JP7609166B2 - Authentication system, terminal, management server, personal information provision method and program - Google Patents

Description

The present invention relates to an authentication system, a terminal, a management server, a personal information provision method, and a storage medium.

In recent years, various services using biometric information have started to become popular. For example, facial recognition is used for various procedures at airports (check-in, baggage drop-off, etc.) and hotel check-in.

In services that use facial recognition, the process is as follows: First, a terminal (installed at an airport or hotel) captures a facial image of the customer and generates features (feature vectors) that characterize the facial image. The generated features are then sent to a server on the network.

The server has a database that stores the biometric information and personal information (such as name and address) of users who receive services using facial recognition. When the server receives a matching request from the terminal, it searches (matches) the database and identifies the biometric information and personal information that correspond to the matching request from the terminal. The server transmits the identified personal information to the terminal, and the terminal installed at the airport or other location performs operations based on the acquired personal information.

In addition, various uses of authentication information and personal information are being considered.

For example, Patent Document 1 states that a method and system are provided for trading personal information in a manner that meets the diverse needs of companies and general users who use the Internet, while allowing the involvement of general users (ISP users) who are the original owners of the information.

Patent document 2 describes how the system makes it possible to provide information useful for safety confirmation to unspecified parties requesting safety confirmation without requiring them to register authentication information in advance, while still respecting privacy.

Patent document 3 states that services and products will be provided in exchange for personal information related to consumer behavior.

JP 2002-056111 A JP 2006-243798 A JP 2008-243072 A

As mentioned above, when providing services using biometric authentication, personal information of users is required. Here, collecting and storing a large amount of personal information creates great value. Specifically, data on what age groups of users are receiving what services can be a valuable tool for companies in their marketing decisions.

However, from the perspective of protecting the user's privacy, it is difficult to provide personal information used when providing services using biometric authentication to a third party without the user's consent. In particular, many users feel strong resistance to providing personal information such as their name or address to a third party.

The primary objective of the present invention is to provide an authentication system, a terminal, a management server, a personal information providing method, and a storage medium that contribute to users' control and management of personal information related to the provision of services through biometric authentication.

According to a first aspect of the present invention, there is provided an authentication system including an information server, an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information, and a management server that stores personal information for providing services to individuals who have been successfully authenticated through the biometric authentication and transmits to the information server behavioral information including personal information of the individuals to whom the service has been provided that the individuals have permitted to be provided to a third party.

According to a second aspect of the present invention, a terminal is provided which is connected to a management server which stores personal information for providing services to individuals who have been successfully authenticated by biometric authentication, and which generates a GUI for inputting personal information of the individuals to whom the services have been provided that the individuals permit to be provided to a third party.

According to a third aspect of the present invention, there is provided a management server that is connected to an information server and an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information, stores personal information for providing services to individuals who have been successfully authenticated through the biometric authentication, and transmits to the information server behavioral information including personal information of the individuals who have been provided with the service that the individuals have permitted to be provided to a third party.

According to a fourth aspect of the present invention, there is provided a method for providing personal information, in which a management server connected to an information server and an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information, stores personal information for providing a service to a person who is successfully authenticated by the biometric authentication, and transmits behavioral information to the information server, the behavioral information including personal information of the person who was successfully authenticated to whom the service was provided that the person permitted to be provided to a third party.

According to a fifth aspect of the present invention, there is provided a computer-readable storage medium that stores a program for causing a computer mounted on a management server connected to an information server and an authentication server that stores biometric information for each of a plurality of users and performs biometric authentication using the stored biometric information to store personal information for providing a service to a person who has been successfully authenticated by the biometric authentication, and to transmit to the information server behavioral information including personal information of the person who has been successfully authenticated to whom the service has been provided that the person has permitted to be provided to a third party.

According to each aspect of the present invention, there are provided an authentication system, a terminal, a management server, a personal information providing method, and a storage medium that contribute to a user's control and management of personal information related to the provision of services through biometric authentication. Note that the effects of the present invention are not limited to the above. The present invention may achieve other effects instead of or in addition to the effects.

FIG. 1 is a diagram for explaining an overview of an embodiment. 1 is a diagram illustrating an example of a schematic configuration of an authentication system according to a first embodiment. 4 is a diagram for explaining the operation in a user registration phase of the authentication system according to the first embodiment. FIG. 4 is a diagram for explaining the operation in a service registration phase of the authentication system according to the first embodiment. FIG. 4 is a diagram for explaining the operation of the authentication system according to the first embodiment in a service provision phase. FIG. 11 is a diagram for explaining an operation in an information collection phase of the authentication system according to the first embodiment. FIG. 11 is a diagram for explaining an operation in an information collection phase of the authentication system according to the first embodiment. FIG. 11 is a diagram for explaining an operation in an information collection phase of the authentication system according to the first embodiment. FIG. 11 is a diagram for explaining an operation in an information collection phase of the authentication system according to the first embodiment. FIG. FIG. 2 is a diagram illustrating an example of a processing configuration of an authentication server according to the first embodiment; 4 is a diagram for explaining the operation of a user registration unit of the authentication server according to the first embodiment; FIG. 4 is a diagram for explaining the operation of a user registration unit of the authentication server according to the first embodiment; FIG. FIG. 4 is a diagram illustrating an example of an authentication information database according to the first embodiment. FIG. 4 is a diagram illustrating an example of an authentication information database according to the first embodiment. FIG. 4 is a diagram illustrating an example of an authentication information database according to the first embodiment. FIG. 2 is a diagram illustrating an example of a processing configuration of a management server according to the first embodiment; 6 is a diagram for explaining the operation of a personal information acquisition unit of the management server according to the first embodiment; FIG. FIG. 4 is a diagram illustrating an example of a user information database according to the first embodiment. 5 is a diagram showing an example of behavioral information transmitted from the management server according to the first embodiment; FIG. FIG. 2 is a diagram illustrating an example of a processing configuration of an authentication terminal according to the first embodiment; FIG. 2 is a diagram illustrating an example of a processing configuration of an information server according to the first embodiment. FIG. 4 is a diagram for explaining the operation of the information server according to the first embodiment. FIG. 2 is a diagram illustrating an example of a processing configuration of a terminal according to the first embodiment. FIG. 4 is a sequence diagram showing an example of an operation related to a service registration phase of the authentication system according to the first embodiment. FIG. 4 is a sequence diagram showing an example of an operation related to a service provision phase of the authentication system according to the first embodiment. FIG. 4 is a sequence diagram showing an example of an operation related to an information collection phase of the authentication system according to the first embodiment. FIG. 11 is a diagram for explaining the operation of the authentication system according to the second embodiment. FIG. 11 is a diagram illustrating an example of a processing configuration of an authentication terminal according to the second embodiment. FIG. 2 illustrates an example of a hardware configuration of a management server. FIG. 13 is a diagram for explaining an operation regarding whether or not personal information can be provided according to a modified example. FIG. 13 is a diagram for explaining an operation regarding whether or not personal information can be provided according to a modified example. FIG. 13 is a diagram for explaining an operation regarding whether or not personal information can be provided according to a modified example. FIG. 13 is a diagram for explaining an operation regarding whether or not personal information can be provided according to a modified example.

First, an overview of one embodiment will be described. The reference numbers in the drawings are added to each element for convenience as an example to aid in understanding, and the description of this overview is not intended to be limiting. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units rather than hardware units. The connection lines between blocks in each drawing include both bidirectional and unidirectional. The unidirectional arrows are used to show the main signal (data) flow diagrammatically, and do not exclude bidirectionality. In this specification and drawings, elements that can be described in the same way may be given the same reference numbers to avoid duplicated explanations.

An authentication system according to one embodiment includes an information server 101, an authentication server 102, and a management server 103 (see FIG. 1). The authentication server 102 stores biometric information for each of a plurality of users and performs biometric authentication using the stored biometric information. The management server 103 stores personal information for providing services to individuals who have been successfully authenticated by biometric authentication. The management server 103 transmits to the information server 101 behavioral information including personal information of individuals who have been successfully authenticated and to whom services have been provided that the individuals have permitted to be provided to third parties.

A user who receives a service through biometric authentication (a person who has been successfully authenticated) inputs personal information that he or she is willing to allow to be provided to a third party to the management server 103, which stores and manages the personal information of the user. In other words, the user can control and manage whether or not to provide personal information related to the provision of a service through biometric authentication to a third party.

Specific embodiments are described in further detail below with reference to the drawings.

[First embodiment]
The first embodiment will be described in more detail with reference to the drawings.

[System Configuration]
Fig. 2 is a diagram showing an example of a schematic configuration of an authentication system according to the first embodiment. As shown in Fig. 2, the authentication system includes an authentication center, an information center, and a plurality of service providers.

Each service provider participating in the authentication system provides a service using biometric authentication. Examples of services provided by a service provider include payment services at retail stores and accommodation services at hotels. Alternatively, a service provided by a service provider may be immigration inspections at airports or ports. The service provider disclosed in the present application may provide any service that can be provided using biometric authentication.

