JPH10242958A - Network security system - Google Patents

Abstract

(57) [Summary] Feature data obtained from an image of an eye captured by a terminal 1 is sent to a host 3 and collated by a collation unit 24. The signature data 7 is extracted based on the identification code 6 obtained as a result. The contract is generated by attaching the signature data to a predetermined portion of the contract. The signature data is extracted for the first time using the identification code 6 as the key when the user is confirmed based on the feature data based on the image of the eyes, so that the security of the signature data extraction can be sufficiently improved.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a network security system for generating a contract with a signature or a seal through a network.

[0002]

2. Description of the Related Art In order to make a predetermined contract or the like based on a result of communication between a terminal and a host connected to a network represented by the Internet, a person operating the terminal needs a predetermined operation. A determination is made as to whether the person is qualified. This requires, for example, the input of a card number, ID number, personal identification number, etc. assigned for the transaction. However, if a malicious third party knows this kind of personal identification number or the like through a network, the personal information may be misused. Therefore, it has been considered to newly use iris data using characteristic data of an eye image for personal identification (Japanese Patent Publication No. 5-841).
No. 66).

[0003]

However, the above-mentioned conventional network security system has the following problems to be solved. When a user creates a contract while operating a terminal through a network, the contract is stamped with the user's autograph or seal. If an attempt is made to create such a signed contract through a network, it is necessary to ensure higher security for storing the signature data and processing for the signature.

[0004]

The present invention employs the following structure to solve the above problems. <Configuration 1> A data acquisition unit that acquires the characteristic data of the image of the user's eye on the terminal side, and the characteristic data and the identification code of the image of the eye of each user are transmitted from the host connected to the terminal via a network. A registered feature data storage unit registered in association with the collation unit for performing collation processing on the feature data of the eye image; a signature data storage unit registered in association with the identification code and signature data of each user; A contract generation unit that generates a contract with the contractor as a contractor, the user obtains the characteristic data of the eye image by the data acquisition unit on the terminal side for creating an arbitrary contract, and hosts the network through the network. Then, on the host side, the collation unit performs collation processing on the feature data of the eye image received from the terminal with reference to the registered feature data storage unit. The network security system contract generation unit, by referring to the signature data storage unit using the corresponding identification code and generates a signed contract.

<Structure 2> A data acquisition unit that acquires the characteristic data of the image of the user's eye and the signature data of the user on the terminal side, and a host connected to the terminal via a network connects each of the user's eyes. A registered feature data storage unit that registers image feature data in association with an identification code, a matching unit that performs a matching process on feature data of an eye image, and a contract generation that generates a contract with a user as a contractor When the user acquires the feature data of the image of the eye by the data acquisition unit on the terminal side and transfers it to the host side via the network for the purpose of creating an arbitrary contract, the collation unit on the host side, After performing collation processing on the feature data of the eye image received from the terminal side with reference to the registered feature data storage unit and confirming the identity, the contract generation unit Network security system, characterized in that the data acquisition unit signature data requesting, generating a signed contract.

<Structure 3> A network security system according to structure 1 or 2, wherein the identification code is kept secret from the user.

<Structure 4> In the structure 1 or 2, a serial number is attached to the generated contract, and a contract information storage unit for registering information on the contract including the serial number is provided. Network security system.

<Structure 5> A network according to structure 1 or 2, wherein the collation unit on the host side transmits attribute data corresponding to the characteristic data to the terminal side as a result of the collation processing, and receives the user's confirmation. Security system.

<Structure 6> In the structure 1 or 2, when the data acquisition unit acquires the characteristic data of the image of the user's eye on the terminal side and registers it in the registered characteristic data storage unit on the host side, A network security system, wherein the provided communication unit monitors the quality of the feature data received through the network, and notifies the terminal side if the quality is registrable.

<Structure 7> A network security system according to structure 1 or 2, wherein a common identification code is assigned to characteristic data of a plurality of users.

[0011]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below using specific examples. <First Embodiment> FIG. 1 is a system block diagram of a first embodiment. In this system, a terminal 1 is connected to a host 3 via a network 2 and performs a predetermined transaction. The terminal 1 includes a camera 11 for capturing an image of a user's eye, an image processing unit 12, a tablet 13,
It comprises a signature data processing unit 14 and a communication unit 15.
The data acquisition section 4 is a section for acquiring predetermined data of the user by the camera 11, the tablet 13, or the like. The image processing unit 12 is a part that processes image data based on the output of the camera 11 and obtains predetermined characteristic data. The tablet 13 is a device for inputting a handwritten signature, a shadow of a seal, and the like. The signature data processing unit 14 is a unit that processes data input by the tablet 13, converts the data into an image, and sends the image to the communication unit 15. The communication unit 15 communicates with the host 3 via the network 2.
It is composed of a communication control unit for communicating with the device.

