JP2003178031A - Biometrics personal authentication system, server terminal and client terminal - Google Patents

Abstract

(57) [Summary] [Problem] To enable personal authentication without user ID without lowering collation accuracy, and to enable collation algorithm to be changed according to security level. SOLUTION: A client terminal transmits a terminal ID of the client terminal to a server terminal based on occurrence of a request for personal authentication, transmits information transmitted from the server terminal to a biometrics verification device, and transmits the information from the biometrics verification device. Performs personal authentication based on the collation result of, and the server terminal manages the user ID corresponding to the terminal ID and the biometric information corresponding to the user ID, and among the managed information, the client terminal The predetermined information is transmitted to the client terminal based on the transmitted terminal ID, and the biometrics collation device performs collation based on the biometrics information acquired from the outside and the information transmitted from the client terminal. The configuration is such that the collation result is transmitted to the client terminal.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a personal authentication system using biometrics information, a server terminal and a client terminal.

[0002]

2. Description of the Related Art FIG. 5 is an explanatory diagram showing the configuration of a biometrics personal authentication system according to the prior art.
In FIG. 5, 501 is a server terminal, 502-1 to 50-2.
2-n is a client terminal, and 503 is a network that connects the server terminal 501 and the client terminals 502-1 to 502-n.

Reference numerals 504-1 to 504-n collate the biometrics information received from the client terminals 502-1 to 502-n with the biometrics information of the user collected via an external input unit (not shown). Biometrics collation device, 505-1 to 505-n are applications that need to authenticate users of the client terminals 502-1 to 502-n, 506-1 to 506-n are server terminal 501, biometrics collation device 504 -1 to 5
04-n and application 505
1 to 505-n is a biometrics management client that returns the collation result for the authentication request from 1 to 505-n.

Reference numeral 508 is a biometrics information DB for managing a set of a user ID and biometrics information, and 509 is a biometrics information DB 508 based on the user ID.
It is a biometrics management server that extracts biometrics information from.

Next, the operation will be described. First, when the applications 505-1 to 505-n require the authentication request, the biometrics management clients 506-1 to 506-1.
506-n. The biometrics management clients 506-1 to 506-n request the input of the user ID. The input user ID is transmitted to the biometrics management server 509 via the network 503.

Upon receiving the user ID, the biometrics management server 509 extracts the biometrics information corresponding to this user ID from the biometrics information DB 508 and returns it to the biometrics management clients 506-1 to 506-n via the network 503. .

The biometrics management clients 506-1 to 506-n receiving the biometrics information are
This biometrics information is transmitted to the biometrics collation devices 504-1 to 504-n.

The biometrics collating devices 504-1 to 504-n having received the biometrics information collate the received biometrics information with the biometrics information of the user collected through the external input unit, and collate the result. Biometrics management clients 506-1 to 50
Return to 6-n.

The biometrics management clients 506-1 to 506-n which have received the collation result return the collation result to the applications 505-1 to 505-n.

[0010]

The conventional biometrics personal authentication system requires the input of the user ID as described above. There was also a system for performing personal authentication without inputting a user ID, but in this case, the biometrics information of the user collected via the external input unit,
It is necessary to collate with all biometrics information managed in the biometrics information DB, and as the system scale increases, collation time increases and collation accuracy decreases.

Further, the conventional biometrics personal authentication system has a problem that the collation algorithm cannot be dynamically changed according to the security level. Here, the matching algorithm is, for example, according to the biometrics information managed in the biometrics information DB,
For example, the threshold value of the matching degree of pattern matching is changed.

The present invention has been made in order to solve the above-mentioned problems, and it is possible to perform personal authentication without a user ID without lowering the matching accuracy, and change the matching algorithm according to the security level. An object of the present invention is to provide a biometrics personal authentication system, a server terminal and a client terminal that can be used.

[0013]

A biometrics personal authentication system according to the present invention is a biometrics personal authentication in which a server terminal and a client terminal are connected via a network, and a biometrics collation device is connected to the client terminal. In the system, the client terminal transmits the terminal ID of the client terminal to the server terminal based on a request for personal authentication, and transmits the information transmitted from the server terminal to the biometrics collation device, Personal authentication is performed based on the matching result from the biometrics matching device, and the server terminal manages a user ID corresponding to the terminal ID and biometrics information corresponding to the user ID, and manages them. Information that is sent from the client terminal Based on the terminal ID, the predetermined information is transmitted to the client terminal, and the biometrics collation device performs collation based on the biometrics information acquired from the outside and the information transmitted from the client terminal. The collation result is transmitted to the client terminal.

