JP7260145B2 - Authentication device, authentication terminal, authentication method, program and recording medium - Google Patents

Description

The present invention relates to an authentication device, an authentication terminal, an authentication method, a program, and a recording medium.

Conventionally, an authentication method using biometric information has been widely used as a method of personal identification. A conventional authentication device registers biometric information for verification in a server or the like in advance, and collates the biometric information obtained from a camera or the like with the biometric information for verification via the Internet (Patent Document 1).

Japanese Patent No. 6151582

However, registering personal information such as biometric information in a server or the like poses risks such as information leakage. Furthermore, there is a problem that a human load such as registration and management is required.

SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide an authentication device and an authentication method that have high security performance and can be easily used by a user.

In order to achieve the above object, the authentication device of the present invention
Including a position detection confirmation unit, a personal authentication data acquisition unit, a biometric information acquisition unit, and an authentication unit,
The position detection/confirmation unit detects the positions of a person to be authenticated and a terminal carried by the person to be authenticated, and confirms whether the person to be authenticated and the terminal are located in an authentication area,
Personal authentication data is stored in the terminal,
The personal authentication data acquisition unit acquires personal authentication data stored in the terminal,
The biometric information acquisition unit acquires the biometric information of the person to be authenticated,
In the position detection/confirmation unit, when the person to be authenticated and the terminal are located in the authentication area, the authentication unit compares the person to be authenticated data and the biometric information of the person to be authenticated, and A device for generating a verification result that the person to be authenticated is authenticated as the person if the biometric information matches, and that the person to be authenticated is not authenticated as the person if the person authentication data and the biometric information do not match. is.

The authentication method of the present invention is
Including a position detection confirmation process, a personal authentication data acquisition process, a biometric information acquisition process, and an authentication process,
The position detection and confirmation step detects the positions of a person to be authenticated and a terminal carried by the person to be authenticated, and confirms whether or not the person to be authenticated and the terminal are located in an authentication area,
Personal authentication data is stored in the terminal,
The personal authentication data obtaining step obtains personal authentication data stored in the terminal,
The biometric information acquisition step acquires the biometric information of the person to be authenticated,
In the position detection and confirmation step, when the person to be authenticated and the terminal are located in the authentication area, the authentication step compares the person to be authenticated data and the biometric information of the person to be authenticated, and A method of generating a verification result that the person to be authenticated is authenticated as the person if the biometric information matches, and that the person to be authenticated is not authenticated as the person if the person authentication data and the biometric information do not match. is.

The authentication terminal of the present invention is
connectable to the authentication device of the present invention via a communication network,
Including a terminal-side communication unit, a storage unit, and a terminal-side authentication unit,
The terminal-side communication unit communicates with the authentication device,
The storage unit stores the personal authentication data,
The terminal-side authenticating unit compares the personal authentication data with the biometric information of the person to be authenticated when the person to be authenticated and the terminal are located in the authentication area in the position detection and confirming unit. and when the biometric information matches, the person to be authenticated is authenticated as the person, and when the person authentication data and the biometric information do not match, the person to be authenticated is not authenticated as the person. , the device.

An authentication method in a mobile terminal of the present invention uses the authentication device of the present invention,
including a communication process, a storage process, and a terminal-side authentication process,
The communication step communicates with the authentication device via a communication network,
The storing step stores the personal authentication data,
In the terminal-side authentication step, when the person to be authenticated and the terminal are located in the authentication area, the position detection/confirmation unit compares the person to be authenticated with the biometric information of the person to be authenticated. and when the biometric information matches, the person to be authenticated is authenticated as the person, and when the person authentication data and the biometric information do not match, the person to be authenticated is not authenticated as the person. , is the method.

According to the present invention, for example, security performance is high, and users can easily use it.

FIG. 1 is a block diagram showing the configuration of an example of the apparatus of Embodiment 1. FIG. FIG. 2 is a block diagram showing an example of the hardware configuration of another example of the apparatus of the first embodiment; FIG. 3 is a flow chart showing an example of processing in the device according to the first embodiment. FIG. 4 is a block diagram showing the configuration of an example of the device according to the second embodiment. FIG. 5 is a block diagram showing the configuration of an example of the device according to the third embodiment. FIG. 6 is a block diagram showing an example configuration of a terminal according to the fourth embodiment. FIG. 7 is a block diagram illustrating an example of a hardware configuration of a terminal according to the fourth embodiment; FIG. 8 is a flowchart illustrating an example of processing in a terminal according to the fourth embodiment; FIG. 9 is a schematic diagram showing an example of the outline of the apparatus of Embodiment 1. FIG. FIG. 10 is a schematic diagram showing an example of the outline of the apparatus of Embodiment 1. FIG.

In the apparatus of the present invention, the person to be authenticated and the terminal are a plurality of the persons to be authenticated and the terminal, and the position detection/confirmation unit sets detection/confirmation positions within the authentication area, and The acquisition unit specifies the terminal existing at the detection confirmation position from among the plurality of terminals and acquires personal authentication data stored in the terminal, and the biometric information acquisition unit selects the plurality of authentication targets. The person to be authenticated who is present at the detection confirmation position is specified from among the persons to be authenticated, biometric information is acquired, and the authentication unit generates a verification result of the specified person to be authenticated. good.

