JP6124124B2 - Authentication system - Google Patents

Description

  The present invention relates to an authentication system using a mobile terminal.

  Conventionally, in personal authentication using a photograph of a face such as an employee ID card or driver's license, a supervisor has visually confirmed the face photograph and the person's face. As a result, it is left to the discretion of the individual supervisor, and it is difficult to ensure a certain level of security, and no authentication history remains. On the other hand, for example, in the IC card authentication system disclosed in Patent Document 1 below, face image data of the person to be authenticated is stored in advance in the IC card, and at the time of authentication, the face of the person to be authenticated is captured by the camera. On the other hand, face image data is read from the captured IC card. Then, the captured image of the face of the person to be authenticated obtained by the camera is collated with the read face image data, and the collation result is output. Thereby, it is accurately determined whether or not the person to be authenticated is a regular IC card intended person, and impersonation at the time of authentication is prevented.

JP 2012-068924 A

  By the way, in a system using an IC card in which face image data is stored in advance as in the authentication system disclosed in Patent Document 1, authentication accuracy is stabilized at a high level as compared with visual confirmation by a monitor or the like. In addition, it is possible to easily leave a verification history and the like. However, when an IC card in which face image data is stored in advance is prepared for all users, not only does it take time to prepare the IC card, but there is a problem that a large amount of cost is required for system construction.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to provide an authentication system capable of improving authentication accuracy without preparing an IC card or the like in which face image data is stored in advance. It is to provide.

In order to achieve the above object, the invention described in claim 1 includes a portable terminal (50) carried by a user and a code for generating an authentication code (C) as an information code for authentication. An authentication system (10) comprising a generation unit (20) and an authentication device (30) for authenticating the user, wherein the portable terminal stores the user's face image data in the code generation unit A storage means (52) for storing the authentication code acquired by output; and a display means (54) for displaying the authentication code stored in the storage means, the code generator Is a code generation extraction means (20) for extracting face feature points from the face image data acquired from the portable terminal, and the authentication in which information relating to the face feature points extracted by the code generation extraction means is recorded. A code generation means (20) for generating a code; and an output means (20) for outputting the authentication code generated by the code generation means to the portable terminal, wherein the authentication device is connected to the display means. Imaging means (33, 40) for imaging the displayed authentication code and the user's face, and acquiring information on the facial feature points by decoding the authentication code imaged by the imaging means Decoding means (31) for performing the verification, extraction means (31) for collation extracting the facial feature points from the image of the user's face imaged by the imaging means, the facial feature points acquired by the decoding means, A collating means (31) for collating the facial feature points extracted by the collating extraction means; an authenticating means (31) for authenticating the user based on the collation result of the collating means; Wherein the imaging means comprises a first imaging means for imaging the authentication code displayed on the display means, and a second imaging means for imaging the face of the user, wherein the 2 imaging means, characterized Rukoto is disposed in a position for imaging the face of the user to the mobile terminal in order to image the authentication code displayed on the display unit is directed to the first image pickup means And
In addition, the code | symbol in each said parenthesis shows the correspondence with the specific means as described in embodiment mentioned later.

  According to the first aspect of the present invention, when the face generation point is extracted from the face image data acquired from the portable terminal by the code generation extracting means in the code generation unit, the authentication code in which information relating to the face feature point is recorded is the code. Generated by the generating means and output to the portable terminal. In the authentication apparatus, when the authentication unit displayed on the display unit of the mobile terminal and the user's face are imaged by the imaging unit, the facial feature acquired by decoding the captured authentication code The collation means collates the points with the face feature points extracted by the collation extraction means from the captured user's face image. Then, the authentication unit authenticates the user based on the verification result of the verification unit.

As a result, the user can realize authentication using the facial feature points only by causing the imaging means of the authentication apparatus to capture the authentication code acquired in advance and his / her face. Therefore, the authentication accuracy can be increased without using an IC card or the like in which the user's face image or face feature point is registered in advance, and the matching history and the like can be easily left.
In particular, the second imaging means for imaging the user's face captures the user's face with the portable terminal facing the first imaging means in order to image the authentication code displayed on the display means. Placed in. Since the user who points the mobile terminal toward the first image pickup unit as described above is normally stationary, the user's face image using the second image pickup unit can be picked up clearly and reliably. .

