WO2022269669A1 - Information processing system, server, terminal, information processing method, and program - Google Patents

Abstract

In order to improve the certainty of preventing an identity fraud that a service applicant and a service user are different, this information processing system (1) comprises: a first acquisition unit (11) for acquiring the first biological information of a subject who applies for the use of a service; a first storage control unit (12) for storing the first biological information in a first storage device when identity confirmation of the subject using the first biological information was successful; a second acquisition unit (13) which, when identity confirmation was successful, acquires second biological information different from the first biological information, as biological information for enabling the use by the subject of biometric authentication in a service; a verification unit (14) for verifying the second biological information against the first biological information stored in the first storage device; and a second storage control unit (15) for storing the second biological information in a second storage unit which is referenced in biometric authentication, when verification by the verification unit (14) was successful.

Description

Information processing system, server, terminal, information processing method and program

The present invention relates to an information processing system, a server, a terminal, an information processing method and a program.

A technology that uses biometric information to authenticate a subject is known. For example, Patent Literature 1 discloses a technique of reading personal information including a face image from an IC card, and using imaging data showing the face of the subject and the face image included in the personal information to verify the identity of the subject. is described. Such a technique is used, for example, for identity verification of a target person when applying for use of a service.

The device described in Patent Document 2 acquires the first biometric information of the user stored in the biometric information server based on the user ID input by the user. In addition, the technology compares the acquired first biometric information with the second biometric information acquired via the input device, and registers the second biometric information in the own device when the matching is successful. Execute the registration process. Such technology is used, for example, to perform biometric authentication using the second biometric information when using a service.

Japanese Patent Application Laid-Open No. 2019-050014 International Publication No. 2020/031429

Here, when an application for use of a service is accepted after personal identification is performed using the technology described in Patent Document 1, a problem of spoofing occurs in that the applicant for the service and the user of the service are different. sometimes.

Also, when registering biometric information for authentication when using a service, the technique described in Cited Document 2 cannot be used if the first biometric information is not stored in advance in the biometric information server. Moreover, even if the first biometric information is stored in the biometric information server, the user must enter the user ID into the terminal device in order to refer to the first biometric information. There is a problem that the convenience of the In addition, there is room for improvement in the certainty of preventing spoofing, considering the case where the user ID is known by another person.

One aspect of the present invention has been made in view of the above problems, and an example of its purpose is to prevent spoofing that a service applicant is different from a service user without impairing user convenience. It is to provide a technology that improves certainty.

An information processing system according to one aspect of the present invention includes: a first acquisition unit for acquiring first biometric information of a subject who applies for use of a service; and identity verification of the subject using the first biometric information. a first storage control means for storing the first biometric information in a first storage device if the authentication is successful; a second acquisition means for acquiring second biometric information different from the first biometric information as biometric information for performing the above; the second biometric information; and the biometric information stored in the first storage device. collation means for collating first biometric information; and second storage for storing said second biometric information in a second storage device referred to in said biometric authentication when said collation means succeeds in said collation. and a control means.

A server according to one aspect of the present invention includes first receiving means for receiving, from a terminal, first biometric information of a subject who applies for use of a service, and identity verification of the subject using the first biometric information. a first storage control means for storing the first biometric information in a first storage device if the authentication is successful; second receiving means for receiving second biometric information different from the first biometric information as biometric information for performing the above; the second biometric information; and the biometric information stored in the first storage device Verification means for verifying against first biometric information; and second storage for storing the second biometric information in a second storage device referred to in the biometric authentication when the verification means succeeds in the verification. collation result transmission means for transmitting information based on the collation result by the collation means to a terminal having control means.

A terminal according to one aspect of the present invention is configured to transmit first biometric information of a target person who applies for use of a service to the first biometric information when identity verification of the target person using the first biometric information is successful. a first transmission means for transmitting information to a server having a first storage control means for storing information in a first storage device; and when the identity verification is successful, the subject person can use biometric authentication in the service. second transmitting means for transmitting second biological information different from the first biological information to the server as biological information for and second storage control means for storing the second biometric information in a second storage device when the matching with the biometric information is successful.

An information processing method according to one aspect of the present invention comprises acquiring first biometric information of a subject who applies for use of a service, and when the identity of the subject is successfully verified using the first biometric information, Storing the first biometric information in a first storage device, and storing the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful. Acquiring second biometric information that is different from biometric information, matching the second biometric information with the first biometric information stored in the first storage device, and succeeding in the matching case, storing the second biometric information in a second storage device referred to in the biometric authentication.

An information processing method according to one aspect of the present invention comprises receiving first biometric information of a subject who applies for use of a service, and when the identity of the subject is successfully verified using the first biometric information, Storing the first biometric information in a first storage device, and storing the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful. receiving second biometric information different from the biometric information, matching the second biometric information with the first biometric information stored in the first storage device, and succeeding in the matching transmitting information based on the result of the verification to a terminal having a second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication in the case of include.

An information processing method according to an aspect of the present invention provides a method of transmitting first biometric information of a target person who applies for use of a service to the first biometric information when identity verification of the target person using the first biometric information is successful. to a server that stores the biometric information in the first storage device, and if the identity verification is successful, the biometric information for enabling the subject person to use biometric authentication in the service, transmitting to the server second biometric information different from the biometric information of the second biometric information when the server succeeds in matching the first biometric information and the second biometric information; storing in a second storage device.

A program for causing a computer to function as an information processing device, the computer comprising: first receiving means for receiving first biological information of a subject applying for use of a service; a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject who has been successfully completed; a second receiving means for receiving second biometric information different from the first biometric information as biometric information for enabling use of biometric authentication; the second biometric information; collation means for collating the first biometric information stored in a storage device; and the second biometric information stored in a second storage device referred to in the biometric authentication when the collation is successful by the collation means. collation result transmission means for transmitting information based on the collation result by the collation means to a terminal having a second storage control means for storing the .

A program according to one aspect of the present invention is a program for causing a computer to function as an information processing device, wherein the computer receives first biometric information of a subject who applies for use of a service, the first biometric information. a first transmission means for transmitting the first biometric information to a server having a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject is successful using the said person; second biometric information different from the first biometric information is transmitted to the server as biometric information for enabling the use of biometric authentication by the subject in the service if the confirmation is successful; transmitting means; and second storage control means for storing the second biometric information in a second storage device when the server succeeds in matching the first biometric information and the second biometric information. , to function as

According to one aspect of the present invention, it is possible to improve the certainty of preventing spoofing that the service applicant is different from the service user without impairing the user's convenience.