The biometrics personal authentication system according to the present invention is a biometrics personal authentication system in which a server terminal and a client terminal are connected via a network, and a biometrics collation device is connected to the client terminal. , The client terminal transmits the terminal ID of the client terminal to the server terminal based on a request for personal authentication, and the information transmitted from the server terminal and the biometrics information transmitted from the biometrics collation device. And the personal authentication based on the result of the collation, and the server terminal uses the user ID corresponding to the terminal ID.
And managing biometrics information corresponding to the user ID, and transmitting predetermined information to the client terminal based on the terminal ID transmitted from the client terminal among the managed information. The biometrics collation device transmits the biometrics information acquired from the outside to the client terminal.

Further, the server terminal manages the matching accuracy corresponding to the terminal ID, and an information set which is a pair of the user ID and biometrics information corresponding to the user ID, and the matching accuracy. From this, a collation algorithm which is a parameter at the time of collation by the biometrics collation device is generated and transmitted to the client terminal.

Further, the server terminal is the user ID
The pre-feature extraction biometrics information corresponding to is stored, a feature extraction algorithm is generated based on the pre-feature extraction biometrics information and the matching accuracy, and the feature extraction algorithm and the pre-feature extraction biometrics information, Based on, the biometrics information is generated and managed.

Further, the client terminal stores the predetermined information transmitted from the server terminal, and when the client terminal cannot connect to the server terminal via the network, stores the stored information in the biometrics collation device. It is something to send.

Further, the server terminal encrypts the predetermined information by using the public key corresponding to the terminal ID to be transmitted and transmits it to the client terminal, and the client terminal transmits the predetermined information transmitted from the server terminal. Is decrypted with the private key of the own device corresponding to the public key.

The server terminal dynamically manages a user ID corresponding to the terminal ID.

A server terminal according to the present invention is a server terminal connected via a network to a client terminal to which a biometrics collation device is connected, and a user corresponding to a terminal ID set for each client terminal. The ID and the biometrics information corresponding to the user ID are managed, and of these managed information, the terminal ID transmitted from the client terminal.
Based on the above, predetermined information is transmitted to the client terminal.

A client terminal according to the present invention is a client terminal connected to a server terminal via a network and to which a biometrics collation device is connected, and the terminal of the client terminal is based on the generation of a request for personal authentication. The ID is transmitted to the server terminal, the predetermined information transmitted from the server terminal is transmitted to the biometrics collation device, and personal authentication is performed based on the collation result from the biometrics collation device.

[0022]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiment 1. 1 is a block diagram showing the system configuration of Embodiment 1 of the present invention.
In FIG. 1, 101 is a server terminal, and 102-1 to 10
2-n is a client terminal, and 103 is a network connecting the server terminal 101 and the client terminals 102-1 to 102-n.

104-11 to 104-1m ,. ． 10,
4-n1 to 104-nl are client terminals 102-1
102-n, a plurality of biometrics information such as fingerprints, faces, handwriting, and voiceprints, and a plurality of biometrics of the user's fingerprints, faces, handwritings, voiceprints, etc. collected via an external input unit (not shown) A biometrics collation device that collates with the metrics information, 105-1 to 105-n are applications that need to authenticate users of the client terminals 102-1 to 102-n, and 106-1 to 106-n are server terminals 101. , Biometrics collation device 104-11 to 1
04-1m ,. ． , 104-n1 to 104-nl, and returns the collation result for the authentication request from the applications 105-1 to 105n.

Reference numeral 107 denotes a terminal ID, a set of types of biometrics matching devices connected to the terminal, a set of user IDs that may use the terminal, and a matching accuracy required by the terminal. A terminal information DB that manages pairs,
Reference numeral 108 is a biometrics information DB that manages a user ID and various biometrics information, and 109 is a user I.
It is a biometrics management server that extracts biometrics information and the like from the biometrics information DB 108 based on D.

First, as a premise, a terminal ID is given to each client terminal, and the biometrics management clients 106-1 to 106-n recognize their own terminal ID. Then, a user who uses the client terminal is set for each client terminal, a user ID is assigned to each user, and a terminal ID of the client terminal is set,
A pair of a user ID corresponding to the terminal ID and a matching accuracy corresponding to the terminal ID is registered in the terminal information DB 107. Here, the collation accuracy is, for example, a setting in which terminals that store important data have higher collation accuracy to enhance security, and terminals that store only unimportant data have lower collation accuracy and looser security. Conceivable. Furthermore, a biometrics collation device connected to the client terminal is also set for each client terminal, and a pair of the terminal ID of the client terminal and the type of the biometrics collation device corresponding to the terminal ID is set to the terminal information DB.
Register in 107. Then, the biometrics information corresponding to the user ID is stored in the biometrics information DB 10
Register in 8.