  In the invention of claim 2, an authentication code is generated by encrypting information relating to the facial feature points using a decryption key by the code generation means, and the authentication code using the decryption key by the decoding means. Is decoded to obtain information on face feature points.

  As described above, by encrypting the authentication code, it becomes difficult for a third party who does not have a decryption key to illegally tamper with the information on the facial feature points, and the security of the authentication system can be improved. it can.

  In the invention of claim 3, the authentication means simply authenticates the user in order to authenticate the user when all items extracted from the face image as face feature points, for example, the arrangement and shape of the eyes and mouth match. Since it is not authenticated to the extent that the shape of is similar, the authentication accuracy can be further increased.

  In the invention of claim 4, when at least part of items extracted from the face image as face feature points, for example, the arrangement and shape of the eyes and mouth, are matched, in other words, the authentication means is the user himself / herself. However, since the imaging conditions and the like are different from those at the time of face image generation, the user is authenticated to the extent that some of the face feature points do not match. As a result, the time required for the authentication process is shortened, and a rapid authentication process can be realized and a certain authentication accuracy can be ensured.

In the invention of claim 5 , the face image data output to the code generator is stored in the storage means, and the face image data stored in the storage means is displayed on the display means in response to a predetermined instruction. As a result, even if the user himself / herself is not authenticated because the imaging conditions and the like are different from those at the time of face image generation, the face image data displayed on the display means of the mobile terminal is used as a collation image as a supervisor. For example, it is possible to reliably eliminate the situation where the user is not authenticated.

It is explanatory drawing which shows roughly the structure of the authentication system which concerns on this embodiment. It is explanatory drawing which illustrates a part of location which extracts a face feature point from the imaged face image data. It is a block diagram which shows roughly the electric structure of an authentication apparatus. It is explanatory drawing which shows roughly the arrangement | positioning relationship between an imaging part and a reading window. It is a block diagram which shows roughly the electric constitution of a portable terminal. It is explanatory drawing explaining the flow of issuance of the code for authentication by prior registration. It is explanatory drawing explaining the flow of issuance of the code for authentication by prior registration. It is explanatory drawing explaining the flow of the authentication process by an authentication apparatus. It is explanatory drawing explaining the flow of the authentication process by an authentication apparatus. It is explanatory drawing explaining the state by which the code for authentication and face image data are alternately displayed on the display part of a portable terminal.

Hereinafter, an embodiment embodying an authentication system according to the present invention will be described with reference to the drawings. FIG. 1 is an explanatory diagram schematically showing the configuration of an authentication system 10 according to the present embodiment.
An authentication system 10 shown in FIG. 1 mainly includes a server 20 and an authentication device 30, and is configured as a system that performs personal authentication of a user who carries a portable terminal 50 using face image data captured in advance. ing.

  The server 20 is configured as a computer that issues an optically readable information code (hereinafter also referred to as an authentication code C) used when performing personal authentication. The server 20 functions as a code generation extracting unit that extracts face feature points from the face image data acquired from the portable terminal 50 via the network N such as the Internet, and also encodes information on the face feature points. And function as code generation means for generating the authentication code C. The server 20 functions as an output unit that outputs (transmits) the generated authentication code C to the portable terminal 50. The server 20 may correspond to an example of a “code generation unit”.

Here, the face feature points and the authentication code C will be described with reference to the drawings. FIG. 2 is an explanatory diagram illustrating a part of locations D1 and D2 where face feature points are extracted from the captured face image data D.
In the present embodiment, items such as the size and shape of face organs such as eyes, eyebrows, nose, ears, and mouth, contours, and positions where the face organs are arranged are employed as face feature points. Then, according to the face feature point extraction process for extracting the known face feature points performed by the server 20, the feature for each item, for example, “D1” is obtained for the face image data D acquired as shown in FIG. : “Cut length” and “D2: Mouth is larger” are calculated and extracted as face feature points.

