JP7597153B2 - Server device, system, server device control method and computer program - Google Patents

Description

The present invention relates to a server device, a system, a method for controlling a server device, and a storage medium.

Immigration inspections are carried out at airports and ports. The immigration officer in charge of the inspection compares the face of the person in front of them with the photograph on the passport, and if the image on the passport matches the face of the person in front of them, the officer allows the person to enter or leave the country.

Technology is currently being developed to use biometric authentication for the above immigration procedures.

For example, the mobility monitoring method described in Patent Document 1 captures biometric data and associated identification data of an individual at a first point in a person's path of movement from a public area to a secure area. The mobility monitoring method captures biometric data and associated identification data of the individual at a second point in the secure area. The mobility monitoring method compares the identification data captured at the second point with that captured at the first point. Furthermore, the mobility monitoring method compares, if there is a match, an associated image captured at the first point with an associated image captured at the second point for the matching identification data.

Patent document 2 states that it provides technology that can estimate the effect of measures to improve accuracy in advance and present it to managers.

Special Publication No. 2007-506159 JP 2014-081796 A

As disclosed in Patent Documents 1 and 2, various technologies related to biometric authentication have been developed. However, there is a limit to the accuracy of biometric authentication, and a certain percentage of erroneous authentication (acceptance of a false person, rejection of the person in question) may occur. If an erroneous authentication occurs during procedures at an airport, it may take time to correct the erroneous authentication, or the user may leave the country on the wrong aircraft.

The main objective of the present invention is to provide a server device, a system, a method for controlling a server device, and a storage medium that contribute to making it possible to detect the occurrence of erroneous authentication (particularly false acceptance) in biometric authentication.

According to a first aspect of the present invention, a server device is provided that includes a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among a plurality of terminals; an authentication unit that performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users that have been registered in advance; and a storage unit that stores, for a person who has succeeded in the biometric authentication, the registered biometric information and authentication result detailed information including details of when the authentication request was processed, the biometric information being acquired by the terminal that is the sender of the authentication request, in association with each other.

According to a second aspect of the present invention, there is provided a system including a plurality of terminals and a server device connected to the plurality of terminals, the server device including a receiving unit that receives an authentication request including the biometric information of a person to be authenticated from a terminal among the plurality of terminals that has acquired the biometric information of the person to be authenticated, an authentication unit that performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users that have been registered in advance, and a storage unit that stores, for a person who has succeeded in the biometric authentication, the pre-registered biometric information and authentication result detailed information including details of when the authentication request was processed, the information including the biometric information acquired by the terminal that is the sender of the authentication request, in association with each other.

According to a third aspect of the present invention, a method for controlling a server device is provided, in which a server device receives an authentication request including biometric information of a person to be authenticated from a terminal among a plurality of terminals that has acquired the biometric information of the person to be authenticated, performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of pre-registered users, and for a person who has succeeded in the biometric authentication, associates and stores the pre-registered biometric information with authentication result detail information including details of when the authentication request was processed and including biometric information acquired by the terminal that is the sender of the authentication request.

According to a fourth aspect of the present invention, a computer-readable storage medium is provided that stores a program for causing a computer mounted on a server device to execute the following processes: receiving an authentication request including biometric information of a person to be authenticated from a terminal among a plurality of terminals that has acquired the biometric information of the person to be authenticated; performing biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of pre-registered users; and, for a person who has succeeded in the biometric authentication, storing in association with each other the pre-registered biometric information and authentication result detailed information including details of when the authentication request was processed and including biometric information acquired by the terminal that is the sender of the authentication request.

According to each aspect of the present invention, a server device, a system, a control method for a server device, and a storage medium are provided that contribute to making it possible to detect the occurrence of erroneous authentication (particularly false acceptance) in biometric authentication. Note that the effects of the present invention are not limited to the above. The present invention may achieve other effects instead of or in addition to the effects.

FIG. 1 is a diagram for explaining an overview of an embodiment. 1 is a diagram showing an example of a schematic configuration of a boarding procedure system according to a first embodiment; FIG. 2 is a diagram illustrating an example of a processing configuration of a check-in terminal according to the first embodiment. FIG. 4 is a diagram for explaining the operation of a system registration unit according to the first embodiment. FIG. 2 is a diagram illustrating an example of a processing configuration of a system registration unit according to the first embodiment. FIG. 2 is a diagram illustrating an example of a processing configuration of a boarding gate apparatus according to the first embodiment. FIG. 11 is a diagram illustrating an example of an authentication request according to the first embodiment. FIG. 2 is a diagram illustrating an example of a processing configuration of a server device according to the first embodiment. FIG. 2 is a diagram illustrating an example of a token ID information database according to the first embodiment. FIG. 2 is a diagram illustrating an example of a business information database according to the first embodiment. FIG. 4 is a diagram illustrating an example of an authentication result database according to the first embodiment. 6 is a diagram for explaining an operation of a verification information generating unit according to the first embodiment; FIG. 6 is a diagram for explaining an operation of a verification information generating unit according to the first embodiment; FIG. FIG. 4 is a sequence diagram showing an example of the operation of the boarding procedure system according to the first embodiment. 13 is a diagram for explaining an operation of a verification information generating unit according to the second embodiment; FIG. FIG. 2 illustrates an example of a hardware configuration of a server device. 13 is a diagram for explaining the operation of a server device according to a modified example of the present disclosure. FIG. 13 is a diagram for explaining the operation of the staff terminal according to the modified example disclosed in the present application. FIG. 13 is a diagram for explaining the operation of the staff terminal according to the modified example disclosed in the present application. FIG. 13 is a diagram for explaining the operation of the staff terminal according to the modified example disclosed in the present application. FIG. FIG. 13 is a diagram illustrating an example of a processing configuration of a server device according to a modified example of the present disclosure.

First, an overview of one embodiment will be described. The reference numbers in the drawings are added to each element for convenience as an example to aid in understanding, and the description of this overview is not intended to be limiting in any way. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units rather than hardware units. The connection lines between blocks in each drawing include both bidirectional and unidirectional lines. Unidirectional arrows are used to show the main signal (data) flow diagrammatically, and do not exclude bidirectionality. In this specification and drawings, elements that can be described in the same way may be given the same reference numbers to avoid duplicated explanations.

A server device 100 according to one embodiment includes a receiving unit 101, an authentication unit 102, and a storage unit 103 (see FIG. 1). The receiving unit 101 receives an authentication request including the biometric information of the person to be authenticated from a terminal among the multiple terminals that has acquired the biometric information of the person to be authenticated. The authentication unit 102 performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of multiple users that have been registered in advance. The storage unit 103 stores, for those who have been successfully authenticated through biometric authentication, the pre-registered biometric information and authentication result details information in association with each other. The authentication result details information includes the biometric information acquired by the terminal that is the sender of the authentication request.

Each time the server device 100 processes an authentication request from a terminal, it stores details of the result (history). Using this history information, the server device 100 can generate authentication result verification information that allows airport staff to verify whether the authentication result includes any erroneous authentications (particularly erroneous authentications related to false acceptance). This information is provided to staff, who can detect the occurrence of false acceptance by checking the display generated based on this information. Here, the authentication result verification information can include the ID of the terminal that acquired the acquired face image in addition to the two types of biometric information used for authentication (e.g., the registered face image and the acquired face image). Staff can identify the terminal where the erroneous authentication occurred based on the ID of the terminal, so problems and inconsistencies associated with the occurrence of false acceptance can be quickly resolved.

Specific embodiments are described in more detail below with reference to the drawings.

[First embodiment]
The first embodiment will be described in more detail with reference to the drawings.

[System Configuration]
Fig. 2 is a diagram showing an example of a schematic configuration of a check-in system according to the first embodiment. The check-in system according to the first embodiment is a system that realizes a series of procedures at an airport (baggage check, security check, etc.) by biometric authentication. The check-in system shown in Fig. 2 is operated, for example, by a public institution such as an immigration control bureau or a contractor entrusted with the business by the public institution.

In this disclosure, "boarding procedures" refers to the series of procedures carried out from check-in to boarding the aircraft.

Referring to FIG. 2, the boarding procedure system includes a check-in terminal 10, a baggage drop machine 11, a passenger passage system 12, a gate device 13, a boarding gate device 14, a server device 20, and an employee terminal 30.

