JP2018010470A - Authentication device, authentication system, authentication method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an easy-to-use authentication device configured to reduce the time required for authentication processing.SOLUTION: A mobile authentication device includes: a bio-information acquisition unit (301) for acquiring bio-information of a subject; a communication unit which communicates with another authentication device; an authentication unit which executes first authentication processing with the bio-information acquired by the bio-information acquisition unit; and a control unit. The communication unit transmits the bio-information to the other authentication device so that second authentication processing may be implemented with the acquired bio-information. The control unit transmits information to a device to be controlled to authenticate the subject when the subject is authenticated by the first authentication processing, during a period from when the subject is authenticated by the second authentication processing of the other authentication device to when a predetermined condition is satisfied.SELECTED DRAWING: Figure 5

Description

  The present invention relates to an authentication device, an authentication system, an authentication method, and a program, and more particularly, to an authentication device, an authentication system, an authentication method, and a program for authenticating a subject using biological information of the subject.

  As security consciousness increases, attention is paid to authentication using biometric information or authentication using a combination of biometric information and ID or password, instead of conventional authentication using only ID (identification) and password. Authentication methods using biometric information are disclosed in WO2002 / 009034 (Patent Document 1) and WO2009 / 096475 (Patent Document 2).

  In authentication using biometric information acquired by a sensor, generally, normal biometric information is registered on the device side (PC (Personal Computer) or server side), and the biometric information acquired on the device side Matching calculation using normal biological information is performed. The reason for this is that the device side is equipped with a high-performance computing device (CPU (Central Processing Unit) and memory) and can perform complex computations (high-precision computations) for biometric authentication processing at high speed. Because it can.

  Thereby, the sensor side can be completed with an inexpensive and simple hardware configuration, and the downsizing and low cost of the sensor can be realized.

  In recent years, there is a demand for biometric authentication to improve security even when using a large-scale on-premises system or cloud service. However, registering personal data related to biometric authentication in the cloud server has a risk of leaking privacy information of many users who register the personal data.

  Therefore, a method in which a mobile phone acquires biometric information and collates the acquired biometric information with biometric information stored in advance in the mobile phone is disclosed in Japanese Patent Laid-Open No. 2002-123778 (Patent Document 3). Is done. In Japanese translations of PCT publication No. 2004-518229 (Patent Document 4), a portable personal digital identification device collates biometric information measured by the device with biometric information stored in advance in the device, and performs authentication. A configuration to be implemented is disclosed.

  In addition, a method has been proposed in which a portable biometric sensor has biometric information and performs a matching calculation related to biometric authentication within the biometric sensor. As this method, there is, for example, UDO (Universal Authentication Framework) of FIDO (Fast IDentity Online).

WO2002 / 009034 WO2009 / 096475 JP 2002-123778 A JP-T-2004-518229

  When biometric authentication is performed by a device such as a PC equipped with an authentication sensor and authentication is performed on a device that uses the authentication result, it is necessary to take out the device from a bag or the like every time authentication is performed on the use device. Inferior.

  In addition, when authentication is performed in the authentication sensor and the utilization device is authenticated using the authentication result, the authentication sensor needs to have a high-performance arithmetic processing unit (CPU), which increases costs. Also, when authentication is performed with a low-performance CPU, the authentication process takes too much time.

  The present disclosure has been made in view of such problems, and an object thereof is to provide an authentication device, an authentication system, and an authentication method that are easy to use. Another object is to provide an authentication device, an authentication method, and an authentication system that require a short time for the authentication process. Still another object is to provide a program for causing a processor to execute these authentication methods.

  According to an aspect of the present disclosure, the portable authentication device includes a biological information acquisition unit that acquires biological information of a subject, a communication unit that communicates with another authentication device, and biological information acquired by the biological information acquisition unit. The authentication part which performs a 1st authentication process, and a control part are provided.

  A communication part transmits the said biometric information to another authentication apparatus, in order to perform a 2nd authentication process with the biometric information acquired. When the predetermined authentication condition is established after the subject is authenticated by the second authentication process of another authentication device, the control unit is authenticated by the first authentication process when the subject is authenticated. Then, the control target device transmits information for authenticating the subject.

  According to another aspect of the present disclosure, the portable authentication device includes a communication unit that communicates with another authentication device including a biological information acquisition unit that acquires biological information of the subject, and the other authentication device is acquired. An authentication unit that performs the first authentication process with biometric information and performs the second authentication process with biometric information received from another authentication device, and a control unit are further provided.

  When the predetermined authentication condition is satisfied after the subject is authenticated by the second authentication process, the control unit determines that the subject is authenticated by the first authentication process. Information for authenticating the subject is transmitted.

Preferably, the accuracy of the first authentication process is different from the accuracy of the second authentication process.
Preferably, the accuracy of the second authentication process is higher than the accuracy of the first authentication process.

  Preferably, the communication includes wireless communication, and the predetermined condition includes a condition based on a strength of a signal received by the authentication apparatus from another authentication apparatus.

  Preferably, the predetermined condition includes a condition based on an elapsed time from when the subject is authenticated as valid by the second authentication process.

