JP7529079B2 - Method, server device and program - Google Patents

Description

The present invention relates to a server device, a terminal, an authentication system, an authentication method, and a storage medium.

Services using biometric authentication are becoming more widespread. For example, biometric authentication (e.g., facial recognition) is beginning to be used for hotel accommodation services and payment at retail stores.

For example, Patent Document 1 states that a sales management system is provided that allows users to make payments more easily and reliably with less hassle. In the system disclosed in Patent Document 1, a store terminal detects a proximity ID (identifier) when a user visits a store and transmits it to a sales management server, and acquires the user's biometric authentication data when purchasing a product or service. The biometric authentication data is transmitted to the sales management server. The sales management server has a user registration information database in which user IDs, proximity IDs, biometric authentication data, and payment method information are registered in association with each other. When receiving the biometric authentication data, the sales management server determines whether there is matching biometric authentication data for the user IDs stored in the store visitor information database. If matching biometric authentication data is found, the sales management server completes the payment for the user's purchase of the product or service.

JP 2016-157294 A

As disclosed in Patent Document 1, when biometric authentication is applied to shopping, etc., biometric information is sent from a terminal (authentication terminal) installed in a store, etc. to a server. The server compares the biometric information acquired from the terminal with pre-registered biometric information to verify the identity of the user.

Here, the hotel operator and the retail store operator are usually different. For example, in most cases, accommodation services at a hotel and payment at a retail store are provided by different service providers. In this case, if the above-mentioned server that performs biometric authentication can be installed for each service provider, it will not be a major problem even if the authentication algorithms used for biometric authentication are different.

However, it would be a big burden for small service providers to install and manage their own biometric authentication servers. Therefore, it would be possible to install a biometric authentication server in each region or municipality, and have that local biometric authentication server provide biometric authentication services to service providers such as hotels and retail stores. By installing such a biometric authentication server, small service providers would be able to easily provide services that use biometric authentication.

Ideally, each service provider (hotel, retail store, etc.) that uses the shared biometric authentication server would use the same biometric authentication method (authentication algorithm; authentication engine). If the same authentication algorithm could be used to provide biometric authentication for hotel accommodation services and retail store payments, the biometric information registered on the server could also be standardized.

However, in reality, each service provider may adopt a different authentication algorithm due to reasons such as the cost of changing existing terminals to be biometric authentication compatible. Or, the biometric authentication method (algorithm) or version of the terminal may differ depending on when the terminal was installed in a hotel or other facility. In this way, when different authentication algorithms are used for each service provider or each terminal, it is necessary to prepare a server compatible with each authentication algorithm, which results in the system becoming bloated.

The main objective of the present invention is to provide a server device, a terminal, an authentication system, an authentication method, and a storage medium that contribute to supporting various authentication algorithms.

According to a first aspect of the present invention, a server device is provided that includes a communication unit that receives a matching request including an ID (identifier) of an authentication algorithm supported by a terminal, and a matching unit that processes the matching request using a registered user database that stores a user's ID, a feature generated from the user's biometric information, and an ID of an authentication algorithm that can use the generated feature in association with each other.

According to a second aspect of the present invention, there is provided a terminal including an acquisition unit that acquires biometric information of a user, and a transmission unit that transmits to a server device the user's ID (identifier), a feature generated from the user's biometric information, and the ID of an authentication algorithm that can use the generated feature.

According to a third aspect of the present invention, there is provided an authentication system including a terminal and a server device, in which the server device receives a matching request including an ID (identifier) of an authentication algorithm supported by the terminal, and processes the matching request using a registered user database that stores a user ID, a feature generated from the user's biometric information, and an ID of an authentication algorithm that can use the generated feature in association with each other.

According to a fourth aspect of the present invention, there is provided an authentication method in an authentication system including a terminal and a server device, which receives a matching request including an ID (identifier) of an authentication algorithm supported by the terminal, and processes the matching request using a registered user database that stores a user ID, a feature generated from the user's biometric information, and an ID of an authentication algorithm that can use the generated feature in association with each other.

According to a fifth aspect of the present invention, a computer-readable storage medium is provided that stores a program for causing a computer installed in a server device to execute the following processes: receiving a matching request including an ID (identifier) of an authentication algorithm supported by the terminal; and processing the matching request using a registered user database that stores a user ID, a feature generated from the biometric information of the user, and an ID of an authentication algorithm that can use the generated feature in association with each other.

According to each aspect of the present invention, a server device, a terminal, an authentication system, an authentication method, and a storage medium are provided that contribute to supporting various authentication algorithms. Note that the effects of the present invention are not limited to the above. The present invention may achieve other effects instead of or in addition to the above effects.

FIG. 1 is a diagram for explaining an overview of an embodiment. 1 is a diagram illustrating an example of a schematic configuration of an authentication system according to a first embodiment. FIG. 2 is a diagram for explaining a user registration phase of the authentication system according to the first embodiment. FIG. 2 is a diagram for explaining a utilization service registration phase of the authentication system according to the first embodiment. FIG. 2 is a diagram for explaining an authentication phase of the authentication system according to the first embodiment. FIG. 2 is a diagram illustrating an example of a processing configuration of an authentication server according to the first embodiment; FIG. 2 is a diagram illustrating an example of a processing configuration of a terminal according to the first embodiment. FIG. 13 is a diagram illustrating an example of a matching request transmitted by a terminal. 4 is a sequence diagram showing an example of operations in a user registration phase and a utilization service registration phase of the authentication system according to the first embodiment. FIG. FIG. 4 is a sequence diagram showing an example of an operation of an authentication phase of the authentication system according to the first embodiment. FIG. 11 is a diagram for explaining a utilization service registration phase of the authentication system according to the second embodiment. FIG. 11 is a diagram illustrating an example of a processing configuration of an authentication server according to a second embodiment. FIG. 11 is a diagram illustrating an example of a processing configuration of a terminal according to a second embodiment. FIG. 2 illustrates an example of a hardware configuration of an authentication server. FIG. 13 is a diagram illustrating an example of a schematic configuration of an authentication system according to a modified example of the present disclosure.

