JP2007199814A - Authentication management method and system - Google Patents

Abstract

An authentication method and a range of application of personal authentication information used for authentication are set in units of identification data corresponding to each service managed by each application instead of each application, and different personal authentication information is set. Use the same authentication application for personal authentication.
In a system in which a user can receive services from a plurality of service providing devices using an IC card, authentication is performed using authentication method identification data when the user selects to use a service. The application is specified, and the representative identification data of the group to which the identification data specifying the selected service belongs is collated with the authenticating representative identification data. As a result of the collation, the personal authentication information related to the successful authenticating representative identification data is specified, and the user is authenticated by executing the specified authentication application. If the authentication is successful, the selected service application is executed to allow service provision.
[Selection] Figure 1

Description

  The present invention relates to an authentication management method and system, and in particular, a personal authentication that uses a medium such as an IC card equipped with a user authentication function to perform user authentication under a plurality of applications corresponding to the service to be used. The present invention relates to a management method and system.

  In recent years, in each service such as finance, transportation, public, medical care, electronic commerce, etc., it is possible to authenticate a user using an IC card having a user authentication function and provide the service only to a legitimate person. It is done. When receiving multiple services, at present, the user must have multiple IC cards corresponding to each service, which is not preferable from the viewpoint of safety and convenience of possession. . Therefore, it has been proposed to have a plurality of applications corresponding to a plurality of services in one IC card, and convenience has been improved.

At present, IC cards are often used in services involving handling of personal information and money transactions, and a higher security level is required in order to prevent the leakage and unauthorized use of personal information. As measures for improving the security level, in order to prevent information leakage due to access from other applications in the IC card, a method of providing a firewall between applications in the IC card as an OS (operating system) specification to restrict mutual cooperation, Methods such as performing identity authentication based on information that only the person can have before using the service have been proposed. In addition to conventional PINs and passwords, authentication methods using biometric information such as voice, fingerprints, finger veins, retina, etc. have been devised as part of the authentication methods for individuals. Has been.
As described above, a medium is required to have a mechanism for improving quality in terms of both convenience and security.

  Regarding transactions using an IC card, for example, Patent Document 1 (Japanese Patent Application Laid-Open No. 2001-243350) discloses a plurality of items such as account information used for bank transactions in one application mounted on one IC card. A system is disclosed that manages condition identification data corresponding to each of the above conditions and authenticates with a representative account selected from the condition identification data, thereby permitting transactions even for a plurality of conditions held.

  Patent Document 2 (Japanese Patent Application Laid-Open No. 2002-298097) discloses a personal authentication method for each application mounted on an IC card and personal authentication information such as a password and a fingerprint, for example, as an application corresponding to each service. Separately, it is provided in the IC card as a common module, cooperates in the IC card, and when using a certain service, the authentication is completed by the authentication method adopted for the application corresponding to the service, so that the same personal authentication is performed. A system that can continuously use other services that employ the method without the user authentication is disclosed.

JP 2001-243350 A JP 2002-298097 A

  According to the techniques disclosed in Patent Documents 1 and 2 above, since one type of personal authentication method is fixed for one application, for example, service contents such as bank transaction account information differ. However, it is not possible to use the personal authentication method flexibly. In addition, as in Patent Document 2, when using an authentication module common to IC cards, the authentication module holds only one personal authentication information for each authentication method, and the same authentication using different personal authentication information. When the authentication method is used, the finger vein authentication method using different personal authentication information such as the middle finger of the right hand in the credit card service and the left index finger in the cash card service cannot be performed in the same module. .

  For this reason, in the conventional technique, it is necessary to prepare an application having a duplicated process other than the personal authentication information separately from the authentication application, which is inefficient.

  An object of the present invention is to set an authentication method and a range to which personal authentication information used for authentication is applied in units of groups of identification data corresponding to each service managed by an application, and use different personal authentication information. It is an object of the present invention to provide an authentication management method and system capable of performing personal authentication using the same authentication application.

