JP5409081B2 - Terminal device including biometric authentication device and biometric authentication system - Google Patents

Description

  The present invention relates to a terminal device including a biometric authentication device and a biometric authentication system using the terminal device.

  In recent years, a system for performing login for authenticating an individual using user's biometric information (fingerprint, finger vein, iris, face, voiceprint, etc.) has become widespread. Examples of such a system include those described in Patent Literature 1 and Patent Literature 2.

  Patent Document 1 describes a system having a server and a plurality of terminal devices connected to the server. The terminal device includes a biometric information reading device, transmits the biometric information of the user read by the biometric information reading device to the server, searches biometric information registered in the server, and performs biometric authentication.

  Patent Document 2 describes a system having a server and a plurality of authentication devices connected to the server. The server records a list of authentication devices that transfer the registered biometric information to each terminal, and the biometric information registered by one authentication device is stored in another list based on the list recorded in the server. Transferred to the authentication device. The user can perform biometric authentication with any authentication device to which biometric information is transferred.

JP 2008-108035 A JP 2006-99607 A

  The system described in Patent Document 1 uses all biometric information recorded in the server during biometric authentication as a search target. Therefore, the greater the number of biometric information stored in the server, the slower the authentication speed. Further, since authentication is performed within the server, biometric authentication cannot be performed when the connection between the terminal device and the server is offline.

  On the other hand, since the biometric information is recorded in the authentication device, the system described in Patent Document 2 can perform biometric authentication regardless of the connection between the authentication device and the server. However, since biometric information is not registered in the server and transfer between terminals is assumed, whether transfer is possible depends on the activation state of the transfer source terminal (terminal used for registration). Further, the change of the user registered in the authentication device is not considered, and there is no description about the change of the list of the authentication device that transfers the biometric information recorded in the server.

  In order to achieve the object of the present invention, biometric information of a user of the system and a terminal to which the biometric information is distributed are associated with each other and recorded on a server. That is, in the server, a user-specific user ID, the user's biometric information, and a terminal name to which the user's biometric information is distributed are recorded in association with each other. The terminal name can be specified when the user registers biometric information, and can be changed later according to the usage status of the user.

  Distribution of the user's biometric information from the server device to the terminal device is performed when the terminal device is activated (or when the biometric authentication processing program stored in the terminal device is started). The terminal device that has received the user's biometric information records the biometric information in a biometric authentication device connected to the terminal device, and prepares for the user's login.

  In addition, the user biometric information recorded at the time of biometric authentication is deleted when the terminal device is shut down (or at the end of the biometric authentication processing program stored in the terminal device).

  With the above configuration, when a user logs in, since biometric authentication is performed using the biometric information of a specific user recorded in the biometric authentication device, when biometric information of all users recorded in the server device is collated Compared with this, processing can be performed in a much shorter time, and biometric authentication is possible even when the connection with the server is offline during authentication.

  In addition, since the biometric information as a master is registered in the server, it can be distributed even if the terminal used for registration is not activated, and the biometric information of the user recorded in the server is distributed. Since the terminal name can be changed, the system can be operated according to the user's usage status.

  Furthermore, the risk of information leakage due to theft of the device can be reduced by deleting the biometric information when the terminal device is shut down.

1 is an external view of a system in Embodiment 1. FIG. It is a functional block diagram of a server device, a terminal device, and a biometric authentication device. It is the figure which showed the data table of the database. 3 is a diagram illustrating a data table in a memory 330. FIG. It is a flowchart at the time of new user registration. It is a flowchart when delivering a user's biometric information to a biometrics authentication apparatus. It is a flowchart at the time of login. It is a flowchart when deleting a user's biometric information from the memory in a biometrics authentication apparatus. It is a flowchart in the case of changing the terminal which delivers biometric information. It is the figure which showed the menu screen. It is the figure which showed the new user registration screen. It is the figure which showed the registration screen of biometric information. It is the figure which showed the data update at the time of biometric information registration. It is the figure which showed the data update at the time of biometric information delivery. It is the figure which showed the login screen. It is the figure which showed the reading screen of biometric information. It is the figure which showed the login success screen. It is the figure which showed the login failure screen. It is the figure which showed the data update at the time of biometric information deletion. It is the figure which showed the delivery terminal change screen. It is the figure which showed the data update at the time of a delivery terminal change.

