JP4575731B2 - Biometric authentication device, biometric authentication system and method - Google Patents

Description

  The present invention relates to a technique for biometric authentication in which authentication is performed using characteristics of a human body, and more particularly to a technique for a biometric authentication system in which use restriction is imposed when authentication fails for a predetermined number of times.

  There is a biometric authentication technology that performs personal authentication using various features of the human body. Since this is harder to break than password authentication or the like, it is being put into practical use.

  However, in biometric authentication, there is a so-called identity rejection that rejects even an authentication request from an authorized user. This is due to variations in biometric information acquired for use in authentication and is not the responsibility of the user. Therefore, in order to reduce the rejection rate, the user's biometric information to be authenticated is stored in advance in the biometric authentication device as registration information, and the biometric information to be authenticated and the respective registration information are collated. For example, Patent Document 1 discloses that authentication is performed.

JP 2004-157602 A

  However, since the amount of data of biometric information is larger than that of text data such as passwords, the technique of Patent Document 1 requires a large number of areas for storing biometric information to be collated. In particular, when performing biometric authentication of a plurality of users, this problem becomes significant because a plurality of pieces of biometric information must be stored for each user.

  In addition to authentication devices using biometric information, authentication devices generally have some usage restrictions such as blocking the user and rejecting authentication if authentication fails continuously for a predetermined number of times or more. There are many. Therefore, in the biometric authentication device, if the rejection of the identity occurs continuously, the inconvenience of being blocked even though the user is the authorized user.

  Accordingly, an object of the present invention is to reduce the person rejection rate in a biometric authentication device that does not include a large-capacity storage device for storing registration information.

  Another object of the present invention is to prevent the use restriction due to the rejection of the person in the biometric authentication apparatus that restricts the use when authentication fails for a predetermined number of times.

  A biometric authentication apparatus according to an embodiment of the present invention reads biometric information, outputs a biometric information to be authenticated based on the read biometric information, and performs authentication processing of the biometric information to be authenticated. An authentication processing unit, a counter that counts the number of authentication processing failures, a past information storage unit that stores past biometric information that has failed in the authentication processing unit in the past, and the authentication processing unit failed in authentication When it is determined whether the authentication target biometric information that has failed in authentication and the past biometric information stored in the past information storage unit are identical, the past biometric information and the authentication target biometric information are identical. A counter management unit that adds the value of the counter when there is not, and performs a predetermined control operation according to the value of the counter.

  Here, the predetermined operation performed according to the counter value is, for example, a predetermined use restriction such as not performing authentication if the counter value is equal to or greater than the predetermined value, or unauthorized access if the counter value is equal to or greater than the predetermined value. This includes a case where an alarm is output considering that there is a high possibility.

  A biometric authentication device according to an embodiment of the present invention includes a receiving unit that receives an authentication request including biometric information, an authentication processing unit that authenticates the biometric information received by the receiving unit, and the number of authentication processing failures. A biometric authentication device that includes a counter and does not authenticate the authentication request when the value of the counter is equal to or greater than a predetermined value. The biometric authentication apparatus includes a past information storage unit that stores past biometric information that has failed in the authentication processing unit in the past, and an authentication target biometric that has failed in the authentication when the authentication processing unit has failed in authentication. It is determined whether information and past biometric information stored in the past information storage unit are identical, and the value of the counter is set when the past biometric information and the authentication target biometric information do not have identity. A counter management unit for adding.

  In a preferred embodiment, one piece of past biological information is stored in the past information storage unit. Then, when the counter management unit adds the count value, the authentication target biometric information may be overwritten in the past information storage unit.

  In a preferred embodiment, the past information storage unit stores a plurality of past biological information. Then, when the counter management unit adds the count value, the biometric information to be authenticated may be stored in the past information storage unit according to a FIFO (First-In First-Out).

  A biometric authentication device according to an embodiment of the present invention includes a biometric information reading device that reads biometric information, and causes the biometric information reading device to read the biometric information a plurality of times, and a plurality of biometric information obtained by reading a plurality of times. A biometric information processing apparatus that performs predetermined processing and generates one authentication target biometric information, and an authentication processing unit that performs authentication processing of the biometric information to be authenticated.

  Here, the predetermined processing for the plurality of pieces of biological information may be performed by superimposing the pieces of biological information to generate the authentication target biological information in which features unique to the biological body are emphasized.