The check-in terminal 10, baggage drop machine 11, passenger passage system 12, gate device 13, and boarding gate device 14 are terminals (touch points) installed at the airport. These terminals are connected to the server device 20 via a network. The network shown in FIG. 2 is composed of a LAN (Local Area Network), including the airport's on-site communication network, a WAN (Wide Area Network), a mobile communication network, etc. The connection method is not limited to a wired method, and may be a wireless method.

The server device 20 is installed in a facility of an airport company or the like. Alternatively, the server device 20 may be a server installed in a cloud on a network.

The staff terminal 30 is a terminal used by airport or airline staff, etc. The check-in system may include one staff terminal 30, or may include multiple staff terminals 30.

The staff terminal 30 may be a stationary computer as shown in FIG. 2, or a portable terminal such as a mobile phone, smartphone, tablet, or laptop. The staff terminal 30 may be of any type or form as long as it is a terminal used by staff.

Note that the configuration shown in FIG. 2 is an example and is not intended to limit the configuration of the boarding system. The boarding system may include devices not shown.

The boarding procedure for users is carried out at each terminal shown in Figure 2. Specifically, a series of procedures when a user departs the country is carried out sequentially at terminals installed at five locations. In the boarding procedure system shown in Figure 2, the boarding procedure for users is realized by authentication using biometric information (biometric authentication).

Biometric information in this disclosure includes face images, fingerprint images, iris images, finger vein images, palm print images, palm vein images, etc. Alternatively, biometric information may be audio data (voiceprint) that stores a person's voice. There may be one or more pieces of biometric information. Note that the term "biometric information" in this disclosure refers to image data containing all or part of a living body, audio data, and features extracted from the images.

When a user (system user) who wishes to check in using biometric authentication arrives at the airport, they operate the check-in terminal 10 to carry out the "check-in procedure." The system user presents the check-in terminal 10 with a paper airline ticket, a two-dimensional barcode containing boarding information, a mobile device displaying a copy of the e-ticket, or the like. Once the check-in procedure is complete, the check-in terminal 10 outputs a boarding pass. The boarding pass includes both paper and electronic boarding passes.

A system user who has completed the check-in procedure and wishes to use biometric authentication for boarding procedures registers with the system using the check-in terminal 10. Specifically, the system user has the check-in terminal 10 read the boarding pass and passport they have acquired. The check-in terminal 10 also acquires the system user's biometric information (e.g., a facial image).

The check-in terminal 10 transmits information related to these (boarding pass, passport, biometric information) to the server device 20.

The server device 20 checks the validity of the information obtained from the check-in terminal 10. Specifically, the server device 20 checks the validity of the presented passport. Upon completing this check, the server device 20 registers the system user. Specifically, the server device 20 issues a token to be used for the boarding procedure of the user registered in the system.

The issued token is identified by a token ID (identifier). Information required for boarding procedures (e.g., biometric information, business information required for boarding procedures, etc.) is associated via the token ID. In other words, a "token" is issued together with the registration of a system user, and is identification information that enables the registered system user to undergo boarding procedures using biometric information. Once a token (token ID) is issued, the system user can use boarding procedures that use biometric authentication.

In response to the generation of the token, the server device 20 adds an entry to both the token ID information database and the business information database.

The token ID information database is a database that stores detailed information about generated tokens. The database stores at least the token ID and biometric information (facial image, feature amount) in association with each other. The server device 20 refers to the token ID information database to perform biometric authentication.

The business information database is a database that stores business information. The business information database stores token IDs and business information in association with each other. Business information is information that is required when a terminal proceeds with a procedure (business).

When a system user to whom a token has been issued arrives at a terminal, biometric information (e.g., a facial image) is acquired at the terminal. The terminal transmits an authentication request including the facial image to the server device 20.

In this disclosure, the term "terminal" refers to an apparatus, device, etc. that transmits an authentication request including biometric information to the server apparatus 20. In the example of FIG. 2, the baggage drop machine 11, the passenger passage system 12, the gate apparatus 13, and the boarding gate apparatus 14 correspond to the "terminal". Alternatively, if the check-in procedure is also performed using biometric authentication, the check-in terminal 10 also corresponds to the "terminal".

The server device 20 performs biometric authentication using the biometric information acquired from the terminal and the biometric information registered in the system. If the biometric authentication is successful, the server device 20 sends a positive response to the terminal indicating that. The positive response includes business information that is required for the terminal to proceed with the procedure. If the biometric authentication fails, the server device 20 sends a negative response to the terminal indicating that the authentication is unsuccessful.

The server device 20 stores and manages detailed information when processing authentication requests received from each terminal. Specifically, the server device 20 uses an authentication result database to store the above details. Details of the authentication result database will be described later.

The terminal that receives the successful authentication performs the boarding procedure for the user based on the acquired business information. For example, the terminal opens the gate, etc., as necessary, and allows the user to pass through. The terminal that receives the failed authentication notifies the person to be authenticated.

The server device 20 analyzes the results (detailed information) of the authentication process stored in the authentication result database, and generates authentication result verification information for airport or airline staff to verify whether the biometric authentication results include any erroneous authentications (particularly erroneous authentications related to false acceptance). The server device 20 provides the generated authentication result verification information to the staff terminal 30.

The staff member verifies whether false acceptance has occurred based on the display generated based on the authentication result verification information. If false acceptance has occurred, the staff member resolves any inconsistencies that arise as a result of the false acceptance.

Next, we will explain the general configuration and functions of each device.

The check-in terminal 10 is installed in the check-in lobby of the airport. As described above, the user uses the check-in terminal 10 to register with the system in order to carry out the boarding procedure using biometric authentication. The system user also operates the check-in terminal 10 to carry out the check-in procedure. In other words, the check-in terminal 10 is also a self-service terminal that is operated by the user to carry out the check-in procedure. The check-in terminal 10 is also called a CUSS (Common Use Self Service) terminal. After completing the check-in procedure, the user proceeds to the baggage drop-off area or security checkpoint.

The baggage drop machine 11 is installed in an area adjacent to the baggage counter (manned counter) in the airport or in an area near the check-in terminal 10. The baggage drop machine 11 is a self-service terminal that is operated by a user to carry out the procedure for dropping off baggage that will not be carried on board the aircraft (baggage drop procedure). The baggage drop machine 11 is also called a CUBD (Common Use Bag Drop) terminal. After completing the baggage drop procedure, the user proceeds to the security inspection area. Note that if the user does not check in baggage, the baggage drop procedure is omitted.

The passenger passage system 12 is a gate device installed at the entrance to the security checkpoint in the airport. The passenger passage system 12 is also called a PRS (Passenger Reconciliation System), and is a system that determines whether or not a user can pass through the security checkpoint at the entrance. After passing through the passenger passage system 12 and completing the security check procedure, the user moves to the departure inspection area.

Gate device 13 is installed at the immigration area in the airport. Gate device 13 is a device that automatically performs immigration procedures for users. After completing immigration procedures, users move to the departure area where duty-free shops and boarding gates are located.

The boarding gate device 14 is a passage control device installed at each boarding gate in the departure area. The boarding gate device 14 is the final gate device in the series of procedures for departure inspection (inspection using biometric information). The boarding gate device 14 is also called an ABG (Automated Boarding Gates) terminal. The boarding gate device 14 verifies that the user is a passenger of an aircraft that can be boarded from the boarding gate. After passing through the boarding gate device 14, the user boards the aircraft and departs for a second country.

Note that the boarding procedure using biometric authentication by the devices shown in FIG. 2 (check-in terminal 10, baggage drop machine 11, passenger passage system 12, gate device 13, boarding gate device 14) is just one example, and is not intended to limit the devices used in the procedure. For example, devices other than the above devices may be used for the boarding procedure, or some of the above devices may not be used for the procedure. For example, gate device 13 may not be included in the boarding procedure system.

The server device 20 is a server device for supporting and managing the above-mentioned boarding procedures. The server device 20 manages token IDs. Specifically, the server device 20 issues and invalidates token IDs. The server device 20 also processes authentication requests from various terminals in the airport.

Next, we will explain the details of each device included in the boarding check-in system according to the first embodiment. In the following explanation, we will use the user's "face image" and "feature values generated from the face image" as examples of biometric information.

[Check-in terminal]
As described above, the check-in terminal 10 is a device that provides system users with operations related to check-in procedures and system registration.