An authentication server 10 is installed in the authentication center. The authentication server 10 stores biometric information of users and performs biometric authentication of users using the biometric information. The authentication server 10 operates as an authentication authority for authentication using biometric information. The authentication server 10 may be a server installed on the premises of the authentication center, or may be a server installed on the cloud.

Examples of the user's biometric information include data (feature quantities) calculated from physical characteristics unique to an individual, such as the face, fingerprint, voiceprint, veins, retina, and iris pattern. Alternatively, the user's biometric information may be image data such as a face image or fingerprint image. The user's biometric information may include information on the user's physical characteristics. In this disclosure, a case where biometric information related to a person's "face" is used will be described.

The authentication server 10 is a server device for providing services using biometric authentication. The authentication server 10 processes "authentication requests" sent from each service provider and sends the results of the authentication process to the service provider. The authentication server 10 stores the biometric information of each of multiple users and performs biometric authentication using the stored biometric information.

Each service provider has a management server and an authentication terminal.

For example, the service provider S1 is provided with a management server 20 and multiple authentication terminals 30. The service provider S2 is provided with a management server 20 and multiple authentication terminals 31.

In the following explanation, when it is necessary to distinguish between the components, the symbol to the right of the hyphen will be used. Since the operation of each device included in service provider S1 and service provider S2 can be the same, the following explanation will focus on service provider S1.

Each device shown in Figure 2 is connected to each other. For example, the authentication server 10 and the management server 20 are connected by a wired or wireless communication means and are configured to be able to communicate with each other.

The management server 20 is a server that controls and manages the overall business of the service provider. For example, if the service provider is a retail store, the management server 20 performs inventory management of products, etc. Alternatively, if the service provider is a hotel operator, the management server 20 performs management of guest reservation information, etc.

In addition to the functions related to providing the above services, management server 20 has control functions and management functions related to the biometric authentication of users. Management server 20 stores personal information (e.g., name, etc.) of users who use the authentication system. That is, management server 20 stores personal information for providing services to individuals who have been successfully authenticated by biometric authentication. Management server 20 also transmits to information server 40 personal information of individuals who have been provided with a service that the successful authentication has given permission for to be provided to a third party (information center, information server 40).

The authentication terminal 30 is a device that is connected to the management server 20 and serves as an interface for users (customers) who visit the service provider. The users receive various services via the authentication terminal 30. For example, if the service provider is a retail store, the user uses the authentication terminal 30 to pay for the service. Alternatively, if the service provider is a hotel operator, the user uses the authentication terminal 30 to carry out check-in procedures.

An information server 40 is installed in the information center. The information center and information server 40 correspond to "third parties" from the user's perspective. The information server 40 collects information on the behavior of users who receive services from service providers. For example, the information server 40 collects the type of service used by the user, their name, age, gender, etc. The collected information is transferred, etc. to other businesses. Alternatively, the information server 40 analyzes the collected information and transfers the analysis results to other businesses, etc. The other businesses use the acquired analysis results, etc. for marketing, etc.

If the information regarding the user's behavior includes the user's personal information (e.g., name, age, etc.), the information server 40 will provide the personal information provider with compensation and benefits for providing the personal information.

Terminal 50 is a terminal possessed by a user (a user who receives services using biometric authentication; a person who is successfully authenticated).

Figure 2 is an example and is not intended to limit the configuration of the authentication system disclosed herein. For example, the authentication center may include two or more authentication servers 10. Alternatively, the service provider may include at least one authentication terminal 30. Alternatively, the functions of the management server 20 and the authentication terminal 30 may be integrated, and a service using biometric authentication may be provided by the integrated device. Alternatively, in each service provider, multiple authentication terminals 30 may be connected to one management server 20 as shown in Figure 2, or one authentication terminal 30 may be connected to one management server 20. Alternatively, the functions of the authentication server 10 and the information server 40 may be integrated. In other words, the authentication server 10 may also be considered a "third party" from the user's perspective.

[System Operation Overview]
Next, the general operation of the authentication system according to the first embodiment will be described.

The operation of the authentication system involves four phases.

The first phase is the phase in which users are registered in the system (user registration phase).

The second phase is the phase in which the service is registered (service registration phase).

The third phase is the phase in which services using biometric authentication are provided to users (service provision phase).

The fourth phase is the information gathering phase, in which information is collected about the behavior of users who receive the service.

[User registration phase]
FIG. 3 is a diagram for explaining the operation in the user registration phase of the authentication system according to the first embodiment.

A user who wishes to use services that use biometric authentication must register in advance. The user determines information to identify the user in the authentication system (user ID (identifier) and password (PW)) and registers it in the system. In the drawings including Figure 3, the user ID is represented as "uID."

In addition, users register their biometric information (e.g., facial images) in the system.

The user registers the above three pieces of information (user ID, password, biometric information) in the system using any means. For example, the user may mail a document containing the above three pieces of information to the authentication center, and an employee of the authentication center may enter the above three pieces of information into the authentication server 10. Alternatively, the user may mail an external storage device, such as a USB (Universal Serial Bus), on which the above three pieces of information are stored to the authentication center.

Alternatively, the user may operate the terminal 50 owned by the user to input a captured image of the user's face, a user ID, and a password to the authentication server 10. Examples of the terminal 50 include a smartphone, a mobile phone, a game console, a mobile terminal device such as a tablet, or a computer (personal computer, notebook computer), etc.

The authentication server 10 generates features (feature vectors consisting of multiple features) from the acquired face image, and stores the features in association with the user ID and password. Specifically, the authentication server 10 adds a new entry to the authentication information database, and stores the above three pieces of information in association with each other.

In this way, in the user registration phase, a first ID (e.g., a user ID) that uniquely identifies a user in the system and first biometric information used to authenticate the user are registered in the system. Note that in the first embodiment, an example is described in which a user ID and a password are used as an identifier (first ID) that uniquely identifies a system user, but if there is no duplication of user IDs between users, it is also possible to use the user ID as the above identifier (first ID).

[Service registration phase]
FIG. 4 is a diagram for explaining the operation in the service registration phase of the authentication system according to the first embodiment.

After completing user registration, the user selects the service provider from which he or she wishes to receive services through biometric authentication, and registers the selected service provider in the system. For example, in FIG. 2, if the user wishes to receive services from service provider S1, the user registers service provider S1 in the system.

The user registers personal information required to receive the service from the selected service provider in the system. Examples of personal information registered in the system include name, age, gender, contact information, and information for receiving payment. Contact information is, for example, an email address of an account that terminal 50 can receive from. The user also registers payment receipt information for receiving payment (payment for providing personal information) in the system. Examples of payment receipt information include a bank account, a virtual currency receiving account, and online shopping ID information. The user also registers the user ID and password determined in the user registration phase in the system along with the above personal information.

In this disclosure, personal information is defined as information that does not include biometric information of the user (person to be authenticated). In other words, biometric information and features generated from the biometric information are excluded from "personal information" in this disclosure.

The user inputs the above three pieces of information (personal information, user ID, password) to the service provider using any means. For example, the user mails a medium (paper or electronic medium) containing the above three pieces of information to the selected service provider. An employee of the service provider inputs the above three pieces of information into the management server 20. The user may input the above three pieces of information into the management server 20 by operating an authentication terminal 30 installed at the service provider.

Alternatively, as shown in Figure 4, the user may operate a terminal 50 to input the above three pieces of information into the management server 20. In this case, the user inputs the above three pieces of information on a WEB page managed and operated by the service provider.

When the management server 20 acquires the above three pieces of information (personal information, user ID, and password), it sends a "service registration request" to the authentication server 10. Specifically, the management server 20 sends a service registration request including the service provider ID, user ID, and password to the authentication server 10.

The service provider ID is identification information for uniquely identifying a service provider (such as a retailer participating in an authentication infrastructure that uses biometric authentication) included in the authentication system. In the example of Figure 2, a different service provider ID is assigned to each of the service providers S1 and S2.

Note that the service provider ID is an ID assigned to each service provider, not an ID assigned to each service. For example, in FIG. 2, even if service providers S1 and S2 are businesses that provide the same type of service (e.g., accommodation services), if they are managed by different entities, different IDs will be assigned to these service providers.

The authentication server 10 and the management server 20 share the service provider ID by any method. For example, when a service provider joins the authentication infrastructure, the authentication server 10 generates a service provider ID and distributes (notifies) the generated service provider ID to the service provider. In the drawings including FIG. 4, the service provider ID is represented as "spID".

When the authentication server 10 receives a service registration request, it searches the authentication information database using the user ID and password included in the request as keys to identify the corresponding user. The authentication server 10 then generates a "service user ID."

The service user ID is identification information that uniquely defines the correspondence (combination) between a user and a service provider. For example, in the example of Figure 2, the service user ID determined from the combination of user U1 and service provider S1 and the service user ID determined from the combination of user U1 and service provider S2 are set to different values.

The authentication server 10 stores the user ID, password, feature, service provider ID, and the generated service user ID in association with each other. In the drawings including FIG. 4, the service user ID is represented as "suID."

The authentication server 10 sends the generated service user ID to the sender of the service registration request. The authentication server 10 sends a response including the service user ID to the management server 20 and issues the service user ID.

