JP2016071598A - Authentication device, authentication system, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication device capable of verifying the identity of a user by a simple operation that makes the user feel no stress, and further, authenticating by the user or a password to be used or a value of biological information, arbitrarily setting an external instrument serving as an operational object, and realizing an authentication method having safety property and convenience.SOLUTION: When detecting that an authentication device 100 is worn by a user, the authentication device carries out authentication only once, by biological information or a password and transmits authentication information to an external instrument continuously while the authentication device is worn. The external instrument to serve as a transmitting object of the authentication information is selected as needed, by the biological information or the password detected when the device is worn or at the authentication.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a wearable personal authentication device, and in particular, determines whether the device is attached or detached using biometric information of the user, etc., and then authenticates the user using authentication information such as a password, according to the authentication result. The present invention relates to an authentication device, an authentication system, and a program for controlling the operation of a predetermined external device.

  In recent years, when using mobile terminals such as mobile phones, notebook PCs (Personal Computers) and tablet PCs, and devices such as multi-function printers, and entering and exiting offices and opening lockers and storages In some cases, an operation terminal for opening a door is provided to ensure security.

  Conventionally, as an authentication method for these, each time of authentication, a method of inputting a pre-registered password or an authentication device such as an ID card storing an ID for uniquely identifying the user is possessed by the user, A method is employed in which authentication is performed by reading an ID stored in the ID card with a card information reading device or the like and comparing the read ID with a pre-registered ID. Here, when the authentication is performed, an operation on the external device is performed such that the device managed by the authenticated management terminal can be used, or the door is opened for entering and leaving the room. Further, for example, in a single organization, it is possible to use a plurality of devices in the organization and open a plurality of doors using the same ID card or the like.

  However, in the authentication method using a password or ID card as described above, if a third party obtains the password or ID card by some means, there is a possibility that various authentication operations may be performed illegally by impersonating a legitimate user. is there. In addition, in the authentication method using a specific password or ID card, only one or a plurality of specified devices can be operated.

  In addition, for example, when an authentication procedure is performed every time authentication is required, for example, when the use of a security-managed device or the frequency of entering or leaving a room is high, it may be annoying.

  On the other hand, a method is known in which authentication can be performed with a simple procedure while the user is continuously wearing the authentication terminal. Patent Document 1 describes a mobile authentication terminal that continues to transmit identification information when the mobile authentication terminal is continuously mounted after the apparatus is activated. In addition, regarding unauthorized use against third parties, the biometric information of users such as fingerprints, irises, vein patterns, and pulse waves is used as an authentication method that is unique and highly convenient, and is less likely to be illegally exercised due to loss or theft. A method used for authentication is known. Patent Document 2 discloses a biometric authentication device that identifies an individual by imaging a vein pattern of a living body. Patent Document 3 discloses a pulse wave sensor that can accurately measure a pulse wave not only at rest but also during exercise.

Japanese Patent No. 5330770 JP 2012-245083 A International Publication WO2014 / 007210

  In the portable authentication terminal of Patent Document 1 described above, authentication can be performed with an easy procedure while the authentication terminal is continuously mounted, but the authentication method using the ID card described in the background art above is the same. In addition, only the specified external device can be operated. Moreover, even if the user's biometric information is used as an authentication method as described in Patent Documents 2 and 3, there is a merit against unauthorized use by a third party, but the external devices to be operated are similarly limited in advance. There was a problem.

  The present invention has been made in order to solve the above-described problems, and can detect that the apparatus is mounted with a simple procedure that does not cause the user to feel stress. Further, the user can input a password or biometric information. It is an object of the present invention to provide an authentication apparatus that realizes an authentication method having safety and convenience that authenticates a user by a value such as and controls the operation of a predetermined external device according to an authentication result by authentication. To do.

The first invention of the present application for achieving the above object is an authentication device,
Storage means for storing authentication information for permitting authentication;
Attaching / detaching detecting means for detecting biological information and determining a wearing state;
A first authentication unit that authenticates a user with reference to the storage unit when biometric information is detected by the attachment / detachment detection unit;
And an authentication control unit that controls a predetermined operation in accordance with an authentication result by the authentication unit. Note that the biological information described here includes information such as pressure, temperature, and shape change caused by contact between the human body and the detection device.

  In the authentication apparatus of the first invention, the authentication control means may include external device operation means for connecting to an external device. By doing so, it is possible to control the operation of a predetermined external device according to the authentication result.

In the authentication device of the first invention, the external device operating means is
You may make it provide the 2nd authentication means different from the authentication by the said 1st authentication means. By doing so, for example, when performing a specific operation such as an operation involving payment or when operating a specific device, higher security can be obtained by separately requesting authentication from the user.