Fig. 3 is a diagram showing an example of a processing configuration (processing module) of the check-in terminal 10 according to the first embodiment. Referring to Fig. 3, the check-in terminal 10 includes a communication control unit 201, a system registration unit 202, a token issuance request unit 203, a message output unit 204, a check-in execution unit 205, and a memory unit 206.

The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the server device 20. The communication control unit 201 also transmits data to the server device 20. The communication control unit 201 passes data received from other devices to other processing modules. The communication control unit 201 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data with other devices via the communication control unit 201.

The system registration unit 202 is a means for performing system registration of a user who wishes to check in using biometric authentication. For example, after the check-in procedure is completed, the system registration unit 202 provides the user with a GUI (Graphical User Interface) for confirming whether or not the user wishes to "check in using a facial image" (see Figure 4).

When a user requests boarding using a facial image, the system registration unit 202 uses a GUI to obtain three pieces of information (information printed on the boarding pass, information printed on the passport, and biometric information).

The system registration unit 202 has three sub-modules. FIG. 5 is a diagram showing an example of the processing configuration (processing module) of the system registration unit 202 according to the first embodiment. As shown in FIG. 5, the system registration unit 202 has a boarding pass information acquisition unit 211, a passport information acquisition unit 212, and a biometric information acquisition unit 213.

The boarding pass information acquisition unit 211 is a means for acquiring information (hereinafter referred to as boarding pass information) printed on a boarding pass held by a system user. The boarding pass information acquisition unit 211 controls a reader such as a scanner (not shown) to acquire the boarding pass information.

Boarding pass information includes name (first name, last name), airline code, flight number, boarding date, departure airport (boarding airport), destination airport (arrival airport), seat number, boarding time, arrival time, etc.

The passport information acquisition unit 212 is a means for acquiring information (hereinafter referred to as passport information) written on a passport held by a system user. The passport information acquisition unit 212 controls a reader such as a scanner to acquire passport information.

Passport information includes a facial image (hereinafter referred to as a passport facial image), name, gender, nationality, passport number, passport issuing country, etc.

The biometric information acquisition unit 213 is a means for acquiring biometric information of a system user. The biometric information acquisition unit 213 controls a camera to acquire a facial image of the system user. For example, when the biometric information acquisition unit 213 detects a face in an image that is constantly or periodically captured, it captures a picture of the user's face and acquires the facial image.

Before capturing a facial image, the biometric information acquisition unit 213 preferably displays a guidance message regarding capturing a facial image via the message output unit 204. For example, the biometric information acquisition unit 213 displays a message such as "We will capture an image of your face and register it in the system. The registered facial image will be deleted from the system after boarding is complete."

The system registration unit 202 passes the three pieces of acquired information (boarding pass information, passport information, and biometric information) to the token issuance request unit 203.

The token issuance request unit 203 shown in FIG. 3 is a means for requesting the server device 20 to issue a token. The token issuance request unit 203 generates a token issuance request including boarding pass information, passport information, and biometric information (facial image). The token issuance request unit 203 transmits the generated token issuance request to the server device 20.

The token issuance request unit 203 passes the response (response to the token issuance request) obtained from the server device 20 to the message output unit 204.

The message output unit 204 is a means for outputting various messages. For example, the message output unit 204 outputs a message in response to a response obtained from the server device 20.

When a response (positive response) indicating that the token has been successfully issued is received, the message output unit 204 outputs that information. For example, the message output unit 204 outputs a message such as "Future procedures can be carried out using facial recognition."

If a response (negative response) is received indicating that the token issuance has failed, the message output unit 204 outputs that information. For example, the message output unit 204 outputs a message such as "Sorry. We cannot process your request using face authentication. Please proceed to a manned booth."

The check-in execution unit 205 is a means for carrying out the check-in procedure for the user. The check-in execution unit 205 executes the check-in procedure, such as seat selection, based on the airline ticket presented by the user. For example, the check-in execution unit 205 transmits the information written on the airline ticket to a DCS (Departure Control System) and obtains the information to be written on the boarding pass from the DCS. Note that the operation of the check-in execution unit 205 can be the same as the operation of existing check-in terminals, so a detailed explanation will be omitted.

The memory unit 206 is a means for storing information necessary for the operation of the check-in terminal 10.

[Boarding gate equipment]
6 is a diagram showing an example of a processing configuration (processing module) of the boarding gate device 14 according to the first embodiment. Referring to Fig. 6, the boarding gate device 14 includes a communication control unit 301, a biometric information acquisition unit 302, an authentication request unit 303, a message output unit 304, a function realization unit 305, and a storage unit 306.

The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the server device 20. The communication control unit 301 also transmits data to the server device 20. The communication control unit 301 passes data received from other devices to other processing modules. The communication control unit 301 transmits data acquired from other processing modules to other devices. In this way, the other processing modules send and receive data to and from other devices via the communication control unit 301.

The biometric information acquisition unit 302 is a means for controlling a camera (not shown) and acquiring biometric information of a user. The biometric information acquisition unit 302 captures an image in front of the device periodically or at a predetermined timing. The biometric information acquisition unit 302 determines whether the acquired image contains a human face image, and if a face image is included, extracts the face image from the acquired image data.

Note that the facial image detection process and facial image extraction process performed by the biometric information acquisition unit 302 can use existing technology, so detailed explanations will be omitted. For example, the biometric information acquisition unit 302 may extract a facial image (facial area) from image data using a learning model trained by a CNN (Convolutional Neural Network). Alternatively, the biometric information acquisition unit 302 may extract a facial image using a method such as template matching.

The biometric information acquisition unit 302 passes the extracted facial image to the authentication request unit 303.

The authentication request unit 303 is a means for requesting the server device 20 to authenticate the user in front of the server device 20. The authentication request unit 303 generates an authentication request including an identifier of the device itself (hereinafter, referred to as a terminal ID), the acquired face image, etc. (see FIG. 7). The terminal ID may be a MAC (Media Access Control address) address, an IP (Internet Protocol) address, etc. The authentication request unit 303 transmits the generated authentication request to the server device 20.

By checking the terminal ID included in the authentication request, the server device 20 can uniquely identify the terminal that sent the authentication request. The server device 20 can also identify the type of terminal (baggage drop machine 11, passenger passage system 12, gate device 13, boarding gate device 14) based on the terminal ID. The terminal ID is shared between each terminal included in the system and the server device 20. For example, a system administrator or the like may determine the terminal ID and input the determined terminal ID to each terminal. The system administrator may also input table information or the like that associates terminal IDs with terminal types to the server device 20.

The authentication request unit 303 receives a response to the authentication request from the server device 20. The authentication request unit 303 passes the response obtained from the server device 20 to the message output unit 304 and the function realization unit 305.

The message output unit 304 is a means for outputting various messages. For example, the message output unit 304 outputs a message according to the authentication result (authentication successful, authentication failed) obtained from the server device 20.

The function realization unit 305 is a means for realizing the functions of the boarding gate device 14. The function realization unit 305 realizes procedures related to a person who has been successfully authenticated (a person who has been determined to have been successfully authenticated). The function realization unit 305 identifies the flight number of an aircraft that the user (person who has been successfully authenticated) can board from the acquired business information. If the identified flight number matches the flight number assigned to the function realization unit 305, the function realization unit 305 allows the person who has been successfully authenticated to pass through the gate. Note that the operation of the function realization unit 305 can be the same as that of existing boarding gate devices, and therefore a detailed explanation will be omitted. Also, an employee working for the airline of the aircraft boarding the aircraft from the boarding gate device 14 can assign (input) the necessary flight number to the boarding gate device 14.

When the function realization unit 305 allows a successfully authenticated person to pass through the gate, it notifies the server device 20 of this fact.

The memory unit 306 is a means for storing information necessary for the operation of the boarding gate device 14.

[Other devices]
The basic processing configuration of the other terminals included in the boarding procedure system (baggage drop machine 11, passenger passage system 12, gate device 13) can be the same as the processing configuration of the boarding gate device 14 shown in Fig. 6, so detailed explanation will be omitted. Each terminal acquires biometric information (facial image) of the system user and requests authentication using the acquired biometric information from the server device 20. If the authentication is successful, the function assigned to each terminal is executed. In addition, each terminal outputs a display (message) according to the authentication result (authentication successful, authentication failed).

[Server device]
Fig. 8 is a diagram showing an example of a processing configuration (processing module) of the server device 20 according to the first embodiment. Referring to Fig. 8, the server device 20 includes a communication control unit 401, a token generation unit 402, a database management unit 403, an authentication unit 404, a verification information generation unit 405, and a storage unit 406.