Next, the operation will be described. One of the client terminals 102-1 to 102-n, for example, the application 105-1 of the client terminal 102-1
When the personal authentication of the user of the terminal is required,
An authentication request is issued to the biometrics management client 106-1. Biometrics management client 1
06-1 refers to the terminal ID set in the terminal via the network 103 to the biometrics management server 1
09 to send.

The biometrics management server 109 that has received the terminal ID accesses the terminal information DB 107 and, based on the received terminal ID, the client terminal 102-
A set of user IDs of users who use 1 is acquired, the type of biometrics collation device connected to the terminal, and the collation accuracy required for the terminal. In FIG. 1, a fingerprint / voiceprint / face biometrics collation device 104 is shown.
It is assumed that -11, 104-12, and 104-1m are connected.

Next, the biometrics management server 109
Accesses the biometrics information DB 108,
The biometrics information of the fingerprint, voiceprint, and face corresponding to the set of user IDs acquired earlier is acquired. As a result, the biometrics management server 109 obtains a user ID acquired based on the terminal ID, and a biometrics information set which is a pair of the fingerprint, voice print, and face biometrics information corresponding to this user ID.

Further, the biometrics management server 109
Generates a fingerprint, voiceprint, and face matching algorithm from the matching accuracy acquired from the terminal information DB 107 and the biometrics information acquired from the biometrics information DB 108. Here, the collation algorithm changes the collation accuracy depending on, for example, which point of the face image is used for the collation, but the selection of a point that can clear the collation accuracy acquired from the terminal information DB 107 can be considered.

Then, the biometrics management server 109
Is a biometrics information set which is a pair of a user ID acquired based on the terminal ID and a fingerprint, a voiceprint, and biometrics information of the face corresponding to the user ID, the generated fingerprint, voiceprint, and face matching algorithm. Is transmitted to the biometrics management client 106-1.

Biometrics management client 106
-1 is a pair of the received fingerprint, voiceprint, face collation algorithm, and biometrics information set, which correspond to the corresponding biometrics collation devices 104-11 to 104-1.
send to m.

Biometrics collation device 104-11
104-1m receives a pair of fingerprint, voiceprint, face matching algorithm and biometrics information set corresponding to each matching device, and receives biometrics from the user of the terminal via an external input unit (not shown). Collect information. For example, in the case of the fingerprint collation device 104-11, the collation algorithm for the fingerprint collation device and the biometrics information set are received, and the biometrics information of the fingerprint of the user is collected via the external input unit.

Then, each biometrics collation device 104
-11 to 104-1m collate the biometrics information for each user ID of the received biometrics information set with the collected biometrics information by using the received collation algorithm, and which user ID is collation OK. To judge. Each biometrics collation device 104-
Each of 11 to 104-1m returns the user ID judged to be collated OK to the biometrics management client 106-1 as a collation result. If the biometrics verification device verifies that the biometrics information corresponding to all the user IDs is NG, the biometrics verification device provides the biometrics management client 106-1 with a verification result indicating that the biometrics verification is NG. return.

Biometrics management client 106
-1 is each biometrics collation device 104-11 to 1
When the collation result from 04-1m is received and all the collation results are the same user ID, it is determined that the authentication is OK, and the user ID is transmitted to the application 105-1 as the authentication result. If any one of the verification results from the biometrics verification devices 104-11 to 104-1m has a different user ID, or verification N
When there is G, the biometrics management client 106-1 determines that the authentication is NG, and sends the authentication result indicating that the authentication is NG to the application 105-1.

As described above, since the user ID is registered for each client terminal and the biometrics information corresponding to the user ID is centrally managed by the server terminal, the biometrics information is managed on the client terminal side. There is no need, the client terminal management cost can be reduced, and the server terminal manages the biometrics information based on the user ID for each terminal ID.
Personal authentication without D can be realized.

Further, since the matching algorithm is determined based on the matching accuracy and biometrics information corresponding to the client terminal, it is possible to deal with a change or the like due to the increase or decrease of the user or the matching device for each client terminal, and it is static. A certain degree of matching accuracy required can be maintained rather than using an algorithm.

Also, since the biometrics information set and the verification algorithm are used only when necessary, the personal information is authenticated on the client terminal side using the one sent from the server terminal, so that even if the biometrics verification terminal is stolen, the server can be used. It is possible to ensure the same level of security as when personal authentication is performed on the terminal side, reduce the load on the server terminal, and do not need to replace the biometrics collation device even when changing the collation algorithm.