  Then, in accordance with a known information code generation process performed by the server 20, the authentication code C is encrypted by being decryptable using the decryption key based on the information about the facial feature points extracted as described above. Generated. In the present embodiment, as the authentication code C, for example, a QR code (registered trademark) whose security is improved by encryption is employed.

Next, the authentication device 30 will be described with reference to FIGS. 3 and 4. 3A is a block diagram schematically showing the electrical configuration of the authentication device 30, and FIG. 3B is a schematic diagram showing the electrical configuration of the information code reading unit 40 of FIG. 3A. FIG. FIG. 4 is an explanatory diagram schematically showing an arrangement relationship between the imaging unit 33 and the reading window 41.
The authentication device 30 is configured as a device for authenticating a user using the authentication code C displayed on the portable terminal 50. As shown in FIG. 3A, as shown in FIG. 32, an imaging unit 33, a display unit 34, an operation unit 35, a communication unit 36, an information code reading unit 40, and the like.

  The control unit 31 is configured mainly with a microcomputer, and performs overall control of the authentication device 30 and various calculations. For example, the control unit 31 functions to execute authentication processing described later. The memory 32 is configured by a known storage medium such as a ROM, RAM, HDD, and nonvolatile memory, and stores a system program, an authentication processing program, and various other data. The memory 32 stores a decryption key for decrypting the authentication code C in advance.

  The imaging unit 33 is configured as an imaging unit including a light receiving sensor (for example, a C-MOS area sensor, a CCD area sensor, or the like). The imaging unit 33 images the face of the user who points the portable terminal 50 toward the reading window 41 of the information code reading unit 40 in order to image the authentication code C displayed on the display unit 54. As shown in FIG. The control unit 31 extracts face feature points from the face image data picked up by the image pickup unit 33 by performing face feature point extraction processing in the same manner as the server 20. The imaging unit 33 may correspond to an example of “second imaging unit”.

  The display unit 34 is composed of a liquid crystal display or the like, and is configured to display predetermined information such as the result of the authentication process under the control of the control unit 31. The operation unit 35 includes an input device such as a touch panel or a keyboard, and is configured to input a signal corresponding to the input operation to the control unit 31. The communication unit 36 is configured as a communication interface for performing data communication with an external device, and is configured to perform communication processing in cooperation with the control unit 31.

  As shown in FIG. 3B, the information code reading unit 40 includes a light receiving sensor 44 formed of a solid-state imaging device such as a CCD area sensor, an imaging lens 43, an illumination unit 42 including a plurality of LEDs and lenses. Etc., and functions to image and read an information code such as the authentication code C in cooperation with the control unit 31. The information code reading unit 40 may correspond to an example of “imaging unit” and “first imaging unit”.

  In the information code reading unit 40, when reading the information code, the illumination light Lf is converted into the information code by the illumination unit 42 that receives a command from the control unit 31 that detects that the information code is held over the reading window 41. It is emitted toward. Then, the reflected light Lr reflected from the illumination light Lf by the information code is taken into the apparatus through the reading window 41 and is received by the light receiving sensor 44 through the imaging lens 43.

  The imaging lens 43 disposed between the reading window 41 and the light receiving sensor 44 is configured to form an image of the information code on the light receiving sensor 44, and the light receiving sensor 44 responds to the information code image. The received light signal is output. The light receiving signal output from the light receiving sensor 44 is stored in the memory 32 as image data and used for decoding processing or the like. The information code reading unit 40 is provided with an amplifier circuit that amplifies the signal from the light receiving sensor 44, an AD converter circuit that converts the amplified signal into a digital signal, and the like. Is omitted.

  Further, when the information code reading unit 40 reads the authentication code C included in the image data generated by the light receiving sensor 44, the authentication code encrypted using the decryption key stored in the memory 32 is used. The decoding process is performed so as to decode the business code C.