The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the check-in terminal 10. The communication control unit 401 also transmits data to the check-in terminal 10. The communication control unit 401 passes data received from other devices to other processing modules. The communication control unit 401 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 401. The communication control unit 401 has a function as an "acquisition unit" that acquires biometric information of the person to be authenticated from the terminal. Alternatively, the communication control unit 401 has a function as a "reception unit" that receives an authentication request including biometric information of the person to be authenticated, and a "transmission unit" that transmits a response to the authentication request.

The token generation unit 402 is a means for generating a token in response to a token generation request from the check-in terminal 10. At that time, the token generation unit 402 judges the validity of the passport presented by the user.

Specifically, the token generation unit 402 determines whether the person who presented a passport to the check-in terminal 10 and the person who was issued the passport are the same person. To perform this determination, the token generation unit 402 extracts the facial image included in the token generation request (the facial image of the system user) and the passport facial image included in the passport information. The token generation unit 402 determines whether these two facial images substantially match.

The token generation unit 402 performs matching (one-to-one matching) of the two facial images. The token generation unit 402 calculates feature vectors from each of the two images. The token generation unit 402 calculates the similarity (e.g., Euclidean distance) between the two images, and determines whether the two images are facial images of the same person based on the result of threshold processing on the calculated similarity. For example, if the similarity is greater than a predetermined value (if the distance is shorter than a predetermined value), the token generation unit 402 determines that the two facial images are of the same person.

When the token generation unit 402 has successfully verified the validity of the passport using the biometric information, it issues a token. For example, the token generation unit 402 generates a unique value as a token ID based on the date and time of processing, a sequence number, etc.

When the token generating unit 402 generates a token (token ID), it transmits a positive response (token issued) to the check-in terminal 10. When the token generating unit 402 fails to generate a token ID, it transmits a negative response (token not issued) to the check-in terminal 10.

When the token generation unit 402 successfully generates (issues) a token ID, it passes the generated token ID, boarding pass information, passport information, and facial image (facial image of the system user) to the database management unit 403.

The database management unit 403 is a means (management unit) for managing the database constructed in the server device 20.

The server device 20 includes a token ID information database, a business information database, and an authentication result database.

The token ID information database stores at least the token ID and the user's biometric information in association with each other. FIG. 9 is a diagram showing an example of the token ID information database. Referring to FIG. 9, the token ID information database has fields for storing the token ID, registered face image, feature amount, token issuance time, token issuing device name, etc.

As described above, the token ID is a temporarily issued identifier. When the user completes the procedures at the boarding gate device 14, the token ID is invalidated. In other words, the token ID is not a permanently used identifier, but a one-time ID with a validity period (life cycle).

The registered face image is a face image of a system user. For example, the registered face image may be a face image of the user captured by the check-in terminal 10, or a passport face image. The feature amount is a feature vector generated from the face image. The token issue time is the time when the server device 20 issues the token ID. The device name is the name of the device (e.g., the check-in terminal 10) from which the registered face image that triggered the issuance of the token ID was obtained.

The business information database is a database that manages information (business information) required when a user performs boarding procedures. FIG. 10 is a diagram showing an example of a business information database. Referring to FIG. 10, the business information database has fields for storing a token ID, passenger name, departure point, destination, airline code, flight number, operation date, etc. In addition to the above fields, the business information database may have fields for storing a seat number, nationality, passport number, surname, first name, date of birth, gender, etc. The business information database stores business information required for a specific task (procedure tasks performed at each touch point) for each token ID.

The above information stored in the business information database is obtained from boarding pass information and passport information.

When the database management unit 403 obtains a token ID from the token generation unit 402 (when a token ID is issued), it adds a new entry to the two databases. The database management unit 403 sets a setting value in the field of each database. For example, the database management unit 403 generates a feature amount from a registered face image and registers the generated feature amount in the token ID information database. Note that for fields in which a setting value cannot be set, the database management unit 403 may set an initial value (default value).

The authentication unit 404 is a means for performing biometric authentication. The authentication unit 404 processes an authentication request acquired from the terminal. The authentication unit 404 performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of multiple users registered in advance in a token ID information database.

Specifically, the authentication unit 404 processes an authentication request from a terminal that has acquired biometric information of the person to be authenticated among the multiple terminals, by referring to the token ID information database. The authentication request includes the biometric information of the person to be authenticated. The authentication unit 404 executes a matching process (1:N matching) using the biometric information included in the authentication request and the biometric information registered in the token ID information database.

The authentication unit 404 generates features from the facial image acquired from the terminal (baggage drop machine 11, passenger passage system 12, gate device 13, boarding gate device 14). Note that existing technology can be used for the feature generation process, so a detailed explanation is omitted. For example, the authentication unit 404 extracts the eyes, nose, mouth, etc. as feature points from the facial image. The authentication unit 404 then calculates the position of each feature point and the distance between each feature point as feature amounts, and generates a feature vector consisting of multiple feature amounts.

The authentication unit 404 sets the generated feature (feature vector) as the feature on the matching side, and the feature stored in the token ID information database as the feature on the registration side.

The authentication unit 404 calculates the similarity (score) between the feature on the matching side and each of the multiple feature on the registration side. The similarity can be calculated using chi-square distance, Euclidean distance, or the like. Note that the greater the distance, the lower the similarity, and the closer the distance, the higher the similarity.

The authentication unit 404 determines that authentication is successful if there is a feature among multiple features (valid features) registered in the token ID information database that has a similarity with the feature to be matched that is equal to or greater than a predetermined value.

If authentication is successful, the authentication unit 404 identifies the token ID that corresponds to the feature with the highest similarity. The authentication unit 404 searches the business information database using the identified token ID as a key to identify the corresponding entry.

The authentication unit 404 sends the authentication result to the terminal (responds to the authentication request).

If the authentication is successful, the authentication unit 404 sends a positive response to the terminal that includes the entry (token ID, business information) identified from the business information database.

If authentication fails, the authentication unit 404 sends a negative response to the terminal indicating that authentication failed.

Next, the authentication result database will be described. As described above, detailed information when an authentication request from each terminal is processed is stored in the authentication result database. For individuals who have been successfully authenticated through biometric authentication, the authentication result database stores pre-registered biometric information in association with information including details when the authentication request was processed (hereinafter referred to as authentication result detailed information).

Fig. 11 is a diagram showing an example of an authentication result database. As shown in Fig. 11, the authentication result database stores a registered face image and at least one authentication result detail information for each token ID (for each person who has been successfully authenticated). The authentication result detail information includes a terminal ID that identifies the sender of the authentication request, an acquired face image (a face image acquired by the terminal) included in the authentication request, a similarity (score) when authentication is determined to be successful, etc.

In addition, in FIG. 11, for ease of understanding, the symbols assigned to each terminal shown in FIG. 2 are used as terminal IDs. Also, the authentication result database shown in FIG. 11 is an example, and is not intended to limit the items to be stored. For example, the authentication result database may store the date and time when authentication was successful (authentication time), etc.

If the authentication is successful, the authentication unit 404 updates the authentication result database. Specifically, if the token ID of the person to be authenticated is not registered in the authentication result database, the authentication unit 404 adds a new entry to the database and writes details of the authentication process. If the token ID of the person to be authenticated is registered in the authentication result database, the authentication unit 404 writes the result of the authentication process in the authentication result detailed information field of the corresponding entry.

Note that the order of boarding procedures at airports is predetermined, so there is also an order to the terminal IDs stored in the authentication result database. For example, in the example of FIG. 2, normal procedures are carried out in the order of baggage drop machine 11, passenger passage system 12, gate device 13, and boarding gate device 14. Therefore, details of the authentication process are stored in the authentication result database in the order of each of the above terminals. Note that the procedure at baggage drop machine 11 is not essential, so the authentication results from that terminal may not be stored in the authentication result database.

The verification information generating unit 405 is a means for generating the above-mentioned authentication result verification information. The verification information generating unit 405 generates authentication result verification information including at least a registered face image, a terminal ID, and an acquired face image acquired by the terminal. The authentication result verification information generated by the verification information generating unit 405 is provided to airport or airline staff, etc.