The authentication management system according to the present invention is preferably a system in which a user can receive services from a plurality of service providing apparatuses that provide a plurality of services using a medium. A plurality of service applications executed in advance in association with a plurality of services, identification data for identifying services used by the service applications, and identification data owned by each service application are stored in one or more groups in the memory. Representative identification data representing each divided group, multiple authentication applications that can perform personal authentication using multiple different authentication methods, and representative identification so that the selected service is provided to the authorized user Identify the authentication application associated with the data Paired with authentication method identification data, personal authentication information having a format defined by each authentication method owned by the authentication application, and representative identification data that uses the personal authentication information for authentication by the authentication application owned by the authentication application. The authentication side representative identification data is stored,
A group for specifying an authentication application by authentication method identification data when a user selects use of a service by execution of a CPU of a medium or a service providing apparatus, and a group to which identification data for specifying the selected service belongs A means for collating with the authenticating representative identification data by using the representative identifying data as a key, and identifying personal authentication information related to the successful authenticating representative identification data as a result of the collating by the verifying means, and executing the specified authentication application And authenticating means for authenticating the user, and configured as an authentication management system that, when successful as a result of user authentication by the authenticating means, executes the selected service application and permits service provision Is done.

In a preferred example, in a system in which a user can receive services from a plurality of service providing apparatuses that provide a plurality of services using a medium, a medium such as an IC card includes a memory for storing information, It has a control unit including a CPU for information processing, and the memory has a plurality of service applications executed in association with a plurality of services, identification data for identifying services used by the service applications, and each service application The personal identification is performed by a plurality of different authentication methods so that the selected service is provided to the legitimate user and the representative identification data representing each group obtained by dividing the identification data into one or a plurality of groups. Multiple authentication applications that can be associated with representative identification data Authentication method identification data for identifying the authentication application, personal authentication information having a format defined by each authentication method owned by the authentication application, and representative identification that uses the personal authentication information for authentication by the authentication application owned by the authentication application The authentication side representative identification data paired with the data is stored, and the control unit executes the service application and the authentication application,
The service providing apparatus is an authentication management system that holds and executes at least one service application and performs user authentication in cooperation with a medium authentication application.

The authentication management method according to the present invention is preferably a user authentication management method in a system in which a user can receive services from a plurality of service providing apparatuses that provide a plurality of services using a medium. , In the memory of the medium or the service providing apparatus, a plurality of service applications executed in advance in association with a plurality of services, identification data for specifying services used by the service applications, and identifications owned by each service application Individual identification can be performed by a plurality of different authentication methods so that representative identification data representing each group obtained by dividing the data into one or a plurality of groups and a selected service are provided to a legitimate user. Associated with multiple authentication applications and representative identification data Authentication method identification data for identifying the authentication application, personal authentication information having a format defined by each authentication method owned by the authentication application, and representative identification for using the personal authentication information for authentication by the authentication application owned by the authentication application Storing and preparing authenticating representative identification data to be paired with data;
When the user selects the use of a service, the step of identifying the authentication application by the authentication method identification data and the representative identification data of the authenticating side using the representative identification data of the group to which the identification data specifying the selected service belongs as a key And the step of identifying personal authentication information related to the successful authenticating representative identification data as a result of the verification, and providing the service of the selected service application when the user is successfully authenticated by the authentication application. And an authentication management method.
In a preferred example, when the user is successfully authenticated, the use of the service of the service application specified by the one or more identification data belonging to the representative identification data used for the authentication is permitted.
Preferably, when the user authentication is successful, one or more identification data belonging to each representative identification data paired with one or more authenticating side representative identification data associated with the personal authentication information used for authentication is Use is permitted for the service of the specified service application.
Preferably, when the user is successfully authenticated, the one belonging to each representative identification data paired with one or more authenticating side representative identification data associated with one or more personal authentication information owned by the authentication application. Alternatively, use of the service application service specified by the plurality of identification data is permitted.

  According to the present invention, the range for applying the personal authentication method and the personal authentication information used for authentication is set not for each application corresponding to the service but for each group of identification data corresponding to each condition managed by each service. be able to. Further, since the authentication application used for personal authentication and the personal authentication information held by the authentication application can be specified using the representative identification data as a key, personal authentication using different personal authentication information can be performed by the same authentication application. it can.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
This example describes a system in which identity authentication is performed using a common IC card and services can be provided from a plurality of different devices. One device that provides the service is the terminal 100 that performs the cash card service shown in FIG. 1, and the other is the device that performs the resident card issue service shown in FIG. The terminal 100, the resident card issuing system, and the IC card used for them are referred to as a personal authentication management system.