1 is a block diagram showing the configuration of an information processing system according to exemplary Embodiment 1 of the present invention; FIG. FIG. 3 is a flow diagram showing the flow of an information processing method according to exemplary embodiment 1 of the present invention; 2 is a block diagram showing a schematic configuration of an information processing system 2 according to exemplary Embodiment 2 of the present invention; FIG. FIG. 4 is a block diagram showing the configuration of a terminal according to exemplary embodiment 2 of the present invention; FIG. 10 is a block diagram showing the configuration of a server according to exemplary embodiment 2 of the present invention; FIG. 7 is a flow diagram showing the flow of an information processing method according to exemplary embodiment 2 of the present invention; FIG. 10 is a block diagram showing the configuration of an information processing system according to exemplary Embodiment 3 of the present invention; FIG. 10 is a block diagram showing the configuration of a terminal and a server according to exemplary Embodiment 3 of the present invention; FIG. 8 is a flow diagram illustrating a method flow for performing an identity verification phase according to illustrative embodiment 3 of the present invention; FIG. 8 is a flow diagram illustrating a method flow for performing a usage registration phase of online authentication according to exemplary embodiment 3 of the present invention; FIG. 10 is a diagram showing an example of a screen displayed on a terminal according to exemplary embodiment 3 of the present invention; FIG. 10 is a diagram showing an example of a screen displayed on a terminal according to exemplary embodiment 3 of the present invention; FIG. 10 is a diagram showing an example of a screen displayed on a terminal according to exemplary embodiment 3 of the present invention; FIG. 8 is a diagram showing storage states of a first storage device and storage states of a second storage device according to exemplary embodiment 3 of the present invention; 1 is a block diagram showing the configuration of a computer functioning as an information processing system, terminal, server, or service providing server according to illustrative embodiments 1 to 3 of the present invention; FIG.

[Exemplary embodiment 1]
A first exemplary embodiment of the invention will now be described in detail with reference to the drawings. This exemplary embodiment is the basis for the exemplary embodiments described later.

<Configuration of information processing system>
A configuration of an information processing system 1 according to this exemplary embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of an information processing system 1. As shown in FIG. As shown in FIG. 1, the information processing system 1 includes a first acquisition unit 11, a first storage control unit 12, a second acquisition unit 13, a collation unit 14, and a second storage control unit 15. and The information processing system 1 is composed of one or more information processing devices. When the information processing system 1 is composed of a plurality of devices, these functional blocks are distributed and arranged in the plurality of devices.

The first acquisition unit 11 is an example of a configuration that implements the first acquisition means described in the claims. The first storage control unit 12 is an example of a configuration that implements the first storage control means described in the claims. The second acquisition unit 13 is an example of a configuration that implements the second acquisition means recited in the claims. The collation unit 14 is an example of a configuration that implements collation means described in the claims. The second storage control unit 15 is an example of a configuration that implements the second storage control means described in the claims.

The first acquisition unit 11 acquires the first biometric information of the target person who applies to use the service. The first storage control unit 12 stores the first biometric information in the first storage device when the identity verification of the subject using the first biometric information is successful. The second acquisition unit 13 acquires second biometric information different from the first biometric information as biometric information for enabling the use of biometric authentication by the target person in the service when the identity verification is successful. . The collation unit 14 collates the second biometric information with the first biometric information stored in the first storage device. The second storage control unit 15 stores the second biometric information in the second storage device referred to in biometric authentication when the collation unit 14 succeeds in collation.

(First biological information)
The first biometric information includes biometric information representing biological characteristics of the subject. The subject's biometric information is, for example, information representing the subject's face image, fingerprint, voiceprint, vein, palmprint, or iris. The first biometric information is information used for identity verification of the subject, and represents, for example, a read image or a photographed image of an official document such as a driver's license or passport to which the subject's face image is attached. Data.

(Second biological information)
The second biometric information includes biometric information representing the biological characteristics of the subject. The second biometric information is, for example, registered as information for verification in online authentication. The second biological information is, for example, data representing an image of the subject's face.

(biometric authentication)
Biometric authentication is authentication using a subject's biometric information. For biometric authentication, for example, a template matching method for an image representing a fingerprint or a face image, a feature point extraction method, a frequency analysis method, and the like are used. In addition, biometric authentication may discriminate a subject using a machine-learned model. The biometric authentication according to this exemplary embodiment is not limited to those using these methods, and may be biometric authentication using other methods.

<Flow of information processing method>
The flow of the information processing method S1 executed by the information processing system 1 configured as described above will be described with reference to FIG. FIG. 2 is a flow diagram showing the flow of the information processing method S1.

(First acquisition step S11)
In a first acquisition step S11 (first acquisition process), the first acquisition unit 11 acquires first biometric information of a subject who applies for use of the service. For example, the first acquisition unit 11 may acquire the first biometric information from a device connected via a network, or may acquire the first biometric information by reading it from a memory. For example, if the first biometric information is a photographed image of a driver's license of a subject, the first acquisition unit 11, for example, acquires the image data representing the image of the driver's license photographed by the camera as the first biometric information. to get as Further, when the first biometric information is a facial image, the first acquiring unit 11 acquires image data representing the facial image captured by the camera as the first biometric information, for example. Further, when the first biometric information is information representing a fingerprint, the first acquisition unit 11 may be, for example, an optical sensor, a capacitance sensor, an electric field sensor, a thermal sensor, a pressure sensor, or the like. to obtain data representing an image read by the sensor of .

(First memory control step S12)
In the first storage control step S12 (first storage control process), the first storage control unit 12 stores the first biometric information when the identity verification of the subject using the first biometric information is successful. Store in the first storage device. The information processing system 1 may perform the identity verification of the subject using the first biometric information, or another device may perform the identity verification. Alternatively, an administrator or the like of the information processing system 1 may verify the identity of the subject and input the verification result to the information processing system 1 . In this case, the first storage control unit 12 determines whether or not the personal identification has succeeded based on the information indicating the input result.

(Second acquisition step S13)
If the subject's identity verification using the first biometric information is successful, in the second acquisition step S13, the second acquisition unit 13 collects the biometric information for enabling the subject to use biometric authentication in the service. As information, second biometric information different from the first biometric information is acquired. For example, the second acquisition unit 13 may acquire the second biometric information from a device connected via a network, or may acquire the second biometric information by reading it from a memory. When the second biometric information is a facial image, the second acquiring unit 13 acquires image data representing the facial image captured by the camera as the second biometric information, for example. Further, when the second biometric information is information representing a fingerprint, the second acquisition unit 13 may be, for example, an optical sensor, a capacitance sensor, an electric field sensor, a thermal sensor, a pressure sensor, or the like. to obtain data representing an image read by the sensor of .

(Collation step S14)
In the collation step S14, the collation unit 14 collates the second biometric information with the first biometric information stored in the first storage device. For example, the matching unit 14 performs matching using an image representing a fingerprint or a face image template matching method, a feature point extraction method, a frequency analysis method, or the like. In addition, as an example, the matching unit 14 may determine the matching result using a learned model learned by machine learning.

(Second memory control step S15)
In the second storage control step S15, the second storage control unit 15 stores the second biometric information in the second storage device referred to in biometric authentication when the matching unit 14 succeeds in matching. As an example, the second storage control unit 15 may store the second biological information in a second storage device connected via a network.