First, an overview of one embodiment will be described. The reference numbers in the drawings are added to each element for convenience as an example to aid in understanding, and the description of this overview is not intended to be limiting in any way. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units rather than hardware units. The connection lines between blocks in each drawing include both bidirectional and unidirectional lines. Unidirectional arrows are used to show the main signal (data) flow diagrammatically, and do not exclude bidirectionality. In this specification and drawings, elements that can be described in the same way may be given the same reference numbers to avoid duplicated explanations.

The server device 100 according to one embodiment includes a communication unit 101 and a matching unit 102 (see FIG. 1). The communication unit 101 receives a matching request including an ID (identifier) of an authentication algorithm supported by the terminal. The matching unit 102 processes the matching request using a registered user database that stores a user's ID, a feature generated from the user's biometric information, and an ID of an authentication algorithm that can use the generated feature in association with each other.

The registered user database accessed by the server device 100 stores at least an ID that identifies a system user, the features of the system user, and the ID of an authentication algorithm that the terminal can use, in association with each other. By using the above database, it is possible to associate the ID of an authentication algorithm with features that match the authentication algorithm (features that the authentication algorithm can use for matching processing). As a result, even if the authentication algorithms that can be used by each terminal that requests biometric authentication (matching) from the server device 100 are different, the server device 100 can extract features from the above database that are suitable for the features that each terminal transmits during matching. In other words, by accessing the above database, the server device 100 can support various authentication algorithms.

Specific embodiments are described in more detail below with reference to the drawings.

[First embodiment]
The first embodiment will be described in more detail with reference to the drawings.

[System Configuration]
Fig. 2 is a diagram showing an example of a schematic configuration of an authentication system according to the first embodiment. Referring to Fig. 2, the authentication system includes a terminal 10, a terminal 20, and a server device 30. The terminals 10 and 20 and the server device 30 are configured to be capable of communicating with each other via wired or wireless communication means. It should be noted that the configuration shown in Fig. 2 is merely an example, and is not intended to limit the number of terminals, etc.

The authentication system shown in FIG. 2 is based on the premise that service providers in various business sectors and industries provide services using biometric authentication. Here, in the first embodiment, a case is described in which the authentication system provides authentication services using the user's "face (facial image)" as biometric information. However, it is not intended to limit the biometric information targeted by the authentication system to "face", and other biometric information, such as biometric information of the iris, may also be used.

Figure 2 shows an example in which hotel A and retail store B provide services (accommodation services, shopping) using facial recognition. Note that the above hotels and retail stores are merely examples, and the service provider may be, for example, a local government or the like.

The terminal 10 is installed, for example, in Hotel A, and provides lodging services to guests using facial recognition. For example, the terminal 10 uses facial recognition to perform check-in processing for users of the authentication system (hereinafter sometimes referred to as system users) and to unlock and lock reserved rooms. Specifically, the terminal 10 identifies users who visit the hotel using facial recognition, and performs check-in processing, unlocking of reserved rooms, etc.

The terminal 20 is installed, for example, in retail store B, and provides customers with shopping using facial recognition. Specifically, the terminal 20 identifies the customer through facial recognition. The terminal 20 transmits the payment information of the identified individual (e.g., information related to a credit card) to a payment server, etc., and makes payment for the product.

The server device 30 is a device that provides face recognition services to service providers (hotels, retail stores, etc.) participating in the authentication system. Specifically, the server device 30 acquires features (features calculated from face images) from the service providers (terminals 10 and 20). The server device 30 performs a comparison (one-to-N comparison; N is a positive integer, the same applies below) between the acquired features and features registered in a database. The server device 30 transmits the ID of the user identified by the comparison to the service provider.

[System Operation Overview]
Next, an outline of the operation of the authentication system according to the first embodiment will be described with reference to the drawings. The authentication system according to the first embodiment includes three phases.

The first phase is a "user registration phase" in which the user registers information for using the authentication system in the server device 30. A user who wants to use face authentication performs user registration in the user registration phase.

The second phase is the "service registration phase" in which the user registers with the service provider the detailed information required for receiving services from each service provider. In the service registration phase, the system user (a user who has completed user registration in the authentication system) individually selects the service provider from which he or she wishes to receive services using facial recognition, and inputs information to each service provider. In the example of Figure 2, if the user wishes to receive accommodation services from Hotel A using facial recognition, he or she inputs detailed information (name, accommodation plans, etc.) to Hotel A. If the user also wishes to receive services using facial recognition from Retailer B, he or she inputs detailed information to Retailer B. If the user does not wish to receive services using facial recognition from Retailer B, there is no need to input detailed information to Retailer B.

The third phase is the "authentication phase" in which the terminals 10 and 20 installed at the service provider authenticate the user. The authentication phase is when a user who has completed user registration and service registration visits the service provider and receives services through facial recognition.

These three phases are explained below.

[User registration phase]
As described above, a user who wishes to receive a service using face authentication from each service provider (hotel A and retail store B in the example of FIG. 2) performs advance registration for use of the authentication system. Specifically, the user performs user registration in server device 30 via a WEB page or the like (see FIG. 3).