First, a configuration example of a terminal system that performs the cash card service shown in FIG. 1 will be described.
In this system, the terminal 100 is a device that provides a service, for example, an automatic savings and saving device (ATM) in a bank, and includes an IC card R / W unit 210, a display device 220, an input device 230, and an authentication information input device 240 as constituent units. Have. Here, the IC card R / W unit 210 communicates with the IC card to read and write the contents. The display device 220 is a display device such as a liquid crystal display that displays information and instructions required by the user. The input device 230 inputs information and instructions necessary for the user to receive service. In the case of ATM, a touch input type display / input device in which the display device 220 and the input device 230 are integrated is used.
The authentication information input device 240 is an input key in the case of password authentication, and is a vein reading device in the case of biometric information authentication such as finger vein authentication. In the case of only password authentication, the authentication information input device 240 may be omitted and the input device 230 may be used.

  The terminal 100 includes therein a CPU 110 that executes a program, a memory 120 that stores programs and data, and a hard disk 130. The hard disk 130 holds a cash card service application as the application 131 and a representative data / authentication method correspondence list 400 for personal authentication management characteristic of the present embodiment.

The configuration of the representative identification data / authentication information correspondence list 400 will be described with reference to FIG.
The representative identification data / authentication method correspondence list A400 registers a pair of authentication method identification data and an authentication application used in the terminal 100 that provides the service. In the illustrated example, two types of authentication, finger vein authentication and password authentication, are used. Therefore, the identification data 410 of the authentication application having the authentication method specified by the specific condition 1 specified by the identification data 510 and the specific condition 2 specified by the cache service application 321 and the identification data 530 are specified. It has identification data 420 of an authentication application having the authentication method specified by the specific condition 1.
Here, the specific conditions 1 and 2 used for the finger vein authentication application 410 may be one, or may be three or more.

Next, the resident card issue system shown in FIG. 8 will be described.
In this system, a server 1100 that registers and manages a resident's card includes a CPU 1110 that executes a program, a memory 1120 that stores the program and data, and a hard disk 1130. The hard disk 130 holds an application 1131 for a resident certificate issuing service and a representative data / authentication method correspondence list B900 for personal authentication management.

  The server 1100 has an operation terminal 1200 for a user to apply for and obtain a resident's card, and further includes an IC card R / W unit 1210, a display device 1220, an input device 1230, an authentication information input device 1240, and the like. It has a composition unit. Each of these units 1210 to 1240 has the same configuration as the unit shown in FIG.

Next, the representative identification data / authentication information correspondence list B900 will be described with reference to FIG.
The representative identification data / authentication method correspondence list B900 registers a pair of authentication method identification data and an authentication application used in the resident card issue service, similarly to the above-described representative identification data / authentication method correspondence list A400. In the illustrated example, two types of authentication, finger vein authentication and password authentication, are used. Regarding the pair of the first authentication method identification and the finger vein authentication application 410, the specific condition 1 that specifies the identification data 1011 and the specific condition 2 that specifies the transfer notification issue service application are registered. Further, specific conditions 1 and 2 are registered in the pair of the second authentication method identification and the password authentication application 420.

Next, the configuration of the IC card will be described with reference to FIG.
The IC card 300 includes a control unit 310 having a CPU and a memory 320. The CPU executes a program held in the IC card. The memory 320 holds application programs and data characteristic of this embodiment.
That is, the cash card service application 321 and the resident card correspond to the service applications (the cash card service application 131 in FIG. 1 and the resident card issue service application 1131 in FIG. 8) held in the terminal 100 that can use the IC card. Corresponding to the service application 322 and those applications, the authentication identification data lists A500 and B1000 are held. In addition, the finger vein authentication application 410 and the personal identification number authentication application 420 as the applications for personal authentication and the representative identification data / authentication information correspondence lists A610 and B620 are held corresponding to these applications.

