JP7240983B2 - Authentication system, authentication method, and registration device - Google Patents

Description

The present invention relates to an authentication system, an authentication method, and a registration device that perform authentication using biometric information.

Conventionally, an authentication system that performs authentication using biometric information is well known. This type of authentication system is used for various services. For example, in the authentication system described in Patent Document 1, correct finger veins are registered in advance as registration information in advance in a vehicle, and when finger veins are detected, they are compared with the registration information to perform authentication. do. Then, based on the result of this authentication, the operation of the in-vehicle device is permitted. In this authentication system, registration information is stored in a memory of an authentication device mounted on a vehicle.

JP 2010-195061 A

By the way, in the authentication system, if the stored registration information is leaked, there is a possibility that the registration information may be used to disguise, for example, the veins of a finger if the registration information is analyzed. Also, biometric information is generally immutable and difficult to change. Therefore, if finger veins are camouflaged, there is a possibility that other services that use the same finger veins may exploit them, and countermeasures have been required.

SUMMARY OF THE INVENTION An object of the present invention is to provide an authentication system, an authentication method, and a registration device capable of improving security.

An authentication system for solving the above problems includes an acquisition unit that acquires unique code information related to the terminal when the terminal communicates with a communication target, and a detection unit that inputs user's biometric information in advance. an authentication unit that decodes biometric authentication registration information that has been modified with the code information and stored in step 1 based on the code information that has been acquired by the acquisition unit, and authenticates the correctness of the biometric information using the registration information; , provided.

An authentication method for solving the above problems includes a step of acquiring unique code information related to the terminal when the terminal communicates with a communication target, a step of deciphering biometric authentication registration information that has been modified and saved with the code information based on the code information acquired by the acquisition unit, and using the registration information to authenticate the correctness of the biometric information; Prepare.

A registration device for solving the above problems is a registration device for registering registration information used as a solution for biometric authentication in a memory of an authentication system, wherein biometric information input by a user is stored in a terminal and a communication target of the terminal. changes based on the code information transmitted from the terminal when communicating, and registers the altered biometric information as the registration information.

The authentication system, authentication method, and registration device of the present invention can improve security.

1 is a block diagram showing the configuration of an authentication system; FIG. The flowchart which shows the flow which registers registration information. The figure which shows the feature data contained in biometric information. FIG. 4 is a flowchart showing the flow of authentication;

An embodiment of an authentication system, an authentication method, and a registration device will be described below with reference to FIGS. 1 to 4. FIG.
As shown in FIG. 1, a vehicle 1 as a communication target is equipped with an authentication system 3 that authenticates a terminal through wireless ID collation with a terminal 2 . The authentication system 3 permits or executes the operation of the in-vehicle device 4 on the condition that the ID verification is established. The authentication system 3 of this example is a key operation-free system that automatically performs ID verification wirelessly upon communication from the vehicle 1 . The in-vehicle device 4 includes, for example, a door lock device and an engine.

The authentication system 3 includes a system device 5 that performs ID verification in the vehicle 1 . The terminal 2 and the system device 5 mutually transmit and receive radio waves to perform wireless communication and perform ID verification. In the wireless communication of this example, radio waves in the LF band (LF: Low Frequency) are transmitted from the system device 5 to the terminal 2, and radio waves in the UHF band (UHF: Ultra High Frequency) are transmitted from the terminal 2 to the system device 5. LF-UHF mutual communication. An electronic key ID and a key unique key are registered in the terminal 2 and the system device 5 as authentication information used for ID verification. For example, the ID collation is performed by collating the electronic key ID to confirm whether the electronic key ID is correct or not, or performing challenge-response authentication using a unique key.

The system device 5 has a communication unit 6 that performs wireless communication. The communication unit 6 is capable of transmitting radio waves in the LF band and receiving radio waves in the UHF band. An electronic key ID and a key unique key are stored in a memory (not shown) of the system device 5 .

