JP2005275600A - IC card authentication method using biometric information and IC card - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an IC card authentication method and an IC card which can permit use of an IC card other than the card owner by the intention of the card owner in the IC card authentication method using biometric information.
In a storage unit of an IC card, owner biometric information 30, use authorized person biometric information 31, and user biometric information 32 are recorded. The user biometric information 32 is set by the user biometric information setting means 23 from the owner biometric information 30 or the authorized person biometric information 31. By collating the user biometric information 32 at the time of use, a person other than the owner can use the IC card. In order to execute the user biometric information setting means 23, the authentication of the owner biometric information 30 is required.
[Selection] Figure 1

Description

  The present invention relates to the technical field of IC cards, and more particularly to an IC card authentication method and IC card using biometric information.

  Conventionally, biometric authentication has been used as an IC card user authentication method. For example, in Patent Document 1, information obtained by digitizing the biometric information (fingerprint, iris, retina, etc.) of the IC card owner is stored in the storage unit of the IC card, and when used, the biometric information of the owner is read, An IC card authentication method is disclosed in which only an IC card owner can use an IC card by collating with stored biometric information.

In Patent Document 2, in addition to the biometric information of the owner, the biometric information of the person who is permitted to use the IC card by the owner is recorded in the storage unit, and the owner and the authorized person can use the IC card. An IC card authentication method that can use this is disclosed.
Japanese Patent Laid-Open No. 9-171547 JP 2001-202494 A

  However, in the IC card authentication method described in Patent Document 2, there is a problem that a person who is permitted by the owner to use the IC card can use the IC card regardless of the intention of the owner.

  Accordingly, in view of the above problems, the present invention provides an IC card authentication method and an IC card that can restrict use of an IC card other than the owner by the intention of the owner in the IC card authentication method that uses biometric information. Objective.

  A first problem-solving means for solving the above-described problem is an IC card authentication method for authenticating a user's biometric information and permitting the use of the IC card. The biometric information of the person who is permitted to use the IC card by the user is stored, and the biometric information for use for authentication at the time of use is set from the biometric information stored in the storage unit of the IC card before use. An IC card authentication method characterized in that the use of an IC card is permitted by collating the user's biometric information with the biometric information at the time of use.

  According to the operation of the first problem solving means, the person who can use the IC card is changed by changing the biometric information to be authenticated at the time of use. By setting the biometric information to be authenticated at the time of use to the biometric information of the person who is permitted to use from the biometric information of the owner, the person permitted to use by the owner can use the IC card.

  Further, the second problem solving means is the IC card authentication method according to the first problem solving means, wherein the biometric information of the owner is required to set the use-time biometric information. An IC card authentication method characterized by the above.

  According to the operation of the second problem solving means, when setting biometric information to be authenticated at the time of use, authentication of the owner's biometric information is necessary. If there is no intention of the owner, a person other than the owner IC card cannot be used.

  Further, the third problem solving means is the IC card authentication method described in the first problem solving means or the second problem solving means, wherein a plurality of the in-use biometric information are set before use, and the storage The unit stores at least the number of users that need to be authenticated in order to permit the use of the IC card. When the number of biometric information at the time of use authenticated at the time of use is greater than or equal to the number of users, the use of the IC card This is an IC card authentication method characterized by permitting.

  According to the action of the third problem solving means, since the authentication of the biometric information of a plurality of users is required to use the IC card, it is possible to prevent unauthorized use of the IC card by a person other than the owner. it can.

  Further, a fourth problem solving means includes: a biometric information adding means for storing biometric information other than the owner in the storage section in the IC card in which the biometric information of the owner is stored in advance in the storage section of the IC card; and the storage section User setting means for setting biometric information to be authenticated at the time of use from the biometric information stored in the biometric information, and biometric information for collating the biometric information input from an external device at the time of use with the biometric information set by the user setting means An IC card comprising at least collation means, command processing means for operating an IC card, and execution control means for controlling execution of the command processing means based on an authentication result of the biometric information collation means.

  If the IC card described in the fourth problem solving means is used, the IC card authentication method described in the first problem solving means or the second problem solving means can be realized.

  Further, a fifth problem solving means is an IC card characterized in that the execution control means has a function of controlling execution of the command processing means based on the number of biometric information authenticated at the time of use. is there.

  If the IC card described in the fifth problem solving means is used, the IC card authentication method described in the fifth problem solving means can be realized.