  When the number of service applications that can be used by the IC card is further increased, more service applications are held corresponding to these services, and the authentication application 410 is used in order to support more authentication methods. , 420, an application of a related authentication method may be added and held.

  Next, the structure of the list used for the service applications 321 and 322 held in the IC card (FIGS. 4 and 10), and the representative identification data / authentication information correspondence list used for the authentication applications 410 and 420 (FIG. 5) will be described.

Referring to FIG. 4, identification data list 500 groups identification data that can be used, and registers identification data belonging to these groups and representative identification data selected from the group. In the example shown in the figure, the group A includes two groups A and B. The group A is composed of representative identification data 510 and belonging identification data 520 including identification data a521, identification data b522, and identification data c523 belonging to the representative identification data 510. The The group B includes representative identification data 530, identification data d541 belonging to the representative identification data 530, and belonging identification data 540 including identification data e542. In the figure, “11111” to “12222” etc. are identification data. For example, in group A, “11111” is registered as representative data from among three types of identification data, and in group B, “12221” is representative identification data. It is registered as.
As shown in FIG. 10, the identification data list 1000 used for the resident card issue service application 322 registers a resident card code 1011 as one representative data 1010.

Next, the configuration of the representative identification data / authentication information correspondence lists 610 and 620 used for the authentication applications 410 and 420 in the IC card will be described.
As shown in FIG. 5A, the representative identification data / authentication information correspondence list 610 is owned by the authentication application 410, and the authentication side representative identification data associated with the finger vein information a611 and the finger vein information a611. A representative account number is registered as 612, and a resident's card code is registered as finger vein information b613 and authentication side representative identification data 614.
Also, as shown in FIG. 5B, the representative identification data / authentication information correspondence list 620 registers the representative account number 622 and the library user ID 623 as the authentication representative identification data associated with the personal identification number c621. .

FIG. 6 shows an example of a screen displayed on the display device 220.
A screen 701 is an example of a screen that prompts card insertion into the IC card R / W unit 210. In the case of a form such as holding the card, placing it, etc., which is different from inserting, the message conforms to each form.
Screen 702 is a screen example that presents a selection menu for the user of terminal 100 based on identification data list 500 read from the IC card. In this embodiment, the identification data is displayed as it is as a menu. However, the menu displayed on the screen does not need to display the identification data as it is, and may be expressed by words associated with the identification data. It is not necessary to display all of the information in the read identification data list 500, and for each of the groups A and B divided in association with the representative identification data, the screen is displayed with the major items based on the representative identification data and the affiliation identification data with the smaller items. The display form and display / non-display may be changed according to the purpose of use, such as displaying separately.

A screen 703 is an example of a screen that is displayed when any one of the identification data a to e associated with the authentication method A is selected on the menu selection screen 702.
A screen 704 is an example of a screen that is displayed when either the identification data d or the identification data e associated with the authentication method B is selected on the menu selection screen 702. The screen details are the same as the conditions written on the screen 703.
A screen 705 is a screen example displayed when authentication by each authentication method is successful. In this embodiment, it is assumed that the screen is displayed for a certain period of time after the screen is displayed, and the screen automatically transitions to the transaction screen.

Next, the authentication management operation will be described.
In the present embodiment, there are two cases of authentication management when using a common IC card and receiving a cash card service using the terminal 100 of FIG. 1 and receiving a resident card issue service of FIG.
First, the operation of authentication management when using the terminal 100 will be described with reference to the flowchart of FIG.

  The CPU 110 of the terminal 100 activates the terminal application 131 on the hard disk 130, displays the screen 701 on the display device 220, and prompts the user to insert the IC card 300 into the IC card R / W 210 (step 801). . When the CPU 110 confirms that the IC card 300 has been inserted (step 802), the CPU 110 selects the application 131 of the terminal 100 from among the applications (# 321, 322 in FIG. 2) held in the memory 320. The corresponding cash card service application 321 is selected. Then, the control unit 310 of the IC card 300 requests an identification data list corresponding to each service condition handled by the terminal application 131 held by the cash card service application 321 held in the memory 320 (step 804).