The terminal 2 includes a terminal control section 20 that controls the operation of the terminal 2 and a terminal communication section 21 that performs wireless communication in the terminal 2 . The terminal 2 is, for example, an electronic key mainly having key functions. The terminal control unit 20 performs an ID verification operation in the terminal 2 . The terminal communication unit 21 can transmit radio waves in the UHF band and receive radio waves in the LF band. Code information used for biometric authentication is stored in the memory 22 of the terminal 2 .

The authentication system 3 has a biometric authentication function for confirming the correctness of the user using the vehicle 1 by biometric authentication. In the case of this example, in the biometric authentication function, the authentication system 3 confirms whether the user is right or wrong by comparing the biometric information taken in from the user and the registration information pre-registered on the vehicle 1 side. Pre-registration is a type of initial registration in which registration information that is a correct answer is registered before the authentication system 3 is used. Biometric information includes, for example, fingerprints, veins, irises, faces, and voices.

The authentication system 3 includes a detection unit 30 that detects biometric information and an authentication control unit 40 that executes biometric authentication based on the output of the detection unit 30 . The detection unit 30 and the authentication control unit 40 of this example are provided in the vehicle 1 . The authentication control unit 40 outputs the biometric authentication result to the system device 5 and causes the system device 5 to operate the in-vehicle device 4 based on the authentication result.

The detection unit 30 is, for example, a camera that captures an image, and outputs image data obtained by capturing the user's face as biometric information. The authentication control unit 40 performs image processing on the image data output from the detection unit 30, for example, and analyzes the feature data included in the biometric information. The feature data includes analyzed feature items and corresponding numerical values. In image processing, for example, input image data is analyzed for a plurality of items, and each item is quantified. As a result, feature data of a plurality of items in which the analyzed items and their corresponding numerical values are combined is obtained. Note that a known image processing technique is used for the image processing.

The authentication control unit 40 includes a registration unit 41 that registers registration information. The registration unit 41 modifies the input biometric information based on the code information, which is information used to modify the biometric information, and registers the modified biometric information as registration information. The registration unit 41 writes and saves the registration information in the memory 45 of the authentication control unit 40 . The code information is preferably information unique to the terminal 2 . An example of code information is authentication information registered in the terminal 2, such as an electronic key ID. For example, when the biometric information is input from the detection unit 30, the registration unit 41 modifies some items among the plurality of items of feature data included in the biometric information. The registration unit 41 modifies, for example, the numeric part of the feature data using randomly generated dummy data.

The authentication control unit 40 includes an acquisition unit 42 that acquires code information during biometric authentication. The acquisition unit 42 acquires code information from the terminal 2 through communication between the system device 5 and the terminal 2, for example. The acquisition unit 42 acquires the electronic key ID transmitted from the terminal 2 via the system device 5, for example, at the time of ID collation communication.

The authentication control unit 40 includes a selection unit 44 that sorts a plurality of feature data included in the biometric information into two groups based on code information. When the code information is acquired, the selection unit 44 passes the code information through a predetermined selection algorithm, for example, and selects whether or not each of the plurality of feature data is modified. The selection algorithm is preferably an operation using an irreversible one-way function, such as a hash function. Hereinafter, the feature data selected as unaltered by the sorting unit 44 will be referred to as "unaltered data". Further, the feature data selected by the selection unit 44 as being modified is described as "altered data".

The registration unit 41 modifies the biometric information based on the sorting result of the sorting unit 44 . The registration unit 41 modifies the modified data among the plurality of feature data included in the biometric information, and does not modify the unmodified data. The registration unit 41 replaces the altered data with randomly generated dummy data. As a result, the registered registration information includes unaltered data and dummy data.

The authentication control unit 40 includes an authentication unit 43 that authenticates whether the biometric information is correct. When the detection unit 30 inputs biometric information, the authentication unit 43 solves the modified and stored registration information based on the code information acquired by the acquisition unit 42, and uses the registration information to perform biometric authentication. conduct. In biometric authentication, the authentication unit 43 performs authentication by comparing the biometric information detected by the detection unit 30 and the decoded registration information. As a result of the comparison, if the biometric information and the registered information can be considered to match, the authentication unit 43 establishes biometric authentication.