In the device of the present invention, the biometric information acquisition unit may continuously acquire the biometric information of the person to be authenticated existing in the authentication area.

The device of the present invention further includes a personal authentication data updating unit, and the personal authentication data updating unit updates the personal biometric information data used for the verification when the authentication result of the authenticating unit is generated. is generated as updated personal authentication data, and the personal authentication data stored in the terminal can be updated using the updated personal authentication data.

The apparatus of the present invention may further include an output unit, and the output unit may output an operation instruction associated with the collation based on the result of the collation.

The authentication terminal of the present invention further includes a personal authentication data conversion unit,
The personal authentication data conversion unit may convert the biometric information into personal authentication data.

In the authentication method of the present invention, the person to be authenticated and the terminal are a plurality of the persons to be authenticated and the terminal, and in the position detection and confirmation step, detection and confirmation positions are set within the authentication area, and the person is authenticated. The data acquisition step specifies the terminal existing at the detection confirmation position from among the plurality of terminals and acquires personal authentication data stored in the terminal; The person to be authenticated who is present at the detection confirmation position is specified from among the persons to be authenticated and biometric information is acquired, and in the authentication step, a collation result of the specified person to be authenticated is generated. good too.

In the authentication method of the present invention, the biometric information acquisition step may continuously acquire the biometric information of the person to be authenticated existing in the authentication area.

The authentication method of the present invention further includes a personal authentication data updating step, and the personal authentication data updating step includes, when the authentication result of authenticating the person is generated in the authentication step, the personal biometric information used for the verification. Data may be generated as updated personal authentication data, and the personal authentication data stored in the terminal may be updated with the updated personal authentication data.

The authentication method of the present invention may further include an output step, and the output step may output an action instruction associated with the collation based on the result of the collation.

The authentication method in the mobile terminal of the present invention further includes a personal authentication data conversion step,
The personal authentication data conversion step may convert the biometric information into personal authentication data.

A program of the present invention is a program capable of executing the authentication method of the present invention and the authentication method in the portable terminal of the present invention on a computer.

A recording medium of the present invention is a computer-readable recording medium recording the program of the present invention.

The person to be authenticated in the present invention is not particularly limited, and is a person to be verified (identity verification).

An embodiment of the present invention will be described with reference to the drawings. The invention is not limited to the following embodiments. In each figure below, the same reference numerals are given to the same parts. In addition, the description of each embodiment can be used with reference to each other's description unless otherwise specified, and the configurations of the respective embodiments can be combined unless otherwise specified.

[Embodiment 1]
FIG. 1 is a block diagram showing an example configuration of an authentication device 1 of this embodiment. As shown in FIG. 1 , the authentication device 1 includes a position detection/confirmation unit 11 , a personal authentication data acquisition unit 12 , a biometric information acquisition unit 13 and an authentication unit 14 .

The device 1 may be, for example, a single device including the above units, or may be a device in which the above units can be connected via a communication network. Although not shown, the device 1 can be connected to a terminal carried by the person to be authenticated via the communication network. Furthermore, the apparatus 1 can be connected to a terminal of a system administrator via the communication network, and the system administrator may manage the apparatus 1 from the terminal. The communication line network is not particularly limited, and a known network can be used, and may be wired or wireless, for example. The communication network includes, for example, the Internet line, telephone line, LAN (Local Area Network), WiFi (Wireless Fidelity), and the like. The device 1 may be incorporated in a server as a system, for example. Also, the device 1 may be, for example, a personal computer (PC) in which the program of the present invention is installed.

The terminal is not particularly limited, and examples thereof include PCs, smart phones, tablets, mobile phones, wearable devices such as spectacles, RF-ID (Radio Frequency Identification), IC cards, and the like.

The device 1 may further include a communication section 17 . FIG. 10 shows an example of a schematic of the authentication device 1 and an external device. In FIG. 10, the camera 110, the WiFi 111, the fingerprint sensor 112, the terminal 50 of the person to be authenticated 40, and the like are shown as the external devices, but the external devices are not limited to these. The device 1 can be connected to the communication network 30 by the communication unit 17 and can be connected to each of the external devices via the communication network 30 .

The external device can be used, for example, to acquire the biometric information. The external device used to acquire the biometric information is not particularly limited, and for example, a known biometric information acquisition device or the like can be used. Specifically, a camera, a fingerprint sensor, a vein sensor, and the like can be mentioned. In FIG. 10, a camera 110 and a fingerprint sensor 112 are shown as examples of the biometric information acquisition device, but the device is not limited to this. For example, the biometric information acquisition device may acquire the biometric information through contact with the person to be authenticated, or may acquire the biometric information without contact. The installation location of the biometric information acquisition device is not particularly limited as long as it is a location where the biometric information of the person to be authenticated can be acquired. For example, it can be installed at the entrance of a predetermined area. Examples of the area include public facilities, facilities of companies, spaces such as event venues, in front of ATMs, in front of payment machines in stores, and the like. The number of the biometric information acquisition devices is not particularly limited, and may be, for example, one or two or more. When the number of the biometric information acquisition devices is plural, the biometric information acquisition devices may each acquire different biometric information.

