TW202026981A - Authentication system - Google Patents

Abstract

This authentication system performs personal identification with a simple procedure. An authentication terminal includes: an authentication light source that projects, toward a body part of a terminal user, light including a wavelength in a visible light region; an image acquisition unit that acquires a reflection image generated by the light that was projected from the authentication light source and that was reflected by the body part; a biometric authentication data generation unit that generates biometric authentication data by extracting, from the acquired reflection image, a feature shape and a vein shape in the body part; and a data transmission unit that transmits the generated biometric authentication data to a biometric authentication server. The biometric authentication server includes: a storage unit that stores identification information for uniquely identifying a plurality of registered users in association with biometric authentication data of the plurality of registered users; an authentication unit that authenticates whether the terminal user is a registered user on the basis of the biometric authentication data transmitted from the data transmission unit; and a post-authentication processing unit that performs a predetermined post-authentication process if the terminal user was authenticated as a registered user.

Description

Authentication system

The invention relates to an authentication system.

In recent years, the use of biometric authentication has increased in credit card settlement or personal authentication such as entering and exiting buildings. By using biometric authentication, personal authentication can be performed more reliably. For example, Patent Document 1 discloses an e-commerce settlement authentication system using biometric authentication. [Prior Art Document] [Patent Document]

Patent Document 1: Japanese Patent No. 6159840

[The problem to be solved by the invention]

However, in the technique disclosed in Patent Document 1, after performing authentication using a user ID and password, in order to perform biometric authentication, the user needs to input the user ID and password, and the authentication procedure becomes complicated.

The present invention has been completed in view of such circumstances, and provides an authentication system that performs personal authentication with simple procedures. [Means to solve the problem]

According to the present invention, there is provided an authentication system including an authentication terminal and a biometric authentication server, the authentication terminal having an authentication light source, an image acquisition unit, a biometric authentication data generation unit, and a data transmission unit, wherein the The authentication light source irradiates a part of the end user's human body with light including a wavelength in the visible light region, and the image acquisition unit acquires a reflection image generated by the light irradiated by the authentication light source and reflected on the part of the end user's body, so The biometric authentication data generation unit extracts the characteristic shape and the vein shape of a part of the human body from the acquired reflection image to generate biometric authentication data, and the data transmission unit converts the generated biometric authentication data Sent to the biometric authentication server, the biometric authentication server having a storage unit, an authentication unit, and a post-authentication processing unit, and the storage unit stores in a corresponding manner for uniquely identifying multiple login users And the biometric authentication data of the plurality of logged-in users, the authenticating unit authenticates whether the terminal user is a logged-in user based on the biometric authentication data received from the data transmitting unit, the The post-authentication processing unit performs predetermined post-authentication processing when authenticating the terminal user as a logged-in user.

With such a configuration, authentication data is generated based on the image acquired by the image acquisition unit of the authentication terminal, and identity authentication is performed based on the authentication data. Therefore, the user does not need to input a user ID and password, and can perform authentication through simple procedures.

Hereinafter, various embodiments of the present invention are illustrated. The embodiments shown below can be combined with each other. Moreover, each characteristic shape constitutes an invention independently.

Preferably, a part of the human body is a palm, and the biometric authentication data generating unit extracts the palm print shape and vein shape of the palm from the acquired reflection image, and generates biometric authentication data. Preferably, a settlement system is further provided, the data sending unit sends the biometric authentication data and product purchase data to the biometric authentication server, and the identification information is further bound with information about the settlement means of the logged-in user, and The post-authentication processing unit sends the commodity purchase data and information about settlement means to the settlement system. Preferably, the storage unit further stores predetermined information bound to the login user as login information, and the post-authentication processing unit sends at least one of the authentication result and login information of the terminal user to the Authentication terminal. Preferably, there is a log-in information server for storing predetermined information bound to the log-in user as log-in information, and the post-authentication processing unit stores the authentication result and log-in of the terminal user At least one of the information is sent to the authentication terminal.

<1. First embodiment> (1.1. Authentication system 100) The authentication system 100 of the first embodiment will be described with reference to FIG. 1. The authentication system 100 uses, for example, an authentication system that performs credit card authentication and settlement. The authentication system 100 includes an authentication terminal 10 of a credit card affiliated store, a biometric authentication server 20 of a data center, and a credit card settlement system 30 of a settlement company.