The management server 20 associates the service user ID obtained from the authentication server 10 with the user's personal information (personal information including payment receipt information) and stores them. The management server 20 adds a new entry to the user information database and stores the above information (personal information, service user ID).

The user repeats the above registration process for each service provider from which the user wishes to receive services using biometric authentication. In other words, the user does not need to register for service providers from which the user does not wish to receive services.

Thus, in the service registration phase, a service registration request including a first ID (e.g., a user ID) and a second ID (e.g., a service provider ID) is sent to the authentication server 10 from the service provider of the service that the user wishes to use. When processing the service registration request, the authentication server 10 generates a third ID (e.g., a service user ID) that is uniquely determined by the combination of the user and the service provider. The authentication server 10 sends the third ID to the service provider. The service provider (management server 20) stores the user's personal information in association with the third ID.

[Service provision phase]
FIG. 5 is a diagram for explaining the operation in the service provision phase of the authentication system according to the first embodiment.

After completing the service registration (service registration phase), the user visits the service provider. The user moves to the authentication terminal 30.

The authentication terminal 30 acquires biometric information from a user in front of the user. Specifically, the authentication terminal 30 captures an image of the user and acquires a facial image. The authentication terminal 30 transmits the acquired facial image to the management server 20.

The management server 20 generates features from the acquired facial image. The management server 20 transmits an authentication request including the generated features and the service provider ID to the authentication server 10.

The authentication server 10 extracts features from the authentication request and performs a matching process (1:N matching; N is a positive integer, same below) using the extracted features and features registered in the authentication information database.

The authentication server 10 identifies the user through a matching process, and identifies a service user ID from among multiple service user IDs associated with the identified user that corresponds to the service provider ID included in the authentication request.

The authentication server 10 sends the identified service user ID to the sender of the authentication request. The authentication server 10 sends a response (response to the authentication request) including the identified service user ID to the management server 20.

The management server 20 searches the user information database using the acquired service user ID as a key, and identifies the user corresponding to the service user ID. The management server 20 transmits all or part of the personal information of the identified user to the authentication terminal 30. The authentication terminal 30 provides a service using the acquired personal information.

When the authentication terminal 30 ends the provision of the service, it notifies the management server 20 of that effect. Specifically, the authentication terminal 30 sends a "service provision end notification" to the management server 20.

In this way, in the service provision phase, the authentication terminal 30 acquires the second biometric information of the user and transmits the acquired second biometric information to the management server. The authentication server 10 receives an authentication request including the user's biometric information and a second ID (service provider ID) from the service provider. The authentication server 10 identifies a third ID (service user ID) by a matching process using the first and second biometric information and the second ID. The authentication server 10 transmits the identified third ID to the service provider. When providing a service to the user, the management server 20 identifies personal information of the user using the third ID acquired by transmitting an authentication request to the authentication server 10. The service provider provides the service to the user using the identified personal information.

[Information gathering phase]
FIG. 6 is a diagram for explaining the operation in the information gathering phase of the authentication system according to the first embodiment.

In the information collection phase, the information server 40 collects information on the behavior of users (those who have been successfully authenticated) who have received services from the service provider. In the following explanation, the information collected by the information server 40 (information provided to the information server 40 by the management server 20) is referred to as "behavioral information."

When the provision of a service using biometric authentication is completed, the service provider (management server 20) acquires the user's intention regarding providing the personal information of the user who received the service through biometric authentication to a third party. Specifically, the management server 20 sends an inquiry (hereinafter referred to as an information provision inquiry) regarding whether or not the personal information can be provided to the terminal 50 held by the user. The information provision inquiry includes a list of personal information (e.g., name, age, gender, address, etc.) stored in the management server 20 and the service user ID of the user who enjoyed the service through biometric authentication.

The terminal 50 that receives the information provision inquiry acquires the user's intention regarding the provision of personal information. For example, the terminal 50 acquires whether or not to provide personal information using a GUI (Graphical User Interface) as shown in FIG. 7. The terminal 50 may display a message clearly indicating that compensation can be obtained by providing personal information.

If the user refuses to provide personal information, the terminal 50 notifies the management server 20 of this (sends a negative response to the information provision inquiry). In this case, the management server 20 sends information regarding the outline of the services provided to the successfully authenticated person (hereinafter referred to as outline information) to the information server 40 as "behavioral information". Examples of the outline information include the type of business of the service provider (accommodation, retail), the location where the service was provided, the date and time, etc.

If the user agrees to provide personal information, the terminal 50 displays a GUI for inputting whether or not to provide each item (type) of personal information held by the management server 20 (see FIG. 8). The terminal 50 may display an outline of the service received through biometric authentication on the input screen for whether or not to provide personal information. For example, the terminal 50 may display a GUI such as that shown in FIG. 9. In this case, the management server 20 may send an information provision inquiry to the terminal 50, which includes outline information and a facial image of the user (a facial image obtained from the authentication terminal 30).

The terminal 50 transmits the information (type of personal information permitted to be provided to a third party) acquired through a GUI such as that shown in Figures 8 and 9 to the management server 20. Specifically, the terminal 50 transmits an affirmative response including the information and the service user ID to the management server 20.

Upon receiving the positive response, the management server 20 searches the user information database using the service user ID as a key to identify the corresponding user. The management server 20 transmits to the information server 40 "behavioral information" including personal information of the identified user that is permitted to be provided and summary information.

The information server 40 stores the received behavioral information. If the behavioral information includes the user's personal information, the information server 40 determines the compensation to be given to the personal information provider according to the type (item) of the personal information provided. Specifically, the information server 40 calculates the compensation according to predetermined standards. For example, the information server 40 gives a high compensation to a user who provides high-value information such as name and age, and a low compensation to a user who provides low-value information such as gender. The information server 40 notifies the management server 20 of the calculated compensation.

Note that the determination of the compensation by the information server 40 described above is merely an example, and the information server 40 can determine the compensation to be given to the personal information provider according to various methods and standards. For example, the information server 40 may determine the compensation according to the demand for personal information (the number of companies wishing to purchase personal information). That is, the information server 40 may give a high compensation for personal information that is in high demand (high value) and a low compensation for personal information that is less important (low value). Alternatively, the information server 40 may determine the compensation to be given to the personal information provider according to the amount offered by companies, etc. wishing to provide information. The information server 40 may give a high compensation to a user who provides personal information for which a high offered amount is offered.

The management server 20 refers to the compensation receipt information of the personal information provider and pays the compensation (money, virtual currency, points) notified by the information server 40 to the personal information provider. The provider of personal information can obtain compensation for providing personal information from the information center via the service provider. The service provider may obtain a portion of the compensation paid to the personal information provider by the information center (information server 40) as an intermediary fee. Alternatively, the information center may pay the service provider a fee based on the total amount of personal information acquired in a specified period (e.g., one month).

It is possible to conclude a contract regarding the payment of the consideration between the service provider and the information center in advance, and have the service provider advance the consideration that the information center will pay to the personal information provider. Also, an ID can be assigned to the information (behavioral information, notification of consideration) exchanged between the management server 20 and the information server 40, and the management server 20 can identify the user who will pay the consideration by managing the ID in association with the service user ID of the personal information provider.

In this way, when the management server 20 has finished providing the service to the successfully authenticated person, it sends an information provision inquiry (an inquiry regarding whether or not to provide personal information, which includes a list of personal information items stored in the management server 20) to the terminal 50. The terminal 50 uses the acquired list of personal information to generate a GUI for inputting the type of personal information that the successfully authenticated person is permitted to provide to a third party. The terminal 50 acquires the type of personal information permitted to be provided to a third party via the GUI, and transmits the acquired type of personal information to the management server 20. When the management server 20 receives a positive response from the terminal 50, it transmits behavioral information to the information server 40, which includes the personal information permitted to be provided and summary information indicating an outline of the service provided.

Next, we will explain in detail each device included in the authentication system related to the first embodiment.

[Authentication Server]
Fig. 10 is a diagram showing an example of a processing configuration (processing module) of the authentication server 10 according to the first embodiment. Referring to Fig. 10, the authentication server 10 includes a communication control unit 201, a user registration unit 202, a database management unit 203, a service registration unit 204, an authentication unit 205, and a storage unit 206.

The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the management server 20. The communication control unit 201 also transmits data to the management server 20. The communication control unit 201 passes the data received from the other devices to the other processing modules. The communication control unit 201 transmits the data acquired from the other processing modules to the other devices. In this way, the other processing modules send and receive data to and from the other devices via the communication control unit 201.

The user registration unit 202 is a means for realizing the above-mentioned user registration. The user registration unit 202 acquires the user ID, password, and biometric information (facial image) of the user (a user who wishes to receive services using biometric authentication; a system user).

The user registration unit 202 acquires the above three pieces of information (user ID, password, and biometric information) using any means. For example, the user registration unit 202 displays a GUI or an input form for determining a user ID and password on the terminal 50. For example, the user registration unit 202 displays a GUI such as that shown in FIG. 11 on the terminal 50.

The user registration unit 202 verifies that the user ID and password acquired via the GUI or the like are not duplicated with a user ID and password that have already been registered. If no duplication has occurred, the user registration unit 202 displays on the terminal 50 a GUI for acquiring the user's biometric information.