<Effects of this exemplary embodiment>
As described above, in the information processing system 1 according to the present exemplary embodiment, the first biometric information of the subject who applies for the use of the service is acquired, and the identification of the subject is performed using the first biometric information. If successful, the first biometric information is stored in the first storage device, and if the identity verification is successful, the first biometric information is stored as biometric information for enabling the subject person to use biometric authentication in the service. acquire second biometric information different from the first biometric information, compare the second biometric information with the first biometric information stored in the first storage device, and refer to biometric authentication if the collation is successful A configuration is adopted in which the second biometric information is stored in the second storage device. According to the above configuration, it is only necessary to use the first biometric information obtained when applying for the service and the second biometric information obtained to enable the use of biometric authentication in the service, and the user ID and the link are used. It does not require a server in which the attached first biometric information is stored in advance. As a result, it is possible to obtain the effect of improving the certainty of preventing spoofing that the applicant of the service and the user of the service are different without impairing the user's convenience.

[Exemplary embodiment 2]
Exemplary embodiment 2 of the present invention will be described in detail with reference to the drawings. Components having the same functions as the components described in the exemplary embodiment 1 are denoted by the same reference numerals, and descriptions thereof are omitted as appropriate. This exemplary embodiment is a form in which the information processing system 1 according to exemplary embodiment 1 is configured with a plurality of devices.

<Configuration of information processing system>
The configuration of the information processing system 2 according to this exemplary embodiment will be described with reference to FIG. FIG. 3 is a block diagram showing a schematic configuration of the information processing system 2. As shown in FIG. As shown in FIG. 3 , the information processing system 2 includes a terminal 20 and a server 30 . Terminal 20 and server 30 are communicably connected to each other via a network. The network is composed of, for example, a wireless LAN, a wired LAN, a mobile data communication network, the Internet, or a combination of some or all of these.

<Device configuration>
A configuration of the terminal 20 will be described with reference to FIG. FIG. 4 is a block diagram showing the configuration of the terminal 20. As shown in FIG. Terminal 20 includes first transmission section 201 , second transmission section 202 , and second storage control section 203 . The first transmission unit 201 is an example of a configuration that implements the first transmission means recited in the claims. The second transmission unit 202 is an example of a configuration that implements the second transmission means described in the claims. The second storage control unit 203 is an example of a configuration that implements the second storage control means described in the claims.

The first transmission unit 201 transmits to the server 30 the first biometric information of the target person who applies for the service. As will be described later, the server 30 has a first storage control unit 302 that stores the first biometric information in the first storage device when the identification of the subject using the first biometric information is successful. When the identity verification using the first biometric information is successful, the second transmission unit 202 uses the biometric information different from the first biometric information as the biometric information for enabling the use of biometric authentication by the target person in the service. The second biometric information is transmitted to the server 30 . The second storage control unit 203 stores the second biometric information in the second storage device when the server 30 successfully matches the first biometric information and the second biometric information.

<Server configuration>
A configuration of the server 30 will be described with reference to FIG. FIG. 5 is a block diagram showing the configuration of the server 30. As shown in FIG. The server 30 includes a first reception section 301 , a first storage control section 302 , a second reception section 303 , a collation section 304 and a collation result transmission section 305 . The first receiving section 301 is an example of a configuration that implements the first receiving means described in the claims. The first storage control unit 302 is an example of a configuration that implements the first storage control means described in the claims. The second receiving section 303 is an example of a configuration that implements the second receiving means described in the claims. The collation unit 304 is an example of a configuration that implements collation means described in the claims. The collation result transmission unit 305 is an example of a configuration that implements the collation result transmission unit described in the claims.

The first receiving unit 301 receives from the terminal 20 the first biometric information of the target person who applies for the use of the service. The first storage control unit 302 stores the first biometric information in the first storage device when the identity verification of the subject using the first biometric information is successful. When the identity verification is successful, the second receiving unit 303 receives second biometric information different from the first biometric information as biometric information for enabling the use of biometric authentication by the target person in the service. . A collation unit 304 collates the second biometric information with the first biometric information stored in the first storage device. The matching result transmission unit 305 transmits information based on the matching result by the matching unit 304 to the terminal 20 . As described above, the terminal 20 has the second storage control unit 203 that stores the second biometric information in the second storage device that is referred to in biometric authentication when the matching unit 304 succeeds in matching. Information based on the matching result is, for example, information indicating that the matching was successful or information indicating that the matching was unsuccessful.

<Flow of information processing method>
The flow of the information processing method S2 executed by the information processing system 2 configured as described above will be described with reference to FIG. FIG. 6 is a flowchart showing the flow of the information processing method S2.

(First transmission step S201/first reception step S202)
In a first transmission step S<b>201 (first transmission processing), the first transmission unit 201 transmits to the server 30 first biometric information of a subject who applies for use of the service. In a first receiving step S<b>202 (first receiving process), the first receiving unit 301 receives first biological information from the terminal 20 .

(First memory control step S203)
In the first storage control step S203 (first storage control process), the first storage control unit 302 stores the first biometric information when the identity verification of the subject using the first biometric information is successful. Store in the first storage device.

(Second transmission step S204/second reception step S205)
If the identity verification using the first biometric information is successful, in the second transmission step S204 (second transmission processing), the second transmission unit 202 enables the subject person to use biometric authentication in the service. Second biometric information, which is different from the first biometric information, is transmitted to the server 30 as the biometric information for performing this. In the second receiving step S<b>205 , the second receiving unit 303 receives second biological information from the terminal 20 .

(Verification step S206/Verification result transmission step S207)
In the matching step S206 (matching process), the matching unit 304 matches the second biometric information received by the second receiving unit 303 with the first biometric information stored in the first storage device. In the matching result transmission step S<b>207 (matching result transmission process), the matching result transmitting unit 305 transmits information based on the matching result by the matching unit 304 to the terminal 20 .

(Second storage control step S208)
In the second storage control step S208 (storage control processing), the second storage control unit 203 stores the second biometric information when the server 30 succeeds in matching the first biometric information and the second biometric information. is stored in the second storage device.

<Effects of this exemplary embodiment>
As described above, in the server 30 according to the present exemplary embodiment, the first biometric information of the subject who applies for the service is received from the terminal, and the identification of the subject is performed using the first biometric information. If successful, the first biometric information is stored in the first storage device, and if the identity verification is successful, the first biometric information is stored as the biometric information for enabling the subject person to use biometric authentication in the service. receives second biometric information different from the biometric information of the terminal 20, compares the second biometric information with the first biometric information stored in the first storage device, and if the matching is successful, the terminal 20 A configuration is adopted in which information based on the collation result is transmitted to. According to the above configuration, it is only necessary to use the first biometric information obtained from the terminal when applying for the service and the second biometric information obtained from the terminal to enable the use of biometric authentication in the service, A server in which the first biometric information associated with the user ID is stored in advance is not required. As a result, it is possible to obtain the effect of improving the certainty of preventing spoofing that the applicant of the service and the user of the service are different without impairing the user's convenience.