The user of the credit card (equivalent to the “end user” in the scope of the patent request) uses the authentication terminal 10 to take an image of the palm of the hand when purchasing a product at the affiliate store. The authentication terminal 10 generates biometric authentication data based on the captured image, and transmits commodity purchase data (for example, a settlement amount) and biometric authentication data to the biometric authentication server 20.

In the biometric authentication server 20, biometric authentication data and information about settlement means (for example, card number and expiration date) are registered in a manner of binding a member ID that uniquely identifies the registered user of the credit card. Based on the received authentication data, the biometric authentication server 20 authenticates whether the user is a registered user who has previously registered as a member of a credit card.

When the terminal user is authenticated as a logged-in user, the biometric authentication server 20 transmits information about the settlement means and the settlement amount (hereinafter also referred to as settlement information) to the settlement system 30. In the settlement system 30, first, based on the received settlement information, the user is authorized. When the authorization process is approved, the settlement process is started.

As described above, in the authentication system 100 of the present embodiment, the user of the credit card does not need to use a credit card, and does not need to input information such as the card number and expiration date, and can purchase goods only by photographing the palm. Hereinafter, the functional configuration and processing flow for realizing the authentication system 100 will be described.

(1.2. Functional structure of the authentication system 100) With reference to Fig. 2, the functional structure of the authentication system 100 will be described. The authentication system 100 includes an authentication terminal 10, a biometric authentication server 20, and a settlement system 30.

(1. 2. 1. Authentication terminal 10) The technology used to realize the authentication terminal 10 is based on the technology disclosed in Japanese Patent No. 5509459, so this content is not described in detail in this specification.

The authentication terminal 10 includes an authentication light source 11, an image acquisition unit 13, a display unit 14, a biometric authentication data generation unit 15, and a data transmission unit 17. The authentication light source 11 irradiates light including a wavelength in the visible light region toward a part of the human body of the end user (the palm in this embodiment).

The image acquisition unit 13 acquires (ie captures) a reflection image, which is generated by light that is irradiated by the authentication light source 11 and reflected on a part of the end user's human body. The display unit 14 displays various types of information on a display included in the authentication terminal 10. The biometric authentication data generating unit 15 extracts the characteristic shape and vein shape of a part of the human body from the acquired reflection image, and generates biometric authentication data. The data transmission unit 17 transmits the generated biometric authentication data and the settlement amount to the biometric authentication server 20.

As described above, in the authentication terminal 10, a part of the human body of the terminal user is photographed using light including a wavelength in the visible light region to generate biometric authentication data. In this way, it can be easily realized by using visible light shooting and installing software on existing smart phones or tablet computers.

The authentication terminal 10 may have a plurality of image acquisition units 13, but when the characteristic shape and vein shape of a part of the human body are extracted from the common human body region (for example, when the palmprint shape and vein shape of the same palm are extracted), the authentication terminal 10 may include only one image acquisition unit 13. When the authentication terminal 10 has only one image acquisition unit 13, it is also possible to acquire a plurality of reflected images, and extract the characteristic shape and vein shape of a part of the human body from each reflected image, but it can also reflect from one image. The image extracts the characteristic shape and vein shape of a part of the human body. When the characteristic shape and vein shape of a part of the human body are extracted from one reflected image, one reflected image may be obtained by combining multiple reflected images, or may be an original (ie, synthesized) reflected image.

When extracting the palm print shape and the vein shape from the above-mentioned reflected image, the biometric authentication data generating unit 15 may also obtain from the palm reflected image obtained by light in the visible light region containing red light (light with a wavelength of 580 to 750 μm) The palmprint shape and vein shape are extracted. Therefore, if it is such a configuration, the palmprint shape and vein shape can also be extracted from a camera with built-in infrared filter and a smart phone equipped with a flash.

(1. 2. 2. Biometric authentication server 20) The biometric authentication server 20 includes an authentication unit 21, a storage unit 23, and a post-authentication processing unit 25. The storage unit 23 stores the member ID of the identification information for uniquely identifying the plurality of login users and the biometric authentication data of the plurality of login users in a corresponding manner. The storage unit 23 also stores the card number and validity period bound to the member ID as information about the payment device of the logged-in user.