  Preferably, the authentication device further includes a detection unit that detects a position, and the predetermined condition includes a condition based on the position of the authentication device detected by the detection unit.

  Preferably, the authentication device further includes a storage unit that stores information for causing the control target device to authenticate the subject, and a predetermined condition is not satisfied after the subject is authenticated by the second authentication process. When this happens, reading of information from the storage unit is prohibited.

  According to another aspect of the present disclosure, a first device that acquires biological information of a subject and a second device that communicates with the first device are provided. The first device includes a first authentication unit that performs a first authentication process on the acquired biometric information, and the second device includes a second authentication unit that performs a second authentication process. The second device receives the biometric information from the first device, and causes the second authentication unit to perform the second authentication process with the biometric information. When the first device or the second device authenticates the subject by the first authentication process while the predetermined condition is satisfied after the subject is authenticated by the second authentication processing. Then, the control target device transmits information for authenticating the subject.

  According to another aspect of the present disclosure, there is an authentication method using a portable authentication device, the step of acquiring biological information of a subject, the step of communicating with another authentication device, and the acquired biological information. Performing the authentication process, and the step of communicating includes transmitting the biometric information to another authentication device to perform the second authentication process on the acquired biometric information, and the authentication method includes: Further, when the subject is authenticated by the first authentication process while the predetermined condition is satisfied after the subject is authenticated by the second authentication process of the other authentication device, the control is performed. The method includes the step of transmitting information for authenticating the subject to the target device.

  According to another aspect of the present disclosure, an authentication method using a portable authentication device includes a step of communicating with another authentication device including a biological information acquisition unit that acquires biological information of a subject. The first authentication process is performed using the acquired biometric information. The authentication method further includes a step of performing the second authentication process with biometric information received from another authentication device, and a predetermined condition is established after the subject is authenticated as valid by the second authentication process. In the meantime, when the subject is authenticated by the first authentication process, there is provided a step of transmitting information for authenticating the subject to the device to be controlled.

  According to another aspect of the present disclosure, a program for causing a processor of the authentication device described above to execute an authentication method is provided.

  According to this disclosure, an authentication device, an authentication system, an authentication method, and a program that are easy to use and that require a short time for authentication processing are provided.

It is a figure which shows the structure of the authentication system 1 concerning Embodiment 1. FIG. 2 is a diagram illustrating a specific example of a hardware configuration of a biometric sensor 300. FIG. It is a figure which shows the specific example of the hardware constitutions of the portable terminal. 3 is a diagram illustrating a specific example of a hardware configuration of the device 100. FIG. 3 is a diagram illustrating an example of a functional configuration of a biometric sensor 300. FIG. 3 is a diagram illustrating an example of a functional configuration of a mobile terminal 200. FIG. 3 is a flowchart of authentication processing according to the first embodiment. 3 is a flowchart of authentication processing according to the first embodiment. 3 is a flowchart of authentication processing according to the first embodiment. 4 is a diagram schematically illustrating data transmitted and received between apparatuses according to Embodiment 1. FIG.

  Embodiments will be described below with reference to the drawings. In the following description, the same parts and components are denoted by the same reference numerals. Their names and functions are also the same.

[Overview]
The outline according to each embodiment is as follows.

  The authentication system includes a portable first device that acquires biological information of a subject, and a portable second device that communicates with the first device. The first device performs a first authentication process on the acquired biometric information, and the second device performs a second authentication process having an accuracy different from the accuracy of the first authentication process. When the second device establishes communication with the first device, the second device performs the second authentication process with the biometric information received from the first device. If the subject is authenticated by the first authentication process while the predetermined condition is satisfied after the communication is established and the subject is authenticated by the second authentication process, the first device Is transmitted to the control target device.

  Since each of the first and second devices is portable, it is easy to use. Further, the authentication process can be performed in a distributed manner between the first device and the second device. Further, only the first authentication process may be performed while the predetermined condition is satisfied after the subject is authenticated by the second authentication process (the second authentication process can be omitted).

  Therefore, in the embodiment, when transmitting information for authenticating the subject to the control target device, the processing load on each device can be reduced by distributing the authentication processing load to the first device and the second device. As a result, the time required for the authentication process can be shortened.

  In each embodiment, a fingerprint image is shown as biometric information, but biometric information is not limited to a fingerprint image. For example, it may be a vein pattern image, an iris pattern image, or the like.

  In each embodiment, the “fingerprint image information” includes a fingerprint image and / or a feature amount of the fingerprint image.

[Embodiment 1]
<System configuration>
FIG. 1 is a diagram illustrating a configuration of an authentication system 1 according to the first embodiment. Referring to FIG. 1, the authentication system 1 includes a biometric authentication sensor 300 (corresponding to a first device) that acquires biometric information and a portable terminal 200 (corresponding to a second device) that communicates with the biometric authentication sensor 300. The biometric sensor 300 and the portable terminal 200 are both examples of an authentication device having an authentication function using biometric information.