  A biometric authentication system according to one embodiment of the present invention includes a biometric information acquisition device that acquires biometric information and a biometric authentication device that authenticates the biometric information acquired by the biometric information acquisition device. The biological information acquisition device includes a biological information reading device that reads biological information, and causes the biological information reading device to read the biological information a plurality of times, and performs predetermined processing on the plurality of biological information obtained by reading the biological information a plurality of times. And a biometric information processing apparatus that generates one authentication target biometric information and an authentication request output apparatus that outputs an authentication request including the authentication target biometric information generated by the biometric information processing apparatus. In addition, the biometric authentication apparatus includes a receiving unit that receives the authentication request, an authentication processing unit that authenticates authentication target biometric information included in the authentication request received by the receiving unit, and a counter that counts the number of authentication processing failures. And a biometric authentication device that rejects the authentication request when the value of the counter is equal to or greater than a predetermined value. And, in the past, when the authentication processing unit fails authentication, the past information storage unit that stores past biometric information that has failed authentication in the authentication processing unit, and the authentication target biometric information that failed in the authentication and the past Counter management for determining whether past biometric information stored in the information storage unit is identical and adding the value of the counter when the past biometric information and the authentication target biometric information are not identical A section.

  In a preferred embodiment, the reading device is a device that reads a vein pattern by irradiating the reading portion with light. The plurality of pieces of biological information may be read under a condition in which the angle or illuminance of light applied to the reading portion is different.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a configuration diagram of a biometric authentication system according to the first embodiment of the present invention. In this embodiment, a case where a finger vein pattern is used as biometric information having characteristics of a human body used for biometric authentication will be described as an example. However, this is only an example for explaining the present invention, and it can be performed using other biological information such as an iris, a fingerprint, a voiceprint, a palm shape, and a retina pattern.

  As shown in FIG. 1, the biometric authentication system according to the present embodiment includes a biometric information acquisition device 100 that acquires biometric information and an IC card 150 that is a biometric authentication device that performs biometric information authentication processing.

  The biological information acquisition apparatus 100 performs overall control of the biological information acquisition apparatus 100 and performs various determinations, calculations, and control processes, and communication processing that enables communication between the biological information acquisition apparatus 100 and an external device. Unit 102, encryption processing unit 103 that encrypts and decrypts communication data when biometric information acquisition apparatus 100 communicates with an external device or IC card 150, and irradiates light on a user's finger to be authenticated. A biometric information reading unit 104 that reads a vein pattern, a feature extraction processing unit 105 that outputs biometric information obtained by extracting features from the biometric information (hereinafter referred to as feature information), and a finger placed on the biometric information reading unit 104. A finger detection unit 106 for detecting whether or not the storage unit 107, and a retry determination unit 111 for determining whether or not a retry has been performed more than a predetermined upper limit number of retries, IC card connection enabling communication between the biometric information processing unit 112 that performs a predetermined process on the biometric information of the same part read by the body information reading unit 104 a plurality of times and outputs one piece of biometric information, and the IC card Part 113.

  The storage unit 107 is retried with the feature information 108 used in the previous authentication process, and the retry upper limit number 109 that is the upper limit number of times that the authentication is allowed to be retried when authentication fails. Each has an area for storing the number of retries 110 indicating the number of retries. The previous feature information 108 stores the feature information that failed to be authenticated when authentication failed, which will be described later. The retry count 110 is cleared when authentication is successful in the authentication process.

  An example of the finger detection unit 106 is shown in FIG. The finger detection unit 106 includes a light emitting unit 1100 and a light receiving unit 1101. Light is output from the light emitting unit 1100 to the light receiving unit 1101, and the light receiving unit 1101 outputs a signal when receiving light. When the finger is placed, the light is blocked and no signal is output from the light receiving unit 1101 to detect the finger.

  The IC card 150 includes a connection unit 151 that is a contact interface, an arithmetic processing unit 152, a storage unit 153, an authentication processing unit 156 that authenticates biometric information, and communication when the IC card 150 communicates with an external device. An encryption processing unit 157 for encrypting and decrypting data. The storage unit 153 stores authentication target user feature information 154 used for authentication and user information 155 related to the authentication target user. The feature information 154 is feature information extracted from the biometric information of the user registered in advance here.