The authentication unit 21 authenticates based on the biometric authentication data transmitted from the data transmission unit 17 of the authentication terminal 10 whether the terminal user is a logged-in user who has previously logged in as a member of the credit card. When the authenticated terminal user is a logged-in user (that is, when the authentication is successful), the post-authentication processing unit 25 sends the settlement amount, card number, and expiration date to the settlement system 30. In addition, when the authentication terminal user is not a logged-in user (that is, the authentication is not successful), the post-authentication processing unit 25 sends the authentication result to the display unit 14 of the authentication terminal 10.

The above-mentioned constituent elements may be implemented by software (including so-called applications) appropriately installed in the authentication terminal 10 or the biometric authentication server 20, or may be implemented by hardware. When realized by software, the CPU executes the programs that constitute the software to realize various functions.

The program can be stored in a storage device (including the storage unit 23, which refers to a storage, HDD or SDD, etc.) built into the authentication terminal 10 or the biometric authentication server 20, or can be stored in a computer-readable non-transitory recording medium. In addition, it is also possible to read programs stored in an external storage unit, and realize it through so-called cloud computing. When implemented by hardware, it is implemented by various circuits such as ASIC, FPGA, or DRP.

(1. 2. 3. Settlement system 30) The settlement system 30 performs authorization processing (confirmation processing of the credit limit of the card member) based on the settlement amount, card number, and expiration date received from the biometric authentication server 20. When the settlement is approved through the authorization process, the settlement system 30 starts the settlement process.

(1. 3. Flow of user registration processing) Referring to FIG. 3, the user registration processing of the authentication system 100 will be described. In step S101, the terminal user inputs information related to settlement, such as identity verification information, card number, and expiration date, into the authentication terminal 10, and takes a palm image. In step S102, the input information and the photographed palm image are registered in the authentication terminal 10.

If the authentication terminal 10 acquires the information input by the terminal user in step S103 and the image of the palm taken, it sends the identity verification information to the identity verification server 50 in step S104.

The identity verification server 50 confirms whether the terminal user is a pre-registered card member based on the identity verification information received in step S105 to step S107, and sends the result to the authentication terminal 10.

In this manner, in the user registration process, the identity verification server 50 uses the identity verification server 50 to prevent a third party other than the credit card contractor from pretending to be a contractor to perform user registration.

If the authentication terminal 10 receives the identity verification result in step S108, it generates biometric authentication data in step S109, and sends the biometric authentication data to the biometric authentication server 20 in step S110.

If the biometric authentication server 20 receives the biometric authentication data in step S111, in step S112 the biometric authentication data is registered in the storage unit 23 in correspondence with the identification information for uniquely identifying the registered user, and in step S113 Send the login result to the authentication terminal 10.

If the authentication terminal 10 receives the login result in step S114, it displays the login result in step S115. The terminal user confirms the login result in step S116.

(1. 5. Flow of settlement processing) Referring to Fig. 4, the flow of user authentication and settlement processing of the authentication system 100 will be described. In step S121, the terminal user inputs the settlement amount into the authentication terminal 10 and takes a palm shot. In step S122, the input settlement amount and the photographed palm image are registered in the authentication terminal 10.

In step S123, the authentication terminal 10 acquires the settlement amount input by the terminal user and the captured image of the palm, and generates biometric authentication data in step S124. The authentication terminal 10 transmits the biometric authentication data to the biometric authentication server 20 in step S125.

The biometric authentication server 20 receives the biometric authentication data in step S126, and in step S127 performs an authentication process of whether the received biometric authentication data is registered in the storage unit 23.

When the received biometric authentication data is not registered in the storage unit 23, the biometric authentication server 20 fails the authentication in step S128a, and sends the result to the authentication terminal 10.

If the authentication terminal 10 receives the result of authentication failure in step S129, it displays the result of authentication failure in step S130. The terminal user confirms that the authentication has failed in step S131.

On the other hand, when the received biometric authentication data is registered in the storage unit 23, the biometric authentication server 20 transmits the settlement information to the settlement system 30 in step S128b.

If the settlement system 30 receives the settlement information in step S132, it performs authorization processing in step S133, and sends the authorization result to the authentication terminal 10 in step S134.

