JP6151120B2 - Biometric authentication management system and biometric authentication method therefor - Google Patents

Description

  The present invention relates to biometric authentication using a biometric template (biometric information). In particular, the present invention relates to a technique in which the person himself / herself releases the blocking process with a simple operation when the authentication of the biometric authentication apparatus fails a plurality of times and the blocking process is executed. In addition, when an unauthorized user fails to authenticate the biometric authentication device multiple times and the blocking process is executed, in order to prevent the risk of fraudulent acts again, when the biometric authentication device authentication failed in the past The present invention relates to a technology that uses a biometric template to connect to an unauthorized user.

  As background art in this technical field, there is JP-A-2005-84822 (Patent Document 1). This gazette states that “if the password authentication fails more than a preset number of times, the user is notified by e-mail and the user stops using the account, thereby preventing unauthorized use by an unauthorized user. "Technology to prevent" (see summary). There is JP-A-2009-15500 (Patent Document 2). This gazette states that “one-time password is sent to a mobile phone of a user registered in advance when biometric authentication at ATM fails, and account transaction can be used by authenticating the fixed PIN and one-time password. Technology ".

JP 2005-84822 A JP2009-15500

  In Patent Document 1, an account user recognizes the presence of his / her unauthorized user by e-mail notification, accesses a page for accepting a request for suspension of use easily and quickly, and suspends his / her account. The procedure can be performed quickly. Although e-mail can notify account users of fraudulent use, it cannot be linked to ATM monitoring functions and cannot be used to identify fraudulent users. Therefore, there is a possibility that an unauthorized user may illegally use another user's account, and a technique for preventing new unauthorized use in advance is required.

  In patent document 2, when the biometric authentication at ATM fails and the account transaction is blocked, a one-time password is sent to the user's mobile phone registered in advance, and the user enters the fixed password and emergency password information. As a result of the one-time password authentication, the account can be unlocked. This can improve the convenience of the user by eliminating the effort until the block is released. However, as in Patent Document 1, since it cannot be linked with the ATM monitoring function, it is possible to identify an unauthorized user and to create a new unauthorized use. This cannot be prevented.

  As described above, according to the present invention, in the blocking process related to biometric authentication, it is difficult to identify an unauthorized user who has caused the blocking process and to prevent new unauthorized use. The purpose is to solve.

  In order to solve the above-described problem, in the present invention, when the blocking process is performed according to the biometric authentication result, the blocking process flag indicating that the blocking process has been performed corresponds to the authentication template information used for the biometric authentication. The blockage processing flag is used for subsequent blockage release processing. More specifically, a notification indicating that the authentication template has been blocked (for example, a mobile phone or a smartphone) is sent to the user of the authentication template with the blocking processing flag set, and a “suspicious person notification” is received from the user. If this happens, the corresponding authentication template is managed separately from others.

  This distinct management includes notification to the monitoring center, storing a flag different from the blockage processing flag, and storing an authentication template input for the authentication in a dedicated unauthorized user template table. Further, it is sufficient that at least one of these managements is executed, and two or more managements may coexist.

  Furthermore, when using an unauthorized user template table, in order to confirm whether or not the user is an unauthorized user in biometric authentication, the contents of the table are compared with the input authentication template. For this reason, it is more preferable that the authentication templates to be stored are sorted or grouped according to a predetermined standard, and the comparison is performed in the sorted or grouped order. Examples of the predetermined standard include date and time of authentication, biometric authentication device that performed authentication, similarity, and the like. When sorting or grouping by similarity, the comparison is performed as follows. Of the authentication templates stored in the unauthorized user template table, comparison is made with the two authentication templates having the largest difference in similarity. As a result, a closer template (having a higher degree of similarity) is identified, and comparison is performed in order from the authentication template next to the identified authentication template.

  According to the present invention, when the authentication of the biometric authentication device fails a plurality of times and the blocking process is executed, the user's convenience is improved by releasing the blocking by notifying the mobile phone. Further, when a blockade by an unauthorized user occurs, an authorized user can be identified by reporting the existence of the unauthorized user by an authorized user.