At the time of authentication, the authentication unit 43 identifies unaltered data from the code information acquired by the acquisition unit 42, and performs biometric authentication based on the unaltered data. The authentication unit 43 compares, for example, biometric information and unaltered data of registered information.

The operation of this embodiment will be described below. First, registration of registration information will be described with reference to FIGS. 2 and 3. FIG. For example, the authentication control unit 40 starts registration processing by the registration unit 41 when a predetermined registration condition is satisfied while a prescribed registration operation is being performed in the vehicle. The specified registration operation includes, for example, a registration start operation using the car navigation system of the vehicle. The registration conditions include, for example, establishment of ID verification of the terminal 2, establishment of user confirmation using an ID and password, and the like.

As shown in FIG. 2, in S101 (S stands for step, hereinafter the same), the registration unit 41 of the authentication control unit 40 inputs the biometric information of the user to be registered. Biometric information is input using the detection unit 30, for example. The biometric information is, for example, a face image. The authentication control unit 40 analyzes the image data as preprocessing and obtains a plurality of feature data. A known image processing technique is used for the preprocessing.

In S102, the acquisition unit 42 of the authentication control unit 40 acquires code information. Code information is, for example, an electronic key ID. In the case of this example, ID verification of the terminal 2 is imposed as a condition for registering the biometric information. In this ID collation, the electronic key ID is transmitted from the terminal 2 to the system device 5 . The acquiring unit 42 acquires the electronic key ID used in ID verification from the system device 5 .

In S103, when the acquiring unit 42 acquires the electronic key ID, the sorting unit 44 sorts the feature data included in the biometric information into two sets. The sorting unit 44 passes the electronic key ID through a predetermined sorting algorithm, for example, and sorts it into a set of unaltered data and altered data, which are feature data used for authentication. The sorting unit 44 outputs the sorting result to the registration unit 41 .

In S<b>104 , the registration unit 41 modifies the biometric information based on the sorting result of the sorting unit 44 . The registration unit 41 modifies the “altered data” and does not alter the “unaltered data”. The registration unit 41 modifies the modified data by replacing it with randomly generated dummy data.

Modification of biometric information will be described with reference to FIG. By performing image processing on the detected image data, the authentication control unit 40 obtains detection values for each of the plurality of items, and obtains feature data including the items and the detection values. The items include features N such as eye-to-eye distance, nose height, nose angle, eyebrow thickness, and eyebrow-to-eye distance, for example. The authentication control unit 40 analyzes the image data and calculates a detection value X for each of these features N. Each item is given an item number n. In image processing, the item number n and feature N are set in advance.

Next, the authentication control unit 40 causes the selection unit 44 to select feature data based on the code information. The selection unit 44 determines whether or not each feature data is altered. The sorting unit 44 passes the code information through a predetermined sorting algorithm, and outputs a sorting result that determines whether or not each feature data is altered. Note that the sorting result is uniquely obtained from the code information.

Next, the authentication control unit 40 causes the registration unit 41 to alter the biometric information based on the selection result. The registration unit 41 replaces the altered data determined to be altered by the selection unit 44 with dummy data. The dummy data is, for example, a dummy value Y generated by a random number whose value changes each time it is generated. The registration unit 41 generates a dummy value Y for each altered data, and replaces the detected value X of the altered data with this dummy value. Thereby, the registration unit 41 generates registration information in which one of the detection value X and the dummy value Y is associated with the plurality of features N as the registration value X/Y.