If the authentication terminal 10 receives the authorization result in step S135, the authorization result is displayed in step S136. The end user confirms the authorization result in step S137.

When the card settlement is approved through the authorization process (step S133), the settlement system 30 will also start the settlement process in step S138.

As described above, the authentication system 100 according to this embodiment includes the authentication terminal 10, the biometric authentication server 20, and the settlement system 30. The authentication terminal 10 irradiates a part of the human body with visible light to photograph, and generates biometric authentication data based on the photographed image. In addition, the biometric authentication server 20 performs end user authentication processing based only on the biometric authentication data. When the terminal user is authenticated as a logged-in user, the settlement system 30 performs credit card settlement processing.

With this configuration, the terminal user does not need to use a credit card, and does not need to enter any card number and other information related to the settlement means, as well as identity verification information that specifies the person, and can also perform the credit card settlement process. Therefore, it is possible to perform personal authentication with a simple configuration.

<2. The second embodiment> (2.1. Overview of the authentication system 200) With reference to FIG. 5, the authentication system 200 according to the second embodiment will be described. It should be noted that in the following description, the same reference numerals are given to the same configurations as those of the first embodiment, and the description will not be repeated.

As shown in FIG. 5, as an example, the authentication system 200 according to the second embodiment is implemented as an entry and exit authentication system that manages a terminal user's work place facility or the like. The authentication system 200 includes an authentication terminal 10 provided in a workplace facility, a biometric authentication server 20 provided in a data center, and a facility management server 60 for the workplace facility. The facility management server 60 can lock and unlock the facility entrance.

When the end user enters or exits the facility, the authentication terminal 10 is used to take an image of the palm of the hand. The authentication terminal 10 generates biometric authentication data based on the captured image, and transmits the biometric authentication data to the biometric authentication server 20.

The biometric authentication data is registered in the biometric authentication server 20, and the biometric authentication data corresponds to identification information (for example, an employee ID) for uniquely identifying an employee of a workplace facility. Based on the received biometric authentication data, the biometric authentication server 20 authenticates whether the end user is a registered user who has previously registered as an employee.

The biometric authentication server 20 transmits the authentication result to the authentication terminal 10. When the authentication terminal 10 that has received the authentication result authenticates the terminal user as a logged-in user, it sends an unlocking instruction to the facility management server 60. The facility management server unlocks the facility entrance so that end users can enter the facility.

As described above, with the authentication system 200 in the present embodiment, the end user does not need to use an ID card or the like, and does not need to input information such as an employee ID or password, and only needs to photograph the palm to perform access authentication. Hereinafter, the functional configuration and processing flow for realizing the authentication system 200 will be described.

(2. 2. Functional structure of the authentication system 200) With reference to Fig. 6, the functional structure of the authentication system 200 will be described. The authentication system 200 includes an authentication terminal 10, a biometric authentication server 20, and a facility management server 60.

(2. 2. 1. Authentication terminal 10) In addition to the above configuration, the authentication terminal 10 further includes an unlocking instruction unit 18. Based on the authentication result received from the post-authentication processing unit 25 of the biometric authentication server 20, the unlock instruction unit 18 instructs the facility management server 60 to unlock when the authentication in the biometric authentication server 20 succeeds.

(2. 2. 2. Biometric authentication server 20) The storage unit 23 stores the employee IDs and biometric authentication data of multiple login users in a corresponding manner. The authentication unit 21 authenticates whether the terminal user is a logged-in user based on the biometric authentication data sent from the data transmission unit 17 of the authentication terminal 10. The post-authentication processing unit 25 sends the authentication result of the authentication terminal 10 to the unlock instruction unit 18.

(2. 3. Flow of authentication processing) Referring to FIG. 7, the flow of user authentication processing of the authentication system 200 will be described. The terminal user uses the authentication terminal 10 to photograph the palm in step S201, and registers the photographed image in the authentication terminal 10 in step S202.

The authentication terminal 10 acquires the image taken by the terminal user in step S203, and generates biometric authentication data in step S204. The authentication terminal 10 transmits the biometric authentication data to the biometric authentication server 20 in step S205.

The biometric authentication server 20 receives the biometric authentication data in step S206, and checks whether the received biometric authentication data is registered in the storage unit 23 in step S207. The biometric authentication server 20 transmits the authentication result to the authentication terminal 10 in step S208.