  The authentication device according to the first aspect of the present invention may stop the operation of the external device operating means when detecting that the attaching / detaching detecting means has removed the authentication apparatus. By doing so, the initial user authentication is continued until it is detected that the authentication device has been removed, and during this time, a predetermined operation on the external device can be continuously performed.

The attachment / detachment detection means in the authentication device of the first invention comprises:
A pulse wave sensor may be included.

The authentication means
Authentication may be performed based on the pulse wave detected by the pulse wave sensor. In this case, the pulse wave sensor is used for both attachment / detachment detection means and authentication means.

Further, the attachment / detachment detection means includes
It may be detected using two or more sensors to determine that the authentication device is attached or removed.

In addition, the sensor
You may make it detect at least 1 of the change of a shape, temperature, and the contact to a human body.

Further, the attachment / detachment detection means includes
You may make it provide the imaging means to image the circumference | surroundings.

The imaging means includes
A vein may be detected from the captured image, and authentication may be performed based on the vein pattern.

The imaging means includes
The eyes may be detected from the captured image, and authentication may be performed based on the iris pattern.

The authentication information is:
It may be a password and / or personal information data. Here, the password is data such as a character string registered in advance for uniquely identifying the user, and the personal information data is biometric information or biometric information such as a fingerprint, an iris, a vein pattern, or a pulse wave. Such features are accumulated for each user.

The authentication means includes
Fingerprint authentication may be used.

The second invention of the present application is
Attaching / detaching detecting means for detecting biological information and determining a wearing state;
Biometric information transmitting means for transmitting the biometric information to the outside;
An authentication result receiving means for receiving the authentication result;
Authentication control means for controlling a predetermined operation according to a reception result by the receiving means;
An authentication device comprising: an external device operating means for connecting to an external device by the authentication control means;
Storage means for storing authentication information for permitting authentication;
Biometric information receiving means for receiving the biometric information;
First authentication means for authenticating a user with reference to the storage means;
An authentication system comprising: an authentication server including an authentication result transmitting unit configured to transmit an authentication result obtained by the first authentication unit.

The third invention of the present application is
A computer device used by a user is a program that causes a computer to execute the authentication device according to any one of the first invention and the second invention.

  According to the present invention, it is possible to prove the identity by a simple operation that does not cause the user to feel stress, and the user is authenticated by the user or the value of a password or biometric information to be used. It is possible to provide an authentication apparatus that realizes an authentication method that can specify the type of external device and has safety and convenience.

It is a figure explaining the outline | summary of the whole in this embodiment. 2 is a block diagram illustrating an authentication device 100. FIG. 2 is a diagram illustrating a hardware configuration of an authentication device 100. FIG. It is a figure for demonstrating the outline | summary of the flow of a process of this embodiment. It is a figure explaining an example of composition of personal information database DB1. It is a figure explaining an example of composition of external equipment database DB2. It is a figure explaining attachment / detachment detection processing S40. It is a figure explaining authentication processing S50. It is a figure explaining authentication control processing S60. It is a figure explaining external apparatus operation processing S70. It is a block diagram explaining the authentication system of this invention 2nd invention.

  First, the form for implementing 1st invention of this application is demonstrated, referring a figure. This is merely an example, and the technical scope of the present invention is not limited to this. FIG. 1 is a diagram for explaining the overall outline of the present embodiment. The authentication device 100 is a wearable personal authentication device that is detachably attached to a user's body, and includes an attachment / detachment detection device 111 that detects whether or not the user is attached and an authentication device 112 that performs personal authentication of the user. And a function of operating an external device. In this example, when personal authentication is successful, the notebook PC 500, which is an external device requiring authentication, is operated by performing short-range wireless communication with the automatic door 600 so that the notebook PC 500 can be used. The door 600 is encouraged to open.

  Next, the authentication device 100 will be described. FIG. 2 is a block diagram for explaining the authentication device 100. In order to implement the present embodiment, the authentication device 100 evaluates the attachment / detachment detection signal from the storage unit 130 that stores authentication information for permitting authentication and the attachment / detachment detection device 111, and the user wears the authentication device. Detachment detecting means 140 for detecting a physiological state from information on the user's human body and the user's human body information, and an authentication for performing personal authentication of the user from a detachment detection signal received by the detachment detecting means 140, a password and fingerprint information input by the user, etc. When personal authentication is performed by the means 150 and the authentication means 150, an authentication control means 160 that controls a predetermined operation according to the authentication result, an external device operation means 170 that operates a predetermined external device according to the authentication result, When the attachment / detachment detection signal is biometric information data, the biometric information data for each individual and the password are referred to when the evaluation is performed. Personal information database DB1 that stores an authentication key to be transmitted to the external device, an external device that stores the external device that is a target for selecting the external device to be operated and stores information necessary for connection to the external device A device database DB2, a transmission / reception unit 110 that performs transmission / reception via short-range wireless communication with an external device, and a control unit 120 that integrally controls these units are provided. In addition, the personal information database DB1 and the external device database DB2 are not necessarily provided in the authentication apparatus 100. For example, both or one of the databases is provided in the external server 810 connected to the network 800. It may be. In this case, when the authentication apparatus 100 needs information in these databases, the control unit 120 uses the transmission / reception unit 110 to obtain information from the external server 810 via the network 800. For convenience, in the following description, an example in which the personal information database DB1 and the external device database DB2 are inside the authentication apparatus 100 will be described.