The external device can be used, for example, to further detect the positions of the person to be authenticated and the terminal in the position detection/confirmation unit 11 . The external device used to detect the position is not particularly limited, and for example, a known position information detection device or the like can be used. Specific examples include cameras, GPS, WiFi SSID (Service Set Identifier), beacons, RF-ID readers and sensors such as their directivity, and visible light communication devices. In FIG. 10, the WiFi 111 is shown as an example of the position detection device, but it is not limited to this. The installation location of the position detection device is not particularly limited as long as it is a location where the location information of the person to be authenticated can be obtained. The number of the position detection devices is not particularly limited, and may be, for example, one or two or more.

FIG. 2 is a block diagram showing an example of another form of the device 1 of this embodiment. In this embodiment, for example, a PC or the like may be used. The apparatus 1 has, for example, a CPU (Central Processing Unit) 101, a memory 102, a bus 103, an input device 104, a display device (display) 105, a communication device 106, a storage device 107, and the like. Each unit of the device 1 is connected to each other via a bus 103 .

The CPU 101 is responsible for overall control of the device 1 . In the device 1, the CPU 101 executes, for example, the program of the present invention and other programs, and reads and writes various information. Specifically, for example, the CPU 101 functions as a position detection/confirmation unit 11 , a personal authentication data acquisition unit 12 , a biometric information acquisition unit 13 , and an authentication unit 14 .

The bus 103 can also be connected to external devices, for example. Examples of the external device include a personal computer (PC), a terminal of the person to be authenticated, and a terminal of the administrator. Also, the external device may be, for example, a camera, a sensor, or the like that acquires the position and biometric information of the person to be authenticated. For example, the apparatus 1 can be connected to a communication network 30 by a communication device 106 connected to the bus 103, and can also be connected to the external device via the communication network 30. FIG.

The memory 102 includes, for example, a main memory, which is also referred to as main memory. When the CPU 101 performs processing, the memory 102 reads various operating programs such as the program of the present invention stored in a storage device 107, which will be described later, and the CPU 101 receives data from the memory 102 and processes the programs. to run. The main memory is, for example, RAM (random access memory). Memory 102, for example, further includes a ROM (Read Only Memory).

The storage device 107 is also called a so-called auxiliary storage device, for example, in contrast to the main memory (main storage device). As described above, the storage device 107 stores operation programs including the program of the present invention. The storage device 107 includes, for example, a storage medium and a drive that reads from and writes to the storage medium. The storage medium is not particularly limited, and may be, for example, a built-in type or an external type. Examples include DVD, flash memory, memory card, etc., and the drive is not particularly limited. The storage device 107 may be, for example, a hard disk drive (HDD) in which a storage medium and drive are integrated.

The device 1 further has an input device 104 and a display 105, for example. The input device 104 is, for example, a touch panel, keyboard, mouse, or the like. The display 105 may be an LED display, a liquid crystal display, or the like.

An example of the outline of the authentication device 1 according to this embodiment is shown in FIG. As shown in FIG. 9 , the person 40 to be authenticated carries a terminal 50 . In FIG. 9, the numbers of the person to be authenticated 40 and the number of terminals 50 are one and one, respectively, but the present invention is not limited to this. Two or more are also acceptable. The terminal 50 stores (stores) personal authentication data. In addition, in FIG. 9, the authentication device 1 is installed near the door 70 .

The personal authentication data is data obtained by converting biometric information into numerical values, alphabets, or the like. The biometric information is, for example, information having physical characteristics and behavioral characteristics, and specific examples thereof include facial images, walking, fingerprints, veins, and the like. For example, if the biometric information is the face image, the personal authentication data is face image data, face feature amount, etc. If the biometric information is the face image, walking video, walking image, etc. If the fingerprint is the fingerprint, fingerprint image, fingerprint feature amount, etc. , a vein image, a vein feature amount, and the like. The number and types of the personal authentication data are not particularly limited, and a plurality of personal authentication data may be stored.

The position detection/confirmation unit 11 detects the positions of the person to be authenticated 40 and the terminal 50 carried by the person to be authenticated. In FIG. 9, the position detection confirmation unit 11 is the sensor 111 (Wi-Fi), but it is not limited to this, and as described above, each camera and each sensor can be used. The position detection confirmation unit 11 further confirms whether or not the person to be authenticated 40 and the terminal 50 are located in the authentication area 60 . The authentication area 60 is a range in which the apparatus 1 can acquire the biometric information and the personal authentication data from the person 40 to be authenticated and the terminal 50 . For the authentication area 60 , for example, the system administrator may set the detection confirmation position in advance at an arbitrary position within the authentication area 60 . In this case, the person to be authenticated 40 and the terminal 50 present at the detection confirmation position are targets for verification and acquisition of the personal authentication data.