In the first embodiment, if any one of the verification results from the biometrics verification devices 104-11 to 104-1m has a different user ID, or if there is an authentication NG, the biometric The case has been described where the metrics management client 106-1 determines that the authentication is unsuccessful, but the present invention is not limited to this, and the authentication is OK / NG.
May be changed according to the system.

In the first embodiment, the case where a plurality of biometrics collating devices are connected to the client terminal has been described, but the same applies to the case where only one biometrics collating device is connected to the client terminal. The effect of can be obtained.

Embodiment 2. In the above-described first embodiment, the case where the biometrics collation device performs the collation has been described, but in the second embodiment, the case where the biometrics management client performs the collation will be described. The block diagram showing the system configuration of the second embodiment is similar to that of FIG. 1, and the biometrics collation devices 104-11 to 104-10
4-1m only collects biometrics information from the user of the terminal via an external input unit (not shown),
And biometrics management clients 106-1 to 106-1
It is different from the first embodiment in that 06-n also performs collation.

The operation of the part different from the first embodiment will be described below. Client terminals 102-1 to 10-1
02-n, for example, the client terminal 102-
When the application 105-1 of No. 1 issues an authentication request to the biometrics management client 106-1 when personal authentication of the user of the terminal is required, the biometrics management server 109 causes the biometrics management server 109 to execute the matching algorithm. The operations up to the operation of transmitting the pair with the biometrics information set to the biometrics management client 106-1 are the same as those in the first embodiment.

Biometrics management client 106
-1 receives the pair of fingerprint, voiceprint, face matching algorithm and biometrics information set from the biometrics management server 109, and then the biometrics matching device 1
A request for collecting biometrics information is issued to 04-11 to 104-1m.

Biometrics collation device 104-11
Upon receiving the biometrics information collection request, the 104-1m collects biometrics information from the user of the terminal via an external input unit (not shown), and collects the collected biometrics information from the biometrics management client 106. Send to -1. For example, the fingerprint collation device 104-
In the case of 11, biometrics information of the fingerprint of the user is collected via the external input unit, and this biometrics information is transmitted to the biometrics management client 106.

Biometrics management client 106
Is the biometrics information for each user ID of the biometrics information set received from the biometrics management server 109, and the biometrics collation device 104-11.
To 104-1m are compared with the biometrics information received from the biometrics management server 109 using the collation algorithm received from the biometrics management server 109, and which user ID is OK for authentication is determined. The biometrics management client 106 performs matching for each biometrics matching device. If all matching results are the same user ID, it is determined that the authentication is OK, and the user ID is used as the authentication result in the application 105. Send to -1.
If at least one of the matching results has a different user ID, or if there is a matching NG, the biometrics management client 106-1 determines that the authentication is NG, and displays the authentication result indicating that the authentication is NG. Send to application 105-1.

As described above, by performing verification by the biometrics management client, the device cost of the biometrics verification device can be reduced.

Embodiment 3. In the above-described first embodiment, the case where the matching algorithm can be dynamically changed has been described, but in the third embodiment, a case where the feature extraction algorithm can also be dynamically changed will be described. For example, in the first embodiment, the matching accuracy changes depending on the selection of which point of the face image is used for matching, so an appropriate matching algorithm is selected. Here, the point before selecting the face image is statically determined,
Biometrics information DB as biometrics information
It is registered in 108. In the third embodiment, the point before selection of the face image can be dynamically changed, and an appropriate feature extraction algorithm is selected. In this case, it is necessary to store biometrics information before feature extraction (for example, the face image itself) in the biometrics information DB 108.

The block diagram showing the system configuration of the third embodiment is the same as that of FIG. 1, and the biometrics information DB
The point 108 is that the biometrics information before feature extraction is stored, and the point that the biometrics management server 109 generates a feature extraction algorithm is different from the first embodiment.

The operation of the part different from the first embodiment will be described below. Client terminals 102-1 to 10-1
02-n, for example, the client terminal 102-
When the application 105-1 of No. 1 requires the personal authentication of the user of the terminal, the biometrics management server 1 that has received the terminal ID from the operation of issuing the authentication request to the biometrics management client 106-1.
09 refers to the terminal information DB 107, and based on the received terminal ID, a set of user IDs of users who use the client terminal 102-1 and the type of biometrics matching device connected to the terminal, The operation up to the acquisition of the matching accuracy required by the terminal is the same as that in the first embodiment.

