JP2013174955A - Information processor for which input of information for releasing security is requested and login method - Google Patents

Abstract

Provided is an information processing apparatus capable of more easily inputting login information (information for releasing security) while ensuring high security.
An information processing apparatus (10) includes a non-biological information authentication unit (23, 19) that performs authentication using non-biological information, and a first that performs authentication using first biometric information of a user. Authentication is performed by the biometric authentication unit (21, 19), the second biometric authentication unit (25, 19) that performs authentication using the second biometric information of the user, and the first biometric authentication unit, After that, authentication is performed by the non-biometric information authentication unit and the second biometric authentication unit, and when authentication by all the authentication units is successful, a login control unit (19) that permits login without requesting password input; .
[Selection] Figure 1

Description

  The present invention relates to an information processing apparatus that inputs information for releasing security.

  2. Description of the Related Art Conventionally, in an information processing apparatus such as a personal computer, information for authenticating whether or not the user of the information processing terminal is a valid user at the time of activation from the viewpoint of security (hereinafter referred to as “authentication information”). There is a thing which requires the input of (refer patent document 1). In such an information processing apparatus, when the user is authenticated as a valid user, the user can log in to the information processing terminal, and the information processing apparatus can be used.

  As the authentication information, a user ID and a password (text) are generally used, but in recent years, biometric information such as a fingerprint, an iris, and a vein pattern has been used as the authentication information (see Patent Document 2). There is also authentication using an IC card in which an IC tag storing identification information is embedded.

JP-A-5-88771 JP 2010-9513 A

  If the user ID and password as authentication information are known to others, there is a problem that they are used by others. If a plurality of authentications are executed in order to strengthen security, the user needs to input authentication information for each authentication, and the login operation becomes complicated and the convenience of the user is impaired.

  The present invention has been made to solve the above-mentioned problems, and the purpose of the present invention is to enable easy input of login information (information for releasing security) while ensuring high security. An information processing apparatus is provided.

  The information processing apparatus according to the present invention is an information processing apparatus that requires input of information for releasing security. The information processing apparatus includes a non-biometric information authentication unit that performs authentication using non-biological information, a first biometric authentication unit that performs authentication using the first biometric information of the user, and a second biometric unit of the user. A second biometric authentication unit that performs authentication using information, and first performs authentication by the first biometric authentication unit, and then performs authentication by the non-biometric information authentication unit and the second biometric authentication unit. A login control unit that permits login without requesting password input when authentication by the authentication unit is successful.

  The login method according to the present invention is a login method for an information processing apparatus that requires input of information for releasing security. The login method includes a step of obtaining non-biological information, a step of obtaining first biometric information of the user, a step of obtaining second biometric information of the user, and first using the non-biological information. The authentication process using the first biometric information, the authentication process using the second biometric information, and the authentication process using all the three authentication processes. Allowing login without requiring input.

  According to the present invention, a plurality of authentications are performed using two pieces of biometric information and one piece of non-biometric information, and this can more securely prevent “spoofing” by others. Here, when each authentication using two pieces of biometric information and one piece of non-biological information is successful, the user can log in to the OS without performing a special operation for login. Therefore, it is possible to simplify the login operation while preventing “spoofing” more firmly, and to improve the convenience for the user.

The figure which showed the structure of the information processing apparatus which concerns on one Embodiment Flowchart of login process in information processing apparatus according to one embodiment The flowchart which shows the authentication process by non-biometric information and the authentication process by biometric information regularly implemented after the login process which concerns on one Embodiment

  Hereinafter, the configuration and operation of an information processing apparatus according to an embodiment will be described with reference to the drawings.

1. Configuration FIG. 1 is a diagram illustrating a configuration of an information processing apparatus according to the present embodiment. The information processing apparatus 10 includes a display unit 11 for displaying various information, an operation unit 13 for a user to input various information to the information processing apparatus 10, a program necessary for controlling the information processing apparatus 10, and the like. A data storage unit 15 to be stored, an external interface unit 17 for the information processing device 10 to communicate with an external device, and a controller 19 for controlling the entire information processing device 10 are provided.

  The display unit 11 can be composed of a liquid crystal panel, an organic EL, or the like. In the present embodiment, the display unit 11 is provided in the information processing apparatus 10, but may be provided outside the information processing apparatus 10 as an external connection device.