  In this example, the selection of the application held in the memory 320 of the IC card 300 is automatically selected when the CPU 110 executes the terminal application 131 held in the hard disk 130. However, in another example, the user of the terminal 100 may select an application held by the IC card 300 using the input device 230.

  Upon receiving the identification data list request, the control unit 310 of the IC card 300 reads the identification data list 500 owned by the cash card service application 321 held in the memory 320 and transmits it to the terminal 100 (step 805). . The CPU 110 receives the identification data list 500 and stores it in the memory 120 (step 806). Then, a screen 702 is displayed on the display device 220 based on the identification data list 500 to prompt the user of the terminal 100 to select identification data corresponding to the service conditions to be handled (step 807). The CPU 110 acquires the identification data a521 (that is, “11111”) selected by the user of the terminal 100 using the input device 230 of the terminal 100 and stores it in the memory 120 (step 809). Then, referring to and searching the identification data list 500 stored in the memory 120 and confirming that the identification data a521 exists in the affiliation identification data 520, the representative identification data 510 is determined as representative identification data and stored in the memory 120. Store (step 810).

  In this example, the CPU 110 of the terminal 100 prompts the user of the terminal 100 to select identification data corresponding to the service conditions handled by using the input device 230. However, the CPU 110 selects the hard disk 130 of the terminal 100. The identification data may be automatically selected based on the setting of the terminal application 131 held by.

Next, the CPU 110 refers to the representative identification data / authentication method correspondence list 400 held in the hard disk 130, and the representative identification data a 510 (that is, “11111”) stored in the memory 120, the specific condition 1 on the list, and the representative It is confirmed that the identification data 611 and the specific condition 2 match the service application A being handled, and it is determined that the authentication is performed using the authentication application 410 and stored in the memory 120 (step 811).
In this example, the representative identification data / authentication method correspondence list 400 is held in the hard disk 400 of the terminal 100. However, as other examples, the memory 320 of the IC card 300 and the memory 320 of the IC card 300 are held. Any of the service applications A321 to be held may hold.

Next, the CPU 110 sends the representative identification data stored in the memory 120 using the authentication application A 410 to the control unit 310 of the IC card 300 based on the information of the authentication application A 410 stored in the memory 120 of the terminal 100. A request is made to perform personal authentication with 510 as a key (step 812).
The control unit 310 of the IC card 300 refers to the representative identification data / authentication information correspondence list A610 owned by the authentication application A410 held in the memory 320 of the IC card 300, searches for the representative identification data 510 transmitted from the terminal 100. And the authentication-side representative identification data 612 held in the list match, and the representative identification data 510 is stored in the memory 320 (step 813). Then, personal authentication is performed by the method of the authentication application A, and the terminal 100 is requested to acquire authentication information in accordance with the method of the authentication application A (step 814).
In this way, the personal authentication information is associated with the representative identification data and managed for each authentication application of the IC card, so that the duplication of the personal authentication information is suppressed and the risk of leakage is suppressed, and the personal authentication information to be used You can specify.

  When receiving the authentication information acquisition request, the CPU 110 of the terminal 100 displays a screen 703 on the display device 220 and prompts the user of the terminal 100 to input the user authentication information using the authentication information input device 240 ( Step 815). When the CPU 110 acquires the personal authentication information from the authentication information input device 240 (step 816), the CPU 110 transmits the acquired personal authentication information to the IC card 300 (step 817). In the present embodiment, illustration of handling of the acquired personal authentication information on the terminal 100 side is omitted, but in order to prevent leakage of personal information, it is deleted from the memory after transmitting the personal authentication information to the IC card 300. It would be desirable to do.

  The control unit 310 of the IC card 300 refers to the representative identification data / authentication information correspondence list A 610 based on the representative identification data 510 stored in the memory 320, and the representative identification data on the list 610 that matches the representative identification data 510. It is decided to use the authentication information a611 attached to 612, and it is confirmed whether the authentication information a611 matches the personal authentication information transmitted from the terminal 100 (step 818). As a result, if they match, the terminal 100 is notified of successful authentication (step 819).