For example, the verification information generating unit 405 transmits the generated authentication result verification information to the staff terminal 30. The staff terminal 30 generates a display (GUI) as shown in FIG. 12 based on the received authentication result verification information. The staff terminal 30 displays a display that allows the registered face image of the entry (successfully authenticated person) stored in the authentication result database and at least one acquired face image to be confirmed simultaneously. The staff terminal 30 also displays the name of the terminal that acquired the acquired face image based on the terminal ID.

The verification information generating unit 405 generates authentication result verification information in response to a request from a staff member (staff terminal 30) and transmits it to the staff terminal 30. The staff member checks the display as shown in FIG. 12, and if it is determined that no erroneous authentication due to false acceptance has occurred, the staff member presses the next button. In response to detecting the pressing of the next button, the staff terminal 30 requests the server device 20 to transmit new authentication result verification information.

When a new request is received, the verification information generation unit 405 generates authentication result verification information from the next entry in the authentication result database and transmits it to the staff terminal 30.

If the registered face image and the acquired face image are compared and it is believed that these face images were taken of different people, the staff member etc. determines that a false positive has occurred. In this case, the staff member etc. inputs the token ID into the server device 20 and obtains detailed information about the person who made the mistaken authentication (e.g., name, airline, flight number, etc.). Based on the obtained detailed information, the staff member etc. goes to the person who made the mistaken authentication and takes appropriate action. Specifically, the staff member etc. checks the passport etc. held by the person who made the mistaken authentication and corrects any inconsistencies that occurred due to the mistaken authentication.

Alternatively, the staff terminal 30 may display a button or the like for obtaining detailed information about the incorrectly authenticated party (see FIG. 13). When the staff member or the like requests detailed information (when the detailed information button is pressed), the staff terminal 30 notifies the server device 20 of this. In response to the notification, the verification information generation unit 405 of the server device searches the business information database using the token ID as a key. The verification information generation unit 405 transmits the name, airline code, flight number, etc. of the entry identified by the search results to the staff terminal 30. The staff terminal 30 displays the obtained information. Alternatively, the verification information generation unit 405 may generate a terminal passage history related to the incorrectly authenticated party (passenger selected by the staff member or the like) by referring to the authentication result database, and transmit the generated history to the staff terminal 30. The staff terminal 30 may display the passage history.

When multiple pieces of authentication result detailed information are stored for the same successful authentication individual, the verification information generating unit 405 generates authentication result verification information including a terminal ID and an acquired face image corresponding to each of the multiple pieces of authentication result detailed information. The staff terminal 30 can generate a display (GUI) such as that shown in FIG. 12 and FIG. 13 using such authentication result verification information.

The storage unit 406 stores various information necessary for the operation of the server device 20. A token ID information database, a business information database, and an authentication result database are constructed in the storage unit 406.

[Staff terminal]
The staff terminal 30 may be equipped with a display device such as a liquid crystal panel, an operating device such as a touch panel, and an information output function and an information input function. The staff terminal 30 may be realized by a commercially available computer, and the internal processing configuration, etc. will be clear to those skilled in the art, so a description thereof will be omitted.

[System Operation]
Next, the operation of the boarding system according to the first embodiment will be described. Fig. 14 is a sequence diagram showing an example of the operation of the boarding system according to the first embodiment. The operation when performing the authentication process of the user and the operation thereafter will be described with reference to Fig. 14. The explanation of the operation related to the system registration will be omitted.

The terminal (either the baggage drop machine 11, the passenger passage system 12, the gate device 13, or the boarding gate device 14) acquires a facial image of the user (person to be authenticated) and sends an authentication request to the server device 20 (step S01).

The server device 20 generates features from the facial image included in the authentication request and performs authentication processing using the token ID information database (step S02).

If the authentication is successful (step S03, Yes branch), the server device 20 searches the business information database using the token ID obtained by the matching process as a key (step S04).

If authentication fails (step S03, No branch), the server device 20 executes the process from step S05 onwards.

The server device 20 sends the authentication result (authentication successful, authentication failed) to the terminal (touch point) (step S05).

The terminal performs a display according to the authentication result obtained from the server device 20 (step S06). The terminal also executes the boarding procedure for the user according to the authentication result. A description of this operation is omitted. Each terminal only needs to execute the function assigned to it.

The staff terminal 30 requests the server device 20 to provide information to verify the occurrence of an erroneous authentication (acceptance of a false identity) (step S11).

The server device 20 generates authentication result verification information by referring to the authentication result database. The server device 20 transmits the generated authentication result verification information to the staff terminal 30 (step S12).

The staff terminal 30 displays a GUI for verifying the occurrence of an erroneous authentication based on the authentication result verification information (step S13).

As described above, when the boarding system according to the first embodiment successfully authenticates the person to be authenticated, it stores details of the authentication process (authentication result) in an authentication result database. In response to a request from a staff member or the like, the server device 20 refers to the database and generates authentication result verification information for the staff member or the like to verify the occurrence of erroneous authentication (acceptance of a false person). The authentication result verification information includes the registered face image and the acquired face image, as well as the terminal ID of the terminal that triggered the occurrence of the authentication process. Therefore, the staff terminal 30 can identify which of multiple terminals (terminals such as the baggage drop machine 11) the false acceptance occurred at. In addition, the staff terminal 30 can present detailed information about the party involved in the false acceptance (e.g., flight number, airline, etc.) to the staff member, so that the staff member can quickly take appropriate measures.

Second Embodiment
Next, the second embodiment will be described in detail with reference to the drawings.

In the first embodiment, each entry stored in the authentication result database is the subject of information provision (the subject of generating authentication result verification information). However, with this approach, if the authentication result database contains a large number of entries, it will require a great deal of effort from staff and others to verify the acceptance of third parties.

In the second embodiment, we will explain the case where the entries for which authentication result verification information is generated are narrowed down in order to reduce the workload of staff.

The schematic configuration of the boarding procedure system according to the second embodiment can be the same as that of the first embodiment, so the explanation corresponding to FIG. 2 will be omitted. Similarly, the processing configuration of the server device 20 and the terminal according to the second embodiment can be the same as that of the first embodiment, so the explanation will be omitted.

The differences between the first and second embodiments are explained below.

The verification information generating unit 405 according to the second embodiment generates authentication result verification information for authentication results that are highly likely to have involved false acceptance among the biometric authentication results. The verification information generating unit 405 excludes authentication results (entries in the authentication result database) that are unlikely to have involved false acceptance from the targets for generating authentication result verification information.

The verification information generating unit 405 determines whether or not to generate authentication result verification information for each entry (authenticated successfully) in the authentication result database when providing information, or in advance in preparation for providing information. More specifically, the verification information generating unit 405 analyzes the authentication result detailed information and determines whether or not to generate authentication result verification information for each entry in the authentication result database.

For example, if at least one or more pieces of authentication result detail information included in each entry contains information that is highly likely to cause an erroneous authentication (acceptance of a false identity), the verification information generating unit 405 sets the entry that contains that information as a target for providing information. In other words, the verification information generating unit 405 does not generate authentication result verification information for an entry that contains only authentication result detail information that is unlikely to cause an erroneous authentication.

For example, the verification information generating unit 405 determines whether or not each entry is to be a target for generating authentication result verification information based on the similarity used when processing an authentication request from a terminal. If the similarity included in the authentication result detailed information is smaller than a predetermined threshold, the verification information generating unit 405 generates authentication result verification information for the entry that includes the authentication result detailed information.

In the example of FIG. 11, when the similarity S11 in the authentication result detailed information 1 for a successful authentication individual with a token ID of "ID11" is smaller than the threshold value TH1, authentication result verification information for that successful authentication individual is generated. In this case, although the authentication is successful, the accuracy is low, and the authentication result for that successful authentication individual is likely to be a false authentication.

Alternatively, the verification information generating unit 405 may determine whether or not to generate authentication result verification information based on time series data that includes the similarity described in each entry of the authentication result database (the similarity included in each of the multiple authentication result detailed information). More specifically, the verification information generating unit 405 may make the above determination based on the result of statistical processing of the above time series data.

For example, if the rate of change in similarity between before and after is greater than a predetermined threshold, the verification information generating unit 405 sets the corresponding entry as a target for generating authentication result verification information.

For example, the similarity obtained as a result of the authentication process for successfully authenticated person A is graphed as shown in FIG. 15(a). The similarity for successfully authenticated person B is graphed as shown in FIG. 15(b). Note that the dotted line in FIG. 15 indicates the value of the threshold TH2 at which authentication is determined to be successful. In other words, each similarity plotted in FIG. 15 is greater than the threshold TH2 at which authentication is determined to be successful.