  According to the IC card authentication method and IC card of the present invention described so far, if the owner permits, the addition of the person permitted to use the IC card and the change of the person who can actually use the IC card are performed. Can do. In addition, according to the present invention, the person who can actually use the IC card can be changed again to the owner by the intention of the owner even after the person who can actually use the IC card is changed to a person other than the owner. Unauthorized use of the IC card by a person who is permitted to use the IC card can be prevented.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. First, the structure of the IC card of the present invention will be described, and then the procedure of the IC card authentication method of the present invention will be described.

[Configuration of IC Card of the Present Invention]
FIG. 1 illustrates the configuration of an IC card according to the present invention. As shown in FIG. 1, the IC card 10 has a selection means 11 for selecting biological information stored in the storage unit of the IC card 10, and biological information input from outside the IC card 10 (hereinafter referred to as input biological information). ) And biometric information selected by the selecting means 11 (hereinafter referred to as selected biometric information), biometric information collating means 20, and security status generating means 21 for generating a security status 34 based on the biometric information collation result; User biometric information setting means 23 for setting user biometric information 32 to be collated at the time of use, and usage for adding authorized person biometric information 31 which is biometric information of a person who is permitted to use the IC card by the owner When the permitter biometric information adding means 24, the object 40, the command processing means 25 for operating the object 40, and the command processing means 25 are executed, Also, a user authentication number setting means 26 for setting a user authentication number 33 that defines the number of users requiring authentication, and an access control means 22 for controlling the execution of each means based on the security status 34 are provided. Yes.

  The storage unit of the IC card 10 stores biometric information obtained by digitizing individual biometric features such as “fingerprint”, “voice print”, or “palm veins”. The biometric information stored in the storage unit of the IC card 10 includes the owner biometric information 30 as the biometric information of the owner of the IC card 10 (hereinafter referred to as the owner), and the use of the IC card 10 is permitted by the owner. The biometric information 31 of the authorized person and the biometric information 32 of the person who can actually use the IC card (hereinafter referred to as the user) are recorded as the biometric information of the person who is authorized (hereinafter referred to as the authorized user). . Here, the user is set from among owners and authorized users. That is, the user biometric information 32 is biometric information set from the owner biometric information 30 and the authorized person biometric information 31.

  Since there is only one owner, only one owner biometric information 30 is stored in the storage unit of the IC card 10, but when the owner permits the use of the IC card 10 to a plurality of persons, the storage of the IC card 10 is performed. The section stores a plurality of authorized person biometric information 31. The user biometric information 32 may set a plurality of pieces of biometric information as necessary.

  The user authentication number 33 defines at least the number of users that need to be authenticated in order to execute the command processing means 25. When the IC card is used, the command processing means 25 is not executed unless the biometric authentication of the user having the user authentication number of 33 or more is successful. For example, when the number of user authentications 33 is “2”, the command processing means 25 can be executed if the biometric information of two or more users is successfully authenticated, but the biometric information of one user can be executed. However, if the authentication is not successful, the command processing means 25 cannot be executed. A detailed description of the execution control of the command processing unit 25 will be omitted here, and will be described when the access control unit 22 is described. The user authentication number 33 cannot be set beyond the number of user biometric information 32 recorded in the storage unit of the IC card 10.

  The selection means 11 is means for selecting biometric information used for authentication from biometric information stored in the storage unit of the IC card 10. The selection means 11 is realized by a selection command provided in the IC card 10. The selection command transmitted from the outside of the IC card 10 includes information for designating biometric information stored in the storage unit of the IC card 10 (hereinafter referred to as designation information). When the IC card 10 receives the selection command, the selection unit 11 sets the biological information designated by the designation information as the selected biological information.

  The biometric information collating means 20 is a means for collating input biometric information and selected biometric information, and is realized by a biometric information collating command provided in the IC card 10. For example, when the biometric information of the owner is collated, the selected biometric information is set as the owner biometric information 30 using the selection unit 11, and the biometric information of the owner input from the outside of the IC card 10 is set as the input biometric information.

  If the biometric information collating means 20 collates the input biometric information with the selected biometric information and the previous collation matches, the IC card 10 determines that the selected biometric information has been authenticated. The verification result of the biometric information verification unit 20 is reflected in the security status 34.

  The security status generation unit 21 is a unit that generates a security status 34 from the collation result of the biometric information collation unit 20.