  In the authentication system 1, the portable terminal 200 and the biometric sensor 300 can be carried by the same user (subject). The biometric authentication sensor 300 and the mobile terminal 200 perform user authentication processing using biometric information, and based on the result of the authentication processing, the user uses or operates the device 100 (corresponding to a control target device) (login operation) Including) may be permitted. In the first embodiment, the device 100 is an image processing device (for example, a copier, a printer, or an MFP (Multi-Function Peripherals) that is a combination of these), but the type of the device 100 is an image processing device. It is not limited. For example, a system that manages permission / prohibition of entry may be used.

  The biometric sensor 300 is a wearable terminal such as a pendant, a wristwatch, and a bag accessory. The biometric sensor 300 communicates with the mobile terminal 200 by short-range wireless communication. This short-range wireless communication follows, for example, a BLE (Bluetooth Low Energy) method that enables communication with extremely low power, but the communication method is not limited to BLE. In addition, the portable terminal 200 or the biometric sensor 300 communicates with the device 100 wirelessly. This wireless communication includes short-range wireless communication such as NFC (Near Field Radio Communication).

<Configuration of Biometric Sensor 300>
FIG. 2 is a diagram illustrating a specific example of the hardware configuration of the biometric sensor 300. Referring to FIG. 2, a biometric authentication sensor 300 includes a CPU (Central Processing Unit) 30 corresponding to a control unit that controls the whole, and a ROM (Read Only Memory) 31 for storing a program executed by the CPU 30 and data. And a RAM (Random Access Memory) 32, a sensor 33, a button 34 operated to accept a user instruction to the biometric sensor 300, and a communication controller 35 for controlling wireless communication.

  The communication controller 35 includes a modem circuit, an amplifier circuit, and the like, and performs wireless communication via an antenna (not shown).

  The sensor 33 has a plurality of electrodes, measures a capacitance that varies according to the distance between the finger surface placed on the sensor surface and the electrode, and acquires a fingerprint image from the measured capacitance. To do. The method for acquiring a fingerprint image is not limited to a method based on a change in capacitance, and may be a method for acquiring a fingerprint image with an imaging element such as a CCD (Charge Coupled Device), for example.

<Configuration of mobile terminal 200>
FIG. 3 is a diagram illustrating a specific example of the hardware configuration of the mobile terminal 200. Referring to FIG. 3, a portable terminal 200 includes a CPU 20 corresponding to a control unit that controls the whole, a ROM 21 and a RAM 22 for storing programs and data executed by the CPU 20, a display 23, and a user receiving information on the portable terminal 200. Are provided with an operation panel 25, a communication controller 27, and a memory interface 28.

  The display 23 and the operation panel 25 may be provided as an integrated touch panel. The communication controller 27 includes a modem circuit, an amplifier circuit, and the like for wireless communication between the biometric sensor 300 and the device 100.

  A memory card 29 is detachably attached to the memory interface 28. Memory interface 28 includes a circuit that is controlled by CPU 20 to write data to memory card 29 or a circuit that reads data from memory card 29.

<Configuration of Device 100>
FIG. 4 is a diagram illustrating a specific example of the hardware configuration of the device 100. FIG. 4 shows a configuration of an MFP as the device 100, for example. Referring to FIG. 4, device 100 includes a CPU (Central Processing Unit) 150 for controlling the whole, a storage unit 160 for storing programs and data, and an image storage unit 153 for mainly storing image data. , An information input / output unit 170, a communication unit 157 for communicating with an external device including the mobile terminal 200 or the biometric authentication sensor 300, a user authentication unit 174, and various processing units.

  The storage unit 160 stores programs executed by the CPU 10 and various data. Data stored in the storage unit 160 includes a registration ID 161. The registration ID 161 indicates information registered to identify the user (operator) of the device 100 as a valid user. The input / output unit 170 includes a display unit 171 including a display and an operation unit 172 operated by a user to input information to the device 100. Here, the display unit 171 and the operation unit 172 may be provided as an integrally configured touch panel.

  The user authentication unit 174 performs authentication processing for the user of the device 100. Communication unit 157 includes a transmission unit 158 for transmitting data to an external device and a reception unit 159 for receiving data from the external device.

  The various processing units described above optically read an image processing unit 151, an image forming unit 152, an image output unit 154, a facsimile control unit 155 for controlling a facsimile function, and a document placed on a document table (not shown). An image reading unit 173 for obtaining image data. These various processing units read and write image data in the image storage unit 153. Since the functions of the respective units included in the various processing units are well known, detailed description thereof will not be repeated here.

<Functional Configuration of Biometric Sensor 300>
FIG. 5 is a diagram illustrating an example of a functional configuration of the biometric sensor 300. In the biometric authentication sensor 300 of FIG. 5, first verification information 310, authentication information 311, and a flag 312 are stored in a storage unit (ROM 31 or RAM 32). The biometric sensor 300 includes a biometric information acquisition unit 301 that acquires a user's fingerprint image (biometric information) from the output of the sensor 33, a first authentication unit 302 that performs a first authentication process using the acquired fingerprint image information, A first communication control unit 304 for controlling communication via the communication controller 35 and a flag processing unit 305 for processing the flag 312 are provided.

