includes flag information indicating a flag 2 (second value) corresponding to a case where the authentication rate of the basic biometric reference information is less than the first threshold value and less than the first threshold value; Basic biometric reference information and additional biometric reference information are stored in the user information storage unit 110 as authentication reference information. The registration processing unit 520 ends the registration process after the process of step S207.

  In step S208, the registration processing unit 520 temporarily registers the face reference information. That is, the registration processing unit 520 causes the display unit 540 to display a message that prompts the registered user to input the face reference information in the face information acquisition unit 532 of the registration information acquisition unit 230. Then, the registration processing unit 520 acquires the face information acquired by the face information acquisition unit 532 as face reference information. As a result, the registered user has temporarily registered the face reference information.

  Next, the registration processing unit 520 determines whether or not registration of face reference information is possible (whether there is no problem) (step S209). That is, the registration processing unit 520 performs the trial authentication several times (for example, three times) as to whether the authentication can be performed correctly, as in the process of step S205, and whether or not registration of the face reference information is possible (no problem). Or not). If the registration processing unit 520 determines that the registration of face reference information is possible (no problem), the process proceeds to step S211. If the registration processing unit 520 determines that registration of face reference information is impossible, the registration processing unit 520 performs the processing. Proceed to step S210.

  In step S211, the registration processing unit 520 writes the temporarily registered face reference information and flag 3 as flag information to the IC card 100. That is, the registration processing unit 520 stores the flag 3 as flag information in the flag information storage unit 112 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. Then, the registration processing unit 520 stores the face reference information temporarily registered in the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. That is, when the authentication rate of the basic biometric reference information is equal to or lower than the second threshold value, which is lower than the first threshold value, the IC card 100 corresponds to the third value (here, the second threshold value). , Flag information indicating flag 3) and authentication standard information (face standard information) of a type different from the basic biometric standard information are stored in the user information storage unit 110. The registration processing unit 520 ends the registration process after the process of step S211.

  In step S210, the registration processing unit 520 writes the personal identification number and the flag 4 as flag information in the IC card 100. In other words, the registration processing unit 520 causes the display unit 540 to display a message that prompts the registered user to input the password, at the password acquisition unit 533. Then, the registration processing unit 520 acquires the security code acquired by the security code acquisition unit 533 as authentication reference information. The registration processing unit 520 stores the flag 4 as flag information in the flag information storage unit 112 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. Then, the registration processing unit 520 stores the acquired personal identification number in the authentication reference information storage unit 113 of the IC card 100 via the card communication unit 120 and the registration device communication unit 510. That is, when the authentication rate of the basic biometric reference information is equal to or lower than the second threshold value, which is lower than the first threshold value, the IC card 100 corresponds to the third value (here, the second threshold value). , Flag information indicating flag 4) and authentication standard information (password) different from the basic biometric reference information are stored in the user information storage unit 110. The registration processing unit 520 ends the registration process after the process of step S210.

Next, processing for trial authentication when registering authentication standard information and calculation of an authentication rate of authentication standard information will be described.
FIG. 7 is a flowchart showing an example of authentication rate calculation processing according to the embodiment of the present invention.

  In this figure, first, the registration processing unit 520 acquires authentication standard information (step S301). Here, it is assumed that the authentication reference information corresponds to the above-described finger vein reference information (basic finger vein reference information), and is already acquired and provisionally registered in the process of step S204 in FIG.

  Next, the registration processing unit 520 acquires authentication information (finger vein information) for comparison (step S302). In other words, the registration processing unit 520 causes the finger vein information acquisition unit 531 of the registration information acquisition unit 230 to display a message prompting the registered user to input finger vein information on the display unit 540. Then, the registration processing unit 520 acquires the finger vein information acquired by the finger vein information acquisition unit 531 as authentication information.