  The first embodiment of the present invention will be described in detail. The biometric authentication system in the present embodiment is configured by a server device that records user biometric information connected via a network, a plurality of terminal devices, and a biometric authentication device connected to the terminal device. The

  First, an outline of the present embodiment will be described.

  The terminal device requests the server device to distribute the biological information of the user after a certain time has elapsed since the power supply of the terminal device, which will be described later, or when the time set in the schedule in advance is reached. The distribution request includes a terminal name (such as a number for identifying a terminal device).

  The server device that has received the distribution request distributes the biometric information of the user of the terminal device to the terminal device that has transmitted the distribution request. The distributed biometric information is stored in a biometric authentication device connected to the terminal device. This makes it possible to log in using biometric authentication with the terminal device. Note that the biometric information stored in the biometric authentication device is deleted when the terminal device is shut down or at a time set in advance in the schedule.

  Next, this embodiment will be described in detail.

  FIG. 1 is an external view of a system in the present embodiment. This system includes a server device 100, a plurality of terminal devices 200 (200a, 200b, 200c, 200d), and a biometric authentication device 300 (300a, 300b, 300c, 300d) connected to the terminal device 200. The network 400 is connected. The server device 100 is a device that records biometric information of all users of this system, and records biometric information of each user and identification information of a terminal device that distributes the biometric information in association with each other. As the terminal device 200 in the present embodiment, it is assumed that a user authenticated by a personal computer (PC) logs in, but other devices (for example, an automatic transaction device, a terminal for a staff member for a sales office, a key) It can also be applied to management devices. The biometric authentication device 300 connected to the terminal device 200 stores the user's biometric information transmitted from the server device 100.

  FIG. 2 is a functional block diagram of the server device 100, the terminal device 200, and the biometric authentication device 300. The server device 100 includes a server control unit 110, a database 120, and a terminal device communication unit 130. The server control unit 110 that controls the server device 100 includes a database management program 111 and a communication control program 112. The database management program 111 reads data in the database 120 and writes data into the database 120. The communication control program 112 controls the terminal device communication unit 120. The database 120 records the biometric information of the user and the identification information (terminal name) of the terminal to which the biometric information is distributed in association with each other. The terminal device communication unit 130 transmits data to the terminal device 200 and receives data from the terminal device 200.

  FIG. 3 is a diagram showing a data table of the database 120. The data recorded in the database 120 includes the user ID 121 for identifying the user, the password 122, the user's biometric information 123, the terminal name 124 to which the biometric information 123 is distributed, and the biometric information 123. A distribution status 125 indicating whether or not there is. The distribution status 125 is recorded in association with the terminal name 124, and is “completed” when the biological information is distributed to the terminal device, and “uncompleted” when the distribution is not performed.

  Returning to FIG. 2, the terminal device 200 includes a terminal device control unit 210, a server communication unit 220, an authentication device communication unit 230, a display unit 240, an input unit 250, a memory 260, and a disk 270. ing. The terminal device control unit 210 that controls the terminal device 200 includes a biometric authentication processing program 211 that is used during biometric authentication using the biometric authentication device 300. The server communication unit 220 transmits data to the server device 100 and receives data from the server device 100. The authentication device communication unit 230 transmits data to the biometric authentication device 300 and receives data from the biometric authentication device 300. The display unit 240 (display or the like) displays a user operation guide and a biometric authentication result. The input unit 250 (keyboard or the like) is used for user operations. The memory 260 temporarily records data input from the input unit 250. The disk 270 includes the terminal name (IP address or the like) of the terminal device 200.

  The biometric authentication device 300 includes an authentication device control unit 310, a terminal device communication unit 320, a memory 330, and a biometric information read unit 340. The authentication device control unit 310 controls the biometric authentication device 300. The terminal device communication unit 320 transmits data to the terminal device 200 and receives data from the terminal device 200. The memory 330 stores biometric information distributed from the server device 100. The biometric information lead unit 340 is, for example, a camera that reads the biometric information of the user.