  The first authentication unit 302 includes a first collation unit 303 that collates (matches) the fingerprint image information acquired by the sensor 33 with the first collation information 310 stored in the ROM 31 in advance. The first verification information 310 includes information on a fingerprint image of a legitimate user of the biometric sensor 300. The first authentication unit 302 calculates the similarity between the acquired fingerprint image and the fingerprint image of the first verification information 310 from the result of the verification process of the first verification unit 303. When determining that the calculated similarity is equal to or greater than the threshold, the first authentication unit 302 reads the authentication information 311 from the ROM 31 and transmits the authentication information 311 to the device 100 via the first communication control unit 304. On the other hand, if it is determined that the similarity is less than the threshold value, the first authentication unit 302 passes (omits) reading processing of the authentication information 311 from the ROM 31. Therefore, in this case, the authentication information 311 is not transmitted to the device 100.

  The first communication control unit 304 performs pairing with the mobile terminal 200 via the communication controller 35 to establish a connection. Thereafter, the established connection is maintained by continuing the pairing. Further, the first communication control unit 304 receives an authentication result by the second authentication unit 202 described later from the portable terminal 200 and a flag update request from the flag update request unit 205 described later. In addition, the first communication control unit 304 transmits the fingerprint image information or the authentication information 311 acquired by the biometric information acquisition unit 301 to the mobile terminal 200.

  The flag processing unit 305 sets the flag 312 stored in the RAM 32 to ON or OFF according to the flag update request received by the first communication control unit 304.

  5 corresponds to a program stored in the ROM 31 of the biometric sensor 300 or a combination of a program and a circuit. The CPU 30 reads out these programs from the ROM 31 and executes the read programs, thereby realizing the functions of the respective units.

<Functional configuration of mobile terminal 200>
FIG. 6 is a diagram illustrating an example of a functional configuration of the mobile terminal 200. Referring to FIG. 6, in portable terminal 200, second verification information 210 and authentication ID 211 are stored in the storage unit (ROM 21 or RAM 22). The second verification information 210 includes information on the fingerprint image of the legitimate user of the mobile terminal 200. The authentication ID 211 indicates information for identifying that the user of the mobile terminal 200 is a valid user of the device 100. The mobile terminal 200 includes a second authentication unit 202, a second communication control unit 204 that controls the communication controller 27, and a flag update request unit 205 that requests updating of the flag 312.

  The second communication control unit 204 performs pairing with the biometric sensor 300 via the communication controller 27 to establish a connection. After that, the connection is maintained while the pairing is continued. Further, the second communication control unit 204 receives the fingerprint image information from the biometric sensor 300 and transmits the authentication ID 211 to the biometric sensor 300. The second communication control unit 204 transmits a request from the flag update request unit 205 to the biometric sensor 300.

  The second collation unit 203 of the second authentication unit 202 collates (matches) the fingerprint image information received from the biometric authentication sensor 300 via the second communication control unit 204 with the second collation information 210. The second authentication unit 202 calculates the similarity between the fingerprint image received from the biometric sensor 300 and the fingerprint image of the first verification information 310 from the result of the verification process of the second verification unit 203. The second authentication unit 202 transmits the authentication ID 211 to the biometric sensor 300 via the second communication control unit 204 when the similarity is greater than or equal to the threshold, but when the similarity is less than the threshold, the authentication ID 211 Pass the sending process. Therefore, the authentication ID 211 is not transmitted to the biometric sensor 300.

  6 corresponds to a program stored in the ROM 21 of the portable terminal 200 or a combination of a program and a circuit. The function of each unit is realized by the CPU 20 reading these programs from the ROM 21 and executing the read programs.

<Verification processing>
As a background of the present embodiment, the main collation processing of fingerprint images for authenticating a user is, for example, a pattern matching method for comparing (collating) fingerprint images, and a higher accuracy of collation processing than the pattern matching method There is a frequency analysis method with higher accuracy of the matching process than the point extraction method (maneuver method) and the feature point extraction method.

  The feature point extraction method is a method of extracting feature amounts (attributes of fingerprint end points or branch points, their relative positional relationship, etc.) from a fingerprint image and collating the extracted feature amounts. In the feature point extraction method, a process of extracting a feature (feature amount) from a fingerprint image is required as a pre-process of the matching process. In the frequency analysis method, a cross section obtained by slicing a fingerprint indicated by an image is regarded as a signal waveform, a result of frequency analysis of the signal waveform is extracted as a feature, and the extracted features are collated. The frequency analysis method is applied to hybrid authentication in combination with the minutiae method. Note that the verification method is not limited to these.

  In the first embodiment, the accuracy of the authentication process of the biometric sensor 300 is different from the accuracy of the authentication process of the mobile terminal 200. Specifically, the accuracy of the authentication process by the second authentication unit 202 of the mobile terminal 200 is higher than the accuracy of the authentication process of the first authentication unit 302 of the biometric sensor 300. In the first embodiment, the first verification unit 303 of the first authentication unit 302 performs the first verification process according to the pattern matching method so that the combination of the authentication processes with different accuracy is performed, and the second authentication unit A second matching unit 203 of 202 performs a second matching process according to the feature point extraction method.

  As long as the authentication processes have different accuracy, the first matching process may be a process according to the feature point extraction method, and the second matching process may be a combination of processes according to the frequency analysis method. Alternatively, the first matching process may be a process according to the pattern matching method, and the second matching process may be a combination of processes according to the frequency analysis method.