The personal authentication data acquisition unit 12 acquires the personal authentication data stored in the terminal 50 . Acquisition of the personal authentication data is performed, for example, via the communication network. The communication network is similar to that described above. When a plurality of terminals 50 are present in the authentication area 60, the personal authentication data acquisition unit 12 designates a terminal existing at the detection confirmation position from among the plurality of terminals, and obtains the terminal stored in the designated terminal. Acquire personal authentication data. The number of terminals to be specified is not particularly limited, and may be one, or may be all the terminals existing at the detection confirmation position.

When there are multiple types of personal authentication data stored in the terminal 50, the personal authentication data acquiring unit 12 may acquire all of the personal authentication data stored in the terminal 50, or Data types may be selected and acquired. The selection of the type may be made based on, for example, acquired biometric information described later. Specifically, when the biometric information acquisition unit 13 uses a face authentication camera as the biometric information acquisition device, the personal authentication data acquisition unit 12 selects facial image data, facial feature amounts, etc. from the terminal 50 as the personal authentication data. to get.

The biometric information acquisition unit 13 acquires the biometric information of the person 40 to be authenticated. The biometric information acquisition unit 13 can acquire the biometric information using, for example, the known biometric information acquisition device. In FIG. 9, the biometric information acquisition device is the camera 110, but it is not limited to this. When a plurality of persons 40 to be authenticated exist in the authentication area 60, the biometric information acquisition unit 13, for example, specifies the person to be authenticated existing at the detection position from among the plurality of persons to be authenticated, and The biometric information is acquired from the person to be authenticated. The number of persons to be authenticated to be designated is not particularly limited.

In addition, the biometric information acquiring unit 13 may continuously acquire the biometric information of the person to be authenticated 40 existing in the authentication area 60, for example. This makes it possible to reduce the time lag in authentication.

In the position detection/confirmation unit 11 , the authentication unit 14 collates the personal authentication data and the biometric information of the person to be authenticated 40 when the person to be authenticated 40 and the terminal 50 are located in the authentication area 60 . Then, if the person authentication data and the biometric information match, the person to be authenticated 40 is authenticated as the person, and if the person authentication data and the biometric information do not match, the person to be authenticated 40 is not authenticated as the person. generates a collation result of In the collation, matching is determined when the personal authentication data and the biometric information have identity equal to or greater than a specified threshold. The threshold is not particularly limited, and can be arbitrarily designated based on, for example, the type of the biometric information and the installation location of the biometric information acquisition device. The collation is not limited to one type of the personal authentication data and the biometric information, and may be collated using two or more types of the personal authentication data and the biometric information. Further, when there are a plurality of persons 40 to be authenticated and multiple terminals 50 in the authentication area 60, the authentication unit 14 generates a verification result of the designated person to be authenticated.

Next, an example of processing in the apparatus 1 will be described with reference to the block diagram of FIG. 1 and the flow chart of FIG.

First, the position detection/confirmation unit 11 detects the position of the terminal (A1), and determines whether or not the terminal is positioned within the authentication area (A2).

In step (A2), if the terminal exists within the authentication area (YES), the personal authentication data acquisition unit 12 acquires personal authentication data stored in the terminal (A3). On the other hand, in the step (A2), if the terminal does not exist within the authentication area (NO), for example, the steps A1 to A2 may be repeated.

The position detection/confirmation unit 11 further detects the position of the person to be authenticated (A4), and determines whether or not the person to be authenticated is located within the authentication area (A5).

In the step (A5), if the person to be authenticated exists within the authentication area (YES), the biometric information acquiring unit 13 acquires the biometric information of the person to be authenticated (A6). On the other hand, in the step (A5), if the person to be authenticated does not exist within the authentication area (NO), for example, the steps A4 to A5 may be repeated.

The processing steps of detecting the location of the terminal (the steps A1 to A2) and detecting the location of the person to be authenticated (the steps A4 to A5) may be processed in parallel. position detection (the steps A4 to A5) may be processed before position detection of the terminal (the steps A1 to A2).

Next, the authentication unit 14 collates the personal authentication data with the biometric information of the person to be authenticated (A7). Then, when the personal authentication data and the biometric information match (YES), the person to be authenticated is authenticated as the person (A8), the verification result of the step A8 is generated (A10), and the process ends (END). . On the other hand, if the personal authentication data and the biometric information do not match (NO), the person to be authenticated is not authenticated as the person (A9), the verification result of the step A9 is generated (A10), and the process ends ( END). Further, when the personal authentication data and the biometric information do not match (NO), for example, the steps A1 to A7 may be repeated.

According to this embodiment, in order to use the personal authentication data stored in the terminal carried by the person to be authenticated, for example, the personal authentication data of the person to be authenticated is registered in advance in an authentication device, server, or the like. Easy to use, no need to Furthermore, since connection with an external network is not required, for example, the risk of information leakage is reduced, and security performance is high.

[Embodiment 2]
This embodiment is a form that further allows the personal authentication data to be updated. Unless otherwise indicated, the description of the first embodiment can be used for this embodiment.

FIG. 4 is a block diagram showing an example configuration of the authentication device 1 of this embodiment. As shown in FIG. 4, the authentication device 1 is the same as the authentication device 1 of the first embodiment, except that it further includes a personal authentication data updating unit 15 . Moreover, the hardware configuration of this device 1 is the same as that of the authentication device 1 of the first embodiment shown in FIG.