  FIG. 2 is a diagram illustrating an example of the user information 155. The user information 155 includes a user ID 200 assigned to uniquely identify the user, a previous authentication date / time 201 indicating the date / time of the previous authentication, a registration date 202 of the feature information 154, and the previous authentication process failed. It includes feature information 203, error count 204, authentication limit count 205, and a block flag 206 indicating whether the IC card 150 is in a block state in which use is limited. In the feature information 203 that has failed in the previous authentication process, the feature information that was the authentication target when the authentication processing unit 156 failed in the authentication process is set. The IC card 150 executes a predetermined control operation according to the value of the error count 204. For example, a part or all of the processing executed by the IC card 150 is restricted, or it is assumed that unauthorized access has been received, and an alarm is output to the outside. The blocking flag 206 includes “blocking” indicating a blocking state and “normal access permitted” indicating that the blocking flag 206 is not blocking. Here, “blocking” refers to a state in which the authentication processing unit 156 does not perform authentication even when an authentication request is received.

  FIG. 3 is a diagram illustrating an example of a telegram configuration exchanged between the biometric information acquisition apparatus 100 and an external device, and a telegram configuration exchanged between the biometric information acquisition apparatus 100 and the IC card 150. As shown in FIG. 3, the messages include an authentication request message 300, an authentication request response message 310, a biometric authentication request message 320, and a biometric authentication request response message 330. Each message has a configuration in which information data is added to a message identification code or a message identification code.

  The authentication request message 300 is a message that requests biometric authentication processing from the external device to the biometric information acquisition apparatus 100. The authentication request message 300 includes a message identification code 301 indicating that it is an authentication request message 300 and signature data 302 for ensuring the authenticity of the authentication request message 300.

  The authentication request response message 310 is a message sent from the biometric information acquisition apparatus 100 to an external device as a response to the authentication request message 300. The authentication request message 300 is a message identification code 311 indicating that it is an authentication request response message 310, an authentication result 312 indicating a result of biometric authentication, and a credibility of information added to the authentication request response message 310. Includes signature data 313.

  The biometric authentication request message 320 is a message for requesting biometric authentication processing from the biometric information acquisition apparatus 100 to the IC card 150. The biometric authentication request message 320 includes a message identification code 321 indicating that it is a biometric authentication request message 320, encrypted feature information 322 to be authenticated, a retry determination result 323 by the retry determination unit 111, and a biometric authentication request. And signature data 324 for ensuring the authenticity of the information added to the message 320. When the biometric information acquisition apparatus 100 generates the biometric authentication request message 320, the encryption processing unit 103 encrypts the feature information to be authenticated, and when the IC card 150 receives the biometric authentication request message 320, the encryption processing unit 157 The encrypted feature information 322 is decrypted.

  The biometric authentication request response message 330 is a message sent from the IC card 150 to the biometric information acquisition apparatus 100 as a response to the biometric authentication request message 320. The biometric authentication request response message 330 is a message identification code 331 indicating that it is a biometric authentication request response message 330, an authentication result 332 indicating the result of biometric authentication, and the credibility of the information added to the biometric authentication request response message 330. Signature data 333 for securing. When the IC card 150 is in the blocked state, the authentication result 332 stores data indicating that the IC card 150 is in the blocked state and the authentication process has not been executed.

  Next, the processing procedure of the authentication system according to the present embodiment will be described with reference to FIGS. By the way, as a premise for performing the following processing, it is necessary to register in advance the feature information of the user to be authenticated. The location to be registered may be either the IC card 150 or the biometric information acquisition apparatus 100, or both. In the present embodiment, the feature information 154 stored in the IC card 150 corresponds to this.

  FIG. 4 is a flowchart showing in what order the biometric information acquisition apparatus 100 performs when performing biometric authentication processing by connecting the IC card 150 to the biometric information acquisition apparatus 100. First, the biometric information acquisition apparatus 100 is in a standby state waiting for an authentication request message 300 from an external device (S401). Here, when the authentication request message 300 is received from the external device (S401: Yes), it is determined whether the IC card 150 is inserted in the biometric information acquisition apparatus 100 (S402). When the IC card is not inserted (S402: No), it waits for the IC card to be inserted, and when the IC card is inserted (S402: Yes), the arithmetic processing unit 101 starts from the IC card 150. User information 155 is acquired (step S403).