  Next, the registration processing unit 520 compares the authentication reference information (temporarily registered finger vein reference information) with the authentication information (finger vein information) acquired in step S302, and calculates the degree of coincidence as a comparison result. (Step S303). Here, the degree of coincidence indicates the degree (ratio) of coincidence between the authentication reference information (finger vein reference information) and the acquired authentication information (finger vein information).

Next, the registration processing unit 520 repeats the processing of step S302 and step S303 three times (step S304).
Next, the registration processing unit 520 calculates an average value of coincidence (step S305). Here, the registration processing unit 520 calculates an average value of the degree of coincidence calculated by repeating three times.

Next, the registration processing unit 520 calculates the authentication rate of the authentication reference information (finger vein reference information). Specifically, the registration processing unit 520 calculates the authentication rate of the authentication reference information (finger vein reference information) based on the calculated average value of the matching levels, using a conversion table in which the matching level is associated with the authentication rate. Then, the process is terminated.
Here, the conversion table is a table that is created by investigating the matching degree and the authentication rate of the authentication reference information in the authentication system 1 in advance, and can estimate the authentication rate from the matching degree. In the conversion table, the degree of coincidence is associated with the authentication rate.
Also, the authentication rate is referred to as “person authentication rate”. For example, it is authenticated that the registrant of the authentication standard information is a valid user, such as how many times of 100 authentications can be correctly authenticated. It is the probability of doing. Note that the “authentication rate” has a relationship of (100% − “rejection rate”), and the “rejection rate” is the probability that a person will be misrecognized as a non-authentic person. . That is, when the matching level of the registered authentication standard information is low, the authentication rate of the authentication standard information is low, and when the matching level of the authentication standard information is high, the authentication rate of the authentication standard information is high.

  In the present embodiment, an example of registering finger vein reference information has been described. However, even when other biometric reference information is registered, the processing for the trial authentication and the calculation of the authentication rate of the authentication reference information is the same. .

  As described above, the authentication system 1 in this embodiment includes the IC card 100 and the authentication device 200. Flag information indicating a method for authenticating the user 400 and authentication standard information used for the authentication method are determined in advance between the IC card 100 and the authentication device 200. The IC card 100 includes a user information storage unit 110 that stores in advance flag information and authentication standard information determined in correspondence with the flag information. Here, the flag information is flag information that is set when registering authentication standard information that serves as a standard for authenticating the user 400. In the authentication apparatus 100, the authentication information acquisition unit 230 acquires authentication information from the user 400, and the authentication processing unit 220 reads authentication standard information corresponding to the flag information from the IC card 100. The authentication processing unit 220 causes the authentication information acquisition unit 230 to acquire authentication information corresponding to the read authentication reference information. Further, the authentication processing unit 220 compares the acquired authentication information with the read authentication reference information, and authenticates whether or not the user 400 is a valid user based on the comparison result.

  As a result, the authentication system 1 according to the present embodiment can change the method of authenticating the user 400 according to the flag information, so that the authentication rate is increased without changing the security level of the entire authentication system 1. be able to. That is, the authentication system 1 in the present embodiment can increase the authentication rate without reducing the security level of the entire authentication system 1.

In the present embodiment, the IC card 100 has identification information (ID information) for identifying the user stored in advance in the user information storage unit 110. The authentication processing unit 220 reads the identification information (ID information) from the IC card 100, and the identification information corresponding to the user in which the read IC card 100 is registered in advance (information stored in the identification information storage unit 250). It is determined whether or not it matches. The authentication processing unit 220 authenticates whether or not the user 400 is a valid user based on the determination result and the comparison result of the authentication reference information described above.
Thereby, in order to use together authentication by authentication standard information and authentication by identification information (ID information), authentication system 1 in this embodiment is based on a judgment result of identification information (ID information), for example. It is possible to appropriately authenticate whether or not the user 400 using the invalid card such as the lost IC card 100 is a valid user.