Specifically, the user accesses the web page and inputs an ID (Identifier) that can uniquely identify the user to the server device 30. In the following description, the ID is referred to as a user ID. Any information can be used for the user ID as long as it can uniquely identify the user. For example, the user ID may be a combination of an ID and a password for accessing the web page, or a pseudonym such as a nickname. Alternatively, the user's name or information issued by a public institution such as a country (for example, a 12-digit personal number) may be used as the user ID.

Alternatively, the server device 30 may generate a user ID that uniquely identifies the user from the information input by the user. For example, the server device 30 may generate a user ID by concatenating the user's name, date of birth, date and time when the information was input, etc., and calculating a hash value of the concatenated data. The user ID calculated by the server device 30 (for example, the calculated hash value) is notified to the user.

In addition to inputting the user ID, the user inputs his/her own facial image (biometric information) to the server device 30. For example, the user may obtain his/her own facial image using a camera device mounted on a smartphone or the like, and input the obtained facial image to the server device 30. Alternatively, the user may specify facial image data (facial image file) captured in advance, and upload the facial image data to the server device 30. The user inputs the facial image (biometric information) to the server device 30 by any method.

The server device 30 adds an entry related to the above input information (user information; user ID, facial image) to the database. When the server device 30 adds the entry to the database, the user registration phase ends. In other words, when the user finishes registering the above information, the registration for use of the authentication system shown in FIG. 2 ends.

[Service registration phase]
After completing the registration of the necessary information in the system, the user inputs the detailed information required to receive services from each service provider. For example, the user inputs the above information from a web page operated by the service provider or a terminal installed in the service provider's facility (see FIG. 4). Note that FIG. 4 illustrates a case in which the user inputs the above detailed information using terminals 10 and 20.

For example, a user who wishes to receive accommodation services from Hotel A would enter personal information such as their name, address, and phone number, as well as details about the stay (dates, information about the room they wish to reserve, etc.). Or, a user who wishes to use facial recognition to shop at retail store B would enter credit card information, etc., in addition to their name, etc.

Furthermore, in addition to the above detailed information (name, address, etc.), the user inputs the user ID that was input to the server device 30 during the user registration phase into the terminals 10 and 20.

When the service provider (terminals 10 and 20) acquires information such as the name and user ID from the user, the service provider manages this information in association with each other. Terminals 10 and 20 add an entry related to the service user's user ID and detailed information about the service user to the database.

The service provider transmits to the server device 30 the acquired user ID and an algorithm ID indicating the type, version, etc. of the face recognition algorithm that the service provider (terminal 10, 20) supports. In the example of FIG. 4, the terminal 10 supports a face recognition algorithm called "AL1", and an algorithm ID that identifies the algorithm is transmitted to the server device 30.

The server device 30 identifies the entry added in the user registration phase using the user ID obtained from the terminals 10 and 20, and adds the obtained algorithm ID to the identified entry.

The server device 30 generates features (feature vectors consisting of multiple features) that are compatible with the face recognition algorithm corresponding to the acquired algorithm ID from the face image registered in the user registration phase. In other words, the server device 30 generates features that can be used by the face recognition algorithm for matching processing. The server device 30 adds the generated features to an entry corresponding to the user ID acquired from the terminals 10 and 20.

The user registers the above information (service usage registration) for each service provider from which the user wishes to receive services using face recognition. In the example of Figure 4, user U1 registers detailed information at hotel A, and then registers detailed information at retail store B.

[Authentication Phase]
When the service registration phase is completed and the necessary detailed information is registered with each service provider, the user visits the service provider (see FIG. 5). In the example of FIG. 5, user U1 visits hotel A and moves in front of the terminal 10.

When the distance between the user and the terminal 10 becomes shorter than a predetermined distance, the terminal 10 acquires a facial image of the user in front of the terminal 10 and calculates features from the facial image. In the example of FIG. 5, the terminal 10 calculates features that match the facial recognition algorithm AL1.

The terminal 10 sends a matching request to the server device 30, which includes the calculated feature amount and the algorithm ID of the face recognition algorithm that the terminal 10 supports.

The server device 30 performs a matching process on the entries (features) stored in the database using the acquired features and the algorithm ID. Specifically, the server device 30 extracts from the database a number of features that match the acquired algorithm ID. The server device 30 performs a one-to-N matching of the features extracted using the algorithm ID with the features acquired from the terminal 10. The server device 30 identifies features that substantially match the acquired features from among the features (features registered in the database) that match the face recognition algorithm corresponding to the acquired algorithm ID.

The server device 30 transmits to the terminal 10 the user ID corresponding to the features identified by the above matching.

The terminal 10, which has acquired the user ID, identifies detailed information (such as name and address) corresponding to the user ID and provides services to the user. In the example of FIG. 5, the name of the user U1 standing in front of the terminal 10 is identified as "Taro," and a message welcoming the user U1 is displayed on the terminal 10.

Next, we will explain the details of each device included in the authentication system.

[Server device]
Fig. 6 is a diagram showing an example of a processing configuration (processing module) of the server device 30 according to the first embodiment. Referring to Fig. 6, the server device 30 includes a communication control unit 201, a user information acquisition unit 202, a feature registration unit 203, a feature generation unit 204, a matching unit 205, and a storage unit 206.

The communication control unit 201 is a means for controlling communication with other devices. Specifically, the communication control unit 201 receives data (packets) from the terminals 10 and 20. The communication control unit 201 also transmits data to the terminals 10 and 20. For example, the communication control unit 201 receives a matching request that includes the ID of an authentication algorithm supported by the terminals 10 and 20.

The user information acquisition unit 202 is a means for acquiring user information related to system usage from a user. Specifically, the user information acquisition unit 202 acquires a user ID and biometric information (facial image) from the user. The user information acquisition unit 202 associates the acquired user ID with the facial image and registers them in a database (hereinafter referred to as the registered user database).