  The security status 34 generated by the security status generation means 21 is generated with an initial value “0” in the volatile memory by a program such as an operating system (hereinafter referred to as “OS”) when the IC card 10 is activated. Active information that is operated by the security status generation means 21 during processing of the card 10 and is information that is temporarily stored in a volatile memory such as a RAM (Random Access Memory) of the IC card 10.

  FIG. 2 is an explanatory diagram of the security status 34 of FIG. The security status 34 includes an owner authentication bit 340 indicating the verification result of the biometric information of the owner, M user authentication bits 341 indicating the verification result of the biometric information of the user, and a verification result based on the number 33 of user authentications. The user authentication number bit 342 shown in FIG. In FIG. 2, in order to make the explanation easy to understand, the owner authentication bit 340, the user authentication bit 341, and the user authentication number bit 342 are continuous information, but they may not be continuous information.

  The owner authentication bit 340 is 1-bit information indicating the authentication result of the owner's biometric information. The initial value of the owner authentication bit 340 is “0b” (b means bit notation), and when the collation between the input biometric information and the owner biometric information 30 matches, the security status generating unit 21 sets the owner authentication bit 340 to “ 1 ”.

  The user authentication bit 341 is 1-bit information indicating the authentication result of the user's biometric information, and the security status 34 has the same number of user authentication bits 341 as the user biometric information 32. When one user biometric information 32 is added to the storage unit of the IC card 10, a user authentication bit 341 corresponding to the added user biometric information 32 is added.

  When the initial value of the user authentication bit 341 is “0b” and the collation between the input biometric information and the user biometric information 32 matches, the security status generation unit 21 performs user authentication corresponding to the user biometric information 32 used for the collation. Bit 341 is set to “1b”.

  The number of user authentication bits 342 is a bit that changes from “0b” to “1b” when the number of user authentication bits 341 that are “1b” is 33 or more. For example, when the number of user authentications 33 is “3” and the three or more user authentication bits 341 are “1b”, the security status generation unit 21 sets the number of user authentications bit 342 to “1b”.

  FIG. 2B is a diagram for explaining the behavior of the security status 34 which is active information. For example, when the verification of the biometric information of the user 1 is successful, the user authentication bit 341 corresponding to the biometric information of the user 1 changes from “0b” to “1b” as shown in FIG.

  The object 40 is a file or program in which information is recorded. The command processing means 25 is means for operating the object 40 and is realized by a command provided in the IC card 10. Here, operating the object 40 means processing such as reading / writing of information recorded in the file when the object 40 is a file, and executing the program when the object 40 is a program.

  The object 40 includes an object security attribute 401 that defines an access condition to the object 40. The object security attribute 401 is passively 3-bit data, and is stored in a nonvolatile memory such as an EEPROM (Electrically Erasable Programmable Read-Only Memory).

  FIG. 3 is an explanatory diagram of the object security attribute 401. The security attribute bit 402 is indicated by bit 0 and bit 1 of the object security attribute 401, and the combination logic bit 403 is indicated by bit 2. The object security attribute 401 can be set for the object 40 for each type of the command processing means 25 or for each command processing means 25.

  The security attribute bit 402 is 2-bit information and indicates a condition necessary for accessing the object 40. Bit 0 means an access condition based on collation of the biometric information of the owner, and bit 1 means an access condition based on the number of user authentications 33. When bit 0 is “1b”, it means that the biometric information of the owner is required to access the object 40, and when bit 1 is “1b”, the number of user authentications is 33 or more for accessing the object 40. This means that it is necessary to successfully authenticate the biometric information of the user.

  The combination logic bit 403 is a bit indicating combination logic of two bits of the security attribute bit 402. As the combination logic, AND logic or OR logic can be set. In combination logic bit 403, “0b” means AND logic, and “1b” means OR logic. For example, when the security attribute 402 is “11b”, the access condition to the object 40 is “1b” for the owner authentication bit 340 and “1b” for the number of user authentications in the security status 34 in the case of AND logic. In the case of OR logic, it is necessary that either or both of the owner authentication bit 340 and the user authentication number bit 342 be “1b”.

  The authorized person biometric information adding means 24 is means for adding the authorized person biometric information 31 to the storage unit of the IC card 10, and is realized by an authorized user addition command included in the IC card 10. The use permitter adding means 24 includes a use permitter biometric information addition security attribute 241 that defines conditions for adding the use permitter biometric information 31. In the present invention, the additional condition is authentication of the biometric information of the owner, and the authorized person biometric information additional security attribute 241 is “1b” (authentication of the biometric information of the owner is required).