In the present embodiment, the authentication standard information includes at least biometric reference information (for example, finger vein reference information) that is biometric information indicating the physical characteristics of the user, and the authentication standard information is registered as the flag information. It is set based on the authentication rate of the biometric reference information calculated at the time.
Thereby, since flag information is set by the authentication rate of the biometric reference information which is the biometric feature of the user, the method for authenticating the user 400 can be changed according to the user characteristics (the biometric feature of the user). Become. For example, when the authentication rate of the biometric reference information is low, the authentication system 1 adds authentication based on the additional finger vein reference information, authenticates the user 400 using face authentication instead of the finger vein reference information, It becomes possible to change the authentication method. Therefore, the authentication system 1 in the present embodiment can increase the authentication rate without reducing the security level of the entire authentication system 1 according to the user characteristics (user biometric features).

In this embodiment, the finger vein reference information includes basic finger vein reference information for which an authentication rate is calculated, and additional finger vein reference information that is different from the basic finger vein reference information. When the authentication rate of the basic finger vein reference information is equal to or higher than a predetermined first threshold, the IC card 100 uses the registration device 500 to display flag information indicating flag 1 (first value), and authentication reference information. Basic finger vein reference information is stored in the user information storage unit 110. Further, when the authentication rate of the basic finger vein reference information is less than the first threshold, the IC card 100 uses the registration device 500 to generate flag information indicating the flag 2 (second value) and basic authentication reference information. Finger vein reference information and additional finger vein reference information are stored in the user information storage unit 110.
The authentication processing unit 220 of the authentication device 200 determines that the comparison result between the basic finger vein reference information and the finger vein information (authentication information) information acquired by the authentication information acquisition unit 230 is not a valid user, and When the flag information is flag 2, the user 400 is authenticated by the additional finger vein reference information. That is, the authentication processing unit 220 authenticates the user 400 based on the comparison result between the finger vein information acquired by the authentication information acquisition unit 230 and the additional finger vein reference information and the determination result of the identification information (ID information). Authenticating whether or not the user is a valid user.

  Accordingly, the authentication apparatus 200 performs authentication based on the additional finger vein reference information for a user who does not increase the authentication rate with one finger vein reference information, and increases the authentication rate. Therefore, the authentication system 1 in the present embodiment can increase the authentication rate without lowering the security level of the entire authentication system 1.

Further, in the present embodiment, the IC card 100 uses the registration device 500 when the authentication rate of the basic finger vein reference information is equal to or lower than the second threshold lower than the first threshold (when registration is not possible). Flag information indicating the flag 3 or the flag 4 and authentication standard information (face reference information or personal identification number) of a type different from the basic finger vein reference information are stored in the user information storage unit 110.
Further, when the flag information is flag 3 or flag 4, the authentication processing unit 220 of the authentication apparatus 200 determines whether the user 400 is a valid user based on different types of authentication standard information (face standard information or password). Authenticate. Here, the different types of authentication standard information are, for example, face standard information or a personal identification number. Accordingly, the authentication apparatus 200 authenticates a user whose finger vein standard information cannot be registered using facial authentication or personal identification number. To increase the authentication rate. That is, the authentication apparatus 200 authenticates the user 400 using a plurality of authentication methods instead of lowering the authentication rate. Therefore, the authentication system 1 in the present embodiment can increase the authentication rate without lowering the security level of the entire authentication system 1.

In the present embodiment, the flag information is set based on the security rank (preset for the user. Here, the security rank preset for the user is, for example, a general employee or a VIP employee. User characteristics such as user attributes such as (executive officer).
As a result, the flag information is set according to the security rank set in advance for the user, so that the method for authenticating the user 400 can be changed according to the user characteristics (user attributes). For example, when the user is a VIP employee (executive employee), the authentication system 1 can be changed to a method (fifth authentication method) for authenticating the user 400 based only on the determination result of the identification information (ID information). It becomes possible. Therefore, the authentication system 1 in the present embodiment can increase the authentication rate without reducing the security level of the entire authentication system 1 according to the user characteristics (user attributes).