<Processing flowchart>
7 to 9 are flowcharts of the authentication process according to the first embodiment. FIG. 10 is a diagram schematically illustrating data transmitted and received between apparatuses according to the first embodiment. The authentication process according to the first embodiment will be described with reference to FIGS.

(High-precision authentication processing by the mobile terminal 200)
With reference to FIG. 7, the case where the portable terminal 200 performs a highly accurate authentication process and notifies the biometric authentication sensor 300 of the authentication result is demonstrated. First, the first communication control unit 304 of the biometric sensor 300 and the second communication control unit 204 of the mobile terminal 200 start pairing and establish communication (connection) (steps S1 and S11). When communication is established, pairing is continuously performed to maintain the connection. The pairing is started when a predetermined operation is performed via the button 34 of the biometric sensor 300 or when a predetermined operation is performed via the operation panel 25 of the mobile terminal 200.

  When pairing is started, the authentication information 311 of the biometric sensor 300 is an initial value (empty or indefinite).

  The sensor 33 of the biometric authentication sensor 300 reads the user's biometric information (fingerprint image). The biometric information acquisition unit 301 acquires fingerprint image information from the output of the sensor 33 (step S3, step T1 in FIG. 10). The first communication control unit 304 transmits the biological information (fingerprint image information) acquired by the biological information acquisition unit 301 to the mobile terminal 200 (step S5, step T2 in FIG. 10).

  In the mobile terminal 200, the second communication control unit 204 determines whether or not to receive biometric information (information of a fingerprint image) from the biometric sensor 300 (step S15). When determining that the biological information is not received (NO in step S15), the second communication control unit 204 waits until the biological information is received. However, if the second communication control unit 204 determines that the biological information is received (YES in step S15), 2 The authentication unit 202 performs authentication processing with higher accuracy in the received biometric information (step S17, step T3 in FIG. 10). Specifically, the second collation unit 203 collates the received fingerprint image information with the second collation information 210 according to the feature point extraction method.

  The second authentication unit 202 determines whether or not the fingerprint image information received from the biometric sensor 300 indicates the fingerprint image of the user of the mobile terminal 200 based on the similarity between the fingerprint images indicated by the collation processing result. (Step S19).

  When the second authentication unit 202 determines that the similarity is equal to or greater than the threshold and the user is legitimate, in other words, the fingerprint image information received from the biometric sensor 300 indicates the fingerprint image of the user of the mobile terminal 200. When the determination is made (YES in Step S19), the flag update request unit 205 transmits a request for setting the flag 312 to ON to the biometric sensor 300 via the second communication control unit 204 (Step S21). S25, step T5 in FIG. At this time, the second authentication unit 202 transmits the authentication ID 211 together with the notification of authentication = OK to the biometric sensor 300 via the second communication control unit 204 (step S25, steps T4 and T5 in FIG. 10). .

  On the other hand, when the similarity is less than the threshold value and the validity of the user is not determined, in other words, the second authentication unit 202 uses the fingerprint image of the user of the mobile terminal 200 as the fingerprint image information received from the biometric authentication sensor 300. When it is determined not to be shown (NO in step S19), along with the notification of authentication = NG, the flag update request unit 205 sends a request for setting the flag 312 to OFF via the second communication control unit 204. It transmits to the sensor 300 (step S23, S25). If off is initially set in the flag 312 at the start of pairing, the process of step S23 may be omitted.

  In the biometric sensor 300, the first communication control unit 304 determines whether or not to receive the authentication result of the second authentication unit 202 from the mobile terminal 200 (step S6).

  While it is determined not to be received (NO in step S6), the process of step S6 is repeated. When it is determined that it has been received (YES in step S6), the CPU 31 stores the received information (steps S7 to S9). Specifically, when the CPU 31 determines that the received information indicates authentication = OK (“OK” in step S7), the CPU 31 stores the received authentication ID 211 as the authentication information 311. The flag processing unit 305 The flag 312 is set to ON according to the received request (step S8).

  On the other hand, when the CPU 31 determines that the received information indicates authentication = NG (“NG” in step S7), the flag processing unit 305 sets the flag 312 to OFF in accordance with the received request (step S7). At this time, the CPU 31 passes the authentication ID 211 storage process. Accordingly, the authentication information 311 remains the initial value (empty or indefinite).

  As described above, in the authentication system 1, whether or not the user of the biometric authentication sensor 300 matches the user of the mobile terminal 200 by performing the highly accurate authentication process by the second authentication unit 202 of the mobile terminal 200. Judged with high accuracy. When it is determined that they match, that is, when the validity of the user is authenticated, the biometric sensor 300 receives an authentication ID 211 for allowing the user to use (operate) the device 100 from the portable terminal 200. Can be received.

(Low-precision authentication process by the biometric sensor 300)
Next, a case where the biometric sensor 300 communicates with the device 100 during the above-described pairing (while the connection is maintained) will be described with reference to FIG.

  First, the CPU 31 of the biometric sensor 300 determines whether to start communication with the device 100 according to the operation of the button 34 (step S10). While the start of communication with device 100 is not determined (NO in step S10), the process in step S10 is repeated.