  Here, with reference to the block flag 206 included in the user information 155, it may be determined whether the IC card 150 is in a block state. Since the user cannot be authenticated with this card in the closed state, the user may be notified using a display device, a sound output device, etc. (not shown).

  Next, using the finger detection unit 106, it is detected whether the finger is placed on the biological information reading unit 104 (step S404).

  When the finger is not placed on the biometric information reading unit 104, it waits for the finger to be placed (S404). When the finger is placed (S404: Yes), the biometric information reading unit 104 reads the finger vein pattern and acquires biometric information (S405). Then, it is determined whether the biological information reading unit 104 has acquired the biological information of the finger a predetermined number of times (S406). When the number of acquisitions of the biometric information has not reached the predetermined number (S406: No), the process returns to step S404 to acquire the biometric information of the finger. Here, it is preferable that the predetermined number of times the biometric information is repeatedly read is two or more. Then, when the biometric information of the finger is acquired a predetermined number of times (S406: Yes), the biometric information processing unit 112 executes a predetermined process using the biometric information for the predetermined number of times to generate one piece of biometric information. To do. For example, the biometric information processing unit 112 performs filtering on the biometric information to remove noise, or supplements data that could not be acquired. Alternatively, the biological information processing unit 112 may superimpose a plurality of pieces of biological information to remove noise, and may generate one piece of biological information in which a vein pattern unique to the living body is emphasized. Thereby, since there is little noise and high quality biometric information can be obtained, authentication using this biometric information can reduce the rejection rate.

  The biometric information generated here is biometric information to be authenticated. Although this biometric information can be used for authentication processing as it is, in this embodiment, the biometric information is not used for authentication processing, but based on the feature information extracted from the biometric information to be authenticated. Perform authentication processing. Therefore, the feature extraction processing unit 105 extracts feature information from the biometric information obtained here (S408).

  Here, the retry determination unit 111 compares the feature information of the authentication target with the previous feature information 108, and determines whether the authentication target feature information is identical to the previously acquired feature information (S409). Here, in addition to the case where the two pieces of feature information completely match, the case where the two pieces of feature information are similar to a certain degree is also identical. For example, when the matching rate of two feature information is greater than or equal to a predetermined threshold, it is determined that the feature information has the same identity. If there is no identity (S409: No), the arithmetic processing unit 101 generates a biometric authentication request message 320, transmits the generated message 320 to the IC card 150, and makes a biometric authentication request ( S410).

  On the other hand, if the two pieces of feature information are identical in step S409 (S409: Yes), the retry count 110 is incremented, and it is determined whether or not the retry count 110 is equal to or greater than the retry upper limit count 109 (S413). ). If the retry count 110 is not equal to or greater than the retry upper limit count 109 (S413: No), the process proceeds to step S410 and the process is continued. When the retry count 110 is equal to or greater than the retry upper limit count 109 (S413: Yes), the biometric information acquisition apparatus 100 adds an authentication request response message 310 to which an authentication result indicating that authentication has failed is added to the external device. Is transmitted (step S414).

  This makes it possible to detect that authentication has failed continuously with the same finger, and limit the number of times authentication is repeated using the same finger.

  Next, in response to the authentication request to the IC card 150 made in step S410, when the IC card outputs the result of biometric authentication as the biometric authentication request response message 330, the biometric information acquisition apparatus 100 receives this and biometric authentication is performed. It is determined whether or not it is successful (S411). If the authentication is successful (S411: success), the biometric information acquisition apparatus 100 transmits an authentication request response message 310 with an authentication result indicating success to the external device (step S412). On the other hand, when authentication fails (S411: failure), the biometric information acquisition apparatus 100 transmits an authentication request response message 310 with an authentication result indicating failure to the external device (step S414). Further, when the IC card 150 is closed, the biometric information acquisition apparatus 100 generates and transmits an authentication request response message 310 indicating that the IC card 150 is closed to an external device. Good.

  Next, FIG. 5 is a flowchart showing an authentication processing procedure performed when the IC card 150 receives the biometric authentication request in step S410.

  First, when the biometric authentication request message 320 is received from the biometric information acquisition apparatus 100, the arithmetic processing unit 152 refers to the user information 155 and determines whether or not the block flag 206 is “block” (S500). If the block flag 206 is “blocked” (S500: Yes), the IC card 150 rejects the authentication request and does not perform the authentication process, and sends a biometric authentication request response message 330 indicating that the block is blocked. The biometric information acquisition apparatus 100 is generated and notified (S510).