  In the IC card 100 and the authentication device 100 included in the authentication system 1 according to the present embodiment, the same effect as that of the authentication system 1 described above can be obtained.

  The registration device 500 according to the present embodiment is a device that registers authentication standard information serving as a reference for authenticating the user 400 in the IC card 100, and the registration information acquisition unit 530 acquires authentication standard information from the registered user. To do. In the registration processing unit 520, flag information indicating a method for authenticating the user 400 and authentication standard information used for the authentication method are determined in advance, and an authentication standard corresponding to the flag information indicating a method for authenticating the user 400 The registered information acquisition unit 530 acquires information. The registration processing unit 520 stores the acquired authentication standard information, flag information, and identification information for identifying the registered user in the user information storage unit 110 of the IC card 100.

  As a result, the registration apparatus 500 according to the present embodiment can change the method of authenticating the user 400 according to the flag information, so that the authentication rate is increased without changing the security level of the entire authentication system 1. be able to.

In the present embodiment, the authentication reference information includes at least biometric reference information (for example, finger vein reference information) that is biometric information indicating the physical characteristics of the user. The registration processing unit 520 of the registration device 500 calculates the authentication rate of the biometric reference information based on the biometric reference information acquired by the registration information acquisition unit 530. The registration processing unit 520 sets flag information based on the calculated authentication rate of the biometric reference information or the security rank set in advance by the user.
As a result, the flag information is set according to the authentication rate of the biometric reference information or the security rank. Therefore, the method for authenticating the user can be changed according to the user characteristics (the biometric feature of the user or the user attribute). It becomes possible. Therefore, the registration apparatus 500 in the present embodiment can increase the authentication rate without reducing the security level of the entire authentication system 1 according to the user characteristics (user biometric features or user attributes).

  Unlike the authentication apparatus 200, the registration apparatus 500 is an apparatus managed by the administrator of the authentication system 1. That is, the registration device 500 is not used by an unspecified number of users 400 like the authentication device 200 but is managed by an administrator of the authentication system 1. Since the setting of the flag information is performed by the registration apparatus 500 and not performed by the authentication apparatus 200, the security level of the entire authentication system 1 is not lowered.

[Second Embodiment]
<Authentication System in Second Embodiment>
Next, an authentication system in the second embodiment will be described.
FIG. 8 is a schematic block diagram showing the configuration of the authentication system 1a in the present embodiment.
8, the same components as those in FIG. 2 are denoted by the same reference numerals, and the description thereof is omitted.
In the present embodiment, the authentication system 1a is the first implementation except that when the flag information described above is the flag 2, the user 400 is authenticated using a plurality of IC cards (100A, 100B). This is the same as the authentication system 1 in the embodiment.

In FIG. 8, the authentication system 1a includes an IC card 100 (100A, 100B) and an authentication device 200.
The IC card 100A corresponds to the IC card 100 in the first embodiment, and is the same as the IC card 100 except that the flag information is flag 2. When the flag information is flag 2, two IC cards 100A and 100B correspond to the IC card 100. That is, in the IC card 100, when the flag information is flag 2, the information stored in the IC card 100 is divided and stored in advance. The IC card 100A (basic portable medium) and the IC card 100B (additional) Portable media).

The IC card 100A includes a user information storage unit 110A and an IC card communication unit 120A. Here, the user information storage unit 110A corresponds to the user information storage unit 110, and the IC card communication unit 120A corresponds to the IC card communication unit 120.
The user information storage unit 110A (storage unit) includes an identification information storage unit 111A, a flag information storage unit 112A, and an authentication reference information storage unit 113A. That is, the IC card 100A stores at least flag information, basic biometric reference information, and identification information (ID information) among information stored in the user information storage unit 110 of the IC card 100.