Next, the biometrics management server 109
Accesses the biometrics information DB 108,
The biometrics information before the feature extraction of the fingerprint, voiceprint, and face corresponding to the set of user IDs acquired earlier is obtained. Furthermore, the biometrics management server 109 is a terminal information DB.
A feature extraction algorithm and a collation algorithm are generated from the matching accuracy acquired from 107 and the biometrics information before feature extraction acquired from the biometrics information DB 108. And the biometrics management server 1
09 is a user ID obtained based on the terminal ID by obtaining biometrics information after feature extraction from this feature extraction algorithm and biometrics information before feature extraction.
Then, a biometrics information set, which is a pair of the fingerprint, voiceprint, and face biometrics information corresponding to this user ID, is obtained.

Then, the biometrics management server 10
Reference numeral 9 denotes a biometrics information set, which is a pair of a user ID acquired based on the terminal ID, a fingerprint, a voiceprint, and biometrics information of the face corresponding to the user ID, and a generated fingerprint / voiceprint / face matching algorithm. And the feature extraction algorithm are transmitted to the biometrics management client 106-1.

Biometrics management client 106
-1 indicates a pair of the received biometrics information set of fingerprint, voiceprint, face, collation algorithm and feature extraction algorithm, and the corresponding biometrics collation device 1
04-11 to 104-1m.

Biometrics collation devices 104-11 to 104-11
104-1m receives a pair of fingerprint, voiceprint, face biometrics information set, matching algorithm, and feature extraction algorithm corresponding to each matching device, and uses the terminal via an external input unit (not shown). The biometrics information is collected using the feature extraction algorithm received from the person. For example, in the case of the fingerprint collation device 104-11, the biometrics information set for the fingerprint collation device, the pair of the collation algorithm and the feature extraction algorithm are received, and the fingerprint of the fingerprint is received from the user of the terminal via the external input unit. Fingerprint biometrics information is collected using a feature extraction algorithm.

After that, each biometrics collation device 104-11 to 104-1m uses the received collation algorithm for the biometrics information for each user ID of the received biometrics information set and the collected biometrics information. And collate, which user ID collates O
The operation such as determining whether K is the same as that in the first embodiment.

As described above, the feature extraction algorithm and the collation algorithm are generated from the matching accuracy acquired from the terminal information DB and the biometrics information before the feature extraction acquired from the biometrics information DB. Since not only the matching algorithm but also the feature extraction algorithm can be dynamically changed according to the user ID corresponding to the ID, the matching accuracy can be further improved.

Further, by dynamically changing the feature extraction algorithm, the biometrics information set also changes, so that impersonation can be prevented.

Further, since the feature extraction algorithm is not provided in the biometrics collation device, it is possible to maintain the same security level as in the first embodiment.

Further, if the feature extraction algorithm is changed in the first embodiment, the change processing is required for all of the server side terminals, which is costly. However, if the system of the third embodiment is used, it is changed. It is possible to reduce costs.

Fourth Embodiment In the first to third embodiments described above, the client terminal and the server terminal are always connected by the network, but the fourth embodiment will be described in the case where the client terminal and the server terminal are not always connected as in the mobile environment. FIG. 2 is a block diagram showing the system configuration of the fourth embodiment, in which the client terminal 102-
1-102-n and the network 103 are not always connected, and the biometrics management client 106-
1 to 106-n are different from the first embodiment in that biometrics information storage means 201-1 to 201-n for storing a pair of a matching algorithm and a biometrics information set are provided.

The operation of the part different from the first embodiment will be described below. Client terminals 102-1 to 10-1
02-n and the network 103 are connected, the biometrics management client 106-1
Although the pair of the received fingerprint, voice print, face matching algorithm, and biometrics information set is transmitted to the corresponding biometrics matching devices 104-11 to 104-1m, the same as in the first embodiment, At this time, the above-mentioned pair is stored in the biometrics information storage means 201 in the biometrics management client, which is different from the first embodiment. Other than this, the first embodiment
Is the same as.

Client terminals 102-1 to 102-n
And the network 103 are not connected, one of the client terminals 102-1 to 102-n, for example, the application 10 of the client terminal 102-1.
5-1 issues an authentication request to the biometrics management client 106-1 when personal authentication of the user of the terminal is required, and the biometrics management client 106-1 determines that the biometrics management client 106-1. -1 biometrics information storage means 201
The above pairs stored in -1 are transmitted to the corresponding biometrics matching devices 104-11 to 104-1m. The subsequent operation is similar to that of the first embodiment.

As described above, the pair of the matching algorithm and the biometrics information set is used as the biometrics information storage means 2 in the biometrics management client.
By storing in 01, the same effect as in the case of the above-described first embodiment can be obtained even in an environment in which the network is intermittently connected.