  The operation unit 13 is a device that gives instructions to the information processing apparatus by a user such as a keyboard and a mouse. The operation unit 13 may be a touch panel provided on the display unit 11. Alternatively, the operation unit 13 may be a device that reads a movement (gesture) of a part or the whole of the user's body. In this case, the operation unit 13 may include an imaging unit that images the user, and may identify the movement by analyzing the captured image. Alternatively, the operation unit 13 may be a sensor that detects the movement of the user.

  The data storage unit 15 is a recording medium for storing data and control programs. The data storage unit 15 also stores information such as IDs and passwords necessary for login processing. The data storage unit 15 is a semiconductor storage device such as a hard disk drive (HDD) or a flash memory. The data storage unit 15 may include a recording medium such as an optical disk. The data storage unit 15 may be provided outside the information processing apparatus 10. For example, a server on the network may be used as the data storage unit 15 (cloud computing).

  The external interface unit 17 enables connection of an external device to the information processing apparatus 10 and exchanges data between the information processing apparatus 10 and the external device. The external interface unit 17 performs communication in accordance with a predetermined interface standard such as USB or HDMI. Alternatively, the external interface unit 17 may perform communication based on a wireless communication standard such as WiFi or IEEE 802.11.

  The controller 19 is a CPU or MPU, and implements various functions to be described later by executing a program stored in the data storage unit 15.

  The information processing apparatus 10 according to the present embodiment further includes a fingerprint reading unit 21, an RFID reading unit 23, and an imaging unit 25.

  The fingerprint reading unit 21 is a device that reads fingerprint information of a human finger. The fingerprint reading unit 21 is provided on the power switch 21s. That is, when the user touches the power switch 21s to press the power switch 21s, the fingerprint reading unit 21 can read the fingerprint information at the same time. The fingerprint reading unit 21 transmits the read fingerprint information to the controller 19. The controller 19 determines whether or not the received fingerprint information matches the fingerprint information registered as reference information in advance. The fingerprint reading unit 21 may be provided at a location different from the power switch.

  The RFID reading unit 23 is a device that reads identification information of an IC tag embedded in an IC card or the like within a predetermined range by radio (that is, non-contact). The RFID reading unit 23 transmits the read identification information to the controller 19. The controller 19 determines whether or not the received identification information matches the identification information registered as reference information in advance.

  The imaging unit 25 captures an image and transmits the captured image data to the controller 19. The controller 19 detects a face image from the received image, and determines whether or not the detected face image matches a face image registered in advance as reference information.

2. Login Process A login process when the information processing apparatus 10 having the above configuration is turned on will be described. In the login process of the information processing apparatus 10, a plurality of authentications are executed. In these plural authentication processes, two pieces of biological information and one piece of non-biological information are used. Specifically, first, authentication with respect to the BIOS (first authentication) is performed, and then two authentications with respect to the OS (second and third authentication) are performed. In the authentication for the first BIOS, biometric information is used as the authentication information input as the BIOS ID. In this example, fingerprint information is used. For this reason, in the information processing apparatus 10, fingerprint information of a valid user is registered in advance as a BIOS ID. In the two authentications for the OS, non-biological information and biometric information are used as LOGIN IDs. In this example, identification information stored in the IC tag as non-biological information and facial image information as biological information are used. These pieces of information are also registered in advance in the information processing apparatus 10 as LOGIN IDs.

  Hereinafter, a login process when the information processing apparatus 10 is turned on will be described with reference to the flowchart of FIG.

  In FIG. 2, when the user presses the power button 21s, the information processing apparatus 10 is turned on (S1). At this time, the fingerprint reading unit 21 reads fingerprint information from the user's finger placed on the power button 21s. For this reason, the fingerprint is read without the user's knowledge.

  When the fingerprint reading unit 21 reads the user's fingerprint information, the fingerprint reading unit 21 transmits the fingerprint information to the controller 19. The controller 19 receives the fingerprint information as the BIOS ID and compares it with the fingerprint information registered as the BIOS ID in advance (S2). If the fingerprint information matches (YES in S2), the controller 19 activates the BIOS (S5). On the other hand, if the fingerprint information does not match, that is, if it does not match the registered BIOS ID (NO in S2), the controller 19 displays a screen for inputting the BIOS password and waits for the user to input the BIOS password ( S3). When the correct BIOS password is input (S4), the BIOS is activated (S5).

  In this way, by using the fingerprint information for the first authentication (S2) after the power is turned on, the fingerprint information is also read at the same time when the user performs an operation on the power switch. It can be improved.