The IC card 100B includes a user information storage unit 110B and an IC card communication unit 120B. Here, the user information storage unit 110B corresponds to the user information storage unit 110, and the IC card communication unit 120B corresponds to the IC card communication unit 120.
The user information storage unit 110B (storage unit) includes an authentication reference information storage unit 113B and a link information storage unit 114.

The link information storage unit 114 stores in advance link information associated with identification information (ID information). The link information may be any information as long as it is associated with identification information (ID information). For example, a random value associated with identification information (ID information) or identification information (ID information) It may be encoded by a predetermined method.
The authentication reference information storage unit 113B stores additional biometric reference information in advance.
That is, the IC card 100B stores link information associated with identification information (ID information) and at least additional biometric reference information among information stored in the user information storage unit 110 of the IC card 100. .

Next, operation | movement of the authentication system 1a in this embodiment is demonstrated.
In the present embodiment, as in the first embodiment, an example will be described in the case where the basic biometric reference information and the additional biometric reference information are finger vein reference information.
FIG. 9 is a flowchart showing the approval process of the authentication device 200 in the present embodiment.
In FIG. 9, the operation of the authentication system 1a is basically the same as the operation of the authentication system 1 in the first embodiment, except that the processes in steps S112a and S113a are different.
In step S112a, the authentication processing unit 220 reads additional finger vein reference information from the IC card 100B (additional IC card). That is, the authentication processing unit 220 causes the display unit 240 to output a message that prompts the user 400 to bring the IC card 100B closer to the authentication device 200. And the authentication process part 220 reads additional finger vein reference | standard information from the authentication reference | standard information storage part 113B of IC card 100B via the card | curd communication part 120B and the authentication apparatus communication part 210. FIG.

  Next, the authentication processing unit 220 performs additional finger vein authentication, and authenticates whether or not the user 400 is a valid user (step S113a). That is, the authentication processing unit 220 causes the display unit 240 to output a message that prompts the user 400 to acquire additional finger vein information from the finger vein information acquisition unit 231 of the authentication information acquisition unit 230. Here, the additional finger vein information is authentication information corresponding to the additional finger vein reference information read from the IC card 100B, for example, finger vein information of “thumb”. Then, the authentication processing unit 220 compares the additional finger vein reference information read from the IC card 100B with the additional finger vein information acquired by the finger vein information acquisition unit 231, and based on the comparison result, the user 400 Authenticate whether the user is valid or not.

  Here, the authentication processing unit 220 authenticates whether or not the user 400 is a valid user, for example, based on whether or not the degree of coincidence as a comparison result is greater than or equal to a predetermined authentication threshold. When the authentication processing unit 220 authenticates that the user 400 is a legitimate user, the process proceeds to step S107. When the user 400 authenticates that the user 400 is not a legitimate user, the authentication processing unit 220 performs the authentication process according to the second authentication method. Terminate.

<Registration Device in Second Embodiment>
Next, a registration apparatus for registering authentication standard information in the IC card 100 (100A, 100B) used in the authentication system 1a described above will be described.
FIG. 10 is a schematic block diagram showing the configuration of the registration device 500 in the present embodiment.
10, the same components as those in FIGS. 5 and 9 are denoted by the same reference numerals, and the description thereof is omitted.
This embodiment is basically the same as the configuration of the registration apparatus 500 in the first embodiment, except that it corresponds to two IC cards (100A, 100B).

Next, the operation of the registration apparatus 500 in this embodiment will be described.
FIG. 11 is a flowchart showing a registration process of the registration apparatus 500 in the present embodiment.
In FIG. 11, the operation of the registration apparatus 500 is basically the same as the operation of the registration apparatus 500 in the first embodiment, except that step S207 in FIG. 6 is divided into steps S207A and S207B.

