JP6129489B2 - Biometric information acquisition apparatus, biometric authentication system, and biometric information acquisition method - Google Patents

Description

  The present invention relates to a biometric information acquisition apparatus, a biometric authentication system, and a biometric information acquisition method.

  When biometric authentication is performed using finger veins, it is roughly divided into a method (Match On Device method, hereinafter referred to as MOD) in which the authentication is performed on the client terminal used by the end user, and the authentication is performed on the server. (Match On Server method, hereinafter referred to as MOS). In MOS, unlike MOD, in order to perform authentication, it is necessary to send biometric information acquired by a client terminal from a client to an authentication server that performs authentication using an Internet line or the like. Although it depends on the security of the line, there is an increased risk of being stolen or tampered with by a malicious user when sending biometric information. In order to reduce this risk, various security measures are taken when constructing a MOS. For example, it is conceivable to guard biometric information using target encryption or asymmetric encryption. One of these security improvement methods is cancelable biometrics. This is a technology that encrypts biometric information when registering it and uses the encrypted data as it is for authentication.

  There exists Unexamined-Japanese-Patent No. 2010-165323 in the background art of this invention. In this publication, “the conversion code management server manages the conversion code for converting the biometric information data, and when the biometric information is registered, the extracted biometric information data is based on the biometric information data for registration and the conversion code. The converted biometric information data for registration is output, the converted biometric information database management server records and manages the converted biometric information data for registration, and the biometric authentication server extracts the extracted biometric information data when collating biometric information. Input as biometric information data for verification, execute conversion processing based on the conversion code managed by the conversion code management server, output converted biometric data for verification, and convert it to the converted biometric data for verification The registered biometric data for registration managed by the completed server is collated ”.

JP 2010-165323 A

  Patent Document 1 describes an invention in which biometric information data is converted to ensure security, and the biometric authentication server uses the converted biometric information to collate with registered biometric information data that is managed. ing. However, the biometric authentication system of Patent Document 1 does not mention a problem when biometric information data is converted.

  In general, when encrypted data such as cancelable biometrics is used for authentication as it is, the quality of registered data as well as the quality of data used for authentication greatly affects the authentication accuracy. For example, in the case of an encryption method with high nonlinearity that scrambles a biometric authentication image, the image data at the place where it should be originally moved to a completely different place with only a slight shift in the image, and as a result another living body Registered and authenticated.

  Therefore, in the biometric information acquisition device equipped with the present invention, the quality vector of the acquired biometric information, for example, the location vector of the finger, the contrast of the image, the distribution of vein density, etc., record the quality vector not used for biometric authentication, By comparing, it is evaluated whether or not the data is difficult to reject or accept others when performing authentication, and only the data that is considered to be high quality for authentication is sent to the authentication server, and the biometric authentication in MOS Improve accuracy.

  In order to solve the above problems, the present application includes a plurality of means. As an example, a biometric information acquisition unit that acquires biometric information and extracts a feature amount from the biometric information, and the biometric information are acquired. , Measuring information used for calculating a quality vector indicating the quality of the feature quantity, calculating a quality vector using the information, and performing biometric authentication using the quality vector and the feature quantity. A feature quantity quality recording unit that records the results in association with each other, a first quality vector recorded in the feature quantity quality recording unit, and a second value calculated from the information measured when newly acquiring biometric information There is a biometric information acquisition device including a feature quantity quality determination unit that determines whether or not a feature quantity extracted from the newly acquired biometric information is a value suitable for biometric authentication by comparing with a quality vector.

  According to the present invention, it is possible to improve the performance of a system in which the quality of biometric data is considered to have a great influence on the authentication accuracy, such as cancelable biometrics in MOS. In addition, the improvement of the MOS authentication accuracy leads to a reduction in the number of authentication retries, and the network traffic can be improved.

1 is a configuration diagram showing an outline of a biometric authentication system 100. FIG. 2 is a block diagram showing a configuration of each device constituting the biometric authentication system 100. FIG. 3 is a flowchart showing the operation of the biometric authentication system 100. It is a figure which shows the element of a feature-value quality vector. It is a figure which shows the quality vector space of a feature-value quality vector.