  FIG. 4 is a diagram illustrating a data table in the memory 330. Data recorded in the memory 330 includes a user ID 331 of the user of the terminal device 200 connected to the biometric authentication device and biometric information 332 of the user.

  Next, the processing flow of this system will be described. For convenience of explanation, (A) new user registration (FIG. 5), (B) biometric information distribution (FIG. 6), (C) biometric authentication (FIG. 7), (D) biometric information deletion (FIG. 8), (E) The description will be divided into five flows at the time of changing the terminal that distributes biometric information (FIG. 9).

(A) Flow at New User Registration FIG. 5 is a flowchart at the time of new user registration.

  The terminal device control unit 210 displays the menu screen of FIG. 10 on the display unit 240 (S101). After the user selects the “new user registration” key 501 in the input unit 250, the terminal device control unit 210 causes the display unit 240 to display the new user registration screen of FIG. 11 (S102). The new user registration screen includes a user ID input field 601, a password input field 602, and a terminal name input field 603 for distributing biometric information. A plurality of terminal names for distributing biometric information can be specified. As an example, FIG. 11 is a diagram illustrating a case where a user with a user ID “0001” inputs “PC1”, “PC2”, and “PC3” as a terminal name for distributing biometric information. The user ID, password, and terminal name input by the user via the input unit 250 are recorded in the memory 260 (S103).

  Thereafter, the terminal device control unit 210 causes the display unit 240 to display the biometric information registration screen of FIG. 12 (S104), and transmits a biometric information reading instruction to the biometric authentication device 300 (S105). Upon receiving the biometric information reading instruction, the authentication device control unit 310 instructs the biometric information read unit to read the biometric information. The biometric information lead unit 340 that has received the instruction reads the biometric information of the user from the living body (for example, a finger) held by the user (S106). The authentication device control unit 310 transmits the read biological information to the terminal device 200 (S107). The terminal device control unit 210 that has received the biological information transmits the biological information, the user ID, password, and terminal name recorded in the memory 260 to the server device 100 (S108).

  The server control unit 110 that has received the data transmitted from the terminal device 200 records the data in the database 120 (S109). FIG. 13 is a diagram showing an example of data update recorded in the database 120 at the time of biometric information registration. The biometric authentication device 300 reads the user ID “0001”, the password “abcde”, the terminal names “PC1”, “PC2”, “PC3” that deliver the biometric information, which are input on the new user registration screen shown in FIG. Data of 701a to 701c is added from the biological information “aaaaaa”. At this time, the distribution status 125 of each biometric information is set to “uncompleted”.

(B) Flow during Distribution of Biometric Information FIG. 6 is a flowchart when distributing the biometric information of the user to the biometric authentication device 300.

  The terminal device control unit 210 transmits a user biometric information distribution request to the server device 100 (S201). The distribution request includes the terminal name recorded on the disk 270. For example, the distribution request is transmitted after a certain period of time (eg, 10 seconds) after the terminal device 200 is activated (or the biometric authentication processing program 211 is started). Or send it at a time set in advance as a schedule.

  The server control unit 110 that has received the distribution request searches the data recorded in the database 120 for data in which the terminal name 124 is the same as the terminal name included in the distribution request (S202). When there is no data in which the terminal name 124 is the same as the terminal name included in the distribution request (N in S203), data distribution to the terminal device 200 is not performed. On the other hand, when the data is present (Y in S203), the user ID and the biometric information of the data whose distribution status 125 is “incomplete” among the data are transmitted to the terminal device 200 (S204).

  The terminal device control unit 210 stores the received user ID in the memory 260 (S205). Also, the terminal device control unit 210 transmits the received user ID and biometric information to the biometric authentication device 300 (S206). The authentication device control unit 310 records the received user ID and biometric information in the memory 330 (S207). The received user ID is recorded in the user ID 331, and the received biometric information is recorded in the biometric information 332. Thereafter, a biometric information registration completion notification is transmitted to the terminal device 200 (S208).