For example, the user registration unit 202 displays a GUI such as that shown in Fig. 12 on the terminal 50. For example, the user presses the "File Selection" button shown in Fig. 12 and specifies image data of a facial image to be registered in the system. The specified facial image is displayed in the preview area (displayed as the selected facial image in Fig. 12).

The user registration unit 202, for example, acquires a user ID, password, and biometric information (facial image) through a GUI such as that shown in Figures 11 and 12, and generates features (feature vector consisting of multiple features) from the facial image.

Specifically, the user registration unit 202 extracts feature points from the acquired facial image. Note that existing technology can be used for the feature point extraction process, so a detailed explanation is omitted. For example, the user registration unit 202 extracts the eyes, nose, mouth, etc. as feature points from the facial image. The user registration unit 202 then calculates the position of each feature point and the distance between each feature point as feature amounts, and generates a feature vector (vector information that characterizes the facial image) consisting of multiple feature amounts.

The user registration unit 202 passes the user ID, password and the above-generated features to the database management unit 203.

The database management unit 203 is a means for managing the authentication information database. The authentication information database stores information identifying a system user (user ID, password), biometric information (feature), a service provider ID identifying a service provider, and a service user ID identifying a user in each service, in association with each other.

When the database management unit 203 obtains the above three pieces of information (user ID, password, feature amount) from the user registration unit 202, it adds a new entry to the authentication information database. For example, when the above three pieces of information about user U1 are obtained, the database management unit 203 adds the entry shown in the bottom row of Figure 13. Note that at the user registration stage, the service provider ID and service user ID have not been generated, so nothing is set in these fields.

The service registration unit 204 is a means for enabling individual service registration by system users. The service registration unit 204 processes service registration requests received from the service provider's management server 20.

The service registration unit 204 searches the authentication information database using the user ID and password included in the acquired service registration request as keys. The service registration unit 204 checks the service provider ID field of the identified user (the user identified from the user ID and password pair).

The service registration unit 204 determines whether the service provider ID included in the service registration request acquired from the management server 20 is set in the service provider ID field. If the service provider ID acquired from the management server 20 is already registered in the database, the service registration unit 204 notifies the management server 20 of this fact. In this case, since the service (service provider) that the user is attempting to register is already registered in the authentication information database, the service registration unit 204 sends a "negative response" in response to the service registration request.

On the other hand, if the service provider ID included in the service registration request is not set in the service provider ID field of the identified user, the service registration unit 204 generates a service user ID corresponding to the user and service provider.

As described above, the service user ID is identification information that is uniquely determined from the combination of a user and a service provider. For example, the service registration unit 204 calculates a hash value using the user ID, password, and service provider ID, and sets the calculated hash value as the service user ID. Specifically, the service registration unit 204 calculates a concatenated value of the user ID, password, and service provider ID, and generates the service user ID by calculating a hash value of the calculated concatenated value.

Note that the generation of the service user ID using the above hash value is merely an example and is not intended to limit the method of generating the service user ID. The service user ID may be any information that can uniquely identify the combination of a system user and a service provider. For example, the service registration unit 204 may assign a unique value each time a service registration request is processed and use this value as the service user ID.

When the service user ID is generated, the service registration unit 204 passes the service provider ID and service user ID to the database management unit 203 along with the user ID and password, etc. The database management unit 203 registers the two IDs (service provider ID, service user ID) in the authentication information database. For example, when user U1 registers a service for service provider S1, the above two IDs are added to the entry shown in the bottom row of Figure 14.

Because service registration is performed for each service provider, multiple service providers and service user IDs may be set for one user. For example, if user U1 performs service registration for each of service providers S1 and S2, the entries in the second and third lines of Figure 15 are generated. Note that if user U2 performs service registration for service provider S1, the entry in the bottom row of Figure 15 is generated.

The authentication information database shown in FIG. 15 etc. is an example and is not intended to limit the information stored in the authentication information database. For example, a facial image may be registered in the authentication information database instead of features for authentication. In other words, features may be generated from a facial image registered in the authentication information database each time authentication is performed.

When the service provider ID and service user ID are registered in the authentication information database, the service registration unit 204 notifies the management server 20 that the service registration request has been processed successfully. The service registration unit 204 sends a "positive response" as a response to the service registration request. At that time, the service registration unit 204 sends a response including the service user ID to the management server 20.

The authentication unit 205 is a means for performing authentication processing of system users. The authentication unit 205 processes authentication requests received from the service provider's management server 20.

The authentication unit 205 extracts the features and the service provider ID contained in the authentication request. The authentication unit 205 searches the authentication information database using the extracted features and the service provider ID as keys to identify the corresponding service user ID.

The authentication unit 205 sets the feature quantity extracted from the authentication request as the feature quantity of the matching side, and the feature quantity stored in the database as the feature quantity of the registration side, and performs 1:N matching. Specifically, the authentication unit 205 calculates the similarity between the feature quantity of the matching side and each of the multiple registration sides. The similarity can be calculated using chi-square distance, Euclidean distance, or the like. Note that the greater the distance, the lower the similarity, and the closer the distance, the higher the similarity.

The authentication unit 205 determines whether or not there is a feature among the multiple features registered in the database whose similarity with the feature to be matched is equal to or greater than a predetermined value. If such a feature exists, the authentication unit 205 identifies the user (user ID, password) corresponding to the feature with the highest similarity. The authentication unit 205 determines whether or not there is an entry that matches the service provider ID included in the authentication request among at least one or more service provider IDs associated with the user identified by the 1:N matching.

If such an entry exists (if the above two determinations are successful), the authentication unit 205 determines that the authentication of the user has been successful. In this case, the authentication unit 205 sends a "positive response" to the management server 20, which is the sender of the authentication request. At that time, the authentication unit 205 generates a response (response to the authentication request) including the service user ID of the identified entry and sends it to the management server 20.

If at least one of the above two judgments fails, the authentication unit 205 determines that authentication of the user has failed. In this case, the authentication unit 205 sends a "negative response" to the management server 20, which is the sender of the authentication request.

For example, in the example of Figure 15, when the authentication request contains a feature "FV1" and a service provider ID "S1", the feature FV1 identifies the entries (users) in the second and third lines, and the service provider ID "S1" identifies the entry in the second line. As a result, the authentication request is processed normally, and a positive response including the service user ID "U1S1" is sent to the management server 20.

On the other hand, if the feature of "FV2" and the service provider ID of "S2" are included in the authentication request, the feature identifies the bottom entry, but the service provider ID of that entry is "S1" and not "S2", so the authentication request is not processed normally. As a result, a negative response is sent to the management server 20.

The memory unit 206 stores information necessary for the operation of the authentication server 10. An authentication information database is constructed in the memory unit 206.

[Administration Server]
Fig. 16 is a diagram showing an example of a processing configuration (processing module) of the management server 20 according to the first embodiment. Referring to Fig. 16, the management server 20 includes a communication control unit 301, a personal information acquisition unit 302, a service registration request unit 303, a database management unit 304, an authentication request unit 305, a behavior information provision unit 306, and a storage unit 307.

The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the authentication server 10. The communication control unit 301 also transmits data to the authentication server 10. The communication control unit 301 passes the data received from the other devices to the other processing modules. The communication control unit 301 transmits the data acquired from the other processing modules to the other devices. In this way, the other processing modules send and receive data with the other devices via the communication control unit 301.

The personal information acquisition unit 302 is a means for acquiring personal information required when the service provider provides the service. For example, if the service provider is a "retailer", the personal information acquisition unit 302 acquires payment-related information (e.g., credit card information, bank account information) in addition to the user's name, etc. Alternatively, if the service provider is a "hotel operator", the personal information acquisition unit 302 acquires reservation information regarding accommodation (e.g., accommodation date, etc.) in addition to the user's name, etc.

The personal information acquisition unit 302 also acquires from the user contact information (e.g., an email address that can be received by the terminal 50) for sending an inquiry regarding whether or not to provide personal information (information provision inquiry), and payment receipt information for receiving payment from the information server 40.

Furthermore, the personal information acquisition unit 302 acquires the user ID and password determined when the user registered with the system, in addition to the personal information such as the name mentioned above.

The personal information acquisition unit 302 acquires personal information, user ID, and password using any means. For example, the personal information acquisition unit 302 displays a GUI or form for inputting the above information on the terminal 50 (see Figure 17). Alternatively, information such as that shown in Figure 17 may be displayed on a web page managed and operated by the service provider. Alternatively, the terminal 50 may download an application provided by the service provider, and the application may display the information as shown in Figure 17. In particular, the web page may be a web page that manages the member information of the service provider. In other words, service registration may be performed on a web page where members of each service provider manage their own member information.

The personal information acquisition unit 302 passes the personal information (including contact information and payment receipt information), user ID, and password acquired using a GUI, etc., to the service registration request unit 303.

The service registration request unit 303 is a means of requesting (asking) the authentication server 10 to register the user's use of the service.