Next, the portable terminal 50 will be described with reference to FIGS. 1 and 5. FIG. 5 is a block diagram schematically showing the electrical configuration of the mobile terminal 50.
A mobile terminal 50 shown in FIGS. 1 and 5 is, for example, a mobile phone, and includes a control unit 51 including a CPU, a memory 52 including a ROM, a RAM, and a nonvolatile memory, a light receiving sensor (for example, a C-MOS area sensor) An imaging unit 53 configured as a camera having a CCD area sensor, a display unit 54 including a liquid crystal display, an operation unit 55 including various operation keys, and a network N such as a mobile phone network or the Internet. And a communication unit 56 configured as a communication interface for performing communication via the network. FIG. 1 illustrates a state where the authentication code C is displayed on the display unit 54. Further, the memory 52 may correspond to an example of “storage means”, and the display unit 54 may correspond to an example of “display means”.

  Next, in the authentication system 10 configured as described above, issuance of an authentication code C by pre-registration and authentication processing by the authentication device 30 will be described with reference to FIGS. 6 and 7 are explanatory diagrams for explaining the flow of issuing the authentication code C by pre-registration. 8 and 9 are explanatory diagrams illustrating the flow of authentication processing by the authentication device 30. FIG.

First, issuance of the authentication code C by pre-registration will be described below with reference to FIGS.
A user who desires authentication using the authentication code C accesses the server 20 using the portable terminal 50 and transmits predetermined information such as personal information and transmits his / her face image data (FIGS. 6 and 7). S11). The face image data may be image data captured by the imaging unit 53 or image data captured by another imaging device.

  When receiving the face image data from the portable terminal 50 (S12), the server 20 extracts the face feature points from the received face image data as described above (S13), and information about the face feature points and information about the user. Etc. are converted into information codes as described above to generate an authentication code C (S14). The authentication code C generated in this way is transmitted to the portable terminal 50 (S15).

  When the portable terminal 50 receives the authentication code C from the server 20 (S16), the portable terminal 50 stores the authentication code C in the memory 52. Thereby, the issuance of the authentication code C by pre-registration is completed, and the user having the portable terminal 50 can receive a service using the authentication code C at any time.

Next, authentication processing by the authentication device 30 will be described below with reference to FIGS. 8 and 9.
When a user who visits a store where the authentication device 30 is installed desires to provide a service using authentication of the authentication code C, the user performs a predetermined operation on the operation unit 55 to store in the memory 52. The stored authentication code C is displayed on the display unit 54 (S21 in FIGS. 8 and 9). Then, the user stands in front of the authentication device 30 and holds the authentication code C displayed on the display unit 54 over the reading window 41 of the information code reading unit 40 (S22).

  When the control unit 31 of the authentication device 30 detects that the portable terminal 50 is held over the reading window 41, the control unit 31 executes an authentication process. In this authentication process, first, the illumination light Lf is emitted from the illumination unit 42, and then the reflected light from the authentication code C taken in through the reading window 41 is received by the light receiving sensor 44, whereby the authentication code C And the decoding process is performed on the authentication code C based on the captured image (S23). In this process, as described above, by decoding using the decryption key stored in the memory 32, the encrypted authentication code C is decrypted, and information on the facial feature points used for authentication is acquired. (S24). The control unit 31 that executes the decoding process may correspond to an example of a “decoding unit”.

  Further, the face of the user holding the authentication code C over the reading window 41 is imaged by the imaging unit 33 (S25), and face image data is generated (S26). Subsequently, face feature points are extracted from the face image data captured as described above by the face feature point extraction process (S27). Note that the control unit 31 that executes the face feature point extraction process may correspond to an example of a “collation extraction unit”.

  Then, based on the facial feature points acquired by decoding and the facial feature points extracted from the facial image data by the collation process, whether or not the pre-registered person and the person who visited the store are the same person, Specifically, for example, it is checked whether or not all items extracted from the face image as face feature points match (S28). The control unit 31 that executes the above-described collation processing may correspond to an example of “collation unit”.