Comparing the two graphs in Figure 15, in Figure 15(a), the similarity (score) is stable at a high value (the rate of change between similarities is small). This fact indicates that the similarities calculated in the four authentication processes are about the same, and indicates that it is highly likely that the facial images of the same person were obtained on each terminal.

In contrast, in FIG. 15(b), the rate of change in similarity is large from the third to the fourth authentication results. This fact suggests that although the similarity between the registered face image and the acquired face image used in the fourth authentication process is greater than the threshold TH2 for determining successful authentication, the acquired face image used in the third authentication process and the acquired face image used in the fourth authentication process are face images of different people. Therefore, the verification information generation unit 405 determines that there is a high probability that false acceptance has occurred in the authentication of successful authentication person B, and sets this as the target for generating authentication result detailed information.

Alternatively, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information based on the "variation" of the time-series data of the feature amount described in each entry. Specifically, the verification information generating unit 405 calculates an index (variance, standard deviation) indicating the variation of the time-series data. If the calculated index (variance, standard deviation) indicating the variation is greater than a predetermined threshold, the verification information generating unit 405 sets the corresponding entry as a target for generating authentication result detailed information.

Alternatively, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information using the largest similarity (first similarity) and the second largest similarity (second similarity; first similarity > second similarity) among the multiple similarities calculated during the authentication process. In this case, the authentication unit 404 stores the above two similarities in the authentication result database.

When the difference between the first similarity and the second similarity is smaller than the threshold value TH3 for the authentication result detailed information of each entry in the authentication result database, the verification information generating unit 405 sets the entry as a target for generating authentication result verification information.

Here, the fact that the difference between the first similarity and the second similarity is large indicates that the face of the person determined to be second most similar to the person being authenticated does not resemble the face of the person being authenticated (the person himself). In contrast, the fact that the difference between the first similarity and the second similarity is small indicates that the face of the person determined to be second most similar to the person being authenticated resembles the face of the person being authenticated. For example, if the people being authenticated are twins and both facial images are registered, the difference between the similarity based on the person's facial image (first similarity) and the similarity based on the twin's other facial image (second similarity) will be small.

Using the above fact, the verification information generation unit 405 determines that authentication in which the difference between the two similarities is smaller than a predetermined threshold is a result with a high probability of false acceptance occurring.

Alternatively, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information based on an index or the like other than the degree of similarity between face images based on feature amounts generated from face images. In biometric authentication, erroneous authentication (acceptance of a different person) occurs because the "faces" of the matching side and the registration side are similar. More precisely, if the positions of the eyes and nose and the distance between these feature points are similar, erroneous authentication (acceptance of a different person) may occur even if the faces are different. Here, in the boarding procedure system at the airport, the registered face image is input to the server device 20 at the time of check-in, and then the terminal (boarding gate device 14, etc.) requests biometric authentication from the server device 20 in a relatively short time. It is difficult to imagine that the subject's hairstyle, whether or not he/she wears glasses, his/her clothes, etc. will change in such a short period of time. The verification information generating unit 405 may determine whether or not to generate authentication result detailed information by utilizing the features and characteristics of such biometric authentication at the airport.

More specifically, the verification information generating unit 405 calculates the similarity between the two images using a method different from the method using the feature amount. For example, the verification information generating unit 405 sets a low value to the similarity if the hairstyles of the people in the two face images are different. Alternatively, the verification information generating unit 405 sets a low value to the similarity if one face image shows glasses and the other face image shows no glasses. Alternatively, the verification information generating unit 405 sets a low value to the similarity if the clothes of the people in the two face images are different. If the similarity calculated by the above method is lower than the threshold value TH4, the verification information generating unit 405 determines that the probability of false acceptance is high. That is, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information based on the similarity between images calculated by a method different from the similarity based on the feature amount.

When determining the similarity of hairstyles, the verification information generating unit 405 may compare the area of the upper face area or may use the shape of the area. Furthermore, when determining whether or not glasses are worn, the verification information generating unit 405 may use a method such as template matching. When determining the identity of clothing, the verification information generating unit 405 may use the results of frequency analysis of areas other than the face area. The server device may determine the identity of clothing depending on whether the patterns and textures of areas other than the face area are different.

The verification information generating unit 405 generates authentication result verification information for authentication results (entries) that are highly likely to have resulted in erroneous authentication by the above method or other methods. In other words, for authentication results that are determined to have a low probability of erroneous authentication (acceptance of a false identity), the display shown in FIG. 12 or FIG. 13 is not performed. In other words, staff, etc., need only verify authentication results (registered face images, acquired face images) that are highly likely to have resulted in erroneous authentication.

As described above, when providing information to staff etc., the server device 20 according to the second embodiment generates authentication result verification information from authentication results (authentication result detailed information) that are highly likely to have involved false acceptance. In this way, the server device 20 provides information to staff etc. by narrowing down information related to authentication results that are highly likely to have involved erroneous authentication, thereby reducing the burden on staff who check the provided information.

Next, we will explain the hardware of each device that makes up the boarding system. Figure 16 is a diagram showing an example of the hardware configuration of server device 20.

The server device 20 can be configured by an information processing device (so-called a computer), and has the configuration shown in FIG. 16. For example, the server device 20 has a processor 311, a memory 312, an input/output interface 313, a communication interface 314, and the like. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

However, the configuration shown in FIG. 16 is not intended to limit the hardware configuration of the server device 20. The server device 20 may include hardware not shown, and may not include an input/output interface 313 as necessary. In addition, the number of processors 311 and the like included in the server device 20 is not intended to be limited to the example shown in FIG. 16, and for example, the server device 20 may include multiple processors 311.

The processor 311 is, for example, a programmable device such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a DSP (Digital Signal Processor). Alternatively, the processor 311 may be a device such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). The processor 311 executes various programs including an operating system (OS).

Memory 312 is a RAM (Random Access Memory), a ROM (Read Only Memory), a HDD (Hard Disk Drive), a SSD (Solid State Drive), etc. Memory 312 stores the OS program, application programs, and various data.

The input/output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display. The input device is, for example, a device that accepts user operations such as a keyboard or a mouse.

The communication interface 314 is a circuit, module, etc. that communicates with other devices. For example, the communication interface 314 includes a NIC (Network Interface Card), etc.

The functions of the server device 20 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network, or updated using a storage medium that stores the program. The processing modules may also be realized by a semiconductor chip.

The check-in terminal 10, boarding gate device 14, staff terminal 30, etc. can also be configured with information processing devices like the server device 20, and their basic hardware configurations are no different from those of the server device 20, so a description of them will be omitted. The check-in terminal 10, etc. only needs to be equipped with a camera, etc.

The server device 20 is equipped with a computer, and the functions of the server device 20 can be realized by having the computer execute a program. The server device 20 also executes a control method for the server device by the program.

[Modification]
The configuration, operation, etc. of the boarding system described in the above embodiment are merely examples and are not intended to limit the system configuration, etc.

In the above embodiment, it has been described that system registration is performed after the user checks in, but system registration may be performed before the check-in procedure. In this case, since a boarding pass is not issued before the check-in procedure, the server device 20 may perform system registration using airline ticket information instead of a boarding pass.

In the above embodiment, a case has been described in which system registration (registration for implementing boarding procedures using biometric authentication) is performed at the check-in terminal 10. However, system registration may be performed at a device or terminal other than the check-in terminal 10. For example, a device dedicated to system registration may be installed at the airport, or system registration may be performed at a terminal (touch point) such as the baggage drop machine 11 or the passenger passage system 12.

In the above embodiment, a case has been described in which a series of boarding procedures are performed using biometric authentication, but some of the procedures may also be performed using biometric authentication. For example, in FIG. 2, system registration may be performed at the baggage drop-off machine 11, and procedures after baggage drop-off (such as security checks) may be performed using biometric authentication. In other words, some of the series of boarding procedures may be performed at manned booths, etc.

In the above embodiment, the server device 20 is described as having three databases. However, the token ID information database, business information database, and authentication result database constructed in the server device 20 may be constructed in a database server different from the server device 20. In other words, the boarding procedure system only needs to include the various means (e.g., token generation means) etc. described in the above embodiment.