  Hereinafter, an embodiment of a biometric authentication system 100 according to the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing a typical configuration when configuring a biometric authentication system 100 using a MOS. The biometric information acquisition apparatus 101 acquires biometric information from the user's finger. In this embodiment, an example in which a finger vein is used as biometric information will be described. However, other biometric information such as a palm vein and a fingerprint may be used. After acquiring the biometric information, the biometric information acquisition device 101 extracts a feature amount from the acquired biometric information, and transmits the biometric feature amount to the host device 102.

  The host apparatus 102 transmits the biometric feature amount sent from the biometric information acquisition apparatus 101 to the biometric authentication server (MOS) 103 via the network 104. When sending the biometric feature quantity to the biometric authentication server 103, the host device 102 also has a role of notifying (controlling) the biometric authentication server 103 whether the data is used for registration or authentication. In addition, when sending to the biometric authentication server 103, the host device 102 encrypts and sends it. However, registration and authentication control can be requested from the biometric authentication server 103 to the host apparatus 102. The biometric authentication server 103 decrypts the encrypted biometric feature amount transmitted from the host device 102, and performs registration and authentication as necessary.

  Next, the configuration of the biometric information acquisition apparatus 101, the host apparatus 102, and the biometric authentication server 103 used in this embodiment will be described with reference to FIG. The biometric information acquisition apparatus 101 includes a near-infrared LED 201 that emits near-infrared light to the finger to read the finger vein, a finger vein sensor 202 that reads a finger vein illuminated by the near-infrared light, and the state of the apparatus (in operation) A state display LED 203 for displaying (in communication, failure, etc.), a feature quantity quality measuring unit 204 for measuring the quality of the finger vein feature quantity read by the finger vein sensor 202, and generating a feature quantity quality vector from the measured feature quantity A feature quantity quality vector recording section 205 for recording and recording, a feature quantity quality vector determining section 206 for evaluating the quality of the feature quantity quality vector, an authentication result recording section 207 for recording the authentication results and results so far, and a host device The communication interface 208 communicates with each other and the control board 209 that controls them. The control board 209 includes a CPU, a memory, a storage device, and the like (not shown).

  The host device 102 records an application 211 that utilizes biometric authentication, a feature amount recording unit 212 that records the feature amount transmitted from the biometric information acquisition device 101, and authentication results and results so far. An authentication result recording unit 213, a biometric information acquisition device device driver 214 for controlling the biometric information acquisition device 101, an OS (Operating System) 215 for the host device 102, and the biometric information acquisition device 101 and the biometric authentication server 103, respectively. It is comprised by the communication interface 216 for communicating with. The host device 102 includes a control unit 217. The control unit 217 includes a CPU, a memory, and the like (not shown), and performs control using the OS 215 for the host device 102.

  The biometric authentication server 103 includes an application 221 that utilizes biometric authentication, a finger vein authentication unit 222 that performs finger vein authentication, a feature amount storage unit 223 that stores feature amounts such as finger veins, and the biometric authentication server An OS 224 and a communication interface 225 for communicating with the host device 102 are configured. The biometric authentication server 102 includes a control unit 226. The control unit 226 includes a CPU, a memory, and the like (not shown), and performs control using the biometric authentication server OS 224.

Next, the operation of the present invention will be described with reference to the operation flowchart of FIG.
First, a request to start authentication is transmitted from the host apparatus 102 to the biometric information acquisition apparatus 101 (S101). The biometric information acquisition apparatus 101 that has received this authentication start request acquires the finger vein data of the user and extracts the feature amount from the finger vein data (S102). The extracted feature quantity is subjected to feature quantity quality measurement by the finger vein device 101 (S103). In the feature quantity quality measurement, the feature quantity quality measurement unit 204 of the finger vein device 101 is used to calculate the feature quantity quality vector value.