  Upon receiving the biometric information distribution completion notification, the terminal device control unit 210 transmits the biometric information registration completion notification, the user ID recorded in the memory 260, and the terminal name recorded on the disk 270 to the server device 100. (S209).

  The server control unit 110 changes the distribution status 125 of the distributed data from “incomplete” to “completed” from the data recorded in the database 120 (S210). FIG. 14 is a diagram showing an example of data update recorded in the database 120 at the time of biometric information distribution. The server apparatus 100 that has received the biometric information distribution request from the terminal apparatus 200 having the terminal name “PC3” has the terminal name 124 of “PC3” from the data recorded in the database 120 and the distribution status “ The user IDs “0001” and “0003” of the data 801a and 801b which are “unfinished” and the biometric information “aaaaaa” and “ccccc” are distributed to the terminal device. After receiving the registration completion notification of the biometric information from the terminal device, the distribution status 801c and 801d of the distributed data is changed from “incomplete” to “completed”.

(C) Flow at Login FIG. 7 is a flowchart at login.

  The terminal device control unit 210 displays the menu screen illustrated in FIG. 10 on the display unit 240 (S301). After the user selects the “login” key 502 using the input unit 250, the terminal device control unit 210 causes the display unit 240 to display the login screen illustrated in FIG. 15 (S302). The login screen includes a user ID input field 901 and a password input field 902. The user ID input by the user through the input unit 250 is recorded in the memory 260 (S303). Thereafter, the terminal device control unit 210 transmits the input user ID and password to the server device 100 (S304).

  The server control unit 110 that has received the user ID and password refers to the data recorded in the database 120 and determines whether the correct password has been input (S305). If the password is correct (Y in S305), a biometric authentication instruction is transmitted to the terminal device 200 (S306). On the other hand, if the password is wrong (N in S305), the fact that login has failed is transmitted to the terminal device 200 (S307).

  Upon receiving the biometric authentication instruction from the server apparatus 100, the terminal apparatus control unit 210 displays the biometric information reading screen illustrated in FIG. 16 on the display unit 240 (S308), and transmits the biometric information reading instruction to the biometric authentication apparatus 300. (S309). Upon receiving the biometric information reading instruction, the authentication device control unit 310 instructs the biometric information read unit to read the biometric information. The biological information lead unit 340 that has received the instruction reads the biological information held by the user (S310). The authentication device control unit 310 searches for the read biometric information in the biometric information 332 recorded in the memory 330 (S311). When the read biometric information exists (Y in S311), the user ID 331 in the memory 330 is referred to, and the user ID recorded in association with the biometric information is transmitted to the terminal device 200 (S312). . On the other hand, when the read biometric information does not exist (N in S307), the fact that the authentication has failed is transmitted to the terminal device 200. (S313).

  When the authentication is successful and the terminal device control unit 210 receives the user ID, the received user ID is compared with the user ID recorded in the memory 260. If the two user IDs match (Y in S314), the login success screen shown in FIG. 17 is displayed on the display unit 240 (S315). On the other hand, if the two users do not match (N in S314), the login failure screen shown in FIG. 18 is displayed on the display unit 240 (S316). Also when the terminal device control unit 201 receives the fact that the login failed transmitted in S307 or the fact that the authentication failed transmitted in S313, the login failure screen shown in FIG. 18 is displayed. It is displayed on the part 240 (S316).

(D) Flow when Deleting Biometric Information FIG. 8 is a flowchart for temporarily deleting the biometric information of the user from the memory 330 in the biometric authentication device 300. For example, a case where the user of the terminal temporarily stops using the terminal is applicable.

  The terminal device control unit 210 transmits a user's biometric information deletion command (hereinafter referred to as a “biometric information deletion command”) to the biometric authentication device 300 (S401). The biometric information deletion command is transmitted, for example, when the terminal device 200 is shut down (or when the biometric authentication processing program 211 ends) or at a time set in advance as a schedule.