  The above-described authentication control unit 160 may select an external device to be controlled, for example, depending on the physiological state of the user detected by the attachment / detachment detection unit 140 when the authentication unit 150 performs personal authentication. Thus, the external device operating means 170 can operate different external devices depending on the physiological state of the user. The physiological state of the user includes the detected time and place. The authentication unit 150 is also referred to as a first authentication unit. However, when an operation requiring higher security is performed, a second authentication unit according to the authentication unit 150 is used subsequent to the first authentication unit. You can also.

  FIG. 3 is a diagram illustrating a hardware configuration of the authentication device 100. The authentication device 100 is a single computer system as hardware, and includes a control unit 101, a storage unit 102, a peripheral device I / F unit 103, an input unit 104, a display unit 105, and a communication unit 106, which are connected to a bus 109. Connected through. Note that the hardware configuration in FIG. 2 is merely an example, and various configurations can be adopted depending on purposes.

  The control unit 101 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The CPU calls a program stored in the storage unit 102, ROM, recording medium, etc. to a work memory area on the RAM, executes it, and drives the devices connected via the bus 109 to perform processing performed by the computer. Realize. The ROM is a non-volatile memory, and permanently stores a program such as a boot program and BIOS of the authentication device 100, data, and the like. The RAM is a volatile memory, temporarily stores programs, data, and the like loaded from the storage unit 102, ROM, recording medium, and the like, and is used as a work area used by the control unit 101 to perform various processes. be able to.

  The storage unit 102 is a storage medium such as an HDD (hard disk drive) or a flash memory, and stores a program executed by the control unit 101, data necessary for program execution, an OS (operating system), and the like. Regarding programs, a control program corresponding to an OS (operating system), a program code that functions as the storage unit 130, a program code that functions as the attachment / detachment detection unit 140, a program code that functions as the authentication unit 150, and a function as the authentication control unit 160 And a program code that functions as the external device operating means 170 are stored. These program codes are read by the control unit 101 as necessary, transferred to the RAM, and read and executed by the CPU to execute various functions in cooperation with the hardware described above.

  The peripheral device I / F unit 103 is a port for connecting a peripheral device to the authentication apparatus 100, and the computer is connected to peripheral devices such as the attachment / detachment detection device 111 and the authentication device 112 via the peripheral device I / F unit 103. Send and receive data.

  The input unit 104 inputs data and includes an input device such as a touch panel or a keyboard. A password can be input to the authentication apparatus 100 via the input unit 104. The display unit 105 is a display device such as a liquid crystal panel or a display device such as an LED.

  The communication unit 106 includes a communication control device, a communication port, and the like, and is a wired or wireless communication interface that mediates communication between the authentication device 100 and an external device. One is via short-range wireless communication, While performing communication control between other computers, the other performs communication control between other computers via the network 800. Here, examples of short-range wireless communication include Bluetooth (registered trademark), NFC (Near Field Communication), and Wi-Fi (registered trademark). The bus 109 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

  Next, the flow of the whole form for implementing 1st invention of this application is demonstrated. FIG. 4 is a diagram for explaining the outline of the processing flow of the present embodiment.

  First, when the authentication apparatus 100 is turned on, each hardware of the authentication apparatus 100 is started, and the control unit 120 is activated following a control program corresponding to the OS. Subsequently, the control unit 120 activates the attachment / detachment detection unit 140, and the attachment / detachment detection process S40 is executed. If the power is cut off during the attachment / detachment detection process S40, the process proceeds to an end process S90, and the authentication apparatus ends the process (details will be described later).

  In the attachment / detachment detection processing S40, preferably, attachment / detachment determination S43 by the attachment / detachment detection device is performed periodically at an appropriate time. Here, if the attachment / detachment determination is the same as the previous determination, it is determined as “continuation of state”, and the process returns to the attachment / detachment detection processing S40 (left arrow). That is, the attachment / detachment determination is performed again after an appropriate time. At this time, there is no change in the state of the authentication device 100. In addition, in the attachment / detachment detection process S40, biometric information may be detected at the same time depending on the type of attachment / detachment detection device. In this case, in order to collate the detected data (attachment / detachment detection signal), the storage means 130 is referred to and acquired from the personal information database DB1.