A similar communication unit 21 is also provided on the host 3 side. In addition, the host 3 also includes a registered feature data storage unit 22, a signature data storage unit 23, a collation unit 2
4. A contract generator 25 and a contract information storage 26 are provided. The registered feature data storage unit 22 stores an identification code 6 corresponding to each feature data in addition to the feature data 5 registered in advance as that of the user. The identification code 6 may be a combination of characters such as an ID number and a symbol. The signature data storage unit 23 stores the signature data 7 and the identification code 6.
The signature data 7 is image data relating to the sign of the user and the shadow of the seal.

The identification code 6 is assigned in correspondence with the signature data. The identification code 6 is stored in the registered feature data storage unit 2 so as to correspond to the feature data of the same person.
The same code as the identification code 6 of No. 2 is used. That is, the identification code 6 corresponding to the characteristic data of a certain user
Is the same as the identification code 6 attached to the signature data 7 of the same person in the signature data storage unit 23. The matching unit 24 refers to the registered feature data storage unit 22 using the feature data received from the communication unit 21 and performs a matching process. In this matching process, the similarity between the registered feature data and the feature data to be compared is determined. If the similarity is more than a certain degree, this processing is performed according to the request of the person having the registered feature data. Is determined to have been made.

The contract document generation unit 25 includes the signature data storage unit 2
This is a part for performing a process of pasting the signature data 7 taken out from 3 into a signature field of a corresponding contract and generating a contract. The contract information storage unit 26 is a part for storing information related to a contract in a format described later.

The data registration processing of the system according to the present invention will be described with reference to FIG. This figure is a sequence chart of a data registration process before operating the system of the present invention. In order to operate the system shown in FIG. 1, it is necessary to register the feature data 5 in the registered feature data storage unit 22 of the host 3 and the signature data 7 in the signature data storage unit 23 in advance. This figure shows the procedure. First, terminal 1
After establishing a connection between the terminal 3 and the host 3, when the terminal 1 issues a feature data registration request to the host 3 (step S <b> 1), an instruction to shoot an image of the eye is output from the host 3 to the terminal 1. (Step S2). The terminal 1 captures an image of the user's eyes using the camera 11 shown in FIG. 1 (step S3). The feature data such as iris data obtained from the eye image is transmitted from the terminal 1 to the host 3 (step S4).

When receiving the characteristic data, the host 3 notifies the terminal 1 of a reception confirmation (step S5). In step S6, the host 3 performs a feature data registration process. At this time, an identification code is added to the feature data and stored. In the next step S7, the host 3 requests the terminal 1 for signature data. The terminal 1 acquires the signature data relating to the user's signature and the shadow of the seal using the tablet 13 shown in FIG. 1 (step S8). The signature data thus obtained is transmitted from the terminal 1 to the host 3 in step S9. The host 3 receives the signature data and registers the signature data using the same identification code used for registering the characteristic data (step S10). Thus, predetermined data registration is performed in the registration feature data storage unit 22 and the signature data storage unit 23 shown in FIG.

FIG. 3 shows a processing flowchart of the host of the first embodiment. In the specific example 1, when the user intends to make a contract, the feature data of the image of the eye is sent to the host, and when the identity is confirmed, the signature registered in the host is reflected in the contract. For this purpose, the host performs predetermined procedure processing in step S1 shown in FIG. 3 in advance. This is a procedure for inputting predetermined items on the assumption that a contract is prepared. In step S2, the host requests the terminal to capture an image of the eye. The terminal acquires the characteristic data and transmits it to the host. Upon receiving this feature data in step S3, the host proceeds to step S4 and refers to the registered feature data storage unit 22.

The collating unit 24 obtains the identification code 6 corresponding to the relevant feature data 5 by this reference. The registered feature data storage unit 22 stores the feature data 5
In addition to the identification code 6 corresponding to the attribute data 5, attribute data corresponding to the characteristic data 5 is also stored. Therefore, the attribute data, for example, the name, address, telephone number, and other data of the user are transmitted to the terminal (step S5). In step S6, the user checks the contents of the data at the terminal, and sends a predetermined response to the host when it is determined that the data is correct. When the host receives this response, it is determined in step S7 whether the content of the response is OK. If there is an error in the collation result, the process ends. As a result of matching,
If it is determined that there is no mistake, the process proceeds to step S8, and the signature data storage unit 23 is referred to using the corresponding identification code 6 read from the registered feature data storage unit 22. Thus, the corresponding signature data 7 is extracted. Thus, in step S9, the contract generation unit 25 pastes the extracted signature data to a predetermined portion of the contract to generate a contract.