  When the BIOS is activated, the RFID reading unit 23 is activated (S6), and the imaging unit 25 is activated for person recognition (S7). Thus, only the fingerprint reading unit 21 with relatively low power consumption is activated first, and the RFID reading unit 23 and the imaging unit 25 are activated after the BIOS activation, so that power saving can be realized.

  Next, authentication for logging in to the OS is performed. As described above, in this embodiment, two-step authentication is performed as authentication for the OS. First, authentication (second authentication) using non-biological information is performed. Specifically, authentication is performed using identification information of the IC tag as non-biological information (S8). In this example, it is assumed that the user owns an IC card containing an IC tag storing identification information. When the user's IC card is within a predetermined range from the RFID reading unit 23, the RFID reading unit 23 reads the identification information of the IC tag inside the IC card, and transmits the read identification information to the controller 19. The controller 19 determines whether or not the read identification information is equal to the LOGIN ID (S8).

  If the identification information of the IC tag matches the LOGIN ID, the controller 19 subsequently performs authentication (third authentication) using biometric information. Specifically, authentication by person recognition based on the image of the user imaged by the imaging unit 25 is performed (S9). In the present embodiment, face recognition is performed based on the captured image as person recognition. As a result of the face recognition, when authentication is successful, that is, when both authentication by IC tag and authentication by face information are successful (YES in S9), the controller 19 exempts the user from entering the LOGIN password, Login to the OS is permitted for the user (S12). That is, processing for logging in the user is executed. In this case, the user can log in to the information processing apparatus 10 without inputting any information for logging in, and the login operation can be simplified. In the present embodiment, face recognition is used as person recognition. Instead, a specific person may be recognized using other biological information, for example, an iris of a human eye or a vein pattern of a finger. Good.

  On the other hand, when the authentication fails as a result of face recognition (person recognition) (NO in S9), the controller 19 displays a LOGIN password input screen and requests the user to input the LOGIN password (S10). ). When a valid LOGIN password is input by the user (YES in S11), the controller 19 permits login to the OS (S12). That is, the user is logged in. When the input of the LOGIN password has failed a predetermined number of times, this process is forcibly terminated.

  After the login process, the user can use the information processing apparatus 10. Thereafter, the controller 19 repeats the processes of steps S8 to S11 every predetermined time after permitting login to the OS. That is, authentication (S8) using non-biological information and authentication (S9) using biometric information are executed at regular intervals. Hereinafter, this process executed after login will be described with reference to the flowchart of FIG. Note that the contents of the processes in steps S22 to S25 in the flowchart of FIG. 3 are substantially the same as the contents of the processes in steps S8 to S11 in the flowchart of FIG.

  As shown in FIG. 3, the controller 19 performs authentication with non-biological information (S22) and authentication with biometric information (S23) after a certain period of time has elapsed after permitting login. When any authentication is successful, or when a valid login password is input by the user (YES in S25), the login state is maintained. However, if any authentication fails and a valid login password is not input by the user (NO in S25), the controller 19 executes a logoff process (S26).

  As described above, by performing the authentication process periodically after login, even if the user's situation changes after login, the use of the information processing apparatus 10 by an unauthorized user can be prevented and security is ensured. it can. For example, if a legitimate user moves away from a predetermined range from the information processing apparatus 10 together with the IC card in which the IC tag is embedded after the login, the authentication based on the identification information of the IC tag cannot be cleared. For this reason, it is possible to prevent another person from impersonating a legitimate user and using the information processing apparatus 10 while the legitimate user is absent. Alternatively, when an unauthorized user uses the information processing apparatus 10 instead of a legitimate user after logging in, the unauthorized user may be a person by the imaging unit 25 even if he / she possesses another person's legitimate IC card. Since recognition (face recognition) cannot be cleared, unauthorized use by an unauthorized user can be prevented.

  In the above embodiment, the fingerprint reading unit 21, the RFID reading unit 23, and the imaging unit 25 are built in the information processing apparatus 10, but each may be an external device to the information processing apparatus 10, respectively. The controller 19 may be controlled by a different controller.

  Moreover, in the said embodiment, although the IC card was mentioned as an example as an article | item incorporating an IC tag, if it is a thing incorporating an IC tag, it will not be limited to an IC card. Other devices may be used instead of the IC tag. For example, any device can be used as long as it has unique identification information and can read the identification information from the outside in a non-contact manner. For example, a smartphone or the like can also be used for authentication (S9) based on non-biological information.

  Moreover, in the said embodiment, although authentication was performed in the order of the authentication by 1st biometric information, the authentication by non-biometric information, and the authentication by 2nd biometric information, the order of these three authentications may be another order.