The authentication terminal 10 receives the authentication result in step S209. Here, when the authentication result is failure, the authentication terminal 10 displays authentication failure in step S210a. The terminal user confirms that the authentication has failed in step S140. On the other hand, when the authentication result is successful, the authentication terminal 10 sends an unlocking instruction to the facility management server 60 in step S210b.

The facility management server 60 receives the unlocking instruction in step S212, and unlocks the facility entrance in step S213.

In this way, the authentication system 200 according to this embodiment includes an authentication terminal 10, a biometric authentication server 20, and a facility management server 60. When the terminal user is authenticated as a logged-in user, the authentication terminal 10 instructs the facility management server 60 to unlock.

With such a configuration, the end user does not need to use an ID card, etc., and does not need to enter information such as an employee ID or password, and can perform entry and exit authentication only by photographing the palm of the hand. That is, it is possible to perform personal authentication with a simple configuration.

<3. The third embodiment> (3.1. Overview of the authentication system 300) With reference to FIGS. 8A and 8B, the authentication system 300 according to the third embodiment will be described.

As shown in FIG. 8A, the authentication system 300 according to the third embodiment is an authentication system that manages the admission of event venues and the like as an example. The authentication system 300 includes an authentication terminal 10 provided in an event venue, a biometric authentication server 20 provided in a data center, and a registration information server 70 provided in a ticket company. In the registration information server 70, information for uniquely identifying the ticket purchaser (address and name in the example shown in FIG. 8) and ticket information are registered.

When an attendee of the event venue enters the venue, the authentication terminal 10 takes an image of the palm of the hand. The authentication terminal 10 generates biometric authentication data based on the captured image, and transmits the biometric authentication data to the biometric authentication server 20.

In the biometric authentication server 20, the biometric authentication data and the address and name for uniquely identifying the registered user registered in advance are registered in a corresponding manner. The biometric authentication server 20 verifies whether the end user is a logged-in user based on the received biometric authentication data.

When the terminal user is authenticated as a logged-in user, the biometric authentication server 20 sends identification information for uniquely identifying the logged-in user to the login information server 70. The login information server 70 sends the login information (ticket information in this example) bound to the received identification information to the biometric authentication server 20.

The biometric authentication server 20 sends the received ticket information to the authentication terminal 10. The authentication terminal 10 displays the received ticket information, so that the terminal user can enter the event venue.

In addition, as shown in FIG. 8B, the authentication system 300 may also be realized as an authentication system used when obtaining a medical examination result of a hospital. The authentication system 300 includes an authentication terminal 10 possessed by the end user, a biometric authentication server 20 possessed by the data center, and a registration information server 70 installed in the hospital. The registration information server 70 is registered with identification information that uniquely identifies the subject and the result of the medical examination.

The person who confirms the result of the medical examination uses the photographed palm image of the authentication terminal 10. The authentication terminal 10 generates biometric authentication data based on the captured image, and transmits the biometric authentication data to the biometric authentication server 20.

Based on the received biometric authentication data, the biometric authentication server 20 determines whether the end user is a registered user who has previously logged in to the authentication server. When the authenticated terminal user is a logged-in user, identification information for uniquely identifying the logged-in user is sent to the log-in information server 70.

The login information server 70 sends the login information (in this example, the result of the medical examination) bound to the identification information to the biometric authentication server 20. The biometric authentication server 20 sends the received medical examination result to the authentication terminal 10. The authentication terminal 10 displays the received medical examination result, thereby enabling the terminal user to confirm the content.

In this way, with the authentication system 300 of this embodiment, the end user does not need to use history information such as specific personal information or ticket purchase history or medical examination history, and only needs to take a palm to obtain the required information. Hereinafter, the functional configuration and processing flow of the authentication system 300 will be described.

(3.2. Functional composition of the authentication system 300) With reference to FIG. 9, the functional composition of the authentication system 300 will be described. The authentication system 300 includes an authentication terminal 10, a biometric authentication server 20, and a login information server 70. (3.2. 1. Authentication terminal 10) The display unit 14 included in the authentication terminal 10 displays the login information received from the post-authentication processing unit 25 of the biometric authentication server 20.