  And the process for authentication based on the said collation result is made. In this process, when it is determined from the collation result that the person is the same person, information indicating that fact is displayed on the display unit 34, and the user can receive a desired service. On the other hand, if it is determined from the collation result that the person is not the same person, information indicating that fact is displayed on the display unit 34, and the user cannot receive the service. The collation history as described above is stored in the memory 32 each time. The control unit 31 that executes the authentication process based on the collation result may correspond to an example of “authentication unit”.

  As described above, in the authentication system 10 according to the present embodiment, when a face feature point is extracted from the face image data acquired from the mobile terminal 50 in the server 20, authentication information in which information on the face feature point is recorded is recorded. A code C is generated and output to the portable terminal 50. In the authentication device 30, the authentication code C displayed on the display unit 54 of the portable terminal 50 is imaged by the information code reading unit 40 and the user's face is imaged by the imaging unit 33. The face feature points acquired by decoding the authentication code C are collated with the face feature points extracted from the captured user's face image. Then, the user is authenticated based on the collation result.

  As a result, the user can realize authentication using the facial feature points only by causing the imaging unit 33 of the authentication device 30 to capture the authentication code C and his / her face acquired in advance. Therefore, the authentication accuracy can be increased without using an IC card or the like in which the user's face image or face feature point is registered in advance, and the matching history and the like can be easily left.

  Further, the server 20 generates an authentication code C by encrypting information on the facial feature points using a decryption key so that the information can be decrypted, and the control unit 31 of the authentication device 30 uses the decryption key to authenticate the authentication code C. By decoding C, information on face feature points is acquired.

  As described above, by encrypting the authentication code C, it becomes difficult for a third party who does not have a decryption key to illegally tamper with information related to facial feature points, and the security of the authentication system 10 is improved. be able to.

  In addition, in order to further improve the confidentiality of the information related to the facial feature points, a partially private code can be adopted as the authentication code C. This partially private code is configured as an information code having a public area and a private area in which information encrypted using a decryption key is decrypted. For this reason, by recording information about facial feature points in a private area, a code reader that does not have a decryption key can read only the information recorded in the public area, and other information is recorded. Even the recognition of information about facial feature points can be enhanced. On the other hand, when the authentication system 10 is used in an environment where the security requirement is relatively low, the authentication code C is not encrypted based on the information about the facial feature points extracted as described above. May be generated.

  Furthermore, in the authentication process by the control unit 31, when all the items extracted from the face image as face feature points match, the user is authenticated as the same person, so that the face shape is simply similar. Is not authenticated, the authentication accuracy can be further increased.

  In the authentication process by the control unit 31, when at least a part of items extracted from the face image as face feature points match, in other words, even when the user is himself, the imaging conditions and the like are different from those when the face image is generated. Therefore, the user may be authenticated as the same person as long as some of the facial feature points do not match. As a result, the time required for the authentication process is shortened, and a rapid authentication process can be realized and a certain authentication accuracy can be ensured.

  In the authentication device 30, the imaging unit 33 for imaging the user's face is a user who points the portable terminal 50 toward the reading window 41 in order to capture the authentication code C displayed on the display unit 54. It is arrange | positioned in the position which images the face. Since the user who points the portable terminal 50 toward the reading window 41 as described above is normally stationary, the user's face image using the imaging unit 33 can be captured clearly and reliably.

In addition, this invention is not limited to the said embodiment, For example, you may actualize as follows.
(1) The authentication system 10 according to the present invention is a system in which authentication accuracy is improved by using face image data, for example, a service that requires authentication by installing an authentication device 30 at a bank counter or a retail store. It can be adopted as a system that is sometimes used.