  On the other hand, if the start of communication with the device 100 is determined (YES in step S10), the CPU 31 determines the value of the flag 312 (step S11). When the CPU 31 determines that the flag 312 indicates OFF (“OFF” in step S11), the transmission process (step S14) of the authentication information 311 (that is, the authentication ID 211) described later to the device 100 is passed and a series of processes is performed. Ends.

  On the other hand, when the CPU 31 determines that the flag 312 indicates ON (“ON” in step S11), the CPU 31 activates the first authentication unit 302. The first authentication unit 302 performs the authentication process with the lower accuracy of the biometric information (fingerprint image information) acquired by the biometric information acquisition unit 301 (step S12, step T6 in FIG. 10). Specifically, the first collation unit 303 collates the fingerprint image acquired via the sensor 33 with the fingerprint image of the first collation information 310 according to pattern matching.

  The first authentication unit 302 determines whether or not the received fingerprint image matches the fingerprint image of the first verification information 310 (step S13). Specifically, it is determined whether or not the similarity between fingerprint images indicated by the result of the collation process of the first collation unit 303 is equal to or greater than a threshold value. When the first authentication unit 302 determines that the degree of similarity is greater than or equal to the threshold value, that is, when the validity of the user is authenticated (YES in step S13), the CPU 31 reads the authentication information 311 (that is, the authentication ID 211). Then, the data is transmitted to the device 100 via the first communication control unit 304 (step S14, step T7 in FIG. 10). Thereafter, the process returns to step S10, and the subsequent processes are executed in the same manner as described above.

  On the other hand, when the first authentication unit 302 determines that the similarity is less than the threshold value, that is, when the validity of the user is not authenticated (NO in step S13), the CPU 31 determines that the authentication information 311 (that is, the authentication ID 211). ) Is transmitted to the device 100 (step S14). Thereafter, based on the operation of the button 34, it is determined whether or not to end the series of processing (step S15). If it is determined that the process is to be terminated (YES in step S15), the series of processes is terminated. If it is determined that the process is not to be terminated (NO in step S15), the process returns to step S10, and the subsequent processes are as described above. It is executed in the same way.

  As described above, the biometric authentication sensor 300 turns on the flag 312 after the authenticity is verified that the biometric authentication sensor 300 and the mobile terminal 200 are the same by the high-precision authentication processing of the second authentication unit 202. If the user of the biometric authentication sensor 300 is authenticated by the low-accuracy authentication process of the first authentication unit 302, the authentication information 311 for authenticating the user to the device 100 (that is, the user is authenticated) Authentication ID 211) is transmitted.

(User authentication by device 100)
The device 100 receives the authentication information 311 (authentication ID 211) from the biometric sensor 300 via the receiving unit 159. The user authentication unit 174 collates the received authentication information 311 with the registration ID 161 of the storage unit 160, and when the collation result is the same, the CPU 150 activates each unit. Thus, when the device 100 determines that the user is a valid user (registered in the device 100), the device 100 enables the user to use (operate) the device 100.

  On the other hand, when the collation result by the user authentication unit 174 does not match, the CPU 150 does not activate each unit. Accordingly, when the device 100 determines that the user is not a valid user of the device 100, the device 100 prohibits the user from using (operating) the device 100.

(Update of flag 312)
Next, a process of updating the flag 312 during connection (during pairing) will be described with reference to FIG. The process of FIG. 9 is repeatedly executed during pairing. In the first embodiment, when it is detected that the biometric authentication sensor 300 and the mobile terminal 200 are separated by a predetermined distance during pairing, the flag 312 is set to OFF and the biometric authentication sensor 300 The reading process of the authentication information 311 (authentication ID 211) is passed (“OFF” in step S11).

  Based on the strength of the signal received from the biometric sensor 300, the flag update request unit 205 determines whether or not the user has left (step S27). Specifically, the flag update request unit 205 detects the strength of a signal received from the biometric sensor 300 via the second communication control unit 204. When the flag update requesting unit 205 detects that the detected reception intensity is less than the threshold value for a predetermined number of times, the biometric authentication sensor 300 and the portable terminal 200 are set at a predetermined distance. It is determined that they are away.

  For example, when the user carrying the portable terminal 200 moves with the biometric sensor 300 on the desk and the distance between the biometric sensor 300 and the portable terminal 200 exceeds a predetermined distance, the flag 312 is set off. Thus, the reading process of the authentication information 311 (authentication ID 211) in the biometric authentication sensor 300 is not performed.

  If the flag update request unit 205 determines that the biometric sensor 300 and the mobile terminal 200 are separated (YES in step S27), the flag update request unit 205 transmits a request for setting the flag 312 off (step S29), and ends the process.

  On the other hand, if the flag update request unit 205 determines that the biometric sensor 300 and the portable terminal 200 are not separated (NO in step S27), the process of step S29 is passed and the series of processes ends.

  In the biometric sensor 300, the first communication control unit 304 receives the request for setting the above-described OFF (step S30). The flag processing unit 305 sets the flag 312 to OFF according to the received request (step S31). At this time, the CPU 31 may set the authentication information 311 (that is, the authentication ID 211) in a read-disabled state. For example, the authentication information 311 (that is, the authentication ID 211) is deleted (discarded).