  If the block flag 206 is not “block” (S500: No), the encryption processing unit 157 decrypts the encrypted feature information 322 included in the message 320, and the authentication processing unit 156 performs authentication processing ( S501). In the authentication process, for example, the decrypted feature information is compared with the feature information 154 stored in the storage unit 153. If the two pieces of feature information have the same identity, both are regarded as biometric information of the same part of the same person, and the authentication is successful. On the other hand, if they do not have the same identity, authentication fails. Whether or not the two pieces of feature information have the same may be determined depending on whether or not the matching rate when the two pieces of information are compared is a predetermined value or more. When this biometric authentication is successful (S502: success), the IC card 150 generates and transmits a biometric authentication request response message 330 with an authentication result indicating success to the biometric information acquisition apparatus 100 (S503). Then, the previous authentication date / time 201 of the user information 155 and the biometric information are updated to the biometric information generated by the current authentication (step S504). At this time, the error count 204 is cleared.

  On the other hand, if the authentication fails (S502: failure), the feature information 203 stored in the user information 155 and failed the previous authentication is compared with the feature information of the authentication target, and both are the same part of the same person. It is determined whether the information is biometric information (S505). This determination may also be performed in the same manner as the authentication process described above. If it is recognized that the feature information to be authenticated is the same part of the same person as the feature information 203 (S505: Yes), steps S506 to S508 are skipped. When the feature information to be authenticated is not the same part as the feature information 203 that failed to be authenticated last time (S505: No), the error count 204 of the user information 155 is incremented (S506). At this time, the feature information 203 that failed in the previous authentication is overwritten with the feature information to be authenticated this time. Then, it is determined whether the error count 204 is equal to or greater than the authentication limit count 205 (S507).

  If the error count 204 is equal to or greater than the authentication limit count 205 (S507: Yes), a predetermined use limit process is performed (step S508). For example, when the number of authentication restrictions is set to 3, when the number of errors due to biometric authentication reaches 3, the IC card 150 is blocked as a use restriction process, and “blocking” indicating the blocking state is set in the blocking flag 206. To do. When the IC card 150 is closed, the authentication request is rejected unless a predetermined release process is performed. If the error count 204 is not equal to or greater than the authentication limit count 205 (S507: No), step S508 is skipped, and a biometric authentication request response message 330 with an authentication result indicating failure is transmitted to the biometric information acquisition apparatus 100 ( Step S509).

  Thereby, when the user repeatedly requests authentication for the same part, only the first time is counted as the number of errors, and the second time and later are not counted as the number of errors. Such processing is performed in order to prevent the IC card from being blocked by such continuous rejection of the identity, although the identity may be repeatedly rejected. That is, according to the present embodiment, when the principal rejection is repeated, the number of errors does not increase in the second and subsequent principal rejections, and therefore, the immediate rejection does not occur.

  In the above-described embodiment, the feature information 203 that failed authentication last time stores only one feature information that failed authentication immediately before. However, a plurality of feature information may be stored in the feature information 203. In this case, when new feature information is stored in the feature information 203, it may be updated by a so-called FIFO (First-In First-Out) procedure in which the oldest in time is deleted and then added. .

  Further, as illustrated in FIG. 4, in step S409, the feature information is compared with the feature information used in the previous authentication process, and it is determined whether or not the relevance rate is equal to or higher than a certain threshold value. The determination target may be biometric information before the feature information is extracted instead of the feature information. In step S413, it is determined whether or not the retry count 110 has reached the retry upper limit count 109, but the determination processing is necessary if retry can be performed any number of times without setting an upper limit. Absent.

  In the first embodiment, the authentication processing unit 156 that performs biometric authentication processing is provided in the IC card 150. In the second embodiment, the authentication processing unit 156 is provided in the biometric information acquisition apparatus 100. It may be done. In the case of the second embodiment, the biometric information acquisition apparatus 100 needs to read the biometric information 154 to be compared in the biometric authentication process from the IC card 150 prior to the authentication process in addition to the user information 155. Further, when reading, in order to increase security, it is necessary to encrypt the data itself of the biometric information 154 and the like to be compared in the biometric authentication process and add signature data for ensuring the authenticity of the information. However, it is not essential if there is no need to increase security.