(2) The server 20 is not limited to generating the authentication code C from the face image data, but by executing a predetermined application program installed in the portable terminal 50, the face image data can be used without using the server 20. An authentication code C may be generated. In this case, the user can acquire the predetermined application program by performing a predetermined procedure in advance, and this application program is stored in the memory 52 of the portable terminal 50 so as to be executable. At that time, the decryption key is stored in the memory 52 so as to be usable by the predetermined application program. For example, when providing a service that requires high security, the server 20 is used to generate the authentication code C from the face image data, and when providing a service that requires relatively low security. As described above, the authentication code C may be generated from the face image data by the portable terminal 50 itself. The control unit 51 that executes the predetermined application program may correspond to an example of a “code generation unit”.

(3) FIG. 10 is an explanatory diagram for explaining a state in which the authentication code C and the face image data are alternately displayed on the display unit 54 of the mobile terminal 50, and FIG. The display state is shown, and FIG. 10B shows the display state of the image data.
The portable terminal 50 stores the face image data transmitted (output) to the server 20 in order to generate the authentication code C in the memory 52, and displays the face image data stored in the memory 52 in response to a predetermined instruction. The unit 54 may be configured to be displayed. As this display method, for example, as shown in FIGS. 10A and 10B, a method of alternately displaying the authentication code C and the face image data stored in the memory 52 on the display unit 54 is adopted. be able to. Further, as shown in FIG. 10B, the face image data stored in the memory 52 may be temporarily displayed on the display unit 54 in accordance with a predetermined operation.

  As a result, even if the user himself / herself is not authenticated because the imaging conditions and the like are different from those at the time of facial image generation, the facial image data displayed on the display unit 54 of the portable terminal 50 is used as an image for verification. By making a store clerk, a supervisor, and the like visually recognize, it is possible to reliably eliminate a situation where the user is not authenticated.

DESCRIPTION OF SYMBOLS 10 ... Authentication system 20 ... Server (Code generation part, Code generation extraction means, Code generation means, Output means)
30 ... Authentication device 31 ... Control unit (decoding means, extraction means for verification, verification means, authentication means)
33 ... Imaging unit (imaging means, second imaging means)
40. Information code reading unit (imaging means, first imaging means)
50 ... mobile terminal 52 ... memory (storage means)
54. Display section (display means)
C ... Authentication code

Claims (5)

A mobile device carried by the user,
A code generator for generating an authentication code as an information code for authentication;
An authentication device for authenticating the user;
An authentication system comprising:
The portable terminal is
Storage means for storing the authentication code acquired by outputting the user's face image data to the code generation unit;
Display means for displaying the authentication code stored in the storage means,
The code generator is
Code generation extracting means for extracting face feature points from the face image data acquired from the portable terminal;
Code generating means for generating the authentication code in which information relating to the facial feature points extracted by the code generating extracting means is recorded;
Output means for outputting the authentication code generated by the code generation means to the portable terminal,
The authentication device
Imaging means for imaging the authentication code displayed on the display means and the user's face;
Decoding means for acquiring information on the facial feature points by decoding the authentication code imaged by the imaging means;
Extraction means for matching that extracts facial feature points from the image of the user's face imaged by the imaging means;
Collating means for collating the facial feature points acquired by the decoding means and the facial feature points extracted by the extracting means for matching;
Authenticating means for authenticating the user based on the matching result of the matching means;
Equipped with a,
The imaging means includes first imaging means for imaging the authentication code displayed on the display means, and second imaging means for imaging the user's face,
The second imaging means, Rukoto is disposed at a position for imaging the face of the user to the mobile terminal in order to image the authentication code displayed on the display unit is directed to the first image pickup means An authentication system characterized by The code generation means generates the authentication code by encrypting information relating to the face feature point using a decryption key so that the information can be decrypted,
The authentication system according to claim 1, wherein the decoding unit acquires information on the face feature point by decoding the authentication code using the decryption key.   The authentication system according to claim 1, wherein the authentication unit authenticates the user when all of the items extracted from the face image as the face feature points match.   The authentication system according to claim 1, wherein the authentication unit authenticates the user when at least a part of items extracted from the face image coincide with each other as the face feature point. The storage means stores the face image data output to the code generator,
The display means, the authentication system according to any one of claims 1 to 4, characterized in you to view the face image data stored in the storage means in accordance with a predetermined instruction.

Images