In addition, in the terminal 20 according to the present exemplary embodiment, the first biometric information of the target person applying for the service is transmitted to the server 30, and if the target person's identity is successfully verified, the service uses the biometric information of the target person. Second biometric information different from the first biometric information is transmitted to the server 30 as biometric information for enabling the use of authentication, and the server 30 compares the first biometric information and the second biometric information. A configuration is adopted in which the second biometric information is stored in the second storage device when the collation is successful. According to the above configuration, the terminal only needs to transmit the first biometric information when applying for a service, and transmit the second biometric information to enable the use of biometric authentication in the service. No need to fetch and send to the server. As a result, it is possible to obtain the effect of improving the certainty of preventing spoofing that the applicant of the service and the user of the service are different without impairing the user's convenience.

[Exemplary embodiment 3]
Exemplary embodiment 3 of the present invention will be described in detail with reference to the drawings. Components having the same functions as those described in exemplary embodiments 1 and 2 are denoted by the same reference numerals, and description thereof will not be repeated.

FIG. 7 is a block diagram showing the configuration of an information processing system 2A according to this exemplary embodiment. The information processing system 2A is a system that performs identity verification of end users who use services provided by service providers and online authentication using biometric authentication. Examples of services provided by service providers include internet banking, car sharing services, and voice call services using mobile phone terminals using SIM cards (Subscriber Identity Module Cards). Personal identification is performed, for example, when a target person opens an Internet banking account, applies for car sharing, or purchases a SIM card. Online authentication is performed, for example, when a target person uses services such as online money transfer, use of a car in car sharing, voice communication using a SIM card, and the like.

The information processing system 2A performs identity verification of the end user by eKYC (electronic Know Your Consumer), and performs authentication according to the FIDO (Fast IDentity Online) protocol as online authentication for using the above service (hereinafter referred to as "FIDO authentication). eKYC is a technology for non-face-to-face identity verification such as online. FIDO is an authentication technology that performs end-user biometric authentication on the terminal side. In the following description, the end user of the information processing system 2A is also called "subject".

(Identification)
Identity confirmation is to confirm that the person to be declared is the person himself/herself, and includes identification of the person to be identified and authentication of the person himself/herself. Identity confirmation is confirmation of the existence of a subject, and for example, confirmation through official documents that attribute information such as declared name and address is correct. Identity authentication means confirming that the subject person is the person who declared it by means of authentication factors (knowledge, possession, biometrics, etc.).

The information processing system 2A includes a terminal 20A, a server 30A, a biometric information storage device 40A, and a service providing server 80. The terminal 20A, the server 30A and the service providing server 80 are communicably connected to each other via a network. The network is composed of, for example, a wireless LAN, a wired LAN, a mobile data communication network, the Internet, or a combination of some or all of these. Although one terminal 20A is illustrated in FIG. 6, the number of terminals 20A is not limited to one.

The terminal 20A is a terminal used by the subject, such as a laptop computer, desktop computer, tablet terminal, or smart phone. The server 30A is a device that performs identity verification and online authentication of a subject. Server 30A may be a single device, or may be implemented by a plurality of devices working together.

The biometric information storage device 40A is a device that stores first biometric information. The biological information storage device 40A may be built in the server 30A, or may be a separate device connected to the server 30A via an input/output interface or a communication interface. The service providing server 80 is a server for providing customer services.

<Device configuration>
FIG. 8 is a block diagram showing configurations of the terminal 20A and the server 30A. The terminal 20A includes a first transmission section 201A, a second transmission section 202A, a second memory control section 203A, a biometric information storage section 206A, an authentication section 207A, and an imaging section 208A.

The first transmission unit 201A transmits the first biological information of the subject to the server 30A. When the server 30A successfully verifies the identity of the target person, the second transmission unit 202A transmits to the server 30A the second biometric information, which serves as verification data referred to in online authentication. The second storage control unit 203A stores the second biometric information in the biometric information storage unit 206A. The biometric information storage unit 206A is a storage device that stores second biometric information, and is an example of a configuration that implements the second storage device described in the claims.

The authentication unit 207A performs authentication using the second biometric information stored in the biometric information storage unit 206A. The authentication performed by the authentication unit 207A is, for example, authentication according to the FIDO protocol. The photographing unit 208A is a photographing device that photographs a subject.

In this exemplary embodiment, the first biometric information is image data obtained by photographing an official document to which the subject's facial photograph is attached, or image data obtained by reading the official document. That is, the first biometric information includes biometric information of the subject and information used for identification of the subject. Below, the official document to which the target person's face photo is attached is also referred to as "confirmation document". Confirmation documents are, for example, a driver's license, passport, residence card, and my number card. Information used for identification of the subject includes, for example, information representing the subject's address, name, telephone number, or date of birth. Also, in this exemplary embodiment, the second biometric information is image data obtained by photographing the subject's face.

<Server configuration>
The server 30A includes a first receiving section 301A, a first storage control section 302A, a second receiving section 303A, a matching section 304A, a biometric authentication management section 305A, and a confirmation section 306A. 305 A of biometrics management parts are an example of the structure which implement|achieves the collation result transmission means described in the claim. 306 A of confirmation parts are an example of the structure which implement|achieves the confirmation means described in the claim.

The first receiving unit 301A receives the first biological information and the third biological information of the subject from the terminal 20A. The first storage control unit 302A stores the first biometric information in the biometric information storage device 40A. The second receiver 303A receives the second biological information. 304 A of collation parts collate the 1st biometric information memorize|stored in 40 A of biometric information storages, and the 2nd biometric information which 303 A of 2nd receiving parts received. 305 A of biometrics management parts transmit the information based on the collation result by the collation part 304 to the terminal 20. FIG. Confirmation unit 306A performs identity verification of the subject using the first biometric information and the third biometric information.

<Flow of information processing method>
The flow of the information processing method executed by the information processing system 2A configured as described above will be described with reference to the drawings. The information processing method performed by the information processing system 2A includes (i) a phase of identity verification and (ii) a phase of online authentication usage registration.

(Identification phase)
FIG. 9 is a flowchart showing the flow of the execution method S3 of the personal identification phase performed by the information processing system 2A. The information processing system 2A performs identity verification using an image representing the confirmation document photographed by the subject and a face image obtained by photographing the subject's face. A general-purpose application (WEB browser, etc.) for exchanging data with the service providing server 80 and the server 30A, and a dedicated application for using services using FIDO authentication are pre-installed in the terminal 20A.

The target person uses the terminal 20A to perform an operation to apply for the use of the service provided by the service provider. As an example, the target person uses the terminal 20A to enter information indicating the SIM plan to be contracted, information indicating agreement to the contract, personal identification information, etc. in the application reception system provided by the service provider. At the same time, an operation to apply for use of the service is performed. The personal identification information includes, for example, information representing the address, name, telephone number, or date of birth of the target person.

(S301)
In step S301, the terminal 20A transmits a request to start applying for a service to the service providing server 80 based on the operation details of the subject. This request includes, by way of example, the subject's identification information.