The personal authentication data updating unit 15 generates updated personal authentication data from the biometric information used for the verification when the authenticating unit generates an authentication result of authenticating the person, and based on the updated personal authentication data, Personal authentication data stored in the terminal can be updated.

The updated personal authentication data is the same data as the personal authentication data. A feature amount and the like can be mentioned.

In the updating, for example, the personal authentication data used for the verification may be deleted, and the updated personal authentication data may be stored in the terminal as new personal authentication data. It may be accumulated and saved as authentication data and stored in the terminal.

For example, in addition to acquiring the biometric information, the biometric information acquiring unit 13 may also acquire acquired information such as the date of photographing in a linked manner. Thereby, the personal authentication data update unit 15 can record the update date of the personal authentication data. Further, in the case of accumulating and saving, the personal authentication data to be used for the verification can be selected from the plurality of accumulated personal authentication data. The selection includes, for example, selecting personal authentication data associated with the latest photographing date.

For example, the authentication unit 14 may compare the plurality of personal authentication data with the acquired biometric information.

In addition, the authentication method of the present embodiment further includes a personal authentication data updating step, and the personal authentication data updating step is used for the verification when the authentication result in which the authentication step authenticates the person is generated. Personal authentication data is generated as updated personal authentication data, and personal authentication data stored in the terminal can be updated by the updated personal authentication data. The personal authentication data updating process can be executed by the personal authentication data updating unit 15 .

Similarly to the authentication device 1 of the first embodiment, the authentication device 1 of the present embodiment also has high security and can update the personal authentication data stored in the terminal. Therefore, for example, it is possible to suppress a decrease in the authentication rate due to changes in biometric information such as aging.

[Embodiment 3]
This embodiment is a form which further enables output of an operation instruction. Unless otherwise indicated, the description of the first and second embodiments can be used for this embodiment.

FIG. 5 is a block diagram showing an example configuration of the authentication device 1 of this embodiment. As shown in FIG. 5, the authentication device 1 is the same as the authentication device 1 of Embodiments 1 and 2 except that an output unit 16 is further included. The hardware configuration of this device 1 is the same as that of the authentication device 1 of the first embodiment shown in FIG. 2, except that the CPU 101 further includes an output unit 16.

The output unit 16 outputs an operation instruction associated with the collation based on the result of the collation. The form of the output is not particularly limited, and for example, the communication device 106 shown in FIG. 2 may be used to connect to the external device and output an operation instruction to the external device. The external device is, for example, the terminals of the administrator and the person to be authenticated, and may output to either one or both. Alternatively, for example, an operation instruction to display the collation result on the display 105 shown in FIG. 2 may be output. The operation instruction may be, for example, an instruction to control entrance/exit to a predetermined area for the person to be authenticated, an instruction to permit payment, or the like. The entry/exit restriction instruction is, for example, an instruction to restrict entry/exit, such as door opening/closing and gate check. Specifically, for example, when the collation result is authentication, instructions such as opening a door, permitting entry and exit, and going to a manned reception are given. The settlement permission instruction is, for example, an instruction to permit payment if the verification is authentication, and not to permit payment if the verification is non-authentication.

Moreover, the authentication method of the present embodiment further includes an output step, and the output step can output an operation instruction linked with the collation based on the result of the collation. The output process can be performed by the output unit 16 .

As with the authentication device 1 of the first embodiment, the authentication device 1 of the present embodiment also has high security, allows confirmation of the authentication result, and restricts the behavior of the person to be authenticated.

[Embodiment 4]
This embodiment can be used for the authentication device 1 of the first to third embodiments, and the terminal performs the collation. Unless otherwise indicated, the description of Embodiments 1 to 3 can be used for this embodiment.

FIG. 6 is a block diagram showing an example configuration of the authentication terminal 2 of this embodiment. As shown in FIG. 6 , the authentication terminal 2 includes a terminal side communication section 21 , a storage section 22 and a terminal side authentication section 23 . The authentication terminal 2 may further include a personal authentication data converter 24 . The authentication terminal 2 is one authentication terminal including the above-described units, and has a form that can be carried by the person to be authenticated. Specific examples include smartphones, tablets, wearable devices such as spectacles, RF-ID (Radio Frequency Identification), and IC cards.

As shown in FIG. 6, the terminal 2 can be connected to the authentication device 1 via a communication network 30. FIG. Communication network 30 is similar to that described above. Terminal-side communication unit 21 communicates with authentication device 1 via communication network 30 . The terminal 2 receives the biometric information of the person to be authenticated acquired by the biometric information acquisition unit 13 from the authentication device 1, for example. On the other hand, the terminal 2 transmits the collation result to the authentication device 1, for example.

The storage unit 22 stores the personal authentication data. The personal authentication data is the same as described above, and the number and types of the personal authentication data are not particularly limited, and a plurality of personal authentication data may be stored.