  When receiving the authentication success notification from the IC card 300, the CPU 110 of the terminal 100 displays the screen 705 on the display device 220 for a certain period of time (step 820), the representative identification data 510 stored in the memory 120, and the use of the terminal 100. Based on the identification data a521 selected by the person and the identification data list 500, the service use of the conditions relating to the belonging identification data 520 accompanying the representative identification data 510 is permitted and stored in the memory 120 (step 821). The service of the condition regarding the identification data a521 selected by the person is started (step 822).

In this embodiment, the permitted range of the service condition when the personal authentication is obtained is for the same group, but this is only for the service condition selected by the user of the terminal 100 or possessing the identification data list 500 It is also possible to change all service conditions etc. according to the purpose of use.
In this embodiment, descriptions of abnormal processing such as authentication failure and unauthorized IC card use are omitted. In these cases, it is desirable to immediately delete the personal information and end the procedure. Let's go.

Next, with reference to the flowchart of FIG. 11, the operation when the user receives the resident card issue service using the same IC card will be described. In addition, the system diagram of FIG. 8, the block diagram of the IC card of FIG. 2, FIGS.
Compared to the service operation in the terminal 100 described above, the configurations of the representative identification data / authentication method correspondence list B in FIG. 9 and the identification data list in FIG. 10 are different, but the basic operation is the same. The following is a description.

  The CPU 1110 of the server 1100 activates the terminal application 1131 on the hard disk 1130, displays the screen 701 on the display device 1220, and prompts the user to insert the IC card 300 into the IC card R / W 1210 (step 1301). . When the CPU 1110 confirms that the IC card 300 has been inserted (step 1302), the application stored in the memory 320 of the IC card 300 (# 321 and 322 in FIG. 2) is transferred to the application 1131 of the server 1100. The corresponding resident card issue service application 322 is selected. Then, the control unit 310 of the IC card 300 requests an identification data list corresponding to each condition of the service handled by the application 131 held by the resident card issue service application 322 held in the memory 320 (step 1304).

  Upon receiving the request for the identification data list, the control unit 310 of the IC card 300 reads the identification data list 1000 owned by the resident card issuance service application 322 held in the memory 320 and transmits it to the server 1100 (step 1305). ). The CPU 1110 receives the identification data list 1000 and stores it in the memory 1120 (step 1306). Based on the identification data list 1000, a screen 702 (the identification data to be displayed is different) is displayed on the display device 1220, and selection of identification data corresponding to the service conditions handled for the user of the server 1100 is selected. (Step 1307). When the user selects the resident card code 1011 from the input device 1230 (step 1308), the CPU 1110 acquires the resident card code 1011 selected by the user (that is, “123456”) and stores it in the memory 1120 ( Step 1309). Then, the representative identification data / authentication method list B900 stored in the memory 1120 is referred to and searched to determine the finger vein recognition method 410 and stored in the memory 1120 (step 1310).

  Next, the CPU 1110 determines an authentication method with reference to the representative identification data / authentication method correspondence list 900 held in the hard disk 1130, and based on the information of the authentication application 410 stored in the memory 1120, The controller 310 is requested to use the authentication application 410 to perform personal authentication using the resident card code 1011 stored in the memory 1120 as a key (step 1312).

  The control unit 310 of the IC card 300 refers to and searches the representative identification data / authentication information correspondence list B 610 owned by the authentication application 410 held in the memory 320 of the IC card 300, and the resident card code 1011 transmitted from the server 1100. And the authentication representative representative identification data 614 held in the list 610 match, and the resident card code 1011 is stored in the memory 320 (step 1312). Then, user authentication is executed by the method of the authentication application A, and the server 1100 is requested to acquire authentication information in accordance with the method of the authentication application A (step 1313).

  When receiving the authentication information acquisition request, the CPU 1110 of the server 1100 displays a screen 703 on the display device 1220 and prompts the user to input the personal authentication information using the authentication information input device 1240 (step 1314). When the CPU 1110 acquires the user authentication information from the authentication information input device 1240 (step 1315), the CPU 1110 transmits the acquired user authentication information to the IC card 300 (step 1316).