  When the attachment / detachment determination is changed from the “detached state” to the “attached state” by the attachment / detachment determination S43, it is determined as “attached”, and the control unit 120 activates the authentication unit 150 and performs authentication processing S50. Is executed (down arrow). When authenticating a user, a user input password or an attachment / detachment detection signal in the attachment / detachment determination is compared with data in the personal information database DB1 obtained by referring to the storage unit 130, and user authentication is performed based on the degree of data match. (S43). Here, when the user authentication determination is not authenticated by NG, the attachment / detachment determination returns to “removal” and then returns to the attachment / detachment detection process S40 (“NG” arrow in the left direction).

  If the user authentication is determined to be OK, the control unit 120 activates the authentication control unit 160 and executes the authentication control process S60 (downward “OK” arrow). Here, the external device to be operated is selected according to the physiological state of the user from the biological information detected in the attachment / detachment determination. When selecting the external device to be operated, the external device database DB2 is referred to. Further, an authentication key such as a password required for accessing the external device is acquired from the personal information database DB1 with reference to the storage unit 130. Information on these selected external devices is stored in the storage unit 102 and transferred to the next processing.

  Next, the control unit 120 activates the external device operation unit 170, and the external device operation process S70 is executed. The external device operation process S70 is started once and continues to operate until the process according to "stop of external apparatus operation" is performed. The external device operating unit 170 identifies a predetermined external device as an operation target based on the information stored by the authentication control unit 160, and when receiving a signal from the predetermined external device, outputs a signal for operating the external device. Send.

  Subsequently, the control unit 120 activates the attachment / detachment detection unit 140 while the external device operation unit 170 is activated, and returns the process to the attachment / detachment detection process S40.

  When the attachment / detachment determination is changed from the “attached state” to the “removed state” by the attachment / detachment determination S43, it is determined as “detached”, and the external device operation stop processing S80 is executed by the control unit 120 (right Direction arrow). In this case, the attachment / detachment determination is returned to “removal”, and the user authentication is stopped and the external device operation processing S70 is stopped. Thereafter, the control unit 120 activates the attachment / detachment detection unit 140 again, and executes the attachment / detachment detection process S40. That is, it returns to the state immediately after the authentication device 100 is activated.

  FIG. 5 is a diagram for explaining an example of the configuration of the personal information database DB1. The personal information database DB1 stores data related to authentication of all users who handle the authentication apparatus 100. The personal information database DB1 stores data relating to two types of authentication as shown in FIG. One is an authentication key storage unit (see FIG. 5B) that stores user identification information (user IDs), authentication keys (passwords), and authentication levels of all users as one record. One is a biometric information storage unit (FIG. 5) that stores user identification information (user ID), specimen data that is biometric information for identifying an individual corresponding to a detection device, and an authentication level as one record. (See (c)). For example, if the detection device is a fingerprint image processing apparatus, feature data extracted from the corresponding fingerprint image is stored as sample data in the biometric information storage unit. The authentication level is an identifier that designates an external device group that can be operated by the authentication apparatus 100 when authenticated by the information of this record. In addition, the personal information database DB1 may store records for use in attachment / detachment detection, not for identifying an individual. In this record, the user ID is an identifier for “attachment / detachment detection”, and authentication is performed. The level is dummy data.

  FIG. 6 is a diagram for explaining an example of the configuration of the external device database DB2. The external device database DB2 stores data related to external devices that can be operated by the authentication apparatus 100. The external device database DB2 stores data relating to two types of external devices as shown in FIG. One is an operation that stores user identification information (user ID) and authentication levels of all users, and identifiers of external devices that can be operated at the authentication level (external device IDs, which may be plural) as one record. The possible device storage unit (see FIG. 6B), the other is an operation procedure storage that stores an operation procedure for transmitting an external device ID and a predetermined authentication key to the external device as one record. Part (see FIG. 6C). This operation procedure is used by the authentication apparatus 100 and is composed of descriptors such as a command sequence and a program.

  Next, details of the operation of the authentication device 100 according to the present embodiment will be described with examples. First, the attachment / detachment detection process S40, which is a program for realizing the attachment / detachment detection unit 140, will be described.

  FIG. 7 is a diagram for explaining the attachment / detachment detection processing S40. When the authentication device 100 is turned on (device activation), the control unit 101 activates a boot program, a program such as BIOS, and a control program corresponding to the OS and functions as the attachment / detachment detection unit 140. The attachment / detachment detection process S40 is loaded into the control unit 101 and activated.