It is the block diagram which showed the whole biometrics authentication system of one Embodiment of this invention. It is a flowchart explaining the authentication process which is one Embodiment of this invention. It is a figure which shows the table information which stores the authentication template at the time of an authentication failure. It is a flowchart which shows the process which preserve | saves the authentication template at the time of an authentication failure in DB, and selects the table which sets a blockage process flag. It is a flowchart which shows the blockage cancellation | release process of a mobile telephone. It is a figure which shows the table information which stores the authentication template of an unauthorized user.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
In this embodiment, an example of a device that performs biometric authentication will be described.
FIG. 1 is an example of a system configuration diagram when a 1: 1 biometric authentication device according to an embodiment of the present invention is configured by a network. Here, the 1: 1 authentication is biometric authentication in which an ID is input in advance and an individual is specified, and then a biometric template (registered template) associated with the input ID is checked.

  Examples of the client side include the following systems (devices). That is, the system 100 is a biometric authentication system, the system 104 is a blockage notification system, and the system 105 is a monitoring system. The system 100, which is a biometric authentication system, includes a biometric authentication device of the device 101, a display of the device 102, and a user ID input device of the device 103. The system 104 that is a blockage notification system includes a mobile phone of the device 112. The system 105, which is a monitoring system, includes a camera of the device 113.

  Hereinafter, the process outline of the system 100 which is a biometric authentication system will be described with reference to the flowchart illustrating the authentication process in FIG. An authentication template photographed when the user holds his / her finger over the biometric authentication device 101 is transmitted to the biometric authentication management server a106 via the network (step 202). Further, in order to perform 1: 1 authentication, a user ID input for identifying itself is accepted from the user via the user ID input device 103 (step 201), and is transmitted to the biometric authentication management server a106. Note that the authentication template and the accepted user ID may be transmitted together. In these transmissions, the biometric authentication device 101 uses the clock function of itself to specify the photographing time of the authentication template and also transmits this.

  The biometric authentication management server a106 side searches the biometric template table 107 and identifies the biometric template corresponding to the transmitted ID. Then, the identified biometric template is compared with the transmitted authentication template (step 204).

  If the verification is successful, the biometric authentication management server a106 transmits the authentication result to the biometric authentication device 101, and the biometric authentication device 101 displays the authentication result on the display 201 (step 205).

  As a result of the verification, if authentication fails, the authentication result is displayed on the display 201 as in step 205, and the biometric authentication management server a106 displays the user ID, the authentication template, and the imaging time via the network. The biometric authentication management server b108 stores the transmitted user ID, authentication template, and shooting time in association with each other in the authentication failure template storage table 109 (step 206). The stored contents are as shown in FIG.

  Next, it is determined whether the number of consecutive authentication failures is less than 10 or more than 10 (step 207). This determination process is performed as follows. For example, it is determined whether or not the same user ID exists 10 times or more within a predetermined period. Further, as the name suggests, it may be determined whether the “user ID” column of the authentication failure template storage table 109 shown in FIG. In addition, 10 times is an example, and this number can be changed as appropriate. Further, an authentication failure template storage table 109 may be prepared for each user ID, and determination may be made using this.

  If the number of consecutive authentication failures is less than 10, the imaging process is executed again (step 202). Specifically, the biometric authentication management server b108 transmits a re-imaging instruction to the biometric authentication device 101. In response to this, the biometric authentication device 101 causes the display 102 to display a message prompting re-photographing. And the process after step 202 is performed. The user ID need not be re-input. This is because the biometric authentication device 101 retains the user ID input at the time of the previous photographing and uses it. However, the biometric authentication device 101 displays the input user ID until the authentication process is completed on the display 102, and when the user confirms this, if it is determined that it is not his own user ID, Re-input is performed, and this is transmitted from the biometric authentication device 101.

  If the number of consecutive authentication failures is 10 or more, the biometric authentication device 101 is closed (step 208). Details of this process will be described with reference to FIG.