  6 and 7 are flowcharts when the biometric information acquisition apparatus 100 includes the authentication processing unit 156 and the biometric information acquisition apparatus 100 executes the authentication process. The same steps as those in FIGS. 4 and 5 are given the same step numbers. In FIG. 6, a process of reading feature information from the IC card 150 (step S600) is further added. In FIG. 7, in the biometric information acquisition apparatus 100, biometric authentication is executed (S601), and when the authentication is successful and the authentication fails, the authentication result is notified to the IC card 150 (S602, S603). .

  FIG. 8 is a diagram illustrating a configuration of a biometric authentication system according to the third embodiment. In the present embodiment, the biometric authentication process is performed without using the IC card 150. In the first embodiment, a user information DB 801 is stored instead of the previous feature information 108 stored in the storage unit 107. Furthermore, the biometric information acquisition apparatus 100 includes an authentication processing unit 156 and performs biometric authentication processing.

  FIG. 9 is a diagram illustrating an example of the user information DB 801. The user information DB 801 has the user information 155, the biometric information 154, the retry count 110, and the retry upper limit count 109 for the number of registered users.

  FIG. 10 is a diagram illustrating a configuration of a biometric authentication system according to the fourth embodiment. In the present embodiment, configurations of the biometric information acquisition apparatus 100 and the biometric authentication server 1001 when performing biometric authentication processing using the network 1000 are illustrated. The biometric authentication server 1001 includes an authentication processing unit 1002 and a user information DB 801, and receives an authentication request from the biometric information acquisition apparatus 100 and performs authentication processing.

It is a figure which shows the structure of the biometrics authentication system which concerns on 1st Embodiment. It is a figure which shows the example of the user information 155. FIG. It is a figure which shows the example of each message | telegram structure in this embodiment. 5 is a flowchart showing a processing procedure in the biological information acquisition apparatus 100. 5 is a flowchart showing a processing procedure in the IC card 150. It is a flowchart which shows the process sequence in 2nd Embodiment. It is a flowchart which shows the process sequence in 2nd Embodiment. It is a figure which shows the structure of the biometrics authentication system which concerns on 3rd Embodiment. It is a figure which shows the example of user information DB601. It is a figure which shows the structure of the biometrics authentication system which concerns on 3rd Embodiment. 3 is a diagram illustrating an example of a configuration of a finger detection unit 106. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Biometric information acquisition apparatus 101 Arithmetic processing part 102 Communication processing part 103 Cryptographic processing part 104 Biometric information reading part 105 Feature extraction processing part 106 Finger detection part 107 Storage part 108 Authentication information 109 Retry upper limit number 110 Retry number 111 Retry determination part 112 Living body Information processing unit 113 IC card R / W unit 150 IC card 151 connection unit 152 arithmetic processing unit 153 storage unit 154 biometric information 155 user information 156 authentication processing unit 157 encryption processing unit

Claims (11)