FIG. 4 shows an explanatory diagram of an example of a contract. As shown in the figure, an arbitrary contract 18 is, for example, a contract
5, only the necessary types are stored. Any type of contract is selected during the contract creation process. When the contract procedure is completed and the identity is confirmed using the characteristic data of the image of the eye, the signature data 30 is printed at a predetermined place of the contract 18 as shown in FIG. Here, the signature data 30 is composed of the seal stamp data 31 and the signature data 32. Either one of them may be used.

<Effect of Specific Example 1> The host 3 stores the feature data of the eye image, the identification code, and the signature data in association with each other, and performs identity verification using the feature data of the eye image. Only when it is determined that there is, signature data is reflected on the contract. This makes it possible to create a contract through a network with high reliability.

When the communication unit 21 of the host 3 receives characteristic data of a quality sufficient for registration at the time of registering the characteristic data of the eye image, for example, a beep sound, a sound, With a configuration in which the notification is made by using means such as light and message screen display, the terminal 1 does not need to perform the focusing of the camera 11 or the confirmation of the content of the acquired characteristic data. That is, the user's eye is automatically photographed, and the obtained feature data is transmitted to the host side, and the host only has to wait for a response from the host side. The user can perform complicated focusing, evaluation of the photographed image, and the like. There is no need to do this, and the burden on the user is reduced.

If the identification code is kept secret from the user, managing the feature data and signature data of the eye image using the identification code improves the security of data management on the host side. .

FIG. 5 is an explanatory diagram of the contract information. In the above specific example, as shown in this figure, a serial number is attached to the contract, and contract information in which the serial number is associated with the attribute of the contract is generated. This contract information is stored in the contract information storage unit 26 shown in FIG. In this way, for example, when the contract is presented using paper and the inquiry is performed, the authenticity of the contract can be confirmed by the serial number.
For this reason, it is possible to prevent the creation of an illegal contract.

Further, for example, when a predetermined contract is made, if there are a plurality of persons who have a representative right or a proxy right to sign the contract, the signature data can be pasted even if any of these persons makes a request. Can be. For example, the combination of the feature data 5 and the identification code 6 stored in the registered feature data storage unit 22 is set so that the same identification code 6 is assigned to the feature data of a plurality of users. As a result, for example, a contract with a company name can be signed by an employee, president, or the like having a predetermined representative right.

<Specific Example 2> In Specific Example 1, feature data and signature data are registered in the host in advance. On the other hand, in this specific example 2, only the characteristic data is registered, and the signature data is accepted each time. FIG. 6 shows a processing flowchart of such a host of the specific example 2. The processing of steps S1 to S7 shown in FIG.
Is the same as the processing of the specific example 1 shown in FIG. That is, contract procedure processing, photographing of the eye, reception of the characteristic data and collation processing are performed, and a response on the terminal side is obtained. Here, when the response from the terminal is OK in step S7, in step S8,
The host requests the signature data from the terminal. That is, in response to this, the terminal acquires the user's signature data each time,
Forward to host. In the host, in step S9, the signature data is received from the terminal, and the contract generation unit pastes the signature data into the contract (step S10).

<Effect of Embodiment 2> According to this embodiment,
There is no need to store all the user's signature data on the host side, and the storage capacity can be reduced. On the other hand, if signature data of all users is registered in advance as in the first embodiment, signature data can be verified in addition to verification using feature data based on eye images. , You can identify yourself with higher security.

<Specific Example 3> In this example, the authenticity of signature data is more reliably determined to prevent plagiarism. FIG. 7 is a block diagram of a main part of a system according to the third embodiment. The feature of this system is that a used signature data storage unit 28 as shown in the figure is added to the system of FIG. The used signature data storage unit 28 stores all signature data used by the user in past transactions. Here, for example, when the user transmits the signature data to the host using the terminal, the signature data input each time is stored in the used signature data storage unit 28. For example, a person who steals signature data via a network and intends to abuse the signature data stores the signature data transmitted in the past through the network in a memory or the like, and requests creation of a contract or the like using the signature data. . However, since the signature data is originally input manually by the user using a tablet or the like each time, it is unlikely that the same data as in the past is obtained. Therefore, if the same signature data as in the past is input, it is determined that the signature data has been misused, and the creation of a contract can be refused.