  Upon receiving the biometric information deletion command, the authentication device control unit 310 deletes the biometric information recorded in the memory 330 (S402), and the fact that the biometric information has been deleted (hereinafter referred to as “biometric information deletion completion data”). Is transmitted to the terminal device (S403).

  The terminal device control unit 210 that has received the biometric information deletion completion data transmits the biometric information deletion completion data and the terminal name recorded on the disk 270 to the server device 100 (S404).

  Receiving the biometric information deletion completion data and the terminal name, the server control unit 110 searches the data recorded in the database 120 for data including the terminal name received in the terminal name 125 (S405), and distributes the data. The status 125 is changed from “completed” indicating the state before distribution to “uncompleted” (S406).

  FIG. 19 is a diagram illustrating an example of updating data recorded in the database 120 when deleting biometric information. When receiving the biometric information deletion completion data from the terminal device 200 having the terminal name “PC3”, the server control unit 110 changes the distribution statuses 1001a and 1001b of the data whose terminal name 125 is “PC3” from “Done” to “Done”. Change to “Not done”.

  In the above description, the biometric information is deleted from the memory 330 of the biometric authentication device 300 when the user of the terminal temporarily stops using the terminal. However, the memory 330 is a tamper-resistant nonvolatile memory. In some cases, it is possible to adopt a configuration in which the biometric information of the user once distributed from the server device 100 is not deleted. In this case, among the biometric information of the user recorded in the database 120, information that is newly registered and never distributed to the terminal device is distributed.

(E) Flow for Changing Terminal for Distributing Biometric Information FIG. 9 is a flowchart for changing a terminal for distributing biometric information.

  The terminal device control unit 210 displays the menu screen illustrated in FIG. 10 on the display unit 240 (S501). After the user selects the “change available terminal” key 503 via the input unit 250, the terminal device control unit 210 causes the display unit 240 to display the login screen illustrated in FIG. 15 (S502). The user ID and password input by the user via the input unit 250 are transmitted to the server apparatus 100 (S503).

  The server control unit 110 that has received the user ID and password refers to the data recorded in the database 120 and determines whether the correct password has been input (S504). If the password is wrong (N in S504), the fact that the login has failed is transmitted to the terminal device 200 (S505). The terminal device control unit 210 that has received the login failure message displays the login failure screen illustrated in FIG. 18 on the display unit 240 (S506).

  On the other hand, if the password is correct (Y in S504), the server control unit 110 searches the data recorded in the database 120 for data that is the same as the user ID received by the user ID 121 (S507). The terminal name of the data is transmitted to the terminal device 200 (S508). The terminal device control unit 210 that has received the terminal name displays the distribution terminal change screen illustrated in FIG. 20 on the display unit 240 (S509). The distribution terminal change screen includes a terminal name input field 1101 for distributing biometric information. After the user inputs a terminal name for distributing biometric information via the input unit 250, the terminal device control unit 210 transmits the terminal name input by the user to the server device 100 (S510). Upon receiving the terminal name input by the user, the server control unit 110 updates the data recorded in the database 120 (S511).

  FIG. 21 is a diagram showing an example of data update recorded in the database 120 when the distribution terminal is changed. When the user whose user ID is “0001” changes the terminal name for distributing biometric information from “PC1”, “PC2”, “PC3” to “PC1,” “PC2,” “PC4”, it is recorded in the database 120. Data update is performed by replacing the data 1201a with the data 1201b.

  In addition, although demonstrated as what changes the terminal which distributes biometric information, it can also be set as the structure which adds and deletes the terminal which distributes biometric information.

  As described above in the flow of A to E, in the case of the biometric authentication system described in the present embodiment, the biometric information to be searched at the time of biometric authentication is limited to the biometric information of the user of the terminal device, and the authentication speed It is possible to speed up. In addition, since the terminal name to which the user's biometric information recorded in the server is distributed can be changed, the system can be operated in accordance with the usage situation of the user. Furthermore, the risk of information leakage can be reduced by deleting biometric information when the terminal device is shut down.