  In step S207A, the registration processing unit 520 writes the temporarily registered finger vein reference information (basic finger vein reference information) and the flag 2 as flag information to the IC card 100A. That is, the registration processing unit 520 stores the flag 2 as flag information in the flag information storage unit 112A of the IC card 100A via the card communication unit 120A and the registration device communication unit 510. Then, the registration processing unit 520 stores the finger vein reference information provisionally registered in the authentication reference information storage unit 113A of the IC card 100A via the card communication unit 120A and the registration device communication unit 510.

  Next, the registration processing unit 520 writes the link information and the additional finger vein reference information to the IC card 100B (additional IC card) (step S207B). That is, the registration processing unit 520 causes the display unit 240 to output a message that prompts the registered user to bring the IC card 100B closer to the authentication device 200. Also, the registration processing unit 520 causes the display unit 540 to display a message that prompts the registered user to input additional finger vein reference information (additional finger vein reference information) in the finger vein information acquisition unit 531. Then, the registration processing unit 520 acquires the finger vein information acquired by the finger vein information acquisition unit 531 as additional finger vein reference information. The registration processing unit 520 stores link information in the link information storage unit 114 of the IC card 100B via the card communication unit 120B and the registration device communication unit 510. Then, the registration processing unit 520 stores the additional finger vein reference information in the authentication reference information storage unit 113B of the IC card 100B via the card communication unit 120B and the registration device communication unit 510.

  That is, the IC card 100A has flag information indicating a flag 2 (second value) corresponding to a case where the authentication rate of the basic biometric reference information is less than the first threshold, Basic biometric reference information is stored in the user information storage unit 110A as authentication reference information. When the authentication rate of the basic biometric reference information is less than the first threshold, the IC card 100B stores link information and additional biometric reference information as authentication reference information in the user information storage unit 110B. The registration processing unit 520 ends the registration process after the process of step S207B.

  As described above, the authentication system 1a according to the present embodiment divides and stores in advance information stored in the IC card 100 when the flag information is flag 2 (second value). IC card 100A (basic portable medium) and IC card 100B (additional portable medium) are included. The IC card 100A stores at least flag information, basic finger vein reference information, and identification information among information stored in the user information storage unit 110 of the IC card 100. Further, the IC card 100B stores link information associated with the identification information and at least additional finger vein reference information among the information stored in the user information storage unit 110 of the IC card 100.

  Accordingly, the authentication apparatus 200 performs authentication based on the additional finger vein reference information for a user who does not increase the authentication rate with one finger vein reference information, and increases the authentication rate. Therefore, the authentication system 1a in the present embodiment can increase the authentication rate without reducing the security level of the entire authentication system 1a. Further, since only the link information and the additional finger vein reference information are stored in the IC card 100B, the IC card 100B alone cannot be used for the authentication system 1a. Therefore, the authentication system 1a according to the present embodiment does not lower the security level of the authentication system 1a even when the IC card 100B is lost.

The present invention is not limited to the above embodiments, and can be modified without departing from the spirit of the present invention.
For example, in each of the above embodiments, the IC card 100 (100A, 100B) has been described as a non-contact type IC card, but the IC card 100 may be a contact type IC card. Moreover, although IC card 100 (100A, 100B) demonstrated the form which is not provided with control parts, such as CPU (Central Processing Unit), the form provided with a control part may be sufficient.
Further, in each of the above embodiments, the form in which the authentication system 1 (or 1a) is installed in the gate 300 of the entrance / exit system has been described. However, for example, the form may be installed in the door 300a as shown in FIG. It may be applied to a system other than the entrance / exit system.