  Therefore, if it is determined that the biometric sensor 300 and the portable terminal 200 are separated during pairing (YES in step S27), the flag 312 is switched from on to off (step S31). Therefore, when the biometric sensor 300 communicates with the device 100 (see step S10 in FIG. 8), the flag 312 is determined to be off (“off” in step S11), and the device 100 with the authentication ID 211 is determined. This transmission process (step S14) is passed, and the use (operation) of the device 100 to the user is prohibited.

  On the other hand, while it is determined that the biometric sensor 300 and the portable terminal 200 are not separated during pairing (NO in step S27), the process in step S29 is passed and the flag 312 remains on. Therefore, the transmission process (step S14) of the authentication ID 211 to the device 100 is performed, and the use (operation) of the device 100 for the user can be permitted.

(Personal rejection rate and acceptance rate of others)
In the case of the high-accuracy authentication process described above, generally, the time required for the process is relatively long, but the rejection rate is 1/100 to 1/1000, whereas the acceptance rate of others is 1/100. The authentication success rate is higher than the probability of false authentication. On the other hand, in the case of the above-described low-accuracy authentication processing, the processing time is generally relatively short, but the rejection rate is 1/10 to 1/100, and the acceptance rate of others is 1/100. The probability of false authentication is higher than the authentication success rate.

  In view of such a background, in the first embodiment, when the flag 312 is on, that is, when the authentication is successful through the high-precision authentication process, the biometric sensor 300 and the portable terminal 200 are not separated from each other. If the user can be authenticated by the low-accuracy authentication processing by the first authentication unit 302, the user can be permitted to operate the device 100.

  As a result, once authentication is successfully performed by high-precision authentication processing, when there is a high possibility that the user is carrying the biometric authentication sensor 300 and the portable terminal 200 (that is, when the flag 312 is on). ) User authentication can be performed by low-accuracy authentication by the first authentication unit 302, and time required for authentication can be shortened.

(Modification when flag 312 is set to OFF)
In the first embodiment, when it is detected that the biometric sensor 300 and the mobile terminal 200 are separated, the flag 312 of the biometric sensor 300 is switched from on to off. The distance from the mobile terminal 200 is not limited.

  For example, as a determination condition, the flag 312 is set when the passage of a predetermined time (for example, about 3 minutes equivalent to a PC screen saver) is measured using a timer after the flag 312 is set to ON. It may be switched from on to off.

  Alternatively, the detection value of the position sensor indicates that the user carrying the biometric sensor 300 or the portable terminal 200 has exited from a predetermined area (the position information of the biometric sensor 300 or the portable terminal 200 is outside the area). ) Is detected, the flag 312 may be switched from on to off.

  Alternatively, the flag 312 may be switched from on to off when it is determined from the similarity of fingerprint images by the first authentication unit 302 that a fingerprint image different from the user's fingerprint image has been acquired.

  In addition, it is possible to determine whether to turn off the flag 312 by combining two or more of the plurality of determination conditions (distance, elapsed time, position information, similarity). is there.

(Modification of accuracy of authentication process)
In Embodiment 1, the authentication accuracy by the first authentication unit 302 and the second authentication unit 202 is made different by changing the type of collation processing, but the method of making the accuracy different is not limited to this. For example, even when the first authentication unit 302 and the second authentication unit 202 perform the same type of collation processing, the similarity threshold is made different between the first authentication unit 302 and the second authentication unit 202. Thus, the accuracy of authentication may be different. Specifically, the similarity threshold of the second authentication unit 202 is set larger than the similarity threshold of the first authentication unit 302.

[Embodiment 2]
The second embodiment shows a modification of the first embodiment. In the first embodiment, when authentication is successful by the first authentication unit 302 (YES in step S13), an authentication ID 211 is transmitted from the mobile terminal 200 to the device 100 (see step T7a in FIG. 10). Specifically, when authentication is successful (YES in step S13), the first authentication unit 302 transmits a notification of authentication success to the mobile terminal 200. When receiving the notification, the CPU 20 of the portable terminal 200 transmits an authentication ID 211 to the device 100 via the second communication control unit 204.

  In Embodiment 2, the process in which the portable terminal 200 transmits the authentication ID 211 to the biometric sensor 300 in step S25 can be omitted.

[Embodiment 3]
The third embodiment shows a modification of the second embodiment. In the first embodiment, the flag update request unit 205 of the mobile terminal 200 determines whether or not the condition for setting the flag 312 to be off is satisfied (step S27). The authentication sensor 300 may be implemented. In that case, transmission of a request to set the flag 312 to OFF (step S29) can be omitted.

[Embodiment 4]
In the fourth embodiment, a program for causing the portable terminal 200 or the biometric authentication sensor 300 to execute the above-described authentication processing is provided. Such a program includes at least a program according to the flowcharts shown in FIGS. Program product recorded on a computer-readable recording medium such as a flexible disk, CD-ROM (Compact Disk-Read Only Memory), ROM, RAM and memory card attached to the computer of the portable terminal 200 or the biometric sensor 300 Can also be provided. Alternatively, the program can be provided by being recorded on a recording medium such as a hard disk built in the computer. A program can also be provided by downloading via a network. The program is executed by one or more processors such as the CPU 20 or the CPU 30 or a combination of a processor and a circuit such as an ASIC (Application Specific Integrated Circuit).