The feature registration unit 203 is a means for registering the features of a user who has registered to use the service in a registered user database. The feature registration unit 203 acquires a user ID and an algorithm ID from the service provider. The feature registration unit 203 identifies an entry in the registered user database that corresponds to the acquired user ID. The feature registration unit 203 writes the acquired algorithm ID in the algorithm ID field of the identified entry.

In addition, if the combination of the user ID and algorithm ID acquired from the service provider has already been registered in the registered user database, the feature registration unit 203 may discard the user ID and algorithm ID acquired from the service provider.

The feature registration unit 203 passes the face image (face image data) and algorithm ID of the identified entry to the feature generation unit 204. The feature registration unit 203 writes the feature generated by the feature generation unit 204 into the feature field of the identified entry.

The feature registration unit 203 creates a registered user database as shown in the upper part of FIG. 4. That is, user IDs, face images, features, and algorithm IDs are associated and managed.

The feature generating unit 204 is a means for generating features from a facial image. Specifically, the feature generating unit 204 generates features for a facial recognition algorithm corresponding to an algorithm ID from a facial image acquired in advance. The feature generating unit 204 generates features to be stored in a registered user database from biometric information of a user acquired before the matching process.

Specifically, the feature generating unit 204 extracts feature points from the acquired face image. For example, the feature generating unit 204 extracts the eyes, nose, mouth, etc. as feature points from the face image. After that, the feature generating unit 204 calculates the position of each feature point and the distance between each feature point as features, and generates a feature vector (vector information that characterizes the face image) consisting of multiple feature amounts.

Here, when the facial recognition algorithm differs, the points calculated as feature points and the method of calculating the feature amounts from the extracted feature points differ. For this reason, there is a correspondence between the facial recognition algorithm and the feature amounts that the facial recognition algorithm can use. Therefore, matching using the facial recognition algorithm cannot be performed unless the feature amount is compatible with the corresponding facial recognition algorithm. For example, facial recognition algorithm A can perform matching using feature amount A that is compatible with facial recognition algorithm A, but cannot perform matching using feature amount B that is compatible with facial recognition algorithm B. In this way, a facial recognition algorithm that performs matching processing using feature amounts on the registration side and feature amounts on the matching side cannot perform matching processing unless it uses compatible feature amounts.

In consideration of the above situation, the feature generating unit 204 generates features that match the face recognition algorithm of the algorithm ID acquired from the feature registering unit 203. Note that the specific processes related to the extraction process of feature points and the calculation process of feature amounts can use existing technology, so detailed explanations thereof will be omitted.

The feature generation unit 204 passes the generated features to the feature registration unit 203.

The matching unit 205 is a means for performing a matching process between the features registered in the registered user database and the features acquired from the terminal 10 or 20. The matching unit 205 processes a matching request acquired from the terminal 10 or 20 using the registered user database.

The matching unit 205 acquires a matching request from the service provider (terminals 10, 20). The matching request includes the features and algorithm ID of the user standing in front of the terminal 10. The matching unit 205 acquires the features and algorithm ID from the matching request. The matching unit 205 extracts entries from the registered user database that store an ID matching the acquired algorithm ID. The matching unit 205 sets the features of the extracted entry to the features of the registration side and the features acquired from the matching request to the features of the matching side (target to be matched), and performs 1:N matching.

The matching unit 205 calculates the similarity between each of the features on the registration side and the features on the matching side. The similarity can be calculated using chi-square distance, Euclidean distance, or the like. Note that the greater the distance, the lower the similarity, and the closer the distance, the higher the similarity.

The matching unit 205 identifies the feature from among the multiple features on the registration side that has a similarity to the feature on the matching side that is equal to or greater than a predetermined value and has the highest similarity.

The matching unit 205 transmits the user ID corresponding to the identified features to the terminals 10 and 20 as a response to the matching request via the communication control unit 201.

The storage unit 206 stores various information necessary for the operation of the server device 30. In addition, a registered user database is constructed in the storage unit 206. As described above, the registered user database stores a user ID, a feature generated from the user's biometric information, and an ID of an authentication algorithm that can use the generated feature, in association with each other.

[Device]
Fig. 7 is a diagram showing an example of a processing configuration (processing module) of the terminal 10 according to the first embodiment. Referring to Fig. 7, the terminal 10 includes a communication control unit 301, a user information registration unit 302, a face image acquisition unit 303, a matching request unit 304, a function realization unit 305, and a storage unit 306. Note that the terminal 10 and the terminal 20 can have the same processing configuration, and therefore a detailed description of the terminal 20 will be omitted.

The communication control unit 301 is a means for controlling communication with other devices. Specifically, the communication control unit 301 receives data (packets) from the server device 30. The communication control unit 301 also transmits data to the server device 30.

The user information registration unit 302 is a means for registering information (user ID, detailed information) for providing services to system users in the service registration phase. Specifically, the user information registration unit 302 acquires the user ID and detailed information (e.g., name, address, etc.) required for the service provider to provide the service to the user.

The user information registration unit 302 can obtain the above information using any method. For example, the user information registration unit 302 may obtain the above information via a web page operated and managed by the service provider. Alternatively, the user information registration unit 302 may obtain information input by the user using an input device (e.g., a keyboard, a touch panel, a mouse, etc.) attached to the terminal 10. Alternatively, the user information registration unit 302 may obtain information by accessing an external database server in which the user ID and detailed information are stored, or may obtain information via a storage medium such as a Universal Serial Bus (USB) memory.

The user information registration unit 302 manages the acquired user ID and detailed information in association with each other. Specifically, the user information registration unit 302 registers the user ID and detailed information by adding an entry to a database (hereinafter referred to as the user database) constructed in the storage unit 306.