  Here, the feature quantity quality vector will be described with reference to FIG. The feature quantity quality vector is a quality index that is not used for biometric authentication other than the feature quantity and is treated as a vector. For example, the vein density and the bias of the feature amount shown in FIG. 4, the contrast of the image of the feature amount itself, the reflection of the fingerprint, the brightness of the environment, the temperature, the humidity, the position where the finger is placed, the background image of the finger, etc. Measured and digitized (evaluated) vector. By using this feature quantity quality vector, it is possible to select a feature having a good feature quantity that is easily authenticated when biometric authentication is performed without actually performing biometric authentication. It is not necessary to perform biometric authentication. In the present embodiment, the quality vector is described as a two-dimensional vector for explanation, but not limited to two dimensions, a high-dimensional vector may be handled.

  Next, the feature quantity quality vector calculated by the feature quantity quality measurement unit 204 is determined using the feature quantity quality vector determination unit 205 (S104). The feature quantity quality vector check (S104) confirms whether or not the calculated feature quantity quality vector has a certain quality. Details of the confirmation method will be described later. If the acquired feature quantity does not have a quality equal to or higher than a predetermined threshold value, the feature quantity is extracted again from the user's biological information and the feature quantity quality vector is determined (S104: NO). If the calculated feature quantity quality vector is equal to or greater than the threshold (S104: Yes), the finger vein device 101 stores the feature quantity quality vector in the feature quantity quality vector storage unit 205 (S105), and transmits the feature quantity to the host device 102. To do.

  In the case of the first biometric authentication performed using the biometric information acquisition apparatus 101, the biometric information acquisition apparatus 101 does not accumulate feature quantity quality vectors. The feature quantity quality vector check (S104) may be skipped, and the feature quantity quality vector may be stored, and then the feature quantity may be transmitted to the host apparatus 102.

  The host device 102 that has received the feature value from the biometric information acquisition apparatus 101 transmits the received feature value to the biometric authentication server 103 (S107). The biometric authentication server 103 that has received the feature amount from the host device 102 uses the finger vein authentication unit 222 to compare the feature amount stored in the feature amount storage unit 223 with the received feature amount, and determine a match / mismatch. , (S108), the authentication result is returned to the host apparatus 102.

  The host apparatus 102 that has received the authentication result determines the authentication result by the application 211 (S110). For example, when biometric authentication is used for authentication in electronic commerce settlement such as Internet shopping, it is conceivable to set the settlement as successful or unsuccessful with this authentication result. When the host device 102 determines that the authentication has failed (S110: authentication failure), the application communicates with the biometric information acquisition device 101 so that the feature amount is re-extracted by the application. The biometric information acquisition apparatus 101 that has received the communication stores the authentication failure information in the feature quantity quality vector associated with the transmitted feature quantity together with the authentication failure information (S111), and extracts the feature quantity again. After extracting the feature amount, the above operation is performed, and biometric authentication is performed again. Although the present embodiment has been described on the assumption that the feature amount is re-extracted, when the higher-level device 102 determines that the authentication has failed, the processing may be terminated as it is.

  If the host device 102 determines that the authentication has succeeded (S110: authentication success), the result is transmitted to the biometric information acquisition device 101 (S112). Further, the application 211 executes processing using the result of the authentication success.

  From the authentication result sent from the host apparatus 102, the biometric information acquisition apparatus 101 uses the feature quantity quality vector of the feature quantity that has failed authentication among the feature quantities sent to the host apparatus 102. And the feature quantity quality vector of the feature quantity that has been successfully authenticated is recorded as a feature quantity quality vector that is likely to be successfully authenticated (S111, S113). In this way, the biometric information acquisition apparatus 101 records the distribution of feature quantity quality vectors that have been successfully authenticated, so that the feature close to the distribution of feature quantity quality vectors that have been successfully authenticated at the time of quality check at the time of next authentication. The amount is sent to the host device 102, and on the contrary, it is considered that authentication failure is likely to occur, that is, the feature amount of the feature vector that is away from the distribution of the quality vector that has been successfully authenticated is determined as the feature amount that is highly likely to fail authentication. Then, the operation of acquiring the feature amount can be performed again. After storing the feature quantity quality vector, the biometric information acquisition apparatus 101 ends the authentication.