Returning to FIG. 2, in S105, the registration unit 41 registers the registration information obtained by modifying the biometric information based on the code information. Registration unit 41 stores the registration information in memory 45 . The registration information is data different from the user's biometric information itself. If the registered information is biometric information itself, even if it is encrypted, it will be restored by analysis. Also, if the registration information is stored in the vehicle 1, the biometric information may be leaked if the vehicle 1 is stolen. In the case of this example, even if an attempt is made to restore the user's biometric information from the registered information, the original biometric information cannot be restored with the dummy data. Therefore, the security of biometric information can be enhanced.

Next, authentication when the user actually operates the vehicle 1 will be described with reference to FIG.
As shown in FIG. 4, in S201, terminal authentication is performed between the terminal 2 and the system device 5 by ID collation. The system device 5 LF-transmits radio waves to the vicinity of the vehicle 1, for example. When the terminal 2 enters the area near the vehicle and receives the radio wave while the radio wave is being LF-transmitted, the terminal 2 transmits a response to this and starts ID collation. In ID collation, the electronic key ID of the terminal 2 is transmitted and received between the terminal 2 and the system device 5 to collate the electronic key ID, and cryptographic authentication is performed using the key unique key. When the system device 5 confirms that the collation and authentication are successful, the ID collation is established.

In S202, the detection unit 30 detects biological information. The detection unit 30 of this example captures a face image as biometric information when ID collation is established. The detection unit 30 outputs the captured image data to the authentication control unit 40 . When the image data is input, the authentication control unit 40 performs preprocessing of the image data. As a result, feature data included in the biometric information just detected is obtained.

In S<b>203 , the authentication control unit 40 acquires code information using the acquisition unit 42 . Acquisition unit 42 of the present example acquires the electronic key ID used in ID collation from system device 5 . The obtaining unit 42 obtains the electronic key ID by outputting the electronic key ID received by the system device 5 when ID collation is performed, for example. The acquisition unit 42 outputs the acquired electronic key ID to the selection unit 44 . In this way, the code information is obtained through communication, so the user does not have to input it. This is highly convenient for the user.

In S204, when the electronic key ID is input, the selection unit 44 selects unaltered data to be used for authentication by passing the electronic key ID through a predetermined selection algorithm. The sorting unit 44 outputs the sorting result to the authentication unit 43 . Here, if the electronic key ID is the same as the electronic key ID used at the time of registration, the sorting result will be the same as at the time of registration.

In S205, the authentication unit 43 compares the biometric information just detected with the registered information based on the selection result of the input unaltered data. The authentication unit 43 compares only the unaltered data of the biometric information and the registered information according to the sorting result of the sorting unit 44 . The authentication unit 43 compares, for example, the numeric parts of unaltered data with the same item number n between the biometric information and the registered information. When the authenticating unit 43 confirms that the biometric information matches the registered information by matching the unaltered data of the biometric information and the unaltered data of the registered information, it determines that the biometric authentication is established. When biometric authentication is established, the authentication unit 43 proceeds to S206. On the other hand, the authentication unit 43 determines that the biometric authentication is not established when it is confirmed that the biometric data without alteration and the data without alteration of the registered information do not match. If the biometric authentication fails, the authentication unit 43 proceeds to S207. If the electronic key ID is different at the time of registration and at the time of authentication, the sorting result will be different, and biometrics authentication will not be established. That is, in the biometric authentication of this example, a person who does not possess the correct terminal 2 cannot pass the biometric authentication to establishment, so the biometric authentication is highly difficult.

In S206, when the biometric authentication is successful, the authentication control unit 40 notifies the system device 5 that the biometric authentication is successful. Upon receiving the notification, the system device 5 permits the operation of the in-vehicle device 4, for example, on the premise that the ID verification is successful.

In S207, the authentication control unit 40 notifies the system device 5 that the biometric authentication has failed if the biometric authentication has failed. Upon receiving the notification, the system device 5 prohibits the operation of the in-vehicle device 4 . It should be noted that the system device 5 may perform control so as to permit the operation of some of the in-vehicle devices 4 and prohibit the operation of the rest when the ID collation of the terminal 2 is established.