Further, in the fourth embodiment, when the client terminals 102-1 to 102-n and the network 103 are not connected, the biometrics information storage means 201-1 in the biometrics management client 106-1 is already present. The case where the pair of the matching algorithm and the biometrics information set is stored in the above is explained. However, the pair is still stored in the biometrics information storage means 201.
If it is not stored in, personal authentication may not be possible.
Alternatively, when the client terminals 102-1 to 102-n are not connected to the network 103 and the pair is not stored in the biometrics information storage unit 201-1 in the biometrics management client 106-1, If the client terminals 102-1 to 102-n have a function of connecting to the network 103 such as a wireless communication function, the client terminals 102-1 to 102-n and the network 103 are connected by using the function. The operation may be performed when and are connected.

Further, in the fourth embodiment, the case where the biometrics information storage means for storing the pair of the matching algorithm and the biometrics information set is provided in the biometrics management client has been described. The same effect can be obtained even if it is used.

Embodiment 5. In the fifth embodiment, a case where the biometrics data flowing in the network is encrypted by public key cryptography will be described.

FIG. 3 is a block diagram showing the system configuration of the fifth embodiment, in which the server terminal 101 uses the public key DB3.
Point having 01, biometrics collation device 104-11
~ 104-1m ,. ． , 104-n1 to 104-nl are private keys 302-11 to 302-1m ,. ． Three
The point having 02-n1 to 302-nl is the above-mentioned first embodiment.
Different from

The operation of the part different from the first embodiment will be described below. Client terminals 102-1 to 10-1
02-n, for example, the client terminal 102-
When the application 105-1 of No. 1 requires personal authentication of the user of the terminal, the biometrics management server 109 sends the terminal information D to the biometrics management client 106-1.
From the matching accuracy acquired from B107 and the biometrics information acquired from the biometrics information DB 108, the operation of generating a fingerprint, voiceprint, and face matching algorithm is the same as in the first embodiment.

Next, the biometrics management server 109
Accesses the public key DB 301, extracts the public key corresponding to the terminal ID, and encrypts it using the user ID obtained based on the terminal ID and this user ID.
The biometrics information set, which is a pair of the fingerprint, the voiceprint, and the biometrics information of the face corresponding to the above, and the pair of the generated fingerprint, voiceprint, and face matching algorithm are transmitted to the biometrics management client 106-1.

Biometrics management client 106
-1 is a pair of the received fingerprint, voiceprint, face collation algorithm, and biometrics information set, which correspond to the corresponding biometrics collation devices 104-11 to 104-1.
send to m.

Biometrics collation device 104-11
104-1m receives the pair of fingerprint, voiceprint, face matching algorithm and biometrics information set corresponding to each matching device, and registers the registered private keys 302-11 to 30-30.
2-1m ,. ． , 302-n1 to 302-nl are used to decode these data. Furthermore, the biometrics collation devices 104-11 to 104-1m collect biometrics information from the user of the terminal via an external input unit (not shown). The subsequent operation is similar to that of the first embodiment.

As described above, by encrypting the data transmitted from the server terminal with the public key for each terminal ID, the data can be decrypted on the network or the client terminal even if the data is eavesdropped. This is not possible, and the safety is improved because it is not used in the biometrics collation device of another terminal.

In the fifth embodiment, the case where each biometrics collation device has a private key has been described, but the security can be improved even if each client terminal has a private key.

Sixth Embodiment In the above-mentioned first embodiment, the data flowing in the network is encrypted by public key encryption. Next, the floor entry / exit management server dynamically manages a set of user IDs that may use the terminal. A case where the entry / exit management information is reflected in the terminal information DB will be described. FIG. 4 is a block diagram showing the system configuration of the sixth embodiment, which is different from the above-mentioned embodiments in that a floor entry / exit management server 401 is connected to the network 103.

The floor entrance / exit management server 401 monitors, for example, users who enter / exit the floor, and dynamically determine the user IDs of the users who may use the client terminals 102-1 to 102-n. Manage.
The entry / exit management information of the floor entry / exit management server 401 is sequentially reflected in the terminal information DB.

For example, when a user enters or leaves the floor, the floor entrance / exit management server 401 reflects the entry / exit of the user to collect a set of user IDs corresponding to the terminal IDs of the corresponding client terminals ( Correct entry / exit management information). And the floor entrance / exit management server 40
In No. 1, the entry / exit management information is reflected in the terminal information DB 107. Thereby, in the terminal information DB 107, the terminal I
The set of user IDs for D is dynamically updated with the latest information. The operation is the same as that of the first embodiment, and therefore its explanation is omitted.

As described above, by reflecting the entrance / exit management information by the floor entrance / exit management server in the terminal information DB, it is not necessary to set a user to be used in the terminal information DB in advance, so that the management cost can be reduced. Further, since the collation target can be narrowed down compared to the static setting, it is possible to reduce the collation time and improve the collation accuracy in the biometrics collation device.