  Next, quality check and storage of feature quantities having feature quantity quality vectors that are likely to succeed in authentication or fail in authentication will be described in detail. A feature quantity quality vector distribution image 502 that is likely to succeed in authentication and a feature quantity quality vector distribution image 503 that is likely to fail authentication are shown in the quality vector space 501 of the feature quantity quality vector in FIG. Actually, it may be more than two dimensions, but for convenience, a two-dimensional quality vector space is shown here. FIG. 5 is a vector space configured with “vein density” and “bias density bias” as elements of the feature quantity quality vector of FIG. It is also possible to construct a vector space using all the elements of FIG. 4, in which case the feature quantity quality vector is evaluated in an 8-dimensional vector space.

  In the present invention, the quality value quality vector of the feature quantity that has succeeded in authentication and the feature quantity quality vector of the feature quantity that has failed in authentication are obtained from the authentication result transmission (S110, S111) of the authentication success from the upper apparatus 102. Record and map in vector space. At this time, the biometric information acquisition apparatus 101 records a plurality of feature quantity quality vectors of feature quantities that have been successfully authenticated and feature quantity quality vectors of feature quantities that have failed to be authenticated. The capacity that can be stored is determined by the capacity and specifications of the biological information acquisition apparatus 101.

  When the biometric information acquisition apparatus 101 receives a command for performing biometric authentication from the host apparatus 102 and extracts the feature quantity, the feature quantity quality measurement is performed, and the quality vector of the feature quantity extracted at that time is recorded as described above. It is compared with the feature quantity quality vector, and it is determined whether or not the feature quantity quality vector is suitable for biometric authentication. As a determination method, when the distance value in the quality vector space is close to a quality vector that has been successfully authenticated in the past, the extracted feature value is determined as a feature value that is likely to succeed in biometric authentication. If it is close to a vector, the extracted feature value is determined as a feature value that is likely to cause biometric authentication to fail.

  The determination method will be described in more detail. Regarding the feature quantity quality vector 503 calculated from the feature quantity extracted from the biometric, the distribution image 502 of the feature quantity quality vector having many feature quantities that are likely to succeed in biometric authentication and the feature quantity that has many feature quantities that are likely to fail in biometric authentication. Distances 505 and 506 in the quality vector space with the quality vector distribution image 503 are respectively calculated. In this embodiment, the distance between the center 507 of the distribution image 502, the center 508 of the distribution image 503, and the feature quantity quality vector 503 is calculated. The target for calculating the distance is not necessarily the center of the distribution image, and may be determined in consideration of the deviation of the distribution image.

  By comparing the calculated distance 505 and distance 506, it is determined to which distribution image the feature quantity quality vector 503 belongs. If it belongs to the distribution image 502, the feature quantity is transmitted to the host apparatus 102 as it is. If it belongs to the distribution image 503, the feature amount is extracted again, and the suitability of the quality vector is confirmed.

  As a result, it is possible to expect improvement in authentication accuracy by not performing feature amount transmission 305 from the biometric information acquisition apparatus 101 to the higher-order upper apparatus 102 until a feature quantity that is determined to be likely to be successfully authenticated is extracted. In addition, since communication is not performed between the host apparatus 102 and the biometric authentication server 103, the number of authentication retries due to authentication failure is reduced, and improvement in network traffic can be expected. In particular, when receiving communication from a large number of host devices such as MOS and performing biometric authentication, the number of times of communication decreases as a whole, so network traffic is improved and waiting time due to authentication is reduced. Authentication can be performed.

  In the first embodiment, a system that performs biometric authentication efficiently by the biometric information acquisition apparatus 101, the host apparatus 102, and the biometric authentication server 103 communicating with each other has been described. However, depending on the system configuration, there may be a case where the biometric information acquisition apparatus 101 cannot receive a biometric authentication result from the host apparatus 102. In particular, when constructing a biometric authentication system, it is often sufficient to manage the authentication result only with the host apparatus 102 and the biometric authentication server 103 that control the operation of the application, and there is no need to transmit the result feedback to the biometric information acquisition apparatus 101. . In this case, it is difficult in terms of the system configuration to record whether the feature amount transmitted to the host apparatus 102 by the biometric information acquisition apparatus 101 has been successfully authenticated or has failed. Therefore, in the present embodiment, description will be given of the storage of the feature quantity quality vector when only the authentication success or the authentication failure can be received from the higher-level device 102.