The user information registration unit 302 transmits the acquired user ID and the algorithm ID of the facial recognition algorithm that the user information registration unit 302 corresponds to to the server device 30. The algorithm ID is information agreed upon between the terminal 10 and the server device 30, and any information can be used as long as it can uniquely identify the authentication algorithm. For example, a combination of the facial recognition algorithm method and its version may be used as the algorithm ID, or a hash value calculated from the above combination may be used as the algorithm ID. When the hash value is used as the algorithm ID, the server device 30 may refer to table information that associates the hash value with the information on which the hash value is based (the facial recognition algorithm method and version) to identify the facial recognition algorithm and its version.

The facial image acquisition unit 303 is a means for acquiring a facial image (biometric information) of a user in front of the user. For example, when the facial image acquisition unit 303 detects a facial area of a user in an image captured continuously or periodically by controlling a camera device, it captures the face of the user and acquires the facial image.

The face image acquisition unit 303 may extract a face area from a captured image if the size of the face area contained in the captured image is equal to or larger than a predetermined value. In this case, by appropriately adjusting the above-mentioned predetermined value (threshold value), a face image of a user located a predetermined distance from the terminal 10 can be acquired. In other words, it is possible to prevent a user located far away from the terminal 10 from being photographed and features that are unsuitable for face authentication (1:N matching by the server device 30) from being transmitted to the server device 30.

Alternatively, the facial image acquisition unit 303 may measure the distance between the terminal 10 and the user using a distance sensor or the like, and acquire a facial image of the user who is in a predetermined position. Alternatively, the facial image acquisition unit 303 may acquire multiple images using a camera capable of measuring the depth direction, such as a stereo camera, and measure the distance between the device itself and the user by analyzing the multiple images. In this case, the facial image acquisition unit 303 acquires a facial image when the distance between the device itself and the user is shorter than a predetermined threshold.

The facial image acquisition unit 303 passes the acquired facial image to the matching request unit 304.

The matching request unit 304 is a means for requesting the server device 30 to check whether or not the person corresponding to the acquired face image is registered in the system. Specifically, the matching request unit 304 calculates features from the acquired face image. In doing so, the matching request unit 304 generates features that are compatible with the face recognition algorithm supported by the device itself.

The matching request unit 304 generates a matching request including the generated features and transmits the generated matching request to the server device 30 via the communication control unit 301.

For example, the matching request unit 304 generates a matching request including an identifier of the device itself (hereinafter, referred to as a terminal identifier), a feature amount, an algorithm ID, etc. (see FIG. 8). Note that the terminal identifier may be the MAC (Media Access Control) address or IP (Internet Protocol) address of the terminal 10.

The matching request unit 304 receives a response to the matching request from the server device 30 via the communication control unit 301. The matching request unit 304 passes the response from the server device 30 (the user ID identified by the 1:N matching) to the function realization unit 305.

The function realization unit 305 is a means for realizing the functions assigned to the terminal 10. Specifically, when the terminal 10 operates as a check-in terminal, the function realization unit 305 executes processing related to the check-in. Note that the operation of the function realization unit 305 changes depending on the functions assigned to the terminal 10, so a detailed explanation of the realization of the functions will be omitted.

The storage unit 306 stores various information necessary for the operation of the terminal 10. In addition, a user database is constructed in the storage unit 306.

[System Operation]
Next, a description will be given of the operation of the authentication system according to the first embodiment. Fig. 9 is a sequence diagram showing an example of the operation of the authentication system according to the first embodiment in the user registration phase and the utilization service registration phase.

In the user registration phase, the server device 30 performs user registration for a user who wishes to use the authentication system. Specifically, the server device 30 acquires a user ID and a facial image from the user (step S01).

Then, the server device 30 adds an entry to the registered user database (step S02).

In the service registration phase, the terminals 10 and 20 register the system users to use the services. Specifically, the terminals 10 and 20 obtain from the users a user ID and detailed information (such as name) required for service provision (step S11).

The terminals 10 and 20 send the user ID and algorithm ID to the server device 30 (step S12).

The server device 30 generates features that are compatible with the face recognition algorithm that corresponds to the acquired algorithm ID (step S13). At that time, the server device 30 generates the features from the face image input by the user in the user registration phase.

The server device 30 stores the generated features and the algorithm ID acquired from the terminals 10 and 20 in a registered user database (DB; Data Base) (step S14).

Figure 10 is a sequence diagram showing an example of the operation of the authentication phase of the authentication system according to the first embodiment.

In the authentication phase, the system user visits the service provider (service provider) with whom he/she has registered to use the service. The terminals 10 and 20 installed at the service provider acquire a facial image of the user (step S21).

The terminals 10 and 20 generate features from the acquired face image (step S22). At that time, the terminals 10 and 20 generate features that are compatible with the face recognition algorithm that the terminals 10 and 20 support.

The terminals 10 and 20 send a matching request including the generated features and algorithm ID to the server device 30 (step S23).

The server device 30 receives the matching request. Thereafter, the server device 30 processes the received matching request (step S24). Specifically, the server device 30 sets the feature of an entry in the registered user database that has an authentication algorithm ID that matches the ID of the authentication algorithm included in the matching request as the registration side feature. The server device 30 also sets the feature included in the matching request as the matching side feature. The server device 30 performs 1:N matching using the registration side feature and the matching side feature.

The server device 30 notifies the terminals 10 and 20 of the matching result (step S25). Specifically, if the server device 30 identifies a user ID through the matching process, it returns the matching result including the user ID to the sender of the matching request. Alternatively, if the result of the matching process does not reveal any features that substantially match the features included in the matching request, the server device 30 returns a message to that effect to the sender.