(S302)
When the service providing server 80 receives the request from the terminal 20A, in step S302, the service providing server 80 transmits a request for personal identification processing to the server 30A. Specifically, for example, the request transmitted from the service providing server 80 is redirected by the WEB browser of the terminal 20A, and the request is transmitted to the server 30A.

(S303)
When the server 30A receives a request for identity verification processing from the service providing server 80, the server 30A transmits a request for the verification document of the subject and the face image of the subject to the terminal 20A. The data representing the confirmation document is an example of the first biometric information described in the claims, and the data representing the face image of the subject is an example of the third biometric information described in the claims. The server 30A transmits, for example, screen data for photographing the confirmation document and screen data for photographing the subject's face to the terminal 20A.

(S304)
The terminal 20A displays a screen for photographing an official document for personal identification based on the screen data received from the server 30A.

FIG. 11 is a diagram showing an example of the screen displayed on the terminal 20A in step S305. The screen G1 includes a guide message for photographing the confirmation document, a photographing button, and the like. The subject photographs an official document for personal identification on the screen G1. After photographing the confirmation document, the terminal 20A displays a screen for photographing the subject's face.

FIG. 12 is a diagram showing an example of a screen for photographing a subject's face. The screen G2 includes a guide message for photographing the subject's face, a photographing button, and the like. The subject photographs the subject's face on the screen G2.

The terminal 20A analyzes the image data generated by shooting and determines whether there is any problem with the image data. For example, if the subject wears a hat, mask, sunglasses, or the like, facial feature points cannot be acquired. Therefore, when the terminal 20A determines that the feature points of the face cannot be acquired, the terminal 20A requests the subject to re-photograph.

(S305)
In step S305, the terminal 20A transmits image data of the photographed confirmation document and image data of the subject's face to the server 30A. Hereinafter, the image data obtained by photographing the confirmation document and the image data obtained by photographing the face of the subject are also referred to as "confirmation document image" and "face image", respectively. The terminal 20A may collectively transmit the confirmation document image and the face image to the server 30A, or may transmit the confirmation document image and the face image individually.

(S306)
In step S306, the first receiving unit 301A receives the confirmation document image and the face image from the terminal 20A. That is, the first receiver 301A acquires the first biological information and the third biological information.

(S307)
In step S307, the confirmation unit 306A performs identity verification using the confirmation document image and face image received in step S306. The confirmation unit 306A performs identification by, for example, collating the target person's attribute information included in the confirmation document image with the target person's identification information included in the request received in step S301. Further, the confirmation unit 306A performs person authentication by comparing the face image of the subject included in the confirmation document image received in step S306 with the face image received in step S306. The confirmation unit 306A performs matching of face images by, for example, template matching of face images, or acquiring output data output from a machine-learned model.

(S308)
In step S308, the first storage control unit 302A determines whether the identity verification of the subject has succeeded. If the personal identification is successful (YES in step S308), the first storage control unit 302A proceeds to the process of step S309. On the other hand, if the identity verification fails (NO in step S308), the first storage control unit 302A skips the processing of steps S309 to S311. When the personal identification fails, the first storage control unit 302A transmits a response to the effect that the personal identification has failed to the service providing server 80 .

(S309/S310)
In step S309, the first storage control unit 302A generates a first biometric template representing an image obtained by cutting out the facial photograph portion of the confirmation document image. The first storage control unit 302A stores the generated first template in the first storage device (biological information storage device 40A).

(S311/S312)
In step S311, the biometric authentication management unit 305A notifies the service providing server 80 that the personal identification has succeeded. The service providing server 80 transmits a notification indicating completion of the application to the terminal 20A.

(Use registration phase of authentication)
After the terminal 20A receives the service application completion notification from the service providing server 80, in order to use FIDO authentication as authentication for using the service, FIDO registration is performed and biometric information for reference is sent to the terminal 20A. It is necessary to register the second biometric information. After transmitting the application completion notification to the terminal 20A, the service providing server 80 transmits "information for requesting start of biometric authentication usage registration" to the terminal 20A. The information is, for example, the address of the "biometric authentication use registration page" described in the e-mail. In addition, after completing the application for the service by the target person, the service provider will confirm whether there are any defects in the application content in order to make the service available to the target person, and after confirmation, the service providing server 80 is used to transmit the above information to the terminal 20A. Since this confirmation may require a period of time, it may take several days to several weeks from the completion of the identity confirmation phase to the start of the use registration phase of authentication. The terminal 20A starts the authentication use registration phase by referring to the “information for requesting start of use registration of biometric authentication” transmitted from the service providing server 80 .

FIG. 10 is a flowchart showing the flow of the execution method S4 of the use registration phase of online authentication performed by the information processing system 2A. The target person uses the terminal 20A to perform an operation for requesting the start of registration for use of FIDO authentication.

(S401-S403)
In step S<b>401 , the terminal 20</b>A transmits a request to start registration for use of biometric authentication to the service providing server 80 . Upon receiving the request from terminal 20A, service providing server 80 transmits a request for a face image to terminal 20A in step S402. In step S403, the terminal 20A displays a screen for photographing the subject's face.

FIG. 13 is a diagram illustrating the screen displayed in step S403. The screen of FIG. 13 includes a guide message for photographing the subject's face, a photographing button, and the like. The subject photographs the subject's face on the screen of FIG. The terminal 20A analyzes the image data generated by shooting and determines whether there is any problem with the image data. For example, if the subject wears a hat, mask, sunglasses, or the like, facial feature points cannot be obtained. Therefore, when the terminal 20A determines that the feature points of the face cannot be acquired, the terminal 20A requests the subject to re-photograph.

(S404)
In step S404, the terminal 20A stores the captured face image (second biometric information) in a predetermined memory and transmits the face image to the server 30A.

(S406/S407)
In step S406, server 30A receives the face image from terminal 20A. In step S407, the matching unit 304A acquires the first biometric information from the biometric information storage device 40A.

(S408)
In step S408, the collation unit 304A collates face images. That is, the collation unit 304A collates each of the N (N is a natural number) first biometric information stored in the biometric information storage device 40A with the second biometric information received in step S406. In this operation example, since the first biometric information is generated from the facial photograph of the personal identification document, it is verified whether the service applicant and the service user are the same person by matching the facial images. It is possible.

(S409)
In step S409, the collation unit 304A determines whether the collation is successful. If the matching is successful (YES in step S409), the matching unit 304A proceeds to the process of step S410. On the other hand, if the collation fails (NO in step S409), collation unit 304A skips steps S410 to S420. Also, when the verification fails, the biometrics management unit 305A transmits a response indicating that the verification has failed to the service providing server 80 .

(S410)
In step S410, the first storage control unit 302A deletes the successfully matched first biometric template from the biometric information storage device 40A. That is, when the collation unit 304A succeeds in collation (YES in step S409), the first storage control unit 302A deletes the successfully collated first biometric information from the first storage device.

(S411/S412)
In step S411, the biometric authentication management unit 305A transmits to the service providing server 80 a matching result indicating that the matching unit 304 has successfully performed matching. In step S412, the service providing server 80 requests registration for use of biometric authentication. That is, the service providing server 80 that has received the collation result transmits a registration request for FIDO authentication to the server 30A, and carries out communication by the challenge-response method.