In the above embodiment, a case has been described in which the authentication request includes a facial image, but the authentication request may also include features generated from the facial image. In this case, the server device 20 processes the authentication request using the features extracted from the authentication request and the features registered in the token ID information database.

In the second embodiment, the server device 20 selects authentication results based on similarity, etc., and narrows down the verification targets for false acceptance occurrence. The above-described selection method is an example, and the server device 20 (verification information generation unit 405) may narrow down the verification targets based on other conditions, etc. For example, the server device 20 may narrow down the generation targets of authentication result verification information based on the seat class (top class passenger seat, superior cabin, regular passenger seat) of the successfully authenticated person. For example, the server device 20 may limit the verification targets for false acceptance occurrence to passengers with a first class seat class. In this case, staff can carefully monitor the occurrence of erroneous authentication regarding first class passengers (passengers with whom airlines, etc. want to avoid trouble).

Alternatively, the server device 20 may determine whether or not to generate authentication result verification information based on the order of the terminal IDs stored in the authentication result database. As described above, the order of procedures at an airport is predetermined. Therefore, the server device 20 may determine that there is a high probability that an erroneous authentication has occurred for an entry in which it is recorded that biometric authentication was performed in an order different from the predetermined order, and may generate authentication result verification information for that entry. For example, the verification information generating unit 405 may determine that an entry in which authentication at the baggage drop machine 11 has occurred (recorded) after authentication at the gate device 13 is to be generated as authentication result verification information. This is because it is usually not expected that authentication will be performed at the baggage drop machine 11 after the gate device 13.

As described in the second embodiment, the server device 20 may not only provide information based on the authentication result verification information based on instructions from staff members, etc., but may also provide the information voluntarily at regular intervals or at a predetermined timing. For example, the server device 20 (verification information generating unit 405) analyzes the authentication result (authentication result detailed information) stored in the authentication result database at regular intervals or at a predetermined timing, and determines whether or not the authentication result verification information needs to be transmitted. Specifically, the server device 20 determines whether or not the transmission is necessary by the method described in the second embodiment or another method. When the server device 20 determines that it is necessary to transmit the authentication result verification information, it notifies (notifies, warns) the staff terminal 30 of the necessity. At that time, the server device 20 may notify the staff terminal 30 of the name of the person involved in the false reception and information about the flight. Specifically, the server device 20 may transmit data to the staff terminal 30 that can generate a display such as that shown in FIG. 17.

When a staff member sees a display such as that shown in FIG. 17, he or she approaches the passenger and verifies whether or not a false authentication (acceptance of a false passenger) has indeed occurred. If false authentication has occurred, the staff member corrects the inconsistency caused by the false authentication. For example, the staff member corrects the data stored in the server device 20. Note that, as shown in FIG. 17, the staff member can compare the facial images acquired at each terminal, and therefore can identify which terminal has caused the false authentication. For example, if the facial image acquired at the boarding gate device 14 is different from the other acquired facial images, the staff member can determine that false authentication has occurred at the boarding gate device 14.

In this way, the verification information generating unit 405 of the server device 20 may analyze the authentication result detailed information periodically or at a predetermined timing, and determine whether or not it is necessary to transmit the authentication result verification information. The verification information generating unit 405 may transmit, together with the authentication result verification information that is determined to need to be generated, information regarding the flight of the corresponding successfully authenticated person to the staff terminal.

The server device 20 may identify the terminal that obtained the face image used in the authentication from an authentication result that is determined to have a high probability of false acceptance, and notify staff, etc. of the information of the identified terminal. For example, in the example of FIG. 15(b), it is determined that the probability of false acceptance is high in the fourth authentication process (e.g., the process related to the authentication request from the boarding gate device 14). Therefore, the server device 20 notifies staff that there is a high probability that false acceptance occurred during authentication at the boarding gate device 14.

In the above embodiment, the server device 20 has been described as transmitting authentication result verification information for one passenger (authenticated successfully) to the staff terminal 30. However, the server device 20 may transmit authentication result verification information for multiple passengers together to the staff terminal 30. For example, the server device 20 may generate authentication result verification information corresponding to each of multiple entries among the entries listed in the authentication database shown in FIG. 11, and transmit the information to the staff terminal 30. The staff terminal 30 may display a list as shown in FIG. 18 from the acquired information.

Alternatively, the server device 20 may transmit to the staff terminal 30 authentication result verification information with a flag indicating whether or not there is a high probability of false acceptance occurring, based on the similarity level used during authentication. The staff terminal 30 may refer to the flag and display results that are likely to have false acceptance occurring, as shown in FIG. 19. In FIG. 19, entries colored gray indicate entries that are likely to have false acceptance occurring.

Alternatively, when a staff member who sees the display shown in FIG. 18 or FIG. 19 selects an entry, the staff terminal 30 may display a display such as that shown in FIG. 12 or FIG. 13 (a display including a facial image). Alternatively, the staff terminal 30 may display the name, airline code, flight number, etc. of the person who has been successfully authenticated in addition to the facial image.

In the above embodiment, with reference to Figs. 12 and 13, a case has been described in which the authentication result verification target for one entry is displayed on one screen. However, authentication result verification targets (authentication results of successful authenticatees) for multiple entries may be displayed on one screen (see Fig. 20).

In the above embodiment, a case where an authentication result with a high probability of false acceptance is identified based on similarity and the like has been described. However, the identification may be performed using a learning model generated by machine learning. Specifically, the system administrator collects a large number of data (acquired face images, registered face images) when false acceptance occurs. The system administrator generates training data by attaching a label related to authentication failure to the collected data. The system administrator inputs the training data into a learning device to generate a learning model (classification model). The learning model is implemented in the server device 20. The server device 20 inputs two face images into the learning model and obtains a judgment result (false acceptance occurs, does not occur). When the judgment result is "false acceptance occurs," the server device 20 may provide information on the corresponding entry or issue an alert to an employee. Note that any algorithm such as a support vector machine, boosting, or neural network can be used to generate the learning model. Note that the above support vector machine and other algorithms can use publicly known techniques, so their explanation will be omitted.

In the above embodiment, the system operation etc. have been described by treating the facial image and the features generated from the facial image as "biometric information". However, other information may be used as "biometric information" instead of the facial image etc. For example, when voiceprint authentication is used, the occurrence of false acceptance may be detected by playing back pre-registered voiceprint information (audio data).

In the above embodiment, a case was described in which the need to generate authentication result verification information was determined based on similarity or time-series data that includes similarity as an element. The server device 20 may determine the need to generate authentication result verification information by combining the above-described methods. For example, the server device 20 determines the need to generate authentication result verification information for each of the multiple determination methods. If at least one of the obtained multiple determination results is "necessary to generate," the server device 20 may generate authentication result verification information from the corresponding entry. Alternatively, the server device 20 may determine the need to generate authentication result verification information based on the results of statistical processing of the multiple determination results. For example, the server device 20 may generate authentication result verification information from the corresponding entry if the number of determinations that are "necessary to generate" is greater than a predetermined threshold value.

In the above embodiment, the server device 20 provides authentication result verification information to staff members, etc. via the staff terminal 30. However, the server device 20 may provide the above information using a display device, etc. of the server device 20 itself. Alternatively, the server device 20 may provide the above information via a dashboard, etc. installed in a management room, etc. where the staff members, etc. are stationed.

The form of data transmission and reception between the check-in terminal 10 and the server device 20 is not particularly limited, but the data transmitted and received between these devices may be encrypted. Boarding pass information and passport information contain personal information, and in order to appropriately protect the personal information, it is desirable to transmit and receive encrypted data.

The server device 20 may provide staff etc. with a search function of the authentication result database. For example, the server device 20 may be equipped with a "search unit 407" that searches for authentication results that are likely to result in false acceptance (see FIG. 21). The search unit 407 acquires search conditions from the staff terminal 30 etc. The search unit 407 searches for authentication results that match the conditions and returns the search results. For example, based on information input from staff etc., the search unit 407 searches for entries (authentication results) in which the difference in similarity between successfully authenticated persons (the difference between the first similarity and the second similarity) is equal to or less than a predetermined threshold.

In the flow diagrams (flowcharts, sequence diagrams) used in the above explanation, multiple steps (processes) are described in order, but the order in which the steps are executed in the embodiment is not limited to the order described. In the embodiment, the order of the steps shown in the diagrams can be changed to the extent that does not interfere with the content, such as executing each process in parallel.