Further, in each of the above embodiments, the description has been given of the form in which the finger vein reference information, the face authentication reference information, and the personal identification number are used as the authentication reference information. However, the present invention is not limited to this. Moreover, although the form which uses finger vein information and face information was demonstrated as biometric information, it is not limited to this. For example, information such as fingerprints, palm shapes, retinas, irises, ear shapes, and voices may be used as biological information.
Further, in each of the embodiments described above, the mode in which one additional authentication criterion information is added when the authentication rate is low has been described. However, a mode in which two or more additional authentication criterion information is added may be used. Further, one or more IC cards 100B (additional IC cards) may be used according to the number of additional authentication standard information to be added. Moreover, although the form using the finger vein standard information which is the same kind of biometric information as the basic authentication standard information has been described as the additional authentication standard information, a form using biometric information of a different type from the basic authentication standard information may be used. For example, face reference information may be used as additional authentication reference information.

Further, in each of the above embodiments, the mode in which flag information is set based on the authentication rate calculated from the average degree of matching of trial authentication has been described. However, the mode in which flag information is set based on the average degree of matching of trial authentication But you can.
Further, in each of the above embodiments, the case where the registration device 500 newly registers authentication standard information in the IC card 100 (100A, 100B) has been described. The flag information and the authentication reference information (method for authenticating the user 400) may be changed again.
Further, in each of the embodiments described above, the registration apparatus 500 has described the form in which the identification information is written in the IC card at the time of registration, but the identification information may be written in the IC card 100 in advance.

  DESCRIPTION OF SYMBOLS 1, 1a ... Authentication system, 100, 100A ... IC card, 100B ... IC card (additional IC card), 110, 110A, 110B ... User information storage part, 111, 111A ... Identification information storage part, 112, 112A ... Flag information Storage unit, 113, 113A, 113B ... authentication reference information storage unit, 114 ... link information storage unit, 120, 120A, 120B ... card communication unit, 200 ... authentication device, 210 ... authentication device communication unit, 220 ... authentication processing unit, 230 ... Authentication information acquisition unit, 231 ... Finger vein information acquisition unit, 232 ... Face information acquisition unit, 233 ... PIN number acquisition unit, 240, 540 ... Display unit, 250 ... Identification information storage unit, 300 ... Gate, 400 ... User , 500 ... Registration device, 510 ... Registration device communication unit, 520 ... Registration processing unit, 530 ... Registration information acquisition unit, 531 ... Finger vein information Acquisition unit, 532 ... face information acquisition unit, 533 ... personal identification number obtaining unit, 600 ... network, 700 ... server device

Claims (11)