In the position detection/confirmation unit 11, when the person to be authenticated and the terminal are located in the authentication area, the terminal side authentication unit 23 collates the person to be authenticated with the biometric information of the person to be authenticated, and confirms the person to be authenticated. and when the biometric information matches, the person to be authenticated is authenticated as the person, and when the person authentication data and the biometric information do not match, the person to be authenticated is not authenticated as the person. .

The verification by the terminal-side authentication unit 23 is performed independently of the verification by the authentication unit 14 .

The personal authentication data may be stored in advance in the storage unit 22, or new personal authentication data may be generated. When the personal authentication data is stored in the storage unit 22 in advance, for example, data traffic between the storage unit 22 and the biometric information acquisition unit 13 can be reduced. On the other hand, when the terminal 2 generates new personal authentication data, the personal authentication data conversion unit 24 receives the biometric information of the person to be authenticated acquired by the biometric information acquisition unit 13 from the authentication device 1, and Convert information into identity data. Specifically, for example, the biometric information is converted into data represented by numerical values, alphabets, or the like.

FIG. 7 illustrates a block diagram of the hardware configuration of the authentication terminal 2. As shown in FIG. The terminal 2 has, for example, a CPU (Central Processing Unit) 201, a memory 202, a bus 203, an input device 204, a display device (display) 205, a communication device 206, a storage device 207, and the like. Each part of the terminal 2 is connected to each other via the bus 203 . Unless otherwise indicated, the description of each part of the authentication device 1 can be used for each part of the terminal 2 .

CPU 201 is responsible for overall control of terminal 2 . In the terminal 2, the CPU 201 executes, for example, the program of the present invention and other programs, and reads and writes various types of information. Specifically, for example, the CPU 201 functions as the terminal-side authentication unit 23 .

The terminal-side communication unit 21 is, for example, the communication device 206 . For example, the terminal 2 can be connected to the communication network 30 via the communication device 206 connected to the bus 203, can be connected to the authentication device 1 via the communication network 30, and can be connected to the external device. can also be connected.

The storage device 207 is, for example, the storage unit 22, and stores the personal authentication data and the like.

The terminal 2 further has an input device 204 and a display 205, for example. If the authentication device 1 includes the output unit 16 , the display 205 may display the collation result in the terminal-side authentication unit 23 .

Next, an example of processing in the terminal 2 will be described with reference to the block diagram of FIG. 6 and the flow chart of FIG.

First, the communication unit 21 communicates with the authentication device 1 via the communication network 30, and acquires the information on the positions of the person to be authenticated and the terminal, and the biometric information of the person to be authenticated (B1).

Next, the personal authentication data used for verification may be obtained. For obtaining the personal authentication data, for example, the biometric information is converted into personal authentication data by the personal authentication data conversion unit 24 (B2). On the other hand, without performing the step (B2), the personal authentication data stored in advance in the storage unit 22 may be used for verification.

Next, the terminal-side authentication unit 23 collates the personal authentication data and the biometric information of the authentication subject in the position detection confirmation unit 11 when the authentication subject and the terminal are located in the authentication area (B3 ). Then, when the personal authentication data and the biometric information match (YES), the person to be authenticated is authenticated as the person (B4), the verification result of the step B4 is generated (B6), and the process ends (END). . On the other hand, if the personal authentication data and the biometric information do not match (NO), the person to be authenticated is not authenticated as the person (B5), the verification result of the step B5 is generated (B6), and the process ends ( END).

As with the authentication device 1 of Embodiment 1, the authentication terminal of this embodiment also uses the personal authentication data stored in the terminal. Therefore, for example, connection with an external network is unnecessary, The risk of information leakage is reduced, and security performance is high.

[Embodiment 5]
A program of this embodiment is a program that can execute the authentication methods of the first to fourth embodiments on a computer. Moreover, the program of this embodiment may be recorded on a computer-readable recording medium, for example. The recording medium is not particularly limited, and examples thereof include read-only memory (ROM), hard disk (HD), optical disk, floppy (registered trademark) disk (FD), and the like.

Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes can be made to the configuration and details of the present invention within the scope of the present invention that can be understood by those skilled in the art.