  The control unit 310 of the IC card 300 refers to the representative identification data / authentication information correspondence list A610 based on the identification data list 1000 stored in the memory 320, and the authentication information of the list 610 from the resident card code 1011, that is, finger vein The information b613 is determined, and it is confirmed whether or not the finger vein information b613 and the personal authentication information transmitted from the server 1100 match (step 1317). Notification is made (step 1318).

  Upon receiving the authentication success notification from the IC card 300, the CPU 1110 of the server 1100 displays the screen 705 on the display device 1220 for a certain period of time (step 1319), and starts a service for the resident card code 1011 (1320).

  As described above, according to the present embodiment, the range of application of personal authentication information and personal authentication information used for authentication corresponds to each condition managed by each service, not the application unit corresponding to each service. It can be set for each group of identification data. Further, since the authentication application used for personal authentication and the personal authentication information held by the authentication application can be specified using the representative identification data as a key, personal authentication using different personal authentication information can be performed by the same authentication application. it can.

  For example, when the finger vein authentication method is performed using different personal authentication information for each condition, such as the right hand middle finger in the credit card service, the left hand middle finger in the account 1 and account 2 in the cash card service, and the left index finger in the account 3 in the cash card service. Is representative identification data in the credit card service application, finger vein information of the middle finger of the right hand which is personal authentication information associated with the representative identification data, representative identification data selected from the account 1 and account 2 in the cash card service application, and the This can be handled by holding the finger vein authentication information of the left middle finger associated with the representative identification data, the representative identification data account 3 and the finger vein information of the left index finger associated with the representative identification data in one finger vein authentication application.

  In addition, this invention is not limited to the said Example, A various deformation | transformation can be implemented. For example, in the above-described embodiment, an example in which an authentication application, authentication method identification data, representative identification data, and the like are provided in an IC card has been described. It can also be provided in a service providing apparatus.

The figure which shows the structure of the terminal system which performs the cash card service by one Example of this invention. The figure which shows the structural example of the IC card used in the personal authentication management system of one Example. The figure which shows the example of the use identification data and authentication system corresponding | compatible list in the personal authentication management system of one Example. The figure which shows the example of the identification data list 500 in the personal authentication management system of one Example. The figure which shows the example of the representative identification data and authentication information corresponding list | wrist in the personal authentication management system of one Example. The figure which shows the example of a screen displayed on the display apparatus of the terminal 100 of one Example. The figure which shows the example of the flowchart which shows the process sequence of the personal authentication in the cash card service of one Example. The figure which shows the structure of the resident's card issue system in one Example. The figure which shows the example of the use identification data and authentication system corresponding | compatible list | wrist 900 in the personal authentication management system of one Example. The figure which shows the example of the identification data list 1000 in the personal authentication management system of one Example. The figure which shows the example of the flowchart which shows the process sequence of the personal authentication in the resident's card issue service of one Example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100: Terminal 120: Memory 130: Hard disk 110: CPU 210: IC card R / W unit 220: Display device 230: Input device 240: Authentication input device 300: IC card 310: Control unit 320: Memory 321: Cash card service application 322: Resident card issuance service application 400, 900: Representative identification data / authentication method correspondence list 410: Finger vein authentication application 420: PIN authentication application 610, 620: Representative identification data / approval information correspondence list 500, 1000: Identification data list

Claims (8)