A biometric information acquisition unit that reads biometric information and outputs biometric information to be authenticated based on the read biometric information;
An authentication processing unit for performing authentication processing of the biometric information to be authenticated;
A counter that counts the number of authentication processing failures;
In the past, a past information storage unit that stores past biometric information that has failed authentication in the authentication processing unit;
When the authentication processing unit fails in authentication, it is determined whether the authentication target biometric information that has failed in authentication and the past biometric information stored in the past information storage unit are identical, and the past biometric information and A counter management unit that does not add the value of the counter when the authentication object biometric information has identity, and adds the value of the counter when there is no identity,
The biometric authentication device , wherein the authentication processing unit performs the authentication process when the value of the counter is not equal to or greater than a predetermined value, and does not perform the authentication process when the value is equal to or greater than the predetermined value . A receiver for receiving an authentication request including the biological information, the authentication processing section for authenticating the biometric information received by the receiving unit, and a counter for counting the number of failed authentication process, the value of the counter is greater than a predetermined value If not performs authentication for the authentication request, a biometric authentication device that does not authenticated to the authentication request when a predetermined value or more,
In the past, a past information storage unit that stores past biometric information that has failed authentication in the authentication processing unit;
When the authentication processing unit fails in authentication, it is determined whether the authentication target biometric information that has failed in authentication and the past biometric information stored in the past information storage unit are identical, and the past biometric information and A biometric authentication, comprising: a counter management unit that does not add the value of the counter when the biometric information to be authenticated is identical but adds the value of the counter when there is no identity apparatus. In the past information storage unit, one piece of past biological information is stored,
The biometric authentication device according to claim 2, wherein when the counter management unit adds the count value, the authentication target biometric information is overwritten in the past information storage unit. In the past information storage unit, a plurality of past biological information is stored,
The biometric authentication according to claim 3, wherein when the counter management unit adds the count value, the biometric information to be authenticated is stored in the past information storage unit according to a FIFO (First-In First-Out). apparatus. The biometric information acquisition unit further includes a biometric information processing unit that reads the biometric information a plurality of times, performs a predetermined process on the plurality of biometric information obtained by reading the biometric information a plurality of times, and generates one authentication target biometric information. ,
The biometric authentication device according to claim 1 , wherein the authentication processing unit performs an authentication process using authentication target biometric information generated by the biometric information processing unit.   6. The biological body according to claim 5, wherein the predetermined processing for the plurality of pieces of biological information generates the authentication target biological information in which the plurality of pieces of biological information are overlapped to emphasize features unique to the biological body. Authentication device. A biometric authentication system comprising a biometric information acquisition device that acquires biometric information and a biometric authentication device that authenticates the biometric information acquired by the biometric information acquisition device,
The biological information acquisition device
A biological information reader for reading biological information;
A biometric information processing device that causes the biometric information reading device to read the biometric information a plurality of times, performs a predetermined process on the plurality of biometric information obtained by reading the biometric information a plurality of times, and generates one authentication target biometric information;
An authentication request output device that outputs an authentication request including authentication target biometric information generated by the biometric information processing device;
The biometric authentication device is:
A receiving unit that receives the authentication request; an authentication processing unit that authenticates authentication-target biometric information included in the authentication request received by the receiving unit; and a counter that counts the number of times authentication processing has failed. there when less than the predetermined value after authentication response to the authentication request, a reject biometric authentication device the authentication request when a predetermined value or more,
In the past, a past information storage unit that stores past biometric information that has failed authentication in the authentication processing unit;
When the authentication processing unit fails in authentication, it is determined whether the authentication target biometric information that has failed in authentication and the past biometric information stored in the past information storage unit are identical, and the past biometric information and A biometric authentication, comprising: a counter management unit that does not add the value of the counter when the biometric information to be authenticated is identical but adds the value of the counter when there is no identity system.   The reading device is a device that reads a vein pattern by irradiating light to a reading portion, and reads the plurality of pieces of biological information under a condition in which an angle or illuminance of light irradiated to the reading portion is different. The biometric authentication system according to claim 7. This is a method in which a biometric authentication device that performs authentication processing when the value of a counter that counts the number of authentication processing failures is not equal to or greater than a predetermined value and that does not perform authentication processing when the value is equal to or greater than a predetermined value adds the counter value. And
Outputting biometric information to be authenticated based on biometric information read by the biometric information reader;
Performing authentication processing of the output biometric information to be authenticated;
When the authentication fails, determining whether the authentication-target biometric information that failed the authentication and the past biometric information that failed in the past have identity;
A step of adding the counter value when the past biometric information and the authentication target biometric information are not identical , and adding the counter value when they are not identical. The biological information reading device further comprises a step of reading biological information from the living body multiple times ,
The step of outputting the biometric information includes performing a predetermined process on the plurality of biometric information obtained by the biometric information reading device a plurality of times to generate and output one authentication target biometric information. The biometric authentication method according to claim 9, wherein:   The biological information acquisition device
  A storage unit that stores biometric information to be authenticated last time that failed authentication in the previous authentication process in the biometric authentication device;
  Identity for determining the identity between the previous authentication target biometric information stored in the storage unit and the authentication target biometric information that is generated by the biometric information processing apparatus and that is not subjected to authentication processing in the biometric authentication apparatus A determination unit;
  When the previous authentication target biometric information and the authentication target biometric information that has not been subjected to authentication processing in the biometric authentication device are identical, the number of retries indicating the number of consecutive authentication failures in the biometric authentication device is The biometric authentication system according to claim 7, wherein if it is equal to or greater than a predetermined upper limit value, the authentication request output unit determines that the authentication has failed without outputting the authentication request.

Images