(S413)
In step S413, the server 30A transmits a use registration request (challenge) for FIDO authentication to the terminal 20A via the service providing server 80. FIG. Note that the server 30A may directly transmit the registration request to the terminal 20A without going through the service providing server 80. FIG.

(S414/S415)
In step S414, when the terminal 20A receives the registration request from the server 30A, the terminal 20A generates a second biological template from the second biological information, which is the face image stored in the predetermined memory in step S404. In step S415, the terminal 20A stores the second biometric template generated in step S414 in the biometric information storage unit 206A (second storage unit).

(S416/S417)
In step S416, the terminal 20A generates a private key and a public key required for FIDO authentication in accordance with the FIDO standard specifications, and stores the private key within the terminal 20A. In step S417, the terminal 20A transmits the generated public key to the server 30A via the service providing server 80. FIG. Note that the terminal 20A may transmit the public key directly to the server 30A without going through the service providing server 80. FIG.

(S418/S419)
In step S418, upon receiving the public key from terminal 20A, server 30A stores the received public key in a predetermined storage device. In step S419, the server 30A notifies the terminal 20A via the service providing server 80 of completion of registration. The server 30A may directly transmit the registration completion notification to the terminal 20A without going through the service providing server 80. FIG.

The terminal 20A performs FIDO authentication in the service provided by the service providing server 80 using the second biometric information stored in the biometric information storage unit 206A.

Thus, in this exemplary embodiment, the storage period of the first biometric template to prevent spoofing is minimized. The retention period of the first biological template will be described with reference to FIG. 14 . FIG. 14 is a diagram for explaining the retention period of the first biological template. As shown in FIG. 14, in this exemplary embodiment, when the subject applies for the service, the subject's first biometric template is stored in the first storage device (biometric information storage device 40A). No. The first biometric template is stored in the first storage device when the application for use is completed and when the subject is registered for use of biometric authentication. Further, when the use registration is completed, the first biological template is deleted from the first storage device, and in exchange, the second biological template is stored in the second storage device (biological information storage unit 206A). ing. Therefore, the storage period of the first biometric template is, at the longest, from when the application for use is completed until immediately before the registration for use of biometric authentication is completed. As a result, the number of first biological templates stored in the first storage device does not increase excessively. Therefore, in step S408, the number of first biometric templates to be matched with face images by the matching unit 304A does not increase excessively, which contributes to shortening the matching time of the matching unit 304A.

As described above, according to this exemplary embodiment, the information processing system 2A temporarily holds the face image (first biometric information) included in the confirmation document used for identity verification of the subject. , when the target person starts using online authentication, the person is authenticated using the first biometric information held. This prevents biometric information of a subject different from the subject whose identity has been verified from being registered as information for online authentication verification.

Further, according to this exemplary embodiment, when the collation unit 304A succeeds in collation, the successfully collated first biometric information is deleted from the biometric information storage device 40A. As a result, the number of pieces of first biometric information stored in the biometric information storage device 40A can be minimized, and the time required for collation can be shortened. In addition, by deleting the first biometric information of the target person whose collation has succeeded, the biometric information of the target person is not held on the server side, and the risk of information leakage is reduced.

<Modification>
(Modification 1)
In the exemplary embodiment described above, the case where the information processing system 2A performs FIDO authentication as online authentication has been described. The online authentication performed by the information processing system 2A is not limited to that shown in the above-described embodiment, and may be authentication according to other protocols using biometric information.

Also, for example, online authentication may be authentication based on server-type biometric authentication in which the second biometric template is stored on the server side. In this case, instead of the terminal 20A including the biometric information storage unit 206A, the server 30A includes the biometric information storage unit 206A. However, from the viewpoint of reducing communication time and collating time with a plurality of second biometric templates registered in the server, it is desirable that the second biometric template is stored on the terminal side.

(Modification 2)
In the exemplary embodiment described above, the information processing system 2A performs identity verification and person authentication of the subject in the identity verification phase, but the information processing system 2A performs only identity verification in the identity verification phase, You don't have to authenticate yourself. In this case, the information processing system 2A stores the first biometric information in the biometric information storage device 40A without performing identity verification in the identity verification phase when the identity verification is successful.

In addition, in the exemplary embodiment described above, the information processing system 2A confirmed the identity of the subject by comparing the subject's attribute information included in the confirmation document with the content of the service application. Methods of identification are not limited to those shown in the exemplary embodiments described above. For example, the information processing system 2A may perform identity verification based on documents other than official documents, or may perform identity verification by inquiring other services using information about the subject.

(Modification 3)
In the exemplary embodiment described above, the first biometric information is image data representing a confirmation document, but the first biometric information is not limited to that shown in the exemplary embodiment described above. The first biometric information includes the subject's biometric information and information used for identifying the subject, and the subject's biometric information includes, for example, the subject's fingerprint, voiceprint, vein, palmprint, or iris It may contain information representing

Further, in the above-described exemplary embodiments, the case where the second biological information and the third biological information are image data obtained by photographing the face of the subject has been described. The information is not limited to that shown in the exemplary embodiments described above. The second biometric information and the third biometric information may include, for example, information representing the subject's fingerprint, voiceprint, vein, palmprint, or iris. In other words, the first biometric information, the second biometric information, and the third biometric information may include information representing at least one of an image of a person's face, a fingerprint, and a voiceprint.

(Modification 4)
In the exemplary embodiment described above, the verification unit 306A of the server 30A performs identity verification using the confirmation document image and face image received from the terminal 20A. Alternatively, an administrator or the like of the information processing system 1 may verify the identity of the target person and input the verification result to the information processing system 1 . In this case, the first storage control unit 302A determines whether or not the personal identification has succeeded based on the input information indicating the result.

[Example of realization by software]
Some or all of the functions of the information processing system 1, the terminals 20 and 20A, the servers 30 and 30A, and the service providing server 80 may be realized by hardware such as integrated circuits (IC chips), or by software. You may

In the latter case, the information processing system 1, the terminals 20 and 20A, the servers 30 and 30A, and the service providing server 80 are implemented, for example, by computers that execute program instructions that are software that implements each function. An example of such a computer (hereinafter referred to as computer C) is shown in FIG. Computer C comprises at least one processor C1 and at least one memory C2. A program P for operating the computer C as the information processing system 1, the terminals 20 and 20A, the servers 30 and 30A, and the service providing server 80 is recorded in the memory C2. In the computer C, the processor C1 reads the program P from the memory C2 and executes it, thereby implementing the functions of the information processing system 1, the terminals 20 and 20A, the servers 30 and 30A, and the service providing server 80.

As the processor C1, for example, CPU (Central Processing Unit), GPU (Graphic Processing Unit), DSP (Digital Signal Processor), MPU (Micro Processing Unit), FPU (Floating point number Processing Unit), PPU (Physics Processing Unit) , a microcontroller, or a combination thereof. As the memory C2, for example, a flash memory, HDD (Hard Disk Drive), SSD (Solid State Drive), or a combination thereof can be used.