In the sixth embodiment, the case of using the floor entry / exit management server for monitoring the users entering / leaving the floor has been described, but this is the case as long as it dynamically manages the user ID corresponding to the terminal ID. However, the same effect can be obtained when another device is used.

In the sixth embodiment, the case where the terminal information DB and the floor entrance / exit management server are separately provided has been described, but the server terminal does not have the terminal information DB and the information of the floor entrance / exit management server is stored. It may be configured to operate by using, or the server terminal does not have a terminal information DB,
The same effect can be obtained even if the function of the floor entrance / exit management server is provided.

[0078]

As described above, in the biometrics personal authentication system according to the present invention, a biometrics individual in which a server terminal and a client terminal are connected via a network and a biometrics collation device is connected to the client terminal In the authentication system, the client terminal transmits a terminal ID of the client terminal to the server terminal based on a request for personal authentication,
The information transmitted from the server terminal is transmitted to the biometrics collation device, personal authentication is performed based on the collation result from the biometrics collation device, and the server terminal is a user ID corresponding to the terminal ID, The biometrics information corresponding to the user ID is managed, and predetermined information among the managed information is transmitted to the client terminal based on the terminal ID transmitted from the client terminal. The collation device performs collation based on the biometrics information acquired from the outside and the information transmitted from the client terminal, and transmits the collation result to the client terminal, so that the user I for each client terminal
Since biometrics information corresponding to D is centrally managed by the server terminal, there is no need to manage biometrics information on the client terminal side, the client terminal management cost can be reduced, and personal authentication without a user ID can be realized.

The biometrics personal authentication system according to the present invention is a biometrics personal authentication system in which a server terminal and a client terminal are connected via a network, and a biometrics collation device is connected to the client terminal. , The client terminal transmits the terminal ID of the client terminal to the server terminal based on a request for personal authentication, and the information transmitted from the server terminal and the biometrics information transmitted from the biometrics collation device. Based on the result of verification, personal authentication is performed based on the result of verification.
The server terminal is a user ID corresponding to the terminal ID.
And managing biometrics information corresponding to the user ID, and transmitting predetermined information to the client terminal based on the terminal ID transmitted from the client terminal among the managed information. The biometrics collation device can reduce the device cost of the biometrics collation device by transmitting the biometrics information acquired from the outside to the client terminal.

Further, the server terminal manages the matching accuracy corresponding to the terminal ID, and an information set which is a pair of the user ID and biometrics information corresponding to the user ID, and the matching accuracy. From this, by generating a matching algorithm which is a parameter at the time of matching by the biometrics matching device and transmitting it to the client terminal, a matching algorithm is determined based on matching accuracy and biometrics information corresponding to the client terminal. Therefore, it is possible to maintain a higher matching accuracy than using a static algorithm.

The server terminal uses the user ID
The pre-feature extraction biometrics information corresponding to is stored, a feature extraction algorithm is generated based on the pre-feature extraction biometrics information and the matching accuracy, and the feature extraction algorithm and the pre-feature extraction biometrics information, By generating and managing the biometrics information based on, the feature extraction algorithm can be dynamically changed according to the user ID corresponding to the terminal ID, and thus the matching accuracy can be further improved.

Further, the client terminal stores the predetermined information transmitted from the server terminal, and when the client terminal cannot connect to the server terminal via the network, stores the stored information in the biometrics collation device. By sending it, it is possible to support an environment in which it is intermittently connected to the network.

Further, the server terminal encrypts the predetermined information by using the public key corresponding to the terminal ID to be transmitted and transmits it to the client terminal, and the client terminal transmits the predetermined information transmitted from the server terminal. By decrypting the information of with the private key of the own device corresponding to the public key,
The safety can be improved.

Further, the server terminal dynamically manages the user ID corresponding to the terminal ID, which eliminates the need to set the user to be used in the terminal information DB in advance, thereby reducing the management cost and reducing the cost. Since the collation target can be narrowed down rather than being set manually, it is possible to reduce the collation time and improve the collation accuracy in the biometrics collation device.

[Brief description of drawings]

FIG. 1 is a block diagram showing a system configuration according to a first embodiment of the present invention.

FIG. 2 is a block diagram showing the system configuration of the fourth embodiment.

FIG. 3 is a block diagram showing the system configuration of the fifth embodiment.

FIG. 4 is a block diagram showing the system configuration of the sixth embodiment.

FIG. 5 is an explanatory diagram showing a configuration of a biometrics personal authentication system according to a conventional technique.