FIG. 8 shows a system operation flowchart of the third embodiment. First, the first half of this process is the same as steps S1 to S8 in the description of the specific example 2 in FIG. In step S21 corresponding to step S9 in FIG. 6, when the signature data is received from the terminal,
The collating unit 24 of the host 3 refers to the used signature data storage unit 28 shown in FIG. 7 to determine whether the same signature data exists. And if there is a match,
The process proceeds from step S23 to a procedure for canceling the process. On the other hand, if there is no match, the process moves from step S23 to step S24 to store the signature data. That is, this signature data is stored again in the used signature data storage unit 28 and used for the next transaction security confirmation. Step S2
When the process of step 4 is completed, the process proceeds to a normal contract creation process.

<Effect of Specific Example 3> As described above, by inputting signature data each time a contract is created, by confirming that the data has never been used in the past, More secure anti-piracy processing becomes possible. Further, in this case, a large-capacity storage device for storing all the signature data is not required, so that the host-side system cost can be reduced.

[Brief description of the drawings]

FIG. 1 is a system block diagram of a specific example 1.

FIG. 2 is a data registration processing sequence chart.

FIG. 3 is a processing flowchart of a host of a specific example 1.

FIG. 4 is an explanatory diagram of an example of a contract.

FIG. 5 is an explanatory diagram of contract information.

FIG. 6 is a processing flowchart of a host according to a specific example 2.

FIG. 7 is a block diagram of a main part of a system according to a third embodiment.

FIG. 8 is a system operation flowchart of a specific example 3;

[Explanation of symbols]

 Reference Signs List 1 terminal 2 network 3 host 4 data acquisition unit 11 camera 12 image processing unit 13 tablet 14 signature data processing unit 22 registered feature data storage unit 23 signature data storage unit 24 verification unit 25 contract generation unit 26 contract information storage unit

──────────────────────────────────────────────────の Continuation of front page (51) Int.Cl. ⁶ Identification code FI G09C 1/00 640 A61B 5/10 320Z G06F 15/62 465P

Claims (7)

[Claims] A data acquisition unit for acquiring characteristic data of an image of a user's eye on a terminal side; and a host connected to the terminal via a network, the characteristic data of the image of an eye of the user and an identification code. Registered feature data storage unit registered in association with, a matching unit that performs a matching process on the feature data of the eye video, a signature data storage unit registered in association with the identification code and signature data of each user, A contract generation unit that generates a contract with the user as a contractor.The user acquires the characteristic data of the eye image by the data acquisition unit on the terminal side to create an arbitrary contract, and through the network When the data is transferred to the host, the collating unit performs collation processing on the feature data of the eye image received from the terminal with reference to the registered feature data storage unit. And a contract generation unit that generates a signed contract with reference to the signature data storage unit using the corresponding identification code. 2. A data acquisition unit for acquiring, on a terminal side, characteristic data of an image of a user's eye and signature data of the user, and a host connected to the terminal via a network. A registered feature data storage unit in which feature data and an identification code are registered in association with each other, a matching unit that performs a matching process on feature data of an eye image, and a contract generation unit that generates a contract with a user as a contractor. When the user acquires the characteristic data of the eye image by the data acquisition unit on the terminal side to create an arbitrary contract and transfers it to the host side via the network, the collation unit on the host side After performing collation processing with reference to the registered feature data storage unit for the feature data of the eye image received from the user and confirming the identity, the contract creation unit transmits the data on the terminal side. A network security system that requests signature data from a data acquisition unit and generates a signed contract. 3. The network security system according to claim 1, wherein the identification code is kept secret from a user. 4. The contract according to claim 1, wherein a serial number is attached to the generated contract, and a contract information storage unit for registering information on the contract including the serial number is provided. Network security system. 5. The network security according to claim 1, wherein the collation unit on the host side transmits attribute data corresponding to the characteristic data to the terminal side as a result of the collation processing, and receives the user's confirmation. system. 6. The data acquisition unit according to claim 1, wherein the data acquisition unit acquires the feature data of the image of the user's eye on the terminal side and registers the feature data in the registered feature data storage unit on the host side. A communication unit that monitors the quality of the feature data received through the network and, if the quality is registrable, notifies the terminal side of the quality. 7. The network security system according to claim 1, wherein a common identification code is assigned to characteristic data of a plurality of users.