The terminals 10 and 20 receive the matching results and provide the service to the user (step S26).

As described above, in the authentication system according to the first embodiment, the server device 30 performs a matching process using a registered user database that stores a user ID, a feature of the system user, and an ID of an authentication algorithm that can be used by the terminal in association with each other. Since the feature for each authentication algorithm is stored in the database, the server device 30 can perform a matching process using the algorithm ID and feature acquired from the terminals 10 and 20. As a result, even if the terminals 10 and 20 are terminals that support different face recognition methods (face recognition algorithms), the server device 30 can realize a matching process for the user by accessing one database in which information about the user is aggregated. For example, even if the terminal 10 supports the authentication method of vendor A and the terminal 20 supports the authentication method of vendor B, the server device 30 can provide a face recognition service to the terminals 10 and 20 that support face recognition methods by different vendors. That is, the server device 30 operates as a centralized management type authentication authority that supports face recognition algorithms by multiple vendors. Therefore, a service provider can provide a face recognition service at low cost while adopting a face recognition algorithm that is suitable for the situation and environment of the company. This is because service providers only need to prepare terminals 10 and 20 with a facial recognition algorithm installed, and do not need to prepare their own expensive facial recognition servers.

In addition, since the facial image of the user is registered in the registered user database, even if the facial recognition algorithm supported by the terminals 10 and 20 changes, the facial recognition algorithm can be switched without requesting the user to re-register the facial image. Specifically, the terminals 10 and 20 notify the server device 30 of the switched facial recognition algorithm. Upon receiving the notification, the server device 30 generates features that are compatible with the switched facial recognition algorithm from the facial image registered in the registered user database, and updates the corresponding entry using the generated features. Note that it is not necessary to update the above entries for the entire registered user database; it is sufficient to update only the switched facial recognition algorithm (the switched facial recognition algorithm used by the terminals 10 and 20).

In addition, in the registered user database (see FIG. 4) of the authentication system according to the first embodiment, authentication information (feature values, algorithm IDs) corresponding to multiple authentication algorithms is stored for each user ID. The user IDs derived from multiple pieces of authentication information are shared, and there is no duplicate information, preventing waste of resources. In other words, the registered user database stores the minimum amount of information required to accommodate multiple authentication algorithms.

In addition, in the authentication system according to the first embodiment, even if the service providers are different, as long as the face recognition algorithm used is the same, there is no need to register features for each service provider. This is because, in the present disclosure, features are not registered for each service provider, but for each authentication algorithm. This also prevents the waste of resources required for database construction.

Second Embodiment
Next, the second embodiment will be described in detail with reference to the drawings.

In the first embodiment, a case where the server device 30 generates features from a face image acquired in advance in the use service registration phase is described. In the second embodiment, a case where the terminals 10 and 20 generate features in the use service registration phase is described.

In the second embodiment, the operation of the authentication system is also divided into three phases. Of these three phases, the authentication phase can be the same as the operation described in the first embodiment, so the explanation of the authentication phase for the second embodiment will be omitted. The following explanation will focus on the differences between the user registration phase and the utilization service registration phase in the first and second embodiments.

In the user registration phase, the user registers a user ID in the system, but does not register a facial image in the system. That is, the user information acquisition unit 202 of the server device 30 acquires the user ID from the user, adds an entry to the registered user database, and stores the acquired user ID.

In the service registration phase, when a user who wishes to register to use the service inputs a user ID and detailed information (personal information such as name and address) into terminal 10, 20, a facial image of the user is acquired. After that, terminal 10, 20 generates features from the acquired facial image and transmits the generated features together with the user ID and algorithm ID to server device 30 (see FIG. 11).

In the usage service registration phase, the server device 30 identifies a corresponding entry in the registered user database using the acquired user ID as a search key, and adds the feature and algorithm ID to the identified entry. In the second embodiment, the feature registration unit 203 of the server device 30 registers the feature acquired from the terminals 10 and 20 (feature that matches the face recognition algorithm supported by each terminal) in the registered user database. This registration operation creates the registered user database described in the first embodiment (the database shown in the upper right corner of Figures 4 and 11).

The processing configuration of the terminal 10 and server device 30 corresponding to the above description can be as shown in Figures 12 and 13.

Referring to Figures 12 and 13, the server device 30 does not have a "feature generating unit," but the terminal 10 has a feature generating unit 307. Note that the operation of other components included in the terminal 10 and the server device 30 (e.g., the matching unit 205 and the matching request unit 304) can be the same as the operation described in the first embodiment, and even if there are differences, they will be clear to those skilled in the art, so detailed explanations will be omitted.

As described above, in the second embodiment, in the utilization service registration phase, the terminals 10 and 20 generate features of the user and transmit the generated features and algorithm ID to the server device 30. The server device 30 uses the received features and algorithm ID to construct a registered user database. In this way, in the second embodiment, an authentication system that supports multiple authentication algorithms is provided without storing the user's facial image (biometric information) in the server device 30. As facial images are not registered in the server device 30, the user's privacy can be appropriately protected.

Next, we will explain the hardware of each device that makes up the authentication system. Figure 14 is a diagram showing an example of the hardware configuration of server device 30.

The server device 30 can be configured by an information processing device (so-called a computer), and has the configuration shown in FIG. 14. For example, the server device 30 has a processor 311, a memory 312, an input/output interface 313, a communication interface 314, etc. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

However, the configuration shown in FIG. 14 is not intended to limit the hardware configuration of the server device 30. The server device 30 may include hardware not shown, and may not include an input/output interface 313 as necessary. In addition, the number of processors 311 and the like included in the server device 30 is not intended to be limited to the example shown in FIG. 14, and for example, the server device 30 may include multiple processors 311.