(3.2. 2. Biometric authentication server 20) The storage unit 23 included in the biometric authentication server 20 correspondingly stores addresses and names as identification information for uniquely identifying multiple registered users Biometric authentication data with multiple registered users. The authentication unit 21 authenticates whether the terminal user is a logged-in user based on the biometric authentication data received from the data transmission unit 17 of the authentication terminal 10. When the authentication is successful, the post-authentication processing unit 25 sends the identification information stored in the storage unit 23 to the login information server 70. The post-authentication processing unit 25 also sends the login information received from the login information server 70 to the display unit 14 of the authentication terminal 10.

(3.2. 3. Log-in information server 70) The log-in information server 70 includes a storage unit 71 that stores identification information and pre-registered log-in information. The login information server 70 sends the login information bound to the identification information received from the post-authentication processing unit 25 to the post-authentication processing unit 25.

(3. 3. Flow of authentication processing) Referring to FIG. 10, the flow of authentication processing of the user of the authentication system 300 will be described. The terminal user uses the authentication terminal 10 to capture the palm of the hand in step S301, and the image captured in step S302 is registered in the authentication terminal 10.

The authentication terminal 10 acquires the image taken by the terminal user in step S303, and generates object authentication data in step S304. The authentication terminal 10 transmits the biometric authentication data to the biometric authentication server 20 in step S305.

The biometric authentication server 20 receives the biometric authentication data in step S306, and performs an authentication process of whether the received object authentication data is registered in the storage unit 23 in step S307. When the authentication process is successful, the biometric authentication server 20 transmits the identification number to the registration information server 70 in step S308. In addition, when the authentication process fails, since the same process as that of Embodiment 1 (step S128a to step S131 in FIG. 4) is performed, the description is abbreviate|omitted.

The registration information server 70 receives the identification number in step S309, and sends the registration information bound to the identification number stored in the storage unit 71 to the biometric authentication server 20 in step S310.

The biometric authentication server 20 receives the registration information in step S311, and sends the registration information to the authentication terminal 10 in step S312.

The authentication terminal 10 receives the login information in step S313, and displays the login information in step S314. The terminal user confirms the login information in step S315.

In this way, the authentication system 300 according to this embodiment includes an authentication terminal 10, a biometric authentication server 20, and a registration information server 70. When the terminal user is authenticated as a login user, the post-authentication processing unit 25 acquires the login information previously registered in the login information server 70 and sends it to the authentication terminal 10.

With such a configuration, the end user does not need to use history information such as specific personal information or ticket purchase history or medical examination history, and can obtain required information only by photographing the palm of the hand. That is, it is possible to perform personal authentication with a simple configuration.

<4. Variations> Hereinafter, variations of the above-mentioned embodiment will be described. The modifications described below are also applicable to any of the above-mentioned embodiments.

(4. 1. Overview of the modified example) Using the authentication system 400 according to the modified example, the identity verification server 80 used to confirm the identity of the logged-in user during the log-in process is pre-registered with the identification information of the logged-in user and obtains The registered identification information is registered in the biometric authentication server 20.

The terminal user inputs the ID and password for identity verification into the authentication terminal 10. The authentication terminal 10 transmits the ID and password to the identity verification server 80, and the identity verification of the terminal user is performed in the identity verification server 80. When the identity confirmation is successful, the identity confirmation server 80 sends the identification information bound to the terminal user to the authentication terminal 10. The authentication terminal 10 transmits the acquired identification information to the biometric authentication server 20, and uses the identification information to perform registration processing in the biometric authentication server 20.

With this configuration, the terminal user can use the identification information previously registered in the identity verification server 80 in the registration process to the biometric authentication server 20, thus saving input time and improving user convenience.

Using such an authentication system 400, as shown in Table 1, based on the reliability of the identification information registered in the identity verification server 80 (ie, the identification information registered in the biometric authentication server 20), it is possible to set available authentication services . As shown in Table 1, the larger the number indicating the security level, the higher the security is required.