[Explanation of symbols]

101 server terminals 102-1 to 102-n client terminals 103 networks 104-11 to 104-1m ,. ． , 104-n1-1
04-nl Biometrics collation device 105-1 to 105-n Application 106-1 to 106-n Biometrics management client 107 Terminal information DB 108 Biometrics information DB 109 Biometrics management server 201-1 to 201-n Biometrics information Storage means 301 public key DBs 302-11 to 302-1m ,. ． , 302-n1-3
02-nl Private key 401 Floor entry / exit management server

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Naonori Okazaki             2-3 2-3 Marunouchi, Chiyoda-ku, Tokyo             Inside Ryo Electric Co., Ltd. (72) Inventor Hiroshi Nakamura             2-3 2-3 Marunouchi, Chiyoda-ku, Tokyo             Inside Ryo Electric Co., Ltd. (72) Inventor Teruko Fujii             2-3 2-3 Marunouchi, Chiyoda-ku, Tokyo             Inside Ryo Electric Co., Ltd. (72) Inventor Takao Katsuta             2-3 2-3 Marunouchi, Chiyoda-ku, Tokyo             Inside Ryo Electric Co., Ltd. F-term (reference) 5B085 AA08 AE02 AE04 AE25 AE29

Claims (9)

[Claims] 1. A biometrics personal authentication system in which a server terminal and a client terminal are connected via a network, and a biometrics collation device is connected to the client terminal, wherein the client terminal generates a personal authentication request. Based on the above, the terminal ID of the client terminal is transmitted to the server terminal, the information transmitted from the server terminal is transmitted to the biometrics collation apparatus, and personal authentication is performed based on the collation result from the biometrics collation apparatus. And the server terminal has a user ID corresponding to the terminal ID.
And managing biometrics information corresponding to the user ID, and transmitting predetermined information to the client terminal based on the terminal ID transmitted from the client terminal among the managed information. The biometrics collation device collates based on biometrics information acquired from the outside and the information transmitted from the client terminal, and transmits the collation result to the client terminal. system. 2. A biometrics personal authentication system in which a server terminal and a client terminal are connected via a network, and a biometrics collation device is connected to the client terminal, wherein the client terminal generates a personal authentication request. The terminal ID of the client terminal is transmitted to the server terminal based on the above, and matching is performed based on the information transmitted from the server terminal and the biometrics information transmitted from the biometrics matching device, and the matching result is obtained. Personal authentication based on the user ID corresponding to the terminal ID.
And managing biometrics information corresponding to the user ID, and transmitting predetermined information to the client terminal based on the terminal ID transmitted from the client terminal among the managed information. A biometrics personal authentication system, wherein the biometrics collation device transmits biometrics information acquired from the outside to the client terminal. 3. The server terminal manages matching accuracy corresponding to the terminal ID, and an information set that is a pair of the user ID and biometrics information corresponding to the user ID, and the matching accuracy. The biometrics personal authentication system according to claim 1 or 2, wherein a collation algorithm, which is a parameter for collation by the biometrics collation apparatus, is generated and transmitted to the client terminal. 4. The server terminal stores pre-feature extraction biometrics information corresponding to the user ID, and generates a feature extraction algorithm based on the pre-feature extraction biometrics information and the matching accuracy, The biometrics personal authentication system according to claim 3, wherein biometrics information is generated and managed based on the feature extraction algorithm and the pre-feature extraction biometrics information. 5. The client terminal stores the predetermined information transmitted from the server terminal, and when the client terminal cannot connect to the server terminal via the network, stores the stored information in the biometrics collation device. The biometrics personal authentication system according to any one of claims 1 to 4, which is transmitted. 6. The server terminal encrypts the predetermined information using a public key corresponding to a terminal ID to be transmitted and transmits the encrypted information to the client terminal, and the client terminal transmits the predetermined information transmitted from the server terminal. 6. The biometrics personal authentication system according to claim 1, wherein the information of 1. is decrypted by the private key of the own device corresponding to the public key. 7. The biometrics personal authentication system according to claim 1, wherein the server terminal dynamically manages a user ID corresponding to the terminal ID. 8. A server terminal connected via a network to a client terminal to which a biometrics collation device is connected, the user ID corresponding to the terminal ID set for each client terminal, and the user ID corresponding to the user ID. The biometrics information to be managed, and the terminal I transmitted from the client terminal among the managed information.
A server terminal, which transmits predetermined information to the client terminal based on D. 9. A client terminal connected to a server terminal via a network and connected to a biometrics collation device, the terminal ID of the client terminal being transmitted to the server terminal based on a request for personal authentication. A client terminal, wherein predetermined information transmitted from the server terminal is transmitted to the biometrics collation device, and personal authentication is performed based on a collation result from the biometrics collation device.