DESCRIPTION OF SYMBOLS 100 ... Server apparatus, 110 ... Server control part, 111 ... Database control program, 112 ... Communication control program, 200 ... Terminal apparatus, 210 ... Terminal apparatus control part, 211 ... Biometric authentication processing program, 220 ... Server communication part, 230 ... Authentication device communication unit, 240 ... display unit, 250 ... input unit, 260 ... memory, 270 ... disk, 300 ... biometric authentication device, 310 ... authentication device control unit, 320 ... terminal device communication unit, 330 ... memory, 340 ... biometric Information lead part, 400 ... network

Claims (8)

A biometric authentication system comprising a server device, a plurality of terminal devices, and a biometric authentication device connected to each terminal device,
The server device includes a database unit that records and records biometric information of a user and identification information of a terminal device that can be used by the user, and a server control unit that controls the database unit,
The terminal device can transmit and receive data when the terminal device is turned on, the biometric authentication processing program of the terminal device is started, or when a preset time is reached A communication feasibility judging means for judging that it is a terminal device control section for controlling the communication feasibility judgment means ,
The biometric authentication device includes a biometric information read unit that reads biometric information, a storage unit that stores biometric information, and an authentication device control unit that controls the biometric information read unit and the storage unit.
The terminal device control unit transmits identification information of the terminal device to the server device after it is determined by the communication capability determination means that data can be transmitted and received,
The server control unit transmits a plurality of biological information corresponding to the transmitted identification information to the terminal device among the biological information recorded in the database unit,
The terminal device control unit transmits the biometric information received from the server device to the biometric authentication device,
The authentication device control unit records the biological information in the storage unit,
A biometric authentication system that compares biometric information read by the biometric information read unit with biometric information recorded in the storage means during biometric authentication. The biometric authentication system according to claim 1,
Each of the terminal devices further includes a biometric information deletion enable determination unit that determines whether to delete the biometric information in the storage unit of the authentication device connected to the terminal device,
The biometric authentication system, wherein the biometric information deletion enable determination means deletes the biometric information stored in the storage means after determining that the biometric information can be deleted. The biometric authentication system according to claim 2,
The biometric information deletion possibility judging means judges that the terminal device shuts down, that the biometric authentication processing program of the terminal device has ended, or that a preset time has come. Biometric authentication system. The biometric authentication system according to any one of claims 1 to 3,
When newly registering biometric information using the biometric authentication device,
The biometric information read unit of the biometric authentication device reads user biometric information,
The biometric authentication system, wherein the terminal device control unit transmits biometric information read by the biometric information read unit and identification information of a terminal device usable by a user to the server device. A terminal device that communicates with a server device and a biometric authentication device,
Data can be transmitted / received when the biometric authentication processing program and the terminal device are turned on, the biometric authentication processing program is activated, or a preset time is reached. A communication feasibility judging means for judging the biometric authentication processing program and the communication feasibility judging means,
The communication capability determining means transmits the identification information of the terminal device to the server device after determining that data can be transmitted and received,
The terminal device control unit receives, from the server device, a plurality of pieces of biometric information recorded in association with the transmitted identification information among the biometric information recorded in the server device, and sends the biometric authentication device to the biometric authentication device. A terminal device for transmitting. The terminal device according to claim 5 ,
Furthermore, it has a biometric information deletion possible judgment means for judging whether or not to erase the biometric information in the storage means of the biometric authentication apparatus connected to the terminal device,
The biometric information deletion enable determination means deletes the biometric information stored in the storage means after determining that the biometric information can be deleted. The terminal device according to claim 6,
The biometric information erasable determination means determines that the terminal device shuts down, the biometric authentication processing program is terminated in the terminal device, or a time set in advance according to a schedule is reached. A terminal device. The terminal device according to any one of claims 5 to 7,
When newly registering biometric information using the biometric authentication device,
The biometric information read by the biometric authentication device connected to the terminal device is obtained via the authentication device communication unit, and the identification information of the terminal device that can use the biometric information is obtained via the server communication unit. A terminal device that transmits to a server device.

Images