  First, the biometric authentication management server b108 sets a blocking process flag on the corresponding template information in the authentication failure template storage table 109 (step 301). This sets a blockage processing flag for recent information. Note that the record for which the blockage flag is to be set does not have to be the latest, and may be set to one of the same usage flags.

  Next, the biometric authentication device 101 is closed (step 302). That is, the biometric authentication management server b108 transmits instruction information that disables the use to the biometric authentication device 101 that has transmitted the information with the blockage processing flag set. In response to this, the biometric authentication device 101 suppresses activation or input.

  In this blocking process, the user ID may be blocked. Specifically, information indicating that the user ID for which the blocking process flag is set is blocked is recorded separately.

  For this reason, in step 204, the information indicating that the blockage has occurred is first confirmed. If there is no such information, the above-described matching process is executed. Further, such user ID blocking and biometric authentication device blocking processing may be performed together.

  Next, the biometric authentication management server b108 notifies the user's mobile phone 112 associated with the user ID included in the information on which the blockage process flag is set, by e-mail that the blockage process has been executed (Step S108). 303). For example, the associated mobile phone is specified using the user management table of the biometric authentication management server b108. Further, the notification destination may be a PC other than a mobile phone, or a means other than e-mail.

  As an example, in the authentication failure template storage table 109 of FIG. 3, the template information of item number 10 has the same user ID from item number 1 to item number 10 and has been stored in the DB ten times or more continuously. . Therefore, as a result of executing the blocking process shown in FIG. 4, the blocking process flag is set in the template information of item number 10.

  Next, it is a flowchart showing the blockage release processing in the mobile phone 112 that has been notified in step 303. When the mobile phone 112 receives a mail notifying that the block process has been executed, the mobile phone 112 accesses the blockage release screen of the website from the link described in the mail in accordance with the input / designation from the user (step 401). This access destination is the biometric authentication management server c110. However, the following processing may be executed using another server (apparatus) as an access destination.

  The button to select “1. Release block” or “2. Report unauthorized user” is displayed on the release screen. The mobile phone 112 accepts selections from the user for the two buttons (step 402).

  When “1. Release occlusion” is selected, the biometric authentication management server c110 causes the mobile phone 112 to display a screen for accepting the input of the PIN code assigned to each user (step 403).

  Next, the mobile phone 112 receives the PIN code input by the user and transmits it to the biometric authentication management server c110. Then, the biometric authentication management server c110 collates the transmitted PIN code with a previously registered PIN code (step 404). The biometric authentication management server c110 identifies a user, that is, a user ID, in the above link, and a PIN code registered in advance is also registered for each user ID. For this reason, the above collation collates PIN codes whose user IDs coincide with each other.

  When the PIN code authentication is successful, the blocking process of the biometric authentication device 101 is released (step 405). This release is realized by transmitting information indicating that the blockage is released from the biometric authentication management server c110 to the biometric authentication device 110. Also, in the case of a mode for blocking a user ID, a block release instruction including a user ID that is a block release target is transmitted to the biometric authentication management server a106, and the biometric authentication management server a106 blocks the user ID. Execute invalidation processing such as deleting the information to the effect.

  If the PIN code authentication fails, the biometric authentication management server c110 transmits information for requesting the user to input the PIN code again to the mobile phone 112 (step 403). Note that this re-input request is executed only for a predetermined upper limit number of times, and if this is exceeded, the processing itself may be terminated.

  When “2. Unauthorized user notification” is selected, the biometric authentication management server c110 collates the biometric template with the blocking process flag and information in the unauthorized user template table 111 (step 406). The unauthorized user template table 111 is as shown in FIG. 6 and records an authentication template in which a blocking process flag is set. This is registered in step 408 described later.

  Then, as a result of the collation, the biometric authentication management server c110 determines whether or not the unauthorized user template table 111 includes an authentication template having a degree of similarity with the biometric template that is equal to or greater than a predetermined threshold (step 407). ). These processes in steps 406 and 407 are performed as follows. First, a biometric template with an occlusion flag set is extracted from the authentication failure template storage table 109. This and the authentication template stored in the unauthorized user template table 111 are collated one by one in the order of records shown in FIG. 6 (from the top to the bottom), and the degree of similarity is calculated. At this time, when the degree of similarity equal to or greater than the threshold is calculated, the subsequent matching process may be omitted.