  The user biometric information setting means 23 is a means for setting the user biometric information 32 that is authenticated at the time of use, and is realized by a user setting command provided in the IC card 10.

  There are two types of user setting commands. One command is a user update command for updating the already stored user biometric information 32 to new user biometric information 32. The other command is a user addition command for adding new user biometric information 32 in addition to the already stored user biometric information 32. The user update command and the user addition command include at least biometric information of a permitted user set as a user.

  The user biometric information setting unit 23 includes a user setting security attribute 231 that defines the setting conditions of the user biometric information 32. In the present invention, the setting condition is authentication of the owner's biometric information, and the user setting security attribute 231 is “1b” (authentication of the owner's biometric information is required).

  The user authentication number setting means 26 is a means for setting the user authentication number 33 stored in the storage unit of the IC card 10 and is realized by a user authentication number setting command provided in the IC card 10. Further, the user authentication number setting means 26 includes a user authentication number setting security attribute 261 that defines conditions for setting the user authentication number 33. In the present invention, the condition is authentication of the biometric information of the owner, and the user authentication number setting security attribute 261 is “1b” (authentication of the biometric information of the owner is necessary).

  The access control means 22 refers to security attributes corresponding to each means when executing the command processing means 25, the user biometric information setting means 23, the use authorized person biometric information adding means 24, and the user authentication number setting means 26. By referring to and comparing with the security status 34, it is a means for confirming whether or not the execution condition of each means is satisfied.

  When executing the command processing unit 25, the access control unit 22 indicates the security attribute bit 402 and the security status 34 of the object security attribute 401 corresponding to the command processing unit 25 to be executed by the combinational logic bit 403 of the security status 34. The execution condition of the command processing means 25 is confirmed by comparison based on the combination logic.

  For example, when the combination logic bit 403 is “1b”, that is, OR logic, and the security attribute bit 402 is “11b”, any one of the owner authentication bit 340 and the user authentication number bit 342 of the security status 34 is “1b”. If so, the command processing means 25 is executed. If the combination logic bit 403 is “0b”, that is, AND logic, and the security attribute bit 402 is “11b”, the command processing is performed when the owner authentication bit 340 and the user authentication number bit 342 of the security status 34 are all “1b”. Means 25 is executed.

  When executing the user biometric information setting unit 23, the authorized person biometric information adding unit 24, and the user authentication number setting unit 26, the access control unit 22 sets the security attribute (1 bit) and security status 34 of each unit. By comparing the owner authentication bit 340 (1 bit), the execution condition of each means is confirmed. When the owner authentication bit 340 is “1”, the user biometric information setting unit 23, the use authorized person biometric information adding unit 24, and the user authentication number setting unit 26 are executed.

[Procedure for IC Card Authentication Method of the Present Invention]
From here, the procedure of the IC card authentication method of this invention is demonstrated. As an IC card authentication method of the present invention, a procedure for adding a permitted user, a procedure for setting a user, and a procedure for operating the object 40 by the command processing means 25 will be described. 4 is a diagram showing a procedure for adding a permitted user, FIG. 5 is a diagram showing a procedure for setting a user, and FIG. 6 is a diagram when the user operates the object 40 using the command processing means 25. It is the figure which showed the procedure of.

  FIG. 7 is an explanatory diagram of the owner biometric information 30, the authorized person biometric information 31, the user biometric information 32, and the user authentication number 33 stored in the storage unit of the IC card 10. In order to make the explanation of the procedure easy to understand, the owner biometric information 30 and the authorized person biometric information 31 are recorded in the record file 50, and the user authentication number 33 and the user biometric information 32 are stored in the record file 51. . The owner biometric information 30 is stored in the record 1 of the record file 50, and N useable biometric information 31 from the record 2 of the record file 50 is stored. Further, the number of user authentications 33 is stored in the record 1 of the record file 51, and M pieces of user biometric information 32 from the record 2 of the record file 51 are stored.

<Procedure for adding authorized users>
The procedure for adding the authorized person biometric information 31 to the storage unit of the IC card 10 will be described. FIG. 8 is a diagram for explaining biometric information stored in the record file 50. FIG. 8A is a diagram showing biometric information stored in the record file 50 when the IC card 10 is distributed to the owner. In FIG. 8A, only the owner biometric information 30 is stored in the record 1 in the record file 50. That is, when the IC card 10 is distributed to the owner, only the owner is permitted to use the IC card 10. The procedure for adding authorized users is shown below.