In a system in which a user can receive services from a plurality of service providing devices that provide a plurality of services using a medium,
A plurality of service applications executed in association with a plurality of services, identification data for specifying a service used by the service application, and each service application are previously stored in the memory of the medium or the service providing apparatus. Individual identification is performed by a plurality of different authentication methods so that the selected service is provided to authorized users and representative identification data representing each group obtained by dividing the identification data into one or a plurality of groups. A plurality of authentication applications capable of authentication, authentication method identification data for identifying an authentication application associated with the representative identification data, personal authentication information having a format defined by each authentication method owned by the authentication application, and the authentication The authentication application owned by the application Authentication representatives identification data as the representative identification data and pairs to use said individual authentication information to the authentication by stores the,
By executing the CPU of the medium or the service providing apparatus,
When a user chooses to use a service, the authenticating side representative identification is made using the means for identifying the authentication application based on the authentication method identification data and the representative identification data of the group to which the identification data for identifying the selected service belongs. A means for collating with data, and personal authentication information related to successful authenticating side representative identification data as a result of collation by the collating means is specified, and the specified authentication application is executed to authenticate the user. Authentication means, and
An authentication management system, wherein, as a result of user authentication by the authentication means, if successful, the selected service application is executed to allow service provision. In a system in which a user can receive services from a plurality of service providing devices that provide a plurality of services using a medium,
The medium has a control unit including a memory for storing information and a CPU for processing information,
The memory includes a plurality of service applications executed in association with a plurality of services, identification data for specifying services used by the service applications, and one or a plurality of identification data owned by each service application. Representative identification data representing each group divided into groups, and a plurality of authentication applications capable of performing personal authentication by a plurality of different authentication methods so that a selected service is provided to a legitimate user; According to authentication method identification data for identifying an authentication application associated with the representative identification data, personal authentication information having a format defined by each authentication method owned by the authentication application, and the authentication application owned by the authentication application Use the personal authentication information for authentication Storing authentication representatives identification data as the representative identification data and pairs with that, the,
The control unit executes the service application and the authentication application,
An authentication management system, wherein the service providing apparatus holds and executes at least one service application, and authenticates a user in cooperation with an authentication application of the medium. In a system in which a user can receive services from a plurality of service providing devices that provide a plurality of services using a medium,
The medium includes a control unit including a first memory for storing information and a first CPU for information processing. The first memory includes identification data for specifying a service used by the service application, and each service application. It is associated with the representative identification data so that the selected service is provided to the authorized user and the representative identification data representing each group obtained by dividing the identification data into one or a plurality of groups. Authentication method identification data for identifying an authentication application, personal authentication information having a format defined by each authentication method owned by the authentication application, and the personal authentication information used for authentication by the authentication application owned by the authentication application Then, the representative identification data paired with the representative identification data is stored,
The service providing apparatus includes a second memory for storing information and a second CPU for processing information. The second memory includes a plurality of service applications executed in association with a plurality of services and an authorized user. An authentication application capable of performing personal authentication by a plurality of different authentication methods so that the selected service is provided, and the service providing apparatus stores the data stored in the memory of the medium And an information management system, wherein the second CPU executes the service application and the authentication application to authenticate a user. 4. The system according to claim 1, wherein a unique code for specifying the service application and the identification data group is used as representative identification data representing each group. In the authentication management method for a user himself / herself in a system in which a user can receive services from a plurality of service providing apparatuses that provide a plurality of services using a medium,
A plurality of service applications executed in association with a plurality of services, identification data for specifying a service used by the service application, and each service application are previously stored in the memory of the medium or the service providing apparatus. Individual identification is performed by a plurality of different authentication methods so that the selected service is provided to authorized users and representative identification data representing each group obtained by dividing the identification data into one or a plurality of groups. A plurality of authentication applications capable of authentication, authentication method identification data for identifying an authentication application associated with the representative identification data, personal authentication information having a format defined by each authentication method owned by the authentication application, and the authentication The authentication application owned by the application Comprising the steps of: providing the stored authentication representatives identification data to be representative identification data and pairs to use said individual authentication information to the authentication, a due,
Identifying an authentication application with the authentication method identification data when the user selects to use a service;
Collating with the authenticating representative identification data using the representative identification data of the group to which the identification data specifying the selected service belongs as a key;
Identifying personal authentication information associated with successful authenticating representative identification data as a result of the verification; and
And a step of permitting the provision of the service of the selected service application when the authentication of the user by the authentication application is successful. 6. The authentication management method according to claim 5, wherein when the user authentication is successful, the use is permitted for the service of the service application specified by the one or more identification data belonging to the representative identification data used for the authentication. The service application specified by one or a plurality of identification data belonging to each representative identification data paired with one or a plurality of authenticating side representative identification data associated with the personal authentication information used for the authentication when the user is successfully authenticated 6. The authentication management method according to claim 5, wherein use of the service is permitted. If the user is successfully authenticated, one or more identifications belonging to each representative identification data paired with one or more authenticating representative identification data associated with one or more personal authentication information owned by the authentication application 6. The authentication management method according to claim 5, wherein use of the service application specified by the data is permitted.

Images