[Table 1] Security Level Identification information Available authentication services Card settlement Login information acquisition Access management Level 4 Driver's license number ○ ○ ○ Level 3 Credit card or bank account number ○ ○ ○ Level 2 Member ID or phone number × × × Grade 1 SNS account ID or email address × × ×

For example, when an employee ID (or phone number) corresponding to level 2 is registered in the identity verification server 80, only the authentication service of access management (equivalent to Embodiment 2) can be used. On the other hand, when a driver’s license number conforming to level 4 is registered in the identity verification server 80, or a credit card number (or bank account number) conforming to level 3 is registered in the identity verification server 80, card settlement (equivalent to Embodiment 1), login information acquisition (equivalent to Embodiment 3), and all authentication services for access management.

In this way, based on the reliability of the identification information registered in advance in the identity verification server 80, it is possible to set the authentication services available to the logged-in user, to provide various authentication services, and to ensure the security of each authentication service.

It should be noted that the settings of the security level, identification information, and available authentication service in Table 1 are just examples. For example, the security level may be set to other than 1 to 4. In addition, the identification information may be any combination of the data in Table 1 above, or data not described in Table 1 may be used.

11 and 12, the flow of the authentication process of the user of the authentication system 400 will be described. It should be noted that when the authentication process by the biometric authentication server 20 fails, the same process as in Embodiment 1 is performed (step S128a to step S131 in FIG. 4), so the description is omitted.

As shown in FIG. 11, in steps S401 to S406, the ID and password input by the end user are sent to the identity verification server 80, and identity verification processing is performed. When the identity verification process (step S406) is successful, the identity verification server 80 transmits the identification information registered in the identity verification server 80 to the authentication terminal 10 in step S407a.

The authentication terminal 10 generates biometric authentication data based on the palm image taken by the terminal user in steps S412 to S415. The authentication terminal 10 transmits the identification information and the biometric authentication data acquired from the identity verification server 80 to the biometric authentication server 20 in step S416. The biometric authentication server 20 receives the identification information and the biometric authentication data in step S417, and performs registration processing in step S418.

On the other hand, when the identity verification process (step S406) fails, the identity verification server 80 transmits the result of the identity verification failure to the authentication terminal 10 in step S407a. The authentication terminal 10 displays the failure of the identity verification in step S410.

Alternatively, in the authentication system 400 of the modified example, as shown in FIG. 12, the functions of the authentication terminal 10 may be realized by using different applications of the application 10a for performing the biometric authentication processing and the application 10b for performing the identity verification processing . With such a configuration, it is possible to install the authentication system 500 by using existing applications that perform the identity verification processing.

<5. Other embodiments> The embodiments of this application and its modifications have been described above, but the application of this specification is not limited to the above. For example, in the above-mentioned embodiment, the image acquisition unit 13 included in the authentication terminal 10 acquires an image of the palm of a part of the human body. However, it is not limited to this example. For example, the human face, fingerprints, eye red membrane, and retina Or the image of the ear. For example, when acquiring an image of a face, the biometric authentication data generating unit 15 generates biometric authentication data based on the characteristic shape and vein shape of the face.

Moreover, in the above-mentioned embodiment, for example, the affiliated store of a credit card has the authentication terminal 10, but it is not limited to this. For example, an application for realizing the function of the authentication terminal 10 is installed on a mobile terminal (so-called smart phone, etc.) possessed by the user of the credit card. At this time, the present invention can also be implemented in online shopping at home, for example.

In addition, in the above-mentioned embodiment, as the settlement system 30, the settlement system of the credit card owned by the settlement company is described, but it is not limited to this example. For example, in addition to credit cards, the present invention can also be applied to other settlement cards such as debit cards and prepaid cards.

In addition, in the above-mentioned embodiment, the terminal user does not need to input specific personal information such as a member ID, and can perform personal authentication using biometric authentication data. It can also be configured to input a part or part of the identification number by shortening the keyword. All. In this case, based on the input information, it is possible to reduce the collation object when collating the biometric information, so that the authentication accuracy and speed can be improved.

In addition, in the modified example, the identity verification server 80 transmits the identity verification result to the authentication terminal 10, but it is not limited to this example. For example, the authentication terminal 10 may send the identity verification data and the biometric authentication data to the identity verification server 80, and when the identity verification is successful, the identity verification server 80 transmits the biometric authentication data to the biometric authentication server 20. .

In addition, in order to realize the above-mentioned system, the present invention can also be realized as a program that makes the authentication terminal 10 and the biometric authentication server 20 function.

In addition, the present invention can also be implemented as a computer-readable non-transitory recording medium storing the above-mentioned program.