  FIG. 4 is a diagram showing a procedure for adding a permitted user. The first step S100 for adding the authorized user is a step for selecting the owner biometric information 30. When the selection command including the designation information of the owner biometric information 30 is transmitted to the IC card, and the IC card receives the selection command, the selection unit 11 is executed to set the owner biometric information 30 as the selected biometric information.

  The next step S110 is a step of authenticating the owner's biometric information. The biometric information of the owner is authenticated by transmitting a biometric information matching command including the biometric information of the owner to the IC card. When the IC card 10 receives the biometric information collation command, the biometric information collating unit 20 operates to use the biometric information of the owner included in the command as input biometric information and the input biometric information and the selected biometric information (in this case, the possessed biometric information). Human biometric information 30).

  When the owner biometric information 30 is authenticated, the owner authentication bit 340 of the security status 34 changes from “0b” to “1b”, and the process proceeds to the next step. If not authenticated, the owner authentication bit 340 of the security status 34 remains “0b” and does not change.

  The next step S120 is a step of transmitting the authorized user addition command to the IC card 10. The authorized user addition command includes biometric information of the authorized user.

  In the next step S130, the access control means 22 confirms the right to execute the authorized user addition command. When the IC card 10 receives the command, the access control means 22 operates, and the access control means 22 confirms the right to execute the authorized person biometric information adding means 24. If the owner authentication bit 340 is “1”, the access control means 22 executes the authorized person biometric information adding means 24 and proceeds to the next step. If the owner authentication bit 340 is “0”, the authorized person biometric information adding means is executed. 24 completes the procedure without executing it.

  In the next step S140, the authorized person biometric information adding means 24 adds the authorized person's biometric information input in step S120 to the storage unit as the authorized person biometric information 31. FIG. 8B is an explanatory diagram of the record file 50 when one user authorized person biometric information 31 is added. The record 2 in which one user-permitted biometric information 31 is recorded is added to the record file 50 after the use-permitted biometric information 31 is added. In FIG. 8B, the person who is permitted to use the IC card 10 is the person who has the use permission person biometric information 31 added with the owner. After executing Step S140, the procedure for adding authorized users is completed.

  By repeating steps S100 to S140 described above, the owner can store any number of authorized person biometric information 31 in the storage unit of the IC card 10. The record file 50 in FIG. 7 is a diagram when N pieces of use-permitted biometric information 31 are added.

<User setting procedure>
Next, a procedure for changing the user from the owner to a person other than the owner by changing the setting of the user biometric information 32 will be described. FIG. 9 is a diagram for explaining the user biometric information 32 stored in the record file 51.

  FIG. 9A is a diagram of the record file 51 when the IC card 10 is distributed to the owner. Only the owner biometric information 30 is stored as the user biometric information 32 in the record 2 of the record file 51. Since only one user biometric information 32 is stored, “1” is stored in the record 1 of the record file 51 as the user authentication number 33. That is, at the time when the IC card 10 is distributed to the owner, the owner biometric information 30 needs to be authenticated in order to operate the object 40 of the IC card 10.

  FIG. 5 is a diagram showing a procedure for setting user biometric information. The first step S200 of the user setting procedure is a step of authenticating the owner's biometric information.

  After executing step S200, if the user is to be updated, the process proceeds to step S201, and if the user is to be added, the process proceeds to step S210.

  Step S201 is a step of selecting user biometric information 32 to be updated. A selection command including designation information of the user selection information 32 to be updated is transmitted to the IC card. When receiving the selection command, the IC card causes the selection means 11 to execute and sets the user selection information 32 indicated by the designation information as selected biometric information.

  Step S202 is a step of authenticating the biometric information of the user to be updated. Authentication of the biometric information of the user to be updated is performed by transmitting a biometric information matching command including the biometric information of the user to be updated to the IC card. When the IC card 10 receives the biometric information collation command, the biometric information of the user included in the command is used as input biometric information, and the input biometric information and selected biometric information (here, the user biometric information 32 to be updated) are collated. To do.

  When the biometric information of the user to be updated is authenticated, the user authentication bit 341 corresponding to the user biometric information 32 to be updated in the security status 34 is changed from “0” to “1”. If not authenticated, the security status 34 does not change.