<Appendix>
Some or all of the above-described embodiments and examples can be described as in the following appendices, but are not limited to the following.
(Appendix 1)
Including a position detection confirmation unit, a personal authentication data acquisition unit, a biometric information acquisition unit, and an authentication unit,
The position detection/confirmation unit detects the positions of a person to be authenticated and a terminal carried by the person to be authenticated, and confirms whether the person to be authenticated and the terminal are located in an authentication area,
Personal authentication data is stored in the terminal,
The personal authentication data acquisition unit acquires personal authentication data stored in the terminal,
The biometric information acquisition unit acquires the biometric information of the person to be authenticated,
In the position detection/confirmation unit, when the person to be authenticated and the terminal are located in the authentication area, the authentication unit compares the person to be authenticated data and the biometric information of the person to be authenticated, and generating a verification result that the person to be authenticated is authenticated as the person if the biometric information matches, and that the person to be authenticated is not authenticated as the person if the person authentication data and the biometric information do not match; Device.
(Appendix 2)
The authentication subject and the terminal are a plurality of authentication subjects and the terminals,
In the position detection confirmation unit, a detection confirmation position is set within the authentication area,
The personal authentication data acquiring unit designates the terminal existing at the detection confirmation position from among the plurality of terminals and acquires the personal authentication data stored in the terminal,
The biometric information acquisition unit acquires biometric information by designating the authentication subject existing at the detection confirmation position from among the plurality of authentication subjects,
The authentication device according to supplementary note 1, wherein the authentication unit generates a verification result of the designated person to be authenticated.
(Appendix 3)
3. The authentication device according to appendix 1 or 2, wherein the biometric information acquisition unit continuously acquires the biometric information of the person to be authenticated existing in the authentication area.
(Appendix 4)
Furthermore, including a personal authentication data update unit,
The personal authentication data updating unit generates updated personal authentication data from the biometric information used for the verification when the authenticating unit generates an authentication result of authenticating the person,
4. The authentication device according to any one of appendices 1 to 3, wherein the personal authentication data stored in the terminal can be updated by the updated personal authentication data.
(Appendix 5)
Furthermore, including an output part,
5. The authentication device according to any one of appendices 1 to 4, wherein the output unit outputs an operation instruction associated with the collation based on a result of the collation.
(Appendix 6)
Connectable to the authentication device according to any one of appendices 1 to 5 via a communication network,
Including a terminal-side communication unit, a storage unit, and a terminal-side authentication unit,
The terminal-side communication unit communicates with the authentication device,
The storage unit stores the personal authentication data,
The terminal-side authenticating unit compares the personal authentication data with the biometric information of the person to be authenticated when the person to be authenticated and the terminal are located in the authentication area in the position detection and confirming unit. and when the biometric information matches, the person to be authenticated is authenticated as the person, and when the person authentication data and the biometric information do not match, the person to be authenticated is not authenticated as the person. , a portable authentication terminal.
(Appendix 7)
Furthermore, including a personal authentication data conversion unit,
7. The authentication terminal according to appendix 6, wherein the personal authentication data conversion unit converts the biometric information into personal authentication data.
(Appendix 8)
Including a position detection confirmation process, a personal authentication data acquisition process, a biometric information acquisition process, and an authentication process,
The position detection and confirmation step detects the positions of a person to be authenticated and a terminal carried by the person to be authenticated, and confirms whether or not the person to be authenticated and the terminal are located in an authentication area,
Personal authentication data is stored in the terminal,
The personal authentication data obtaining step obtains personal authentication data stored in the terminal,
The biometric information acquisition step acquires the biometric information of the person to be authenticated,
In the position detection and confirmation step, when the person to be authenticated and the terminal are located in the authentication area, the authentication step compares the person to be authenticated data and the biometric information of the person to be authenticated, and generating a verification result that the person to be authenticated is authenticated as the person if the biometric information matches, and that the person to be authenticated is not authenticated as the person if the person authentication data and the biometric information do not match; Method.
(Appendix 9)
The authentication subject and the terminal are a plurality of authentication subjects and the terminals,
In the position detection confirmation step, a detection confirmation position is set within the authentication area,
The personal authentication data acquiring step designates the terminal existing at the detection confirmation position from among the plurality of terminals and acquires the personal authentication data stored in the terminal;
The biometric information acquiring step specifies the authentication subject existing at the detection confirmation position from among the plurality of authentication subjects and acquires the biometric information;
The authentication method according to appendix 8, wherein the authentication step generates a verification result of the designated person to be authenticated.
(Appendix 10)
10. The authentication method according to appendix 8 or 9, wherein the biometric information acquiring step continuously acquires the biometric information of the person to be authenticated existing in the authentication area.
(Appendix 11)
Furthermore, including a personal authentication data update process,
The personal authentication data updating step generates the personal biometric information data used for the verification as updated personal authentication data when the authentication step generates an authentication result in which the person is authenticated,
11. The authentication method according to any one of appendices 8 to 10, wherein the personal authentication data stored in the terminal can be updated by the updated personal authentication data.
(Appendix 12)
Furthermore, including an output step,
12. The authentication method according to any one of appendices 8 to 11, wherein the outputting step outputs an operation instruction linked with the collation based on the result of the collation.
(Appendix 13)
Using the authentication device according to any one of appendices 1 to 5,
including a communication process, a storage process, and a terminal-side authentication process,
The communication step communicates with the authentication device via a communication network,
The storing step stores the personal authentication data,
In the terminal-side authentication step, when the person to be authenticated and the terminal are located in the authentication area in the position detection and confirmation step, the person to be authenticated and the biometric information of the person to be authenticated are collated to obtain the person to be authenticated. and when the biometric information matches, the person to be authenticated is authenticated as the person, and when the person authentication data and the biometric information do not match, the person to be authenticated is not authenticated as the person. , an authentication method in a portable terminal.
(Appendix 14)
Furthermore, including a personal authentication data conversion process,
14. The authentication method in a portable terminal according to appendix 13, wherein the personal authentication data conversion step converts the biometric information into personal authentication data.
(Appendix 15)
A program capable of executing the method according to any one of appendices 8 to 12 on a computer.
(Appendix 16)
A program capable of executing the method according to appendix 13 or 14 on a computer.
(Appendix 17)
A computer-readable recording medium recording the program according to appendix 15.
(Appendix 18)
A computer-readable recording medium recording the program according to appendix 16.