Various embodiments according to the present invention are mentioned, but these are only examples and do not limit the scope of the present invention. The present invention can also be implemented in other forms, and various omissions, substitutions, and changes can be made without departing from the scope of the present invention. These embodiments or changes should also be regarded as the protection scope of the present invention or its equivalent scope.

10: Authentication terminal 10a, 10b: application 11: Light source for certification 13: Image acquisition department 14: Display 15: Biometric authentication data generation department 17: Data Transmission Department 18: Unlock instruction part 20: Biometric authentication server 21: Certification Department 23: Storage Department 25: Post-certification processing department 30: settlement system 50: Identity verification server 60: Facility Management Server 70: Login Information Server 71: Storage Department 80: Identity verification server 100, 200, 300, 400: authentication system

FIG. 1 is a diagram illustrating the outline of an authentication system 100 according to Embodiment 1 of the present invention. FIG. 2 is a functional block diagram of the authentication system 100. FIG. 3 is a diagram illustrating the flow of user registration processing of the authentication system 100. FIG. 4 is a diagram illustrating the flow of settlement processing of the authentication system 100. FIG. 5 is a diagram of the outline of the authentication system 200 according to the second embodiment. FIG. 6 is a functional block diagram of the authentication system 200. FIG. 7 is a diagram of the flow of authentication processing of the authentication system 200. In FIG. 8, FIG. 8A is a diagram illustrating the outline of an example of the authentication system 300 according to the third embodiment. FIG. 8B is a diagram illustrating the outline of another example of the authentication system 300 according to the third embodiment. FIG. 9 is a functional block diagram of the authentication system 300. FIG. 10 is a diagram illustrating the flow of authentication processing of the authentication system 300. FIG. 11 is a diagram of an example of the flow of authentication processing in a modification example. FIG. 12 is a diagram of another example of the flow of the authentication process of the modification.

10: Authentication terminal

11: Light source for certification

13: Image acquisition department

14: Display

15: Biometric authentication data generation department

17: Data Transmission Department

20: Biometric authentication server

21: Certification Department

23: Storage Department

25: Post-certification processing department

30: settlement system

100: authentication system

Claims (5)

An authentication system that has an authentication terminal and a biometric authentication server. The authentication terminal has an authentication light source, an image acquisition unit, a biometric authentication data generation unit, and a data transmission unit. The authentication light source will include a visible light area. The light of the wavelength irradiates a part of the human body of the end user, the image acquisition unit acquires a reflection image, and the reflection image is generated by light that is irradiated from the authentication light source and reflected on a part of the human body of the end user, The biometric authentication data generating unit extracts the characteristic shape and vein shape of a part of the human body from the acquired reflection image, respectively, to generate biometric authentication data, and the biometric authentication data to be generated by the data transmission unit Sent to the biometric authentication server, the biometric authentication server has a storage unit, an authentication unit, and a post-authentication processing unit, and the storage unit stores in a corresponding manner to uniquely identify multiple login users The identification information and the biometric authentication data of the multiple logged-in users, the authentication unit authenticates whether the terminal user is a logged-in user based on the biometric authentication data received from the data transmission unit, The post-authentication processing unit performs predetermined post-authentication processing when authenticating the terminal user as a logged-in user. The authentication system according to claim 1, wherein, a part of the human body is a palm, and the biometric authentication data generation unit extracts the palm print shape and vein shape of the palm from the acquired reflection image, and generates Biometric authentication data. According to the authentication system described in claim 1 or 2, wherein, it also has a settlement system, the data sending unit sends the biometric authentication data and product purchase data to the biometric authentication server, and the identification information is also Information related to the settlement means of the logged-in user is bound, and the post-authentication processing unit sends the commodity purchase data and information about the settlement means to the settlement system. The authentication system according to claim 1 or 2, wherein, the storage unit also stores the predetermined information bound to the logged-in user as login information, and the post-authentication processing unit stores the end user’s At least one of the authentication result and the login information is sent to the authentication terminal. The authentication system according to claim 1 or 2, wherein, it also has a log-in information server, and the log-in information server is used to store predetermined information bound to the logged-in user as log-in information. After the authentication, The processing unit sends at least one of the authentication result and login information of the terminal user to the authentication terminal.

Images