  When a normal biometric authentication system is constructed, biometric authentication is repeated until authentication is successful. For example, when biometric authentication fails, there is a biometric authentication system that repeats authentication retry (feature amount re-extraction) until success. In this case, a feature amount re-extraction 310 request is returned when the biometric information acquisition apparatus 101 sends a feature quantity to the host apparatus 102 in order to determine whether or not the feature quantity is likely to be successfully authenticated. The quality vector of the feature quantity that has been recorded is recorded as a quality vector that has failed authentication.

  In a biometric authentication system, authentication is usually repeated until authentication is successful. For example, a feature is obtained when a feature amount is continuously acquired at a predetermined interval until authentication is successful, and it is detected that a finger is separated from the biometric information acquisition apparatus 101 or a notification of the end of biometric authentication is received from the host apparatus 102. A biometric authentication system that terminates the acquisition of the quantity can be considered. In this case, when biometric authentication is completed without sending a feature amount re-extraction request from the host device 102 when the feature amount is transmitted to the host device 102, the feature amount is transmitted several times after the last or last transmission. It is highly possible that the acquired data has succeeded in biometric authentication.

  Therefore, the feature amount and its quality vector when the feature amount is transmitted to the host device 102 are stored, and the storage time is also stored. Depending on the storage capacity of the biometric information acquisition apparatus 101, it may not be possible to store a number of quality vectors that exceed the storage capacity. In this case, the number of quality vectors that can be stored in order from the latest is stored, and the storage capacity is increased. If it exceeds, the new quality vector is overwritten in order from the old quality vector. In this way, the latest feature quantity and quality vector are recorded every time the feature quantity transmission 305 is performed, and the latest feature quantity and quality vector stored when the authentication is completed is saved as a feature quantity and quality vector that has been successfully authenticated. To do.

  Next, when performing biometric authentication, the feature quantity and quality vector extracted at the time of authentication are compared with the quality vector of the feature quantity that has been successfully authenticated and the quality vector of the feature quantity when the authentication has failed, as in the first embodiment. It is possible to evaluate whether the feature amount is likely to succeed in the authentication or whether the authentication is likely to fail, and the result can be used to improve the authentication accuracy.

  As described above, in the present invention, an appropriate quality vector space distribution can be created even when there is no feedback of the authentication result from the host apparatus 102.

  In addition, a present Example is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of a certain embodiment can be replaced with a configuration of another embodiment, and a configuration of another embodiment can be added to a configuration of a certain embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a memory, a recording device such as HDD or SSD, or a recording medium such as an SD card.

DESCRIPTION OF SYMBOLS 100: Biometric authentication system, 101: Biometric information acquisition apparatus, 102: Host apparatus, 103: Authentication server, 104: Network, 201: Near infrared LED, 202: Finger vein sensor, 203: Status display LED, 204: Feature quantity quality Measurement unit 205: Feature quantity quality vector recording unit 206: Feature quantity quality vector discrimination unit 207: Authentication result recording unit 208: Communication interface 209: Control board 211: Application 212: Feature quantity storage unit 213 : Authentication result recording unit, 214: Device driver for biometric information acquisition device, 215: OS, 216: Communication interface, 217: Control unit, 221: Application, 222: Finger vein authentication unit, 223: Feature quantity storage unit, 224: OS, 225: communication interface, 226: control unit, 401: Elements of symptoms amount quality vector, 501: quality vector space, 502: distribution image, 503: distribution image, 504: feature quantity quality vector, 505: Distance, 506: Distance, 507: center, 508: center

Claims (6)