  Step S210 is a step of selecting the authorized person biometric information 31 of the authorized person to use. When the selection command including the designation information of the authorized person biometric information 31 is transmitted to the IC card, the IC card executes the selection means 11 and uses the authorized person biometric information 31 indicated by the designated information as the selected biological information.

  Step S220 is a step of transmitting a user update command or a user addition command to the IC card as a user setting command. The user update command and the user addition command include biometric information of a user who is authorized to use. The user update command also includes designation information of user biometric information 32 to be updated (information for designating user biometric information 32 authenticated in step S202).

  In the next step S230, the access control means 22 confirms the right to execute the user setting command. When the IC card 10 receives the user setting command, the access control means 22 executes the user setting command if the owner authentication bit 340 of the security status 34 is “1”, and the owner authentication of the security status 34 If bit 340 is “0”, the procedure ends without executing the user setting command.

  Next, step S240 is a step of authenticating the biometric information of the authorized user as a user. The IC card collates the input biometric information (here, the biometric information of the authorized person) and the selected biometric information (here, the authorized person biometric information 31 selected in step S210). If authenticated, the process proceeds to step S250, and if not authenticated, the user setting procedure is terminated. The verification result of the authorized person biometric information 31 is not reflected in the security status 34.

  Step S250 is a step of updating the user biometric information 32 or adding the user biometric information 32. When the user biometric information 32 is updated, it is confirmed that the user authentication bit 341 corresponding to the user biometric information 32 designated by the designation information included in the user update command is “1b”. If the user authentication bit 341 is “1b”, the user biometric information 32 designated by the designation information is updated to the biometric information of the authorized user included in the user update command. When the user authentication bit 341 is “0b”, the user biometric information 32 is not updated.

  When the user biometric information 32 is added, the biometric information of the authorized user included in the user addition command is added as the user biometric information 32. When added as the user biometric information 32, a user authentication bit 341 corresponding to the added user biometric information 32 is added to the security status 34.

  After executing step S250, if the user authentication number 33 is set, the process proceeds to step S260, and if the user authentication number 33 is not set, the procedure ends.

  Step S260 is a step of transmitting a user authentication number setting command including the user authentication number 33 to be set to the IC card.

  In the next step S270, the person access control means 22 confirms the execution right of the user authentication number setting means 26. The access control means 22 executes the user authentication number setting means 26 if the ownership authentication bit 340 of the security status 34 is “1”, and the number of user authentications if the owner authentication bit 340 of the security status 34 is “0”. The procedure ends without executing the setting means 26.

  In the next step S280, the user authentication number setting means 26 sets the user authentication number 33. When the user authentication number setting means 26 sets the user authentication number 33, the number of user biometric information 32 stored in the storage unit of the IC card 10 is checked, and the number of user biometric information 32 is determined. A mechanism is provided in which a value exceeding the user authentication number 33 cannot be set. After execution of step S280, the procedure ends.

  FIG. 9B is a diagram when the user biometric information of the record 2 is updated from the owner biometric information to the biometric information of the user 1. In the state shown in FIG. 9B, the biometric information of the user 1 needs to be authenticated in order to operate the object 40 of the IC card. FIG. 9C is a diagram in which user biometric information 32 which is biometric information of the user 1 is added to FIG. In FIG. 9C, a record 3 recorded with user biometric information 32 is added. In FIG. 9C, since the number of user authentications 33 is “1”, it is necessary to authenticate the biometric information of the owner or the user 1 in order to operate the object 40 of the IC card.

  The record file 51 in FIG. 7 is a diagram when M pieces of user biometric information 32 are added and the number of user authentications 33 is set to “L”. In the record file 51 of FIG. 7, in order to operate the object 40 of the IC card, authentication of L or more user biometric information 32 is required.

<Operation procedure of the object>
A procedure for the user to operate the object 40 from here will be described. FIG. 6 is a diagram showing a procedure for operating the object 40. Here, to make the explanation easy to understand, two pieces of user biometric information 32 are set, and the number of user authentications 33 is set to “2”.

  The object 40 is a record file, and the command processing means 25 is a record read command or a record write command. The object security attribute 401 for the record read command is “111b” (OR logic), and the object security attribute 401 for the record write command is “011b” (AND logic).