  This attachment / detachment detection device 111 detects contact with a human body by detection by contact with an object made of a capacitive touch sensor or pressure sensor, or by a change in shape of the authentication device 100 main body or support medium made of an expansion sensor or bending sensor. Detects personal characteristics of the human body in contact with the human body, such as detection of time-series variations in pulse waves from detection devices and pulse wave sensors, and detection by imaging vein patterns or irises and fingerprint images using an imaging device. And a detection device that is mounted in contact with or close to the human body and detects attachment to the human body (whether or not the device is being worn). In addition, these detection devices may include a clock for measuring the detection time, and may further include a function for specifying the current location (such as a GPS (Global Positioning System) function-equipped device). Two or more sensors may be combined. For example, the above-mentioned Patent Document 1 gives an example in which a contact sensor configured by combining a temperature sensor and a pulse sensor is used as a contact sensor for detecting whether or not the device is attached to the person to be authenticated. In the present embodiment, description will be made assuming that a pulse wave sensor is used as the attachment / detachment detection device 111. It should be noted that the imaging means is appropriately activated when the imaging device captures a vein pattern or an image around an iris or fingerprint.

  In the attachment / detachment detection process S40, first, detection data is acquired from the attachment / detachment detection device 111 (S41). Here, since the attachment / detachment detection device 111 is a pulse wave sensor, the obtained data is data representing a dynamic change having a time axis.

  Next, the acquired detection data is collated (S42). When the detection data is detection by contact with an object or detection by change in shape of an object, the attachment / detachment is detected by ON / OFF or comparison with a threshold value, but contact and contact with a human body like the pulse wave sensor of this example. In the case of the detection device that detects the personal characteristics of the human body, the detection of contact with the human body and the data of the record stored in the biometric information storage unit of the personal information database DB1 are simultaneously performed with the detection of attachment / detachment. User characteristics may be detected. Here, if only attachment / detachment detection is performed, as described above, the sample data and the acquired detection of the record in which the user ID is for “attachment / detachment detection” and the detection device ID is “pulse wave sensor”. It is only necessary to collate the data and determine whether it is attached based on the similarity.

  In addition, when the user can be identified by collating the detection data, such as when there is a large amount of user biometric information for the detection data, it is not necessary to collate the record for which the user ID is “detachment detection”. You may make it collate with records other than for detection. At this time, the record may be stored at the same time as the attachment is determined, and the data may be delivered to the authentication process S50.

  Next, the attachment / detachment determination is performed based on the detection data collation (S42) and the flag value (S43). The flag stores which attachment / detachment has been determined in the immediately preceding attachment / detachment detection process. For example, if it is “0” for attachment and “1” for removal, it is set to “0” when the attachment / detachment detection device 111 is activated. When it is determined as “removed” in the collation (S42) of the detection data, the determination is “continuation of state” if the flag is “0”, and the determination is “removal” if the flag is “1”. Further, when it is determined as “attached” by collating the detection data, if the flag is “0”, the determination is “attached”, and if the flag is “1”, the determination is “continuation of state”.

  In this manner, the attachment / detachment detection process S40 determines attachment / detachment as described above with reference to FIG. 4, and proceeds to the next process according to each determination. If a power-off operation is performed during the attach / detach detection process S40, the authentication apparatus 100 moves the process to an end process S90 (details will be described later).

  FIG. 8 is a diagram for explaining the authentication process S50. When it is newly determined to be “attached” by the attachment / detachment determination S43 of the attachment / detachment detection process S40, the control unit 101 loads the authentication process S50, which is a program functioning as the authentication unit 150, from the storage unit 102 to the control unit 101. to start.

  The authentication process S50 acquires authentication data from the authentication device 112 (S51). In this example, since the same pulse wave sensor as the attachment / detachment detection device 111 is used for the authentication device 112, as described above, the authentication data used for authentication has already been acquired in the attachment / detachment detection processing S40. To do.

  Here, for example, when the attachment / detachment detection device 111 is a detection device that detects contact with a human body, or the attachment / detachment detection device 111 is a detection device that detects a personal characteristic of a human body that has come into contact with contact with a human body. If only the attachment / detachment is detected, a physical medium (graphic code such as a two-dimensional code, IC card or tag) in which a password or password is described or stored is obtained as authentication data from the authentication device 112 separately. When the authentication data is a physical medium describing or storing a password, a password, or the like as described above, when the authentication data is acquired (S51), it is decrypted into a character string (code string) depending on each decryption algorithm or device. This data and the authentication key stored in the authentication key storage unit of the personal information database DB1 obtained by referring to the storage means 130 are collated (S52), and if they match completely, the user is authenticated (S53).

  Further, for example, when the biometric information data is acquired by the detection device that detects the personal characteristics of the human body that has come into contact with the contact of the human body with the attachment / detachment detection device 111, signals and images that fluctuate in time series of the biometric information. The data (voice print, pulse wave, fingerprint, iris, vein pattern, etc.) is compared with the sample data stored in the biological information storage unit of the personal information database DB1 obtained by referring to the storage means 130 (S52). ), When the degree of matching is high (exceeding a certain threshold), it is determined that they match and the user is authenticated (S53).