  Note that the program may be a program module that is provided as part of an OS (Operating System) of a computer and that performs necessary processing by calling necessary modules in a predetermined arrangement at a predetermined timing. In that case, the program itself does not include the module, and the process is executed in cooperation with the OS. A program that does not include such a module can also be included in the program of the fourth embodiment.

  The program according to the fourth embodiment may be provided by being incorporated in a part of another program. Even in this case, the program itself does not include the module included in the other program, and the process is executed in cooperation with the other program. A program incorporated in such another program can also be included in the program according to the fourth embodiment.

  The provided program product is installed in a program storage unit such as a hard disk and executed. The program product includes the program itself and a recording medium on which the program is recorded.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

  DESCRIPTION OF SYMBOLS 1 Authentication system, 33 sensor, 100 apparatus, 200 portable terminal, 202 2nd authentication part, 203 2nd collation part, 204 2nd communication control part, 205 Flag update request | requirement part, 210 2nd collation information, 300 Biometric sensor 301 biometric information acquisition unit 302 first authentication unit 303 first verification unit 304 first communication control unit 305 flag processing unit 310 first verification information 311 authentication information 312 flag

Claims (12)

A portable authentication device,
A biological information acquisition unit that acquires biological information of the subject;
A communication unit that communicates with other authentication devices;
An authentication unit that performs a first authentication process on the biometric information acquired by the biometric information acquisition unit;
A control unit,
The communication unit transmits the biometric information to the other authentication device to perform a second authentication process on the acquired biometric information,
The controller is
When the subject is authenticated by the first authentication process while a predetermined condition is satisfied after the subject is authenticated by the second authentication process of the other authentication device. Is an authentication device that transmits information for authenticating the subject to the control target device. A portable authentication device,
A communication unit that communicates with another authentication device including a biometric information acquisition unit that acquires biometric information of a subject,
The other authentication device performs a first authentication process on the acquired biometric information,
An authentication unit that performs a second authentication process on the biometric information received from the other authentication device;
A control unit,
The controller is
While the predetermined condition is established after the subject is authenticated by the second authentication process, when the subject is authenticated by the first authentication process, An authentication device that transmits information for authenticating the subject.   The authentication apparatus according to claim 1, wherein the accuracy of the first authentication process is different from the accuracy of the second authentication process.   The authentication apparatus according to any one of claims 1 to 3, wherein the accuracy of the second authentication process is higher than the accuracy of the first authentication process. The communication includes wireless communication,
5. The authentication apparatus according to claim 1, wherein the predetermined condition includes a condition based on a strength of a signal received by the authentication apparatus from the other authentication apparatus.   The authentication device according to any one of claims 1 to 5, wherein the predetermined condition includes a condition based on an elapsed time from when the subject is authenticated as valid by the second authentication process. . The authentication device further includes a detection unit that detects a position,
The authentication apparatus according to any one of claims 1 to 6, wherein the predetermined condition includes a condition based on a position of the authentication apparatus detected by the detection unit. The authentication device
A storage unit for storing information for authenticating the subject to the control target device;
The reading of the information from the storage unit is prohibited when a predetermined condition is not satisfied after the subject is authenticated by the second authentication process. The authentication device according to item. A first device for acquiring biological information of the subject;
A second device in communication with the first device;
The first device includes:
Including a first authentication unit that performs a first authentication process on the acquired biometric information,
The second device includes:
Including a second authentication unit for performing a second authentication process;
The second device includes:
Receiving the biometric information from the first device, causing the second authentication unit to perform the second authentication process with the biometric information,
The first device or the second device is
While the predetermined condition is established after the subject is authenticated by the second authentication process, when the subject is authenticated by the first authentication process, An authentication system for transmitting information for authenticating the subject. There is an authentication method using a portable authentication device,
Obtaining biological information of the subject;
Communicating with other authentication devices;
Performing a first authentication process on the acquired biometric information,
The step of communicating includes the step of transmitting the biometric information to the other authentication device in order to perform a second authentication process on the acquired biometric information,
The authentication method further includes:
When the subject is authenticated by the first authentication process while a predetermined condition is satisfied after the subject is authenticated by the second authentication process of the other authentication device. Is an authentication method comprising the step of transmitting information for authenticating the subject to the device to be controlled. There is an authentication method using a portable authentication device,
Comprising the step of communicating with another authentication device comprising a biometric information acquisition unit for acquiring biometric information of a subject,
The other authentication device performs a first authentication process on the acquired biometric information,
The authentication method further includes:
Performing a second authentication process on the biometric information received from the other authentication device;
While the predetermined condition is established after the subject is authenticated by the second authentication process, when the subject is authenticated by the first authentication process, An authentication method, comprising: transmitting information for authenticating the subject.   The program for making the processor of the authentication apparatus of Claim 10 or 11 perform the said authentication method.

Images