The service registration request unit 303 selects the user ID and password from the above three pieces of information (personal information, user ID, and password) acquired from the personal information acquisition unit 302. The service registration request unit 303 transmits a service registration request including the selected user ID, password, and service provider ID to the authentication server 10.

The service registration request unit 303 obtains a response to the service registration request from the authentication server 10. If the obtained response is a "negative response," the service registration request unit 303 notifies the user of this fact. For example, the service registration request unit 303 notifies the user that the service registration has already been performed.

If the acquired response is an "affirmative response," the service registration request unit 303 notifies the user that the service registration was successful. The service registration request unit 303 also passes the service user ID included in the response and the personal information acquired from the personal information acquisition unit 302 (such as name, sex, address, family structure, contact information, and payment receipt information) to the database management unit 304.

The database management unit 304 is a means for managing the user information database. The user information database is a database that manages information on users (system users) to whom services are provided. The user information database stores the personal information of the user (e.g., name, etc.) in association with the service user ID obtained from the authentication server 10.

When the database management unit 304 acquires the above information (personal information, service user ID) from the service registration request unit 303, it adds a new entry to the user information database. For example, when the management server 20 of the service provider S1 acquires the above information regarding the user U1, the entry shown in the bottom row of Figure 18 is added.

The authentication request unit 305 is a means for requesting authentication of a user from the authentication server 10.

When the authentication request unit 305 acquires biometric information (face image) from the authentication terminal 30, it generates features from the face image. The authentication request unit 305 transmits an authentication request including the generated features and the service provider ID to the authentication server 10.

If the response from the authentication server 10 is a "negative response" (if authentication fails), the authentication request unit 305 notifies the authentication terminal 30 of this fact.

If the response from the authentication server 10 is an "affirmative response" (authentication is successful), the authentication request unit 305 extracts the service user ID contained in the response from the authentication server 10. The authentication request unit 305 searches the user information database using the service user ID as a key to identify the corresponding entry.

The authentication request unit 305 reads out the personal information of the identified entry and transmits it to the authentication terminal 30. For example, in the example of FIG. 18, if the service user ID is "U1S1", the personal information in the bottom row is transmitted to the authentication terminal 30. Note that the authentication request unit 305 does not need to transmit to the authentication terminal 30 personal information that is not necessary for the authentication terminal 30 to provide the service. For example, if contact information for information inquiries or payment receipt information is not necessary for the provision of the service, this information does not need to be transmitted to the authentication terminal 30.

The behavioral information providing unit 306 is a means for providing information (behavioral information) regarding the user's behavior when a service is provided through biometric authentication to the information server 40.

When the behavioral information providing unit 306 receives a "service provision termination notification" from the authentication terminal 30, it transmits an "information provision inquiry" to the terminal 50 held by the user (authenticated successfully; a user who has received a service provided through biometric authentication). As described above, the inquiry includes a list of personal information stored in the management server 20 and the service user ID.

If the response to the information provision inquiry is a negative response (refusal to provide personal information), the behavioral information providing unit 306 generates summary information and transmits the summary information to the information server 40 as "behavioral information." Note that the summary information does not include information that can identify the user, but is information for notifying the information server 40 that a service has been provided through biometric authentication and a brief description of the service. Therefore, the management server 20 may include the user's product purchase price, accommodation record, etc. in the summary information.

If the response to the information provision inquiry is an affirmative response (agreement to the provision of personal information), the behavioral information providing unit 306 identifies the user by the service user ID included in the response. Furthermore, the behavioral information providing unit 306 reads out from the user information database the personal information related to the identified user that the user has permitted to be provided. The behavioral information providing unit 306 transmits the read personal information and summary information to the information server 40 as "behavioral information".

When transmitting behavioral information including personal information and summary information, the behavioral information providing unit 306 generates an ID (behavioral information ID) that enables the behavioral information to be transmitted to be identified, and transmits the behavioral information including the ID to the information server 40 (see FIG. 19). The behavioral information providing unit 306 stores the behavioral information ID in association with the service user ID.

When the behavioral information providing unit 306 receives a notification regarding the payment from the information server 40, it extracts the behavioral information ID included in the notification and identifies the corresponding user (service user ID). The behavioral information providing unit 306 searches the user information database using the identified service user ID as a key to identify the corresponding entry. The behavioral information providing unit 306 references the payment receipt information of the identified entry to obtain the payee of the payment. The behavioral information providing unit 306 pays the payment notified by the information server 40 to the payee.

The memory unit 307 stores information necessary for the operation of the management server 20. A user information database is constructed in the memory unit 307.

[Authentication device]
The authentication terminal 30 transmits the biometric information acquired from the user to the management server 20, thereby acquiring personal information of the user from the management server 20. The authentication terminal 30 provides services to the user using the acquired personal information.

Figure 20 is a diagram showing an example of a processing configuration (processing module) of the authentication terminal 30 according to the first embodiment. Referring to Figure 20, the authentication terminal 30 includes a communication control unit 401, a biometric information acquisition unit 402, a service providing unit 403, a message output unit 404, and a memory unit 405.

The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the management server 20. The communication control unit 401 also transmits data to the management server 20. The communication control unit 401 passes the data received from the other devices to the other processing modules. The communication control unit 401 transmits data acquired from the other processing modules to the other devices. In this way, the other processing modules send and receive data with the other devices via the communication control unit 401.

The biometric information acquisition unit 402 is a means for controlling the camera and acquiring the biometric information (facial image) of the user. The biometric information acquisition unit 402 captures an image in front of the device periodically or at a specified timing. The biometric information acquisition unit 402 determines whether the acquired image contains a human facial image, and if a facial image is included, extracts the facial image from the acquired image data.

Note that the facial image detection process and facial image extraction process performed by the biometric information acquisition unit 402 can use existing technology, so detailed explanations will be omitted. For example, the biometric information acquisition unit 402 may extract a facial image (face area) from image data using a learning model trained by a CNN (Convolutional Neural Network). Alternatively, the biometric information acquisition unit 402 may extract a facial image using a method such as template matching.

The biometric information acquisition unit 402 passes the extracted facial image to the service providing unit 403.

The service providing unit 403 is a means for providing a specific service to a user. The service providing unit 403 transmits the facial image acquired from the biometric information acquisition unit 402 to the management server 20. The management server 20 replies with personal information (e.g., name, etc.) corresponding to the facial image. The service providing unit 403 uses the returned personal information to provide a service to the user. When the provision of the service to the user ends, the service providing unit 403 transmits a "service provision end notification" to the management server 20.

The message output unit 404 is a means for outputting various messages to the user. For example, the message output unit 404 outputs a message regarding the user's authentication result or a message regarding the provision of services. The message output unit 404 may display a message using a display device such as an LCD monitor, or may play an audio message using audio equipment such as a speaker.

The memory unit 405 stores information necessary for the operation of the authentication terminal 30.

[Information Server]
Fig. 21 is a diagram showing an example of a processing configuration (processing module) of the information server 40 according to the first embodiment. Referring to Fig. 21, the information server 40 includes a communication control unit 501, a behavior information processing unit 502, and a storage unit 503.

The communication control unit 501 is a means for controlling communication with other devices. For example, the communication control unit 501 receives data (packets) from the management server 20. The communication control unit 501 also transmits data to the management server 20. The communication control unit 501 passes the data received from the other devices to the other processing modules. The communication control unit 501 transmits the data acquired from the other processing modules to the other devices. In this way, the other processing modules send and receive data to and from the other devices via the communication control unit 501.

The behavior information processing unit 502 is a means for processing the behavior information acquired from the management server 20. The behavior information processing unit 502 stores the acquired behavior information in the memory unit 503.

When the acquired behavioral information includes personal information (e.g., name, age, etc.), the behavioral information processing unit 502 determines the compensation to be paid to the provider of the behavioral information (personal information provider). For example, the behavioral information processing unit 502 determines the compensation by referring to table information that defines the type of acquired personal information and the compensation to be paid (amount, points, etc.) as shown in FIG. 22. The behavioral information processing unit 502 calculates the sum of the compensation corresponding to each type of personal information provided, and determines this as the compensation to be paid to the personal information provider. The information center determines the amount of compensation depending on the value of the information provided.

The behavioral information processing unit 502 notifies the management server 20 of the determined compensation.

The memory unit 503 is a means for storing information necessary for the operation of the information server 40.

The information server 40 analyzes the accumulated behavioral information and generates information to be sold to businesses, etc. However, since this function is different from the purpose of this application, an explanation of this function will be omitted.

In this way, the information server 40 determines the compensation to be paid to the user (the person who successfully authenticated the service) according to the type of personal information provided by the user. The information server 40 also notifies the management server 20 of the compensation to be paid to the user. The management server 20 pays the notified compensation based on the user's compensation receipt information.

[Device]
Fig. 23 is a diagram showing an example of a processing configuration (processing module) of the terminal 50 according to the first embodiment. Referring to Fig. 23, the terminal 50 includes a communication control unit 601, a personal information control unit 602, and a storage unit 603.

The communication control unit 601 is a means for controlling communication with other devices. For example, the communication control unit 601 receives data (packets) from the management server 20. The communication control unit 601 also transmits data to the management server 20. The communication control unit 601 passes the data received from the other devices to the other processing modules. The communication control unit 601 transmits data acquired from the other processing modules to the other devices. In this way, the other processing modules send and receive data to and from the other devices via the communication control unit 601.