A biometric information acquisition unit that acquires biometric information and extracts feature values used for biometric authentication from the biometric information;
A feature quantity quality measurement unit for measuring information used for calculating a quality vector indicating the quality of the feature quantity when obtaining the biometric information, and calculating the quality vector not used for biometric authentication using the information; ,
A feature quantity quality recording unit that records the quality vector and the result of biometric authentication using the feature quantity in association with each other;
By comparing the first quality vector recorded in the feature quantity quality recording unit with the second quality vector calculated from the information measured when newly acquiring biological information, the newly acquired biological body A feature quantity quality determination unit that determines whether or not the feature quantity extracted from the information is a value suitable for biometric authentication ;
A communication unit that communicates with a biometric authentication server that performs biometric authentication,
When the feature quantity quality determination unit determines that the feature quantity extracted from the newly acquired biometric information is suitable for biometric authentication, the feature quantity quality determination unit extracts the feature quantity extracted from the newly acquired biometric information by the communication unit. To
Receiving success or failure of biometric authentication from the biometric authentication server;
The biometric information acquisition apparatus, wherein the feature quantity quality recording unit stores success or failure of biometric authentication received together with the second quality vector. The biological information acquisition apparatus according to claim 1,
When determining the quality of the newly extracted feature quantity, the feature quantity quality determination unit fails in the successful quality vector or biometric authentication in which the second quality vector has succeeded in biometric authentication out of the first quality vector. A biometric information acquisition device characterized by determining which of the failure quality vectors it belongs to. The biological information acquisition apparatus according to claim 2 ,
The first quality vector and the second quality vector are at least the vein density of the living body, the bias of the vein density, the contrast of the image, the reflection of the fingerprint, the brightness of the environment, the humidity, the temperature, the position where the living body is placed, A vector composed of elements containing any of the background images of the living body,
The feature quantity quality determination unit calculates a distance between the second quality vector, the distribution of the success quality vector, and the distribution of the failure quality vector, and the distribution of the quality vector that is close to the distance When it is determined that the second quality vector is classified, and the second quality vector is classified as the success quality vector, it is determined whether the distance is a predetermined value, and whether the quality is suitable for biometric authentication. A biological information acquisition device characterized by determining whether or not. A biometric information acquisition device that acquires biometric information and extracts feature values used for biometric authentication from the biometric information;
A host device that receives the feature quantity from the biometric information acquisition device and transmits it to the biometric authentication server;
The biometric authentication server that performs biometric authentication using the feature amount received from the host device,
The biological information acquisition device
A feature quantity quality measurement unit for measuring information used for calculating a quality vector indicating the quality of the feature quantity when obtaining the biometric information, and calculating the quality vector not used for biometric authentication using the information; ,
A feature quantity quality recording unit that records the quality vector and the result of biometric authentication using the feature quantity in association with each other;
By comparing the first quality vector recorded in the feature quantity quality recording unit with the second quality vector calculated from the information measured when newly acquiring biological information, the newly acquired biological body have a determining feature amount quality judgment unit features extracted from the information as to whether or not a value suitable for the biometric authentication,
When the biometric information acquisition device determines that the feature amount quality determination unit is suitable for biometric authentication, the biometric information acquisition device transmits the feature amount extracted from the newly acquired biometric information to the biometric authentication server via the host device. ,
The biometric authentication server performs biometric authentication using the feature amount received from the biometric information acquisition device, transmits an authentication result of biometric authentication to the biometric information acquisition device via the host device,
The biometric authentication system, wherein the feature quantity quality recording unit stores success or failure of biometric authentication together with the second quality vector. The biometric authentication system according to claim 4 ,
When determining the quality of the newly extracted feature quantity, the feature quantity quality determination unit fails in the successful quality vector or biometric authentication in which the second quality vector has succeeded in biometric authentication out of the first quality vector. A biometric authentication system characterized by determining which of the failure quality vectors belongs to. The biometric authentication system according to claim 5 ,
The first quality vector and the second quality vector are at least the vein density of the living body, the bias of the vein density, the contrast of the image, the reflection of the fingerprint, the brightness of the environment, the humidity, the temperature, the position where the living body is placed, A vector composed of elements containing any of the background images of the living body,
The feature quantity quality determination unit calculates a distance between the second quality vector, the distribution of the success quality vector, and the distribution of the failure quality vector, and the distribution of the quality vector that is close to the distance When it is determined that the second quality vector is classified, and the second quality vector is classified as the success quality vector, it is determined whether the distance is a predetermined value, and whether the quality is suitable for biometric authentication. A biometric authentication system characterized by determining whether or not.

Images