  When a pulse wave sensor is used for the authentication device 112 as in this example, as described above, the obtained data is data representing a dynamic change having a time axis. This data is compared with the sample data stored in the biometric information storage unit of the personal information database DB1, and user authentication is performed. Thus, the attachment / detachment detection device 111 and the authentication device 112 may use the same device, or in the case where a plurality of detection devices are held, they may be used interchangeably.

  Here, biological information and sample data will be described. Patent Document 3 can measure not only when the subject is resting but also when exercising, attenuation of light due to biological tissue, venous blood (deoxygenated hemoglobin Hb), arterial blood (oxygenated hemoglobin HbO2), and its chronological transition, etc. A pulse wave sensor that can measure the state of tension (stress), fatigue, and drowsiness is presented by measuring each of these and applying various filters to these original pulse wave waveforms. If such a sphygmomanometer is used as the authentication device 112 and sample data of the user's various states (tension, fatigue, drowsiness) is accumulated using this sphygmomanometer, comparison is made. The accuracy of verification can be improved, and the content of the operation performed by the authentication device on the external device can be selected according to the user's state.

  Furthermore, if the sample data stored in the biometric information storage unit of the personal information database DB1 stores data related to time, the authentication device can be connected to an external device depending on the time by using the detection time in the biometric information. It is possible to select the content of the operation to be performed.

  Similarly, if the sample data stored in the biometric information storage unit of the personal information database DB1 stores data related to the current position information, authentication is performed according to the current position by using the current position information in the biometric information. It is possible to select the content of operations performed by the apparatus on external devices.

  Further, as in this example, when the attachment / detachment detection device 111 and the authentication device 112 are sensors that detect human body information including the same biological information, as described in the description of the attachment / detachment detection process, the detection data In comparison, it is possible to determine mounting by comparing with a record other than “attachment / detachment detection” stored in the biometric information storage unit of the personal information database DB1, and deliver the verified record to the authentication process S50. In this case, the authentication process S50 may omit the verification of verification data (S52).

  As described above, based on the verification result of the authentication data, if the authentication data is an authentication key, if there is a record having an authentication key that exactly matches, or if the authentication data is biometric information When there is a record having sample data deemed to have a predetermined similarity, authentication is performed for the user and the authentication level specified from the user ID. If the verification fails, authentication is not performed (S53).

  In this way, the authentication process S50 determines whether the user authentication has succeeded or failed as described above with reference to FIG. 4, and proceeds to the next process according to each determination.

  FIG. 9 is a diagram for explaining the authentication control process S60. When it is determined by the user authentication determination S53 of the authentication process S50 that the user authentication is successful, the control unit 101 controls the external unit operation process S70, which is a program functioning as the external apparatus operation unit 170, from the storage unit 102. Load and start.

  First, the authentication control process S60 acquires the user ID and the authentication level described in the record of the personal information database DB1 that has been successfully authenticated by the user authentication determination S53 of the previous authentication process S50, and can operate the external device database DB2. With reference to the record in the device storage unit, the external device to be operated is set, and the information is stored (S61). Thereafter, the process proceeds to the next external device operation process S70.

  FIG. 10 is a diagram for explaining the external device operation processing S70. When it is determined that the user authentication is successful by the setting S61 of the operation target device in the authentication control process S60, the control unit 101 executes the external device operation process S70 which is a program functioning as the external device operation unit 170 from the storage unit 102. Loaded into the control unit 101 and activated.

  As described above with reference to FIG. 4, the external device operation processing S70 is performed in the future when the external device operation stop S80 that is activated when the authentication device 100 is removed from the user in the future is performed. The apparatus 100 is continuously operated until the power is turned off and the termination process S90 is activated.

  First, the external device operation process S70 acquires and stores information on the operation target device stored in the operation target device setting S61 of the authentication control process S60 (S71).

  Here, the external device operation processing S70 is a device in which the external device to be operated is specified (this specification is described in the record of the operable device storage unit of the external device database DB2). The second authentication may be performed (the second password is requested and authenticated).

  Thereafter, the external device operation processing S70 periodically performs a process of receiving a signal from the external device (for example, once per second). In the signal reception from the external device, the authentication apparatus 100 receives the signal from the external device through the short-range wireless communication using the communication unit 106 via the transmission / reception unit 110 (S72).

  Here, when the signal from the external device is received, the external device operation processing S70 confirms whether or not the signal is from the operation target device as compared with the stored external device to be operated ( S73).