Note that the computer C may further include a RAM (Random Access Memory) for expanding the program P during execution and temporarily storing various data. Computer C may further include a communication interface for sending and receiving data to and from other devices. Computer C may further include an input/output interface for connecting input/output devices such as a keyboard, mouse, display, and printer.

In addition, the program P can be recorded on a non-temporary tangible recording medium M that is readable by the computer C. As such a recording medium M, for example, a tape, disk, card, semiconductor memory, programmable logic circuit, or the like can be used. The computer C can acquire the program P via such a recording medium M. Also, the program P can be transmitted via a transmission medium. As such a transmission medium, for example, a communication network or broadcast waves can be used. Computer C can also obtain program P via such a transmission medium.

[Appendix 1]
The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims. For example, embodiments obtained by appropriately combining the technical means disclosed in the embodiments described above are also included in the technical scope of the present invention.

[Appendix 2]
Some or all of the above-described embodiments may also be described as follows. However, the present invention is not limited to the embodiments described below.

(Appendix 1)
a first acquisition means for acquiring first biometric information of a subject applying for use of the service;
a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject using the first biometric information is successful;
a second acquisition of acquiring second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; means and
collation means for collating the second biometric information with the first biometric information stored in the first storage device;
a second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the collation means succeeds in the collation;
An information processing system comprising

According to the above configuration, it is only necessary to use the first biometric information obtained when applying for the service and the second biometric information obtained to enable the use of biometric authentication in the service. A server in which the associated first biometric information is stored in advance is not required. As a result, it is possible to obtain the effect of improving the certainty of preventing spoofing that the applicant of the service and the user of the service are different without impairing the user's convenience.

(Appendix 2)
The first storage control means deletes the successfully verified first biometric information from the first storage device when the verification means succeeds in the verification.
The information processing system according to appendix 1.

According to the above configuration, the number of pieces of first biometric information stored in the first storage device can be minimized, and the time required for verification can be shortened. In addition, by deleting the first biometric information of the target person whose collation has succeeded, the biometric information of the target person is not held on the server side, and the risk of information leakage is reduced.

(Appendix 3)
The first acquisition means acquires the first biological information and the third biological information,
Further comprising confirmation means for confirming the identity of the subject using the first biometric information and the third biometric information,
The information processing system according to appendix 1 or 2.

According to the above configuration, identity verification using the first biometric information can be more reliably performed using the third biometric information.

(Appendix 4)
The biometric authentication is authentication according to the FIDO (fast identity online) protocol,
The information processing system according to any one of Appendices 1 to 3.

According to the above configuration, in biometric authentication according to the FIDO protocol, the above-described spoofing is more reliably prevented without impairing user convenience.

(Appendix 5)
The first biometric information and the second biometric information include information representing at least one of an image of a person's face, a fingerprint, and a voiceprint,
5. The information processing system according to any one of Appendices 1 to 4.

According to the above configuration, it is possible to improve the certainty of preventing the above-described spoofing without impairing the user's convenience for a target person who wishes to use at least one of a person's face, fingerprint, and voiceprint for biometric authentication. do.

(Appendix 6)
a first receiving means for receiving, from a terminal, first biometric information of a target person applying for use of the service;
a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject using the first biometric information is successful;
a second reception for receiving second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; means and
collation means for collating the second biometric information with the first biometric information stored in the first storage device;
for a terminal having second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the collation means succeeds in the collation; matching result transmission means for transmitting information based on the matching result;
A server with

According to the above configuration, it is possible to realize a server that has the same effects as those of Supplementary Note 1 described above.

(Appendix 7)
Storing first biometric information of a subject who applies for use of a service in a first storage device when identity verification of the subject is successful using the first biometric information a first transmission means for transmitting to a server having a first storage control means;
When the identity verification is successful, second biometric information different from the first biometric information is transmitted to the server as biometric information for enabling the subject person to use biometric authentication in the service. a second transmission means;
second storage control means for storing the second biometric information in a second storage device when the server succeeds in matching the first biometric information and the second biometric information;
terminal with

According to the above configuration, it is possible to realize a terminal that has the same effects as those of Appendix 1 described above.

(Appendix 8)
8. The terminal according to appendix 7, further comprising authentication means for performing biometric authentication of the subject in the service using the second biometric information stored in the second storage device.

According to the above configuration, it is possible to improve the certainty that the target person who uses the terminal to use the service through biometric authentication is not an impersonator who is different from the person who applied for the service.

(Appendix 9)
Acquiring first biometric information of a subject applying for use of the service;
Storing the first biometric information in a first storage device when identity verification of the subject using the first biometric information is successful;
Acquiring second biometric information different from the first biometric information as biometric information for enabling the use of biometric authentication by the subject in the service when the identity verification is successful;
collating the second biometric information with the first biometric information stored in the first storage device;
storing the second biometric information in a second storage device referred to in the biometric authentication when the verification is successful;
Information processing method including.

According to the above configuration, the same effect as Appendix 1 can be obtained.

(Appendix 10)
receiving first biometric information of a subject applying for use of the service;
Storing the first biometric information in a first storage device when identity verification of the subject using the first biometric information is successful;
Receiving second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful;
collating the second biometric information with the first biometric information stored in the first storage device;
information based on the result of the verification to a terminal having a second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the verification is successful; to send
Information processing method including.

According to the above configuration, the same effect as Appendix 1 can be obtained.

(Appendix 11)
Storing first biometric information of a subject who applies for use of a service in a first storage device when identity verification of the subject is successful using the first biometric information to the server;
transmitting second biometric information different from the first biometric information to the server as biometric information for enabling the use of biometric authentication by the subject in the service when the identity verification is successful; ,
storing the second biometric information in a second storage device when the server successfully matches the first biometric information and the second biometric information;
Information processing method including.

According to the above configuration, the same effect as Appendix 1 can be obtained.

(Appendix 12)
A program for causing a computer to function as an information processing device, the computer comprising:
a first receiving means for receiving first biometric information of a subject applying for use of the service;
a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject using the first biometric information is successful;
a second reception for receiving second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; means and
collation means for collating the second biometric information with the first biometric information stored in the first storage device;
for a terminal having second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the collation means succeeds in the collation; matching result transmission means for transmitting information based on the matching result;
A program characterized by functioning as

According to the above configuration, the same effect as Appendix 1 can be obtained.

(Appendix 13)
A program for causing a computer to function as an information processing device, the computer comprising:
Storing first biometric information of a subject who applies for use of a service in a first storage device when identity verification of the subject is successful using the first biometric information a first transmission means for transmitting to a server having a first storage control means;
transmitting second biometric information different from the first biometric information to the server as biometric information for enabling the use of biometric authentication by the subject in the service when the identity verification is successful; 2 transmitting means;
second storage control means for storing the second biometric information in a second storage device when the server succeeds in matching the first biometric information and the second biometric information;
A program characterized by functioning as

According to the above configuration, the same effect as Appendix 1 can be obtained.