According to the present invention, for example, the security performance is high and the user can easily use it.

1 authentication device 2 authentication terminal 11 position detection confirmation unit 12 identity authentication data acquisition unit 13 biometric information acquisition unit 14 authentication unit 15 identity authentication data update unit 16 output unit 17 communication unit 21 terminal side communication unit 22 storage unit 23 terminal side authentication Unit 30 Communication network 40 Person to be authenticated 50 Terminal 60 Authentication area 70 Doors 101, 201 CPU
102, 202 memory 103, 203 bus 104, 204 input device 105, 205 display 106, 206 communication device 107, 207 storage device 110 camera 111 WiFi
112 fingerprint sensor

Claims (10)

Including a position detection confirmation unit, a personal authentication data acquisition unit, a biometric information acquisition unit, and an authentication unit,
The position detection/confirmation unit detects the positions of a person to be authenticated and a terminal carried by the person to be authenticated, and confirms whether the person to be authenticated and the terminal are located in an authentication area,
Personal authentication data is stored in the terminal,
The personal authentication data acquisition unit acquires personal authentication data stored in the terminal,
The biometric information acquisition unit acquires the biometric information of the person to be authenticated,
In the position detection/confirmation unit, when the person to be authenticated and the terminal are located in the authentication area, the authentication unit compares the person to be authenticated data and the biometric information of the person to be authenticated, and generating a verification result that the person to be authenticated is authenticated as the person if the biometric information matches, and that the person to be authenticated is not authenticated as the person if the person authentication data and the biometric information do not match; Device. The authentication subject and the terminal are a plurality of authentication subjects and the terminals,
In the position detection confirmation unit, a detection confirmation position is set within the authentication area,
The personal authentication data acquiring unit designates the terminal existing at the detection confirmation position from among the plurality of terminals and acquires the personal authentication data stored in the terminal,
The biometric information acquisition unit acquires biometric information by designating the authentication subject existing at the detection confirmation position from among the plurality of authentication subjects,
2. The authentication device according to claim 1, wherein said authentication unit generates a verification result of said designated person to be authenticated. Furthermore, including a personal authentication data update unit,
The personal authentication data updating unit generates updated personal authentication data from the biometric information used for the verification when the authenticating unit generates an authentication result of authenticating the person,
3. The authentication device according to claim 1, wherein the user authentication data stored in said terminal can be updated with said updated user authentication data. Furthermore, including an output part,
The authentication device according to any one of claims 1 to 3, wherein the output unit outputs an operation instruction associated with the collation based on a result of the collation. Connectable to the authentication device according to any one of claims 1 to 4 via a communication network,
Including a terminal-side communication unit, a storage unit, and a terminal-side authentication unit,
The terminal-side communication unit communicates with the authentication device,
The storage unit stores the personal authentication data,
The terminal-side authenticating unit compares the personal authentication data with the biometric information of the person to be authenticated when the person to be authenticated and the terminal are located in the authentication area in the position detection and confirming unit. and when the biometric information matches, the person to be authenticated is authenticated as the person, and when the person authentication data and the biometric information do not match, the person to be authenticated is not authenticated as the person. , a portable authentication terminal. Furthermore, including a personal authentication data conversion unit,
6. The authentication terminal according to claim 5, wherein said personal authentication data conversion unit converts said biometric information into personal authentication data. Including a position detection confirmation process, a personal authentication data acquisition process, a biometric information acquisition process, and an authentication process,
The position detection and confirmation step detects the positions of a person to be authenticated and a terminal carried by the person to be authenticated, and confirms whether or not the person to be authenticated and the terminal are located in an authentication area,
Personal authentication data is stored in the terminal,
The personal authentication data obtaining step obtains personal authentication data stored in the terminal,
The biometric information acquisition step acquires the biometric information of the person to be authenticated,
In the position detection and confirmation step, when the person to be authenticated and the terminal are located in the authentication area, the authentication step compares the person to be authenticated data and the biometric information of the person to be authenticated, and generating a verification result that the person to be authenticated is authenticated as the person if the biometric information matches, and that the person to be authenticated is not authenticated as the person if the person authentication data and the biometric information do not match; Method. Using the authentication device according to any one of claims 1 to 4,
including a communication process, a storage process, and a terminal-side authentication process,
The communication step communicates with the authentication device via a communication network,
The storing step stores the personal authentication data,
In the terminal-side authentication step, when the person to be authenticated and the terminal are located in the authentication area , the position detection/confirmation unit compares the person to be authenticated with the biometric information of the person to be authenticated. and when the biometric information matches, the person to be authenticated is authenticated as the person, and when the person authentication data and the biometric information do not match, the person to be authenticated is not authenticated as the person. , an authentication method in a portable terminal. A program capable of executing the method according to claim 7 on a computer. A program capable of executing the method according to claim 8 on a computer.

Images