The personal information control unit 602 is a means for controlling whether or not personal information held by the service provider is provided to the information server 40 in accordance with the user's wishes.

When the personal information control unit 602 receives an information provision inquiry from the management server 20, it acquires the user's intention regarding whether or not to consent to the provision of personal information stored in the management server 20 to the information server 40. Specifically, the personal information control unit 602 displays a GUI such as that shown in FIG. 7, and acquires the user's comprehensive (overall) intention regarding the provision of personal information.

If the user has no intention of providing personal information, the personal information control unit 602 notifies the management server 20 of that fact. Specifically, the personal information control unit 602 sends a negative response to the information provision inquiry to the management server 20.

If the user intends to provide personal information, the personal information control unit 602 displays a GUI such as that shown in Figures 8 and 9, and acquires the types of personal information permitted to be provided to the information center (third party). The personal information control unit 602 determines the types of personal information shown in Figures 8 and 9 based on a list of personal information items acquired from the management server 20. Figures 8 and 9 show an interface that allows the user to select personal information that can be provided to third parties, but an interface that allows the user to set permission to provide or refusal to provide (YES, NO) for each piece of personal information may also be used.

If the service provider (management server 20) is different, the personal information stored in the management server 20 will also be different. Therefore, by referring to the list of personal information items obtained from the management server 20, the personal information control unit 602 will not request the user to select personal information that cannot be provided to the information server 40.

The personal information control unit 602 transmits the type of personal information acquired through the GUI shown in Figures 8 and 9 to the management server 20. Specifically, the personal information control unit 602 transmits an affirmative response including the type of personal information permitted by the user to the management server 20.

The memory unit 603 stores information necessary for the operation of the terminal 50.

[System Operation]
Next, a description will be given of the operation of the authentication system according to the first embodiment. Note that the description of the operation will focus on the service registration phase, the service provision phase, and the information collection phase, and a description of the user registration phase will be omitted.

Figure 24 is a sequence diagram showing an example of operation related to the service registration phase of the authentication system relating to the first embodiment.

The management server 20 obtains personal information (information necessary to provide the service), user ID, and password from the user (step S01).

The management server 20 sends a service registration request including the acquired user ID and password and the service provider ID to the authentication server 10 (step S02).

The authentication server 10 generates a service user ID using the acquired user ID, password and service provider ID (step S03).

The authentication server 10 stores the service provider ID and the service user ID in the authentication information database (step S04).

The authentication server 10 sends a response (response to the service registration request) including the service user ID to the management server 20 (step S05).

The management server 20 associates the personal information acquired in step S01 with the service user ID acquired from the authentication server 10 and stores them in the user information database (step S06).

In this way, the management server 20 obtains the service user ID by sending an authentication request including the user ID, password, and service provider ID to the authentication server 10. The management server 20 stores the obtained service user ID in association with the user's personal information.

Figure 25 is a sequence diagram showing an example of operation related to the service provision phase of the authentication system relating to the first embodiment.

The authentication terminal 30 acquires a facial image (biometric information) of the user and transmits the acquired facial image to the management server 20 (step S11).

The management server 20 generates features from the acquired facial image (step S12).

The management server 20 sends an authentication request including the generated features and the service provider ID to the authentication server 10 (step S13).

The authentication server 10 performs an authentication process using the features included in the authentication request and the service provider ID, and identifies the corresponding service user ID (step S14).

The authentication server 10 sends a response (response to the authentication request) including the identified service user ID to the management server 20 (step S15).

The management server 20 searches the user information database using the acquired service user ID and identifies the corresponding personal information (step S16).

The management server 20 transmits the identified personal information to the authentication terminal 30 (step S17).

The authentication terminal 30 provides services using the acquired personal information (step S18).

When the service provision ends, the authentication terminal 30 sends a service provision end notification to the management server 20 (step S19).

Figure 26 is a sequence diagram showing an example of operation related to the information collection phase of the authentication system relating to the first embodiment.

Upon receiving a notification of the end of service provision from the authentication terminal 30, the management server 20 sends an information provision inquiry to the terminal 50 (step S21).

Upon receiving an information provision inquiry, the terminal 50 generates a GUI to obtain the user's intention regarding providing personal information to a third party (information center, information server 40) (obtaining whether or not to provide personal information; step S22).

If the user agrees to provide personal information, the terminal 50 generates a GUI for selecting the type of personal information that can be provided to a third party (selection of personal information to provide; step S23).

The terminal 50 generates a response (response to the information inquiry) including the type of personal information selected by the user and transmits it to the management server 20 (step S24).

The management server 20 transmits the behavioral information including the personal information and summary information that are permitted to be provided to the information server 40 (step S25).

The information server 40 stores the acquired behavioral information (step S26) and determines the compensation to be paid to the personal information provider (step S27).

The information server 40 notifies the management server 20 of the determined price (step S28).

The management server 20 refers to the compensation receipt information of the personal information provider and pays the compensation notified by the management server 20 to the user (step S29).

As described above, in the authentication system according to the first embodiment, when a service is provided to a user, in addition to the information resulting from the provision of the service (summary information showing an outline of the service), personal information of the user who received the service is sent to the information center. At that time, the user can select which items of their personal information they wish to allow to be provided to third parties, and can therefore refuse to provide personal information that they do not wish to provide. In other words, the user can control the provision or refusal of personal information based on their own wishes.

Furthermore, information centers that collect and utilize personal information make it easy to collect personal information that is highly useful (such as name, address, etc.) by offering a high compensation for such information. In other words, because a large compensation can be obtained, users agree (are convinced) to provide highly useful personal information to third parties. Furthermore, different service providers will have different personal information that the information center can collect, allowing the information center to collect a wider variety of data. For example, the information center can obtain the user's age along with the amount paid by the user from retailers, and the user's length of stay and age, gender, etc. from hotel operators.

Second Embodiment
Next, the second embodiment will be described in detail with reference to the drawings.

In the second embodiment, we will explain the case where the authentication terminal 30 obtains whether or not personal information can be provided.

The configuration of the authentication system for the second embodiment can be the same as that of the first embodiment, so the explanation corresponding to Figure 2 will be omitted.

In the second embodiment, the user's contact information, which was required in the first embodiment, is not required. This is because in the second embodiment, the authentication terminal 30 obtains the decision on whether or not to provide personal information.

Figure 27 is a diagram for explaining the operation of the authentication system relating to the second embodiment.

When the authentication terminal 30 acquires the personal information from the management server 20, it uses the personal information to provide a service. When the provision of the service is completed, the authentication terminal 30 displays a GUI that asks whether or not to provide the personal information. Specifically, the authentication terminal 30 generates a GUI as shown in Figure 7 and acquires whether or not to provide the personal information.

When the user agrees to provide personal information, the authentication terminal 30 generates a GUI (for example, a GUI as shown in Figures 8 and 9) for inputting personal information that can be provided to a third party. The authentication terminal 30 transmits the personal information that can be provided, acquired via the GUI, to the management server 20.

The management server 20 transmits (provides) behavioral information (behavioral information including personal information and summary information) to the information server 40 based on the received personal information.

In order to realize the operation of the authentication system according to the second embodiment, the authentication terminal 30 only needs to include the "personal information control function" of the terminal 50 according to the first embodiment. That is, as shown in FIG. 28, the authentication terminal 30 according to the second embodiment only needs to include a personal information control unit 406.

As described above, in the authentication system according to the second embodiment, when the authentication terminal 30 has finished providing a service to a successfully authenticated person, it generates a GUI for inputting the type of personal information that the successfully authenticated person is permitted to provide to a third party. The management server 20 obtains the user's intention regarding the provision of personal information via the authentication terminal 30. The second embodiment also allows the user to appropriately control and manage personal information related to services provided by biometric authentication.

Next, we will explain the hardware of each device that makes up the authentication system. Figure 29 is a diagram showing an example of the hardware configuration of the management server 20.

The management server 20 can be configured by an information processing device (so-called a computer) and has the configuration shown in Fig. 29. For example, the management server 20 has a processor 311, a memory 312, an input/output interface 313, a communication interface 314, etc. The components such as the processor 311 are connected by an internal bus or the like and are configured to be able to communicate with each other.

However, the configuration shown in FIG. 29 is not intended to limit the hardware configuration of the management server 20. The management server 20 may include hardware not shown. Furthermore, the number of processors 311 and the like included in the management server 20 is not intended to be limited to the example shown in FIG. 29, and for example, multiple processors 311 may be included in the management server 20.

The processor 311 is, for example, a programmable device such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a DSP (Digital Signal Processor). Alternatively, the processor 311 may be a device such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). The processor 311 executes various programs including an operating system (OS).

Memory 312 is a RAM (Random Access Memory), a ROM (Read Only Memory), a HDD (Hard Disk Drive), a SSD (Solid State Drive), etc. Memory 312 stores an OS program, application programs, and various data.

The input/output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display. The input device is, for example, a device that accepts user operations such as a keyboard or a mouse.