  Further, the unauthorized user template table 111 is stored in a record closer to the similarity (for example, stored in the order of similarity to the reference data), and two authentication templates and biometric templates having the most similarities are stored. The comparison may be made in order from the next authentication of the authentication template having the higher similarity. Further, the unauthorized user template table 111 may be grouped based on the similarity. In this case, a biometric template that represents each group may be determined, and collation may be performed from a group having a high degree of similarity that is a collation result with these templates.

  Further, the unauthorized user template table 111 may be registered in order of photographing date and time, and these may be collated in the order closer to the present. This is because there is a higher probability of hits in the time zone closer to the present time because unauthorized use was identified at an older date and time, and attempts to make unauthorized use many times during a certain time zone It is. In addition to the shooting date and time, the biometric authentication device that has been illegally used is sorted (eg, the authentication template for a closer device is stored in a closer record), and the biometric template that is the target of verification You may collate in order from the authentication template of the biometric authentication device in which the image is taken.

  The grouping of the unauthorized user template table 111 may be based on the shooting date / time or biometric authentication device. At this time, the storage order of authentication templates in each group may be set as the similarity, and the collation order in the group may be started after the authentication template having the high similarity as described above.

  Here, in the case of sorting or grouping based on the photographing date / time and biometric authentication device, the biometric authentication management server c110 receives the photographing date / time of the biometric template and the photographed biometric authentication device from the biometric authentication management server b108. Receive identifying information. This may be received together with the biological template.

  If an authentication template is included in step 407 (that is, if the similarity is greater than or equal to a threshold value), it is determined that there is a high possibility that the current user has made unauthorized use in the past. In this case, the biometric authentication management server c110 notifies the monitoring center (step 409). Then, the camera 113 of the monitoring center is activated in accordance with the notification from the biometric authentication management server c110 (step 410). This may be performed independently by the monitoring center after the notification, or may be performed in accordance with the control signal of the camera 113 included in the notification. For this reason, the notification includes information for specifying the biometric authentication device 101 to be blocked or the camera 113 associated therewith.

  Thereafter, the monitoring center dispatches security guards (step 411), and identifies unauthorized users as a result of the dispatch (step 412). In this case, the biometric authentication management server c110 may output the turnout instruction information for step 411 or specify the unauthorized user in step 412 based on the contents captured by the camera 113.

  If no unauthorized user template equal to or greater than the threshold is detected in step 407, the template information with the blocking process flag set is newly saved in the unauthorized user template (step 408).

  As an example, in the authentication failure template storage table 109 of FIG. 3, a blocking processing flag is set for the template information of item number 10, but this template information is collated with the information stored in the unauthorized user template table 111 of FIG. I do. As a result of calculating the matching degree between the template information of the item number 100 in the unauthorized user template table 110 and the template information in which the blocking process flag is set, a result of the threshold value or more is obtained. Thereafter, the camera 113 of the monitoring system 105 can be activated to connect to an unauthorized user.

Claims (5)