The processor 311 is, for example, a programmable device such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a DSP (Digital Signal Processor). Alternatively, the processor 311 may be a device such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). The processor 311 executes various programs including an operating system (OS).

Memory 312 is a RAM (Random Access Memory), a ROM (Read Only Memory), a HDD (Hard Disk Drive), a SSD (Solid State Drive), etc. Memory 312 stores the OS program, application programs, and various data.

The input/output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display. The input device is, for example, a device that accepts user operations such as a keyboard or a mouse.

The communication interface 314 is a circuit, module, etc. that communicates with other devices. For example, the communication interface 314 includes a NIC (Network Interface Card), etc.

The functions of the server device 30 are realized by various processing modules. For example, the processing modules are realized by the processor 311 executing a program stored in the memory 312. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network or updated using a storage medium that stores the program. Furthermore, the processing modules may be realized by a semiconductor chip.

In addition, like the server device 30, the terminals 10 and 20 can also be configured with information processing devices, and their basic hardware configuration is no different from that of the server device 30, so a description thereof will be omitted. Specifically, the terminals 10 and 20 differ from the server device 30 in that they are equipped with a camera device, but the other components can be the same as those of the server device 30.

[Modification]
The configuration, operation, and the like of the authentication system described in the above embodiment are merely examples, and are not intended to limit the system configuration, and the like.

For example, in the above embodiment, a case has been described in which the registered user database is constructed inside the server device 30, but the registered user database may also be constructed in an externally installed database server. Furthermore, the server device 30 may be physically configured by one information processing device, or may be physically configured by multiple information processing devices. In the latter case, the multiple information processing devices may be connected to each other via a network.

In the above embodiment, a case has been described in which the terminals 10 and 20 transmit features generated from the user's facial image to the server device 30 in the authentication phase. However, the terminals 10 and 20 may transmit the user's facial image (biometric information) to the server device 30 and request matching from the server. In this case, the server device 30 may extract the facial image from the matching request and generate features according to the algorithm ID. Furthermore, the authentication system may include a mixture of terminals that transmit features and terminals that transmit biometric information (facial image).

In the above embodiment, the case where the terminals 10, 20 installed at the service provider send a matching request to the server device 30 has been described. However, a server installed at each service provider may receive the matching request from the terminals 10, 20 and transmit (transfer) the matching request to the server device 30. That is, the network configuration on the service side may be a so-called server-client configuration as shown in FIG. 15. In the example shown in FIG. 15, a service server 40 installed at hotel A accepts matching requests from multiple terminals 10-1, 10-2 and transfers the matching requests to the server device 30. In addition, the service server 40 transfers the response (user ID) received from the server device 30 to the sender of the matching request.

Furthermore, when the configuration shown in FIG. 15 is adopted, the service server 40 may perform the service registration process for the user. In other words, the service server 40 may operate as an HTTP (Hyper Text Transfer Protocol) server for inputting a user ID and detailed information (name, address, etc.). In this case, the service server 40 may also transmit the user ID and algorithm ID to the server device 30 in the usage service registration phase.

The form of data transmission and reception between the terminal 10 and the server device 30 is not particularly limited, but the data transmitted and received between these devices may be encrypted. The facial image and the features calculated from the facial image are personal information, and in order to appropriately protect the personal information, it is desirable to transmit and receive encrypted data. Furthermore, the terminals 10 and 20 may transmit a matching request with a digital signature to the server device 30. If the verification of the digital signature is successful, the server device 30 may process the acquired matching request. In this way, the server device 30 may be able to verify the legitimacy of the terminals 10 and 20 that are the senders of the matching request by verifying the digital signature.

In the flow diagrams (flowcharts, sequence diagrams) used in the above explanation, multiple steps (processes) are described in order, but the order in which the steps are executed in the embodiment is not limited to the order described. In the embodiment, the order of the steps shown in the diagrams can be changed to the extent that does not interfere with the content, such as executing each process in parallel.

The above embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are necessary. Furthermore, when multiple embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace part of the configuration of an embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of an embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of an embodiment with other configurations.

The above explanation makes it clear that the present invention has industrial applicability, and it can be suitably applied to personal authentication when providing lodging services at a hotel or when paying for merchandise at a retail store.