The above embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are necessary. Furthermore, when multiple embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace part of the configuration of an embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of an embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of an embodiment with other configurations.

The above explanation makes clear the industrial applicability of the present invention, and the present invention can be suitably applied to boarding procedures at airports and the like. However, the application of the present disclosure is not limited to airport procedures, and the present disclosure can be applied to systems that require multiple procedures. For example, the present disclosure can also be applied to entrance and exit control at event venues and the like. For example, the server device 20 can analyze the authentication history at the event venue, and notify the event organizer or the like of any results that are strongly suspected to be erroneous authentication.

A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.
[Appendix 1]
a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated, among a plurality of terminals;
an authentication unit that performs biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance;
a storage unit that stores, for a person who has been successfully authenticated by the biometric authentication, the pre-registered biometric information and authentication result detail information including details of processing the authentication request and including the biometric information acquired by a terminal that is a sender of the authentication request, in association with each other;
A server device comprising:
[Appendix 2]
The authentication result detailed information stored in the storage unit further includes a terminal ID for identifying a source of the authentication request,
2. The server device according to claim 1, further comprising a generation unit configured to generate authentication result verification information including at least the pre-registered biometric information, the terminal ID, and the biometric information acquired by the terminal.
[Appendix 3]
The server device according to claim 2, wherein the authentication result detailed information includes a similarity degree when the authentication is determined to be successful by the biometric authentication.
[Appendix 4]
The server device according to claim 3, wherein the generation unit analyzes the authentication result detailed information and determines whether to generate the authentication result verification information.
[Appendix 5]
The server device according to claim 4, wherein the generation unit determines whether or not to generate the authentication result verification information based on the similarity.
[Appendix 6]
The server device according to claim 5, wherein the generation unit generates the authentication result verification information when the similarity included in the authentication result detailed information is smaller than a first threshold value.
[Appendix 7]
The server device according to claim 5 or 6, wherein the generation unit generates the authentication result verification information when a difference between the largest first similarity and the second largest second similarity is smaller than a second threshold value.
[Appendix 8]
The generation unit is
When multiple pieces of authentication result detail information are stored for the same authenticated person,
The server device according to any one of appendixes 5 to 7, which determines whether to generate the authentication result detailed information based on a result of statistical processing on time-series data having similarity included in each of the plurality of authentication result detailed information as an element.
[Appendix 9]
The server device according to any one of appendices 2 to 8, wherein the generation unit transmits the authentication result verification information to a staff terminal used by an airport or airline staff member.
[Appendix 10]
The generation unit analyzes the authentication result detailed information periodically or at a predetermined timing, and transmits information regarding the flight of the corresponding successfully authenticated person to the staff terminal together with the authentication result verification information that is determined to need to be generated.
[Appendix 11]
11. The server device according to claim 1, wherein the biometric information is a face image or a feature extracted from the face image.
[Appendix 12]
Multiple devices and
A server device connected to the plurality of terminals;
Including,
The server device includes:
a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among the plurality of terminals;
an authentication unit that performs biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance;
a storage unit that stores, for a person who has been successfully authenticated by the biometric authentication, the pre-registered biometric information and authentication result detail information including details of processing the authentication request and including the biometric information acquired by a terminal that is a sender of the authentication request, in association with each other;
A system comprising:
[Appendix 13]
In the server device,
receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among the plurality of terminals;
performing biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users registered in advance;
A method for controlling a server device, which stores, in association with each other, the pre-registered biometric information for a person who has successfully passed the biometric authentication, and authentication result detailed information including details of when the authentication request was processed, the biometric information being acquired by a terminal that sent the authentication request.
[Appendix 14]
A computer installed in the server device
receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among a plurality of terminals;
A process of performing biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance;
a process of storing, for a person who has been successfully authenticated by the biometric authentication, the pre-registered biometric information in association with detailed authentication result information including details of processing the authentication request and including the biometric information acquired by a terminal that is a sender of the authentication request;
A computer-readable storage medium that stores a program for executing the above.

The disclosures of the above cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. Those skilled in the art will understand that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and amendments that a person skilled in the art can make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas.

10 Check-in terminal 11 Baggage drop machine 12 Passenger passage system 13 Gate device 14 Boarding gate device 20, 100 Server device 30 Staff terminal 101 Receiving unit 102, 404 Authentication unit 103, 206, 306, 406 Memory unit 201, 301, 401 Communication control unit 202 System registration unit 203 Token issuance request unit 204, 304 Message output unit 205 Check-in execution unit 211 Boarding pass information acquisition unit 212 Passport information acquisition unit 213, 302 Biometric information acquisition unit 303 Authentication request unit 305 Function realization unit 311 Processor 312 Memory 313 Input/output interface 314 Communication interface 402 Token generation unit 403 Database management unit 405 Verification information generation unit 407 Search unit

Claims (9)

a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated, among a plurality of terminals;
an authentication unit that performs biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance;
a generation unit that generates data that associates pre-registered biometric information of a user who has been successfully authenticated and authentication result detail information for each terminal, the data including biometric information acquired by a terminal that is a transmission source of the authentication request, with a successful authentication subject who has been successfully authenticated by the biometric authentication;
Equipped with
The authentication result detail information includes information regarding a similarity when the authentication is determined to be successful by the biometric authentication,
The generation unit is a server device that outputs, based on the analysis results of the authentication result detailed information, authentication result verification information including the biometric information and the authentication result detailed information associated with the successfully authenticated person to an employee terminal as information for verifying false acceptance, which is one type of erroneous authentication . The server device according to claim 1 , wherein the generation unit generates the authentication result verification information based on a similarity when it is determined that the authentication is successful. The server device according to claim 2 , wherein the generation unit outputs the authentication result verification information when the similarity included in the authentication result detailed information is smaller than a first threshold value. The authentication result detail information for the authenticated person is generated for each terminal that has transmitted the authentication request when it is determined that the authentication is successful by the biometric authentication using the biometric information acquired by the terminal, and includes information on the similarity when it is determined that the authentication is successful by the biometric authentication,
The server device according to claim 2, wherein the generation unit outputs the authentication result verification information when a difference between the largest first similarity and the second largest second similarity among the similarities contained in the authentication result detailed information is smaller than a second threshold value when multiple authentication result detailed information are generated for a successful authentication person. The authentication result detail information for the authenticated person is output for each terminal that has transmitted the authentication request when it is determined that the authentication is successful by the biometric authentication using the biometric information acquired by the terminal, and includes information on the similarity when it is determined that the authentication is successful by the biometric authentication,
The server device according to claim 2, wherein when a plurality of the authentication result detailed information pieces are generated for a successful authentication person, the generation unit determines whether or not to output the authentication result detailed information based on a result of statistical processing of time-series data having similarity included in the authentication result detailed information pieces as an element. The server device according to claim 1 , wherein the generation unit outputs information about a flight of the corresponding successfully authenticated person together with the authentication result detailed information to the staff terminal . Multiple devices and
A system comprising: the server device according to claim 1 connected to a plurality of the terminals. A server device,
receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among the plurality of terminals;
performing biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users registered in advance;
generating data associating preregistered biometric information of a user with detailed authentication result information for each terminal, the detailed authentication result information including biometric information acquired by a terminal that is a transmission source of the authentication request, for a successful authentication subject who has succeeded in the biometric authentication;
The authentication result detail information includes information regarding a similarity when the authentication is determined to be successful by the biometric authentication,
A method for controlling a server device, which outputs authentication result verification information including the biometric information and the authentication result detailed information associated with the successfully authenticated person based on an analysis result of the authentication result detailed information to an employee terminal as information for verifying false acceptance, which is one type of erroneous authentication . A computer installed in the server device
receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among a plurality of terminals;
A process of performing biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance;
A process of generating data associating pre-registered biometric information of a user who has been successfully authenticated and authentication result detailed information for each terminal including biometric information acquired by a terminal that is a sender of the authentication request, for a successful authentication subject who has been successfully authenticated by the biometric authentication ;
The authentication result detailed information includes information regarding a similarity when the authentication is determined to be successful by the biometric authentication, and based on an analysis result of the authentication result detailed information, the authentication result verification information including the biometric information associated with the person who has been successfully authenticated and the authentication result detailed information is output to an employee terminal as information for verifying false acceptance, which is one type of erroneous authentication.
A computer program for executing the above.

Images