The first biometric authentication management server, the second biometric authentication management server, and the third biometric authentication management server constituting the biometric authentication management system that executes biometric authentication using the biometric information of the user executes the following processes. In the biometric authentication method,
The first biometric authentication management server stores a user ID for each user in association with a biometric template corresponding to the biometric information of the user in a biometric template table,
The second biometric authentication management server performs authentication by associating the photographing time of the user, the user ID, a biometric template that is a biometric template for which biometric authentication has failed, and a blockage flag indicating whether the biometric template has been blocked. Remember it in the failure template table,
The third biometric authentication management server stores an unauthorized user template that is a biometric template that satisfies a predetermined condition among the authentication failure templates in an unauthorized user template table,
The first biometric authentication management server accepts an authentication request including an authentication template based on the user ID of the user and the biometric information of the user;
The first biometric authentication management server compares the received user ID and authentication template with the biometric template stored in the biometric template table and corresponding to the user ID, thereby authenticating the user. Run
When the third biometric authentication management server fails to authenticate the user ID input as a result of the authentication, the authentication failure template input in the failed authentication is changed to an unauthorized user template table. Compare with the user template, if there is a corresponding one, notify the monitoring center,
The second biometric authentication management server stores the authentication failure template in the authentication failure template table;
When the second biometric authentication management server satisfies the predetermined condition, the second biometric authentication management server stores a blocking flag for the corresponding biometric template in the authentication failure template table,
The second biometric authentication management server notifies the user terminal device indicated by the user ID corresponding to the biometric template in which the block flag is stored that the block flag has been stored,
When the third biometric authentication management server receives an unauthorized user notification request from the terminal device in response to the notification that the block flag is stored, it is similar to the biometric template in which the block flag is stored. Determining whether an unauthorized user template having a degree equal to or greater than a predetermined threshold is stored in the unauthorized user template table;
If the third biometric authentication management server is not stored as a result of the determination, the third biometric authentication management server stores the biometric template in which the blockage flag is stored as an unauthorized user template in the unauthorized user template table.
A biometric authentication method in a biometric authentication management system. The biometric authentication method in the biometric authentication management system according to claim 1,
When the third biometric authentication management server receives the release request for the blocking flag from the terminal device, the terminal device displays a screen for accepting an input of a PIN assigned to each user, A biometric authentication method in a biometric authentication management system, comprising: receiving a PIN input on a screen; performing user authentication using the received PIN; and determining whether to release the block flag. In the biometric authentication method in the biometric authentication management system according to claim 1 or 2,
The biometric authentication method in a biometric management system, wherein the plurality of unauthorized user templates used for comparison with the authentication failure template and the unauthorized user template are used in the order of similarity with reference data. In the biometric authentication method in the biometric authentication management system according to claim 1 or 2,
The plurality of unauthorized user templates used for comparison with the authentication failure template and the unauthorized user template are used in the order based on the date and time of the failed authentication or the biometric authentication device that performed the failed authentication. A biometric authentication method in a biometric authentication management system. In a biometric authentication management system that performs biometric authentication using user biometric information,
The first biometric authentication management server constituting the biometric authentication management system stores the user ID for each user in association with the biometric template corresponding to the biometric information of the user in the biometric template table,
The second biometric authentication management server constituting the biometric authentication management system indicates the user's imaging time, user ID, biometric template that is a biometric template that failed biometric authentication, and whether the biometric template is blocked. Store the blockage flag in the authentication failure template table in association with it,
A third biometric authentication management server constituting the biometric authentication management system stores an unauthorized user template that is a biometric template that satisfies a predetermined condition among the authentication failure templates in an unauthorized user template table,
The first biometric authentication management server accepts an authentication request including an authentication template based on the user ID of the user and the biometric information of the user;
The first biometric authentication management server compares the received user ID and authentication template with the biometric template stored in the biometric template table and corresponding to the user ID, thereby authenticating the user. Run
When the third biometric authentication management server fails to authenticate the user ID input as a result of the authentication, the authentication failure template input in the failed authentication is changed to an unauthorized user template table. Compare with the user template, if there is a corresponding one, notify the monitoring center,
The second biometric authentication management server stores the authentication failure template in the authentication failure template table;
When the second biometric authentication management server satisfies the predetermined condition, the second biometric authentication management server stores a blocking flag for the corresponding biometric template in the authentication failure template table,
The second biometric authentication management server notifies the user terminal device indicated by the user ID corresponding to the biometric template in which the block flag is stored that the block flag has been stored,
When the third biometric authentication management server receives an unauthorized user notification request from the terminal device in response to the notification that the blockage flag is stored, the raw body template in which the blockage flag is stored; Determining whether an unauthorized user template whose similarity is equal to or greater than a predetermined threshold is stored in the unauthorized user template table;
When the third biometric authentication management server is not stored as a result of the determination, the third biometric authentication management server stores the biometric template in which the blockage flag is stored in the unauthorized user template table as an unauthorized user template. A biometric authentication management system.

Images