The communication interface 314 is a circuit, module, etc. that communicates with other devices. For example, the communication interface 314 includes a wireless communication circuit, a NIC (Network Interface Card), etc.

The functions of the management server 20 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network or updated using a storage medium that stores the program. The processing modules may also be realized by a semiconductor chip.

In addition, the authentication server 10, authentication terminal 30, information server 40, terminal 50, etc. can also be configured using information processing devices like the management server 20, and their basic hardware configurations are no different from those of the management server 20, so a description will be omitted. For example, the authentication terminal 30 may be equipped with a camera for capturing an image of the user.

The management server 20 is equipped with a computer, and the functions of the management server 20 can be realized by causing the computer to execute a program. The management server 20 also executes the personal information provision method by the program.

[Modification]
The configuration, operation, and the like of the authentication system described in the above embodiment are merely examples, and are not intended to limit the system configuration, and the like.

In the above embodiment, it has been described that a user determines a user ID and password, and identifies a user (system user) registered in the system using the user ID and password. However, the authentication system may determine an ID (identifier) that uniquely identifies a system user. For example, in the user registration phase, the authentication server 10 acquires biometric information (facial image, features) of the user. The authentication server 10 may generate the ID based on the biometric information. For example, the authentication server 10 may calculate a hash value from the features of the facial image, and use the calculated hash value as a substitute for a user ID and password. The features of the facial image differ for each user, and the hash value generated from the features also differs for each user, so it can be used as the ID of the system user.

In the above embodiment, it has been described that the user registration phase and the service registration phase are executed at different times, but these phases may be executed at substantially the same time. For example, an authentication terminal 30 installed at a service provider to which the user wishes to receive a service may be used to execute the above two registration phases. Specifically, the user may perform user registration using the authentication terminal 30, and then perform service registration consecutively. In this case, the authentication terminal 30 may be provided with a user registration function (user registration unit 202) of the authentication server 10 and a personal information acquisition function (personal information acquisition unit 302) of the management server 20.

The multiple authentication terminals 30 owned by a service provider do not have to be installed on the same premises, building, etc. If the service provider is the same, each authentication terminal 30 may be installed in a spatially separated location.

In the above embodiment, one service provider ID is assigned to one service provider, but one service provider ID may be assigned to multiple service providers. Multiple service providers may be grouped together and a service provider ID may be issued for each group. For example, when service providers S1 and S2 cooperate with each other to provide the same service, a common service provider ID may be issued to service providers S1 and S2.

In the above embodiment, a case has been described in which biometric information related to "feature amounts generated from a facial image" is transmitted from the management server 20 to the authentication server 10. However, biometric information related to a "facial image" may also be transmitted from the management server 20 to the authentication server 10. In this case, the authentication server 10 may generate feature amounts from the acquired facial image and execute the authentication process (matching process).

In the above embodiment, a case has been described in which the authentication terminal 30 acquires a facial image and the management server 20 generates features from the facial image. However, the authentication terminal 30 may generate features from the facial image and transmit the generated features to the management server 20. In other words, the management server 20 does not have to generate features.

In the above embodiment, a case where a user inputs a user ID and a password to a service provider when registering personal information in the service registration phase (see FIG. 11) has been described. However, instead of the user ID and password, the user's biometric information (face image) may be input to the service provider. In this case, the management server 20 transmits a service registration request including a feature amount generated from a face image and a service provider ID to the authentication server 10. The authentication server 10 executes a matching process using the feature amount included in the request and the feature amount registered in the authentication information database to identify the corresponding user. If the authentication server 10 succeeds in identifying (authenticating) the user, it issues a service user ID. With this kind of response, even if the user has forgotten the user ID or password, the user can easily register for the service. Alternatively, the service provider may obtain the user's biometric information (face image) in addition to the user ID and password. In this case, the authentication server 10 may issue a service user ID if the user ID, password, and biometric information match (two-factor authentication using biometric information and password may be executed).

The service provider may cache (temporarily store) information acquired from the authentication server 10 or the authentication terminal 30. For example, the management server 20 caches the biometric information acquired from the authentication terminal 30 and the result of authentication based on the biometric information (service user ID) for a predetermined period of time. When the management server 20 acquires biometric information from the authentication terminal 30, it first checks the cached data, and if there is cached data that matches the acquired biometric information, it does not send an authentication request to the authentication server 10. The management server 20 identifies personal information using the service user ID included in the cached data. Alternatively, the management server 20 may cache a combination of biometric information and personal information. Alternatively, the conditions for deleting cached data may be changed depending on the type of service. For example, when a hotel operator provides accommodation services, the management server 20 may delete the cached data when the guest's stay period ends.

The form of data transmission and reception between each device (authentication server 10, management server 20, authentication terminal 30) is not particularly limited, but the data transmitted and received between these devices may be encrypted. Biometric information is transmitted and received between these devices, and in order to appropriately protect the biometric information, it is desirable to transmit and receive encrypted data.

In the above embodiment, it has been described that the user decides whether or not to provide personal information for each service provider. However, the terminal 50 may be provided with a GUI that allows the user to input whether or not to provide personal information for the entire authentication system.

In the above embodiment, the decision as to whether or not to provide personal information is made after the service is provided by the service provider. However, the decision as to whether or not to provide personal information may be made before the service is provided. In other words, as long as authentication is performed by the authentication server 10, the decision as to whether or not to provide personal information may be made either before or after the service is provided.

In the above embodiment, the case where the terminal 50 obtains the availability of personal information has been described. The terminal 50 may be used for a purpose other than the above purpose. For example, the user may use the terminal 50 to update other information registered in the authentication server 10. For example, the user may use the terminal 50 to access the authentication server 10 and select a service provider from which the service is to be provided by biometric authentication. That is, the user may register for a service via the authentication server 10. In this case, if there are a large number of service providers, service providers that are used less frequently or have not been used recently may be displayed preferentially. Alternatively, the user may use the terminal 50 to apply for withdrawal from the system or service.

The management server 20 may acquire information in advance about the compensation that the information server 40 will give to each piece of personal information provided, and may notify the terminal 50 or the authentication terminal 30 of information about the compensation to be returned to the user based on the acquired information. For example, the management server 20 may notify the terminal 50 of a list of personal information items included in the information provision notification and the compensation to be given when each item is provided. In this case, the terminal 50 may display a GUI as shown in FIG. 30. As shown in FIG. 30, the terminal 50 may specify that the compensation (money, virtual currency, points that can be used for online shopping, etc.) obtained varies depending on the type of personal information provided. Also, as shown in FIG. 30, the terminal 50 may display the total compensation obtained by providing the selected personal information to a third party.

The terminal 50 or the authentication terminal 30 may display a GUI for inputting the period of provision of the provided data for each piece of personal information permitted to be provided to a third party (see FIG. 31). For example, the terminal 50 or the authentication terminal 30 may display a GUI for selecting the period of provision (for example, one month, one year, ten years, unlimited) as shown in FIG. 31. Alternatively, the terminal 50 or the authentication terminal 30 may display a GUI for inputting the start and end of the period of provision (the user may input the period of provision in a format such as 20XX/YY/ZZ to 20ZZ/YY/XX). The terminal 50 or the authentication terminal 30 notifies the management server 20 of the period of provision together with the personal information permitted to be provided. The management server 20 transmits behavioral information including these pieces of information to the information server 40. The information server 40 determines the compensation according to the type of personal information provided and the length of the period of provision of data for each type of personal information provided. The information server 40 discards the stored personal information when the specified period of provision has passed.

In the above embodiment, one information center is exemplified as a destination of personal information. However, personal information may be provided to multiple information centers (information banks). In this case, the user may select an information center from the multiple information centers to which the user is permitted to provide personal information. Specifically, when sending a status provision inquiry, the management server 20 also transmits information on the affiliated information center (information server 40) to the terminal 50, etc. For example, the management server 20 transmits the name of the information center, etc. to the terminal 50, etc. The terminal 50 or the authentication terminal 30 may display a GUI as shown in FIG. 32 using the acquired information and obtain whether or not to provide personal information for each information center individually. In other words, the terminal 50 or the authentication terminal 30 may generate a GUI for inputting whether or not to permit the provision of personal information for each of the multiple information centers.

Furthermore, the terminal 50 and the authentication terminal 30 may display a GUI (such as the GUIs shown in Figures 8, 9, 30, and 31) that allows the user to select personal information to be provided to each information center that is authorized to provide information. The terminal 50 and the authentication terminal 30 may also display the compensation to be obtained from each information center (the compensation to be obtained may differ depending on the destination of the personal information).

In GUIs such as Figures 8 and 9, the terminal 50 or the authentication terminal 30 may display the personal information of the user (successfully authenticated person) directly rather than displaying the type of personal information (see Figure 33).

Although the above embodiment does not mention user identity verification, the user identity may be verified in one of the authentication systems. For example, when registering a user, the authentication server 10 may verify the user's identity. In this case, the user registration unit 202 of the authentication server 10 may obtain the user's identity document (e.g., a passport, etc.) from the terminal 50 and perform one-to-one matching using the user's facial image and the facial image written on the identity document. The authentication server 10 may register users who have been successfully matched. Alternatively, a similar identity verification may be performed when registering for a service. By verifying the user's identity in one of the authentication systems, the reliability of personal information provided to the information center is guaranteed.