  The first step S300 of the procedure in which the user operates the object 40 is a step of authenticating the biometric information of one user who has the biometric information set as the use biometric information 32. If the biometric information of the user is authenticated, the bit corresponding to the authenticated user biometric information 32 of the security status 34 changes to “1”, but the user authentication number bit 342 of the security status 34 is “0”. It remains. This is because the number of user authentications 33 is “2”, but only one user authentication bit 341 is “1”. Also, the owner authentication bit 340 remains “0”.

  The next step S310 is a step of authenticating the biometric information of another user having the biometric information that is also set as the use biometric information 32. When authenticated, the bit corresponding to the authenticated user biometric information 32 of the security status 34 changes to “1”, and the user authentication number bit 342 of the security status also changes to “1”. This is because the number of user authentications 33 is “2” and the two user authentication bits 341 are “1” as described above.

  The next step S320 is a step of transmitting a command for operating the object 40 to the IC card 10. As described above, there are two commands for operating the object 40: a record read command or a record write command.

  The next step S330 is a step of confirming the execution right of the command processing means 25 corresponding to the transmitted command. When the IC card 10 receives a command for operating the object 40, the access control means 22 refers to the object security attribute 401 and compares it with the security status 34 to confirm the execution right of the command processing means 25.

  When the transmitted command is a record read command, the security attribute bit 402 of the object security attribute 401 is “11b”, the combination logic bit 403 is “1”, that is, OR logic, and the user authentication number bit 342 of the security status 34 is “ 1 ”, the access control means 22 determines that the record read command execution right is satisfied.

  When the transmitted command is a record write command, the security attribute bit 402 of the object security attribute 401 is “11b”, the combination logic bit 403 is “0”, that is, AND logic, and the owner authentication bit 340 of the security status 34 is “0”. Therefore, the access control means 22 determines that the record write command execution right is not satisfied.

  The next step S340 is a step of executing a command for operating the object 40. In this step, the record read command is executed, but the record write command is not executed. In order to execute the record write command, the biometric information of the owner needs to be authenticated. After the process of step S340 ends, the procedure for the user to operate the object 40 ends.

The block diagram of an IC card. Explanatory drawing of a security status. Explanatory drawing of a target object security attribute. The figure which showed the procedure which adds a use permission person. The figure which showed the procedure which sets a user. The figure which showed the procedure which operates a target object. Explanatory drawing of the record file which memorize | stored biometric information. Explanatory drawing of the record file which memorize | stored the biometric information when a use permission person is added. Explanatory drawing of the record file which memorize | stored the biometric information when a user was changed.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 IC card 20 Biometric information collation means 21 Security status generation means 22 Access control means 23 User setting means 24 Use permission person addition means 25 Command processing means 26 User authentication number setting means 30 Owner biometric information 31 Use permission person biometric information 32 User biometric information 33 Number of user authentications 34 Security status 340 Security status owner authentication bit
341 User authentication bit of security status
342 Number of user authentications in security status bit
40 Object 401 Object security attribute 402 Security attribute bit of object security attribute
403 Combination logic bit of object security attribute

Claims (5)

  In the IC card authentication method for authenticating the user's biometric information and permitting the use of the IC card, the owner's biometric information and the owner's permission to use the IC card are previously stored in the IC card storage unit Biometric information is stored, and biometric information at the time of use is set from the biometric information stored in the storage unit of the IC card before use, and the biometric information of the user and the biometric information at the time of use An IC card authentication method characterized in that the use of an IC card is permitted by checking the above.   2. The IC card authentication method according to claim 1, wherein the biometric information of the owner needs to be authenticated in order to set the use-time biometric information.   The IC card authentication method according to claim 1 or 2, wherein a plurality of the in-use biometric information are set before use, and at least authentication is performed to permit use of the IC card in the storage unit. An IC card authentication method for storing a necessary number of users and permitting the use of an IC card when the number of biometric information at the time of use authenticated is equal to or greater than the number of users.   In the IC card in which the biometric information of the owner is stored in advance in the storage unit of the IC card, the biometric information adding means for storing the biometric information other than the owner in the storage unit and the biometric information stored in the storage unit at the time of use User setting means for setting biometric information to be authenticated, biometric information collating means for collating biometric information input from an external device with the biometric information set by the user setting means, and operating the IC card An IC card comprising at least command processing means and execution control means for controlling execution of the command processing means based on an authentication result of the biometric information matching means. 5. The IC card according to claim 4, wherein the execution control means has a function of controlling execution of the command processing means based on the number of biometric information authenticated at the time of use. IC card to do.

Images