The effects of this embodiment will be described below.
(1) The authentication system 3 includes an acquisition unit 42 that acquires code information unique to the terminal 2 when the terminal 2 communicates with the system device 5 . Further, when the user's biometric information is input by the detection unit 30 , the authentication system 3 obtains biometric authentication registration information that has been modified in advance with code information and saved, based on the code information acquired by the acquisition unit 42 . An authentication unit 43 is provided for authenticating the correctness of the biometric information using the registered information. According to this configuration, since the registered information used for biometric authentication is registered based on the modified code information, the original biometric information cannot be restored from the registered information. Therefore, security is improved.

(2) Code information is authentication information used in communication for authenticating terminal 2 . According to this configuration, since the authentication information used for terminal authentication is also used as code information, there is no need to generate code information separately. In addition, if biometric authentication and authentication of the terminal 2 are performed, it contributes to an improvement in the security of authentication.

(3) Registered information is information in which a plurality of feature data included in biometric information are sorted into two sets according to whether or not they have been altered. The authentication unit 43 uses the code information acquired by the acquisition unit 42 to specify unaltered data among the plurality of feature data, and performs biometric authentication based on the specified unaltered data. According to this configuration, it is possible to perform authentication by a simple process of determining the unaltered data to be used for biometric authentication based on the code information and comparing only the portions of the unaltered data. This eliminates the need to modify the biometric information at the time of authentication. This contributes to reducing the processing load.

(4) The registration information is part of the biometric information and includes unaltered data used for biometric authentication and randomly generated dummy data. According to this configuration, random dummy data can make it difficult to restore the biometric information from the registered information. This contributes to improved security.

In addition, this embodiment can be changed and implemented as follows. This embodiment and the following modified examples can be implemented in combination with each other within a technically consistent range.
[Regarding the authentication unit 43]
- The authentication unit 43 may modify the biometric information using the code information and compare it with the registered registration information. This can be applied, for example, to a configuration in which the sorting section 44 is omitted.

- A method for authentication by the authentication unit 43 by comparing the biometric information and the registered information is not particularly limited. For example, only unaltered data may be compared, or the comparison result of altered data may be ignored. Also, as a comparison method, a known technique such as matching can be used.

[Regarding the acquisition unit 42]
- The timing at which the acquisition unit 42 acquires the code information may be before, after, or during the input of the biometric information. Alternatively, it may be obtained when ID collation is performed.

- The acquisition unit 42 may acquire the code information without using the system device 5 . That is, the authentication control unit 40 may communicate with the terminal 2 .
[Regarding the registration unit 41]
- The registration unit 41 is not limited to replacing numerical values of feature data with dummy data. For example, feature data may be modified using a calculation result calculated from code information.

- The registration unit 41 may modify all feature data included in the biometric information.
The modification by the registration unit 41 is not limited to changing the detected value. For example, corresponding numerical values may be exchanged between modified data, numerical values may be deleted, or numerical values may be replaced. You may change the item to dummy.

- When modifying the biometric information, the registration unit 41 may newly generate code information to be used for modification. In this case, the generated code information may be transmitted to the terminal 2 and stored. That is, the code information is not limited to the electronic key ID, and may be information separately provided for modification.

- The code information may not be constant and may be updated. For example, it may be updated to a new value at each registration. In this case, new code information may be generated after a certain number of times or for a certain period of time, and new registration information may be registered based on this. Also, the generated code information may be transmitted to the terminal 2 side and rewritten.

- Registration conditions for registering biometric information are not particularly limited. The registration conditions include, for example, establishment of ID verification of the terminal 2, establishment of user confirmation using an ID and password, and the like. Also, the registration may be performed only at the initial stage, or may be performed at an arbitrary timing during use.

- The registration unit 41 is not limited to being provided in the vehicle 1, and may be provided in the terminal 2, or may be provided separately as a registration device.
[Regarding the sorting unit 44]
- The sorting unit 44 is not limited to performing sorting by passing the code information through an algorithm, and may sort using the code information itself.