  If it is determined by this confirmation that the signal from the operation target device has been received, the external device operation processing S70 is acquired from the information on the operation target device storing the authentication key such as a password and the operation procedure of the external device, The operation signal is transmitted to the external device via the transmission / reception means 110 (S74).

  As described above, the personal device authentication data can be transmitted to the external device by the external device operation processing S70, and the external device can use the apparatus or open the door in accordance with the authentication data. It will be possible to open the door.

  Further, as described above, the external device operation process S70 periodically performs a process of continuously receiving a signal from the external apparatus. By doing so, it becomes possible to subsequently transmit an operation signal to the operation target device.

  Next, the external device operation stop process S80 will be described (not shown). As described above, the external device operation stop processing S80 is executed when the attachment / detachment determination S43 determines that the attachment / detachment determination is “detachment”. The flag of the attachment / detachment detection process S40 is returned to “0” indicating removal, and the data stored by the attachment / detachment detection process S40 and the authentication process S50 is erased, and the external device operation process is stopped. To do. Furthermore, after these are done, the process returns to the attachment / detachment detection process S40. That is, it returns to the state immediately after the authentication device 100 is activated.

  Finally, the termination process S90 will be described (not shown). The end process S90 is a process executed when the power is turned off during the attachment / detachment detection process S40. Here, “power is cut off” means that the supply of power is not actually stopped, but that the power switch has been turned off. In the termination process S90, the communication with the peripheral device and the communication with the external device in communication with the communication unit are normally cut off, the own storage unit is cleared, the computer is normally stopped, and the power supply is cut off. As a result, the authentication device 100 is in a state before activation.

  According to the first embodiment of the present invention, the authentication device 100 has the following effects. First, once the user installs the apparatus and the authentication is successful, the user can access the external device without inputting a password or presenting a card until the apparatus is removed. Furthermore, an external device that can be operated is selected consciously or unconsciously. For example, it is possible to control that a personal computer at work cannot be used outside working hours, or that the computer cannot enter a hazardous area if it is feverish. Since this device can be used continuously with a single authentication, it does not matter much even if the authentication load is a little (for example, if the number of digits in the password is large). Therefore, it is possible to easily use an authentication method that is not often used in public places, such as a fingerprint of a foot or voice, so that further improvement in security can be expected.

  Next, a mode for carrying out the authentication system of the second invention of the present application will be described with reference to the drawings. This is achieved by using the two devices for the same function as that of the first embodiment of the present invention. The personal information database DB1 and the external device database described in the description of FIG. 2 of the first embodiment. This is in accordance with an example in which DB2 is placed on an external server.

  FIG. 11 is a diagram illustrating an overview of the entire authentication system according to the present embodiment. Each of the authentication devices 100a and 700 is a computer system as hardware, and has a hardware configuration as described in the description of FIG.

  The authentication device 100a in the second embodiment of the present application is a wearable personal authentication device that is detachably attached to the user's body, and has the same function as the attachment / detachment detection means 140 in the first embodiment of the present invention. The attachment / detachment detection means 130a, the biological information transmission means 140a for transmitting the biological information detected by the attachment / detachment detection means 130a to the authentication server 700, the authentication result reception means 150a for receiving the authentication result received by the authentication means 750 of the authentication server 700, and the reception Authentication control means 160a for controlling a predetermined operation according to the authentication result, external device operation means 170a for operating a predetermined external device according to the authentication result, and transmission / reception with short distance wireless communication with the external device. A transmission / reception unit 110a and a control unit 120a for integrated control of these units are provided.

  Further, the authentication server 700 in this embodiment includes a storage unit 730 that stores authentication information for permitting authentication, a biometric information receiving unit 740 that receives an attachment / detachment detection signal from the authentication device 100a, a received attachment / detachment detection signal, and a user. Authentication unit 750 for performing personal authentication of the user from a password input by the user, authentication result transmission unit 760 for transmitting the authentication result to the authentication apparatus 100a, and biometric information data for each individual referred to when analyzing and evaluating the attachment / detachment detection signal And personal information database DB1 that stores the verification of the password and an authentication key to be transmitted to the external device, stores the external device to be used in selecting the external device to be operated, and stores information necessary for connection with the external device. External device database DB2 stored, transmission / reception via external network Receiving means 710, and a control unit 720 for controlling integrating the means of these is provided performed.