An authentication system comprising a portable medium capable of storing information, and an authentication device for authenticating a user using information stored in the portable medium,
Flag information that is set for each user when registering authentication standard information that serves as a reference for authenticating the user, flag information indicating a method for authenticating the user, and the method used for the authentication method Authentication standard information is predetermined between the portable medium and the authentication device,
The portable medium is
A storage unit preliminarily storing the flag information and the authentication standard information determined corresponding to the flag information;
The authentication device
An authentication information acquisition unit for acquiring authentication information from the user;
The flag information and the authentication standard information corresponding to the flag information are read from the portable medium, and the authentication information acquisition unit is configured to acquire the authentication information corresponding to the read authentication standard information. An authentication processing unit that compares authentication information with the read authentication standard information and performs authentication based on the comparison result to determine whether the user is a valid user;
An authentication system comprising: The portable medium is
Identification information for identifying the user is stored in advance in the storage unit,
The authentication processing unit
The identification information is read from the portable medium, it is determined whether or not the read identification information matches the identification information corresponding to the user registered in advance, and based on the determination result and the comparison result The authentication system according to claim 1, wherein authentication is performed to determine whether or not the user is a valid user. The authentication reference information includes at least biometric reference information that is biometric information indicating the physical characteristics of the user,
The flag information is an authentication rate of the biometric reference information calculated when the authentication reference information is registered, and is based on an authentication rate that indicates a probability of correctly authenticating among a plurality of authentications. The authentication system according to claim 2, wherein the authentication system is set as follows. The biometric reference information includes basic biometric reference information for which the authentication rate is calculated, and additional biometric reference information different from the basic biometric reference information,
The portable medium is
When the authentication rate of the basic biometric reference information is equal to or higher than a predetermined first threshold, the flag information indicating a first value corresponding to the case where the authentication rate is equal to or higher than the first threshold, and the authentication reference information And the basic biometric reference information is stored in the storage unit,
When the authentication rate of the basic biometric reference information is less than the first threshold, the flag information indicating a second value corresponding to the case where the authentication rate is less than the first threshold, and the basic as the authentication reference information Biometric reference information and the additional biometric reference information are stored in the storage unit,
The authentication processing unit
When it is determined that the comparison result between the basic biometric reference information and the authentication information corresponding to the basic biometric reference information acquired by the authentication information acquisition unit is not a valid user, and the flag information is the first information When the value is 2, the user is based on the comparison result between the authentication information corresponding to the additional biometric reference information acquired by the authentication information acquisition unit and the additional biometric reference information, and the determination result. The authentication system according to claim 3, wherein authentication is performed to determine whether or not the user is a valid user. In the portable medium, there are a basic portable medium and an additional portable medium in which information stored in the portable medium is divided and stored in advance when the flag information is the second value. Included,
The basic portable medium is
Of the information stored in the storage unit of the portable medium, at least the flag information, the basic biometric reference information, and the identification information are stored,
The additional portable medium is
The link information associated with the identification information and at least the additional biometric reference information among the information stored in the storage unit of the portable medium are stored. Authentication system. The portable medium is
When the authentication rate of the basic biometric reference information is equal to or lower than a second predetermined threshold that is lower than the first threshold, the third value corresponding to a case where the authentication rate is equal to or lower than the second threshold Flag information and authentication standard information of a type different from the basic biometric reference information are stored in the storage unit,
The authentication processing unit
When the flag information is the third value, the comparison result between the different types of authentication standard information and the authentication information corresponding to the different types of authentication standard information acquired by the authentication information acquisition unit; The authentication system according to claim 5, wherein authentication is performed based on the determination result to determine whether the user is a valid user. The authentication system according to claim 6, wherein the different types of authentication reference information are the biometric reference information or a personal identification number. The authentication system according to any one of claims 1 to 7, wherein the flag information is set based on a security rank preset for a user. A registration device for registering authentication standard information serving as a reference for authenticating the user in a portable medium capable of storing information used in an authentication system for performing user authentication,
A registration information acquisition unit that acquires the authentication standard information from a registered user;
Flag information that is set for each user when registering authentication standard information that serves as a reference for authenticating the user, flag information indicating a method for authenticating the user, and the authentication used for the authentication method Reference information is predetermined, and the registration information acquisition unit acquires the authentication reference information determined in correspondence with the flag information, and the acquired authentication reference information and the flag information are A registration processing unit to be stored in the storage unit of the portable medium;
A registration device comprising: The authentication reference information includes at least biometric reference information that is biometric information indicating physical characteristics of the registered user,
The registration processing unit
The authentication rate of the biometric reference information is calculated based on the biometric reference information acquired by the registration information acquisition unit, and is set in advance for the calculated authentication rate of the biometric reference information or the registered user. The registration apparatus according to claim 9, wherein the flag information is set based on a security rank. An authentication device that performs user authentication using information stored in a portable medium capable of storing information,
An authentication information acquisition unit for acquiring authentication information from the user;
Flag information that is set for each user when registering authentication standard information that serves as a reference for authenticating the user, flag information indicating a method for authenticating the user, and the method used for the authentication method Authentication standard information is determined in advance with the portable medium, and the flag information and the authentication standard information determined corresponding to the flag information are read from the portable medium and read. The authentication information acquisition unit acquires the authentication information corresponding to the authentication criterion information, compares the acquired authentication information with the read authentication criterion information, and the user is authorized based on the comparison result. An authentication processing unit for authenticating whether or not the user is a user,
An authentication device comprising:

Images