  In the above embodiment, the reference information (fingerprint information, IC tag identification information, face information) used in each of the authentication using the first biological information, the authentication using the non-biological information, and the authentication using the second biological information is as follows. These are registered in association with each other as information unique to one user (individual). Here, a plurality of reference information (IC tag identification information) for authentication using non-biological information may be registered for one user. Further, reference information (IC tag identification information) in authentication based on non-biological information may be shared by a plurality of users (for example, persons belonging to the same group).

3. Summary The information processing apparatus (10) of the present embodiment includes a non-biological information authentication unit (RFID reading unit 23 and controller 19) that performs authentication using non-biological information (IC tag), and user fingerprint information (first information). The first biometric information authentication unit (fingerprint reading unit 21 and controller 19) that performs authentication using the biometric information of the user and the second biometric that performs authentication using the user's face information (second biometric information). Authentication with the information authentication unit (imaging unit 25 and controller 19) is first performed with fingerprint authentication, and then authentication with IC tag and face information is performed. If all authentication is successful, no password input is requested. And a controller 19 that permits login.

  In this way, a plurality of authentications are performed using two pieces of biological information and one piece of non-biological information, thereby making it possible to more firmly prevent “spoofing” by others. Here, when each authentication using two pieces of biometric information and one piece of non-biological information is successful, the user can log in to the OS without performing a special operation for login. Therefore, it is possible to simplify the login operation while preventing “spoofing” more firmly, and to improve the convenience for the user.

  In addition, it is preferable that the biometric authentication first performed after the information processing apparatus 10 is turned on is authentication using fingerprint information. This is because when the power is turned on, the power switch is operated by a finger, and the fingerprint is read immediately after that, so that the user can perform a series of operations from the power-on operation or the power-on operation (natural operation). This is because the fingerprint can be read in the operation), and authentication is performed with a natural movement for the user.

  Further, the information processing apparatus 10 periodically authenticates with the second biological information (face recognition) and non-biological information (IC tag) even after login (S13, S8, S9). Thereby, even after a valid login, it is possible to prevent impersonation of another person more reliably.

  The present embodiment is applicable to information processing apparatuses and security systems that require user authentication, such as personal computers, workstations, and smartphones.

DESCRIPTION OF SYMBOLS 10 Information processing apparatus 11 Display part 13 Operation part 15 Data storage part 17 External interface part 19 Controller 21 Fingerprint reading part 23 RFID reading part 25 Imaging part

Claims (9)

An information processing apparatus that requires input of information for releasing security,
A non-biological information authentication unit that performs authentication using non-biological information;
A first biometric authentication unit that performs authentication using the first biometric information of the user;
A second biometric authentication unit that performs authentication using the second biometric information of the user;
First, authentication by the first biometric authentication unit is performed, and then authentication by the non-biometric information authentication unit and the second biometric authentication unit is performed. A login controller that allows login without requiring input; and
An information processing apparatus comprising:   The information processing apparatus according to claim 1, wherein after the authentication by the first biometric authentication unit, authentication by the non-biometric information authentication unit is performed before authentication by the second biometric authentication unit. The login control unit
When the authentication by the first biometric authentication unit is successful, the BIOS is allowed to start,
The authentication is then performed by the non-biometric information authentication unit and the second biometric authentication unit, and login is permitted when the authentication by the non-biological information authentication unit and the second biometric authentication unit is successful. The information processing apparatus described.   The information processing apparatus according to claim 1, wherein the login control unit requests input of a BIOS password when authentication by the first biometric authentication unit fails.   The information processing apparatus according to claim 3, wherein authentication by the non-biometric information authentication unit and the second biometric authentication unit is periodically performed after login permission.   The information processing apparatus according to claim 1, wherein the first biometric authentication unit performs authentication using information related to a human fingerprint.   The information processing apparatus according to claim 1, wherein the second biometric authentication unit performs authentication using information related to a human face.   The information processing apparatus according to claim 1, wherein the non-biological information authentication unit is a non-contact type authentication apparatus. A method of logging in to an information processing apparatus that requires input of information for releasing security,
Obtaining non-biological information;
Obtaining first biometric information of the user;
Obtaining second biometric information of the user;
First, performing an authentication process using the non-biometric information, and then performing an authentication process using the first biometric information and an authentication process using the second biometric information;
If authentication is successful in all three authentication processes, allowing login without requiring the password input;
Login method including:

Images