A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.
[Appendix 1]
A communication unit that receives a matching request including an ID (identifier) of an authentication algorithm supported by the terminal;
a matching unit that processes the matching request using a registered user database that stores a user ID, a feature amount generated from the biometric information of the user, and an ID of an authentication algorithm that can use the generated feature amount in association with each other;
A server device comprising:
[Appendix 2]
The server device described in Appendix 1, wherein the matching unit sets the features of an entry in the registered user database that has an authentication algorithm ID that matches the authentication algorithm ID included in the matching request as the features of the registration side, and processes the matching request.
[Appendix 3]
the matching request includes a feature amount generated from the biometric information of the user acquired by the terminal;
The server device according to claim 2, wherein the matching unit sets the feature included in the matching request as a feature on the matching side and processes the matching request.
[Appendix 4]
4. The server device according to claim 1, wherein the matching unit transmits the ID of the user identified by processing the matching request to a terminal that is a sender of the matching request.
[Appendix 5]
5. The server device according to claim 1, further comprising a feature generation unit that generates features to be stored in the registered user database from biometric information of the user acquired before processing the matching request.
[Appendix 6]
5. The server device according to claim 1, further comprising: a terminal that receives information stored in the registered user database from the terminal;
[Appendix 7]
An acquisition unit that acquires biometric information of a user;
a transmission unit that transmits to a server device an ID (identifier) of a user, a feature amount generated from biometric information of the user, and an ID of an authentication algorithm that can use the generated feature amount;
A terminal comprising:
[Appendix 8]
A terminal,
A server device;
Including,
The server device includes:
receiving a verification request including an ID (Identifier) of an authentication algorithm supported by the terminal;
An authentication system that processes the matching request using a registered user database that stores a user's ID, a feature generated from the user's biometric information, and an ID of an authentication algorithm that can use the generated feature, in association with each other.
[Appendix 9]
The server device includes:
An authentication system as described in Appendix 8, which sets the features of an entry in the registered user database that has an authentication algorithm ID that matches the authentication algorithm ID included in the matching request as the features of the registration side, and processes the matching request.
[Appendix 10]
the matching request includes a feature amount generated from the biometric information of the user acquired by the terminal;
The authentication system according to claim 9, wherein the server device sets the feature included in the matching request as a feature on the matching side and processes the matching request.
[Appendix 11]
11. The authentication system according to claim 8, wherein the server device transmits the ID of the user identified by the processing of the verification request to the terminal that is the sender of the verification request.
[Appendix 12]
The authentication system according to any one of appendices 8 to 11, wherein the server device generates a feature to be stored in the registered user database from biometric information of the user acquired before processing the matching request.
[Appendix 13]
13. The authentication system according to any one of appendices 8 to 12, wherein the server device acquires information to be stored in the registered user database from the terminal.
[Appendix 14]
A terminal,
A server device;
In an authentication system including
receiving a verification request including an ID (Identifier) of an authentication algorithm supported by the terminal;
An authentication method, comprising: processing the matching request using a registered user database that stores a user's ID, a feature generated from the user's biometric information, and an ID of an authentication algorithm that can use the generated feature, in association with each other.
[Appendix 15]
A computer installed in the server device
A process of receiving a matching request including an ID (Identifier) of an authentication algorithm supported by the terminal;
a process of processing the matching request using a registered user database that stores a user ID, a feature amount generated from the biometric information of the user, and an ID of an authentication algorithm that can use the generated feature amount in association with each other;
A computer-readable storage medium that stores a program for executing the above.
In addition, the forms of Supplementary Note 14 and Supplementary Note 15 can be expanded into the forms of Supplementary Note 2 to Supplementary Note 6, similarly to the form of Supplementary Note 1.

The disclosures of the above cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. Those skilled in the art will understand that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and amendments that a person skilled in the art can make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas.

10, 10-1, 10-2, 20 Terminal 30, 100 Server device 40 Service server 101 Communication unit 102, 205 Matching unit 201, 301 Communication control unit 202 User information acquisition unit 203 Feature registration unit 204, 307 Feature generation unit 206, 306 Storage unit 302 User information registration unit 303 Face image acquisition unit 304 Matching request unit 305 Function realization unit 311 Processor 312 Memory 313 Input/output interface 314 Communication interface

Claims (9)

The computer
acquiring, from a service provider , a feature amount of biometric information of a user , the feature amount being generated by the service provider, and an algorithm ID of an authentication engine adopted by the service provider ;
a step of comparing the acquired feature amount with a feature amount generated based on an authentication engine corresponding to the acquired algorithm ID among a plurality of authentication engines ;
transmitting the result of said matching to said service provider. The step of checking includes:
The method according to claim 1 , wherein the matching is performed using the acquired feature amount and a feature amount of the biometric information of the user that is generated differently depending on the authentication engine even if the biometric information of the user is the same. The computer includes:
The method according to claim 1 , further comprising the step of acquiring a feature amount of biometric information of the user from a terminal installed at the service provider. The computer
acquiring a user ID and biometric information of a user;
acquiring, from a service provider , the user ID and an algorithm ID of an authentication engine adopted by the service provider ;
extracting a feature amount of biometric information of the user corresponding to the acquired user ID according to an authentication engine corresponding to the acquired algorithm ID among a plurality of authentication engines ;
and registering the extracted feature quantity. The method according to claim 4, wherein the step of extracting the feature quantity extracts the feature quantity such that the feature quantity of the biometric information of the user differs when the type of the authentication engine is different even if the acquired biometric information of the user is the same. a means for acquiring from a service provider a feature amount of biometric information of a user, the feature amount being generated by the service provider, and an algorithm ID of an authentication engine adopted by the service provider ;
a means for comparing the acquired feature amount with a feature amount generated based on an authentication engine corresponding to the acquired algorithm ID among a plurality of authentication engines ;
means for transmitting the result of said matching to said service provider;
A server device comprising: A means for acquiring a user ID and biometric information of a user;
A means for acquiring, from a service provider , the user ID and an algorithm ID of an authentication engine adopted by the service provider ;
means for extracting a feature amount of biometric information of the user corresponding to the acquired user ID according to an authentication engine corresponding to the acquired algorithm ID among a plurality of authentication engines ;
A means for registering the extracted feature amount;
A server device comprising: A computer installed in the server device
A process of acquiring, from a service provider , feature amounts of biometric information of a user, which are generated by the service provider, and an algorithm ID of an authentication engine adopted by the service provider ;
A process of comparing the acquired feature amount with a feature amount generated based on an authentication engine corresponding to the acquired algorithm ID among a plurality of authentication engines ;
sending a result of the matching to the service provider;
A program for executing. A computer installed in the server device
A process of acquiring a user ID and biometric information of a user;
A process of acquiring the user ID and an algorithm ID of an authentication engine adopted by the service provider from the service provider;
extracting a feature amount of biometric information of the user corresponding to the acquired user ID according to an authentication engine adopted by the service provider corresponding to the acquired algorithm ID among a plurality of authentication engines;
A process of registering the extracted feature amount;
A program for executing.

Images