In the above embodiment, the management server 20 notifies the user that biometric authentication has been performed by sending an information provision inquiry to the terminal 50. However, the authentication server 10 may notify the terminal 50 of the fact. In this case, the terminal 50 may display a GUI or the like regarding whether or not to provide information in response to the notification from the authentication server 10.

In the flow diagrams (flowcharts, sequence diagrams) used in the above explanation, multiple steps (processes) are described in order, but the order of execution of the steps performed in the embodiments is not limited to the order described. In the embodiments, the order of the steps shown in the diagrams can be changed to the extent that does not interfere with the content, such as by executing each process in parallel.

The above embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are required. Furthermore, when multiple embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace part of the configuration of an embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of an embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of an embodiment with other configurations.

The above explanation makes clear the industrial applicability of the present invention, and the present invention is particularly applicable to authentication systems that authenticate customers of retail stores, hotels, etc.

A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.
[Appendix 1]
An information server;
an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information;
a management server that stores personal information for providing services to the person who was successfully authenticated by biometric authentication, and transmits to the information server behavioral information including personal information of the person who was successfully authenticated to whom the service was provided that the person permitted to be provided to a third party;
An authentication system, including:
[Appendix 2]
The authentication method further includes a terminal carried by the successful authentication person,
When the provision of the service to the successfully authenticated person is completed, the management server transmits to the terminal an inquiry regarding whether or not personal information can be provided, the inquiry including a list of personal information stored in the terminal;
The authentication system of claim 1, wherein the terminal uses the list of personal information to generate a GUI for inputting the type of personal information that the successful authentication person is permitted to provide to the third party.
[Appendix 3]
The authentication system according to claim 2, wherein when the management server receives a positive response from the terminal to an inquiry regarding whether or not the personal information can be provided, the management server transmits the behavioral information to the information server.
[Appendix 4]
The authentication system according to any one of claims 1 to 3, wherein the management server transmits the behavioral information to the information server, the behavioral information including personal information that the successful authentication person has permitted to be provided to a third party and summary information regarding an overview of services provided to the successful authentication person.
5. The authentication system according to claim 1, wherein the information server determines a compensation to be paid to the successful authenticated person depending on the type of personal information provided by the successful authenticated person.
[Appendix 6]
The management server stores payment receipt information for receiving the payment,
The information server notifies the management server of the compensation to be paid to the successful authentication person;
The authentication system according to claim 5, wherein the management server pays the notified fee based on the fee receipt information of the successfully authenticated person.
[Appendix 7]
The authentication system according to claim 2 or 3, wherein the terminal generates a GUI displaying a reward that can be obtained by providing personal information to the third party.
[Appendix 8]
The authentication system according to any one of appendixes 2, 3, and 7, wherein the terminal generates a GUI for inputting a period for providing the provided data for each type of personal information permitted to be provided to the third party.
[Appendix 9]
An authentication system as described in Appendix 5, wherein the information server determines a compensation to be paid to the successful authentication person depending on the type of personal information provided and the length of the period for which data for each type of personal information provided is provided.
[Appendix 10]
The authentication system according to any one of appendices 2, 3, 7, and 8, wherein the terminal generates a GUI for inputting whether or not to permit the provision of personal information for each of the third parties.
[Appendix 11]
and an authentication terminal connected to the management server, acquiring biometric information of the person to be authenticated, and providing services to the person who has been successfully authenticated.
The authentication system described in Appendix 1, wherein, when the authentication terminal has completed providing the service to the successfully authenticated person, it generates a GUI for inputting the type of personal information that the successfully authenticated person is permitted to provide to the third party.
[Appendix 12]
12. The authentication system according to claim 1, wherein the biometric information is a face image or a feature generated from the face image.
[Appendix 13]
The system is connected to a management server that stores personal information for providing services to those who have been successfully authenticated by biometric authentication.
a terminal that generates a GUI for inputting personal information of the successfully authenticated person to whom the service is provided that the successfully authenticated person permits to be provided to a third party;
[Appendix 14]
An information server;
an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information;
A management server that stores personal information for providing services to individuals who have been successfully authenticated through biometric authentication, and transmits behavioral information to the information server, including personal information of the individuals to whom the service has been provided that the individuals have permitted to be provided to third parties.
[Appendix 15]
An information server;
an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information; and a management server connected to the authentication server,
storing personal information for providing services to the person who has been successfully authenticated by the biometric authentication;
A personal information providing method, comprising transmitting to the information server behavioral information including personal information of the successfully authenticated person to whom the service has been provided that the successfully authenticated person has permitted to be provided to a third party.
[Appendix 16]
An information server;
An authentication server stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information. A computer is installed in a management server connected to the authentication server.
A process of storing personal information for providing services to a person who has been successfully authenticated by the biometric authentication;
a process of transmitting to the information server behavioral information including personal information of the successfully authenticated person to whom the service has been provided that the successfully authenticated person has permitted to be provided to a third party;
A computer-readable storage medium that stores a program for executing the above.

The disclosures of the above cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. Those skilled in the art will understand that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and amendments that a person skilled in the art can make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas.

10, 102 Authentication server 20, 20-1, 20-2, 103 Management server 30, 30-1, 30-2, 31-1, 31-2 Authentication terminal 40, 101 Information server 50 Terminal 201, 301, 401, 501, 601 Communication control unit 202 User registration unit 203, 304 Database (DB; Data Base) management unit 204 Service registration unit 205 Authentication unit 206, 307, 405, 503, 603 Storage unit 302 Personal information acquisition unit 303 Service registration request unit 305 Authentication request unit 306 Behavior information provision unit 311 Processor 312 Memory 313 Input/output interface 314 Communication interface 402 Biometric information acquisition unit 403 Service provision unit 404 Message output unit 406, 602 Personal information control unit 502 Behavior information processing unit

Claims (9)

An information server;
an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information;
a management server that stores personal information for providing services to the person who was successfully authenticated by biometric authentication, and transmits to the information server behavioral information including personal information of the person who was successfully authenticated to whom the service was provided that the person permitted to be provided to a third party;
Including,
When the provision of the personal information is refused, the management server transmits summary information, which is information about the service provided through the biometric authentication and does not contain information that can identify the individual, to the information server as the behavioral information. The authentication method further includes a terminal carried by the successful authentication person,
When the provision of the service to the successfully authenticated person is completed, the management server transmits to the terminal an inquiry regarding whether or not personal information can be provided, the inquiry including a list of personal information stored in the terminal;
2. The authentication system according to claim 1, wherein the terminal uses the list of personal information to generate a GUI (Graphical User Interface) for inputting the type of personal information that the successful authentication person is permitted to provide to the third party. The authentication system according to claim 2, wherein the management server transmits the behavioral information to the information server when it receives a positive response from the terminal to an inquiry regarding whether or not the personal information can be provided. The authentication system according to any one of claims 1 to 3, wherein the management server transmits the behavioral information to the information server, the behavioral information including personal information that the successful authentication person has permitted to be provided to a third party and general information regarding an outline of the services provided to the successful authentication person. The authentication system according to any one of claims 1 to 4, wherein the information server determines the compensation to be paid to the successful authenticated person depending on the type of personal information provided by the successful authenticated person. The management server stores payment receipt information for receiving the payment,
The information server notifies the management server of the compensation to be paid to the successful authentication person;
6. The authentication system according to claim 5, wherein the management server pays the notified fee based on the fee receipt information of the successfully authenticated person. An information server;
an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information;
storing personal information for providing a service to the person who was successfully authenticated by the biometric authentication, and transmitting behavioral information including personal information that the person who was successfully authenticated has permitted to be provided to a third party among the personal information of the person who was successfully authenticated by the biometric authentication to the information server ;
If the provision of the personal information is refused, summary information, which is information on the service provided by the biometric authentication and does not include information that can identify the individual, is transmitted to the information server as the behavioral information.
Management server. An information server;
an authentication server that stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information; and a management server connected to the authentication server;
storing personal information for providing services to the person who has been successfully authenticated by the biometric authentication;
transmitting behavioral information including personal information of the successfully authenticated person to whom the service was provided that the successfully authenticated person has permitted to be provided to a third party to the information server;
When the provision of the personal information is refused, the personal information providing method transmits, to the information server, as the behavioral information, summary information which is information about the service provided through the biometric authentication and does not contain information that can identify the individual. An information server;
An authentication server stores biometric information of each of a plurality of users and performs biometric authentication using the stored biometric information. A computer is installed in a management server connected to the authentication server.
A process of storing personal information for providing services to a person who has been successfully authenticated by the biometric authentication;
a process of transmitting to the information server behavioral information including personal information of the successfully authenticated person to whom the service has been provided that the successfully authenticated person has permitted to be provided to a third party;
a process of transmitting, when the provision of the personal information is refused, summary information which is information on the service provided by the biometric authentication and does not include information which can identify the individual, as the behavioral information to the information server;
A program for executing.

Images