  The overall flow of the embodiment of the second invention of the present application will be described (not shown). When the attachment detection unit 130a detects the attachment, the authentication device 100a transmits the biological information, which is a signal related to the detected attachment / detachment detection, to the authentication server 700 using the biological information transmission unit 140a. This corresponds to the attachment / detachment detection means of the first invention. When the authentication server 700 receives the detection information signal using the biometric information receiving unit 740, the authentication server 700 performs user authentication using the authentication unit 750. Specifically, the received detection information signal and the personal information database DB1 are collated using the storage unit 730, the degree of coincidence is determined, user authentication is performed, and the authentication result transmitting unit 760 is used to authenticate the authentication apparatus 100a. Send to. This corresponds to the authentication means of the first invention. At this time, information on the authenticated user and information on the external device corresponding to the authentication level may be transmitted at the same time. When the authentication apparatus 100a receives the authentication information by the authentication result receiving unit 150a, the authentication control unit 160a that controls a predetermined operation according to the received authentication result, and an external that operates a predetermined external device according to the authentication result The device operating unit 170a operates a predetermined external device using the transmitting / receiving unit 110a that performs transmission / reception with the external device through short-range wireless communication. This corresponds to the authentication control means, the part device operation means, and the transmission / reception means of the first invention.

  According to the embodiment of the second invention of the present application, the same function as that of the embodiment of the first invention of the present application is realized by using two devices instead of one device. By causing the authentication server 700 to execute verification processing that requires processing capability, the processing load on the authentication device 100a, which is a wearable terminal, can be reduced, and the authentication device 100a can be easily reduced in weight and size. Can be expected.

  Further, the third invention of the present application is a program for causing a computer to execute the authentication device according to any one of the first invention and the second invention as a computer device used by a user.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims. For example, in the example of the present embodiment, the authentication apparatus 100 is exemplified that the attachment / detachment detection device 111 and the authentication device 112 are sensors that detect human body information including the same biological information, but these are different sensors. May be. The authentication apparatus 100 may be provided with, for example, a touch panel, a numeric keypad, a camera (image pickup device), a microphone, or the like as necessary, or may be in the form of glasses even if it is a bracelet type. Also good. In addition, for the illustrated tables, items necessary on the application side may be added as appropriate. Further, the communication means for short-range wireless communication is not limited to the exemplified method, and the present invention can be similarly implemented even by using a communication method such as infrared communication.

DESCRIPTION OF SYMBOLS 100,100a Authentication apparatus 130 Memory | storage means 130 Attachment / detachment detection means 140 Authentication means 160 Authentication control means 170 External apparatus operation means 700 Authentication server 800 Network 810 Server DB1 Personal information database DB2 External apparatus database

Claims (15)

Storage means for storing authentication information for permitting authentication;
Attaching / detaching detecting means for detecting biological information and determining a wearing state;
A first authentication unit that authenticates a user with reference to the storage unit when biometric information is detected by the attachment / detachment detection unit;
And an authentication control means for controlling a predetermined operation in accordance with an authentication result by the authentication means.   The authentication apparatus according to claim 1, wherein the authentication control unit includes an external device operation unit that connects to an external device. The external device operating means is
The authentication apparatus according to claim 1, further comprising a second authentication unit different from the authentication by the first authentication unit.   The authentication apparatus according to any one of claims 1 to 3, wherein the predetermined operation is stopped when the removal is detected by the attachment / detachment detection means. The attachment / detachment detection means includes
The authentication apparatus according to any one of claims 1 to 4, further comprising a pulse wave sensor. The authentication means includes
The authentication apparatus according to claim 5, wherein authentication is performed based on a pulse wave detected by the pulse wave sensor. The attachment / detachment detection means includes
The authentication apparatus according to claim 1, wherein detection is performed using two or more sensors. The sensor is
The authentication apparatus according to claim 7, wherein at least one of a change in shape, temperature, and contact with a human body is detected. The attachment / detachment detection means includes
The authentication apparatus according to any one of claims 1 to 8, further comprising an imaging unit that images the surroundings. The imaging means includes
The authentication apparatus according to claim 9, wherein a vein is detected from the captured image, and authentication is performed based on the vein pattern. The imaging means includes
The authentication apparatus according to claim 9 or 10, wherein eyes are detected from a captured image, and authentication is performed based on an iris pattern. The authentication information is:
The authentication apparatus according to claim 1, wherein the authentication apparatus is a password and / or personal information data. The authentication means includes
The authentication device according to claim 1, wherein the authentication device is fingerprint authentication. Attaching / detaching detecting means for detecting biological information and determining a wearing state;
Biometric information transmitting means for transmitting the biometric information to the outside;
An authentication result receiving means for receiving the authentication result;
Authentication control means for controlling a predetermined operation according to a reception result by the receiving means;
An authentication device comprising: an external device operating means for connecting to an external device by the authentication control means;
Storage means for storing authentication information for permitting authentication;
Biometric information receiving means for receiving the biometric information;
First authentication means for authenticating a user with reference to the storage means;
An authentication system comprising: an authentication server comprising: an authentication result transmission unit configured to transmit an authentication result obtained by the first authentication unit.   The program which makes a computer perform the authentication apparatus as described in any one of Claims 1-14.

Images