[Appendix 3]
Some or all of the embodiments described above can also be expressed as follows.

at least one processor, said processor comprising:
a first acquisition process for acquiring first biometric information of a subject applying for use of the service;
a first storage control process of storing the first biometric information in a first storage device when identity verification of the subject using the first biometric information is successful;
a second acquisition of acquiring second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; processing;
a matching process of matching the second biometric information with the first biometric information stored in the first storage device;
a second storage control process of storing the second biometric information in a second storage device referred to in the biometric authentication when the matching is successful in the matching process;
An information processing system that executes

at least one processor, said processor comprising:
a first reception process for receiving, from a terminal, first biometric information of a target person applying for use of the service;
a first storage control process of storing the first biometric information in a first storage device when identity verification of the subject using the first biometric information is successful;
a second reception for receiving second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; processing;
a matching process of matching the second biometric information with the first biometric information stored in the first storage device;
for a terminal having a second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the matching in the matching process is successful; A server that executes matching result transmission processing for transmitting information based on the matching result.

The server may further include a memory, in which the first reception processing, the first storage control processing, the second reception processing, the collation processing, A program may be stored for causing the processor to execute the matching result transmission process. Also, this program may be recorded in a computer-readable non-temporary tangible recording medium.

at least one processor, said processor comprising:
Storing first biometric information of a subject who applies for use of a service in a first storage device when identity verification of the subject is successful using the first biometric information a first transmission process of transmitting to a server having a first storage control means;
When the identity verification is successful, second biometric information different from the first biometric information is transmitted to the server as biometric information for enabling the subject person to use biometric authentication in the service. a second transmission process;
and executing a second storage control process of storing the second biometric information in a second storage device when the server succeeds in matching the first biometric information and the second biometric information. terminal.

The terminal may further include a memory, and the memory causes the processor to execute the first transmission process, the second transmission process, and the second storage control process. A program for this may be stored. Also, this program may be recorded in a computer-readable non-temporary tangible recording medium.

1, 2, 2A Information processing system 11 First acquisition units 12, 302, 302A First storage control unit 13 Second acquisition units 14, 304, 304A Verification units 15, 203, 203A Second storage control unit 20 , 20A terminal 30, 30A server 40A biometric information storage device 80 service providing server 201, 201A first transmission unit 301, 301A first reception unit 202, 202A second transmission unit 206A biometric information storage unit 207A authentication unit 208A photographing Unit 302A First memory control units 303, 303A Second receiving unit 305 Verification result transmitting unit 305A Biometrics management unit 306A Verification unit C1 Processor C2 Memory

Claims (13)

1. a first acquisition means for acquiring first biometric information of a subject applying for use of the service;
   a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject using the first biometric information is successful;
   a second acquisition of acquiring second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; means and
   collation means for collating the second biometric information with the first biometric information stored in the first storage device;
   a second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the collation means succeeds in the collation;
   An information processing system comprising
2. The first storage control means deletes the successfully verified first biometric information from the first storage device when the verification means succeeds in the verification.
   The information processing system according to claim 1.
3. The first acquisition means acquires the first biological information and the third biological information,
   Further comprising confirmation means for confirming the identity of the subject using the first biometric information and the third biometric information,
   The information processing system according to claim 1 or 2.
4. The biometric authentication is authentication according to the FIDO (fast identity online) protocol,
   The information processing system according to any one of claims 1 to 3.
5. The first biometric information and the second biometric information include information representing at least one of an image of a person's face, a fingerprint, and a voiceprint,
   The information processing system according to any one of claims 1 to 4.
6. a first receiving means for receiving, from a terminal, first biometric information of a target person applying for use of the service;
   a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject using the first biometric information is successful;
   a second reception for receiving second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; means and
   collation means for collating the second biometric information with the first biometric information stored in the first storage device;
   for a terminal having second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the collation means succeeds in the collation; matching result transmission means for transmitting information based on the matching result;
   A server with
7. Storing first biometric information of a subject who applies for use of a service in a first storage device when identity verification of the subject is successful using the first biometric information a first transmission means for transmitting to a server having a first storage control means;
   When the identity verification is successful, second biometric information different from the first biometric information is transmitted to the server as biometric information for enabling the subject person to use biometric authentication in the service. a second transmission means;
   second storage control means for storing the second biometric information in a second storage device when the server succeeds in matching the first biometric information and the second biometric information;
   terminal with
8. The terminal according to claim 7, further comprising authentication means for performing biometric authentication of the subject in the service using the second biometric information stored in the second storage device.
9. Acquiring first biometric information of a subject applying for use of the service;
   Storing the first biometric information in a first storage device when identity verification of the subject using the first biometric information is successful;
   Acquiring second biometric information different from the first biometric information as biometric information for enabling the use of biometric authentication by the subject in the service when the identity verification is successful;
   collating the second biometric information with the first biometric information stored in the first storage device;
   storing the second biometric information in a second storage device referred to in the biometric authentication when the verification is successful;
   Information processing method including.
10. receiving first biometric information of a subject applying for use of the service;
    Storing the first biometric information in a first storage device when identity verification of the subject using the first biometric information is successful;
    Receiving second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful;
    collating the second biometric information with the first biometric information stored in the first storage device;
    information based on the result of the verification to a terminal having a second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the verification is successful; to send
    Information processing method including.
11. Storing first biometric information of a subject who applies for use of a service in a first storage device when identity verification of the subject is successful using the first biometric information to the server;
    transmitting second biometric information different from the first biometric information to the server as biometric information for enabling the use of biometric authentication by the subject in the service when the identity verification is successful; ,
    storing the second biometric information in a second storage device when the server successfully matches the first biometric information and the second biometric information;
    Information processing method including.
12. A program for causing a computer to function as an information processing device, the computer comprising:
    a first receiving means for receiving first biometric information of a subject applying for use of the service;
    a first storage control means for storing the first biometric information in a first storage device when the identity verification of the subject using the first biometric information is successful;
    a second reception for receiving second biometric information different from the first biometric information as biometric information for enabling the subject person to use biometric authentication in the service when the identity verification is successful; means and
    collation means for collating the second biometric information with the first biometric information stored in the first storage device;
    for a terminal having second storage control means for storing the second biometric information in a second storage device referred to in the biometric authentication when the collation means succeeds in the collation; matching result transmission means for transmitting information based on the matching result;
    A program characterized by functioning as
13. A program for causing a computer to function as an information processing device, the computer comprising:
    Storing first biometric information of a subject who applies for use of a service in a first storage device when identity verification of the subject is successful using the first biometric information a first transmission means for transmitting to a server having a first storage control means;
    transmitting second biometric information different from the first biometric information to the server as biometric information for enabling the use of biometric authentication by the subject in the service when the identity verification is successful; 2 transmitting means;
    second storage control means for storing the second biometric information in a second storage device when the server succeeds in matching the first biometric information and the second biometric information;
    A program characterized by functioning as
    
    

Images