- The numbers of unaltered data and altered data sorted out by the sorting unit 44 are not particularly limited. At least one piece of data should be included in both the unaltered data and the altered data.

- The sorting unit 44 can be omitted.
[others]
- The detection unit 30 is not limited to being provided in the vehicle 1, and may be provided on the terminal 2 side.

- At the time of registration, biometric information may be detected by a detection device other than the detection unit 30 provided in the vehicle 1 .
- Feature data included in biometric information is not limited to the embodiment. For example, the present invention is not limited to analysis of features as in the embodiment, and data analyzed by various image processing may be used. Also, the image processing method is not particularly limited, and a known technique can be used.

- The feature data is a combination of an item and a numerical value, but is not limited to this. For example, it may be a list of numerical values.
- The data included in the registration information is not particularly limited. If it is possible to compare registered information and biometric information, for example, a simple list of registered values X/Y, a combination of item number n and registered values X/Y, or a combination of feature N and registered values X/Y may be used. It's okay.

- The detection unit 30 is not limited to a camera, and various detection devices such as a sensor and a microphone can be used.
- The biological information is not particularly limited. Biometric information includes, for example, fingerprints, veins, irises, faces, and voices.

- The terminal 2 is not limited to an electronic key, and may be various terminals such as a high-performance mobile phone, a so-called smart phone, or the like.
- In authentication, ID verification and biometric authentication may be performed at the same time, or may be performed at different timings.

- In the authentication system 3, ID collation of the terminal 2 is not limited to the key operation free system, and the terminal authentication method is not particularly limited. Also, the ID collation of the terminal 2, that is, the terminal authentication may be omitted.

- The authentication system 3 is not limited to vehicles. For example, it may be used for locking and unlocking a house door.

DESCRIPTION OF SYMBOLS 1... Vehicle, 2... Terminal, 3... Authentication system, 4... Vehicle-mounted apparatus, 5... System apparatus, 6... Communication part, 20... Terminal control part, 21... Terminal communication part, 22... Memory, 30... Detection part, 40 ... authentication control section, 41 ... registration section, 42 ... acquisition section, 43 ... authentication section, 44 ... selection section, 45 ... memory.

Claims (5)

an acquisition unit that acquires code information specific to the terminal when the terminal communicates with a communication target;
When biometric information of a user is input by a detection unit, biometric authentication registration information that has been modified and saved in advance with the code information is solved based on the code information acquired by the acquisition unit, and the registration information is obtained. and an authentication unit that authenticates the correctness of the biometric information using
The registration information is information in which a plurality of feature data included in the biometric information is sorted into two groups according to presence or absence of modification,
The authentication system, wherein the authentication unit specifies unaltered data among the plurality of feature data using the code information acquired by the acquiring unit, and performs the biometric authentication based on the specified unaltered data. 2. The authentication system according to claim 1, wherein said code information is authentication information used for authentication of said terminal. 3. The authentication system according to claim 1, wherein said registration information comprises said unaltered data, which is part of said biometric information and used for said biometric authentication, and randomly generated dummy data. obtaining code information specific to the terminal by an obtaining unit when the terminal communicates with a communication target;
When biometric information of a user is input by a detection unit, biometric authentication registration information that has been modified and saved in advance with the code information is solved based on the code information acquired by the acquisition unit, and the registration information is obtained. and authenticating the correctness of the biometric information using
The registration information is information in which a plurality of feature data included in the biometric information is sorted into two groups according to presence or absence of modification,
In the step of authenticating whether the biometric information is correct or not, the code information acquired by the acquisition unit is used to specify unaltered data among the plurality of characteristic data, and the biometric authentication is performed based on the specified unaltered data. Authentication method to perform . A registration device for registering registration information used as a solution for biometric authentication in the memory of the authentication system according to any one of claims 1 to 3 ,
A registration device that modifies biometric information input by a user based on code information transmitted from the terminal when a terminal and a communication target of the terminal communicate with each other, and registers the modified biometric information as the registration information.

Images